Merge tag 'v3.15-rc6' into sched/core, to pick up the latest fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>
author: Ingo Molnar <mingo@kernel.org> 2014-05-22 04:28:56 -0400
committer: Ingo Molnar <mingo@kernel.org> 2014-05-22 04:28:56 -0400
commit: 65c2ce70046c779974af8b5dfc25a0df489089b5 (patch)
tree: b16f152eb62b71cf5a1edc51da865b357c989922
parent: 842514849a616e9b61acad65771c7afe01e651f9 (diff)
parent: 4b660a7f5c8099d88d1a43d8ae138965112592c7 (diff)
918 files changed, 10052 insertions, 5767 deletions
diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci
index a3c5a6685036..ab8d76dfaa80 100644
--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@@ -117,7 +117,7 @@ Description:
 What:           /sys/bus/pci/devices/.../vpd
 Date:           February 2008
-Contact:        Ben Hutchings <bhutchings@solarflare.com>
+Contact:        Ben Hutchings <bwh@kernel.org>
 Description:
                A file named vpd in a device directory will be a
                binary file containing the Vital Product Data for the
diff --git a/Documentation/devicetree/bindings/arm/arch_timer.txt b/Documentation/devicetree/bindings/arm/arch_timer.txt
index 06fc7602593a..37b2cafa4e52 100644
--- a/Documentation/devicetree/bindings/arm/arch_timer.txt
+++ b/Documentation/devicetree/bindings/arm/arch_timer.txt
@@ -19,6 +19,9 @@ to deliver its interrupts via SPIs.
 - clock-frequency : The frequency of the main counter, in Hz. Optional.
+- always-on : a boolean property. If present, the timer is powered through an
+  always-on power domain, therefore it never loses context.
 Example:
        timer {
diff --git a/Documentation/devicetree/bindings/ata/apm-xgene.txt b/Documentation/devicetree/bindings/ata/apm-xgene.txt
index 7bcfbf59810e..a668f0e7d001 100644
--- a/Documentation/devicetree/bindings/ata/apm-xgene.txt
+++ b/Documentation/devicetree/bindings/ata/apm-xgene.txt
@@ -24,6 +24,7 @@ Required properties:
  * "sata-phy" for the SATA 6.0Gbps PHY
 Optional properties:
+- dma-coherent          : Present if dma operations are coherent
 - status                : Shall be "ok" if enabled or "disabled" if disabled.
                          Default is "ok".
@@ -55,6 +56,7 @@ Example:
                              <0x0 0x1f22e000 0x0 0x1000>,
                              <0x0 0x1f227000 0x0 0x1000>;
                        interrupts = <0x0 0x87 0x4>;
+                        dma-coherent;
                        status = "ok";
                        clocks = <&sataclk 0>;
                        phys = <&phy2 0>;
@@ -69,6 +71,7 @@ Example:
                              <0x0 0x1f23e000 0x0 0x1000>,
                              <0x0 0x1f237000 0x0 0x1000>;
                        interrupts = <0x0 0x88 0x4>;
+                        dma-coherent;
                        status = "ok";
                        clocks = <&sataclk 0>;
                        phys = <&phy3 0>;
diff --git a/Documentation/devicetree/bindings/clock/at91-clock.txt b/Documentation/devicetree/bindings/clock/at91-clock.txt
index cd5e23912888..6794cdc96d8f 100644
--- a/Documentation/devicetree/bindings/clock/at91-clock.txt
+++ b/Documentation/devicetree/bindings/clock/at91-clock.txt
@@ -62,7 +62,7 @@ Required properties for PMC node:
 - interrupt-controller : tell that the PMC is an interrupt controller.
 - #interrupt-cells : must be set to 1. The first cell encodes the interrupt id,
        and reflect the bit position in the PMC_ER/DR/SR registers.
-        You can use the dt macros defined in dt-bindings/clk/at91.h.
+        You can use the dt macros defined in dt-bindings/clock/at91.h.
        0 (AT91_PMC_MOSCS) -> main oscillator ready
        1 (AT91_PMC_LOCKA) -> PLL A ready
        2 (AT91_PMC_LOCKB) -> PLL B ready
diff --git a/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt b/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
index 5992dceec7af..02a25d99ca61 100644
--- a/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
+++ b/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
@@ -43,7 +43,7 @@ Example
                clock-output-names =
                        "tpu0", "mmcif1", "sdhi3", "sdhi2",
                         "sdhi1", "sdhi0", "mmcif0";
-                renesas,clock-indices = <
+                clock-indices = <
                        R8A7790_CLK_TPU0 R8A7790_CLK_MMCIF1 R8A7790_CLK_SDHI3
                        R8A7790_CLK_SDHI2 R8A7790_CLK_SDHI1 R8A7790_CLK_SDHI0
                        R8A7790_CLK_MMCIF0
diff --git a/Documentation/devicetree/bindings/dma/ti-edma.txt b/Documentation/devicetree/bindings/dma/ti-edma.txt
index 9fbbdb783a72..68ff2137bae7 100644
--- a/Documentation/devicetree/bindings/dma/ti-edma.txt
+++ b/Documentation/devicetree/bindings/dma/ti-edma.txt
@@ -29,6 +29,6 @@ edma: edma@49000000 {
        dma-channels = <64>;
        ti,edma-regions = <4>;
        ti,edma-slots = <256>;
-        ti,edma-xbar-event-map = <1 12
+        ti,edma-xbar-event-map = /bits/ 16 <1 12
-                                  2 13>;
+                                            2 13>;
 };
diff --git a/Documentation/devicetree/bindings/net/arc_emac.txt b/Documentation/devicetree/bindings/net/arc_emac.txt
index 7fbb027218a1..a1d71eb43b20 100644
--- a/Documentation/devicetree/bindings/net/arc_emac.txt
+++ b/Documentation/devicetree/bindings/net/arc_emac.txt
@@ -4,11 +4,15 @@ Required properties:
 - compatible: Should be "snps,arc-emac"
 - reg: Address and length of the register set for the device
 - interrupts: Should contain the EMAC interrupts
- clock-frequency: CPU frequency. It is needed to calculate and set polling
-period of EMAC.
 - max-speed: see ethernet.txt file in the same directory.
 - phy: see ethernet.txt file in the same directory.
+Clock handling:
+The clock frequency is needed to calculate and set polling period of EMAC.
+It must be provided by one of:
+- clock-frequency: CPU frequency.
+- clocks: reference to the clock supplying the EMAC.
 Child nodes of the driver are the individual PHY devices connected to the
 MDIO bus. They must have a "reg" property given the PHY address on the MDIO bus.
@@ -19,7 +23,11 @@ Examples:
                reg = <0xc0fc2000 0x3c>;
                interrupts = <6>;
                mac-address = [ 00 11 22 33 44 55 ];
                clock-frequency = <80000000>;
+                /* or */
+                clocks = <&emac_clock>;
                max-speed = <100>;
                phy = <&phy0>;
diff --git a/Documentation/devicetree/bindings/net/socfpga-dwmac.txt b/Documentation/devicetree/bindings/net/socfpga-dwmac.txt
index 636f0ac4e223..2a60cd3e8d5d 100644
--- a/Documentation/devicetree/bindings/net/socfpga-dwmac.txt
+++ b/Documentation/devicetree/bindings/net/socfpga-dwmac.txt
@@ -23,5 +23,5 @@ gmac0: ethernet@ff700000 {
        interrupt-names = "macirq";
        mac-address = [00 00 00 00 00 00];/* Filled in by U-Boot */
        clocks = <&emac_0_clk>;
-        clocks-names = "stmmaceth";
+        clock-names = "stmmaceth";
 };
diff --git a/Documentation/devicetree/bindings/net/stmmac.txt b/Documentation/devicetree/bindings/net/stmmac.txt
index 80c1fb8bfbb8..a2acd2b26baf 100644
--- a/Documentation/devicetree/bindings/net/stmmac.txt
+++ b/Documentation/devicetree/bindings/net/stmmac.txt
@@ -33,7 +33,7 @@ Optional properties:
 - max-frame-size: See ethernet.txt file in the same directory
 - clocks: If present, the first clock should be the GMAC main clock,
  further clocks may be specified in derived bindings.
- clocks-names: One name for each entry in the clocks property, the
+- clock-names: One name for each entry in the clocks property, the
  first one should be "stmmaceth".
 Examples:
diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl-st.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl-st.txt
index 4bd5be0e5e7d..26bcb18f4e60 100644
--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-st.txt
+++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-st.txt
@@ -83,7 +83,7 @@ Example:
                reg             = <0xfe61f080 0x4>;
                reg-names       = "irqmux";
                interrupts      = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>;
-                interrupts-names = "irqmux";
+                interrupt-names = "irqmux";
                ranges          = <0 0xfe610000 0x5000>;
                PIO0: gpio@fe610000 {
@@ -165,7 +165,7 @@ sdhci0:sdhci@fe810000{
        interrupt-parent = <&PIO3>;
        #interrupt-cells = <2>;
        interrupts = <3 IRQ_TYPE_LEVEL_HIGH>; /* Interrupt line via PIO3-3 */
-        interrupts-names = "card-detect";
+        interrupt-names = "card-detect";
        pinctrl-names = "default";
        pinctrl-0       = <&pinctrl_mmc>;
 };
diff --git a/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.txt b/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.txt
index 569b26c4a81e..60ca07996458 100644
--- a/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.txt
+++ b/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.txt
@@ -47,7 +47,7 @@ mcasp0: mcasp0@1d00000 {
        reg = <0x100000 0x3000>;
        reg-names "mpu";
        interrupts = <82>, <83>;
-        interrupts-names = "tx", "rx";
+        interrupt-names = "tx", "rx";
        op-mode = <0>;          /* MCASP_IIS_MODE */
        tdm-slots = <2>;
        serial-dir = <
diff --git a/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt b/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt
index 74c66dee3e14..eff12be5e789 100644
--- a/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt
+++ b/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt
@@ -13,6 +13,9 @@ Required properties:
    "ti,tlv320aic3111" - TLV320AIC3111 (stereo speaker amp, MiniDSP)
 - reg - <int> -  I2C slave address
+- HPVDD-supply, SPRVDD-supply, SPLVDD-supply, AVDD-supply, IOVDD-supply,
+  DVDD-supply : power supplies for the device as covered in
+  Documentation/devicetree/bindings/regulator/regulator.txt
 Optional properties:
@@ -24,9 +27,6 @@ Optional properties:
        3 or MICBIAS_AVDD - MICBIAS output is connected to AVDD
        If this node is not mentioned or if the value is unknown, then
        micbias is set to 2.0V.
- HPVDD-supply, SPRVDD-supply, SPLVDD-supply, AVDD-supply, IOVDD-supply,
-  DVDD-supply : power supplies for the device as covered in
-  Documentation/devicetree/bindings/regulator/regulator.txt
 CODEC output pins:
  * HPL
diff --git a/Documentation/input/elantech.txt b/Documentation/input/elantech.txt
index 5602eb71ad5d..e1ae127ed099 100644
--- a/Documentation/input/elantech.txt
+++ b/Documentation/input/elantech.txt
@@ -504,9 +504,12 @@ byte 5:
 * reg_10
   bit   7   6   5   4   3   2   1   0
-         0   0   0   0   0   0   0   A
+         0   0   0   0   R   F   T   A
         A: 1 = enable absolute tracking
+         T: 1 = enable two finger mode auto correct
+         F: 1 = disable ABS Position Filter
+         R: 1 = enable real hardware resolution
 6.2 Native absolute mode 6 byte packet format
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 43842177b771..30a8ad0dae53 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2218,10 +2218,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        noreplace-smp   [X86-32,SMP] Don't replace SMP instructions
                        with UP alternatives
-        nordrand        [X86] Disable the direct use of the RDRAND
+        nordrand        [X86] Disable kernel use of the RDRAND and
-                        instruction even if it is supported by the
+                        RDSEED instructions even if they are supported
-                        processor.  RDRAND is still available to user
+                        by the processor.  RDRAND and RDSEED are still
-                        space applications.
+                        available to user space applications.
        noresume        [SWSUSP] Disables resume and restores original swap
                        space.
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
index ca6977f5b2ed..99ca40e8e810 100644
--- a/Documentation/networking/scaling.txt
+++ b/Documentation/networking/scaling.txt
@@ -429,7 +429,7 @@ RPS and RFS were introduced in kernel 2.6.35. XPS was incorporated into
 (therbert@google.com)
 Accelerated RFS was introduced in 2.6.35. Original patches were
-submitted by Ben Hutchings (bhutchings@solarflare.com)
+submitted by Ben Hutchings (bwh@kernel.org)
 Authors:
 Tom Herbert (therbert@google.com)
diff --git a/MAINTAINERS b/MAINTAINERS
index e67ea2442041..6846c7c622e3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1893,14 +1893,15 @@ L:	netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bnx2x/
-BROADCOM BCM281XX/BCM11XXX ARM ARCHITECTURE
+BROADCOM BCM281XX/BCM11XXX/BCM216XX ARM ARCHITECTURE
 M:      Christian Daudt <bcm@fixthebug.org>
 M:      Matt Porter <mporter@linaro.org>
 L:      bcm-kernel-feedback-list@broadcom.com
-T:      git git://git.github.com/broadcom/bcm11351
+T:      git git://github.com/broadcom/mach-bcm
 S:      Maintained
 F:      arch/arm/mach-bcm/
 F:      arch/arm/boot/dts/bcm113*
+F:      arch/arm/boot/dts/bcm216*
 F:      arch/arm/boot/dts/bcm281*
 F:      arch/arm/configs/bcm_defconfig
 F:      drivers/mmc/host/sdhci_bcm_kona.c
@@ -2245,12 +2246,6 @@ L:	linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/host/ohci-ep93xx.c
-CIRRUS LOGIC CS4270 SOUND DRIVER
-M:      Timur Tabi <timur@tabi.org>
-L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
-S:      Odd Fixes
-F:      sound/soc/codecs/cs4270*
 CIRRUS LOGIC AUDIO CODEC DRIVERS
 M:      Brian Austin <brian.austin@cirrus.com>
 M:      Paul Handrigan <Paul.Handrigan@cirrus.com>
@@ -3485,6 +3480,12 @@ S:	Maintained
 F:      drivers/extcon/
 F:      Documentation/extcon/
+EXYNOS DP DRIVER
+M:      Jingoo Han <jg1.han@samsung.com>
+L:      dri-devel@lists.freedesktop.org
+S:      Maintained
+F:      drivers/gpu/drm/exynos/exynos_dp*
 EXYNOS MIPI DISPLAY DRIVERS
 M:      Inki Dae <inki.dae@samsung.com>
 M:      Donghwa Lee <dh09.lee@samsung.com>
@@ -3550,7 +3551,7 @@ F:	include/scsi/libfcoe.h
 F:      include/uapi/scsi/fc/
 FILE LOCKING (flock() and fcntl()/lockf())
-M:      Jeff Layton <jlayton@redhat.com>
+M:      Jeff Layton <jlayton@poochiereds.net>
 M:      J. Bruce Fields <bfields@fieldses.org>
 L:      linux-fsdevel@vger.kernel.org
 S:      Maintained
@@ -4812,6 +4813,14 @@ L:	linux-kernel@vger.kernel.org
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
 F:      kernel/irq/
+IRQCHIP DRIVERS
+M:      Thomas Gleixner <tglx@linutronix.de>
+M:      Jason Cooper <jason@lakedaemon.net>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
+T:      git git://git.infradead.org/users/jcooper/linux.git irqchip/core
 F:      drivers/irqchip/
 IRQ DOMAINS (IRQ NUMBER MAPPING LIBRARY)
@@ -5108,14 +5117,19 @@ F:	drivers/s390/kvm/
 KERNEL VIRTUAL MACHINE (KVM) FOR ARM
 M:      Christoffer Dall <christoffer.dall@linaro.org>
+M:      Marc Zyngier <marc.zyngier@arm.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kvmarm@lists.cs.columbia.edu
 W:      http://systems.cs.columbia.edu/projects/kvm-arm
 S:      Supported
 F:      arch/arm/include/uapi/asm/kvm*
 F:      arch/arm/include/asm/kvm*
 F:      arch/arm/kvm/
+F:      virt/kvm/arm/
+F:      include/kvm/arm_*
 KERNEL VIRTUAL MACHINE FOR ARM64 (KVM/arm64)
+M:      Christoffer Dall <christoffer.dall@linaro.org>
 M:      Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kvmarm@lists.cs.columbia.edu
@@ -5479,15 +5493,15 @@ F:	Documentation/hwmon/ltc4261
 F:      drivers/hwmon/ltc4261.c
 LTP (Linux Test Project)
-M:      Shubham Goyal <shubham@linux.vnet.ibm.com>
 M:      Mike Frysinger <vapier@gentoo.org>
 M:      Cyril Hrubis <chrubis@suse.cz>
-M:      Caspar Zhang <caspar@casparzhang.com>
 M:      Wanlong Gao <gaowanlong@cn.fujitsu.com>
+M:      Jan Stancek <jstancek@redhat.com>
+M:      Stanislav Kholmanskikh <stanislav.kholmanskikh@oracle.com>
+M:      Alexey Kodanev <alexey.kodanev@oracle.com>
 L:      ltp-list@lists.sourceforge.net (subscribers-only)
-W:      http://ltp.sourceforge.net/
+W:      http://linux-test-project.github.io/
 T:      git git://github.com/linux-test-project/ltp.git
-T:      git git://ltp.git.sourceforge.net/gitroot/ltp/ltp-dev
 S:      Maintained
 M32R ARCHITECTURE
@@ -7277,7 +7291,6 @@ F:	drivers/video/aty/aty128fb.c
 RALINK RT2X00 WIRELESS LAN DRIVER
 P:      rt2x00 project
 M:      Ivo van Doorn <IvDoorn@gmail.com>
-M:      Gertjan van Wingerde <gwingerde@gmail.com>
 M:      Helmut Schaa <helmut.schaa@googlemail.com>
 L:      linux-wireless@vger.kernel.org
 L:      users@rt2x00.serialmonkey.com (moderated for non-subscribers)
@@ -7293,7 +7306,7 @@ F:	Documentation/blockdev/ramdisk.txt
 F:      drivers/block/brd.c
 RANDOM NUMBER DRIVER
-M:      Theodore Ts'o" <tytso@mit.edu>
+M:      "Theodore Ts'o" <tytso@mit.edu>
 S:      Maintained
 F:      drivers/char/random.c
@@ -7674,7 +7687,6 @@ F:	drivers/clk/samsung/
 SAMSUNG SXGBE DRIVERS
 M:      Byungho An <bh74.an@samsung.com>
 M:      Girish K S <ks.giri@samsung.com>
-M:      Siva Reddy Kallam <siva.kallam@samsung.com>
 M:      Vipul Pandya <vipul.pandya@samsung.com>
 S:      Supported
 L:      netdev@vger.kernel.org
@@ -9098,6 +9110,9 @@ F:	arch/um/os-Linux/drivers/
 TURBOCHANNEL SUBSYSTEM
 M:      "Maciej W. Rozycki" <macro@linux-mips.org>
+M:      Ralf Baechle <ralf@linux-mips.org>
+L:      linux-mips@linux-mips.org
+Q:      http://patchwork.linux-mips.org/project/linux-mips/list/
 S:      Maintained
 F:      drivers/tc/
 F:      include/linux/tc.h
@@ -9951,7 +9966,7 @@ F:	drivers/net/hamradio/*scc.c
 F:      drivers/net/hamradio/z8530.h
 ZBUD COMPRESSED PAGE ALLOCATOR
-M:      Seth Jennings <sjenning@linux.vnet.ibm.com>
+M:      Seth Jennings <sjennings@variantweb.net>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      mm/zbud.c
@@ -9996,7 +10011,7 @@ F:	mm/zsmalloc.c
 F:      include/linux/zsmalloc.h
 ZSWAP COMPRESSED SWAP CACHING
-M:      Seth Jennings <sjenning@linux.vnet.ibm.com>
+M:      Seth Jennings <sjennings@variantweb.net>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      mm/zswap.c
diff --git a/Makefile b/Makefile
index 80a2d2448531..9d993787afe0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 15
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc6
 NAME = Shuffling Zombie Juror
 # *DOCUMENTATION*
diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index 819dd5f7eb05..29b82adbf0b4 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -614,11 +614,13 @@ resume_user_mode_begin:
 resume_kernel_mode:
-#ifdef CONFIG_PREEMPT
+        ; Disable Interrupts from this point on
+        ; CONFIG_PREEMPT: This is a must for preempt_schedule_irq()
-        ; This is a must for preempt_schedule_irq()
+        ; !CONFIG_PREEMPT: To ensure restore_regs is intr safe
        IRQ_DISABLE     r9
+#ifdef CONFIG_PREEMPT
        ; Can't preempt if preemption disabled
        GET_CURR_THR_INFO_FROM_SP   r10
        ld  r8, [r10, THREAD_INFO_PREEMPT_COUNT]
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index ab438cb5af55..db3c5414223e 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -30,9 +30,9 @@ config ARM
        select HAVE_ARCH_SECCOMP_FILTER if (AEABI && !OABI_COMPAT)
        select HAVE_ARCH_TRACEHOOK
        select HAVE_BPF_JIT
+        select HAVE_CC_STACKPROTECTOR
        select HAVE_CONTEXT_TRACKING
        select HAVE_C_RECORDMCOUNT
-        select HAVE_CC_STACKPROTECTOR
        select HAVE_DEBUG_KMEMLEAK
        select HAVE_DMA_API_DEBUG
        select HAVE_DMA_ATTRS
@@ -311,6 +311,7 @@ config ARCH_MULTIPLATFORM
        select ARM_HAS_SG_CHAIN
        select ARM_PATCH_PHYS_VIRT
        select AUTO_ZRELADDR
+        select CLKSRC_OF
        select COMMON_CLK
        select GENERIC_CLOCKEVENTS
        select MULTI_IRQ_HANDLER
@@ -422,8 +423,8 @@ config ARCH_EFM32
        bool "Energy Micro efm32"
        depends on !MMU
        select ARCH_REQUIRE_GPIOLIB
-        select AUTO_ZRELADDR
        select ARM_NVIC
+        select AUTO_ZRELADDR
        select CLKSRC_OF
        select COMMON_CLK
        select CPU_V7M
@@ -511,8 +512,8 @@ config ARCH_IXP4XX
        bool "IXP4xx-based"
        depends on MMU
        select ARCH_HAS_DMA_SET_COHERENT_MASK
-        select ARCH_SUPPORTS_BIG_ENDIAN
        select ARCH_REQUIRE_GPIOLIB
+        select ARCH_SUPPORTS_BIG_ENDIAN
        select CLKSRC_MMIO
        select CPU_XSCALE
        select DMABOUNCE if PCI
@@ -1110,9 +1111,9 @@ config ARM_NR_BANKS
        default 8
 config IWMMXT
-        bool "Enable iWMMXt support" if !CPU_PJ4
+        bool "Enable iWMMXt support"
-        depends on CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK || CPU_PJ4
+        depends on CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK || CPU_PJ4 || CPU_PJ4B
-        default y if PXA27x || PXA3xx || ARCH_MMP || CPU_PJ4
+        default y if PXA27x || PXA3xx || ARCH_MMP || CPU_PJ4 || CPU_PJ4B
        help
          Enable support for iWMMXt context switching at run time if
          running on a CPU that supports it.
@@ -1575,8 +1576,8 @@ config BIG_LITTLE
 config BL_SWITCHER
        bool "big.LITTLE switcher support"
        depends on BIG_LITTLE && MCPM && HOTPLUG_CPU
-        select CPU_PM
        select ARM_CPU_SUSPEND
+        select CPU_PM
        help
          The big.LITTLE "switcher" provides the core functionality to
          transparently handle transition between a cluster of A15's
@@ -1920,9 +1921,9 @@ config XEN
        depends on CPU_V7 && !CPU_V6
        depends on !GENERIC_ATOMIC64
        depends on MMU
+        select ARCH_DMA_ADDR_T_64BIT
        select ARM_PSCI
        select SWIOTLB_XEN
-        select ARCH_DMA_ADDR_T_64BIT
        help
          Say Y if you want to run Linux in a Virtual Machine on Xen on ARM.
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 4a2fc0bf6fc9..eab8ecbe69c1 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -1030,9 +1030,9 @@ config DEBUG_UART_PHYS
        default 0x40100000 if DEBUG_PXA_UART1
        default 0x42000000 if ARCH_GEMINI
        default 0x7c0003f8 if FOOTBRIDGE
-        default 0x80230000 if DEBUG_PICOXCELL_UART
        default 0x80070000 if DEBUG_IMX23_UART
        default 0x80074000 if DEBUG_IMX28_UART
+        default 0x80230000 if DEBUG_PICOXCELL_UART
        default 0x808c0000 if ARCH_EP93XX
        default 0x90020000 if DEBUG_NSPIRE_CLASSIC_UART || DEBUG_NSPIRE_CX_UART
        default 0xb0090000 if DEBUG_VEXPRESS_UART0_CRX
@@ -1096,22 +1096,22 @@ config DEBUG_UART_VIRT
        default 0xfeb26000 if DEBUG_RK3X_UART1
        default 0xfeb30c00 if DEBUG_KEYSTONE_UART0
        default 0xfeb31000 if DEBUG_KEYSTONE_UART1
-        default 0xfec12000 if DEBUG_MVEBU_UART || DEBUG_MVEBU_UART_ALTERNATE
-        default 0xfed60000 if DEBUG_RK29_UART0
-        default 0xfed64000 if DEBUG_RK29_UART1 || DEBUG_RK3X_UART2
-        default 0xfed68000 if DEBUG_RK29_UART2 || DEBUG_RK3X_UART3
        default 0xfec02000 if DEBUG_SOCFPGA_UART
+        default 0xfec12000 if DEBUG_MVEBU_UART || DEBUG_MVEBU_UART_ALTERNATE
        default 0xfec20000 if DEBUG_DAVINCI_DMx_UART0
        default 0xfed0c000 if DEBUG_DAVINCI_DA8XX_UART1
        default 0xfed0d000 if DEBUG_DAVINCI_DA8XX_UART2
        default 0xfed12000 if ARCH_KIRKWOOD
+        default 0xfed60000 if DEBUG_RK29_UART0
+        default 0xfed64000 if DEBUG_RK29_UART1 || DEBUG_RK3X_UART2
+        default 0xfed68000 if DEBUG_RK29_UART2 || DEBUG_RK3X_UART3
        default 0xfedc0000 if ARCH_EP93XX
        default 0xfee003f8 if FOOTBRIDGE
        default 0xfee20000 if DEBUG_NSPIRE_CLASSIC_UART || DEBUG_NSPIRE_CX_UART
-        default 0xfef36000 if DEBUG_HIGHBANK_UART
        default 0xfee82340 if ARCH_IOP13XX
        default 0xfef00000 if ARCH_IXP4XX && !CPU_BIG_ENDIAN
        default 0xfef00003 if ARCH_IXP4XX && CPU_BIG_ENDIAN
+        default 0xfef36000 if DEBUG_HIGHBANK_UART
        default 0xfefff700 if ARCH_IOP33X
        default 0xff003000 if DEBUG_U300_UART
        default DEBUG_UART_PHYS if !MMU
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 35c146f31e46..377b7c364033 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -51,10 +51,9 @@ dtb-$(CONFIG_ARCH_AT91)	+= sama5d36ek.dtb
 dtb-$(CONFIG_ARCH_ATLAS6) += atlas6-evb.dtb
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2835-rpi-b.dtb
+dtb-$(CONFIG_ARCH_BCM_5301X) += bcm4708-netgear-r6250.dtb
 dtb-$(CONFIG_ARCH_BCM_MOBILE) += bcm28155-ap.dtb \
        bcm21664-garnet.dtb
-dtb-$(CONFIG_ARCH_BCM2835) += bcm2835-rpi-b.dtb
-dtb-$(CONFIG_ARCH_BCM_5301X) += bcm4708-netgear-r6250.dtb
 dtb-$(CONFIG_ARCH_BERLIN) += \
        berlin2-sony-nsz-gs7.dtb        \
        berlin2cd-google-chromecast.dtb
@@ -246,6 +245,7 @@ dtb-$(CONFIG_ARCH_OMAP2PLUS) += omap2420-h4.dtb \
        omap3-sbc-t3730.dtb \
        omap3-devkit8000.dtb \
        omap3-beagle-xm.dtb \
+        omap3-beagle-xm-ab.dtb \
        omap3-evm.dtb \
        omap3-evm-37xx.dtb \
        omap3-ldp.dtb \
@@ -294,13 +294,6 @@ dtb-$(CONFIG_ARCH_PRIMA2) += prima2-evb.dtb
 dtb-$(CONFIG_ARCH_QCOM) += qcom-msm8660-surf.dtb \
        qcom-msm8960-cdp.dtb \
        qcom-apq8074-dragonboard.dtb
-dtb-$(CONFIG_ARCH_U8500) += ste-snowball.dtb \
-        ste-hrefprev60-stuib.dtb \
-        ste-hrefprev60-tvk.dtb \
-        ste-hrefv60plus-stuib.dtb \
-        ste-hrefv60plus-tvk.dtb \
-        ste-ccu8540.dtb \
-        ste-ccu9540.dtb
 dtb-$(CONFIG_ARCH_S3C24XX) += s3c2416-smdk2416.dtb
 dtb-$(CONFIG_ARCH_S3C64XX) += s3c6410-mini6410.dtb \
        s3c6410-smdk6410.dtb
@@ -369,9 +362,16 @@ dtb-$(CONFIG_ARCH_TEGRA) += tegra20-harmony.dtb \
        tegra30-cardhu-a04.dtb \
        tegra114-dalmore.dtb \
        tegra124-venice2.dtb
+dtb-$(CONFIG_ARCH_U300) += ste-u300.dtb
+dtb-$(CONFIG_ARCH_U8500) += ste-snowball.dtb \
+        ste-hrefprev60-stuib.dtb \
+        ste-hrefprev60-tvk.dtb \
+        ste-hrefv60plus-stuib.dtb \
+        ste-hrefv60plus-tvk.dtb \
+        ste-ccu8540.dtb \
+        ste-ccu9540.dtb
 dtb-$(CONFIG_ARCH_VERSATILE) += versatile-ab.dtb \
        versatile-pb.dtb
-dtb-$(CONFIG_ARCH_U300) += ste-u300.dtb
 dtb-$(CONFIG_ARCH_VEXPRESS) += vexpress-v2p-ca5s.dtb \
        vexpress-v2p-ca9.dtb \
        vexpress-v2p-ca15-tc1.dtb \
diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
index e3f27ec31718..2e7d932887b5 100644
--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
@@ -183,7 +183,7 @@
 &usb {
        status = "okay";
-        control@44e10000 {
+        control@44e10620 {
                status = "okay";
        };
@@ -204,7 +204,7 @@
                dr_mode = "host";
        };
-        dma-controller@07402000  {
+        dma-controller@47402000  {
                status = "okay";
        };
 };
diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
index 28ae040e7c3d..6028217ace0f 100644
--- a/arch/arm/boot/dts/am335x-evm.dts
+++ b/arch/arm/boot/dts/am335x-evm.dts
@@ -301,8 +301,8 @@
        am335x_evm_audio_pins: am335x_evm_audio_pins {
                pinctrl-single,pins = <
-                        0x10c (PIN_INPUT_PULLDOWN | MUX_MODE4) /* mii1_rx_dv.mcasp1_aclkx */
+                        0x10c (PIN_INPUT_PULLDOWN | MUX_MODE4) /* mii1_crs.mcasp1_aclkx */
-                        0x110 (PIN_INPUT_PULLDOWN | MUX_MODE4) /* mii1_txd3.mcasp1_fsx */
+                        0x110 (PIN_INPUT_PULLDOWN | MUX_MODE4) /* mii1_rxerr.mcasp1_fsx */
                        0x108 (PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* mii1_col.mcasp1_axr2 */
                        0x144 (PIN_INPUT_PULLDOWN | MUX_MODE4) /* rmii1_ref_clk.mcasp1_axr3 */
                >;
@@ -331,7 +331,7 @@
 &usb {
        status = "okay";
-        control@44e10000 {
+        control@44e10620 {
                status = "okay";
        };
@@ -352,7 +352,7 @@
                dr_mode = "host";
        };
-        dma-controller@07402000  {
+        dma-controller@47402000  {
                status = "okay";
        };
 };
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index ec08f6f677c3..ab238850a7b2 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -364,7 +364,7 @@
 &usb {
        status = "okay";
-        control@44e10000 {
+        control@44e10620 {
                status = "okay";
        };
@@ -385,7 +385,7 @@
                dr_mode = "host";
        };
-        dma-controller@07402000  {
+        dma-controller@47402000  {
                status = "okay";
        };
 };
diff --git a/arch/arm/boot/dts/am335x-igep0033.dtsi b/arch/arm/boot/dts/am335x-igep0033.dtsi
index 7063311a58d9..9f22c189f636 100644
--- a/arch/arm/boot/dts/am335x-igep0033.dtsi
+++ b/arch/arm/boot/dts/am335x-igep0033.dtsi
@@ -118,7 +118,6 @@
                reg = <0 0 0>; /* CS0, offset 0 */
                nand-bus-width = <8>;
                ti,nand-ecc-opt = "bch8";
-                gpmc,device-nand = "true";
                gpmc,device-width = <1>;
                gpmc,sync-clk-ps = <0>;
                gpmc,cs-on-ns = <0>;
@@ -202,7 +201,7 @@
 &usb {
        status = "okay";
-        control@44e10000 {
+        control@44e10620 {
                status = "okay";
        };
@@ -223,7 +222,7 @@
                dr_mode = "host";
        };
-        dma-controller@07402000  {
+        dma-controller@47402000  {
                status = "okay";
        };
 };
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index 9770e35f2536..7ad75b4e0663 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -72,7 +72,7 @@
        };
        /*
-         * The soc node represents the soc top level view. It is uses for IPs
+         * The soc node represents the soc top level view. It is used for IPs
         * that are not memory mapped in the MPU view or for the MPU itself.
         */
        soc {
@@ -94,8 +94,8 @@
        /*
         * XXX: Use a flat representation of the AM33XX interconnect.
-         * The real AM33XX interconnect network is quite complex.Since
+         * The real AM33XX interconnect network is quite complex. Since
-         * that will not bring real advantage to represent that in DT
+         * it will not bring real advantage to represent that in DT
         * for the moment, just use a fake OCP bus entry to represent
         * the whole bus hierarchy.
         */
@@ -144,7 +144,7 @@
                        compatible = "ti,edma3";
                        ti,hwmods = "tpcc", "tptc0", "tptc1", "tptc2";
                        reg =   <0x49000000 0x10000>,
-                                <0x44e10f90 0x10>;
+                                <0x44e10f90 0x40>;
                        interrupts = <12 13 14>;
                        #dma-cells = <1>;
                        dma-channels = <64>;
@@ -802,7 +802,7 @@
                              <0x46000000 0x400000>;
                        reg-names = "mpu", "dat";
                        interrupts = <80>, <81>;
-                        interrupts-names = "tx", "rx";
+                        interrupt-names = "tx", "rx";
                        status = "disabled";
                        dmas = <&edma 8>,
                                <&edma 9>;
@@ -816,7 +816,7 @@
                              <0x46400000 0x400000>;
                        reg-names = "mpu", "dat";
                        interrupts = <82>, <83>;
-                        interrupts-names = "tx", "rx";
+                        interrupt-names = "tx", "rx";
                        status = "disabled";
                        dmas = <&edma 10>,
                                <&edma 11>;
diff --git a/arch/arm/boot/dts/am3517.dtsi b/arch/arm/boot/dts/am3517.dtsi
index 788391f91684..5a452fdd7c5d 100644
--- a/arch/arm/boot/dts/am3517.dtsi
+++ b/arch/arm/boot/dts/am3517.dtsi
@@ -62,5 +62,21 @@
        };
 };
+&iva {
+        status = "disabled";
+};
+&mailbox {
+        status = "disabled";
+};
+&mmu_isp {
+        status = "disabled";
+};
+&smartreflex_mpu_iva {
+        status = "disabled";
+};
 /include/ "am35xx-clocks.dtsi"
 /include/ "omap36xx-am35xx-omap3430es2plus-clocks.dtsi"
diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
index 36d523a26831..d1f8707ff1df 100644
--- a/arch/arm/boot/dts/am4372.dtsi
+++ b/arch/arm/boot/dts/am4372.dtsi
@@ -691,7 +691,7 @@
                              <0x46000000 0x400000>;
                        reg-names = "mpu", "dat";
                        interrupts = <80>, <81>;
-                        interrupts-names = "tx", "rx";
+                        interrupt-names = "tx", "rx";
                        status = "disabled";
                        dmas = <&edma 8>,
                               <&edma 9>;
@@ -705,7 +705,7 @@
                              <0x46400000 0x400000>;
                        reg-names = "mpu", "dat";
                        interrupts = <82>, <83>;
-                        interrupts-names = "tx", "rx";
+                        interrupt-names = "tx", "rx";
                        status = "disabled";
                        dmas = <&edma 10>,
                               <&edma 11>;
diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts
index df8798e8bd25..a055f7f0f14a 100644
--- a/arch/arm/boot/dts/am437x-gp-evm.dts
+++ b/arch/arm/boot/dts/am437x-gp-evm.dts
@@ -117,6 +117,11 @@
        status = "okay";
 };
+&gpio5 {
+        status = "okay";
+        ti,no-reset-on-init;
+};
 &mmc1 {
        status = "okay";
        vmmc-supply = <&vmmcsd_fixed>;
diff --git a/arch/arm/boot/dts/armada-370-db.dts b/arch/arm/boot/dts/armada-370-db.dts
index 82f238a9063f..3383c4b66803 100644
--- a/arch/arm/boot/dts/armada-370-db.dts
+++ b/arch/arm/boot/dts/armada-370-db.dts
@@ -67,6 +67,7 @@
                        i2c@11000 {
                                pinctrl-0 = <&i2c0_pins>;
                                pinctrl-names = "default";
+                                clock-frequency = <100000>;
                                status = "okay";
                                audio_codec: audio-codec@4a {
                                        compatible = "cirrus,cs42l51";
diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
index bbb40f62037d..bb77970c0b12 100644
--- a/arch/arm/boot/dts/armada-370-xp.dtsi
+++ b/arch/arm/boot/dts/armada-370-xp.dtsi
@@ -230,6 +230,7 @@
                                #size-cells = <0>;
                                compatible = "marvell,orion-mdio";
                                reg = <0x72004 0x4>;
+                                clocks = <&gateclk 4>;
                        };
                        eth1: ethernet@74000 {
diff --git a/arch/arm/boot/dts/armada-375-db.dts b/arch/arm/boot/dts/armada-375-db.dts
index 9378d3136b41..0451124e8ebf 100644
--- a/arch/arm/boot/dts/armada-375-db.dts
+++ b/arch/arm/boot/dts/armada-375-db.dts
@@ -79,6 +79,11 @@
                                };
                        };
+                        sata@a0000 {
+                                status = "okay";
+                                nr-ports = <2>;
+                        };
                        nand: nand@d0000 {
                                pinctrl-0 = <&nand_pins>;
                                pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index a064f59da02d..ca8813bb99ba 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -336,6 +336,7 @@
                                #size-cells = <0>;
                                compatible = "marvell,orion-mdio";
                                reg = <0x72004 0x4>;
+                                clocks = <&gateclk 4>;
                        };
                        coredivclk: clock@e4250 {
diff --git a/arch/arm/boot/dts/armada-xp-db.dts b/arch/arm/boot/dts/armada-xp-db.dts
index 448373c4b0e5..90f0bf6f9271 100644
--- a/arch/arm/boot/dts/armada-xp-db.dts
+++ b/arch/arm/boot/dts/armada-xp-db.dts
@@ -49,7 +49,7 @@
                        /* Device Bus parameters are required */
                        /* Read parameters */
-                        devbus,bus-width    = <8>;
+                        devbus,bus-width    = <16>;
                        devbus,turn-off-ps  = <60000>;
                        devbus,badr-skew-ps = <0>;
                        devbus,acc-first-ps = <124000>;
diff --git a/arch/arm/boot/dts/armada-xp-gp.dts b/arch/arm/boot/dts/armada-xp-gp.dts
index 61bda687f782..0c756421ae6a 100644
--- a/arch/arm/boot/dts/armada-xp-gp.dts
+++ b/arch/arm/boot/dts/armada-xp-gp.dts
@@ -59,7 +59,7 @@
                        /* Device Bus parameters are required */
                        /* Read parameters */
-                        devbus,bus-width    = <8>;
+                        devbus,bus-width    = <16>;
                        devbus,turn-off-ps  = <60000>;
                        devbus,badr-skew-ps = <0>;
                        devbus,acc-first-ps = <124000>;
@@ -146,22 +146,22 @@
                        ethernet@70000 {
                                status = "okay";
                                phy = <&phy0>;
-                                phy-mode = "rgmii-id";
+                                phy-mode = "qsgmii";
                        };
                        ethernet@74000 {
                                status = "okay";
                                phy = <&phy1>;
-                                phy-mode = "rgmii-id";
+                                phy-mode = "qsgmii";
                        };
                        ethernet@30000 {
                                status = "okay";
                                phy = <&phy2>;
-                                phy-mode = "rgmii-id";
+                                phy-mode = "qsgmii";
                        };
                        ethernet@34000 {
                                status = "okay";
                                phy = <&phy3>;
-                                phy-mode = "rgmii-id";
+                                phy-mode = "qsgmii";
                        };
                        /* Front-side USB slot */
diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
index 985948ce67b3..5d42feb31049 100644
--- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
+++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
@@ -39,7 +39,7 @@
                        /* Device Bus parameters are required */
                        /* Read parameters */
-                        devbus,bus-width    = <8>;
+                        devbus,bus-width    = <16>;
                        devbus,turn-off-ps  = <60000>;
                        devbus,badr-skew-ps = <0>;
                        devbus,acc-first-ps = <124000>;
diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index ce1375595e5f..4537259ce529 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -34,7 +34,7 @@
                        };
                        spi0: spi@f0004000 {
-                                cs-gpios = <&pioD 13 0>;
+                                cs-gpios = <&pioD 13 0>, <0>, <0>, <&pioD 16 0>;
                                status = "okay";
                        };
@@ -79,7 +79,7 @@
                        };
                        spi1: spi@f8008000 {
-                                cs-gpios = <&pioC 25 0>, <0>, <0>, <&pioD 16 0>;
+                                cs-gpios = <&pioC 25 0>;
                                status = "okay";
                        };
diff --git a/arch/arm/boot/dts/at91sam9261.dtsi b/arch/arm/boot/dts/at91sam9261.dtsi
index e21dda0e8986..3be973e9889a 100644
--- a/arch/arm/boot/dts/at91sam9261.dtsi
+++ b/arch/arm/boot/dts/at91sam9261.dtsi
@@ -10,7 +10,7 @@
 #include <dt-bindings/pinctrl/at91.h>
 #include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/clk/at91.h>
+#include <dt-bindings/clock/at91.h>
 / {
        model = "Atmel AT91SAM9261 family SoC";
diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
index 63e1784d272c..92a52faebef7 100644
--- a/arch/arm/boot/dts/at91sam9rl.dtsi
+++ b/arch/arm/boot/dts/at91sam9rl.dtsi
@@ -8,7 +8,7 @@
 #include "skeleton.dtsi"
 #include <dt-bindings/pinctrl/at91.h>
-#include <dt-bindings/clk/at91.h>
+#include <dt-bindings/clock/at91.h>
 #include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/gpio/gpio.h>
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 1c0f8e1893ae..149b55099935 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -80,7 +80,7 @@
        };
        /*
-         * The soc node represents the soc top level view. It is uses for IPs
+         * The soc node represents the soc top level view. It is used for IPs
         * that are not memory mapped in the MPU view or for the MPU itself.
         */
        soc {
@@ -94,7 +94,7 @@
        /*
         * XXX: Use a flat representation of the SOC interconnect.
         * The real OMAP interconnect network is quite complex.
-         * Since that will not bring real advantage to represent that in DT for
+         * Since it will not bring real advantage to represent that in DT for
         * the moment, just use a fake OCP bus entry to represent the whole bus
         * hierarchy.
         */
diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
index e96da9a898ad..cfb8fc753f50 100644
--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
@@ -1640,7 +1640,7 @@
                #clock-cells = <0>;
                compatible = "ti,mux-clock";
                clocks = <&abe_24m_fclk>, <&abe_sys_clk_div>, <&func_24m_clk>, <&atlclkin3_ck>, <&atl_clkin2_ck>, <&atl_clkin1_ck>, <&atl_clkin0_ck>, <&sys_clkin2>, <&ref_clkin0_ck>, <&ref_clkin1_ck>, <&ref_clkin2_ck>, <&ref_clkin3_ck>, <&mlb_clk>, <&mlbp_clk>;
-                ti,bit-shift = <28>;
+                ti,bit-shift = <24>;
                reg = <0x1860>;
        };
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index 32f760e24898..ea323f09dc78 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -56,6 +56,7 @@
                osc {
                        compatible = "fsl,imx-osc", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24000000>;
                };
        };
diff --git a/arch/arm/boot/dts/imx27-apf27.dts b/arch/arm/boot/dts/imx27-apf27.dts
index 09f57b39e3ef..73aae4f5e539 100644
--- a/arch/arm/boot/dts/imx27-apf27.dts
+++ b/arch/arm/boot/dts/imx27-apf27.dts
@@ -29,6 +29,7 @@
                osc26m {
                        compatible = "fsl,imx-osc26m", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <0>;
                };
        };
diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index 6279e0b4f768..137e010eab35 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi
@@ -48,6 +48,7 @@
                osc26m {
                        compatible = "fsl,imx-osc26m", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <26000000>;
                };
        };
diff --git a/arch/arm/boot/dts/imx50.dtsi b/arch/arm/boot/dts/imx50.dtsi
index 0c75fe3deb35..9c89d1ca97c2 100644
--- a/arch/arm/boot/dts/imx50.dtsi
+++ b/arch/arm/boot/dts/imx50.dtsi
@@ -53,21 +53,25 @@
                ckil {
                        compatible = "fsl,imx-ckil", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <32768>;
                };
                ckih1 {
                        compatible = "fsl,imx-ckih1", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <22579200>;
                };
                ckih2 {
                        compatible = "fsl,imx-ckih2", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <0>;
                };
                osc {
                        compatible = "fsl,imx-osc", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24000000>;
                };
        };
diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi
index 5f8216d08f6b..150bb4e2f744 100644
--- a/arch/arm/boot/dts/imx51.dtsi
+++ b/arch/arm/boot/dts/imx51.dtsi
@@ -50,21 +50,25 @@
                ckil {
                        compatible = "fsl,imx-ckil", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <32768>;
                };
                ckih1 {
                        compatible = "fsl,imx-ckih1", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <0>;
                };
                ckih2 {
                        compatible = "fsl,imx-ckih2", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <0>;
                };
                osc {
                        compatible = "fsl,imx-osc", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24000000>;
                };
        };
diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
index f6d3ac3e5587..d5d146a8b149 100644
--- a/arch/arm/boot/dts/imx53-m53evk.dts
+++ b/arch/arm/boot/dts/imx53-m53evk.dts
@@ -17,7 +17,8 @@
        compatible = "denx,imx53-m53evk", "fsl,imx53";
        memory {
-                reg = <0x70000000 0x20000000>;
+                reg = <0x70000000 0x20000000>,
+                      <0xb0000000 0x20000000>;
        };
        soc {
@@ -193,17 +194,17 @@
                irq-trigger = <0x1>;
                stmpe_touchscreen {
-                        compatible = "stmpe,ts";
+                        compatible = "st,stmpe-ts";
                        reg = <0>;
-                        ts,sample-time = <4>;
+                        st,sample-time = <4>;
-                        ts,mod-12b = <1>;
+                        st,mod-12b = <1>;
-                        ts,ref-sel = <0>;
+                        st,ref-sel = <0>;
-                        ts,adc-freq = <1>;
+                        st,adc-freq = <1>;
-                        ts,ave-ctrl = <3>;
+                        st,ave-ctrl = <3>;
-                        ts,touch-det-delay = <3>;
+                        st,touch-det-delay = <3>;
-                        ts,settling = <4>;
+                        st,settling = <4>;
-                        ts,fraction-z = <7>;
+                        st,fraction-z = <7>;
-                        ts,i-drive = <1>;
+                        st,i-drive = <1>;
                };
        };
diff --git a/arch/arm/boot/dts/imx53-mba53.dts b/arch/arm/boot/dts/imx53-mba53.dts
index 7c8c12969892..a3431d784870 100644
--- a/arch/arm/boot/dts/imx53-mba53.dts
+++ b/arch/arm/boot/dts/imx53-mba53.dts
@@ -244,7 +244,7 @@
 &tve {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_vga_sync_1>;
-        i2c-ddc-bus = <&i2c3>;
+        ddc-i2c-bus = <&i2c3>;
        fsl,tve-mode = "vga";
        fsl,hsync-pin = <4>;
        fsl,vsync-pin = <6>;
diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index 3f825a6813da..ede04fa4161f 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -14,7 +14,8 @@
 / {
        memory {
-                reg = <0x70000000 0x40000000>;
+                reg = <0x70000000 0x20000000>,
+                      <0xb0000000 0x20000000>;
        };
        display0: display@di0 {
diff --git a/arch/arm/boot/dts/imx53-tx53-x03x.dts b/arch/arm/boot/dts/imx53-tx53-x03x.dts
index 0217dde3b36b..3b73e81dc3f0 100644
--- a/arch/arm/boot/dts/imx53-tx53-x03x.dts
+++ b/arch/arm/boot/dts/imx53-tx53-x03x.dts
@@ -25,12 +25,17 @@
        soc {
                display: display@di0 {
                        compatible = "fsl,imx-parallel-display";
-                        crtcs = <&ipu 0>;
                        interface-pix-fmt = "rgb24";
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_rgb24_vga1>;
                        status = "okay";
+                        port {
+                                display0_in: endpoint {
+                                        remote-endpoint = <&ipu_di0_disp0>;
+                                };
+                        };
                        display-timings {
                                VGA {
                                        clock-frequency = <25200000>;
@@ -293,6 +298,10 @@
        };
 };
+&ipu_di0_disp0 {
+        remote-endpoint = <&display0_in>;
+};
 &kpp {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_kpp>;
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index b57ab57740f6..6a1bf4ff83d5 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -70,21 +70,25 @@
                ckil {
                        compatible = "fsl,imx-ckil", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <32768>;
                };
                ckih1 {
                        compatible = "fsl,imx-ckih1", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <22579200>;
                };
                ckih2 {
                        compatible = "fsl,imx-ckih2", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <0>;
                };
                osc {
                        compatible = "fsl,imx-osc", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24000000>;
                };
        };
@@ -111,7 +115,7 @@
                        #address-cells = <1>;
                        #size-cells = <0>;
                        compatible = "fsl,imx53-ipu";
-                        reg = <0x18000000 0x080000000>;
+                        reg = <0x18000000 0x08000000>;
                        interrupts = <11 10>;
                        clocks = <&clks IMX5_CLK_IPU_GATE>,
                                 <&clks IMX5_CLK_IPU_DI0_GATE>,
@@ -430,7 +434,7 @@
                                        port {
                                                lvds1_in: endpoint {
-                                                        remote-endpoint = <&ipu_di0_lvds0>;
+                                                        remote-endpoint = <&ipu_di1_lvds1>;
                                                };
                                        };
                                };
diff --git a/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts b/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts
index a63bbb3d46bb..e4ae38fd0269 100644
--- a/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts
+++ b/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts
@@ -19,7 +19,10 @@
        compatible = "dmo,imx6q-edmqmx6", "fsl,imx6q";
        aliases {
-                gpio7 = &stmpe_gpio;
+                gpio7 = &stmpe_gpio1;
+                gpio8 = &stmpe_gpio2;
+                stmpe-i2c0 = &stmpe1;
+                stmpe-i2c1 = &stmpe2;
        };
        memory {
@@ -40,13 +43,15 @@
                        regulator-always-on;
                };
-                reg_usb_otg_vbus: regulator@1 {
+                reg_usb_otg_switch: regulator@1 {
                        compatible = "regulator-fixed";
                        reg = <1>;
-                        regulator-name = "usb_otg_vbus";
+                        regulator-name = "usb_otg_switch";
                        regulator-min-microvolt = <5000000>;
                        regulator-max-microvolt = <5000000>;
                        gpio = <&gpio7 12 0>;
+                        regulator-boot-on;
+                        regulator-always-on;
                };
                reg_usb_host1: regulator@2 {
@@ -65,23 +70,23 @@
                led-blue {
                        label = "blue";
-                        gpios = <&stmpe_gpio 8 GPIO_ACTIVE_HIGH>;
+                        gpios = <&stmpe_gpio1 8 GPIO_ACTIVE_HIGH>;
                        linux,default-trigger = "heartbeat";
                };
                led-green {
                        label = "green";
-                        gpios = <&stmpe_gpio 9 GPIO_ACTIVE_HIGH>;
+                        gpios = <&stmpe_gpio1 9 GPIO_ACTIVE_HIGH>;
                };
                led-pink {
                        label = "pink";
-                        gpios = <&stmpe_gpio 10 GPIO_ACTIVE_HIGH>;
+                        gpios = <&stmpe_gpio1 10 GPIO_ACTIVE_HIGH>;
                };
                led-red {
                        label = "red";
-                        gpios = <&stmpe_gpio 11 GPIO_ACTIVE_HIGH>;
+                        gpios = <&stmpe_gpio1 11 GPIO_ACTIVE_HIGH>;
                };
        };
 };
@@ -99,7 +104,8 @@
        clock-frequency = <100000>;
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_i2c2
-                     &pinctrl_stmpe>;
+                     &pinctrl_stmpe1
+                     &pinctrl_stmpe2>;
        status = "okay";
        pmic: pfuze100@08 {
@@ -205,13 +211,25 @@
                };
        };
-        stmpe: stmpe1601@40 {
+        stmpe1: stmpe1601@40 {
                compatible = "st,stmpe1601";
                reg = <0x40>;
                interrupts = <30 0>;
                interrupt-parent = <&gpio3>;
-                stmpe_gpio: stmpe_gpio {
+                stmpe_gpio1: stmpe_gpio {
+                        #gpio-cells = <2>;
+                        compatible = "st,stmpe-gpio";
+                };
+        };
+        stmpe2: stmpe1601@44 {
+                compatible = "st,stmpe1601";
+                reg = <0x44>;
+                interrupts = <2 0>;
+                interrupt-parent = <&gpio5>;
+                stmpe_gpio2: stmpe_gpio {
                        #gpio-cells = <2>;
                        compatible = "st,stmpe-gpio";
                };
@@ -273,10 +291,14 @@
                        >;
                };
-                pinctrl_stmpe: stmpegrp {
+                pinctrl_stmpe1: stmpe1grp {
                        fsl,pins = <MX6QDL_PAD_EIM_D30__GPIO3_IO30 0x80000000>;
                };
+                pinctrl_stmpe2: stmpe2grp {
+                        fsl,pins = <MX6QDL_PAD_EIM_A25__GPIO5_IO02 0x80000000>;
+                };
                pinctrl_uart1: uart1grp {
                        fsl,pins = <
                                MX6QDL_PAD_SD3_DAT7__UART1_TX_DATA      0x1b0b1
@@ -293,7 +315,7 @@
                pinctrl_usbotg: usbotggrp {
                        fsl,pins = <
-                                MX6QDL_PAD_GPIO_1__USB_OTG_ID           0x17059
+                                MX6QDL_PAD_ENET_RX_ER__USB_OTG_ID       0x17059
                        >;
                };
@@ -344,11 +366,11 @@
 &usbh1 {
        vbus-supply = <&reg_usb_host1>;
        disable-over-current;
+        dr_mode = "host";
        status = "okay";
 };
 &usbotg {
-        vbus-supply = <&reg_usb_otg_vbus>;
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usbotg>;
        disable-over-current;
diff --git a/arch/arm/boot/dts/imx6q-gw5400-a.dts b/arch/arm/boot/dts/imx6q-gw5400-a.dts
index 902f98310481..e51bb3f0fd56 100644
--- a/arch/arm/boot/dts/imx6q-gw5400-a.dts
+++ b/arch/arm/boot/dts/imx6q-gw5400-a.dts
@@ -487,9 +487,6 @@
 &ldb {
        status = "okay";
-        lvds-channel@0 {
-                crtcs = <&ipu1 0>, <&ipu1 1>, <&ipu2 0>, <&ipu2 1>;
-        };
 };
 &pcie {
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index 8e99c9a9bc76..035d3a85c318 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -436,9 +436,6 @@
 &ldb {
        status = "okay";
-        lvds-channel@0 {
-                crtcs = <&ipu1 0>, <&ipu1 1>;
-        };
 };
 &pcie {
diff --git a/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi b/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi
index a3cb2fff8f61..d16066608e21 100644
--- a/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi
@@ -26,25 +26,25 @@
                                /* GPIO16 -> AR8035 25MHz */
                                MX6QDL_PAD_GPIO_16__ENET_REF_CLK        0xc0000000
                                MX6QDL_PAD_RGMII_TXC__RGMII_TXC         0x80000000
-                                MX6QDL_PAD_RGMII_TD0__RGMII_TD0         0x1b0b0
+                                MX6QDL_PAD_RGMII_TD0__RGMII_TD0         0x1b030
-                                MX6QDL_PAD_RGMII_TD1__RGMII_TD1         0x1b0b0
+                                MX6QDL_PAD_RGMII_TD1__RGMII_TD1         0x1b030
-                                MX6QDL_PAD_RGMII_TD2__RGMII_TD2         0x1b0b0
+                                MX6QDL_PAD_RGMII_TD2__RGMII_TD2         0x1b030
-                                MX6QDL_PAD_RGMII_TD3__RGMII_TD3         0x1b0b0
+                                MX6QDL_PAD_RGMII_TD3__RGMII_TD3         0x1b030
-                                MX6QDL_PAD_RGMII_TX_CTL__RGMII_TX_CTL   0x1b0b0
+                                MX6QDL_PAD_RGMII_TX_CTL__RGMII_TX_CTL   0x1b030
                                /* AR8035 CLK_25M --> ENET_REF_CLK (V22) */
                                MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK    0x0a0b1
                                /* AR8035 pin strapping: IO voltage: pull up */
-                                MX6QDL_PAD_RGMII_RXC__RGMII_RXC         0x1b0b0
+                                MX6QDL_PAD_RGMII_RXC__RGMII_RXC         0x1b030
                                /* AR8035 pin strapping: PHYADDR#0: pull down */
-                                MX6QDL_PAD_RGMII_RD0__RGMII_RD0         0x130b0
+                                MX6QDL_PAD_RGMII_RD0__RGMII_RD0         0x13030
                                /* AR8035 pin strapping: PHYADDR#1: pull down */
-                                MX6QDL_PAD_RGMII_RD1__RGMII_RD1         0x130b0
+                                MX6QDL_PAD_RGMII_RD1__RGMII_RD1         0x13030
                                /* AR8035 pin strapping: MODE#1: pull up */
-                                MX6QDL_PAD_RGMII_RD2__RGMII_RD2         0x1b0b0
+                                MX6QDL_PAD_RGMII_RD2__RGMII_RD2         0x1b030
                                /* AR8035 pin strapping: MODE#3: pull up */
-                                MX6QDL_PAD_RGMII_RD3__RGMII_RD3         0x1b0b0
+                                MX6QDL_PAD_RGMII_RD3__RGMII_RD3         0x1b030
                                /* AR8035 pin strapping: MODE#0: pull down */
-                                MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL   0x130b0
+                                MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL   0x13030
                                /*
                                 * As the RMII pins are also connected to RGMII
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 55cb926fa3f7..eca0971d4db1 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -10,6 +10,8 @@
 * http://www.gnu.org/copyleft/gpl.html
 */
+#include <dt-bindings/interrupt-controller/arm-gic.h>
 #include "skeleton.dtsi"
 / {
@@ -46,8 +48,6 @@
        intc: interrupt-controller@00a01000 {
                compatible = "arm,cortex-a9-gic";
                #interrupt-cells = <3>;
-                #address-cells = <1>;
-                #size-cells = <1>;
                interrupt-controller;
                reg = <0x00a01000 0x1000>,
                      <0x00a00100 0x100>;
@@ -59,16 +59,19 @@
                ckil {
                        compatible = "fsl,imx-ckil", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <32768>;
                };
                ckih1 {
                        compatible = "fsl,imx-ckih1", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <0>;
                };
                osc {
                        compatible = "fsl,imx-osc", "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24000000>;
                };
        };
@@ -138,6 +141,12 @@
                                  0x82000000 0 0x01000000 0x01000000 0 0x00f00000>; /* non-prefetchable memory */
                        num-lanes = <1>;
                        interrupts = <0 123 IRQ_TYPE_LEVEL_HIGH>;
+                        #interrupt-cells = <1>;
+                        interrupt-map-mask = <0 0 0 0x7>;
+                        interrupt-map = <0 0 0 1 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+                                        <0 0 0 2 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+                                        <0 0 0 3 &intc GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+                                        <0 0 0 4 &intc GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
                        clocks = <&clks 189>, <&clks 187>, <&clks 206>, <&clks 144>;
                        clock-names = "pcie_ref_125m", "sata_ref_100m", "lvds_gate", "pcie_axi";
                        status = "disabled";
diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
index 864d8dfb51ca..a8d9a93fab85 100644
--- a/arch/arm/boot/dts/imx6sl-evk.dts
+++ b/arch/arm/boot/dts/imx6sl-evk.dts
@@ -282,6 +282,7 @@
                                MX6SL_PAD_ECSPI1_MISO__ECSPI1_MISO      0x100b1
                                MX6SL_PAD_ECSPI1_MOSI__ECSPI1_MOSI      0x100b1
                                MX6SL_PAD_ECSPI1_SCLK__ECSPI1_SCLK      0x100b1
+                                MX6SL_PAD_ECSPI1_SS0__GPIO4_IO11        0x80000000
                        >;
                };
diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
index 3cb4941afeef..d26b099260a3 100644
--- a/arch/arm/boot/dts/imx6sl.dtsi
+++ b/arch/arm/boot/dts/imx6sl.dtsi
@@ -68,8 +68,6 @@
        intc: interrupt-controller@00a01000 {
                compatible = "arm,cortex-a9-gic";
                #interrupt-cells = <3>;
-                #address-cells = <1>;
-                #size-cells = <1>;
                interrupt-controller;
                reg = <0x00a01000 0x1000>,
                      <0x00a00100 0x100>;
@@ -81,11 +79,13 @@
                ckil {
                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <32768>;
                };
                osc {
                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24000000>;
                };
        };
diff --git a/arch/arm/boot/dts/kirkwood-b3.dts b/arch/arm/boot/dts/kirkwood-b3.dts
index 40791053106b..6becedebaa4e 100644
--- a/arch/arm/boot/dts/kirkwood-b3.dts
+++ b/arch/arm/boot/dts/kirkwood-b3.dts
@@ -75,7 +75,7 @@
                        m25p16@0 {
                                #address-cells = <1>;
                                #size-cells = <1>;
-                                compatible = "m25p16";
+                                compatible = "st,m25p16";
                                reg = <0>;
                                spi-max-frequency = <40000000>;
                                mode = <0>;
diff --git a/arch/arm/boot/dts/kirkwood-cloudbox.dts b/arch/arm/boot/dts/kirkwood-cloudbox.dts
index 0e06fd3cee4d..3b62aeeaa3a2 100644
--- a/arch/arm/boot/dts/kirkwood-cloudbox.dts
+++ b/arch/arm/boot/dts/kirkwood-cloudbox.dts
@@ -46,7 +46,7 @@
                        flash@0 {
                                #address-cells = <1>;
                                #size-cells = <1>;
-                                compatible = "mx25l4005a";
+                                compatible = "mxicy,mx25l4005a";
                                reg = <0>;
                                spi-max-frequency = <20000000>;
                                mode = <0>;
diff --git a/arch/arm/boot/dts/kirkwood-dreamplug.dts b/arch/arm/boot/dts/kirkwood-dreamplug.dts
index ef3463e0ae19..28b3ee369778 100644
--- a/arch/arm/boot/dts/kirkwood-dreamplug.dts
+++ b/arch/arm/boot/dts/kirkwood-dreamplug.dts
@@ -43,7 +43,7 @@
                        m25p40@0 {
                                #address-cells = <1>;
                                #size-cells = <1>;
-                                compatible = "mx25l1606e";
+                                compatible = "mxicy,mx25l1606e";
                                reg = <0>;
                                spi-max-frequency = <50000000>;
                                mode = <0>;
diff --git a/arch/arm/boot/dts/kirkwood-laplug.dts b/arch/arm/boot/dts/kirkwood-laplug.dts
index c9e82eff9bf2..6761ffa2c4ab 100644
--- a/arch/arm/boot/dts/kirkwood-laplug.dts
+++ b/arch/arm/boot/dts/kirkwood-laplug.dts
@@ -48,7 +48,7 @@
                        status = "okay";
                        eeprom@50 {
-                                compatible = "at,24c04";
+                                compatible = "atmel,24c04";
                                pagesize = <16>;
                                reg = <0x50>;
                        };
diff --git a/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts b/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts
index 2cb0dc529165..b939f4f52d16 100644
--- a/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts
+++ b/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts
@@ -30,6 +30,16 @@
                bootargs = "console=ttyS0,115200n8 earlyprintk";
        };
+        mbus {
+                pcie-controller {
+                        status = "okay";
+                        pcie@1,0 {
+                                status = "okay";
+                        };
+                };
+        };
        ocp@f1000000 {
                pinctrl@10000 {
                        pmx_usb_led: pmx-usb-led {
@@ -56,7 +66,7 @@
                        flash@0 {
                                #address-cells = <1>;
                                #size-cells = <1>;
-                                compatible = "mx25l12805d";
+                                compatible = "mxicy,mx25l12805d";
                                reg = <0>;
                                spi-max-frequency = <50000000>;
                                mode = <0>;
@@ -73,14 +83,6 @@
                ehci@50000 {
                        status = "okay";
                };
-                pcie-controller {
-                        status = "okay";
-                        pcie@1,0 {
-                                status = "okay";
-                        };
-                };
        };
        gpio-leds {
diff --git a/arch/arm/boot/dts/kirkwood-ns2-common.dtsi b/arch/arm/boot/dts/kirkwood-ns2-common.dtsi
index 743152f31a81..e6e5ec4fe6b9 100644
--- a/arch/arm/boot/dts/kirkwood-ns2-common.dtsi
+++ b/arch/arm/boot/dts/kirkwood-ns2-common.dtsi
@@ -32,7 +32,7 @@
                        flash@0 {
                                #address-cells = <1>;
                                #size-cells = <1>;
-                                compatible = "mx25l4005a";
+                                compatible = "mxicy,mx25l4005a";
                                reg = <0>;
                                spi-max-frequency = <20000000>;
                                mode = <0>;
@@ -50,7 +50,7 @@
                        status = "okay";
                        eeprom@50 {
-                                compatible = "at,24c04";
+                                compatible = "atmel,24c04";
                                pagesize = <16>;
                                reg = <0x50>;
                        };
diff --git a/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi b/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi
index aa78c2d11fe7..e2cc85cc3b87 100644
--- a/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi
+++ b/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi
@@ -4,6 +4,16 @@
 / {
        model = "ZyXEL NSA310";
+        mbus {
+                pcie-controller {
+                        status = "okay";
+                        pcie@1,0 {
+                                status = "okay";
+                        };
+                };
+        };
        ocp@f1000000 {
                pinctrl: pinctrl@10000 {
@@ -26,14 +36,6 @@
                        status = "okay";
                        nr-ports = <2>;
                };
-                pcie-controller {
-                        status = "okay";
-                        pcie@1,0 {
-                                status = "okay";
-                        };
-                };
        };
        gpio_poweroff {
diff --git a/arch/arm/boot/dts/kirkwood-nsa310.dts b/arch/arm/boot/dts/kirkwood-nsa310.dts
index 03fa24cf3344..0a07af9d8e58 100644
--- a/arch/arm/boot/dts/kirkwood-nsa310.dts
+++ b/arch/arm/boot/dts/kirkwood-nsa310.dts
@@ -104,7 +104,7 @@
                        status = "okay";
                        adt7476: adt7476a@2e {
-                                compatible = "adt7476";
+                                compatible = "adi,adt7476";
                                reg = <0x2e>;
                        };
                };
diff --git a/arch/arm/boot/dts/kirkwood-nsa310a.dts b/arch/arm/boot/dts/kirkwood-nsa310a.dts
index a5e779452867..27ca6a79c48a 100644
--- a/arch/arm/boot/dts/kirkwood-nsa310a.dts
+++ b/arch/arm/boot/dts/kirkwood-nsa310a.dts
@@ -94,7 +94,7 @@
                        status = "okay";
                        lm85: lm85@2e {
-                                compatible = "lm85";
+                                compatible = "national,lm85";
                                reg = <0x2e>;
                        };
                };
diff --git a/arch/arm/boot/dts/kirkwood-openblocks_a6.dts b/arch/arm/boot/dts/kirkwood-openblocks_a6.dts
index b88da9392c32..0650beafc1de 100644
--- a/arch/arm/boot/dts/kirkwood-openblocks_a6.dts
+++ b/arch/arm/boot/dts/kirkwood-openblocks_a6.dts
@@ -40,7 +40,7 @@
                        pinctrl-names = "default";
                        s35390a: s35390a@30 {
-                                compatible = "s35390a";
+                                compatible = "sii,s35390a";
                                reg = <0x30>;
                        };
                };
diff --git a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
index b2f7cae06839..38520a287514 100644
--- a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
+++ b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
@@ -52,7 +52,7 @@
                        pinctrl-names = "default";
                        s24c02: s24c02@50 {
-                                compatible = "24c02";
+                                compatible = "atmel,24c02";
                                reg = <0x50>;
                        };
                };
diff --git a/arch/arm/boot/dts/kirkwood-t5325.dts b/arch/arm/boot/dts/kirkwood-t5325.dts
index 7d1c7677a18f..0bd70d928c69 100644
--- a/arch/arm/boot/dts/kirkwood-t5325.dts
+++ b/arch/arm/boot/dts/kirkwood-t5325.dts
@@ -127,11 +127,6 @@
                i2c@11000 {
                        status = "okay";
-                        alc5621: alc5621@1a {
-                                compatible = "realtek,alc5621";
-                                reg = <0x1a>;
-                        };
                };
                serial@12000 {
diff --git a/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
index f577b7df9a29..521c587acaee 100644
--- a/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
+++ b/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
@@ -24,11 +24,10 @@
                compatible = "smsc,lan9221", "smsc,lan9115";
                bank-width = <2>;
                gpmc,mux-add-data;
-                gpmc,cs-on-ns = <0>;
+                gpmc,cs-on-ns = <1>;
-                gpmc,cs-rd-off-ns = <186>;
+                gpmc,cs-rd-off-ns = <180>;
-                gpmc,cs-wr-off-ns = <186>;
+                gpmc,cs-wr-off-ns = <180>;
-                gpmc,adv-on-ns = <12>;
+                gpmc,adv-rd-off-ns = <18>;
-                gpmc,adv-rd-off-ns = <48>;
                gpmc,adv-wr-off-ns = <48>;
                gpmc,oe-on-ns = <54>;
                gpmc,oe-off-ns = <168>;
@@ -36,12 +35,10 @@
                gpmc,we-off-ns = <168>;
                gpmc,rd-cycle-ns = <186>;
                gpmc,wr-cycle-ns = <186>;
-                gpmc,access-ns = <114>;
+                gpmc,access-ns = <144>;
-                gpmc,page-burst-access-ns = <6>;
+                gpmc,page-burst-access-ns = <24>;
-                gpmc,bus-turnaround-ns = <12>;
+                gpmc,bus-turnaround-ns = <90>;
-                gpmc,cycle2cycle-delay-ns = <18>;
+                gpmc,cycle2cycle-delay-ns = <90>;
-                gpmc,wr-data-mux-bus-ns = <90>;
-                gpmc,wr-access-ns = <186>;
                gpmc,cycle2cycle-samecsen;
                gpmc,cycle2cycle-diffcsen;
                vddvario-supply = <&vddvario>;
diff --git a/arch/arm/boot/dts/omap2.dtsi b/arch/arm/boot/dts/omap2.dtsi
index 22f35ea142c1..8f8c07da4ac1 100644
--- a/arch/arm/boot/dts/omap2.dtsi
+++ b/arch/arm/boot/dts/omap2.dtsi
@@ -71,13 +71,6 @@
                        interrupts = <58>;
                };
-                mailbox: mailbox@48094000 {
-                        compatible = "ti,omap2-mailbox";
-                        ti,hwmods = "mailbox";
-                        reg = <0x48094000 0x200>;
-                        interrupts = <26>;
-                };
                intc: interrupt-controller@1 {
                        compatible = "ti,omap2-intc";
                        interrupt-controller;
diff --git a/arch/arm/boot/dts/omap2420.dtsi b/arch/arm/boot/dts/omap2420.dtsi
index 85b1fb014c43..2d9979835f24 100644
--- a/arch/arm/boot/dts/omap2420.dtsi
+++ b/arch/arm/boot/dts/omap2420.dtsi
@@ -125,6 +125,14 @@
                        dma-names = "tx", "rx";
                };
+                mailbox: mailbox@48094000 {
+                        compatible = "ti,omap2-mailbox";
+                        reg = <0x48094000 0x200>;
+                        interrupts = <26>, <34>;
+                        interrupt-names = "dsp", "iva";
+                        ti,hwmods = "mailbox";
+                };
                timer1: timer@48028000 {
                        compatible = "ti,omap2420-timer";
                        reg = <0x48028000 0x400>;
diff --git a/arch/arm/boot/dts/omap2430.dtsi b/arch/arm/boot/dts/omap2430.dtsi
index d09697dab55e..42d2c61c9e2d 100644
--- a/arch/arm/boot/dts/omap2430.dtsi
+++ b/arch/arm/boot/dts/omap2430.dtsi
@@ -216,6 +216,13 @@
                        dma-names = "tx", "rx";
                };
+                mailbox: mailbox@48094000 {
+                        compatible = "ti,omap2-mailbox";
+                        reg = <0x48094000 0x200>;
+                        interrupts = <26>;
+                        ti,hwmods = "mailbox";
+                };
                timer1: timer@49018000 {
                        compatible = "ti,omap2420-timer";
                        reg = <0x49018000 0x400>;
diff --git a/arch/arm/boot/dts/omap3-beagle-xm-ab.dts b/arch/arm/boot/dts/omap3-beagle-xm-ab.dts
new file mode 100644
index 000000000000..7ac3bcf59d59
--- /dev/null
+++ b/arch/arm/boot/dts/omap3-beagle-xm-ab.dts
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) 2011 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include "omap3-beagle-xm.dts"
+/ {
+        /* HS USB Port 2 Power enable was inverted with the xM C */
+        hsusb2_power: hsusb2_power_reg {
+                enable-active-high;
+        };
+};
diff --git a/arch/arm/boot/dts/omap3-cm-t3x30.dtsi b/arch/arm/boot/dts/omap3-cm-t3x30.dtsi
index d00055809e31..25ba08331d88 100644
--- a/arch/arm/boot/dts/omap3-cm-t3x30.dtsi
+++ b/arch/arm/boot/dts/omap3-cm-t3x30.dtsi
@@ -10,18 +10,6 @@
                        cpu0-supply = <&vcc>;
                };
        };
-        vddvario: regulator-vddvario {
-                compatible = "regulator-fixed";
-                regulator-name = "vddvario";
-                regulator-always-on;
-        };
-        vdd33a: regulator-vdd33a {
-                compatible = "regulator-fixed";
-                regulator-name = "vdd33a";
-                regulator-always-on;
-        };
 };
 &omap3_pmx_core {
@@ -35,58 +23,34 @@
        hsusb0_pins: pinmux_hsusb0_pins {
                pinctrl-single,pins = <
-                        OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0)               /* hsusb0_clk.hsusb0_clk */
+                        OMAP3_CORE1_IOPAD(0x21a2, PIN_OUTPUT | MUX_MODE0)               /* hsusb0_clk.hsusb0_clk */
-                        OMAP3_CORE1_IOPAD(0x21a2, PIN_OUTPUT | MUX_MODE0)               /* hsusb0_stp.hsusb0_stp */
+                        OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0)               /* hsusb0_stp.hsusb0_stp */
-                        OMAP3_CORE1_IOPAD(0x21a4, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_dir.hsusb0_dir */
+                        OMAP3_CORE1_IOPAD(0x21a6, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_dir.hsusb0_dir */
-                        OMAP3_CORE1_IOPAD(0x21a6, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_nxt.hsusb0_nxt */
+                        OMAP3_CORE1_IOPAD(0x21a8, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_nxt.hsusb0_nxt */
-                        OMAP3_CORE1_IOPAD(0x21a8, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data0.hsusb2_data0 */
+                        OMAP3_CORE1_IOPAD(0x21aa, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data0.hsusb2_data0 */
-                        OMAP3_CORE1_IOPAD(0x21aa, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data1.hsusb0_data1 */
+                        OMAP3_CORE1_IOPAD(0x21ac, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data1.hsusb0_data1 */
-                        OMAP3_CORE1_IOPAD(0x21ac, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data2.hsusb0_data2 */
+                        OMAP3_CORE1_IOPAD(0x21ae, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data2.hsusb0_data2 */
-                        OMAP3_CORE1_IOPAD(0x21ae, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data3 */
+                        OMAP3_CORE1_IOPAD(0x21b0, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data3 */
-                        OMAP3_CORE1_IOPAD(0x21b0, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data4 */
+                        OMAP3_CORE1_IOPAD(0x21b2, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data4 */
-                        OMAP3_CORE1_IOPAD(0x21b2, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data5 */
+                        OMAP3_CORE1_IOPAD(0x21b4, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data5 */
-                        OMAP3_CORE1_IOPAD(0x21b4, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data6 */
+                        OMAP3_CORE1_IOPAD(0x21b6, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data6 */
-                        OMAP3_CORE1_IOPAD(0x21b6, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data7 */
+                        OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* hsusb0_data7.hsusb0_data7 */
                >;
        };
 };
+#include "omap-gpmc-smsc911x.dtsi"
 &gpmc {
        ranges = <5 0 0x2c000000 0x01000000>;
-        smsc1: ethernet@5,0 {
+        smsc1: ethernet@gpmc {
                compatible = "smsc,lan9221", "smsc,lan9115";
                pinctrl-names = "default";
                pinctrl-0 = <&smsc1_pins>;
                interrupt-parent = <&gpio6>;
                interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
                reg = <5 0 0xff>;
-                bank-width = <2>;
-                gpmc,mux-add-data;
-                gpmc,cs-on-ns = <0>;
-                gpmc,cs-rd-off-ns = <186>;
-                gpmc,cs-wr-off-ns = <186>;
-                gpmc,adv-on-ns = <12>;
-                gpmc,adv-rd-off-ns = <48>;
-                gpmc,adv-wr-off-ns = <48>;
-                gpmc,oe-on-ns = <54>;
-                gpmc,oe-off-ns = <168>;
-                gpmc,we-on-ns = <54>;
-                gpmc,we-off-ns = <168>;
-                gpmc,rd-cycle-ns = <186>;
-                gpmc,wr-cycle-ns = <186>;
-                gpmc,access-ns = <114>;
-                gpmc,page-burst-access-ns = <6>;
-                gpmc,bus-turnaround-ns = <12>;
-                gpmc,cycle2cycle-delay-ns = <18>;
-                gpmc,wr-data-mux-bus-ns = <90>;
-                gpmc,wr-access-ns = <186>;
-                gpmc,cycle2cycle-samecsen;
-                gpmc,cycle2cycle-diffcsen;
-                vddvario-supply = <&vddvario>;
-                vdd33a-supply = <&vdd33a>;
-                reg-io-width = <4>;
-                smsc,save-mac-address;
        };
 };
diff --git a/arch/arm/boot/dts/omap3-devkit8000.dts b/arch/arm/boot/dts/omap3-devkit8000.dts
index bf5a515a3247..da402f0fdab4 100644
--- a/arch/arm/boot/dts/omap3-devkit8000.dts
+++ b/arch/arm/boot/dts/omap3-devkit8000.dts
@@ -112,7 +112,6 @@
                reg = <0 0 0>; /* CS0, offset 0 */
                nand-bus-width = <16>;
-                gpmc,device-nand;
                gpmc,sync-clk-ps = <0>;
                gpmc,cs-on-ns = <0>;
                gpmc,cs-rd-off-ns = <44>;
diff --git a/arch/arm/boot/dts/omap3-igep.dtsi b/arch/arm/boot/dts/omap3-igep.dtsi
index b97736d98a64..e2d163bf0619 100644
--- a/arch/arm/boot/dts/omap3-igep.dtsi
+++ b/arch/arm/boot/dts/omap3-igep.dtsi
@@ -107,7 +107,7 @@
                >;
        };
-        smsc911x_pins: pinmux_smsc911x_pins {
+        smsc9221_pins: pinmux_smsc9221_pins {
                pinctrl-single,pins = <
                        0x1a2 (PIN_INPUT | MUX_MODE4)           /* mcspi1_cs2.gpio_176 */
                >;
diff --git a/arch/arm/boot/dts/omap3-igep0020.dts b/arch/arm/boot/dts/omap3-igep0020.dts
index 7abd64f6ae21..b22caaaf774b 100644
--- a/arch/arm/boot/dts/omap3-igep0020.dts
+++ b/arch/arm/boot/dts/omap3-igep0020.dts
@@ -10,7 +10,7 @@
 */
 #include "omap3-igep.dtsi"
-#include "omap-gpmc-smsc911x.dtsi"
+#include "omap-gpmc-smsc9221.dtsi"
 / {
        model = "IGEPv2 (TI OMAP AM/DM37x)";
@@ -248,7 +248,7 @@
        ethernet@gpmc {
                pinctrl-names = "default";
-                pinctrl-0 = <&smsc911x_pins>;
+                pinctrl-0 = <&smsc9221_pins>;
                reg = <5 0 0xff>;
                interrupt-parent = <&gpio6>;
                interrupts = <16 IRQ_TYPE_LEVEL_LOW>;
diff --git a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
index 6369d9f43ca2..cc1dce6978f5 100644
--- a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
+++ b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
@@ -368,7 +368,6 @@
                /* no elm on omap3 */
                gpmc,mux-add-data = <0>;
-                gpmc,device-nand;
                gpmc,device-width = <2>;
                gpmc,wait-pin = <0>;
                gpmc,wait-monitoring-ns = <0>;
diff --git a/arch/arm/boot/dts/omap3-sb-t35.dtsi b/arch/arm/boot/dts/omap3-sb-t35.dtsi
index 7909c51b05a5..d59e3de1441e 100644
--- a/arch/arm/boot/dts/omap3-sb-t35.dtsi
+++ b/arch/arm/boot/dts/omap3-sb-t35.dtsi
@@ -2,20 +2,6 @@
 * Common support for CompuLab SB-T35 used on SBC-T3530, SBC-T3517 and SBC-T3730
 */
-/ {
-        vddvario_sb_t35: regulator-vddvario-sb-t35 {
-                compatible = "regulator-fixed";
-                regulator-name = "vddvario";
-                regulator-always-on;
-        };
-        vdd33a_sb_t35: regulator-vdd33a-sb-t35 {
-                compatible = "regulator-fixed";
-                regulator-name = "vdd33a";
-                regulator-always-on;
-        };
-};
 &omap3_pmx_core {
        smsc2_pins: pinmux_smsc2_pins {
                pinctrl-single,pins = <
@@ -37,11 +23,10 @@
                reg = <4 0 0xff>;
                bank-width = <2>;
                gpmc,mux-add-data;
-                gpmc,cs-on-ns = <0>;
+                gpmc,cs-on-ns = <1>;
-                gpmc,cs-rd-off-ns = <186>;
+                gpmc,cs-rd-off-ns = <180>;
-                gpmc,cs-wr-off-ns = <186>;
+                gpmc,cs-wr-off-ns = <180>;
-                gpmc,adv-on-ns = <12>;
+                gpmc,adv-rd-off-ns = <18>;
-                gpmc,adv-rd-off-ns = <48>;
                gpmc,adv-wr-off-ns = <48>;
                gpmc,oe-on-ns = <54>;
                gpmc,oe-off-ns = <168>;
@@ -49,16 +34,14 @@
                gpmc,we-off-ns = <168>;
                gpmc,rd-cycle-ns = <186>;
                gpmc,wr-cycle-ns = <186>;
-                gpmc,access-ns = <114>;
+                gpmc,access-ns = <144>;
-                gpmc,page-burst-access-ns = <6>;
+                gpmc,page-burst-access-ns = <24>;
-                gpmc,bus-turnaround-ns = <12>;
+                gpmc,bus-turnaround-ns = <90>;
-                gpmc,cycle2cycle-delay-ns = <18>;
+                gpmc,cycle2cycle-delay-ns = <90>;
-                gpmc,wr-data-mux-bus-ns = <90>;
-                gpmc,wr-access-ns = <186>;
                gpmc,cycle2cycle-samecsen;
                gpmc,cycle2cycle-diffcsen;
-                vddvario-supply = <&vddvario_sb_t35>;
+                vddvario-supply = <&vddvario>;
-                vdd33a-supply = <&vdd33a_sb_t35>;
+                vdd33a-supply = <&vdd33a>;
                reg-io-width = <4>;
                smsc,save-mac-address;
        };
diff --git a/arch/arm/boot/dts/omap3-sbc-t3517.dts b/arch/arm/boot/dts/omap3-sbc-t3517.dts
index 024c9c6c682d..42189b65d393 100644
--- a/arch/arm/boot/dts/omap3-sbc-t3517.dts
+++ b/arch/arm/boot/dts/omap3-sbc-t3517.dts
@@ -8,6 +8,19 @@
 / {
        model = "CompuLab SBC-T3517 with CM-T3517";
        compatible = "compulab,omap3-sbc-t3517", "compulab,omap3-cm-t3517", "ti,am3517", "ti,omap3";
+        /* Only one GPMC smsc9220 on SBC-T3517, CM-T3517 uses am35x Ethernet */
+        vddvario: regulator-vddvario-sb-t35 {
+                compatible = "regulator-fixed";
+                regulator-name = "vddvario";
+                regulator-always-on;
+        };
+        vdd33a: regulator-vdd33a-sb-t35 {
+                compatible = "regulator-fixed";
+                regulator-name = "vdd33a";
+                regulator-always-on;
+        };
 };
 &omap3_pmx_core {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 5e5790f631eb..4231191ade06 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -61,7 +61,7 @@
                        ti,hwmods = "mpu";
                };
-                iva {
+                iva: iva {
                        compatible = "ti,iva2.2";
                        ti,hwmods = "iva";
@@ -74,7 +74,7 @@
        /*
         * XXX: Use a flat representation of the OMAP3 interconnect.
         * The real OMAP interconnect network is quite complex.
-         * Since that will not bring real advantage to represent that in DT for
+         * Since it will not bring real advantage to represent that in DT for
         * the moment, just use a fake OCP bus entry to represent the whole bus
         * hierarchy.
         */
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 27fcac874742..649b5cd38b40 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -72,7 +72,7 @@
        };
        /*
-         * The soc node represents the soc top level view. It is uses for IPs
+         * The soc node represents the soc top level view. It is used for IPs
         * that are not memory mapped in the MPU view or for the MPU itself.
         */
        soc {
@@ -96,7 +96,7 @@
        /*
         * XXX: Use a flat representation of the OMAP4 interconnect.
         * The real OMAP interconnect network is quite complex.
-         * Since that will not bring real advantage to represent that in DT for
+         * Since it will not bring real advantage to represent that in DT for
         * the moment, just use a fake OCP bus entry to represent the whole bus
         * hierarchy.
         */
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 6f3de22fb266..36b4312a5e0d 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -93,7 +93,7 @@
        };
        /*
-         * The soc node represents the soc top level view. It is uses for IPs
+         * The soc node represents the soc top level view. It is used for IPs
         * that are not memory mapped in the MPU view or for the MPU itself.
         */
        soc {
@@ -107,7 +107,7 @@
        /*
         * XXX: Use a flat representation of the OMAP3 interconnect.
         * The real OMAP interconnect network is quite complex.
-         * Since that will not bring real advantage to represent that in DT for
+         * Since it will not bring real advantage to represent that in DT for
         * the moment, just use a fake OCP bus entry to represent the whole bus
         * hierarchy.
         */
@@ -630,6 +630,13 @@
                        status = "disabled";
                };
+                mailbox: mailbox@4a0f4000 {
+                        compatible = "ti,omap4-mailbox";
+                        reg = <0x4a0f4000 0x200>;
+                        interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+                        ti,hwmods = "mailbox";
+                };
                timer1: timer@4ae18000 {
                        compatible = "ti,omap5430-timer";
                        reg = <0x4ae18000 0x80>;
@@ -813,6 +820,12 @@
                                      <0x4a084c00 0x40>;
                                reg-names = "phy_rx", "phy_tx", "pll_ctrl";
                                ctrl-module = <&omap_control_usb3phy>;
+                                clocks = <&usb_phy_cm_clk32k>,
+                                         <&sys_clkin>,
+                                         <&usb_otg_ss_refclk960m>;
+                                clock-names =   "wkupclk",
+                                                "sysclk",
+                                                "refclk";
                                #phy-cells = <0>;
                        };
                };
diff --git a/arch/arm/boot/dts/r8a7740.dtsi b/arch/arm/boot/dts/r8a7740.dtsi
index 8280884bfa59..2551e9438d35 100644
--- a/arch/arm/boot/dts/r8a7740.dtsi
+++ b/arch/arm/boot/dts/r8a7740.dtsi
@@ -28,7 +28,6 @@
        gic: interrupt-controller@c2800000 {
                compatible = "arm,cortex-a9-gic";
                #interrupt-cells = <3>;
-                #address-cells = <1>;
                interrupt-controller;
                reg = <0xc2800000 0x1000>,
                      <0xc2000000 0x1000>;
diff --git a/arch/arm/boot/dts/r8a7790-lager.dts b/arch/arm/boot/dts/r8a7790-lager.dts
index 6e99eb2df076..d01048ab3e77 100644
--- a/arch/arm/boot/dts/r8a7790-lager.dts
+++ b/arch/arm/boot/dts/r8a7790-lager.dts
@@ -141,12 +141,12 @@
        };
        sdhi0_pins: sd0 {
-                renesas,gpios = "sdhi0_data4", "sdhi0_ctrl";
+                renesas,groups = "sdhi0_data4", "sdhi0_ctrl";
                renesas,function = "sdhi0";
        };
        sdhi2_pins: sd2 {
-                renesas,gpios = "sdhi2_data4", "sdhi2_ctrl";
+                renesas,groups = "sdhi2_data4", "sdhi2_ctrl";
                renesas,function = "sdhi2";
        };
diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts
index bdd73e6657b2..de1b6977c69a 100644
--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
+++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
@@ -230,17 +230,17 @@
        };
        sdhi0_pins: sd0 {
-                renesas,gpios = "sdhi0_data4", "sdhi0_ctrl";
+                renesas,groups = "sdhi0_data4", "sdhi0_ctrl";
                renesas,function = "sdhi0";
        };
        sdhi1_pins: sd1 {
-                renesas,gpios = "sdhi1_data4", "sdhi1_ctrl";
+                renesas,groups = "sdhi1_data4", "sdhi1_ctrl";
                renesas,function = "sdhi1";
        };
        sdhi2_pins: sd2 {
-                renesas,gpios = "sdhi2_data4", "sdhi2_ctrl";
+                renesas,groups = "sdhi2_data4", "sdhi2_ctrl";
                renesas,function = "sdhi2";
        };
diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi
index bb36596ea205..ed9a70af3e3f 100644
--- a/arch/arm/boot/dts/rk3188.dtsi
+++ b/arch/arm/boot/dts/rk3188.dtsi
@@ -149,7 +149,7 @@
                        uart0 {
                                uart0_xfer: uart0-xfer {
-                                        rockchip,pins = <RK_GPIO1 0 RK_FUNC_1 &pcfg_pull_none>,
+                                        rockchip,pins = <RK_GPIO1 0 RK_FUNC_1 &pcfg_pull_up>,
                                                        <RK_GPIO1 1 RK_FUNC_1 &pcfg_pull_none>;
                                };
@@ -164,7 +164,7 @@
                        uart1 {
                                uart1_xfer: uart1-xfer {
-                                        rockchip,pins = <RK_GPIO1 4 RK_FUNC_1 &pcfg_pull_none>,
+                                        rockchip,pins = <RK_GPIO1 4 RK_FUNC_1 &pcfg_pull_up>,
                                                        <RK_GPIO1 5 RK_FUNC_1 &pcfg_pull_none>;
                                };
@@ -179,7 +179,7 @@
                        uart2 {
                                uart2_xfer: uart2-xfer {
-                                        rockchip,pins = <RK_GPIO1 8 RK_FUNC_1 &pcfg_pull_none>,
+                                        rockchip,pins = <RK_GPIO1 8 RK_FUNC_1 &pcfg_pull_up>,
                                                        <RK_GPIO1 9 RK_FUNC_1 &pcfg_pull_none>;
                                };
                                /* no rts / cts for uart2 */
@@ -187,7 +187,7 @@
                        uart3 {
                                uart3_xfer: uart3-xfer {
-                                        rockchip,pins = <RK_GPIO1 10 RK_FUNC_1 &pcfg_pull_none>,
+                                        rockchip,pins = <RK_GPIO1 10 RK_FUNC_1 &pcfg_pull_up>,
                                                        <RK_GPIO1 11 RK_FUNC_1 &pcfg_pull_none>;
                                };
diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
index eabcfdbb403a..a106b0872910 100644
--- a/arch/arm/boot/dts/sama5d3.dtsi
+++ b/arch/arm/boot/dts/sama5d3.dtsi
@@ -13,7 +13,7 @@
 #include <dt-bindings/pinctrl/at91.h>
 #include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/clk/at91.h>
+#include <dt-bindings/clock/at91.h>
 / {
        model = "Atmel SAMA5D3 family SoC";
diff --git a/arch/arm/boot/dts/sama5d3_mci2.dtsi b/arch/arm/boot/dts/sama5d3_mci2.dtsi
index b029fe7ef17a..1b02208ea6ff 100644
--- a/arch/arm/boot/dts/sama5d3_mci2.dtsi
+++ b/arch/arm/boot/dts/sama5d3_mci2.dtsi
@@ -9,7 +9,7 @@
 #include <dt-bindings/pinctrl/at91.h>
 #include <dt-bindings/interrupt-controller/irq.h>
-#include <dt-bindings/clk/at91.h>
+#include <dt-bindings/clock/at91.h>
 / {
        ahb {
diff --git a/arch/arm/boot/dts/sama5d3_tcb1.dtsi b/arch/arm/boot/dts/sama5d3_tcb1.dtsi
index 382b04431f66..02848453ca0c 100644
--- a/arch/arm/boot/dts/sama5d3_tcb1.dtsi
+++ b/arch/arm/boot/dts/sama5d3_tcb1.dtsi
@@ -9,7 +9,7 @@
 #include <dt-bindings/pinctrl/at91.h>
 #include <dt-bindings/interrupt-controller/irq.h>
-#include <dt-bindings/clk/at91.h>
+#include <dt-bindings/clock/at91.h>
 / {
        aliases {
diff --git a/arch/arm/boot/dts/sama5d3_uart.dtsi b/arch/arm/boot/dts/sama5d3_uart.dtsi
index a9fa75e41652..7a8d4c6115f7 100644
--- a/arch/arm/boot/dts/sama5d3_uart.dtsi
+++ b/arch/arm/boot/dts/sama5d3_uart.dtsi
@@ -9,7 +9,7 @@
 #include <dt-bindings/pinctrl/at91.h>
 #include <dt-bindings/interrupt-controller/irq.h>
-#include <dt-bindings/clk/at91.h>
+#include <dt-bindings/clock/at91.h>
 / {
        aliases {
diff --git a/arch/arm/boot/dts/sh73a0.dtsi b/arch/arm/boot/dts/sh73a0.dtsi
index b7bd3b9a6753..5ecf552e1c00 100644
--- a/arch/arm/boot/dts/sh73a0.dtsi
+++ b/arch/arm/boot/dts/sh73a0.dtsi
@@ -34,7 +34,6 @@
        gic: interrupt-controller@f0001000 {
                compatible = "arm,cortex-a9-gic";
                #interrupt-cells = <3>;
-                #address-cells = <1>;
                interrupt-controller;
                reg = <0xf0001000 0x1000>,
                      <0xf0000100 0x100>;
diff --git a/arch/arm/boot/dts/ste-ccu8540.dts b/arch/arm/boot/dts/ste-ccu8540.dts
index 7f3baf51a3a9..32dd55e5f4e6 100644
--- a/arch/arm/boot/dts/ste-ccu8540.dts
+++ b/arch/arm/boot/dts/ste-ccu8540.dts
@@ -18,6 +18,7 @@
        compatible = "st-ericsson,ccu8540", "st-ericsson,u8540";
        memory@0 {
+                device_type = "memory";
                reg = <0x20000000 0x1f000000>, <0xc0000000 0x3f000000>;
        };
diff --git a/arch/arm/boot/dts/stih415-pinctrl.dtsi b/arch/arm/boot/dts/stih415-pinctrl.dtsi
index f09fb10a3791..81df870e5ee6 100644
--- a/arch/arm/boot/dts/stih415-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stih415-pinctrl.dtsi
@@ -49,7 +49,7 @@
                        reg             = <0xfe61f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfe610000 0x5000>;
                        PIO0: gpio@fe610000 {
@@ -187,7 +187,7 @@
                        reg             = <0xfee0f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfee00000 0x8000>;
                        PIO5: gpio@fee00000 {
@@ -282,7 +282,7 @@
                        reg             = <0xfe82f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfe820000 0x8000>;
                        PIO13: gpio@fe820000 {
@@ -423,7 +423,7 @@
                        reg             = <0xfd6bf080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfd6b0000 0x3000>;
                        PIO100: gpio@fd6b0000 {
@@ -460,7 +460,7 @@
                        reg             = <0xfd33f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfd330000 0x5000>;
                        PIO103: gpio@fd330000 {
diff --git a/arch/arm/boot/dts/stih416-pinctrl.dtsi b/arch/arm/boot/dts/stih416-pinctrl.dtsi
index aeea304086eb..250d5ecc951e 100644
--- a/arch/arm/boot/dts/stih416-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stih416-pinctrl.dtsi
@@ -53,7 +53,7 @@
                        reg             = <0xfe61f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfe610000 0x6000>;
                        PIO0: gpio@fe610000 {
@@ -201,7 +201,7 @@
                        reg             = <0xfee0f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfee00000 0x10000>;
                        PIO5: gpio@fee00000 {
@@ -333,7 +333,7 @@
                        reg             = <0xfe82f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfe820000 0x6000>;
                        PIO13: gpio@fe820000 {
@@ -461,7 +461,7 @@
                        reg             = <0xfd6bf080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges          = <0 0xfd6b0000 0x3000>;
                        PIO100: gpio@fd6b0000 {
@@ -498,7 +498,7 @@
                        reg             = <0xfd33f080 0x4>;
                        reg-names       = "irqmux";
                        interrupts      = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
-                        interrupts-names = "irqmux";
+                        interrupt-names = "irqmux";
                        ranges                  = <0 0xfd330000 0x5000>;
                        PIO103: gpio@fd330000 {
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 32efc105df83..aba1c8a3f388 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -87,7 +87,7 @@
                pll4: clk@01c20018 {
                        #clock-cells = <0>;
-                        compatible = "allwinner,sun4i-a10-pll1-clk";
+                        compatible = "allwinner,sun7i-a20-pll4-clk";
                        reg = <0x01c20018 0x4>;
                        clocks = <&osc24M>;
                        clock-output-names = "pll4";
@@ -109,6 +109,14 @@
                        clock-output-names = "pll6_sata", "pll6_other", "pll6";
                };
+                pll8: clk@01c20040 {
+                        #clock-cells = <0>;
+                        compatible = "allwinner,sun7i-a20-pll4-clk";
+                        reg = <0x01c20040 0x4>;
+                        clocks = <&osc24M>;
+                        clock-output-names = "pll8";
+                };
                cpu: cpu@01c20054 {
                        #clock-cells = <0>;
                        compatible = "allwinner,sun4i-a10-cpu-clk";
@@ -805,9 +813,9 @@
                        status = "disabled";
                };
-                i2c4: i2c@01c2bc00 {
+                i2c4: i2c@01c2c000 {
                        compatible = "allwinner,sun4i-i2c";
-                        reg = <0x01c2bc00 0x400>;
+                        reg = <0x01c2c000 0x400>;
                        interrupts = <0 89 4>;
                        clocks = <&apb1_gates 15>;
                        clock-frequency = <100000>;
diff --git a/arch/arm/boot/dts/tegra124.dtsi b/arch/arm/boot/dts/tegra124.dtsi
index cf45a1a39483..6d540a025148 100644
--- a/arch/arm/boot/dts/tegra124.dtsi
+++ b/arch/arm/boot/dts/tegra124.dtsi
@@ -233,19 +233,6 @@
                status = "disabled";
        };
-        serial@0,70006400 {
-                compatible = "nvidia,tegra124-uart", "nvidia,tegra20-uart";
-                reg = <0x0 0x70006400 0x0 0x40>;
-                reg-shift = <2>;
-                interrupts = <GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>;
-                clocks = <&tegra_car TEGRA124_CLK_UARTE>;
-                resets = <&tegra_car 66>;
-                reset-names = "serial";
-                dmas = <&apbdma 20>, <&apbdma 20>;
-                dma-names = "rx", "tx";
-                status = "disabled";
-        };
        pwm@0,7000a000 {
                compatible = "nvidia,tegra124-pwm", "nvidia,tegra20-pwm";
                reg = <0x0 0x7000a000 0x0 0x100>;
diff --git a/arch/arm/boot/dts/vf610-twr.dts b/arch/arm/boot/dts/vf610-twr.dts
index 7dd1d6ede525..ded361075aab 100644
--- a/arch/arm/boot/dts/vf610-twr.dts
+++ b/arch/arm/boot/dts/vf610-twr.dts
@@ -25,11 +25,13 @@
        clocks {
                audio_ext {
                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24576000>;
                };
                enet_ext {
                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <50000000>;
                };
        };
diff --git a/arch/arm/boot/dts/vf610.dtsi b/arch/arm/boot/dts/vf610.dtsi
index 804873367669..b8ce0aa7b157 100644
--- a/arch/arm/boot/dts/vf610.dtsi
+++ b/arch/arm/boot/dts/vf610.dtsi
@@ -45,11 +45,13 @@
                sxosc {
                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <32768>;
                };
                fxosc {
                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
                        clock-frequency = <24000000>;
                };
        };
@@ -72,8 +74,6 @@
                        intc: interrupt-controller@40002000 {
                                compatible = "arm,cortex-a9-gic";
                                #interrupt-cells = <3>;
-                                #address-cells = <1>;
-                                #size-cells = <1>;
                                interrupt-controller;
                                reg = <0x40003000 0x1000>,
                                      <0x40002100 0x100>;
diff --git a/arch/arm/boot/dts/zynq-7000.dtsi b/arch/arm/boot/dts/zynq-7000.dtsi
index 511180769af5..c1176abc34d9 100644
--- a/arch/arm/boot/dts/zynq-7000.dtsi
+++ b/arch/arm/boot/dts/zynq-7000.dtsi
@@ -24,6 +24,7 @@
                        device_type = "cpu";
                        reg = <0>;
                        clocks = <&clkc 3>;
+                        clock-latency = <1000>;
                        operating-points = <
                                /* kHz    uV */
                                666667  1000000
@@ -54,6 +55,28 @@
                interrupt-parent = <&intc>;
                ranges;
+                i2c0: zynq-i2c@e0004000 {
+                        compatible = "cdns,i2c-r1p10";
+                        status = "disabled";
+                        clocks = <&clkc 38>;
+                        interrupt-parent = <&intc>;
+                        interrupts = <0 25 4>;
+                        reg = <0xe0004000 0x1000>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                };
+                i2c1: zynq-i2c@e0005000 {
+                        compatible = "cdns,i2c-r1p10";
+                        status = "disabled";
+                        clocks = <&clkc 39>;
+                        interrupt-parent = <&intc>;
+                        interrupts = <0 48 4>;
+                        reg = <0xe0005000 0x1000>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                };
                intc: interrupt-controller@f8f01000 {
                        compatible = "arm,cortex-a9-gic";
                        #interrupt-cells = <3>;
diff --git a/arch/arm/boot/dts/zynq-zc702.dts b/arch/arm/boot/dts/zynq-zc702.dts
index c913f77a21eb..5e09cee33d42 100644
--- a/arch/arm/boot/dts/zynq-zc702.dts
+++ b/arch/arm/boot/dts/zynq-zc702.dts
@@ -34,6 +34,82 @@
        phy-mode = "rgmii";
 };
+&i2c0 {
+        status = "okay";
+        clock-frequency = <400000>;
+        i2cswitch@74 {
+                compatible = "nxp,pca9548";
+                #address-cells = <1>;
+                #size-cells = <0>;
+                reg = <0x74>;
+                i2c@0 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <0>;
+                        si570: clock-generator@5d {
+                                #clock-cells = <0>;
+                                compatible = "silabs,si570";
+                                temperature-stability = <50>;
+                                reg = <0x5d>;
+                                factory-fout = <156250000>;
+                                clock-frequency = <148500000>;
+                        };
+                };
+                i2c@2 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <2>;
+                        eeprom@54 {
+                                compatible = "at,24c08";
+                                reg = <0x54>;
+                        };
+                };
+                i2c@3 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <3>;
+                        gpio@21 {
+                                compatible = "ti,tca6416";
+                                reg = <0x21>;
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                        };
+                };
+                i2c@4 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <4>;
+                        rtc@51 {
+                                compatible = "nxp,pcf8563";
+                                reg = <0x51>;
+                        };
+                };
+                i2c@7 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <7>;
+                        hwmon@52 {
+                                compatible = "ti,ucd9248";
+                                reg = <52>;
+                        };
+                        hwmon@53 {
+                                compatible = "ti,ucd9248";
+                                reg = <53>;
+                        };
+                        hwmon@54 {
+                                compatible = "ti,ucd9248";
+                                reg = <54>;
+                        };
+                };
+        };
+};
 &sdhci0 {
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/zynq-zc706.dts b/arch/arm/boot/dts/zynq-zc706.dts
index 88f62c50382e..4cc9913078cd 100644
--- a/arch/arm/boot/dts/zynq-zc706.dts
+++ b/arch/arm/boot/dts/zynq-zc706.dts
@@ -35,6 +35,74 @@
        phy-mode = "rgmii";
 };
+&i2c0 {
+        status = "okay";
+        clock-frequency = <400000>;
+        i2cswitch@74 {
+                compatible = "nxp,pca9548";
+                #address-cells = <1>;
+                #size-cells = <0>;
+                reg = <0x74>;
+                i2c@0 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <0>;
+                        si570: clock-generator@5d {
+                                #clock-cells = <0>;
+                                compatible = "silabs,si570";
+                                temperature-stability = <50>;
+                                reg = <0x5d>;
+                                factory-fout = <156250000>;
+                                clock-frequency = <148500000>;
+                        };
+                };
+                i2c@2 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <2>;
+                        eeprom@54 {
+                                compatible = "at,24c08";
+                                reg = <0x54>;
+                        };
+                };
+                i2c@3 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <3>;
+                        gpio@21 {
+                                compatible = "ti,tca6416";
+                                reg = <0x21>;
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                        };
+                };
+                i2c@4 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <4>;
+                        rtc@51 {
+                                compatible = "nxp,pcf8563";
+                                reg = <0x51>;
+                        };
+                };
+                i2c@7 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        reg = <7>;
+                        ucd90120@65 {
+                                compatible = "ti,ucd90120";
+                                reg = <0x65>;
+                        };
+                };
+        };
+};
 &sdhci0 {
        status = "okay";
 };
diff --git a/arch/arm/common/bL_switcher.c b/arch/arm/common/bL_switcher.c
index 5774b6ea7ad5..f01c0ee0c87e 100644
--- a/arch/arm/common/bL_switcher.c
+++ b/arch/arm/common/bL_switcher.c
@@ -797,10 +797,8 @@ static int __init bL_switcher_init(void)
 {
        int ret;
-        if (MAX_NR_CLUSTERS != 2) {
+        if (!mcpm_is_available())
-                pr_err("%s: only dual cluster systems are supported\n", __func__);
+                return -ENODEV;
-                return -EINVAL;
-        }
        cpu_notifier(bL_switcher_hotplug_callback, 0);
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index 41bca32409fc..5339009b3c0c 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -1423,55 +1423,38 @@ EXPORT_SYMBOL(edma_clear_event);
 #if IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_DMADEVICES)
-static int edma_of_read_u32_to_s16_array(const struct device_node *np,
+static int edma_xbar_event_map(struct device *dev, struct device_node *node,
-                                         const char *propname, s16 *out_values,
+                               struct edma_soc_info *pdata, size_t sz)
-                                         size_t sz)
 {
-        int ret;
+        const char pname[] = "ti,edma-xbar-event-map";
-        ret = of_property_read_u16_array(np, propname, out_values, sz);
-        if (ret)
-                return ret;
-        /* Terminate it */
-        *out_values++ = -1;
-        *out_values++ = -1;
-        return 0;
-}
-static int edma_xbar_event_map(struct device *dev,
-                               struct device_node *node,
-                               struct edma_soc_info *pdata, int len)
-{
-        int ret, i;
        struct resource res;
        void __iomem *xbar;
-        const s16 (*xbar_chans)[2];
+        s16 (*xbar_chans)[2];
+        size_t nelm = sz / sizeof(s16);
        u32 shift, offset, mux;
+        int ret, i;
-        xbar_chans = devm_kzalloc(dev,
+        xbar_chans = devm_kzalloc(dev, (nelm + 2) * sizeof(s16), GFP_KERNEL);
-                                  len/sizeof(s16) + 2*sizeof(s16),
-                                  GFP_KERNEL);
        if (!xbar_chans)
                return -ENOMEM;
        ret = of_address_to_resource(node, 1, &res);
        if (ret)
-                return -EIO;
+                return -ENOMEM;
        xbar = devm_ioremap(dev, res.start, resource_size(&res));
        if (!xbar)
                return -ENOMEM;
-        ret = edma_of_read_u32_to_s16_array(node,
+        ret = of_property_read_u16_array(node, pname, (u16 *)xbar_chans, nelm);
-                                            "ti,edma-xbar-event-map",
-                                            (s16 *)xbar_chans,
-                                            len/sizeof(u32));
        if (ret)
                return -EIO;
-        for (i = 0; xbar_chans[i][0] != -1; i++) {
+        /* Invalidate last entry for the other user of this mess */
+        nelm >>= 1;
+        xbar_chans[nelm][0] = xbar_chans[nelm][1] = -1;
+        for (i = 0; i < nelm; i++) {
                shift = (xbar_chans[i][1] & 0x03) << 3;
                offset = xbar_chans[i][1] & 0xfffffffc;
                mux = readl(xbar + offset);
@@ -1480,8 +1463,7 @@ static int edma_xbar_event_map(struct device *dev,
                writel(mux, (xbar + offset));
        }
-        pdata->xbar_chans = xbar_chans;
+        pdata->xbar_chans = (const s16 (*)[2]) xbar_chans;
        return 0;
 }
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index 1e361abc29eb..86fd60fefbc9 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -48,6 +48,11 @@ int __init mcpm_platform_register(const struct mcpm_platform_ops *ops)
        return 0;
 }
+bool mcpm_is_available(void)
+{
+        return (platform_ops) ? true : false;
+}
 int mcpm_cpu_power_up(unsigned int cpu, unsigned int cluster)
 {
        if (!platform_ops)
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index a9667957b757..a4e8d017f25b 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -226,7 +226,7 @@ CONFIG_USB_DWC3=m
 CONFIG_USB_TEST=y
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_OMAP_USB2=y
-CONFIG_OMAP_USB3=y
+CONFIG_TI_PIPE3=y
 CONFIG_AM335X_PHY_USB=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_GADGET_DEBUG=y
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index b5df4a511b0a..81ba78eaf54a 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -37,7 +37,7 @@ CONFIG_SUN4I_EMAC=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SMSC is not set
-# CONFIG_NET_VENDOR_STMICRO is not set
+CONFIG_STMMAC_ETH=y
 # CONFIG_NET_VENDOR_WIZNET is not set
 # CONFIG_WLAN is not set
 CONFIG_SERIAL_8250=y
diff --git a/arch/arm/configs/u300_defconfig b/arch/arm/configs/u300_defconfig
index fd81a1b99cce..aaa95ab606a8 100644
--- a/arch/arm/configs/u300_defconfig
+++ b/arch/arm/configs/u300_defconfig
@@ -11,6 +11,7 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_LBDAF is not set
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
 # CONFIG_IOSCHED_CFQ is not set
 # CONFIG_ARCH_MULTI_V7 is not set
 CONFIG_ARCH_U300=y
@@ -21,7 +22,6 @@ CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
 CONFIG_CMDLINE="root=/dev/ram0 rw rootfstype=rootfs console=ttyAMA0,115200n8 lpj=515072"
 CONFIG_CPU_IDLE=y
-CONFIG_FPE_NWFPE=y
 # CONFIG_SUSPEND is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
@@ -64,8 +64,8 @@ CONFIG_TMPFS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_INFO=y
 CONFIG_DEBUG_FS=y
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_TIMER_STATS=y
 # CONFIG_DEBUG_PREEMPT is not set
-CONFIG_DEBUG_INFO=y
diff --git a/arch/arm/configs/u8500_defconfig b/arch/arm/configs/u8500_defconfig
index 65f77885c167..d219d6a43238 100644
--- a/arch/arm/configs/u8500_defconfig
+++ b/arch/arm/configs/u8500_defconfig
@@ -1,16 +1,16 @@
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
-CONFIG_NO_HZ=y
+CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
 CONFIG_ARCH_U8500=y
 CONFIG_MACH_HREFV60=y
 CONFIG_MACH_SNOWBALL=y
-CONFIG_MACH_UX500_DT=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=2
 CONFIG_PREEMPT=y
@@ -34,16 +34,22 @@ CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_NETFILTER=y
 CONFIG_PHONET=y
-# CONFIG_WIRELESS is not set
+CONFIG_CFG80211=y
+CONFIG_CFG80211_DEBUGFS=y
+CONFIG_MAC80211=y
+CONFIG_MAC80211_LEDS=y
 CONFIG_CAIF=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=65536
 CONFIG_SENSORS_BH1780=y
 CONFIG_NETDEVICES=y
 CONFIG_SMSC911X=y
 CONFIG_SMSC_PHY=y
-# CONFIG_WLAN is not set
+CONFIG_CW1200=y
+CONFIG_CW1200_WLAN_SDIO=y
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_EVDEV=y
 # CONFIG_KEYBOARD_ATKBD is not set
@@ -85,15 +91,12 @@ CONFIG_AB8500_USB=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_ETH=m
 CONFIG_MMC=y
-CONFIG_MMC_UNSAFE_RESUME=y
-# CONFIG_MMC_BLOCK_BOUNCE is not set
 CONFIG_MMC_ARMMMCI=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_LM3530=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_LP5521=y
-CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_AB8500=y
@@ -103,6 +106,11 @@ CONFIG_STE_DMA40=y
 CONFIG_STAGING=y
 CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4=y
 CONFIG_HSEM_U8500=y
+CONFIG_IIO=y
+CONFIG_IIO_ST_ACCEL_3AXIS=y
+CONFIG_IIO_ST_GYRO_3AXIS=y
+CONFIG_IIO_ST_MAGN_3AXIS=y
+CONFIG_IIO_ST_PRESS=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_XATTR=y
 CONFIG_EXT2_FS_POSIX_ACL=y
@@ -110,8 +118,6 @@ CONFIG_EXT2_FS_SECURITY=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS=y
 CONFIG_VFAT_FS=y
-CONFIG_DEVTMPFS=y
-CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_MISC_FILESYSTEMS is not set
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index c651e3b26ec7..4764344367d4 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -222,22 +222,22 @@ static inline int cpu_is_xsc3(void)
 #endif
 /*
- * Marvell's PJ4 core is based on V7 version. It has some modification
+ * Marvell's PJ4 and PJ4B cores are based on V7 version,
- * for coprocessor setting. For this reason, we need a way to distinguish
+ * but require a specical sequence for enabling coprocessors.
- * it.
+ * For this reason, we need a way to distinguish them.
 */
-#ifndef CONFIG_CPU_PJ4
+#if defined(CONFIG_CPU_PJ4) || defined(CONFIG_CPU_PJ4B)
-#define cpu_is_pj4()    0
-#else
 static inline int cpu_is_pj4(void)
 {
        unsigned int id;
        id = read_cpuid_id();
-        if ((id & 0xfffffff0) == 0x562f5840)
+        if ((id & 0xff0fff00) == 0x560f5800)
                return 1;
        return 0;
 }
+#else
+#define cpu_is_pj4()    0
 #endif
 #endif
diff --git a/arch/arm/include/asm/div64.h b/arch/arm/include/asm/div64.h
index 191ada6e4d2d..662c7bd06108 100644
--- a/arch/arm/include/asm/div64.h
+++ b/arch/arm/include/asm/div64.h
@@ -156,7 +156,7 @@
                /* Select the best insn combination to perform the   */ \
                /* actual __m * __n / (__p << 64) operation.         */ \
                if (!__c) {                                             \
-                        asm (   "umull  %Q0, %R0, %1, %Q2\n\t"          \
+                        asm (   "umull  %Q0, %R0, %Q1, %Q2\n\t"         \
                                "mov    %Q0, #0"                        \
                                : "=&r" (__res)                         \
                                : "r" (__m), "r" (__n)                  \
diff --git a/arch/arm/include/asm/mcpm.h b/arch/arm/include/asm/mcpm.h
index 608516ebabfe..a5ff410dcdb6 100644
--- a/arch/arm/include/asm/mcpm.h
+++ b/arch/arm/include/asm/mcpm.h
@@ -54,6 +54,13 @@ void mcpm_set_early_poke(unsigned cpu, unsigned cluster,
 */
 /**
+ * mcpm_is_available - returns whether MCPM is initialized and available
+ *
+ * This returns true or false accordingly.
+ */
+bool mcpm_is_available(void);
+/**
 * mcpm_cpu_power_up - make given CPU in given cluster runable
 *
 * @cpu: CPU number within given cluster
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 0baf7f0d9394..f1a0dace3efe 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -98,15 +98,25 @@ static inline void __tlb_alloc_page(struct mmu_gather *tlb)
        }
 }
-static inline void tlb_flush_mmu(struct mmu_gather *tlb)
+static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
 {
        tlb_flush(tlb);
+}
+static inline void tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
        free_pages_and_swap_cache(tlb->pages, tlb->nr);
        tlb->nr = 0;
        if (tlb->pages == tlb->local)
                __tlb_alloc_page(tlb);
 }
+static inline void tlb_flush_mmu(struct mmu_gather *tlb)
+{
+        tlb_flush_mmu_tlbonly(tlb);
+        tlb_flush_mmu_free(tlb);
+}
 static inline void
 tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
 {
diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
index cf4f3e867395..ded062f9b358 100644
--- a/arch/arm/include/asm/xen/page.h
+++ b/arch/arm/include/asm/xen/page.h
@@ -77,7 +77,6 @@ static inline xpaddr_t machine_to_phys(xmaddr_t machine)
 }
 /* VIRT <-> MACHINE conversion */
 #define virt_to_machine(v)      (phys_to_machine(XPADDR(__pa(v))))
-#define virt_to_pfn(v)          (PFN_DOWN(__pa(v)))
 #define virt_to_mfn(v)          (pfn_to_mfn(virt_to_pfn(v)))
 #define mfn_to_virt(m)          (__va(mfn_to_pfn(m) << PAGE_SHIFT))
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index fb5584d0cc05..ba94446c72d9 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -408,6 +408,7 @@
 #define __NR_finit_module               (__NR_SYSCALL_BASE+379)
 #define __NR_sched_setattr              (__NR_SYSCALL_BASE+380)
 #define __NR_sched_getattr              (__NR_SYSCALL_BASE+381)
+#define __NR_renameat2                  (__NR_SYSCALL_BASE+382)
 /*
 * This may need to be greater than __NR_last_syscall+1 in order to
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index a766bcbaf8ad..040619c32d68 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -79,6 +79,7 @@ obj-$(CONFIG_CPU_XSCALE)	+= xscale-cp0.o
 obj-$(CONFIG_CPU_XSC3)          += xscale-cp0.o
 obj-$(CONFIG_CPU_MOHAWK)        += xscale-cp0.o
 obj-$(CONFIG_CPU_PJ4)           += pj4-cp0.o
+obj-$(CONFIG_CPU_PJ4B)          += pj4-cp0.o
 obj-$(CONFIG_IWMMXT)            += iwmmxt.o
 obj-$(CONFIG_PERF_EVENTS)       += perf_regs.o
 obj-$(CONFIG_HW_PERF_EVENTS)    += perf_event.o perf_event_cpu.o
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 166e945de832..8f51bdcdacbb 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -391,6 +391,7 @@
                CALL(sys_finit_module)
 /* 380 */       CALL(sys_sched_setattr)
                CALL(sys_sched_getattr)
+                CALL(sys_renameat2)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f8c08839edf3..591d6e4a6492 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -587,7 +587,7 @@ __fixup_pv_table:
        add     r6, r6, r3      @ adjust __pv_phys_pfn_offset address
        add     r7, r7, r3      @ adjust __pv_offset address
        mov     r0, r8, lsr #12 @ convert to PFN
-        str     r0, [r6, #LOW_OFFSET]   @ save computed PHYS_OFFSET to __pv_phys_pfn_offset
+        str     r0, [r6]        @ save computed PHYS_OFFSET to __pv_phys_pfn_offset
        strcc   ip, [r7, #HIGH_OFFSET]  @ save to __pv_offset high bits
        mov     r6, r3, lsr #24 @ constant for add/sub instructions
        teq     r3, r6, lsl #24 @ must be 16MiB aligned
diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
index a08783823b32..2452dd1bef53 100644
--- a/arch/arm/kernel/iwmmxt.S
+++ b/arch/arm/kernel/iwmmxt.S
@@ -19,12 +19,16 @@
 #include <asm/thread_info.h>
 #include <asm/asm-offsets.h>
-#if defined(CONFIG_CPU_PJ4)
+#if defined(CONFIG_CPU_PJ4) || defined(CONFIG_CPU_PJ4B)
 #define PJ4(code...)            code
 #define XSC(code...)
-#else
+#elif defined(CONFIG_CPU_MOHAWK) || \
+        defined(CONFIG_CPU_XSC3) || \
+        defined(CONFIG_CPU_XSCALE)
 #define PJ4(code...)
 #define XSC(code...)            code
+#else
+#error "Unsupported iWMMXt architecture"
 #endif
 #define MMX_WR0                 (0x00)
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index f0d180d8b29f..8cf0996aa1a8 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -184,3 +184,10 @@ void machine_kexec(struct kimage *image)
        soft_restart(reboot_entry_phys);
 }
+void arch_crash_save_vmcoreinfo(void)
+{
+#ifdef CONFIG_ARM_LPAE
+        VMCOREINFO_CONFIG(ARM_LPAE);
+#endif
+}
diff --git a/arch/arm/kernel/pj4-cp0.c b/arch/arm/kernel/pj4-cp0.c
index fc7208636284..8153e36b2491 100644
--- a/arch/arm/kernel/pj4-cp0.c
+++ b/arch/arm/kernel/pj4-cp0.c
@@ -45,7 +45,7 @@ static int iwmmxt_do(struct notifier_block *self, unsigned long cmd, void *t)
        return NOTIFY_DONE;
 }
-static struct notifier_block iwmmxt_notifier_block = {
+static struct notifier_block __maybe_unused iwmmxt_notifier_block = {
        .notifier_call  = iwmmxt_do,
 };
@@ -72,6 +72,33 @@ static void __init pj4_cp_access_write(u32 value)
                : "=r" (temp) : "r" (value));
 }
+static int __init pj4_get_iwmmxt_version(void)
+{
+        u32 cp_access, wcid;
+        cp_access = pj4_cp_access_read();
+        pj4_cp_access_write(cp_access | 0xf);
+        /* check if coprocessor 0 and 1 are available */
+        if ((pj4_cp_access_read() & 0xf) != 0xf) {
+                pj4_cp_access_write(cp_access);
+                return -ENODEV;
+        }
+        /* read iWMMXt coprocessor id register p1, c0 */
+        __asm__ __volatile__ ("mrc    p1, 0, %0, c0, c0, 0\n" : "=r" (wcid));
+        pj4_cp_access_write(cp_access);
+        /* iWMMXt v1 */
+        if ((wcid & 0xffffff00) == 0x56051000)
+                return 1;
+        /* iWMMXt v2 */
+        if ((wcid & 0xffffff00) == 0x56052000)
+                return 2;
+        return -EINVAL;
+}
 /*
 * Disable CP0/CP1 on boot, and let call_fpe() and the iWMMXt lazy
@@ -79,17 +106,26 @@ static void __init pj4_cp_access_write(u32 value)
 */
 static int __init pj4_cp0_init(void)
 {
-        u32 cp_access;
+        u32 __maybe_unused cp_access;
+        int vers;
        if (!cpu_is_pj4())
                return 0;
+        vers = pj4_get_iwmmxt_version();
+        if (vers < 0)
+                return 0;
+#ifndef CONFIG_IWMMXT
+        pr_info("PJ4 iWMMXt coprocessor detected, but kernel support is missing.\n");
+#else
        cp_access = pj4_cp_access_read() & ~0xf;
        pj4_cp_access_write(cp_access);
-        printk(KERN_INFO "PJ4 iWMMXt coprocessor enabled.\n");
+        pr_info("PJ4 iWMMXt v%d coprocessor enabled.\n", vers);
        elf_hwcap |= HWCAP_IWMMXT;
        thread_register_notifier(&iwmmxt_notifier_block);
+#endif
        return 0;
 }
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index 702bd329d9d0..e90a3148f385 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -203,9 +203,9 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
        int ret;
        switch (cmd) {
-        case F_GETLKP:
+        case F_OFD_GETLK:
-        case F_SETLKP:
+        case F_OFD_SETLK:
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
        case F_GETLK64:
        case F_SETLK64:
        case F_SETLKW64:
diff --git a/arch/arm/kvm/Kconfig b/arch/arm/kvm/Kconfig
index 466bd299b1a8..4be5bb150bdd 100644
--- a/arch/arm/kvm/Kconfig
+++ b/arch/arm/kvm/Kconfig
@@ -23,7 +23,7 @@ config KVM
        select HAVE_KVM_CPU_RELAX_INTERCEPT
        select KVM_MMIO
        select KVM_ARM_HOST
-        depends on ARM_VIRT_EXT && ARM_LPAE
+        depends on ARM_VIRT_EXT && ARM_LPAE && !CPU_BIG_ENDIAN
        ---help---
          Support hosting virtualized guest machines. You will also
          need to select one or more of the processor modules below.
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 80bb1e6c2c29..16f804938b8f 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -42,6 +42,8 @@ static unsigned long hyp_idmap_start;
 static unsigned long hyp_idmap_end;
 static phys_addr_t hyp_idmap_vector;
+#define pgd_order get_order(PTRS_PER_PGD * sizeof(pgd_t))
 #define kvm_pmd_huge(_x)        (pmd_huge(_x) || pmd_trans_huge(_x))
 static void kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
@@ -293,14 +295,14 @@ void free_boot_hyp_pgd(void)
        if (boot_hyp_pgd) {
                unmap_range(NULL, boot_hyp_pgd, hyp_idmap_start, PAGE_SIZE);
                unmap_range(NULL, boot_hyp_pgd, TRAMPOLINE_VA, PAGE_SIZE);
-                kfree(boot_hyp_pgd);
+                free_pages((unsigned long)boot_hyp_pgd, pgd_order);
                boot_hyp_pgd = NULL;
        }
        if (hyp_pgd)
                unmap_range(NULL, hyp_pgd, TRAMPOLINE_VA, PAGE_SIZE);
-        kfree(init_bounce_page);
+        free_page((unsigned long)init_bounce_page);
        init_bounce_page = NULL;
        mutex_unlock(&kvm_hyp_pgd_mutex);
@@ -330,7 +332,7 @@ void free_hyp_pgds(void)
                for (addr = VMALLOC_START; is_vmalloc_addr((void*)addr); addr += PGDIR_SIZE)
                        unmap_range(NULL, hyp_pgd, KERN_TO_HYP(addr), PGDIR_SIZE);
-                kfree(hyp_pgd);
+                free_pages((unsigned long)hyp_pgd, pgd_order);
                hyp_pgd = NULL;
        }
@@ -1024,7 +1026,7 @@ int kvm_mmu_init(void)
                size_t len = __hyp_idmap_text_end - __hyp_idmap_text_start;
                phys_addr_t phys_base;
-                init_bounce_page = kmalloc(PAGE_SIZE, GFP_KERNEL);
+                init_bounce_page = (void *)__get_free_page(GFP_KERNEL);
                if (!init_bounce_page) {
                        kvm_err("Couldn't allocate HYP init bounce page\n");
                        err = -ENOMEM;
@@ -1050,8 +1052,9 @@ int kvm_mmu_init(void)
                         (unsigned long)phys_base);
        }
-        hyp_pgd = kzalloc(PTRS_PER_PGD * sizeof(pgd_t), GFP_KERNEL);
+        hyp_pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, pgd_order);
-        boot_hyp_pgd = kzalloc(PTRS_PER_PGD * sizeof(pgd_t), GFP_KERNEL);
+        boot_hyp_pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, pgd_order);
        if (!hyp_pgd || !boot_hyp_pgd) {
                kvm_err("Hyp mode PGD not allocated\n");
                err = -ENOMEM;
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index 8b1b0a870025..a0282928e9c1 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -1296,7 +1296,7 @@ static struct resource adc_resources[] = {
 };
 static struct platform_device at91_adc_device = {
-        .name           = "at91_adc",
+        .name           = "at91sam9260-adc",
        .id             = -1,
        .dev            = {
                                .platform_data          = &adc_data,
diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
index 77b04c2edd78..dab362c06487 100644
--- a/arch/arm/mach-at91/at91sam9g45_devices.c
+++ b/arch/arm/mach-at91/at91sam9g45_devices.c
@@ -1204,7 +1204,7 @@ static struct resource adc_resources[] = {
 };
 static struct platform_device at91_adc_device = {
-        .name           = "at91_adc",
+        .name           = "at91sam9g45-adc",
        .id             = -1,
        .dev            = {
                                .platform_data  = &adc_data,
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index b0e7f9d2c245..2b4d6acfa34a 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -208,8 +208,8 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
         * the "output_enable" bit as a gate, even though it's really just
         * enabling clock output.
         */
-        clk[lvds1_gate] = imx_clk_gate("lvds1_gate", "dummy", base + 0x160, 10);
+        clk[lvds1_gate] = imx_clk_gate("lvds1_gate", "lvds1_sel", base + 0x160, 10);
-        clk[lvds2_gate] = imx_clk_gate("lvds2_gate", "dummy", base + 0x160, 11);
+        clk[lvds2_gate] = imx_clk_gate("lvds2_gate", "lvds2_sel", base + 0x160, 11);
        /*                                name              parent_name        reg       idx */
        clk[pll2_pfd0_352m] = imx_clk_pfd("pll2_pfd0_352m", "pll2_bus",     base + 0x100, 0);
@@ -258,14 +258,14 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
        clk[ipu2_sel]         = imx_clk_mux("ipu2_sel",         base + 0x3c, 14, 2, ipu_sels,          ARRAY_SIZE(ipu_sels));
        clk[ldb_di0_sel]      = imx_clk_mux_flags("ldb_di0_sel", base + 0x2c, 9,  3, ldb_di_sels,      ARRAY_SIZE(ldb_di_sels), CLK_SET_RATE_PARENT);
        clk[ldb_di1_sel]      = imx_clk_mux_flags("ldb_di1_sel", base + 0x2c, 12, 3, ldb_di_sels,      ARRAY_SIZE(ldb_di_sels), CLK_SET_RATE_PARENT);
-        clk[ipu1_di0_pre_sel] = imx_clk_mux("ipu1_di0_pre_sel", base + 0x34, 6,  3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels));
+        clk[ipu1_di0_pre_sel] = imx_clk_mux_flags("ipu1_di0_pre_sel", base + 0x34, 6,  3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels), CLK_SET_RATE_PARENT);
-        clk[ipu1_di1_pre_sel] = imx_clk_mux("ipu1_di1_pre_sel", base + 0x34, 15, 3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels));
+        clk[ipu1_di1_pre_sel] = imx_clk_mux_flags("ipu1_di1_pre_sel", base + 0x34, 15, 3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels), CLK_SET_RATE_PARENT);
-        clk[ipu2_di0_pre_sel] = imx_clk_mux("ipu2_di0_pre_sel", base + 0x38, 6,  3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels));
+        clk[ipu2_di0_pre_sel] = imx_clk_mux_flags("ipu2_di0_pre_sel", base + 0x38, 6,  3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels), CLK_SET_RATE_PARENT);
-        clk[ipu2_di1_pre_sel] = imx_clk_mux("ipu2_di1_pre_sel", base + 0x38, 15, 3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels));
+        clk[ipu2_di1_pre_sel] = imx_clk_mux_flags("ipu2_di1_pre_sel", base + 0x38, 15, 3, ipu_di_pre_sels,   ARRAY_SIZE(ipu_di_pre_sels), CLK_SET_RATE_PARENT);
-        clk[ipu1_di0_sel]     = imx_clk_mux("ipu1_di0_sel",     base + 0x34, 0,  3, ipu1_di0_sels,     ARRAY_SIZE(ipu1_di0_sels));
+        clk[ipu1_di0_sel]     = imx_clk_mux_flags("ipu1_di0_sel",     base + 0x34, 0,  3, ipu1_di0_sels,     ARRAY_SIZE(ipu1_di0_sels), CLK_SET_RATE_PARENT);
-        clk[ipu1_di1_sel]     = imx_clk_mux("ipu1_di1_sel",     base + 0x34, 9,  3, ipu1_di1_sels,     ARRAY_SIZE(ipu1_di1_sels));
+        clk[ipu1_di1_sel]     = imx_clk_mux_flags("ipu1_di1_sel",     base + 0x34, 9,  3, ipu1_di1_sels,     ARRAY_SIZE(ipu1_di1_sels), CLK_SET_RATE_PARENT);
-        clk[ipu2_di0_sel]     = imx_clk_mux("ipu2_di0_sel",     base + 0x38, 0,  3, ipu2_di0_sels,     ARRAY_SIZE(ipu2_di0_sels));
+        clk[ipu2_di0_sel]     = imx_clk_mux_flags("ipu2_di0_sel",     base + 0x38, 0,  3, ipu2_di0_sels,     ARRAY_SIZE(ipu2_di0_sels), CLK_SET_RATE_PARENT);
-        clk[ipu2_di1_sel]     = imx_clk_mux("ipu2_di1_sel",     base + 0x38, 9,  3, ipu2_di1_sels,     ARRAY_SIZE(ipu2_di1_sels));
+        clk[ipu2_di1_sel]     = imx_clk_mux_flags("ipu2_di1_sel",     base + 0x38, 9,  3, ipu2_di1_sels,     ARRAY_SIZE(ipu2_di1_sels), CLK_SET_RATE_PARENT);
        clk[hsi_tx_sel]       = imx_clk_mux("hsi_tx_sel",       base + 0x30, 28, 1, hsi_tx_sels,       ARRAY_SIZE(hsi_tx_sels));
        clk[pcie_axi_sel]     = imx_clk_mux("pcie_axi_sel",     base + 0x18, 10, 1, pcie_axi_sels,     ARRAY_SIZE(pcie_axi_sels));
        clk[ssi1_sel]         = imx_clk_fixup_mux("ssi1_sel",   base + 0x1c, 10, 2, ssi_sels,          ARRAY_SIZE(ssi_sels),          imx_cscmr1_fixup);
@@ -445,6 +445,15 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
                clk_set_parent(clk[ldb_di1_sel], clk[pll5_video_div]);
        }
+        clk_set_parent(clk[ipu1_di0_pre_sel], clk[pll5_video_div]);
+        clk_set_parent(clk[ipu1_di1_pre_sel], clk[pll5_video_div]);
+        clk_set_parent(clk[ipu2_di0_pre_sel], clk[pll5_video_div]);
+        clk_set_parent(clk[ipu2_di1_pre_sel], clk[pll5_video_div]);
+        clk_set_parent(clk[ipu1_di0_sel], clk[ipu1_di0_pre]);
+        clk_set_parent(clk[ipu1_di1_sel], clk[ipu1_di1_pre]);
+        clk_set_parent(clk[ipu2_di0_sel], clk[ipu2_di0_pre]);
+        clk_set_parent(clk[ipu2_di1_sel], clk[ipu2_di1_pre]);
        /*
         * The gpmi needs 100MHz frequency in the EDO/Sync mode,
         * We can not get the 100MHz from the pll2_pfd0_352m.
diff --git a/arch/arm/mach-omap2/board-rx51-video.c b/arch/arm/mach-omap2/board-rx51-video.c
index 43a90c8d6837..9cfebc5c7455 100644
--- a/arch/arm/mach-omap2/board-rx51-video.c
+++ b/arch/arm/mach-omap2/board-rx51-video.c
@@ -48,7 +48,7 @@ static struct omap_dss_board_info rx51_dss_board_info = {
 static int __init rx51_video_init(void)
 {
-        if (!machine_is_nokia_rx51() && !of_machine_is_compatible("nokia,omap3-n900"))
+        if (!machine_is_nokia_rx51())
                return 0;
        if (omap_mux_init_gpio(RX51_LCD_RESET_GPIO, OMAP_PIN_OUTPUT)) {
diff --git a/arch/arm/mach-omap2/clkt_dpll.c b/arch/arm/mach-omap2/clkt_dpll.c
index 2649ce445845..332af927f4d3 100644
--- a/arch/arm/mach-omap2/clkt_dpll.c
+++ b/arch/arm/mach-omap2/clkt_dpll.c
@@ -209,7 +209,7 @@ u8 omap2_init_dpll_parent(struct clk_hw *hw)
                if (v == OMAP3XXX_EN_DPLL_LPBYPASS ||
                    v == OMAP3XXX_EN_DPLL_FRBYPASS)
                        return 1;
-        } else if (soc_is_am33xx() || cpu_is_omap44xx()) {
+        } else if (soc_is_am33xx() || cpu_is_omap44xx() || soc_is_am43xx()) {
                if (v == OMAP4XXX_EN_DPLL_LPBYPASS ||
                    v == OMAP4XXX_EN_DPLL_FRBYPASS ||
                    v == OMAP4XXX_EN_DPLL_MNBYPASS)
@@ -255,7 +255,7 @@ unsigned long omap2_get_dpll_rate(struct clk_hw_omap *clk)
                if (v == OMAP3XXX_EN_DPLL_LPBYPASS ||
                    v == OMAP3XXX_EN_DPLL_FRBYPASS)
                        return __clk_get_rate(dd->clk_bypass);
-        } else if (soc_is_am33xx() || cpu_is_omap44xx()) {
+        } else if (soc_is_am33xx() || cpu_is_omap44xx() || soc_is_am43xx()) {
                if (v == OMAP4XXX_EN_DPLL_LPBYPASS ||
                    v == OMAP4XXX_EN_DPLL_FRBYPASS ||
                    v == OMAP4XXX_EN_DPLL_MNBYPASS)
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index ab43755364f5..9fe8c949305c 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -501,7 +501,7 @@ static int gpmc_cs_delete_mem(int cs)
        int r;
        spin_lock(&gpmc_mem_lock);
-        r = release_resource(&gpmc_cs_mem[cs]);
+        r = release_resource(res);
        res->start = 0;
        res->end = 0;
        spin_unlock(&gpmc_mem_lock);
@@ -527,6 +527,14 @@ static int gpmc_cs_remap(int cs, u32 base)
                pr_err("%s: requested chip-select is disabled\n", __func__);
                return -ENODEV;
        }
+        /*
+         * Make sure we ignore any device offsets from the GPMC partition
+         * allocated for the chip select and that the new base confirms
+         * to the GPMC 16MB minimum granularity.
+         */ 
+        base &= ~(SZ_16M - 1);
        gpmc_cs_get_memconf(cs, &old_base, &size);
        if (base == old_base)
                return 0;
@@ -586,6 +594,8 @@ EXPORT_SYMBOL(gpmc_cs_request);
 void gpmc_cs_free(int cs)
 {
+        struct resource *res = &gpmc_cs_mem[cs];
        spin_lock(&gpmc_mem_lock);
        if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) {
                printk(KERN_ERR "Trying to free non-reserved GPMC CS%d\n", cs);
@@ -594,7 +604,8 @@ void gpmc_cs_free(int cs)
                return;
        }
        gpmc_cs_disable_mem(cs);
-        release_resource(&gpmc_cs_mem[cs]);
+        if (res->flags)
+                release_resource(res);
        gpmc_cs_set_reserved(cs, 0);
        spin_unlock(&gpmc_mem_lock);
 }
diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
index 75e92952c18e..40c5d5f1451c 100644
--- a/arch/arm/mach-omap2/omap-headsmp.S
+++ b/arch/arm/mach-omap2/omap-headsmp.S
@@ -1,7 +1,7 @@
 /*
 * Secondary CPU startup routine source file.
 *
- * Copyright (C) 2009 Texas Instruments, Inc.
+ * Copyright (C) 2009-2014 Texas Instruments, Inc.
 *
 * Author:
 *      Santosh Shilimkar <santosh.shilimkar@ti.com>
@@ -28,9 +28,13 @@
 * code.  This routine also provides a holding flag into which
 * secondary core is held until we're ready for it to initialise.
 * The primary core will update this flag using a hardware
-+ * register AuxCoreBoot0.
+ * register AuxCoreBoot0.
 */
 ENTRY(omap5_secondary_startup)
+.arm
+THUMB( adr     r9, BSYM(wait)  )       @ CPU may be entered in ARM mode.
+THUMB( bx      r9              )       @ If this is a Thumb-2 kernel,
+THUMB( .thumb                  )       @ switch to Thumb now.
 wait:   ldr     r2, =AUX_CORE_BOOT0_PA  @ read from AuxCoreBoot0
        ldr     r0, [r2]
        mov     r0, r0, lsr #5
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 1f33f5db10d5..66c60fe1104c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2546,11 +2546,12 @@ static int __init _init(struct omap_hwmod *oh, void *data)
                return -EINVAL;
        }
-        if (np)
+        if (np) {
                if (of_find_property(np, "ti,no-reset-on-init", NULL))
                        oh->flags |= HWMOD_INIT_NO_RESET;
                if (of_find_property(np, "ti,no-idle-on-init", NULL))
                        oh->flags |= HWMOD_INIT_NO_IDLE;
+        }
        oh->_state = _HWMOD_STATE_INITIALIZED;
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index a123ff0070bd..71ac7d5f3385 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1964,7 +1964,7 @@ static struct omap_hwmod_irq_info omap3xxx_usb_host_hs_irqs[] = {
 static struct omap_hwmod omap3xxx_usb_host_hs_hwmod = {
        .name           = "usb_host_hs",
        .class          = &omap3xxx_usb_host_hs_hwmod_class,
-        .clkdm_name     = "l3_init_clkdm",
+        .clkdm_name     = "usbhost_clkdm",
        .mpu_irqs       = omap3xxx_usb_host_hs_irqs,
        .main_clk       = "usbhost_48m_fck",
        .prcm = {
@@ -2047,7 +2047,7 @@ static struct omap_hwmod_irq_info omap3xxx_usb_tll_hs_irqs[] = {
 static struct omap_hwmod omap3xxx_usb_tll_hs_hwmod = {
        .name           = "usb_tll_hs",
        .class          = &omap3xxx_usb_tll_hs_hwmod_class,
-        .clkdm_name     = "l3_init_clkdm",
+        .clkdm_name     = "core_l4_clkdm",
        .mpu_irqs       = omap3xxx_usb_tll_hs_irqs,
        .main_clk       = "usbtll_fck",
        .prcm = {
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 1f3770a8a728..87099bb6de69 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -330,10 +330,6 @@ void omap_sram_idle(void)
                        omap3_sram_restore_context();
                        omap2_sms_restore_context();
                }
-                if (core_next_state == PWRDM_POWER_OFF)
-                        omap2_prm_clear_mod_reg_bits(OMAP3430_AUTO_OFF_MASK,
-                                               OMAP3430_GR_MOD,
-                                               OMAP3_PRM_VOLTCTRL_OFFSET);
        }
        omap3_intc_resume_idle();
diff --git a/arch/arm/mach-orion5x/common.h b/arch/arm/mach-orion5x/common.h
index f565f9944af2..7548db2bfb8a 100644
--- a/arch/arm/mach-orion5x/common.h
+++ b/arch/arm/mach-orion5x/common.h
@@ -21,7 +21,7 @@ struct mv_sata_platform_data;
 #define ORION_MBUS_DEVBUS_BOOT_ATTR   0x0f
 #define ORION_MBUS_DEVBUS_TARGET(cs)  0x01
 #define ORION_MBUS_DEVBUS_ATTR(cs)    (~(1 << cs))
-#define ORION_MBUS_SRAM_TARGET        0x00
+#define ORION_MBUS_SRAM_TARGET        0x09
 #define ORION_MBUS_SRAM_ATTR          0x00
 /*
diff --git a/arch/arm/mach-pxa/include/mach/hx4700.h b/arch/arm/mach-pxa/include/mach/hx4700.h
index 8bc02913517c..0e1bb46264f9 100644
--- a/arch/arm/mach-pxa/include/mach/hx4700.h
+++ b/arch/arm/mach-pxa/include/mach/hx4700.h
@@ -14,6 +14,7 @@
 #include <linux/gpio.h>
 #include <linux/mfd/asic3.h>
+#include "irqs.h" /* PXA_NR_BUILTIN_GPIO */
 #define HX4700_ASIC3_GPIO_BASE  PXA_NR_BUILTIN_GPIO
 #define HX4700_EGPIO_BASE       (HX4700_ASIC3_GPIO_BASE + ASIC3_NUM_GPIOS)
diff --git a/arch/arm/mach-rockchip/platsmp.c b/arch/arm/mach-rockchip/platsmp.c
index dbfa5a26cfff..072842f6491b 100644
--- a/arch/arm/mach-rockchip/platsmp.c
+++ b/arch/arm/mach-rockchip/platsmp.c
@@ -152,7 +152,7 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus)
        node = of_find_compatible_node(NULL, NULL, "rockchip,rk3066-pmu");
        if (!node) {
-                pr_err("%s: could not find sram dt node\n", __func__);
+                pr_err("%s: could not find pmu dt node\n", __func__);
                return;
        }
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 2858f380beae..486063db2a2f 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -992,6 +992,7 @@ static struct asoc_simple_card_info fsi_wm8978_info = {
        .platform       = "sh_fsi2",
        .daifmt         = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBM_CFM,
        .cpu_dai = {
+                .fmt    = SND_SOC_DAIFMT_IB_NF,
                .name   = "fsia-dai",
        },
        .codec_dai = {
diff --git a/arch/arm/mach-shmobile/board-lager.c b/arch/arm/mach-shmobile/board-lager.c
index f0104bfe544e..18c7e0311aa6 100644
--- a/arch/arm/mach-shmobile/board-lager.c
+++ b/arch/arm/mach-shmobile/board-lager.c
@@ -588,14 +588,12 @@ static struct asoc_simple_card_info rsnd_card_info = {
        .card           = "SSI01-AK4643",
        .codec          = "ak4642-codec.2-0012",
        .platform       = "rcar_sound",
-        .daifmt         = SND_SOC_DAIFMT_LEFT_J,
+        .daifmt         = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM,
        .cpu_dai = {
                .name   = "rcar_sound",
-                .fmt    = SND_SOC_DAIFMT_CBS_CFS,
        },
        .codec_dai = {
                .name   = "ak4642-hifi",
-                .fmt    = SND_SOC_DAIFMT_CBM_CFM,
                .sysclk = 11289600,
        },
 };
diff --git a/arch/arm/mach-shmobile/clock-r8a7778.c b/arch/arm/mach-shmobile/clock-r8a7778.c
index 2009a9bc6356..9989b1b06ffd 100644
--- a/arch/arm/mach-shmobile/clock-r8a7778.c
+++ b/arch/arm/mach-shmobile/clock-r8a7778.c
@@ -170,7 +170,7 @@ static struct clk mstp_clks[MSTP_NR] = {
        [MSTP010] = SH_CLK_MSTP32(&p_clk, MSTPCR0, 10, 0), /* SSI2 */
        [MSTP009] = SH_CLK_MSTP32(&p_clk, MSTPCR0,  9, 0), /* SSI3 */
        [MSTP008] = SH_CLK_MSTP32(&p_clk, MSTPCR0,  8, 0), /* SRU */
-        [MSTP007] = SH_CLK_MSTP32(&p_clk, MSTPCR0,  7, 0), /* HSPI */
+        [MSTP007] = SH_CLK_MSTP32(&s_clk, MSTPCR0,  7, 0), /* HSPI */
 };
 static struct clk_lookup lookups[] = {
diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c
index 64790353951f..26fda4ed4d51 100644
--- a/arch/arm/mach-spear/time.c
+++ b/arch/arm/mach-spear/time.c
@@ -71,7 +71,7 @@ static void clockevent_set_mode(enum clock_event_mode mode,
 static int clockevent_next_event(unsigned long evt,
                                 struct clock_event_device *clk_event_dev);
-static void spear_clocksource_init(void)
+static void __init spear_clocksource_init(void)
 {
        u32 tick_rate;
        u16 val;
diff --git a/arch/arm/mach-tegra/Kconfig b/arch/arm/mach-tegra/Kconfig
index 92d660f9610f..55b305d51669 100644
--- a/arch/arm/mach-tegra/Kconfig
+++ b/arch/arm/mach-tegra/Kconfig
@@ -70,7 +70,4 @@ config TEGRA_AHB
          which controls AHB bus master arbitration and some
          performance parameters(priority, prefech size).
-config TEGRA_EMC_SCALING_ENABLE
-        bool "Enable scaling the memory frequency"
 endmenu
diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c
index 788495d35cf9..30b993399ed7 100644
--- a/arch/arm/mach-vexpress/dcscb.c
+++ b/arch/arm/mach-vexpress/dcscb.c
@@ -51,12 +51,14 @@ static int dcscb_allcpus_mask[2];
 static int dcscb_power_up(unsigned int cpu, unsigned int cluster)
 {
        unsigned int rst_hold, cpumask = (1 << cpu);
-        unsigned int all_mask = dcscb_allcpus_mask[cluster];
+        unsigned int all_mask;
        pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
        if (cpu >= 4 || cluster >= 2)
                return -EINVAL;
+        all_mask = dcscb_allcpus_mask[cluster];
        /*
         * Since this is called with IRQs enabled, and no arch_spin_lock_irq
         * variant exists, we need to disable IRQs manually here.
@@ -101,11 +103,12 @@ static void dcscb_power_down(void)
        cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0);
        cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
        cpumask = (1 << cpu);
-        all_mask = dcscb_allcpus_mask[cluster];
        pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
        BUG_ON(cpu >= 4 || cluster >= 2);
+        all_mask = dcscb_allcpus_mask[cluster];
        __mcpm_cpu_going_down(cpu, cluster);
        arch_spin_lock(&dcscb_lock);
diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
index c26ef5b92ca7..2c2754e79cb3 100644
--- a/arch/arm/mach-vexpress/spc.c
+++ b/arch/arm/mach-vexpress/spc.c
@@ -392,7 +392,7 @@ static irqreturn_t ve_spc_irq_handler(int irq, void *data)
 *  +--------------------------+
 *  | 31      20 | 19        0 |
 *  +--------------------------+
- *  |   u_volt   |  freq(kHz)  |
+ *  |   m_volt   |  freq(kHz)  |
 *  +--------------------------+
 */
 #define MULT_FACTOR     20
@@ -414,7 +414,7 @@ static int ve_spc_populate_opps(uint32_t cluster)
                ret = ve_spc_read_sys_cfg(SYSCFG_SCC, off, &data);
                if (!ret) {
                        opps->freq = (data & FREQ_MASK) * MULT_FACTOR;
-                        opps->u_volt = data >> VOLT_SHIFT;
+                        opps->u_volt = (data >> VOLT_SHIFT) * 1000;
                } else {
                        break;
                }
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index f5ad9ee70426..5bf7c3c3b301 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -420,29 +420,29 @@ config CPU_32v3
        bool
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
-        select TLS_REG_EMUL if SMP || !MMU
        select NEED_KUSER_HELPERS
+        select TLS_REG_EMUL if SMP || !MMU
 config CPU_32v4
        bool
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
-        select TLS_REG_EMUL if SMP || !MMU
        select NEED_KUSER_HELPERS
+        select TLS_REG_EMUL if SMP || !MMU
 config CPU_32v4T
        bool
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
-        select TLS_REG_EMUL if SMP || !MMU
        select NEED_KUSER_HELPERS
+        select TLS_REG_EMUL if SMP || !MMU
 config CPU_32v5
        bool
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
-        select TLS_REG_EMUL if SMP || !MMU
        select NEED_KUSER_HELPERS
+        select TLS_REG_EMUL if SMP || !MMU
 config CPU_32v6
        bool
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f62aa0677e5c..6b00be1f971e 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1963,8 +1963,8 @@ arm_iommu_create_mapping(struct bus_type *bus, dma_addr_t base, size_t size)
        mapping->nr_bitmaps = 1;
        mapping->extensions = extensions;
        mapping->base = base;
-        mapping->size = bitmap_size << PAGE_SHIFT;
        mapping->bits = BITS_PER_BYTE * bitmap_size;
+        mapping->size = mapping->bits << PAGE_SHIFT;
        spin_lock_init(&mapping->lock);
diff --git a/arch/arm/vfp/vfpdouble.c b/arch/arm/vfp/vfpdouble.c
index 6cac43bd1d86..423f56dd4028 100644
--- a/arch/arm/vfp/vfpdouble.c
+++ b/arch/arm/vfp/vfpdouble.c
@@ -866,6 +866,8 @@ vfp_double_multiply_accumulate(int dd, int dn, int dm, u32 fpscr, u32 negate, ch
                vdp.sign = vfp_sign_negate(vdp.sign);
        vfp_double_unpack(&vdn, vfp_get_double(dd));
+        if (vdn.exponent == 0 && vdn.significand)
+                vfp_double_normalise_denormal(&vdn);
        if (negate & NEG_SUBTRACT)
                vdn.sign = vfp_sign_negate(vdn.sign);
diff --git a/arch/arm/vfp/vfpsingle.c b/arch/arm/vfp/vfpsingle.c
index b252631b406b..4f96c1617aae 100644
--- a/arch/arm/vfp/vfpsingle.c
+++ b/arch/arm/vfp/vfpsingle.c
@@ -915,6 +915,8 @@ vfp_single_multiply_accumulate(int sd, int sn, s32 m, u32 fpscr, u32 negate, cha
        v = vfp_get_float(sd);
        pr_debug("VFP: s%u = %08x\n", sd, v);
        vfp_single_unpack(&vsn, v);
+        if (vsn.exponent == 0 && vsn.significand)
+                vfp_single_normalise_denormal(&vsn);
        if (negate & NEG_SUBTRACT)
                vsn.sign = vfp_sign_negate(vsn.sign);
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index e6e4d3749a6e..e759af5d7098 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -323,8 +323,6 @@ menu "CPU Power Management"
 source "drivers/cpuidle/Kconfig"
-source "kernel/power/Kconfig"
 source "drivers/cpufreq/Kconfig"
 endmenu
diff --git a/arch/arm64/boot/dts/apm-storm.dtsi b/arch/arm64/boot/dts/apm-storm.dtsi
index 93f4b2dd9248..f8c40a66e65d 100644
--- a/arch/arm64/boot/dts/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm-storm.dtsi
@@ -307,6 +307,7 @@
                              <0x0 0x1f21e000 0x0 0x1000>,
                              <0x0 0x1f217000 0x0 0x1000>;
                        interrupts = <0x0 0x86 0x4>;
+                        dma-coherent;
                        status = "disabled";
                        clocks = <&sata01clk 0>;
                        phys = <&phy1 0>;
@@ -321,6 +322,7 @@
                              <0x0 0x1f22e000 0x0 0x1000>,
                              <0x0 0x1f227000 0x0 0x1000>;
                        interrupts = <0x0 0x87 0x4>;
+                        dma-coherent;
                        status = "ok";
                        clocks = <&sata23clk 0>;
                        phys = <&phy2 0>;
@@ -334,6 +336,7 @@
                              <0x0 0x1f23d000 0x0 0x1000>,
                              <0x0 0x1f23e000 0x0 0x1000>;
                        interrupts = <0x0 0x88 0x4>;
+                        dma-coherent;
                        status = "ok";
                        clocks = <&sata45clk 0>;
                        phys = <&phy3 0>;
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index e94f9458aa6f..993bce527b85 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -138,6 +138,7 @@ static inline void *phys_to_virt(phys_addr_t x)
 #define __pa(x)                 __virt_to_phys((unsigned long)(x))
 #define __va(x)                 ((void *)__phys_to_virt((phys_addr_t)(x)))
 #define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
+#define virt_to_pfn(x)      __phys_to_pfn(__virt_to_phys(x))
 /*
 *  virt_to_page(k)     convert a _valid_ virtual address to struct page *
diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
index f600d400c07d..aff0292c8f4d 100644
--- a/arch/arm64/include/asm/mmu.h
+++ b/arch/arm64/include/asm/mmu.h
@@ -22,6 +22,9 @@ typedef struct {
        void *vdso;
 } mm_context_t;
+#define INIT_MM_CONTEXT(name) \
+        .context.id_lock = __RAW_SPIN_LOCK_UNLOCKED(name.context.id_lock),
 #define ASID(mm)        ((mm)->context.id & 0xffff)
 extern void paging_init(void);
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index 72cadf52ca80..80e2c08900d6 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -19,6 +19,7 @@
 #ifndef __ASM_TLB_H
 #define __ASM_TLB_H
+#define  __tlb_remove_pmd_tlb_entry __tlb_remove_pmd_tlb_entry
 #include <asm-generic/tlb.h>
@@ -99,5 +100,10 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
 }
 #endif
+static inline void __tlb_remove_pmd_tlb_entry(struct mmu_gather *tlb, pmd_t *pmdp,
+                                                unsigned long address)
+{
+        tlb_add_flush(tlb, address);
+}
 #endif
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index bb8eb8a78e67..c8d8fc17bd5a 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -403,8 +403,9 @@ __SYSCALL(378, sys_kcmp)
 __SYSCALL(379, sys_finit_module)
 __SYSCALL(380, sys_sched_setattr)
 __SYSCALL(381, sys_sched_getattr)
+__SYSCALL(382, sys_renameat2)
-#define __NR_compat_syscalls            379
+#define __NR_compat_syscalls            383
 /*
 * Compat syscall numbers used by the AArch64 kernel.
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index ed3955a95747..a7fb874b595e 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -318,9 +318,6 @@ static int brk_handler(unsigned long addr, unsigned int esr,
        if (call_break_hook(regs, esr) == DBG_HOOK_HANDLED)
                return 0;
-        pr_warn("unexpected brk exception at %lx, esr=0x%x\n",
-                        (long)instruction_pointer(regs), esr);
        if (!user_mode(regs))
                return -EFAULT;
diff --git a/arch/arm64/kernel/early_printk.c b/arch/arm64/kernel/early_printk.c
index ffbbdde7aba1..2dc36d00addf 100644
--- a/arch/arm64/kernel/early_printk.c
+++ b/arch/arm64/kernel/early_printk.c
@@ -143,10 +143,8 @@ static int __init setup_early_printk(char *buf)
        }
        /* no options parsing yet */
-        if (paddr) {
+        if (paddr)
-                set_fixmap_io(FIX_EARLYCON_MEM_BASE, paddr);
+                early_base = (void __iomem *)set_fixmap_offset_io(FIX_EARLYCON_MEM_BASE, paddr);
-                early_base = (void __iomem *)fix_to_virt(FIX_EARLYCON_MEM_BASE);
-        }
        printch = match->printch;
        early_console = &early_console_dev;
diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
index 473e5dbf8f39..0f08dfd69ebc 100644
--- a/arch/arm64/kernel/irq.c
+++ b/arch/arm64/kernel/irq.c
@@ -97,11 +97,15 @@ static bool migrate_one_irq(struct irq_desc *desc)
        if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity))
                return false;
-        if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) {
+        if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids)
-                affinity = cpu_online_mask;
                ret = true;
-        }
+        /*
+         * when using forced irq_set_affinity we must ensure that the cpu
+         * being offlined is not present in the affinity mask, it may be
+         * selected as the target CPU otherwise
+         */
+        affinity = cpu_online_mask;
        c = irq_data_get_irq_chip(d);
        if (!c->irq_set_affinity)
                pr_debug("IRQ%u: unable to set affinity\n", d->irq);
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 720853f70b6b..7ec784653b29 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -393,11 +393,10 @@ void __init setup_arch(char **cmdline_p)
 static int __init arm64_device_init(void)
 {
-        of_clk_init(NULL);
        of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
        return 0;
 }
-arch_initcall(arm64_device_init);
+arch_initcall_sync(arm64_device_init);
 static DEFINE_PER_CPU(struct cpu, cpu_data);
diff --git a/arch/arm64/kernel/time.c b/arch/arm64/kernel/time.c
index 29c39d5d77e3..6815987b50f8 100644
--- a/arch/arm64/kernel/time.c
+++ b/arch/arm64/kernel/time.c
@@ -33,6 +33,7 @@
 #include <linux/irq.h>
 #include <linux/delay.h>
 #include <linux/clocksource.h>
+#include <linux/clk-provider.h>
 #include <clocksource/arm_arch_timer.h>
@@ -65,6 +66,7 @@ void __init time_init(void)
 {
        u32 arch_timer_rate;
+        of_clk_init(NULL);
        clocksource_of_init();
        arch_timer_rate = arch_timer_get_rate();
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 0ba347e59f06..c851eb44dc50 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -22,8 +22,11 @@
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/dma-contiguous.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
 #include <linux/vmalloc.h>
 #include <linux/swiotlb.h>
+#include <linux/amba/bus.h>
 #include <asm/cacheflush.h>
@@ -305,17 +308,45 @@ struct dma_map_ops coherent_swiotlb_dma_ops = {
 };
 EXPORT_SYMBOL(coherent_swiotlb_dma_ops);
+static int dma_bus_notifier(struct notifier_block *nb,
+                            unsigned long event, void *_dev)
+{
+        struct device *dev = _dev;
+        if (event != BUS_NOTIFY_ADD_DEVICE)
+                return NOTIFY_DONE;
+        if (of_property_read_bool(dev->of_node, "dma-coherent"))
+                set_dma_ops(dev, &coherent_swiotlb_dma_ops);
+        return NOTIFY_OK;
+}
+static struct notifier_block platform_bus_nb = {
+        .notifier_call = dma_bus_notifier,
+};
+static struct notifier_block amba_bus_nb = {
+        .notifier_call = dma_bus_notifier,
+};
 extern int swiotlb_late_init_with_default_size(size_t default_size);
 static int __init swiotlb_late_init(void)
 {
        size_t swiotlb_size = min(SZ_64M, MAX_ORDER_NR_PAGES << PAGE_SHIFT);
-        dma_ops = &coherent_swiotlb_dma_ops;
+        /*
+         * These must be registered before of_platform_populate().
+         */
+        bus_register_notifier(&platform_bus_type, &platform_bus_nb);
+        bus_register_notifier(&amba_bustype, &amba_bus_nb);
+        dma_ops = &noncoherent_swiotlb_dma_ops;
        return swiotlb_late_init_with_default_size(swiotlb_size);
 }
-subsys_initcall(swiotlb_late_init);
+arch_initcall(swiotlb_late_init);
 #define PREALLOC_DMA_DEBUG_ENTRIES      4096
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 5e9aec358306..31eb959e9aa8 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -51,7 +51,11 @@ int pmd_huge(pmd_t pmd)
 int pud_huge(pud_t pud)
 {
+#ifndef __PAGETABLE_PMD_FOLDED
        return !(pud_val(pud) & PUD_TABLE_BIT);
+#else
+        return 0;
+#endif
 }
 int pmd_huge_support(void)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 6b7e89569a3a..0a472c41a67f 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -374,6 +374,9 @@ int kern_addr_valid(unsigned long addr)
        if (pmd_none(*pmd))
                return 0;
+        if (pmd_sect(*pmd))
+                return pfn_valid(pmd_pfn(*pmd));
        pte = pte_offset_kernel(pmd, addr);
        if (pte_none(*pte))
                return 0;
diff --git a/arch/hexagon/include/asm/barrier.h b/arch/hexagon/include/asm/barrier.h
deleted file mode 100644
index 4e863daea25b..000000000000
--- a/arch/hexagon/include/asm/barrier.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Memory barrier definitions for the Hexagon architecture
- *
- * Copyright (c) 2010-2011, The Linux Foundation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 and
- * only version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-#ifndef _ASM_BARRIER_H
-#define _ASM_BARRIER_H
-#define rmb()                           barrier()
-#define read_barrier_depends()          barrier()
-#define wmb()                           barrier()
-#define mb()                            barrier()
-#define smp_rmb()                       barrier()
-#define smp_read_barrier_depends()      barrier()
-#define smp_wmb()                       barrier()
-#define smp_mb()                        barrier()
-/*  Set a value and use a memory barrier.  Used by the scheduler somewhere.  */
-#define set_mb(var, value) \
-        do { var = value; mb(); } while (0)
-#endif /* _ASM_BARRIER_H */
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index bc5efc7c3f3f..39d64e0df1de 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -91,18 +91,9 @@ extern struct ia64_tr_entry *ia64_idtrs[NR_CPUS];
 #define RR_RID_MASK     0x00000000ffffff00L
 #define RR_TO_RID(val)  ((val >> 8) & 0xffffff)
-/*
- * Flush the TLB for address range START to END and, if not in fast mode, release the
- * freed pages that where gathered up to this point.
- */
 static inline void
-ia64_tlb_flush_mmu (struct mmu_gather *tlb, unsigned long start, unsigned long end)
+ia64_tlb_flush_mmu_tlbonly(struct mmu_gather *tlb, unsigned long start, unsigned long end)
 {
-        unsigned long i;
-        unsigned int nr;
-        if (!tlb->need_flush)
-                return;
        tlb->need_flush = 0;
        if (tlb->fullmm) {
@@ -135,6 +126,14 @@ ia64_tlb_flush_mmu (struct mmu_gather *tlb, unsigned long start, unsigned long e
                flush_tlb_range(&vma, ia64_thash(start), ia64_thash(end));
        }
+}
+static inline void
+ia64_tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
+        unsigned long i;
+        unsigned int nr;
        /* lastly, release the freed pages */
        nr = tlb->nr;
@@ -144,6 +143,19 @@ ia64_tlb_flush_mmu (struct mmu_gather *tlb, unsigned long start, unsigned long e
                free_page_and_swap_cache(tlb->pages[i]);
 }
+/*
+ * Flush the TLB for address range START to END and, if not in fast mode, release the
+ * freed pages that where gathered up to this point.
+ */
+static inline void
+ia64_tlb_flush_mmu (struct mmu_gather *tlb, unsigned long start, unsigned long end)
+{
+        if (!tlb->need_flush)
+                return;
+        ia64_tlb_flush_mmu_tlbonly(tlb, start, end);
+        ia64_tlb_flush_mmu_free(tlb);
+}
 static inline void __tlb_alloc_page(struct mmu_gather *tlb)
 {
        unsigned long addr = __get_free_pages(GFP_NOWAIT | __GFP_NOWARN, 0);
@@ -206,6 +218,16 @@ static inline int __tlb_remove_page(struct mmu_gather *tlb, struct page *page)
        return tlb->max - tlb->nr;
 }
+static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
+{
+        ia64_tlb_flush_mmu_tlbonly(tlb, tlb->start_addr, tlb->end_addr);
+}
+static inline void tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
+        ia64_tlb_flush_mmu_free(tlb);
+}
 static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 {
        ia64_tlb_flush_mmu(tlb, tlb->start_addr, tlb->end_addr);
diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
index ae763d8bf55a..fb13dc5e8f8c 100644
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -11,7 +11,7 @@
-#define NR_syscalls                     314 /* length of syscall table */
+#define NR_syscalls                     315 /* length of syscall table */
 /*
 * The following defines stop scripts/checksyscalls.sh from complaining about
diff --git a/arch/ia64/include/uapi/asm/unistd.h b/arch/ia64/include/uapi/asm/unistd.h
index 715e85f858de..7de0a2d65da4 100644
--- a/arch/ia64/include/uapi/asm/unistd.h
+++ b/arch/ia64/include/uapi/asm/unistd.h
@@ -327,5 +327,6 @@
 #define __NR_finit_module               1335
 #define __NR_sched_setattr              1336
 #define __NR_sched_getattr              1337
+#define __NR_renameat2                  1338
 #endif /* _UAPI_ASM_IA64_UNISTD_H */
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index fa8d61a312a7..ba3d03503e84 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1775,6 +1775,7 @@ sys_call_table:
        data8 sys_finit_module                  // 1335
        data8 sys_sched_setattr
        data8 sys_sched_getattr
+        data8 sys_renameat2
        .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
 #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 9d38b73989eb..33afa56ad47a 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
-#define NR_syscalls             351
+#define NR_syscalls             352
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index b932dd470041..9cd82fbc7817 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -356,5 +356,6 @@
 #define __NR_finit_module       348
 #define __NR_sched_setattr      349
 #define __NR_sched_getattr      350
+#define __NR_renameat2          351
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index b6223dc41d82..501e10212789 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -371,4 +371,5 @@ ENTRY(sys_call_table)
        .long sys_finit_module
        .long sys_sched_setattr
        .long sys_sched_getattr         /* 350 */
+        .long sys_renameat2
diff --git a/arch/metag/include/asm/barrier.h b/arch/metag/include/asm/barrier.h
index 5d6b4b407dda..2d6f0de77325 100644
--- a/arch/metag/include/asm/barrier.h
+++ b/arch/metag/include/asm/barrier.h
@@ -15,6 +15,7 @@ static inline void wr_fence(void)
        volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_FENCE;
        barrier();
        *flushptr = 0;
+        barrier();
 }
 #else /* CONFIG_METAG_META21 */
@@ -35,6 +36,7 @@ static inline void wr_fence(void)
        *flushptr = 0;
        *flushptr = 0;
        *flushptr = 0;
+        barrier();
 }
 #endif /* !CONFIG_METAG_META21 */
@@ -68,6 +70,7 @@ static inline void fence(void)
        volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_ATOMIC_UNLOCK;
        barrier();
        *flushptr = 0;
+        barrier();
 }
 #define smp_mb()        fence()
 #define smp_rmb()       fence()
diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
index f16477d1f571..a8a37477c66e 100644
--- a/arch/metag/include/asm/processor.h
+++ b/arch/metag/include/asm/processor.h
@@ -22,6 +22,8 @@
 /* Add an extra page of padding at the top of the stack for the guard page. */
 #define STACK_TOP       (TASK_SIZE - PAGE_SIZE)
 #define STACK_TOP_MAX   STACK_TOP
+/* Maximum virtual space for stack */
+#define STACK_SIZE_MAX  (CONFIG_MAX_STACK_SIZE_MB*1024*1024)
 /* This decides where the kernel will search for a free chunk of vm
 * space during mmap's.
diff --git a/arch/metag/include/uapi/asm/Kbuild b/arch/metag/include/uapi/asm/Kbuild
index 84e09feb4d54..ab78be2b6eb0 100644
--- a/arch/metag/include/uapi/asm/Kbuild
+++ b/arch/metag/include/uapi/asm/Kbuild
@@ -4,11 +4,11 @@ include include/uapi/asm-generic/Kbuild.asm
 header-y += byteorder.h
 header-y += ech.h
 header-y += ptrace.h
-header-y += resource.h
 header-y += sigcontext.h
 header-y += siginfo.h
 header-y += swab.h
 header-y += unistd.h
 generic-y += mman.h
+generic-y += resource.h
 generic-y += setup.h
diff --git a/arch/metag/include/uapi/asm/resource.h b/arch/metag/include/uapi/asm/resource.h
deleted file mode 100644
index 526d23cc3054..000000000000
--- a/arch/metag/include/uapi/asm/resource.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _UAPI_METAG_RESOURCE_H
-#define _UAPI_METAG_RESOURCE_H
-#define _STK_LIM_MAX    (1 << 28)
-#include <asm-generic/resource.h>
-#endif /* _UAPI_METAG_RESOURCE_H */
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index c2bb4f896ce7..3aa5b46b2d40 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -635,7 +635,7 @@ static void octeon_irq_cpu_offline_ciu(struct irq_data *data)
                cpumask_clear(&new_affinity);
                cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity);
        }
-        __irq_set_affinity_locked(data, &new_affinity);
+        irq_set_affinity_locked(data, &new_affinity, false);
 }
 static int octeon_irq_ciu_set_affinity(struct irq_data *data,
diff --git a/arch/mips/dec/ecc-berr.c b/arch/mips/dec/ecc-berr.c
index 5abf4e894216..2a66e908f6a9 100644
--- a/arch/mips/dec/ecc-berr.c
+++ b/arch/mips/dec/ecc-berr.c
@@ -21,6 +21,7 @@
 #include <asm/addrspace.h>
 #include <asm/bootinfo.h>
 #include <asm/cpu.h>
+#include <asm/cpu-type.h>
 #include <asm/irq_regs.h>
 #include <asm/processor.h>
 #include <asm/ptrace.h>
diff --git a/arch/mips/dec/kn02xa-berr.c b/arch/mips/dec/kn02xa-berr.c
index f434b759e3b9..ec606363b806 100644
--- a/arch/mips/dec/kn02xa-berr.c
+++ b/arch/mips/dec/kn02xa-berr.c
@@ -19,6 +19,7 @@
 #include <linux/types.h>
 #include <asm/addrspace.h>
+#include <asm/cpu-type.h>
 #include <asm/irq_regs.h>
 #include <asm/ptrace.h>
 #include <asm/traps.h>
diff --git a/arch/mips/dec/prom/Makefile b/arch/mips/dec/prom/Makefile
index 064ae7a76bdc..ae73e42ac20b 100644
--- a/arch/mips/dec/prom/Makefile
+++ b/arch/mips/dec/prom/Makefile
@@ -6,4 +6,3 @@
 lib-y                   += init.o memory.o cmdline.o identify.o console.o
 lib-$(CONFIG_32BIT)     += locore.o
-lib-$(CONFIG_64BIT)     += call_o32.o
diff --git a/arch/mips/dec/prom/call_o32.S b/arch/mips/dec/prom/call_o32.S
deleted file mode 100644
index 8c8498159e43..000000000000
--- a/arch/mips/dec/prom/call_o32.S
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- *      O32 interface for the 64 (or N32) ABI.
- *
- *      Copyright (C) 2002  Maciej W. Rozycki
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-#include <asm/asm.h>
-#include <asm/regdef.h>
-/* Maximum number of arguments supported.  Must be even!  */
-#define O32_ARGC        32
-/* Number of static registers we save.  */
-#define O32_STATC       11
-/* Frame size for both of the above.  */
-#define O32_FRAMESZ     (4 * O32_ARGC + SZREG * O32_STATC)
-                .text
-/*
- * O32 function call dispatcher, for interfacing 32-bit ROM routines.
- *
- * The standard 64 (N32) calling sequence is supported, with a0
- * holding a function pointer, a1-a7 -- its first seven arguments
- * and the stack -- remaining ones (up to O32_ARGC, including a1-a7).
- * Static registers, gp and fp are preserved, v0 holds a result.
- * This code relies on the called o32 function for sp and ra
- * restoration and thus both this dispatcher and the current stack
- * have to be placed in a KSEGx (or KUSEG) address space.  Any
- * pointers passed have to point to addresses within one of these
- * spaces as well.
- */
-NESTED(call_o32, O32_FRAMESZ, ra)
-                REG_SUBU        sp,O32_FRAMESZ
-                REG_S           ra,O32_FRAMESZ-1*SZREG(sp)
-                REG_S           fp,O32_FRAMESZ-2*SZREG(sp)
-                REG_S           gp,O32_FRAMESZ-3*SZREG(sp)
-                REG_S           s7,O32_FRAMESZ-4*SZREG(sp)
-                REG_S           s6,O32_FRAMESZ-5*SZREG(sp)
-                REG_S           s5,O32_FRAMESZ-6*SZREG(sp)
-                REG_S           s4,O32_FRAMESZ-7*SZREG(sp)
-                REG_S           s3,O32_FRAMESZ-8*SZREG(sp)
-                REG_S           s2,O32_FRAMESZ-9*SZREG(sp)
-                REG_S           s1,O32_FRAMESZ-10*SZREG(sp)
-                REG_S           s0,O32_FRAMESZ-11*SZREG(sp)
-                move            jp,a0
-                sll             a0,a1,zero
-                sll             a1,a2,zero
-                sll             a2,a3,zero
-                sll             a3,a4,zero
-                sw              a5,0x10(sp)
-                sw              a6,0x14(sp)
-                sw              a7,0x18(sp)
-                PTR_LA          t0,O32_FRAMESZ(sp)
-                PTR_LA          t1,0x1c(sp)
-                li              t2,O32_ARGC-7
-1:
-                lw              t3,(t0)
-                REG_ADDU        t0,SZREG
-                sw              t3,(t1)
-                REG_SUBU        t2,1
-                REG_ADDU        t1,4
-                bnez            t2,1b
-                jalr            jp
-                REG_L           s0,O32_FRAMESZ-11*SZREG(sp)
-                REG_L           s1,O32_FRAMESZ-10*SZREG(sp)
-                REG_L           s2,O32_FRAMESZ-9*SZREG(sp)
-                REG_L           s3,O32_FRAMESZ-8*SZREG(sp)
-                REG_L           s4,O32_FRAMESZ-7*SZREG(sp)
-                REG_L           s5,O32_FRAMESZ-6*SZREG(sp)
-                REG_L           s6,O32_FRAMESZ-5*SZREG(sp)
-                REG_L           s7,O32_FRAMESZ-4*SZREG(sp)
-                REG_L           gp,O32_FRAMESZ-3*SZREG(sp)
-                REG_L           fp,O32_FRAMESZ-2*SZREG(sp)
-                REG_L           ra,O32_FRAMESZ-1*SZREG(sp)
-                REG_ADDU        sp,O32_FRAMESZ
-                jr              ra
-END(call_o32)
diff --git a/arch/mips/fw/lib/call_o32.S b/arch/mips/fw/lib/call_o32.S
index b308b2a0613e..4703fe4dbd9a 100644
--- a/arch/mips/fw/lib/call_o32.S
+++ b/arch/mips/fw/lib/call_o32.S
@@ -1,7 +1,7 @@
 /*
 *      O32 interface for the 64 (or N32) ABI.
 *
- *      Copyright (C) 2002  Maciej W. Rozycki
+ *      Copyright (C) 2002, 2014  Maciej W. Rozycki
 *
 *      This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
@@ -12,28 +12,37 @@
 #include <asm/asm.h>
 #include <asm/regdef.h>
+/* O32 register size.  */
+#define O32_SZREG       4
 /* Maximum number of arguments supported.  Must be even!  */
 #define O32_ARGC        32
-/* Number of static registers we save.  */
+/* Number of static registers we save.  */
 #define O32_STATC       11
-/* Frame size for static register  */
+/* Argument area frame size.  */
-#define O32_FRAMESZ     (SZREG * O32_STATC)
+#define O32_ARGSZ       (O32_SZREG * O32_ARGC)
-/* Frame size on new stack */
+/* Static register save area frame size.  */
-#define O32_FRAMESZ_NEW (SZREG + 4 * O32_ARGC)
+#define O32_STATSZ      (SZREG * O32_STATC)
+/* Stack pointer register save area frame size.  */
+#define O32_SPSZ        SZREG
+/* Combined area frame size.  */
+#define O32_FRAMESZ     (O32_ARGSZ + O32_SPSZ + O32_STATSZ)
+/* Switched stack frame size.  */
+#define O32_NFRAMESZ    (O32_ARGSZ + O32_SPSZ)
                .text
 /*
 * O32 function call dispatcher, for interfacing 32-bit ROM routines.
 *
- * The standard 64 (N32) calling sequence is supported, with a0
+ * The standard 64 (N32) calling sequence is supported, with a0 holding
- * holding a function pointer, a1 a new stack pointer, a2-a7 -- its
+ * a function pointer, a1 a pointer to the new stack to call the
- * first six arguments and the stack -- remaining ones (up to O32_ARGC,
+ * function with or 0 if no stack switching is requested, a2-a7 -- the
- * including a2-a7). Static registers, gp and fp are preserved, v0 holds
+ * function call's first six arguments, and the stack -- the remaining
- * a result. This code relies on the called o32 function for sp and ra
+ * arguments (up to O32_ARGC, including a2-a7).  Static registers, gp
- * restoration and this dispatcher has to be placed in a KSEGx (or KUSEG)
+ * and fp are preserved, v0 holds the result.  This code relies on the
- * address space.  Any pointers passed have to point to addresses within
+ * called o32 function for sp and ra restoration and this dispatcher has
- * one of these spaces as well.
+ * to be placed in a KSEGx (or KUSEG) address space.  Any pointers
+ * passed have to point to addresses within one of these spaces as well.
 */
 NESTED(call_o32, O32_FRAMESZ, ra)
                REG_SUBU        sp,O32_FRAMESZ
@@ -51,32 +60,36 @@ NESTED(call_o32, O32_FRAMESZ, ra)
                REG_S           s0,O32_FRAMESZ-11*SZREG(sp)
                move            jp,a0
-                REG_SUBU        s0,a1,O32_FRAMESZ_NEW
-                REG_S           sp,O32_FRAMESZ_NEW-1*SZREG(s0)
+                move            fp,sp
+                beqz            a1,0f
+                REG_SUBU        fp,a1,O32_NFRAMESZ
+0:
+                REG_S           sp,O32_NFRAMESZ-1*SZREG(fp)
                sll             a0,a2,zero
                sll             a1,a3,zero
                sll             a2,a4,zero
                sll             a3,a5,zero
-                sw              a6,0x10(s0)
+                sw              a6,4*O32_SZREG(fp)
-                sw              a7,0x14(s0)
+                sw              a7,5*O32_SZREG(fp)
                PTR_LA          t0,O32_FRAMESZ(sp)
-                PTR_LA          t1,0x18(s0)
+                PTR_LA          t1,6*O32_SZREG(fp)
                li              t2,O32_ARGC-6
 1:
                lw              t3,(t0)
                REG_ADDU        t0,SZREG
                sw              t3,(t1)
                REG_SUBU        t2,1
-                REG_ADDU        t1,4
+                REG_ADDU        t1,O32_SZREG
                bnez            t2,1b
-                move            sp,s0
+                move            sp,fp
                jalr            jp
-                REG_L           sp,O32_FRAMESZ_NEW-1*SZREG(sp)
+                REG_L           sp,O32_NFRAMESZ-1*SZREG(sp)
                REG_L           s0,O32_FRAMESZ-11*SZREG(sp)
                REG_L           s1,O32_FRAMESZ-10*SZREG(sp)
diff --git a/arch/mips/fw/sni/sniprom.c b/arch/mips/fw/sni/sniprom.c
index 2c2cb182af4e..6aa264b9856a 100644
--- a/arch/mips/fw/sni/sniprom.c
+++ b/arch/mips/fw/sni/sniprom.c
@@ -40,7 +40,8 @@
 #ifdef CONFIG_64BIT
-static u8 o32_stk[16384];
+/* O32 stack has to be 8-byte aligned. */
+static u64 o32_stk[4096];
 #define O32_STK   &o32_stk[sizeof(o32_stk)]
 #define __PROM_O32(fun, arg) fun arg __asm__(#fun); \
diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h
index c0ead6313845..b59a2103b61a 100644
--- a/arch/mips/include/asm/dec/prom.h
+++ b/arch/mips/include/asm/dec/prom.h
@@ -113,31 +113,31 @@ extern int (*__pmax_close)(int);
 #define __DEC_PROM_O32(fun, arg) fun arg __asm__(#fun); \
                                 __asm__(#fun " = call_o32")
-int __DEC_PROM_O32(_rex_bootinit, (int (*)(void)));
+int __DEC_PROM_O32(_rex_bootinit, (int (*)(void), void *));
-int __DEC_PROM_O32(_rex_bootread, (int (*)(void)));
+int __DEC_PROM_O32(_rex_bootread, (int (*)(void), void *));
-int __DEC_PROM_O32(_rex_getbitmap, (int (*)(memmap *), memmap *));
+int __DEC_PROM_O32(_rex_getbitmap, (int (*)(memmap *), void *, memmap *));
 unsigned long *__DEC_PROM_O32(_rex_slot_address,
-                             (unsigned long *(*)(int), int));
+                             (unsigned long *(*)(int), void *, int));
-void *__DEC_PROM_O32(_rex_gettcinfo, (void *(*)(void)));
+void *__DEC_PROM_O32(_rex_gettcinfo, (void *(*)(void), void *));
-int __DEC_PROM_O32(_rex_getsysid, (int (*)(void)));
+int __DEC_PROM_O32(_rex_getsysid, (int (*)(void), void *));
-void __DEC_PROM_O32(_rex_clear_cache, (void (*)(void)));
+void __DEC_PROM_O32(_rex_clear_cache, (void (*)(void), void *));
-int __DEC_PROM_O32(_prom_getchar, (int (*)(void)));
+int __DEC_PROM_O32(_prom_getchar, (int (*)(void), void *));
-char *__DEC_PROM_O32(_prom_getenv, (char *(*)(char *), char *));
+char *__DEC_PROM_O32(_prom_getenv, (char *(*)(char *), void *, char *));
-int __DEC_PROM_O32(_prom_printf, (int (*)(char *, ...), char *, ...));
+int __DEC_PROM_O32(_prom_printf, (int (*)(char *, ...), void *, char *, ...));
-#define rex_bootinit()          _rex_bootinit(__rex_bootinit)
+#define rex_bootinit()          _rex_bootinit(__rex_bootinit, NULL)
-#define rex_bootread()          _rex_bootread(__rex_bootread)
+#define rex_bootread()          _rex_bootread(__rex_bootread, NULL)
-#define rex_getbitmap(x)        _rex_getbitmap(__rex_getbitmap, x)
+#define rex_getbitmap(x)        _rex_getbitmap(__rex_getbitmap, NULL, x)
-#define rex_slot_address(x)     _rex_slot_address(__rex_slot_address, x)
+#define rex_slot_address(x)     _rex_slot_address(__rex_slot_address, NULL, x)
-#define rex_gettcinfo()         _rex_gettcinfo(__rex_gettcinfo)
+#define rex_gettcinfo()         _rex_gettcinfo(__rex_gettcinfo, NULL)
-#define rex_getsysid()          _rex_getsysid(__rex_getsysid)
+#define rex_getsysid()          _rex_getsysid(__rex_getsysid, NULL)
-#define rex_clear_cache()       _rex_clear_cache(__rex_clear_cache)
+#define rex_clear_cache()       _rex_clear_cache(__rex_clear_cache, NULL)
-#define prom_getchar()          _prom_getchar(__prom_getchar)
+#define prom_getchar()          _prom_getchar(__prom_getchar, NULL)
-#define prom_getenv(x)          _prom_getenv(__prom_getenv, x)
+#define prom_getenv(x)          _prom_getenv(__prom_getenv, NULL, x)
-#define prom_printf(x...)       _prom_printf(__prom_printf, x)
+#define prom_printf(x...)       _prom_printf(__prom_printf, NULL, x)
 #else /* !CONFIG_64BIT */
diff --git a/arch/mips/include/asm/rm9k-ocd.h b/arch/mips/include/asm/rm9k-ocd.h
deleted file mode 100644
index b0b80d9ecf96..000000000000
--- a/arch/mips/include/asm/rm9k-ocd.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- *  Copyright (C) 2004 by Basler Vision Technologies AG
- *  Author: Thomas Koeller <thomas.koeller@baslerweb.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#if !defined(_ASM_RM9K_OCD_H)
-#define _ASM_RM9K_OCD_H
-#include <linux/types.h>
-#include <linux/spinlock.h>
-#include <asm/io.h>
-extern volatile void __iomem * const ocd_base;
-extern volatile void __iomem * const titan_base;
-#define ocd_addr(__x__)         (ocd_base + (__x__))
-#define titan_addr(__x__)       (titan_base + (__x__))
-#define scram_addr(__x__)       (scram_base + (__x__))
-/* OCD register access */
-#define ocd_readl(__offs__) __raw_readl(ocd_addr(__offs__))
-#define ocd_readw(__offs__) __raw_readw(ocd_addr(__offs__))
-#define ocd_readb(__offs__) __raw_readb(ocd_addr(__offs__))
-#define ocd_writel(__val__, __offs__) \
-        __raw_writel((__val__), ocd_addr(__offs__))
-#define ocd_writew(__val__, __offs__) \
-        __raw_writew((__val__), ocd_addr(__offs__))
-#define ocd_writeb(__val__, __offs__) \
-        __raw_writeb((__val__), ocd_addr(__offs__))
-/* TITAN register access - 32 bit-wide only */
-#define titan_readl(__offs__) __raw_readl(titan_addr(__offs__))
-#define titan_writel(__val__, __offs__) \
-        __raw_writel((__val__), titan_addr(__offs__))
-/* Protect access to shared TITAN registers */
-extern spinlock_t titan_lock;
-extern int titan_irqflags;
-#define lock_titan_regs() spin_lock_irqsave(&titan_lock, titan_irqflags)
-#define unlock_titan_regs() spin_unlock_irqrestore(&titan_lock, titan_irqflags)
-#endif  /* !defined(_ASM_RM9K_OCD_H) */
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index c6e9cd2bca8d..17960fe7a8ce 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -133,6 +133,8 @@ static inline int syscall_get_arch(void)
 #ifdef CONFIG_64BIT
        if (!test_thread_flag(TIF_32BIT_REGS))
                arch |= __AUDIT_ARCH_64BIT;
+        if (test_thread_flag(TIF_32BIT_ADDR))
+                arch |= __AUDIT_ARCH_CONVENTION_MIPS64_N32;
 #endif
 #if defined(__LITTLE_ENDIAN)
        arch |=  __AUDIT_ARCH_LE;
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index df6e775f3fef..3125797f2a88 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -484,13 +484,13 @@ enum MIPS6e_i8_func {
 * Damn ...  bitfields depend from byteorder :-(
 */
 #ifdef __MIPSEB__
-#define BITFIELD_FIELD(field, more)                                     \
+#define __BITFIELD_FIELD(field, more)                                   \
        field;                                                          \
        more
 #elif defined(__MIPSEL__)
-#define BITFIELD_FIELD(field, more)                                     \
+#define __BITFIELD_FIELD(field, more)                                   \
        more                                                            \
        field;
@@ -499,112 +499,112 @@ enum MIPS6e_i8_func {
 #endif
 struct j_format {
-        BITFIELD_FIELD(unsigned int opcode : 6, /* Jump format */
+        __BITFIELD_FIELD(unsigned int opcode : 6, /* Jump format */
-        BITFIELD_FIELD(unsigned int target : 26,
+        __BITFIELD_FIELD(unsigned int target : 26,
        ;))
 };
 struct i_format {                       /* signed immediate format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rs : 5,
+        __BITFIELD_FIELD(unsigned int rs : 5,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(signed int simmediate : 16,
+        __BITFIELD_FIELD(signed int simmediate : 16,
        ;))))
 };
 struct u_format {                       /* unsigned immediate format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rs : 5,
+        __BITFIELD_FIELD(unsigned int rs : 5,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int uimmediate : 16,
+        __BITFIELD_FIELD(unsigned int uimmediate : 16,
        ;))))
 };
 struct c_format {                       /* Cache (>= R6000) format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rs : 5,
+        __BITFIELD_FIELD(unsigned int rs : 5,
-        BITFIELD_FIELD(unsigned int c_op : 3,
+        __BITFIELD_FIELD(unsigned int c_op : 3,
-        BITFIELD_FIELD(unsigned int cache : 2,
+        __BITFIELD_FIELD(unsigned int cache : 2,
-        BITFIELD_FIELD(unsigned int simmediate : 16,
+        __BITFIELD_FIELD(unsigned int simmediate : 16,
        ;)))))
 };
 struct r_format {                       /* Register format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rs : 5,
+        __BITFIELD_FIELD(unsigned int rs : 5,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int rd : 5,
+        __BITFIELD_FIELD(unsigned int rd : 5,
-        BITFIELD_FIELD(unsigned int re : 5,
+        __BITFIELD_FIELD(unsigned int re : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct p_format {               /* Performance counter format (R10000) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rs : 5,
+        __BITFIELD_FIELD(unsigned int rs : 5,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int rd : 5,
+        __BITFIELD_FIELD(unsigned int rd : 5,
-        BITFIELD_FIELD(unsigned int re : 5,
+        __BITFIELD_FIELD(unsigned int re : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct f_format {                       /* FPU register format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int : 1,
+        __BITFIELD_FIELD(unsigned int : 1,
-        BITFIELD_FIELD(unsigned int fmt : 4,
+        __BITFIELD_FIELD(unsigned int fmt : 4,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int rd : 5,
+        __BITFIELD_FIELD(unsigned int rd : 5,
-        BITFIELD_FIELD(unsigned int re : 5,
+        __BITFIELD_FIELD(unsigned int re : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;)))))))
 };
 struct ma_format {              /* FPU multiply and add format (MIPS IV) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int fr : 5,
+        __BITFIELD_FIELD(unsigned int fr : 5,
-        BITFIELD_FIELD(unsigned int ft : 5,
+        __BITFIELD_FIELD(unsigned int ft : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int func : 4,
+        __BITFIELD_FIELD(unsigned int func : 4,
-        BITFIELD_FIELD(unsigned int fmt : 2,
+        __BITFIELD_FIELD(unsigned int fmt : 2,
        ;)))))))
 };
 struct b_format {                       /* BREAK and SYSCALL */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int code : 20,
+        __BITFIELD_FIELD(unsigned int code : 20,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;)))
 };
 struct ps_format {                      /* MIPS-3D / paired single format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rs : 5,
+        __BITFIELD_FIELD(unsigned int rs : 5,
-        BITFIELD_FIELD(unsigned int ft : 5,
+        __BITFIELD_FIELD(unsigned int ft : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct v_format {                               /* MDMX vector format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int sel : 4,
+        __BITFIELD_FIELD(unsigned int sel : 4,
-        BITFIELD_FIELD(unsigned int fmt : 1,
+        __BITFIELD_FIELD(unsigned int fmt : 1,
-        BITFIELD_FIELD(unsigned int vt : 5,
+        __BITFIELD_FIELD(unsigned int vt : 5,
-        BITFIELD_FIELD(unsigned int vs : 5,
+        __BITFIELD_FIELD(unsigned int vs : 5,
-        BITFIELD_FIELD(unsigned int vd : 5,
+        __BITFIELD_FIELD(unsigned int vd : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;)))))))
 };
 struct spec3_format {   /* SPEC3 */
-        BITFIELD_FIELD(unsigned int opcode:6,
+        __BITFIELD_FIELD(unsigned int opcode:6,
-        BITFIELD_FIELD(unsigned int rs:5,
+        __BITFIELD_FIELD(unsigned int rs:5,
-        BITFIELD_FIELD(unsigned int rt:5,
+        __BITFIELD_FIELD(unsigned int rt:5,
-        BITFIELD_FIELD(signed int simmediate:9,
+        __BITFIELD_FIELD(signed int simmediate:9,
-        BITFIELD_FIELD(unsigned int func:7,
+        __BITFIELD_FIELD(unsigned int func:7,
        ;)))))
 };
@@ -616,141 +616,141 @@ struct spec3_format {   /* SPEC3 */
 *      if it is MIPS32 instruction re-encoded for use in the microMIPS ASE.
 */
 struct fb_format {              /* FPU branch format (MIPS32) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int bc : 5,
+        __BITFIELD_FIELD(unsigned int bc : 5,
-        BITFIELD_FIELD(unsigned int cc : 3,
+        __BITFIELD_FIELD(unsigned int cc : 3,
-        BITFIELD_FIELD(unsigned int flag : 2,
+        __BITFIELD_FIELD(unsigned int flag : 2,
-        BITFIELD_FIELD(signed int simmediate : 16,
+        __BITFIELD_FIELD(signed int simmediate : 16,
        ;)))))
 };
 struct fp0_format {             /* FPU multiply and add format (MIPS32) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int fmt : 5,
+        __BITFIELD_FIELD(unsigned int fmt : 5,
-        BITFIELD_FIELD(unsigned int ft : 5,
+        __BITFIELD_FIELD(unsigned int ft : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct mm_fp0_format {          /* FPU multipy and add format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int ft : 5,
+        __BITFIELD_FIELD(unsigned int ft : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int fmt : 3,
+        __BITFIELD_FIELD(unsigned int fmt : 3,
-        BITFIELD_FIELD(unsigned int op : 2,
+        __BITFIELD_FIELD(unsigned int op : 2,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;)))))))
 };
 struct fp1_format {             /* FPU mfc1 and cfc1 format (MIPS32) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int op : 5,
+        __BITFIELD_FIELD(unsigned int op : 5,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct mm_fp1_format {          /* FPU mfc1 and cfc1 format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fmt : 2,
+        __BITFIELD_FIELD(unsigned int fmt : 2,
-        BITFIELD_FIELD(unsigned int op : 8,
+        __BITFIELD_FIELD(unsigned int op : 8,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct mm_fp2_format {          /* FPU movt and movf format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int cc : 3,
+        __BITFIELD_FIELD(unsigned int cc : 3,
-        BITFIELD_FIELD(unsigned int zero : 2,
+        __BITFIELD_FIELD(unsigned int zero : 2,
-        BITFIELD_FIELD(unsigned int fmt : 2,
+        __BITFIELD_FIELD(unsigned int fmt : 2,
-        BITFIELD_FIELD(unsigned int op : 3,
+        __BITFIELD_FIELD(unsigned int op : 3,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))))
 };
 struct mm_fp3_format {          /* FPU abs and neg format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fmt : 3,
+        __BITFIELD_FIELD(unsigned int fmt : 3,
-        BITFIELD_FIELD(unsigned int op : 7,
+        __BITFIELD_FIELD(unsigned int op : 7,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct mm_fp4_format {          /* FPU c.cond format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int cc : 3,
+        __BITFIELD_FIELD(unsigned int cc : 3,
-        BITFIELD_FIELD(unsigned int fmt : 3,
+        __BITFIELD_FIELD(unsigned int fmt : 3,
-        BITFIELD_FIELD(unsigned int cond : 4,
+        __BITFIELD_FIELD(unsigned int cond : 4,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;)))))))
 };
 struct mm_fp5_format {          /* FPU lwxc1 and swxc1 format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int index : 5,
+        __BITFIELD_FIELD(unsigned int index : 5,
-        BITFIELD_FIELD(unsigned int base : 5,
+        __BITFIELD_FIELD(unsigned int base : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int op : 5,
+        __BITFIELD_FIELD(unsigned int op : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct fp6_format {             /* FPU madd and msub format (MIPS IV) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int fr : 5,
+        __BITFIELD_FIELD(unsigned int fr : 5,
-        BITFIELD_FIELD(unsigned int ft : 5,
+        __BITFIELD_FIELD(unsigned int ft : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct mm_fp6_format {          /* FPU madd and msub format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int ft : 5,
+        __BITFIELD_FIELD(unsigned int ft : 5,
-        BITFIELD_FIELD(unsigned int fs : 5,
+        __BITFIELD_FIELD(unsigned int fs : 5,
-        BITFIELD_FIELD(unsigned int fd : 5,
+        __BITFIELD_FIELD(unsigned int fd : 5,
-        BITFIELD_FIELD(unsigned int fr : 5,
+        __BITFIELD_FIELD(unsigned int fr : 5,
-        BITFIELD_FIELD(unsigned int func : 6,
+        __BITFIELD_FIELD(unsigned int func : 6,
        ;))))))
 };
 struct mm_i_format {            /* Immediate format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(unsigned int rs : 5,
+        __BITFIELD_FIELD(unsigned int rs : 5,
-        BITFIELD_FIELD(signed int simmediate : 16,
+        __BITFIELD_FIELD(signed int simmediate : 16,
        ;))))
 };
 struct mm_m_format {            /* Multi-word load/store format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rd : 5,
+        __BITFIELD_FIELD(unsigned int rd : 5,
-        BITFIELD_FIELD(unsigned int base : 5,
+        __BITFIELD_FIELD(unsigned int base : 5,
-        BITFIELD_FIELD(unsigned int func : 4,
+        __BITFIELD_FIELD(unsigned int func : 4,
-        BITFIELD_FIELD(signed int simmediate : 12,
+        __BITFIELD_FIELD(signed int simmediate : 12,
        ;)))))
 };
 struct mm_x_format {            /* Scaled indexed load format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int index : 5,
+        __BITFIELD_FIELD(unsigned int index : 5,
-        BITFIELD_FIELD(unsigned int base : 5,
+        __BITFIELD_FIELD(unsigned int base : 5,
-        BITFIELD_FIELD(unsigned int rd : 5,
+        __BITFIELD_FIELD(unsigned int rd : 5,
-        BITFIELD_FIELD(unsigned int func : 11,
+        __BITFIELD_FIELD(unsigned int func : 11,
        ;)))))
 };
@@ -758,51 +758,51 @@ struct mm_x_format {		/* Scaled indexed load format (microMIPS) */
 * microMIPS instruction formats (16-bit length)
 */
 struct mm_b0_format {           /* Unconditional branch format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(signed int simmediate : 10,
+        __BITFIELD_FIELD(signed int simmediate : 10,
-        BITFIELD_FIELD(unsigned int : 16, /* Ignored */
+        __BITFIELD_FIELD(unsigned int : 16, /* Ignored */
        ;)))
 };
 struct mm_b1_format {           /* Conditional branch format (microMIPS) */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rs : 3,
+        __BITFIELD_FIELD(unsigned int rs : 3,
-        BITFIELD_FIELD(signed int simmediate : 7,
+        __BITFIELD_FIELD(signed int simmediate : 7,
-        BITFIELD_FIELD(unsigned int : 16, /* Ignored */
+        __BITFIELD_FIELD(unsigned int : 16, /* Ignored */
        ;))))
 };
 struct mm16_m_format {          /* Multi-word load/store format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int func : 4,
+        __BITFIELD_FIELD(unsigned int func : 4,
-        BITFIELD_FIELD(unsigned int rlist : 2,
+        __BITFIELD_FIELD(unsigned int rlist : 2,
-        BITFIELD_FIELD(unsigned int imm : 4,
+        __BITFIELD_FIELD(unsigned int imm : 4,
-        BITFIELD_FIELD(unsigned int : 16, /* Ignored */
+        __BITFIELD_FIELD(unsigned int : 16, /* Ignored */
        ;)))))
 };
 struct mm16_rb_format {         /* Signed immediate format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rt : 3,
+        __BITFIELD_FIELD(unsigned int rt : 3,
-        BITFIELD_FIELD(unsigned int base : 3,
+        __BITFIELD_FIELD(unsigned int base : 3,
-        BITFIELD_FIELD(signed int simmediate : 4,
+        __BITFIELD_FIELD(signed int simmediate : 4,
-        BITFIELD_FIELD(unsigned int : 16, /* Ignored */
+        __BITFIELD_FIELD(unsigned int : 16, /* Ignored */
        ;)))))
 };
 struct mm16_r3_format {         /* Load from global pointer format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rt : 3,
+        __BITFIELD_FIELD(unsigned int rt : 3,
-        BITFIELD_FIELD(signed int simmediate : 7,
+        __BITFIELD_FIELD(signed int simmediate : 7,
-        BITFIELD_FIELD(unsigned int : 16, /* Ignored */
+        __BITFIELD_FIELD(unsigned int : 16, /* Ignored */
        ;))))
 };
 struct mm16_r5_format {         /* Load/store from stack pointer format */
-        BITFIELD_FIELD(unsigned int opcode : 6,
+        __BITFIELD_FIELD(unsigned int opcode : 6,
-        BITFIELD_FIELD(unsigned int rt : 5,
+        __BITFIELD_FIELD(unsigned int rt : 5,
-        BITFIELD_FIELD(signed int simmediate : 5,
+        __BITFIELD_FIELD(signed int simmediate : 5,
-        BITFIELD_FIELD(unsigned int : 16, /* Ignored */
+        __BITFIELD_FIELD(unsigned int : 16, /* Ignored */
        ;))))
 };
@@ -810,57 +810,57 @@ struct mm16_r5_format {		/* Load/store from stack pointer format */
 * MIPS16e instruction formats (16-bit length)
 */
 struct m16e_rr {
-        BITFIELD_FIELD(unsigned int opcode : 5,
+        __BITFIELD_FIELD(unsigned int opcode : 5,
-        BITFIELD_FIELD(unsigned int rx : 3,
+        __BITFIELD_FIELD(unsigned int rx : 3,
-        BITFIELD_FIELD(unsigned int nd : 1,
+        __BITFIELD_FIELD(unsigned int nd : 1,
-        BITFIELD_FIELD(unsigned int l : 1,
+        __BITFIELD_FIELD(unsigned int l : 1,
-        BITFIELD_FIELD(unsigned int ra : 1,
+        __BITFIELD_FIELD(unsigned int ra : 1,
-        BITFIELD_FIELD(unsigned int func : 5,
+        __BITFIELD_FIELD(unsigned int func : 5,
        ;))))))
 };
 struct m16e_jal {
-        BITFIELD_FIELD(unsigned int opcode : 5,
+        __BITFIELD_FIELD(unsigned int opcode : 5,
-        BITFIELD_FIELD(unsigned int x : 1,
+        __BITFIELD_FIELD(unsigned int x : 1,
-        BITFIELD_FIELD(unsigned int imm20_16 : 5,
+        __BITFIELD_FIELD(unsigned int imm20_16 : 5,
-        BITFIELD_FIELD(signed int imm25_21 : 5,
+        __BITFIELD_FIELD(signed int imm25_21 : 5,
        ;))))
 };
 struct m16e_i64 {
-        BITFIELD_FIELD(unsigned int opcode : 5,
+        __BITFIELD_FIELD(unsigned int opcode : 5,
-        BITFIELD_FIELD(unsigned int func : 3,
+        __BITFIELD_FIELD(unsigned int func : 3,
-        BITFIELD_FIELD(unsigned int imm : 8,
+        __BITFIELD_FIELD(unsigned int imm : 8,
        ;)))
 };
 struct m16e_ri64 {
-        BITFIELD_FIELD(unsigned int opcode : 5,
+        __BITFIELD_FIELD(unsigned int opcode : 5,
-        BITFIELD_FIELD(unsigned int func : 3,
+        __BITFIELD_FIELD(unsigned int func : 3,
-        BITFIELD_FIELD(unsigned int ry : 3,
+        __BITFIELD_FIELD(unsigned int ry : 3,
-        BITFIELD_FIELD(unsigned int imm : 5,
+        __BITFIELD_FIELD(unsigned int imm : 5,
        ;))))
 };
 struct m16e_ri {
-        BITFIELD_FIELD(unsigned int opcode : 5,
+        __BITFIELD_FIELD(unsigned int opcode : 5,
-        BITFIELD_FIELD(unsigned int rx : 3,
+        __BITFIELD_FIELD(unsigned int rx : 3,
-        BITFIELD_FIELD(unsigned int imm : 8,
+        __BITFIELD_FIELD(unsigned int imm : 8,
        ;)))
 };
 struct m16e_rri {
-        BITFIELD_FIELD(unsigned int opcode : 5,
+        __BITFIELD_FIELD(unsigned int opcode : 5,
-        BITFIELD_FIELD(unsigned int rx : 3,
+        __BITFIELD_FIELD(unsigned int rx : 3,
-        BITFIELD_FIELD(unsigned int ry : 3,
+        __BITFIELD_FIELD(unsigned int ry : 3,
-        BITFIELD_FIELD(unsigned int imm : 5,
+        __BITFIELD_FIELD(unsigned int imm : 5,
        ;))))
 };
 struct m16e_i8 {
-        BITFIELD_FIELD(unsigned int opcode : 5,
+        __BITFIELD_FIELD(unsigned int opcode : 5,
-        BITFIELD_FIELD(unsigned int func : 3,
+        __BITFIELD_FIELD(unsigned int func : 3,
-        BITFIELD_FIELD(unsigned int imm : 8,
+        __BITFIELD_FIELD(unsigned int imm : 8,
        ;)))
 };
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index d6e154a9e6a5..2692abb28e36 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -371,11 +371,12 @@
 #define __NR_finit_module               (__NR_Linux + 348)
 #define __NR_sched_setattr              (__NR_Linux + 349)
 #define __NR_sched_getattr              (__NR_Linux + 350)
+#define __NR_renameat2                  (__NR_Linux + 351)
 /*
 * Offset of the last Linux o32 flavoured syscall
 */
-#define __NR_Linux_syscalls             350
+#define __NR_Linux_syscalls             351
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
@@ -699,11 +700,12 @@
 #define __NR_getdents64                 (__NR_Linux + 308)
 #define __NR_sched_setattr              (__NR_Linux + 309)
 #define __NR_sched_getattr              (__NR_Linux + 310)
+#define __NR_renameat2                  (__NR_Linux + 311)
 /*
 * Offset of the last Linux 64-bit flavoured syscall
 */
-#define __NR_Linux_syscalls             310
+#define __NR_Linux_syscalls             311
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
@@ -1031,11 +1033,12 @@
 #define __NR_finit_module               (__NR_Linux + 312)
 #define __NR_sched_setattr              (__NR_Linux + 313)
 #define __NR_sched_getattr              (__NR_Linux + 314)
+#define __NR_renameat2                  (__NR_Linux + 315)
 /*
 * Offset of the last N32 flavoured syscall
 */
-#define __NR_Linux_syscalls             314
+#define __NR_Linux_syscalls             315
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
index e40971b51d2f..037a44d962f3 100644
--- a/arch/mips/kernel/proc.c
+++ b/arch/mips/kernel/proc.c
@@ -124,14 +124,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
        seq_printf(m, "kscratch registers\t: %d\n",
                      hweight8(cpu_data[n].kscratch_mask));
        seq_printf(m, "core\t\t\t: %d\n", cpu_data[n].core);
-#if defined(CONFIG_MIPS_MT_SMP) || defined(CONFIG_MIPS_MT_SMTC)
-        if (cpu_has_mipsmt) {
-                seq_printf(m, "VPE\t\t\t: %d\n", cpu_data[n].vpe_id);
-#if defined(CONFIG_MIPS_MT_SMTC)
-                seq_printf(m, "TC\t\t\t: %d\n", cpu_data[n].tc_id);
-#endif
-        }
-#endif
        sprintf(fmt, "VCE%%c exceptions\t\t: %s\n",
                      cpu_has_vce ? "%u" : "not available");
        seq_printf(m, fmt, 'D', vced_count);
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index fdc70b400442..3245474f19d5 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -577,3 +577,4 @@ EXPORT(sys_call_table)
        PTR     sys_finit_module
        PTR     sys_sched_setattr
        PTR     sys_sched_getattr               /* 4350 */
+        PTR     sys_renameat2
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index dd99c3285aea..be2fedd4ae33 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -430,4 +430,5 @@ EXPORT(sys_call_table)
        PTR     sys_getdents64
        PTR     sys_sched_setattr
        PTR     sys_sched_getattr               /* 5310 */
+        PTR     sys_renameat2
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index f68d2f4f0090..c1dbcda4b816 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -423,4 +423,5 @@ EXPORT(sysn32_call_table)
        PTR     sys_finit_module
        PTR     sys_sched_setattr
        PTR     sys_sched_getattr
+        PTR     sys_renameat2                   /* 6315 */
        .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 70f6acecd928..f1343ccd7ed7 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -556,4 +556,5 @@ EXPORT(sys32_call_table)
        PTR     sys_finit_module
        PTR     sys_sched_setattr
        PTR     sys_sched_getattr               /* 4350 */
+        PTR     sys_renameat2
        .size   sys32_call_table,.-sys32_call_table
diff --git a/arch/mips/lantiq/dts/easy50712.dts b/arch/mips/lantiq/dts/easy50712.dts
index fac1f5b178eb..143b8a37b5e4 100644
--- a/arch/mips/lantiq/dts/easy50712.dts
+++ b/arch/mips/lantiq/dts/easy50712.dts
@@ -8,6 +8,7 @@
        };
        memory@0 {
+                device_type = "memory";
                reg = <0x0 0x2000000>;
        };
diff --git a/arch/mips/lib/csum_partial.S b/arch/mips/lib/csum_partial.S
index 2e4825e48388..9901237563c5 100644
--- a/arch/mips/lib/csum_partial.S
+++ b/arch/mips/lib/csum_partial.S
@@ -56,14 +56,20 @@
 #define UNIT(unit)  ((unit)*NBYTES)
 #define ADDC(sum,reg)                                           \
+        .set    push;                                           \
+        .set    noat;                                           \
        ADD     sum, reg;                                       \
        sltu    v1, sum, reg;                                   \
        ADD     sum, v1;                                        \
+        .set    pop
 #define ADDC32(sum,reg)                                         \
+        .set    push;                                           \
+        .set    noat;                                           \
        addu    sum, reg;                                       \
        sltu    v1, sum, reg;                                   \
        addu    sum, v1;                                        \
+        .set    pop
 #define CSUM_BIGCHUNK1(src, offset, sum, _t0, _t1, _t2, _t3)    \
        LOAD    _t0, (offset + UNIT(0))(src);                   \
@@ -710,6 +716,8 @@ LEAF(csum_partial)
        ADDC(sum, t2)
 .Ldone\@:
        /* fold checksum */
+        .set    push
+        .set    noat
 #ifdef USE_DOUBLE
        dsll32  v1, sum, 0
        daddu   sum, v1
@@ -732,6 +740,7 @@ LEAF(csum_partial)
        or      sum, sum, t0
 1:
 #endif
+        .set    pop
        .set reorder
        ADDC32(sum, psum)
        jr      ra
diff --git a/arch/mips/lib/delay.c b/arch/mips/lib/delay.c
index 44713af15a62..705cfb7c1a74 100644
--- a/arch/mips/lib/delay.c
+++ b/arch/mips/lib/delay.c
@@ -6,7 +6,7 @@
 * Copyright (C) 1994 by Waldorf Electronics
 * Copyright (C) 1995 - 2000, 01, 03 by Ralf Baechle
 * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
- * Copyright (C) 2007  Maciej W. Rozycki
+ * Copyright (C) 2007, 2014 Maciej W. Rozycki
 */
 #include <linux/module.h>
 #include <linux/param.h>
@@ -15,6 +15,12 @@
 #include <asm/compiler.h>
 #include <asm/war.h>
+#ifndef CONFIG_CPU_DADDI_WORKAROUNDS
+#define GCC_DADDI_IMM_ASM() "I"
+#else
+#define GCC_DADDI_IMM_ASM() "r"
+#endif
 void __delay(unsigned long loops)
 {
        __asm__ __volatile__ (
@@ -22,13 +28,13 @@ void __delay(unsigned long loops)
        "       .align  3                                       \n"
        "1:     bnez    %0, 1b                                  \n"
 #if BITS_PER_LONG == 32
-        "       subu    %0, 1                                   \n"
+        "       subu    %0, %1                                  \n"
 #else
-        "       dsubu   %0, 1                                   \n"
+        "       dsubu   %0, %1                                  \n"
 #endif
        "       .set    reorder                                 \n"
        : "=r" (loops)
-        : "0" (loops));
+        : GCC_DADDI_IMM_ASM() (1), "0" (loops));
 }
 EXPORT_SYMBOL(__delay);
diff --git a/arch/mips/lib/strncpy_user.S b/arch/mips/lib/strncpy_user.S
index d3301cd1e9a5..3c32baf8b494 100644
--- a/arch/mips/lib/strncpy_user.S
+++ b/arch/mips/lib/strncpy_user.S
@@ -35,7 +35,6 @@ LEAF(__strncpy_from_\func\()_asm)
        bnez            v0, .Lfault\@
 FEXPORT(__strncpy_from_\func\()_nocheck_asm)
-        .set            noreorder
        move            t0, zero
        move            v1, a1
 .ifeqs "\func","kernel"
@@ -45,21 +44,21 @@ FEXPORT(__strncpy_from_\func\()_nocheck_asm)
 .endif
        PTR_ADDIU       v1, 1
        R10KCBARRIER(0(ra))
+        sb              v0, (a0)
        beqz            v0, 2f
-         sb             v0, (a0)
        PTR_ADDIU       t0, 1
+        PTR_ADDIU       a0, 1
        bne             t0, a2, 1b
-         PTR_ADDIU      a0, 1
 2:      PTR_ADDU        v0, a1, t0
        xor             v0, a1
        bltz            v0, .Lfault\@
-         nop
+        move            v0, t0
        jr              ra                      # return n
-         move           v0, t0
        END(__strncpy_from_\func\()_asm)
-.Lfault\@: jr           ra
+.Lfault\@:
-          li            v0, -EFAULT
+        li              v0, -EFAULT
+        jr              ra
        .section        __ex_table,"a"
        PTR             1b, .Lfault\@
diff --git a/arch/mips/loongson/Kconfig b/arch/mips/loongson/Kconfig
index 7397be226a06..603d79a95f47 100644
--- a/arch/mips/loongson/Kconfig
+++ b/arch/mips/loongson/Kconfig
@@ -64,7 +64,6 @@ config LEMOTE_MACH3A
        bool "Lemote Loongson 3A family machines"
        select ARCH_SPARSEMEM_ENABLE
        select GENERIC_ISA_DMA_SUPPORT_BROKEN
-        select GENERIC_HARDIRQS_NO__DO_IRQ
        select BOOT_ELF32
        select BOARD_SCACHE
        select CSRC_R4K
diff --git a/arch/mips/loongson/lemote-2f/clock.c b/arch/mips/loongson/lemote-2f/clock.c
index e1f427f4f5f3..67dd94ef28e6 100644
--- a/arch/mips/loongson/lemote-2f/clock.c
+++ b/arch/mips/loongson/lemote-2f/clock.c
@@ -91,6 +91,7 @@ EXPORT_SYMBOL(clk_put);
 int clk_set_rate(struct clk *clk, unsigned long rate)
 {
+        unsigned int rate_khz = rate / 1000;
        int ret = 0;
        int regval;
        int i;
@@ -111,10 +112,10 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
                if (loongson2_clockmod_table[i].frequency ==
                    CPUFREQ_ENTRY_INVALID)
                        continue;
-                if (rate == loongson2_clockmod_table[i].frequency)
+                if (rate_khz == loongson2_clockmod_table[i].frequency)
                        break;
        }
-        if (rate != loongson2_clockmod_table[i].frequency)
+        if (rate_khz != loongson2_clockmod_table[i].frequency)
                return -ENOTSUPP;
        clk->rate = rate;
diff --git a/arch/mips/mm/tlb-funcs.S b/arch/mips/mm/tlb-funcs.S
index 30a494db99c2..a5427c6e9757 100644
--- a/arch/mips/mm/tlb-funcs.S
+++ b/arch/mips/mm/tlb-funcs.S
@@ -16,8 +16,10 @@
 #define FASTPATH_SIZE   128
+EXPORT(tlbmiss_handler_setup_pgd_start)
 LEAF(tlbmiss_handler_setup_pgd)
-        .space          16 * 4
+1:      j       1b              /* Dummy, will be replaced. */
+        .space  64
 END(tlbmiss_handler_setup_pgd)
 EXPORT(tlbmiss_handler_setup_pgd_end)
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index ee88367ab3ad..f99ec587b151 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -1422,16 +1422,17 @@ static void build_r4000_tlb_refill_handler(void)
 extern u32 handle_tlbl[], handle_tlbl_end[];
 extern u32 handle_tlbs[], handle_tlbs_end[];
 extern u32 handle_tlbm[], handle_tlbm_end[];
-extern u32 tlbmiss_handler_setup_pgd[], tlbmiss_handler_setup_pgd_end[];
+extern u32 tlbmiss_handler_setup_pgd_start[], tlbmiss_handler_setup_pgd[];
+extern u32 tlbmiss_handler_setup_pgd_end[];
 static void build_setup_pgd(void)
 {
        const int a0 = 4;
        const int __maybe_unused a1 = 5;
        const int __maybe_unused a2 = 6;
-        u32 *p = tlbmiss_handler_setup_pgd;
+        u32 *p = tlbmiss_handler_setup_pgd_start;
        const int tlbmiss_handler_setup_pgd_size =
-                tlbmiss_handler_setup_pgd_end - tlbmiss_handler_setup_pgd;
+                tlbmiss_handler_setup_pgd_end - tlbmiss_handler_setup_pgd_start;
 #ifndef CONFIG_MIPS_PGD_C0_CONTEXT
        long pgdc = (long)pgd_current;
 #endif
diff --git a/arch/mips/ralink/dts/mt7620a_eval.dts b/arch/mips/ralink/dts/mt7620a_eval.dts
index 35eb874ab7f1..709f58132f5c 100644
--- a/arch/mips/ralink/dts/mt7620a_eval.dts
+++ b/arch/mips/ralink/dts/mt7620a_eval.dts
@@ -7,6 +7,7 @@
        model = "Ralink MT7620A evaluation board";
        memory@0 {
+                device_type = "memory";
                reg = <0x0 0x2000000>;
        };
diff --git a/arch/mips/ralink/dts/rt2880_eval.dts b/arch/mips/ralink/dts/rt2880_eval.dts
index 322d7002595b..0a685db093d4 100644
--- a/arch/mips/ralink/dts/rt2880_eval.dts
+++ b/arch/mips/ralink/dts/rt2880_eval.dts
@@ -7,6 +7,7 @@
        model = "Ralink RT2880 evaluation board";
        memory@0 {
+                device_type = "memory";
                reg = <0x8000000 0x2000000>;
        };
diff --git a/arch/mips/ralink/dts/rt3052_eval.dts b/arch/mips/ralink/dts/rt3052_eval.dts
index 0ac73ea28198..ec9e9a035541 100644
--- a/arch/mips/ralink/dts/rt3052_eval.dts
+++ b/arch/mips/ralink/dts/rt3052_eval.dts
@@ -7,6 +7,7 @@
        model = "Ralink RT3052 evaluation board";
        memory@0 {
+                device_type = "memory";
                reg = <0x0 0x2000000>;
        };
diff --git a/arch/mips/ralink/dts/rt3883_eval.dts b/arch/mips/ralink/dts/rt3883_eval.dts
index 2fa6b330bf4f..e8df21a5d10d 100644
--- a/arch/mips/ralink/dts/rt3883_eval.dts
+++ b/arch/mips/ralink/dts/rt3883_eval.dts
@@ -7,6 +7,7 @@
        model = "Ralink RT3883 evaluation board";
        memory@0 {
+                device_type = "memory";
                reg = <0x0 0x2000000>;
        };
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 1faefed32749..108d48e652af 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -22,6 +22,7 @@ config PARISC
        select GENERIC_SMP_IDLE_THREAD
        select GENERIC_STRNCPY_FROM_USER
        select SYSCTL_ARCH_UNALIGN_ALLOW
+        select SYSCTL_EXCEPTION_TRACE
        select HAVE_MOD_ARCH_SPECIFIC
        select VIRT_TO_BUS
        select MODULES_USE_ELF_RELA
diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
index 198a86feb574..d951c9681ab3 100644
--- a/arch/parisc/include/asm/processor.h
+++ b/arch/parisc/include/asm/processor.h
@@ -55,6 +55,11 @@
 #define STACK_TOP       TASK_SIZE
 #define STACK_TOP_MAX   DEFAULT_TASK_SIZE
+/* Allow bigger stacks for 64-bit processes */
+#define STACK_SIZE_MAX  (USER_WIDE_MODE                                 \
+                         ? (1 << 30)    /* 1 GB */                      \
+                         : (CONFIG_MAX_STACK_SIZE_MB*1024*1024))
 #endif
 #ifndef __ASSEMBLY__
diff --git a/arch/parisc/include/uapi/asm/Kbuild b/arch/parisc/include/uapi/asm/Kbuild
index a580642555b6..348356c99514 100644
--- a/arch/parisc/include/uapi/asm/Kbuild
+++ b/arch/parisc/include/uapi/asm/Kbuild
@@ -1,6 +1,8 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+generic-y += resource.h
 header-y += bitsperlong.h
 header-y += byteorder.h
 header-y += errno.h
@@ -13,7 +15,6 @@ header-y += msgbuf.h
 header-y += pdc.h
 header-y += posix_types.h
 header-y += ptrace.h
-header-y += resource.h
 header-y += sembuf.h
 header-y += setup.h
 header-y += shmbuf.h
diff --git a/arch/parisc/include/uapi/asm/resource.h b/arch/parisc/include/uapi/asm/resource.h
deleted file mode 100644
index 8b06343b62ed..000000000000
--- a/arch/parisc/include/uapi/asm/resource.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _ASM_PARISC_RESOURCE_H
-#define _ASM_PARISC_RESOURCE_H
-#define _STK_LIM_MAX    10 * _STK_LIM
-#include <asm-generic/resource.h>
-#endif
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 265ae5190b0a..47e0e21d2272 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -829,8 +829,9 @@
 #define __NR_sched_setattr      (__NR_Linux + 334)
 #define __NR_sched_getattr      (__NR_Linux + 335)
 #define __NR_utimes             (__NR_Linux + 336)
+#define __NR_renameat2          (__NR_Linux + 337)
-#define __NR_Linux_syscalls     (__NR_utimes + 1)
+#define __NR_Linux_syscalls     (__NR_renameat2 + 1)
 #define __IGNORE_select         /* newselect */
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 31ffa9b55322..e1ffea2f9a0b 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -72,10 +72,10 @@ static unsigned long mmap_upper_limit(void)
 {
        unsigned long stack_base;
-        /* Limit stack size to 1GB - see setup_arg_pages() in fs/exec.c */
+        /* Limit stack size - see setup_arg_pages() in fs/exec.c */
        stack_base = rlimit_max(RLIMIT_STACK);
-        if (stack_base > (1 << 30))
+        if (stack_base > STACK_SIZE_MAX)
-                stack_base = 1 << 30;
+                stack_base = STACK_SIZE_MAX;
        return PAGE_ALIGN(STACK_TOP - stack_base);
 }
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index a63bb179f79a..838786011037 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -589,10 +589,13 @@ cas_nocontend:
 # endif
 /* ENABLE_LWS_DEBUG */
+        rsm     PSW_SM_I, %r0                           /* Disable interrupts */
+        /* COW breaks can cause contention on UP systems */
        LDCW    0(%sr2,%r20), %r28                      /* Try to acquire the lock */
        cmpb,<>,n       %r0, %r28, cas_action           /* Did we get it? */
 cas_wouldblock:
        ldo     2(%r0), %r28                            /* 2nd case */
+        ssm     PSW_SM_I, %r0
        b       lws_exit                                /* Contended... */
        ldo     -EAGAIN(%r0), %r21                      /* Spin in userspace */
@@ -619,15 +622,17 @@ cas_action:
        stw     %r1, 4(%sr2,%r20)
 #endif
        /* The load and store could fail */
-1:      ldw     0(%sr3,%r26), %r28
+1:      ldw,ma  0(%sr3,%r26), %r28
        sub,<>  %r28, %r25, %r0
-2:      stw     %r24, 0(%sr3,%r26)
+2:      stw,ma  %r24, 0(%sr3,%r26)
        /* Free lock */
-        stw     %r20, 0(%sr2,%r20)
+        stw,ma  %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
        /* Clear thread register indicator */
        stw     %r0, 4(%sr2,%r20)
 #endif
+        /* Enable interrupts */
+        ssm     PSW_SM_I, %r0
        /* Return to userspace, set no error */
        b       lws_exit
        copy    %r0, %r21
@@ -639,6 +644,7 @@ cas_action:
 #if ENABLE_LWS_DEBUG
        stw     %r0, 4(%sr2,%r20)
 #endif
+        ssm     PSW_SM_I, %r0
        b       lws_exit
        ldo     -EFAULT(%r0),%r21       /* set errno */
        nop
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 83ead0ea127d..f1432da7b4c0 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -432,6 +432,7 @@
        ENTRY_SAME(sched_setattr)
        ENTRY_SAME(sched_getattr)       /* 335 */
        ENTRY_COMP(utimes)
+        ENTRY_COMP(renameat2)
        /* Nothing yet */
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 1cd1d0c83b6d..47ee620d15d2 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -25,6 +25,7 @@
 #include <linux/interrupt.h>
 #include <linux/console.h>
 #include <linux/bug.h>
+#include <linux/ratelimit.h>
 #include <asm/assembly.h>
 #include <asm/uaccess.h>
@@ -42,9 +43,6 @@
 #include "../math-emu/math-emu.h"       /* for handle_fpe() */
-#define PRINT_USER_FAULTS /* (turn this on if you want user faults to be */
-                          /*  dumped to the console via printk)          */
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
 DEFINE_SPINLOCK(pa_dbit_lock);
 #endif
@@ -160,6 +158,17 @@ void show_regs(struct pt_regs *regs)
        }
 }
+static DEFINE_RATELIMIT_STATE(_hppa_rs,
+        DEFAULT_RATELIMIT_INTERVAL, DEFAULT_RATELIMIT_BURST);
+#define parisc_printk_ratelimited(critical, regs, fmt, ...)     {             \
+        if ((critical || show_unhandled_signals) && __ratelimit(&_hppa_rs)) { \
+                printk(fmt, ##__VA_ARGS__);                                   \
+                show_regs(regs);                                              \
+        }                                                                     \
+}
 static void do_show_stack(struct unwind_frame_info *info)
 {
        int i = 1;
@@ -229,12 +238,10 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)
                if (err == 0)
                        return; /* STFU */
-                printk(KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
+                parisc_printk_ratelimited(1, regs,
+                        KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
                        current->comm, task_pid_nr(current), str, err, regs->iaoq[0]);
-#ifdef PRINT_USER_FAULTS
-                /* XXX for debugging only */
-                show_regs(regs);
-#endif
                return;
        }
@@ -321,14 +328,11 @@ static void handle_break(struct pt_regs *regs)
                        (tt == BUG_TRAP_TYPE_NONE) ? 9 : 0);
        }
-#ifdef PRINT_USER_FAULTS
+        if (unlikely(iir != GDB_BREAK_INSN))
-        if (unlikely(iir != GDB_BREAK_INSN)) {
+                parisc_printk_ratelimited(0, regs,
-                printk(KERN_DEBUG "break %d,%d: pid=%d command='%s'\n",
+                        KERN_DEBUG "break %d,%d: pid=%d command='%s'\n",
                        iir & 31, (iir>>13) & ((1<<13)-1),
                        task_pid_nr(current), current->comm);
-                show_regs(regs);
-        }
-#endif
        /* send standard GDB signal */
        handle_gdb_break(regs, TRAP_BRKPT);
@@ -758,11 +762,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
        default:
                if (user_mode(regs)) {
-#ifdef PRINT_USER_FAULTS
+                        parisc_printk_ratelimited(0, regs, KERN_DEBUG
-                        printk(KERN_DEBUG "\nhandle_interruption() pid=%d command='%s'\n",
+                                "handle_interruption() pid=%d command='%s'\n",
-                            task_pid_nr(current), current->comm);
+                                task_pid_nr(current), current->comm);
-                        show_regs(regs);
-#endif
                        /* SIGBUS, for lack of a better one. */
                        si.si_signo = SIGBUS;
                        si.si_code = BUS_OBJERR;
@@ -779,16 +781,10 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
        if (user_mode(regs)) {
            if ((fault_space >> SPACEID_SHIFT) != (regs->sr[7] >> SPACEID_SHIFT)) {
-#ifdef PRINT_USER_FAULTS
+                parisc_printk_ratelimited(0, regs, KERN_DEBUG
-                if (fault_space == 0)
+                                "User fault %d on space 0x%08lx, pid=%d command='%s'\n",
-                        printk(KERN_DEBUG "User Fault on Kernel Space ");
+                                code, fault_space,
-                else
+                                task_pid_nr(current), current->comm);
-                        printk(KERN_DEBUG "User Fault (long pointer) (fault %d) ",
-                               code);
-                printk(KERN_CONT "pid=%d command='%s'\n",
-                       task_pid_nr(current), current->comm);
-                show_regs(regs);
-#endif
                si.si_signo = SIGSEGV;
                si.si_errno = 0;
                si.si_code = SEGV_MAPERR;
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 747550762f3c..3ca9c1131cfe 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -19,10 +19,6 @@
 #include <asm/uaccess.h>
 #include <asm/traps.h>
-#define PRINT_USER_FAULTS /* (turn this on if you want user faults to be */
-                         /*  dumped to the console via printk)          */
 /* Various important other fields */
 #define bit22set(x)             (x & 0x00000200)
 #define bits23_25set(x)         (x & 0x000001c0)
@@ -34,6 +30,8 @@
 DEFINE_PER_CPU(struct exception_data, exception_data);
+int show_unhandled_signals = 1;
 /*
 * parisc_acctyp(unsigned int inst) --
 *    Given a PA-RISC memory access instruction, determine if the
@@ -173,6 +171,32 @@ int fixup_exception(struct pt_regs *regs)
        return 0;
 }
+/*
+ * Print out info about fatal segfaults, if the show_unhandled_signals
+ * sysctl is set:
+ */
+static inline void
+show_signal_msg(struct pt_regs *regs, unsigned long code,
+                unsigned long address, struct task_struct *tsk,
+                struct vm_area_struct *vma)
+{
+        if (!unhandled_signal(tsk, SIGSEGV))
+                return;
+        if (!printk_ratelimit())
+                return;
+        pr_warn("\n");
+        pr_warn("do_page_fault() command='%s' type=%lu address=0x%08lx",
+            tsk->comm, code, address);
+        print_vma_addr(KERN_CONT " in ", regs->iaoq[0]);
+        if (vma)
+                pr_warn(" vm_start = 0x%08lx, vm_end = 0x%08lx\n",
+                                vma->vm_start, vma->vm_end);
+        show_regs(regs);
+}
 void do_page_fault(struct pt_regs *regs, unsigned long code,
                              unsigned long address)
 {
@@ -270,16 +294,8 @@ bad_area:
        if (user_mode(regs)) {
                struct siginfo si;
-#ifdef PRINT_USER_FAULTS
+                show_signal_msg(regs, code, address, tsk, vma);
-                printk(KERN_DEBUG "\n");
-                printk(KERN_DEBUG "do_page_fault() pid=%d command='%s' type=%lu address=0x%08lx\n",
-                    task_pid_nr(tsk), tsk->comm, code, address);
-                if (vma) {
-                        printk(KERN_DEBUG "vm_start = 0x%08lx, vm_end = 0x%08lx\n",
-                                        vma->vm_start, vma->vm_end);
-                }
-                show_regs(regs);
-#endif
                switch (code) {
                case 15:        /* Data TLB miss fault/Data page fault */
                        /* send SIGSEGV when outside of vma */
diff --git a/arch/powerpc/boot/main.c b/arch/powerpc/boot/main.c
index a28f02165e97..d367a0aece2a 100644
--- a/arch/powerpc/boot/main.c
+++ b/arch/powerpc/boot/main.c
@@ -139,18 +139,18 @@ static struct addr_range prep_initrd(struct addr_range vmlinux, void *chosen,
 * edit the command line passed to vmlinux (by setting /chosen/bootargs).
 * The buffer is put in it's own section so that tools may locate it easier.
 */
-static char cmdline[COMMAND_LINE_SIZE]
+static char cmdline[BOOT_COMMAND_LINE_SIZE]
        __attribute__((__section__("__builtin_cmdline")));
 static void prep_cmdline(void *chosen)
 {
        if (cmdline[0] == '\0')
-                getprop(chosen, "bootargs", cmdline, COMMAND_LINE_SIZE-1);
+                getprop(chosen, "bootargs", cmdline, BOOT_COMMAND_LINE_SIZE-1);
        printf("\n\rLinux/PowerPC load: %s", cmdline);
        /* If possible, edit the command line */
        if (console_ops.edit_cmdline)
-                console_ops.edit_cmdline(cmdline, COMMAND_LINE_SIZE);
+                console_ops.edit_cmdline(cmdline, BOOT_COMMAND_LINE_SIZE);
        printf("\n\r");
        /* Put the command line back into the devtree for the kernel */
@@ -174,7 +174,7 @@ void start(void)
         * built-in command line wasn't set by an external tool */
        if ((loader_info.cmdline_len > 0) && (cmdline[0] == '\0'))
                memmove(cmdline, loader_info.cmdline,
-                        min(loader_info.cmdline_len, COMMAND_LINE_SIZE-1));
+                        min(loader_info.cmdline_len, BOOT_COMMAND_LINE_SIZE-1));
        if (console_ops.open && (console_ops.open() < 0))
                exit();
diff --git a/arch/powerpc/boot/ops.h b/arch/powerpc/boot/ops.h
index b3218ce451bb..8aad3c55aeda 100644
--- a/arch/powerpc/boot/ops.h
+++ b/arch/powerpc/boot/ops.h
@@ -15,7 +15,7 @@
 #include "types.h"
 #include "string.h"
-#define COMMAND_LINE_SIZE       512
+#define BOOT_COMMAND_LINE_SIZE  2048
 #define MAX_PATH_LEN            256
 #define MAX_PROP_LEN            256 /* What should this be? */
diff --git a/arch/powerpc/boot/ps3.c b/arch/powerpc/boot/ps3.c
index 9954d98871d0..4ec2d86d3c50 100644
--- a/arch/powerpc/boot/ps3.c
+++ b/arch/powerpc/boot/ps3.c
@@ -47,13 +47,13 @@ BSS_STACK(4096);
 * The buffer is put in it's own section so that tools may locate it easier.
 */
-static char cmdline[COMMAND_LINE_SIZE]
+static char cmdline[BOOT_COMMAND_LINE_SIZE]
        __attribute__((__section__("__builtin_cmdline")));
 static void prep_cmdline(void *chosen)
 {
        if (cmdline[0] == '\0')
-                getprop(chosen, "bootargs", cmdline, COMMAND_LINE_SIZE-1);
+                getprop(chosen, "bootargs", cmdline, BOOT_COMMAND_LINE_SIZE-1);
        else
                setprop_str(chosen, "bootargs", cmdline);
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index a2efdaa020b0..66ad7a74116f 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -41,14 +41,14 @@ struct opal_takeover_args {
 * size except the last one in the list to be as well.
 */
 struct opal_sg_entry {
-        void    *data;
+        __be64 data;
-        long    length;
+        __be64 length;
 };
-/* sg list */
+/* SG list */
 struct opal_sg_list {
-        unsigned long num_entries;
+        __be64 length;
-        struct opal_sg_list *next;
+        __be64 next;
        struct opal_sg_entry entry[];
 };
@@ -858,8 +858,8 @@ int64_t opal_lpc_write(uint32_t chip_id, enum OpalLPCAddressType addr_type,
 int64_t opal_lpc_read(uint32_t chip_id, enum OpalLPCAddressType addr_type,
                      uint32_t addr, __be32 *data, uint32_t sz);
-int64_t opal_read_elog(uint64_t buffer, size_t size, uint64_t log_id);
+int64_t opal_read_elog(uint64_t buffer, uint64_t size, uint64_t log_id);
-int64_t opal_get_elog_size(uint64_t *log_id, size_t *size, uint64_t *elog_type);
+int64_t opal_get_elog_size(__be64 *log_id, __be64 *size, __be64 *elog_type);
 int64_t opal_write_elog(uint64_t buffer, uint64_t size, uint64_t offset);
 int64_t opal_send_ack_elog(uint64_t log_id);
 void opal_resend_pending_logs(void);
@@ -868,23 +868,24 @@ int64_t opal_validate_flash(uint64_t buffer, uint32_t *size, uint32_t *result);
 int64_t opal_manage_flash(uint8_t op);
 int64_t opal_update_flash(uint64_t blk_list);
 int64_t opal_dump_init(uint8_t dump_type);
-int64_t opal_dump_info(uint32_t *dump_id, uint32_t *dump_size);
+int64_t opal_dump_info(__be32 *dump_id, __be32 *dump_size);
-int64_t opal_dump_info2(uint32_t *dump_id, uint32_t *dump_size, uint32_t *dump_type);
+int64_t opal_dump_info2(__be32 *dump_id, __be32 *dump_size, __be32 *dump_type);
 int64_t opal_dump_read(uint32_t dump_id, uint64_t buffer);
 int64_t opal_dump_ack(uint32_t dump_id);
 int64_t opal_dump_resend_notification(void);
-int64_t opal_get_msg(uint64_t buffer, size_t size);
+int64_t opal_get_msg(uint64_t buffer, uint64_t size);
-int64_t opal_check_completion(uint64_t buffer, size_t size, uint64_t token);
+int64_t opal_check_completion(uint64_t buffer, uint64_t size, uint64_t token);
 int64_t opal_sync_host_reboot(void);
 int64_t opal_get_param(uint64_t token, uint32_t param_id, uint64_t buffer,
-                size_t length);
+                uint64_t length);
 int64_t opal_set_param(uint64_t token, uint32_t param_id, uint64_t buffer,
-                size_t length);
+                uint64_t length);
 int64_t opal_sensor_read(uint32_t sensor_hndl, int token, __be32 *sensor_data);
 /* Internal functions */
-extern int early_init_dt_scan_opal(unsigned long node, const char *uname, int depth, void *data);
+extern int early_init_dt_scan_opal(unsigned long node, const char *uname,
+                                   int depth, void *data);
 extern int early_init_dt_scan_recoverable_ranges(unsigned long node,
                                 const char *uname, int depth, void *data);
@@ -893,10 +894,6 @@ extern int opal_put_chars(uint32_t vtermno, const char *buf, int total_len);
 extern void hvc_opal_init_early(void);
-/* Internal functions */
-extern int early_init_dt_scan_opal(unsigned long node, const char *uname,
-                                   int depth, void *data);
 extern int opal_notifier_register(struct notifier_block *nb);
 extern int opal_notifier_unregister(struct notifier_block *nb);
@@ -906,9 +903,6 @@ extern void opal_notifier_enable(void);
 extern void opal_notifier_disable(void);
 extern void opal_notifier_update_evt(uint64_t evt_mask, uint64_t evt_val);
-extern int opal_get_chars(uint32_t vtermno, char *buf, int count);
-extern int opal_put_chars(uint32_t vtermno, const char *buf, int total_len);
 extern int __opal_async_get_token(void);
 extern int opal_async_get_token_interruptible(void);
 extern int __opal_async_release_token(int token);
@@ -916,8 +910,6 @@ extern int opal_async_release_token(int token);
 extern int opal_async_wait_response(uint64_t token, struct opal_msg *msg);
 extern int opal_get_sensor_data(u32 sensor_hndl, u32 *sensor_data);
-extern void hvc_opal_init_early(void);
 struct rtc_time;
 extern int opal_set_rtc_time(struct rtc_time *tm);
 extern void opal_get_rtc_time(struct rtc_time *tm);
@@ -937,6 +929,10 @@ extern int opal_resync_timebase(void);
 extern void opal_lpc_init(void);
+struct opal_sg_list *opal_vmalloc_to_sg_list(void *vmalloc_addr,
+                                             unsigned long vmalloc_size);
+void opal_free_sg_list(struct opal_sg_list *sg);
 #endif /* __ASSEMBLY__ */
 #endif /* __OPAL_H */
diff --git a/arch/powerpc/include/uapi/asm/setup.h b/arch/powerpc/include/uapi/asm/setup.h
index 552df83f1a49..ae3fb68cb28e 100644
--- a/arch/powerpc/include/uapi/asm/setup.h
+++ b/arch/powerpc/include/uapi/asm/setup.h
@@ -1 +1,6 @@
-#include <asm-generic/setup.h>
+#ifndef _UAPI_ASM_POWERPC_SETUP_H
+#define _UAPI_ASM_POWERPC_SETUP_H
+#define COMMAND_LINE_SIZE       2048
+#endif /* _UAPI_ASM_POWERPC_SETUP_H */
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index 3bd77edd7610..450850a49dce 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -120,6 +120,7 @@ EXPORT_SYMBOL(giveup_spe);
 EXPORT_SYMBOL(flush_instruction_cache);
 #endif
 EXPORT_SYMBOL(flush_dcache_range);
+EXPORT_SYMBOL(flush_icache_range);
 #ifdef CONFIG_SMP
 #ifdef CONFIG_PPC32
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 2f3cdb01506d..658e89d2025b 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -705,7 +705,7 @@ static int __init rtas_flash_init(void)
        if (rtas_token("ibm,update-flash-64-and-reboot") ==
                       RTAS_UNKNOWN_SERVICE) {
                pr_info("rtas_flash: no firmware flash support\n");
-                return 1;
+                return -EINVAL;
        }
        rtas_validate_flash_data.buf = kzalloc(VALIDATE_BUF_SIZE, GFP_KERNEL);
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 122a580f7322..7e711bdcc6da 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -813,9 +813,6 @@ static void __init clocksource_init(void)
 static int decrementer_set_next_event(unsigned long evt,
                                      struct clock_event_device *dev)
 {
-        /* Don't adjust the decrementer if some irq work is pending */
-        if (test_irq_work_pending())
-                return 0;
        __get_cpu_var(decrementers_next_tb) = get_tb_or_rtc() + evt;
        set_dec(evt);
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index ffbb871c2bd8..b031f932c0cc 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -242,6 +242,12 @@ kvm_novcpu_exit:
 */
        .globl  kvm_start_guest
 kvm_start_guest:
+        /* Set runlatch bit the minute you wake up from nap */
+        mfspr   r1, SPRN_CTRLF
+        ori     r1, r1, 1
+        mtspr   SPRN_CTRLT, r1
        ld      r2,PACATOC(r13)
        li      r0,KVM_HWTHREAD_IN_KVM
@@ -309,6 +315,11 @@ kvm_no_guest:
        li      r0, KVM_HWTHREAD_IN_NAP
        stb     r0, HSTATE_HWTHREAD_STATE(r13)
 kvm_do_nap:
+        /* Clear the runlatch bit before napping */
+        mfspr   r2, SPRN_CTRLF
+        clrrdi  r2, r2, 1
+        mtspr   SPRN_CTRLT, r2
        li      r3, LPCR_PECE0
        mfspr   r4, SPRN_LPCR
        rlwimi  r4, r3, 0, LPCR_PECE0 | LPCR_PECE1
@@ -1999,8 +2010,13 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_206)
        /*
         * Take a nap until a decrementer or external or doobell interrupt
-         * occurs, with PECE1, PECE0 and PECEDP set in LPCR
+         * occurs, with PECE1, PECE0 and PECEDP set in LPCR. Also clear the
+         * runlatch bit before napping.
         */
+        mfspr   r2, SPRN_CTRLF
+        clrrdi  r2, r2, 1
+        mtspr   SPRN_CTRLT, r2
        li      r0,1
        stb     r0,HSTATE_HWTHREAD_REQ(r13)
        mfspr   r5,SPRN_LPCR
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index 3ea26c25590b..cf1d325eae8b 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -82,17 +82,14 @@ static inline void __tlbie(unsigned long vpn, int psize, int apsize, int ssize)
                va &= ~((1ul << mmu_psize_defs[apsize].shift) - 1);
                va |= penc << 12;
                va |= ssize << 8;
-                /* Add AVAL part */
+                /*
-                if (psize != apsize) {
+                 * AVAL bits:
-                        /*
+                 * We don't need all the bits, but rest of the bits
-                         * MPSS, 64K base page size and 16MB parge page size
+                 * must be ignored by the processor.
-                         * We don't need all the bits, but rest of the bits
+                 * vpn cover upto 65 bits of va. (0...65) and we need
-                         * must be ignored by the processor.
+                 * 58..64 bits of va.
-                         * vpn cover upto 65 bits of va. (0...65) and we need
+                 */
-                         * 58..64 bits of va.
+                va |= (vpn & 0xfe); /* AVAL */
-                         */
-                        va |= (vpn & 0xfe);
-                }
                va |= 1; /* L */
                asm volatile(ASM_FTR_IFCLR("tlbie %0,1", PPC_TLBIE(%1,%0), %2)
                             : : "r" (va), "r"(0), "i" (CPU_FTR_ARCH_206)
@@ -133,17 +130,14 @@ static inline void __tlbiel(unsigned long vpn, int psize, int apsize, int ssize)
                va &= ~((1ul << mmu_psize_defs[apsize].shift) - 1);
                va |= penc << 12;
                va |= ssize << 8;
-                /* Add AVAL part */
+                /*
-                if (psize != apsize) {
+                 * AVAL bits:
-                        /*
+                 * We don't need all the bits, but rest of the bits
-                         * MPSS, 64K base page size and 16MB parge page size
+                 * must be ignored by the processor.
-                         * We don't need all the bits, but rest of the bits
+                 * vpn cover upto 65 bits of va. (0...65) and we need
-                         * must be ignored by the processor.
+                 * 58..64 bits of va.
-                         * vpn cover upto 65 bits of va. (0...65) and we need
+                 */
-                         * 58..64 bits of va.
+                va |= (vpn & 0xfe);
-                         */
-                        va |= (vpn & 0xfe);
-                }
                va |= 1; /* L */
                asm volatile(".long 0x7c000224 | (%0 << 11) | (1 << 21)"
                             : : "r"(va) : "memory");
diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
index 297c91051413..e0766b82e165 100644
--- a/arch/powerpc/perf/hv-24x7.c
+++ b/arch/powerpc/perf/hv-24x7.c
@@ -155,16 +155,28 @@ static ssize_t read_offset_data(void *dest, size_t dest_len,
        return copy_len;
 }
-static unsigned long h_get_24x7_catalog_page(char page[static 4096],
+static unsigned long h_get_24x7_catalog_page_(unsigned long phys_4096,
-                                             u32 version, u32 index)
+                                              unsigned long version,
+                                              unsigned long index)
 {
-        WARN_ON(!IS_ALIGNED((unsigned long)page, 4096));
+        pr_devel("h_get_24x7_catalog_page(0x%lx, %lu, %lu)",
+                        phys_4096,
+                        version,
+                        index);
+        WARN_ON(!IS_ALIGNED(phys_4096, 4096));
        return plpar_hcall_norets(H_GET_24X7_CATALOG_PAGE,
-                        virt_to_phys(page),
+                        phys_4096,
                        version,
                        index);
 }
+static unsigned long h_get_24x7_catalog_page(char page[],
+                                             u64 version, u32 index)
+{
+        return h_get_24x7_catalog_page_(virt_to_phys(page),
+                                        version, index);
+}
 static ssize_t catalog_read(struct file *filp, struct kobject *kobj,
                            struct bin_attribute *bin_attr, char *buf,
                            loff_t offset, size_t count)
@@ -173,7 +185,7 @@ static ssize_t catalog_read(struct file *filp, struct kobject *kobj,
        ssize_t ret = 0;
        size_t catalog_len = 0, catalog_page_len = 0, page_count = 0;
        loff_t page_offset = 0;
-        uint32_t catalog_version_num = 0;
+        uint64_t catalog_version_num = 0;
        void *page = kmem_cache_alloc(hv_page_cache, GFP_USER);
        struct hv_24x7_catalog_page_0 *page_0 = page;
        if (!page)
@@ -185,7 +197,7 @@ static ssize_t catalog_read(struct file *filp, struct kobject *kobj,
                goto e_free;
        }
-        catalog_version_num = be32_to_cpu(page_0->version);
+        catalog_version_num = be64_to_cpu(page_0->version);
        catalog_page_len = be32_to_cpu(page_0->length);
        catalog_len = catalog_page_len * 4096;
@@ -208,8 +220,9 @@ static ssize_t catalog_read(struct file *filp, struct kobject *kobj,
                                page, 4096, page_offset * 4096);
 e_free:
        if (hret)
-                pr_err("h_get_24x7_catalog_page(ver=%d, page=%lld) failed: rc=%ld\n",
+                pr_err("h_get_24x7_catalog_page(ver=%lld, page=%lld) failed:"
-                                catalog_version_num, page_offset, hret);
+                       " rc=%ld\n",
+                       catalog_version_num, page_offset, hret);
        kfree(page);
        pr_devel("catalog_read: offset=%lld(%lld) count=%zu(%zu) catalog_len=%zu(%zu) => %zd\n",
@@ -243,7 +256,7 @@ e_free:								\
 static DEVICE_ATTR_RO(_name)
 PAGE_0_ATTR(catalog_version, "%lld\n",
-                (unsigned long long)be32_to_cpu(page_0->version));
+                (unsigned long long)be64_to_cpu(page_0->version));
 PAGE_0_ATTR(catalog_len, "%lld\n",
                (unsigned long long)be32_to_cpu(page_0->length) * 4096);
 static BIN_ATTR_RO(catalog, 0/* real length varies */);
@@ -485,13 +498,13 @@ static int hv_24x7_init(void)
        struct hv_perf_caps caps;
        if (!firmware_has_feature(FW_FEATURE_LPAR)) {
-                pr_info("not a virtualized system, not enabling\n");
+                pr_debug("not a virtualized system, not enabling\n");
                return -ENODEV;
        }
        hret = hv_perf_caps_get(&caps);
        if (hret) {
-                pr_info("could not obtain capabilities, error 0x%80lx, not enabling\n",
+                pr_debug("could not obtain capabilities, not enabling, rc=%ld\n",
                                hret);
                return -ENODEV;
        }
diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
index 278ba7b9c2b5..c9d399a2df82 100644
--- a/arch/powerpc/perf/hv-gpci.c
+++ b/arch/powerpc/perf/hv-gpci.c
@@ -78,7 +78,7 @@ static ssize_t kernel_version_show(struct device *dev,
        return sprintf(page, "0x%x\n", COUNTER_INFO_VERSION_CURRENT);
 }
-DEVICE_ATTR_RO(kernel_version);
+static DEVICE_ATTR_RO(kernel_version);
 HV_CAPS_ATTR(version, "0x%x\n");
 HV_CAPS_ATTR(ga, "%d\n");
 HV_CAPS_ATTR(expanded, "%d\n");
@@ -273,13 +273,13 @@ static int hv_gpci_init(void)
        struct hv_perf_caps caps;
        if (!firmware_has_feature(FW_FEATURE_LPAR)) {
-                pr_info("not a virtualized system, not enabling\n");
+                pr_debug("not a virtualized system, not enabling\n");
                return -ENODEV;
        }
        hret = hv_perf_caps_get(&caps);
        if (hret) {
-                pr_info("could not obtain capabilities, error 0x%80lx, not enabling\n",
+                pr_debug("could not obtain capabilities, not enabling, rc=%ld\n",
                                hret);
                return -ENODEV;
        }
diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
index 253fefe3d1a0..5b51079f3e3b 100644
--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
+++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
@@ -549,7 +549,8 @@ static int ioda_eeh_reset(struct eeh_pe *pe, int option)
                ret = ioda_eeh_phb_reset(hose, option);
        } else {
                bus = eeh_pe_bus_get(pe);
-                if (pci_is_root_bus(bus))
+                if (pci_is_root_bus(bus) ||
+                    pci_is_root_bus(bus->parent))
                        ret = ioda_eeh_root_reset(hose, option);
                else
                        ret = ioda_eeh_bridge_reset(hose, bus->self, option);
diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
index b9827b0d87e4..788a1977b9a5 100644
--- a/arch/powerpc/platforms/powernv/opal-dump.c
+++ b/arch/powerpc/platforms/powernv/opal-dump.c
@@ -209,89 +209,20 @@ static struct kobj_type dump_ktype = {
        .default_attrs = dump_default_attrs,
 };
-static void free_dump_sg_list(struct opal_sg_list *list)
+static int64_t dump_read_info(uint32_t *dump_id, uint32_t *dump_size, uint32_t *dump_type)
-{
-        struct opal_sg_list *sg1;
-        while (list) {
-                sg1 = list->next;
-                kfree(list);
-                list = sg1;
-        }
-        list = NULL;
-}
-static struct opal_sg_list *dump_data_to_sglist(struct dump_obj *dump)
-{
-        struct opal_sg_list *sg1, *list = NULL;
-        void *addr;
-        int64_t size;
-        addr = dump->buffer;
-        size = dump->size;
-        sg1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!sg1)
-                goto nomem;
-        list = sg1;
-        sg1->num_entries = 0;
-        while (size > 0) {
-                /* Translate virtual address to physical address */
-                sg1->entry[sg1->num_entries].data =
-                        (void *)(vmalloc_to_pfn(addr) << PAGE_SHIFT);
-                if (size > PAGE_SIZE)
-                        sg1->entry[sg1->num_entries].length = PAGE_SIZE;
-                else
-                        sg1->entry[sg1->num_entries].length = size;
-                sg1->num_entries++;
-                if (sg1->num_entries >= SG_ENTRIES_PER_NODE) {
-                        sg1->next = kzalloc(PAGE_SIZE, GFP_KERNEL);
-                        if (!sg1->next)
-                                goto nomem;
-                        sg1 = sg1->next;
-                        sg1->num_entries = 0;
-                }
-                addr += PAGE_SIZE;
-                size -= PAGE_SIZE;
-        }
-        return list;
-nomem:
-        pr_err("%s : Failed to allocate memory\n", __func__);
-        free_dump_sg_list(list);
-        return NULL;
-}
-static void sglist_to_phy_addr(struct opal_sg_list *list)
-{
-        struct opal_sg_list *sg, *next;
-        for (sg = list; sg; sg = next) {
-                next = sg->next;
-                /* Don't translate NULL pointer for last entry */
-                if (sg->next)
-                        sg->next = (struct opal_sg_list *)__pa(sg->next);
-                else
-                        sg->next = NULL;
-                /* Convert num_entries to length */
-                sg->num_entries =
-                        sg->num_entries * sizeof(struct opal_sg_entry) + 16;
-        }
-}
-static int64_t dump_read_info(uint32_t *id, uint32_t *size, uint32_t *type)
 {
+        __be32 id, size, type;
        int rc;
-        *type = 0xffffffff;
-        rc = opal_dump_info2(id, size, type);
+        type = cpu_to_be32(0xffffffff);
+        rc = opal_dump_info2(&id, &size, &type);
        if (rc == OPAL_PARAMETER)
-                rc = opal_dump_info(id, size);
+                rc = opal_dump_info(&id, &size);
+        *dump_id = be32_to_cpu(id);
+        *dump_size = be32_to_cpu(size);
+        *dump_type = be32_to_cpu(type);
        if (rc)
                pr_warn("%s: Failed to get dump info (%d)\n",
@@ -314,15 +245,12 @@ static int64_t dump_read_data(struct dump_obj *dump)
        }
        /* Generate SG list */
-        list = dump_data_to_sglist(dump);
+        list = opal_vmalloc_to_sg_list(dump->buffer, dump->size);
        if (!list) {
                rc = -ENOMEM;
                goto out;
        }
-        /* Translate sg list addr to real address */
-        sglist_to_phy_addr(list);
        /* First entry address */
        addr = __pa(list);
@@ -341,7 +269,7 @@ static int64_t dump_read_data(struct dump_obj *dump)
                        __func__, dump->id);
        /* Free SG list */
-        free_dump_sg_list(list);
+        opal_free_sg_list(list);
 out:
        return rc;
diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
index ef7bc2a97862..10268c41d830 100644
--- a/arch/powerpc/platforms/powernv/opal-elog.c
+++ b/arch/powerpc/platforms/powernv/opal-elog.c
@@ -238,18 +238,25 @@ static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type)
 static void elog_work_fn(struct work_struct *work)
 {
-        size_t elog_size;
+        __be64 size;
+        __be64 id;
+        __be64 type;
+        uint64_t elog_size;
        uint64_t log_id;
        uint64_t elog_type;
        int rc;
        char name[2+16+1];
-        rc = opal_get_elog_size(&log_id, &elog_size, &elog_type);
+        rc = opal_get_elog_size(&id, &size, &type);
        if (rc != OPAL_SUCCESS) {
                pr_err("ELOG: Opal log read failed\n");
                return;
        }
+        elog_size = be64_to_cpu(size);
+        log_id = be64_to_cpu(id);
+        elog_type = be64_to_cpu(type);
        BUG_ON(elog_size > OPAL_MAX_ERRLOG_SIZE);
        if (elog_size >= OPAL_MAX_ERRLOG_SIZE)
diff --git a/arch/powerpc/platforms/powernv/opal-flash.c b/arch/powerpc/platforms/powernv/opal-flash.c
index 714ef972406b..dc487ff04704 100644
--- a/arch/powerpc/platforms/powernv/opal-flash.c
+++ b/arch/powerpc/platforms/powernv/opal-flash.c
@@ -79,9 +79,6 @@
 /* XXX: Assume candidate image size is <= 1GB */
 #define MAX_IMAGE_SIZE  0x40000000
-/* Flash sg list version */
-#define SG_LIST_VERSION (1UL)
 /* Image status */
 enum {
        IMAGE_INVALID,
@@ -131,11 +128,15 @@ static DEFINE_MUTEX(image_data_mutex);
 */
 static inline void opal_flash_validate(void)
 {
-        struct validate_flash_t *args_buf = &validate_flash_data;
+        long ret;
+        void *buf = validate_flash_data.buf;
+        __be32 size, result;
-        args_buf->status = opal_validate_flash(__pa(args_buf->buf),
+        ret = opal_validate_flash(__pa(buf), &size, &result);
-                                               &(args_buf->buf_size),
-                                               &(args_buf->result));
+        validate_flash_data.status = ret;
+        validate_flash_data.buf_size = be32_to_cpu(size);
+        validate_flash_data.result = be32_to_cpu(result);
 }
 /*
@@ -268,93 +269,11 @@ static ssize_t manage_store(struct kobject *kobj,
 }
 /*
- * Free sg list
- */
-static void free_sg_list(struct opal_sg_list *list)
-{
-        struct opal_sg_list *sg1;
-        while (list) {
-                sg1 = list->next;
-                kfree(list);
-                list = sg1;
-        }
-        list = NULL;
-}
-/*
- * Build candidate image scatter gather list
- *
- * list format:
- *   -----------------------------------
- *  |  VER (8) | Entry length in bytes  |
- *   -----------------------------------
- *  |  Pointer to next entry            |
- *   -----------------------------------
- *  |  Address of memory area 1         |
- *   -----------------------------------
- *  |  Length of memory area 1          |
- *   -----------------------------------
- *  |   .........                       |
- *   -----------------------------------
- *  |   .........                       |
- *   -----------------------------------
- *  |  Address of memory area N         |
- *   -----------------------------------
- *  |  Length of memory area N          |
- *   -----------------------------------
- */
-static struct opal_sg_list *image_data_to_sglist(void)
-{
-        struct opal_sg_list *sg1, *list = NULL;
-        void *addr;
-        int size;
-        addr = image_data.data;
-        size = image_data.size;
-        sg1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!sg1)
-                return NULL;
-        list = sg1;
-        sg1->num_entries = 0;
-        while (size > 0) {
-                /* Translate virtual address to physical address */
-                sg1->entry[sg1->num_entries].data =
-                        (void *)(vmalloc_to_pfn(addr) << PAGE_SHIFT);
-                if (size > PAGE_SIZE)
-                        sg1->entry[sg1->num_entries].length = PAGE_SIZE;
-                else
-                        sg1->entry[sg1->num_entries].length = size;
-                sg1->num_entries++;
-                if (sg1->num_entries >= SG_ENTRIES_PER_NODE) {
-                        sg1->next = kzalloc(PAGE_SIZE, GFP_KERNEL);
-                        if (!sg1->next) {
-                                pr_err("%s : Failed to allocate memory\n",
-                                       __func__);
-                                goto nomem;
-                        }
-                        sg1 = sg1->next;
-                        sg1->num_entries = 0;
-                }
-                addr += PAGE_SIZE;
-                size -= PAGE_SIZE;
-        }
-        return list;
-nomem:
-        free_sg_list(list);
-        return NULL;
-}
-/*
 * OPAL update flash
 */
 static int opal_flash_update(int op)
 {
-        struct opal_sg_list *sg, *list, *next;
+        struct opal_sg_list *list;
        unsigned long addr;
        int64_t rc = OPAL_PARAMETER;
@@ -364,30 +283,13 @@ static int opal_flash_update(int op)
                goto flash;
        }
-        list = image_data_to_sglist();
+        list = opal_vmalloc_to_sg_list(image_data.data, image_data.size);
        if (!list)
                goto invalid_img;
        /* First entry address */
        addr = __pa(list);
-        /* Translate sg list address to absolute */
-        for (sg = list; sg; sg = next) {
-                next = sg->next;
-                /* Don't translate NULL pointer for last entry */
-                if (sg->next)
-                        sg->next = (struct opal_sg_list *)__pa(sg->next);
-                else
-                        sg->next = NULL;
-                /*
-                 * Convert num_entries to version/length format
-                 * to satisfy OPAL.
-                 */
-                sg->num_entries = (SG_LIST_VERSION << 56) |
-                        (sg->num_entries * sizeof(struct opal_sg_entry) + 16);
-        }
        pr_alert("FLASH: Image is %u bytes\n", image_data.size);
        pr_alert("FLASH: Image update requested\n");
        pr_alert("FLASH: Image will be updated during system reboot\n");
diff --git a/arch/powerpc/platforms/powernv/opal-sysparam.c b/arch/powerpc/platforms/powernv/opal-sysparam.c
index 6b614726baf2..d202f9bc3683 100644
--- a/arch/powerpc/platforms/powernv/opal-sysparam.c
+++ b/arch/powerpc/platforms/powernv/opal-sysparam.c
@@ -39,10 +39,11 @@ struct param_attr {
        struct kobj_attribute kobj_attr;
 };
-static int opal_get_sys_param(u32 param_id, u32 length, void *buffer)
+static ssize_t opal_get_sys_param(u32 param_id, u32 length, void *buffer)
 {
        struct opal_msg msg;
-        int ret, token;
+        ssize_t ret;
+        int token;
        token = opal_async_get_token_interruptible();
        if (token < 0) {
@@ -59,7 +60,7 @@ static int opal_get_sys_param(u32 param_id, u32 length, void *buffer)
        ret = opal_async_wait_response(token, &msg);
        if (ret) {
-                pr_err("%s: Failed to wait for the async response, %d\n",
+                pr_err("%s: Failed to wait for the async response, %zd\n",
                                __func__, ret);
                goto out_token;
        }
@@ -111,7 +112,7 @@ static ssize_t sys_param_show(struct kobject *kobj,
 {
        struct param_attr *attr = container_of(kobj_attr, struct param_attr,
                        kobj_attr);
-        int ret;
+        ssize_t ret;
        mutex_lock(&opal_sysparam_mutex);
        ret = opal_get_sys_param(attr->param_id, attr->param_size,
@@ -121,9 +122,10 @@ static ssize_t sys_param_show(struct kobject *kobj,
        memcpy(buf, param_data_buf, attr->param_size);
+        ret = attr->param_size;
 out:
        mutex_unlock(&opal_sysparam_mutex);
-        return ret ? ret : attr->param_size;
+        return ret;
 }
 static ssize_t sys_param_store(struct kobject *kobj,
@@ -131,14 +133,20 @@ static ssize_t sys_param_store(struct kobject *kobj,
 {
        struct param_attr *attr = container_of(kobj_attr, struct param_attr,
                        kobj_attr);
-        int ret;
+        ssize_t ret;
+        /* MAX_PARAM_DATA_LEN is sizeof(param_data_buf) */
+        if (count > MAX_PARAM_DATA_LEN)
+                count = MAX_PARAM_DATA_LEN;
        mutex_lock(&opal_sysparam_mutex);
        memcpy(param_data_buf, buf, count);
        ret = opal_set_sys_param(attr->param_id, attr->param_size,
                        param_data_buf);
        mutex_unlock(&opal_sysparam_mutex);
-        return ret ? ret : count;
+        if (!ret)
+                ret = count;
+        return ret;
 }
 void __init opal_sys_param_init(void)
@@ -214,13 +222,13 @@ void __init opal_sys_param_init(void)
        }
        if (of_property_read_u32_array(sysparam, "param-len", size, count)) {
-                pr_err("SYSPARAM: Missing propery param-len in the DT\n");
+                pr_err("SYSPARAM: Missing property param-len in the DT\n");
                goto out_free_perm;
        }
        if (of_property_read_u8_array(sysparam, "param-perm", perm, count)) {
-                pr_err("SYSPARAM: Missing propery param-perm in the DT\n");
+                pr_err("SYSPARAM: Missing property param-perm in the DT\n");
                goto out_free_perm;
        }
@@ -233,6 +241,12 @@ void __init opal_sys_param_init(void)
        /* For each of the parameters, populate the parameter attributes */
        for (i = 0; i < count; i++) {
+                if (size[i] > MAX_PARAM_DATA_LEN) {
+                        pr_warn("SYSPARAM: Not creating parameter %d as size "
+                                "exceeds buffer length\n", i);
+                        continue;
+                }
                sysfs_attr_init(&attr[i].kobj_attr.attr);
                attr[i].param_id = id[i];
                attr[i].param_size = size[i];
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 49d2f00019e5..360ad80c754c 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -242,14 +242,14 @@ void opal_notifier_update_evt(uint64_t evt_mask,
 void opal_notifier_enable(void)
 {
        int64_t rc;
-        uint64_t evt = 0;
+        __be64 evt = 0;
        atomic_set(&opal_notifier_hold, 0);
        /* Process pending events */
        rc = opal_poll_events(&evt);
        if (rc == OPAL_SUCCESS && evt)
-                opal_do_notifier(evt);
+                opal_do_notifier(be64_to_cpu(evt));
 }
 void opal_notifier_disable(void)
@@ -529,7 +529,7 @@ static irqreturn_t opal_interrupt(int irq, void *data)
        opal_handle_interrupt(virq_to_hw(irq), &events);
-        opal_do_notifier(events);
+        opal_do_notifier(be64_to_cpu(events));
        return IRQ_HANDLED;
 }
@@ -638,3 +638,66 @@ void opal_shutdown(void)
 /* Export this so that test modules can use it */
 EXPORT_SYMBOL_GPL(opal_invalid_call);
+/* Convert a region of vmalloc memory to an opal sg list */
+struct opal_sg_list *opal_vmalloc_to_sg_list(void *vmalloc_addr,
+                                             unsigned long vmalloc_size)
+{
+        struct opal_sg_list *sg, *first = NULL;
+        unsigned long i = 0;
+        sg = kzalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!sg)
+                goto nomem;
+        first = sg;
+        while (vmalloc_size > 0) {
+                uint64_t data = vmalloc_to_pfn(vmalloc_addr) << PAGE_SHIFT;
+                uint64_t length = min(vmalloc_size, PAGE_SIZE);
+                sg->entry[i].data = cpu_to_be64(data);
+                sg->entry[i].length = cpu_to_be64(length);
+                i++;
+                if (i >= SG_ENTRIES_PER_NODE) {
+                        struct opal_sg_list *next;
+                        next = kzalloc(PAGE_SIZE, GFP_KERNEL);
+                        if (!next)
+                                goto nomem;
+                        sg->length = cpu_to_be64(
+                                        i * sizeof(struct opal_sg_entry) + 16);
+                        i = 0;
+                        sg->next = cpu_to_be64(__pa(next));
+                        sg = next;
+                }
+                vmalloc_addr += length;
+                vmalloc_size -= length;
+        }
+        sg->length = cpu_to_be64(i * sizeof(struct opal_sg_entry) + 16);
+        return first;
+nomem:
+        pr_err("%s : Failed to allocate memory\n", __func__);
+        opal_free_sg_list(first);
+        return NULL;
+}
+void opal_free_sg_list(struct opal_sg_list *sg)
+{
+        while (sg) {
+                uint64_t next = be64_to_cpu(sg->next);
+                kfree(sg);
+                if (next)
+                        sg = __va(next);
+                else
+                        sg = NULL;
+        }
+}
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 3b2b4fb3585b..98824aa99173 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -343,7 +343,6 @@ static void pnv_ioda_setup_same_PE(struct pci_bus *bus, struct pnv_ioda_pe *pe)
                                pci_name(dev));
                        continue;
                }
-                pci_dev_get(dev);
                pdn->pcidev = dev;
                pdn->pe_number = pe->pe_number;
                pe->dma_weight += pnv_ioda_dma_weight(dev);
@@ -462,7 +461,7 @@ static void pnv_pci_ioda_dma_dev_setup(struct pnv_phb *phb, struct pci_dev *pdev
        pe = &phb->ioda.pe_array[pdn->pe_number];
        WARN_ON(get_dma_ops(&pdev->dev) != &dma_iommu_ops);
-        set_iommu_table_base_and_group(&pdev->dev, &pe->tce32_table);
+        set_iommu_table_base(&pdev->dev, &pe->tce32_table);
 }
 static int pnv_pci_ioda_dma_set_mask(struct pnv_phb *phb,
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 61cf8fa9c61b..8723d32632f5 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -162,18 +162,62 @@ static void pnv_shutdown(void)
 }
 #ifdef CONFIG_KEXEC
+static void pnv_kexec_wait_secondaries_down(void)
+{
+        int my_cpu, i, notified = -1;
+        my_cpu = get_cpu();
+        for_each_online_cpu(i) {
+                uint8_t status;
+                int64_t rc;
+                if (i == my_cpu)
+                        continue;
+                for (;;) {
+                        rc = opal_query_cpu_status(get_hard_smp_processor_id(i),
+                                                   &status);
+                        if (rc != OPAL_SUCCESS || status != OPAL_THREAD_STARTED)
+                                break;
+                        barrier();
+                        if (i != notified) {
+                                printk(KERN_INFO "kexec: waiting for cpu %d "
+                                       "(physical %d) to enter OPAL\n",
+                                       i, paca[i].hw_cpu_id);
+                                notified = i;
+                        }
+                }
+        }
+}
 static void pnv_kexec_cpu_down(int crash_shutdown, int secondary)
 {
        xics_kexec_teardown_cpu(secondary);
-        /* Return secondary CPUs to firmware on OPAL v3 */
+        /* On OPAL v3, we return all CPUs to firmware */
-        if (firmware_has_feature(FW_FEATURE_OPALv3) && secondary) {
+        if (!firmware_has_feature(FW_FEATURE_OPALv3))
+                return;
+        if (secondary) {
+                /* Return secondary CPUs to firmware on OPAL v3 */
                mb();
                get_paca()->kexec_state = KEXEC_STATE_REAL_MODE;
                mb();
                /* Return the CPU to OPAL */
                opal_return_cpu();
+        } else if (crash_shutdown) {
+                /*
+                 * On crash, we don't wait for secondaries to go
+                 * down as they might be unreachable or hung, so
+                 * instead we just wait a bit and move on.
+                 */
+                mdelay(1);
+        } else {
+                /* Primary waits for the secondaries to have reached OPAL */
+                pnv_kexec_wait_secondaries_down();
        }
 }
 #endif /* CONFIG_KEXEC */
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 908672bdcea6..bf5fcd452168 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -30,6 +30,7 @@
 #include <asm/cputhreads.h>
 #include <asm/xics.h>
 #include <asm/opal.h>
+#include <asm/runlatch.h>
 #include "powernv.h"
@@ -156,7 +157,9 @@ static void pnv_smp_cpu_kill_self(void)
         */
        mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
        while (!generic_check_cpu_restart(cpu)) {
+                ppc64_runlatch_off();
                power7_nap();
+                ppc64_runlatch_on();
                if (!generic_check_cpu_restart(cpu)) {
                        DBG("CPU%d Unexpected exit while offline !\n", cpu);
                        /* We may be getting an IPI, so we re-enable
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index 9b8e05078a63..20d62975856f 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -88,13 +88,14 @@ void set_default_offline_state(int cpu)
 static void rtas_stop_self(void)
 {
-        struct rtas_args args = {
+        static struct rtas_args args = {
-                .token = cpu_to_be32(rtas_stop_self_token),
                .nargs = 0,
                .nret = 1,
                .rets = &args.args[0],
        };
+        args.token = cpu_to_be32(rtas_stop_self_token);
        local_irq_disable();
        BUG_ON(rtas_stop_self_token == RTAS_UNKNOWN_SERVICE);
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 573b488fc48b..7f75c94af822 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -100,10 +100,10 @@ static int pseries_remove_memblock(unsigned long base, unsigned int memblock_siz
        start_pfn = base >> PAGE_SHIFT;
-        if (!pfn_valid(start_pfn)) {
+        lock_device_hotplug();
-                memblock_remove(base, memblock_size);
-                return 0;
+        if (!pfn_valid(start_pfn))
-        }
+                goto out;
        block_sz = memory_block_size_bytes();
        sections_per_block = block_sz / MIN_MEMORY_BLOCK_SIZE;
@@ -114,8 +114,10 @@ static int pseries_remove_memblock(unsigned long base, unsigned int memblock_siz
                base += MIN_MEMORY_BLOCK_SIZE;
        }
+out:
        /* Update memory regions for memory remove */
        memblock_remove(base, memblock_size);
+        unlock_device_hotplug();
        return 0;
 }
diff --git a/arch/powerpc/sysdev/ppc4xx_pci.c b/arch/powerpc/sysdev/ppc4xx_pci.c
index 64603a10b863..4914fd3f41ec 100644
--- a/arch/powerpc/sysdev/ppc4xx_pci.c
+++ b/arch/powerpc/sysdev/ppc4xx_pci.c
@@ -1058,7 +1058,7 @@ static int __init apm821xx_pciex_core_init(struct device_node *np)
        return 1;
 }
-static int apm821xx_pciex_init_port_hw(struct ppc4xx_pciex_port *port)
+static int __init apm821xx_pciex_init_port_hw(struct ppc4xx_pciex_port *port)
 {
        u32 val;
diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
index cf3c0089bef2..23223cd63e54 100644
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -820,6 +820,9 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
                else
                        memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
                spin_unlock(&ctrblk_lock);
+        } else {
+                if (!nbytes)
+                        memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
        }
        /*
         * final block may be < AES_BLOCK_SIZE, copy only nbytes
diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
index 0a5aac8a9412..7acb77f7ef1a 100644
--- a/arch/s390/crypto/des_s390.c
+++ b/arch/s390/crypto/des_s390.c
@@ -429,6 +429,9 @@ static int ctr_desall_crypt(struct blkcipher_desc *desc, long func,
                else
                        memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
                spin_unlock(&ctrblk_lock);
+        } else {
+                if (!nbytes)
+                        memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
        }
        /* final block may be < DES_BLOCK_SIZE, copy only nbytes */
        if (nbytes) {
diff --git a/arch/s390/include/asm/ccwgroup.h b/arch/s390/include/asm/ccwgroup.h
index 6e670f88d125..ebc2913f9ee0 100644
--- a/arch/s390/include/asm/ccwgroup.h
+++ b/arch/s390/include/asm/ccwgroup.h
@@ -22,8 +22,8 @@ struct ccwgroup_device {
 /* public: */
        unsigned int count;
        struct device   dev;
-        struct ccw_device *cdev[0];
        struct work_struct ungroup_work;
+        struct ccw_device *cdev[0];
 };
 /**
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index c544b6f05d95..a25f09fbaf36 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -59,12 +59,23 @@ static inline void tlb_gather_mmu(struct mmu_gather *tlb,
        tlb->batch = NULL;
 }
-static inline void tlb_flush_mmu(struct mmu_gather *tlb)
+static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
 {
        __tlb_flush_mm_lazy(tlb->mm);
+}
+static inline void tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
        tlb_table_flush(tlb);
 }
+static inline void tlb_flush_mmu(struct mmu_gather *tlb)
+{
+        tlb_flush_mmu_tlbonly(tlb);
+        tlb_flush_mmu_free(tlb);
+}
 static inline void tlb_finish_mmu(struct mmu_gather *tlb,
                                  unsigned long start, unsigned long end)
 {
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 9c36dc398f90..452d3ebd9d0f 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -276,7 +276,6 @@ static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter)
        case BPF_S_LD_W_IND:
        case BPF_S_LD_H_IND:
        case BPF_S_LD_B_IND:
-        case BPF_S_LDX_B_MSH:
        case BPF_S_LD_IMM:
        case BPF_S_LD_MEM:
        case BPF_S_MISC_TXA:
diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h
index 362192ed12fe..62f80d2a9df9 100644
--- a/arch/sh/include/asm/tlb.h
+++ b/arch/sh/include/asm/tlb.h
@@ -86,6 +86,14 @@ tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vma)
        }
 }
+static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
+{
+}
+static inline void tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
+}
 static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 {
 }
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 0f9e94537eee..fde5abaac0cc 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -71,6 +71,23 @@
 #include <linux/sched.h>
+extern unsigned long sparc64_valid_addr_bitmap[];
+/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
+static inline bool __kern_addr_valid(unsigned long paddr)
+{
+        if ((paddr >> MAX_PHYS_ADDRESS_BITS) != 0UL)
+                return false;
+        return test_bit(paddr >> ILOG2_4MB, sparc64_valid_addr_bitmap);
+}
+static inline bool kern_addr_valid(unsigned long addr)
+{
+        unsigned long paddr = __pa(addr);
+        return __kern_addr_valid(paddr);
+}
 /* Entries per page directory level. */
 #define PTRS_PER_PTE    (1UL << (PAGE_SHIFT-3))
 #define PTRS_PER_PMD    (1UL << PMD_BITS)
@@ -79,9 +96,12 @@
 /* Kernel has a separate 44bit address space. */
 #define FIRST_USER_ADDRESS      0
-#define pte_ERROR(e)    __builtin_trap()
+#define pmd_ERROR(e)                                                    \
-#define pmd_ERROR(e)    __builtin_trap()
+        pr_err("%s:%d: bad pmd %p(%016lx) seen at (%pS)\n",             \
-#define pgd_ERROR(e)    __builtin_trap()
+               __FILE__, __LINE__, &(e), pmd_val(e), __builtin_return_address(0))
+#define pgd_ERROR(e)                                                    \
+        pr_err("%s:%d: bad pgd %p(%016lx) seen at (%pS)\n",             \
+               __FILE__, __LINE__, &(e), pgd_val(e), __builtin_return_address(0))
 #endif /* !(__ASSEMBLY__) */
@@ -258,8 +278,8 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t prot)
 {
        unsigned long mask, tmp;
-        /* SUN4U: 0x600307ffffffecb8 (negated == 0x9ffcf80000001347)
+        /* SUN4U: 0x630107ffffffec38 (negated == 0x9cfef800000013c7)
-         * SUN4V: 0x30ffffffffffee17 (negated == 0xcf000000000011e8)
+         * SUN4V: 0x33ffffffffffee07 (negated == 0xcc000000000011f8)
         *
         * Even if we use negation tricks the result is still a 6
         * instruction sequence, so don't try to play fancy and just
@@ -289,10 +309,10 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t prot)
        "       .previous\n"
        : "=r" (mask), "=r" (tmp)
        : "i" (_PAGE_PADDR_4U | _PAGE_MODIFIED_4U | _PAGE_ACCESSED_4U |
-               _PAGE_CP_4U | _PAGE_CV_4U | _PAGE_E_4U | _PAGE_PRESENT_4U |
+               _PAGE_CP_4U | _PAGE_CV_4U | _PAGE_E_4U |
               _PAGE_SPECIAL | _PAGE_PMD_HUGE | _PAGE_SZALL_4U),
          "i" (_PAGE_PADDR_4V | _PAGE_MODIFIED_4V | _PAGE_ACCESSED_4V |
-               _PAGE_CP_4V | _PAGE_CV_4V | _PAGE_E_4V | _PAGE_PRESENT_4V |
+               _PAGE_CP_4V | _PAGE_CV_4V | _PAGE_E_4V |
               _PAGE_SPECIAL | _PAGE_PMD_HUGE | _PAGE_SZALL_4V));
        return __pte((pte_val(pte) & mask) | (pgprot_val(prot) & ~mask));
@@ -633,7 +653,7 @@ static inline unsigned long pmd_large(pmd_t pmd)
 {
        pte_t pte = __pte(pmd_val(pmd));
-        return (pte_val(pte) & _PAGE_PMD_HUGE) && pte_present(pte);
+        return pte_val(pte) & _PAGE_PMD_HUGE;
 }
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -719,20 +739,6 @@ static inline pmd_t pmd_mkwrite(pmd_t pmd)
        return __pmd(pte_val(pte));
 }
-static inline pmd_t pmd_mknotpresent(pmd_t pmd)
-{
-        unsigned long mask;
-        if (tlb_type == hypervisor)
-                mask = _PAGE_PRESENT_4V;
-        else
-                mask = _PAGE_PRESENT_4U;
-        pmd_val(pmd) &= ~mask;
-        return pmd;
-}
 static inline pmd_t pmd_mksplitting(pmd_t pmd)
 {
        pte_t pte = __pte(pmd_val(pmd));
@@ -757,6 +763,20 @@ static inline int pmd_present(pmd_t pmd)
 #define pmd_none(pmd)                   (!pmd_val(pmd))
+/* pmd_bad() is only called on non-trans-huge PMDs.  Our encoding is
+ * very simple, it's just the physical address.  PTE tables are of
+ * size PAGE_SIZE so make sure the sub-PAGE_SIZE bits are clear and
+ * the top bits outside of the range of any physical address size we
+ * support are clear as well.  We also validate the physical itself.
+ */
+#define pmd_bad(pmd)                    ((pmd_val(pmd) & ~PAGE_MASK) || \
+                                         !__kern_addr_valid(pmd_val(pmd)))
+#define pud_none(pud)                   (!pud_val(pud))
+#define pud_bad(pud)                    ((pud_val(pud) & ~PAGE_MASK) || \
+                                         !__kern_addr_valid(pud_val(pud)))
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 extern void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                       pmd_t *pmdp, pmd_t pmd);
@@ -790,10 +810,7 @@ static inline unsigned long __pmd_page(pmd_t pmd)
 #define pud_page_vaddr(pud)             \
        ((unsigned long) __va(pud_val(pud)))
 #define pud_page(pud)                   virt_to_page((void *)pud_page_vaddr(pud))
-#define pmd_bad(pmd)                    (0)
 #define pmd_clear(pmdp)                 (pmd_val(*(pmdp)) = 0UL)
-#define pud_none(pud)                   (!pud_val(pud))
-#define pud_bad(pud)                    (0)
 #define pud_present(pud)                (pud_val(pud) != 0U)
 #define pud_clear(pudp)                 (pud_val(*(pudp)) = 0UL)
@@ -893,6 +910,10 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
 extern void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
                                 pmd_t *pmd);
+#define __HAVE_ARCH_PMDP_INVALIDATE
+extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
+                            pmd_t *pmdp);
 #define __HAVE_ARCH_PGTABLE_DEPOSIT
 extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
                                       pgtable_t pgtable);
@@ -919,18 +940,6 @@ extern unsigned long pte_file(pte_t);
 extern pte_t pgoff_to_pte(unsigned long);
 #define PTE_FILE_MAX_BITS       (64UL - PAGE_SHIFT - 1UL)
-extern unsigned long sparc64_valid_addr_bitmap[];
-/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
-static inline bool kern_addr_valid(unsigned long addr)
-{
-        unsigned long paddr = __pa(addr);
-        if ((paddr >> 41UL) != 0UL)
-                return false;
-        return test_bit(paddr >> 22, sparc64_valid_addr_bitmap);
-}
 extern int page_in_phys_avail(unsigned long paddr);
 /*
diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
index 2230f80d9fe3..90916f955cac 100644
--- a/arch/sparc/include/asm/tsb.h
+++ b/arch/sparc/include/asm/tsb.h
@@ -171,7 +171,8 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
        andcc           REG1, REG2, %g0;                \
        be,pt           %xcc, 700f;                     \
         sethi          %hi(4 * 1024 * 1024), REG2;     \
-        andn            REG1, REG2, REG1;               \
+        brgez,pn        REG1, FAIL_LABEL;               \
+         andn           REG1, REG2, REG1;               \
        and             VADDR, REG2, REG2;              \
        brlz,pt         REG1, PTE_LABEL;                \
         or             REG1, REG2, REG1;               \
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 26b706a1867d..452f04fe8da6 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -282,8 +282,8 @@ sun4v_chip_type:
        stx     %l2, [%l4 + 0x0]
        ldx     [%sp + 2047 + 128 + 0x50], %l3  ! physaddr low
        /* 4MB align */
-        srlx    %l3, 22, %l3
+        srlx    %l3, ILOG2_4MB, %l3
-        sllx    %l3, 22, %l3
+        sllx    %l3, ILOG2_4MB, %l3
        stx     %l3, [%l4 + 0x8]
        /* Leave service as-is, "call-method" */
diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S
index 542e96ac4d39..605d49204580 100644
--- a/arch/sparc/kernel/ktlb.S
+++ b/arch/sparc/kernel/ktlb.S
@@ -277,7 +277,7 @@ kvmap_dtlb_load:
 #ifdef CONFIG_SPARSEMEM_VMEMMAP
 kvmap_vmemmap:
        sub             %g4, %g5, %g5
-        srlx            %g5, 22, %g5
+        srlx            %g5, ILOG2_4MB, %g5
        sethi           %hi(vmemmap_table), %g1
        sllx            %g5, 3, %g5
        or              %g1, %lo(vmemmap_table), %g1
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 6479256fd5a4..337094556916 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -68,27 +68,16 @@ EXPORT_SYMBOL(touch_nmi_watchdog);
 static void die_nmi(const char *str, struct pt_regs *regs, int do_panic)
 {
+        int this_cpu = smp_processor_id();
        if (notify_die(DIE_NMIWATCHDOG, str, regs, 0,
                       pt_regs_trap_type(regs), SIGINT) == NOTIFY_STOP)
                return;
-        console_verbose();
-        bust_spinlocks(1);
-        printk(KERN_EMERG "%s", str);
-        printk(" on CPU%d, ip %08lx, registers:\n",
-               smp_processor_id(), regs->tpc);
-        show_regs(regs);
-        dump_stack();
-        bust_spinlocks(0);
        if (do_panic || panic_on_oops)
-                panic("Non maskable interrupt");
+                panic("Watchdog detected hard LOCKUP on cpu %d", this_cpu);
+        else
-        nmi_exit();
+                WARN(1, "Watchdog detected hard LOCKUP on cpu %d", this_cpu);
-        local_irq_enable();
-        do_exit(SIGBUS);
 }
 notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 9781048161ab..745a3633ce14 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -149,7 +149,7 @@ void cpu_panic(void)
 #define NUM_ROUNDS      64      /* magic value */
 #define NUM_ITERS       5       /* likewise */
-static DEFINE_SPINLOCK(itc_sync_lock);
+static DEFINE_RAW_SPINLOCK(itc_sync_lock);
 static unsigned long go[SLAVE + 1];
 #define DEBUG_TICK_SYNC 0
@@ -257,7 +257,7 @@ static void smp_synchronize_one_tick(int cpu)
        go[MASTER] = 0;
        membar_safe("#StoreLoad");
-        spin_lock_irqsave(&itc_sync_lock, flags);
+        raw_spin_lock_irqsave(&itc_sync_lock, flags);
        {
                for (i = 0; i < NUM_ROUNDS*NUM_ITERS; i++) {
                        while (!go[MASTER])
@@ -268,7 +268,7 @@ static void smp_synchronize_one_tick(int cpu)
                        membar_safe("#StoreLoad");
                }
        }
-        spin_unlock_irqrestore(&itc_sync_lock, flags);
+        raw_spin_unlock_irqrestore(&itc_sync_lock, flags);
 }
 #if defined(CONFIG_SUN_LDOMS) && defined(CONFIG_HOTPLUG_CPU)
diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
index f7c72b6efc27..d066eb18650c 100644
--- a/arch/sparc/kernel/sys32.S
+++ b/arch/sparc/kernel/sys32.S
@@ -44,7 +44,7 @@ SIGN1(sys32_timer_settime, compat_sys_timer_settime, %o1)
 SIGN1(sys32_io_submit, compat_sys_io_submit, %o1)
 SIGN1(sys32_mq_open, compat_sys_mq_open, %o1)
 SIGN1(sys32_select, compat_sys_select, %o0)
-SIGN3(sys32_futex, compat_sys_futex, %o1, %o2, %o5)
+SIGN1(sys32_futex, compat_sys_futex, %o1)
 SIGN1(sys32_recvfrom, compat_sys_recvfrom, %o0)
 SIGN1(sys32_recvmsg, compat_sys_recvmsg, %o0)
 SIGN1(sys32_sendmsg, compat_sys_sendmsg, %o0)
diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
index 3c1a7cb31579..35ab8b60d256 100644
--- a/arch/sparc/kernel/unaligned_64.c
+++ b/arch/sparc/kernel/unaligned_64.c
@@ -166,17 +166,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
 unsigned long compute_effective_address(struct pt_regs *regs,
                                        unsigned int insn, unsigned int rd)
 {
+        int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
        unsigned int rs1 = (insn >> 14) & 0x1f;
        unsigned int rs2 = insn & 0x1f;
-        int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
+        unsigned long addr;
        if (insn & 0x2000) {
                maybe_flush_windows(rs1, 0, rd, from_kernel);
-                return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
+                addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
        } else {
                maybe_flush_windows(rs1, rs2, rd, from_kernel);
-                return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
+                addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
        }
+        if (!from_kernel && test_thread_flag(TIF_32BIT))
+                addr &= 0xffffffff;
+        return addr;
 }
 /* This is just to make gcc think die_if_kernel does return... */
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index 69bb818fdd79..a8ff0d1a3b69 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -96,38 +96,51 @@ static unsigned int get_user_insn(unsigned long tpc)
        pte_t *ptep, pte;
        unsigned long pa;
        u32 insn = 0;
-        unsigned long pstate;
-        if (pgd_none(*pgdp))
+        if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp)))
-                goto outret;
+                goto out;
        pudp = pud_offset(pgdp, tpc);
-        if (pud_none(*pudp))
+        if (pud_none(*pudp) || unlikely(pud_bad(*pudp)))
-                goto outret;
+                goto out;
-        pmdp = pmd_offset(pudp, tpc);
-        if (pmd_none(*pmdp))
-                goto outret;
        /* This disables preemption for us as well. */
-        __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate));
+        local_irq_disable();
-        __asm__ __volatile__("wrpr %0, %1, %%pstate"
-                                : : "r" (pstate), "i" (PSTATE_IE));
-        ptep = pte_offset_map(pmdp, tpc);
-        pte = *ptep;
-        if (!pte_present(pte))
-                goto out;
-        pa  = (pte_pfn(pte) << PAGE_SHIFT);
+        pmdp = pmd_offset(pudp, tpc);
-        pa += (tpc & ~PAGE_MASK);
+        if (pmd_none(*pmdp) || unlikely(pmd_bad(*pmdp)))
+                goto out_irq_enable;
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        if (pmd_trans_huge(*pmdp)) {
+                if (pmd_trans_splitting(*pmdp))
+                        goto out_irq_enable;
-        /* Use phys bypass so we don't pollute dtlb/dcache. */
+                pa  = pmd_pfn(*pmdp) << PAGE_SHIFT;
-        __asm__ __volatile__("lduwa [%1] %2, %0"
+                pa += tpc & ~HPAGE_MASK;
-                             : "=r" (insn)
-                             : "r" (pa), "i" (ASI_PHYS_USE_EC));
+                /* Use phys bypass so we don't pollute dtlb/dcache. */
+                __asm__ __volatile__("lduwa [%1] %2, %0"
+                                     : "=r" (insn)
+                                     : "r" (pa), "i" (ASI_PHYS_USE_EC));
+        } else
+#endif
+        {
+                ptep = pte_offset_map(pmdp, tpc);
+                pte = *ptep;
+                if (pte_present(pte)) {
+                        pa  = (pte_pfn(pte) << PAGE_SHIFT);
+                        pa += (tpc & ~PAGE_MASK);
+                        /* Use phys bypass so we don't pollute dtlb/dcache. */
+                        __asm__ __volatile__("lduwa [%1] %2, %0"
+                                             : "=r" (insn)
+                                             : "r" (pa), "i" (ASI_PHYS_USE_EC));
+                }
+                pte_unmap(ptep);
+        }
+out_irq_enable:
+        local_irq_enable();
 out:
-        pte_unmap(ptep);
-        __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate));
-outret:
        return insn;
 }
@@ -153,7 +166,8 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
 }
 static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
-                             unsigned int insn, int fault_code)
+                             unsigned long fault_addr, unsigned int insn,
+                             int fault_code)
 {
        unsigned long addr;
        siginfo_t info;
@@ -161,10 +175,18 @@ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
        info.si_code = code;
        info.si_signo = sig;
        info.si_errno = 0;
-        if (fault_code & FAULT_CODE_ITLB)
+        if (fault_code & FAULT_CODE_ITLB) {
                addr = regs->tpc;
-        else
+        } else {
-                addr = compute_effective_address(regs, insn, 0);
+                /* If we were able to probe the faulting instruction, use it
+                 * to compute a precise fault address.  Otherwise use the fault
+                 * time provided address which may only have page granularity.
+                 */
+                if (insn)
+                        addr = compute_effective_address(regs, insn, 0);
+                else
+                        addr = fault_addr;
+        }
        info.si_addr = (void __user *) addr;
        info.si_trapno = 0;
@@ -239,7 +261,7 @@ static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code,
                /* The si_code was set to make clear whether
                 * this was a SEGV_MAPERR or SEGV_ACCERR fault.
                 */
-                do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code);
+                do_fault_siginfo(si_code, SIGSEGV, regs, address, insn, fault_code);
                return;
        }
@@ -525,7 +547,7 @@ do_sigbus:
         * Send a sigbus, regardless of whether we were in kernel
         * or user mode.
         */
-        do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code);
+        do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, address, insn, fault_code);
        /* Kernel mode? Handle exceptions or die */
        if (regs->tstate & TSTATE_PRIV)
diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
index c4d3da68b800..1aed0432c64b 100644
--- a/arch/sparc/mm/gup.c
+++ b/arch/sparc/mm/gup.c
@@ -73,7 +73,7 @@ static int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
        struct page *head, *page, *tail;
        int refs;
-        if (!pmd_large(pmd))
+        if (!(pmd_val(pmd) & _PAGE_VALID))
                return 0;
        if (write && !pmd_write(pmd))
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index eafbc65c9c47..ed3c969a5f4c 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -588,7 +588,7 @@ static void __init remap_kernel(void)
        int i, tlb_ent = sparc64_highest_locked_tlbent();
        tte_vaddr = (unsigned long) KERNBASE;
-        phys_page = (prom_boot_mapping_phys_low >> 22UL) << 22UL;
+        phys_page = (prom_boot_mapping_phys_low >> ILOG2_4MB) << ILOG2_4MB;
        tte_data = kern_large_tte(phys_page);
        kern_locked_tte_data = tte_data;
@@ -1881,7 +1881,7 @@ void __init paging_init(void)
        BUILD_BUG_ON(NR_CPUS > 4096);
-        kern_base = (prom_boot_mapping_phys_low >> 22UL) << 22UL;
+        kern_base = (prom_boot_mapping_phys_low >> ILOG2_4MB) << ILOG2_4MB;
        kern_size = (unsigned long)&_end - (unsigned long)KERNBASE;
        /* Invalidate both kernel TSBs.  */
@@ -1937,7 +1937,7 @@ void __init paging_init(void)
        shift = kern_base + PAGE_OFFSET - ((unsigned long)KERNBASE);
        real_end = (unsigned long)_end;
-        num_kernel_image_mappings = DIV_ROUND_UP(real_end - KERNBASE, 1 << 22);
+        num_kernel_image_mappings = DIV_ROUND_UP(real_end - KERNBASE, 1 << ILOG2_4MB);
        printk("Kernel: Using %d locked TLB entries for main kernel image.\n",
               num_kernel_image_mappings);
@@ -2094,7 +2094,7 @@ static void __init setup_valid_addr_bitmap_from_pavail(unsigned long *bitmap)
                                if (new_start <= old_start &&
                                    new_end >= (old_start + PAGE_SIZE)) {
-                                        set_bit(old_start >> 22, bitmap);
+                                        set_bit(old_start >> ILOG2_4MB, bitmap);
                                        goto do_next_page;
                                }
                        }
@@ -2143,7 +2143,7 @@ void __init mem_init(void)
        addr = PAGE_OFFSET + kern_base;
        last = PAGE_ALIGN(kern_size) + addr;
        while (addr < last) {
-                set_bit(__pa(addr) >> 22, sparc64_valid_addr_bitmap);
+                set_bit(__pa(addr) >> ILOG2_4MB, sparc64_valid_addr_bitmap);
                addr += PAGE_SIZE;
        }
@@ -2267,7 +2267,7 @@ int __meminit vmemmap_populate(unsigned long vstart, unsigned long vend,
                void *block;
                if (!(*vmem_pp & _PAGE_VALID)) {
-                        block = vmemmap_alloc_block(1UL << 22, node);
+                        block = vmemmap_alloc_block(1UL << ILOG2_4MB, node);
                        if (!block)
                                return -ENOMEM;
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index b12cb5e72812..b89aba217e3b 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -134,7 +134,7 @@ no_cache_flush:
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
-                               pmd_t pmd, bool exec)
+                               pmd_t pmd)
 {
        unsigned long end;
        pte_t *pte;
@@ -142,8 +142,11 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
        pte = pte_offset_map(&pmd, vaddr);
        end = vaddr + HPAGE_SIZE;
        while (vaddr < end) {
-                if (pte_val(*pte) & _PAGE_VALID)
+                if (pte_val(*pte) & _PAGE_VALID) {
+                        bool exec = pte_exec(*pte);
                        tlb_batch_add_one(mm, vaddr, exec);
+                }
                pte++;
                vaddr += PAGE_SIZE;
        }
@@ -177,19 +180,30 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
        }
        if (!pmd_none(orig)) {
-                pte_t orig_pte = __pte(pmd_val(orig));
-                bool exec = pte_exec(orig_pte);
                addr &= HPAGE_MASK;
                if (pmd_trans_huge(orig)) {
+                        pte_t orig_pte = __pte(pmd_val(orig));
+                        bool exec = pte_exec(orig_pte);
                        tlb_batch_add_one(mm, addr, exec);
                        tlb_batch_add_one(mm, addr + REAL_HPAGE_SIZE, exec);
                } else {
-                        tlb_batch_pmd_scan(mm, addr, orig, exec);
+                        tlb_batch_pmd_scan(mm, addr, orig);
                }
        }
 }
+void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
+                     pmd_t *pmdp)
+{
+        pmd_t entry = *pmdp;
+        pmd_val(entry) &= ~_PAGE_VALID;
+        set_pmd_at(vma->vm_mm, address, pmdp, entry);
+        flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
+}
 void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
                                pgtable_t pgtable)
 {
diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h
index 29b0301c18aa..16eb63fac57d 100644
--- a/arch/um/include/asm/tlb.h
+++ b/arch/um/include/asm/tlb.h
@@ -59,13 +59,25 @@ extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
                               unsigned long end);
 static inline void
+tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
+{
+        flush_tlb_mm_range(tlb->mm, tlb->start, tlb->end);
+}
+static inline void
+tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
+        init_tlb_gather(tlb);
+}
+static inline void
 tlb_flush_mmu(struct mmu_gather *tlb)
 {
        if (!tlb->need_flush)
                return;
-        flush_tlb_mm_range(tlb->mm, tlb->start, tlb->end);
+        tlb_flush_mmu_tlbonly(tlb);
-        init_tlb_gather(tlb);
+        tlb_flush_mmu_free(tlb);
 }
 /* tlb_finish_mmu
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index d1b7c377a234..33f71b01fd22 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -79,11 +79,14 @@ else
        UTS_MACHINE := x86_64
        CHECKFLAGS += -D__x86_64__ -m64
+        biarch := -m64
        KBUILD_AFLAGS += -m64
        KBUILD_CFLAGS += -m64
        # Don't autogenerate traditional x87, MMX or SSE instructions
-        KBUILD_CFLAGS += -mno-mmx -mno-sse -mno-80387 -mno-fp-ret-in-387
+        KBUILD_CFLAGS += -mno-mmx -mno-sse
+        KBUILD_CFLAGS += $(call cc-option,-mno-80387)
+        KBUILD_CFLAGS += $(call cc-option,-mno-fp-ret-in-387)
        # Use -mpreferred-stack-boundary=3 if supported.
        KBUILD_CFLAGS += $(call cc-option,-mpreferred-stack-boundary=3)
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index abb9eba61b50..dbe8dd2fe247 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -71,7 +71,7 @@ $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE
 SETUP_OBJS = $(addprefix $(obj)/,$(setup-y))
-sed-voffset := -e 's/^\([0-9a-fA-F]*\) . \(_text\|_end\)$$/\#define VO_\2 0x\1/p'
+sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 0x\1/p'
 quiet_cmd_voffset = VOFFSET $@
      cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@
@@ -80,7 +80,7 @@ targets += voffset.h
 $(obj)/voffset.h: vmlinux FORCE
        $(call if_changed,voffset)
-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) . \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|z_.*\)$$/\#define ZO_\2 0x\1/p'
+sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|z_.*\)$$/\#define ZO_\2 0x\1/p'
 quiet_cmd_zoffset = ZOFFSET $@
      cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 17684615374b..57ab74df7eea 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -354,7 +354,7 @@ static void parse_elf(void *output)
        free(phdrs);
 }
-asmlinkage void *decompress_kernel(void *rmode, memptr heap,
+asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
                                  unsigned char *input_data,
                                  unsigned long input_len,
                                  unsigned char *output,
diff --git a/arch/x86/include/asm/hpet.h b/arch/x86/include/asm/hpet.h
index b18df579c0e9..36f7125945e3 100644
--- a/arch/x86/include/asm/hpet.h
+++ b/arch/x86/include/asm/hpet.h
@@ -63,6 +63,7 @@
 /* hpet memory map physical address */
 extern unsigned long hpet_address;
 extern unsigned long force_hpet_address;
+extern int boot_hpet_disable;
 extern u8 hpet_blockid;
 extern int hpet_force_user;
 extern u8 hpet_msi_disable;
diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
index a8091216963b..68c05398bba9 100644
--- a/arch/x86/include/asm/hugetlb.h
+++ b/arch/x86/include/asm/hugetlb.h
@@ -52,6 +52,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
 static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
                                         unsigned long addr, pte_t *ptep)
 {
+        ptep_clear_flush(vma, addr, ptep);
 }
 static inline int huge_pte_none(pte_t pte)
diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
index c827ace3121b..fcf2b3ae1bf0 100644
--- a/arch/x86/include/uapi/asm/msr-index.h
+++ b/arch/x86/include/uapi/asm/msr-index.h
@@ -384,7 +384,7 @@
 #define MSR_IA32_MISC_ENABLE_MWAIT_BIT                  18
 #define MSR_IA32_MISC_ENABLE_MWAIT                      (1ULL << MSR_IA32_MISC_ENABLE_MWAIT_BIT)
 #define MSR_IA32_MISC_ENABLE_LIMIT_CPUID_BIT            22
-#define MSR_IA32_MISC_ENABLE_LIMIT_CPUID                (1ULL << MSR_IA32_MISC_ENABLE_LIMIT_CPUID_BIT);
+#define MSR_IA32_MISC_ENABLE_LIMIT_CPUID                (1ULL << MSR_IA32_MISC_ENABLE_LIMIT_CPUID_BIT)
 #define MSR_IA32_MISC_ENABLE_XTPR_DISABLE_BIT           23
 #define MSR_IA32_MISC_ENABLE_XTPR_DISABLE               (1ULL << MSR_IA32_MISC_ENABLE_XTPR_DISABLE_BIT)
 #define MSR_IA32_MISC_ENABLE_XD_DISABLE_BIT             34
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 3a2ae4c88948..31368207837c 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -31,7 +31,7 @@ static char temp_stack[4096];
 *
 * Wrapper around acpi_enter_sleep_state() to be called by assmebly.
 */
-acpi_status asmlinkage x86_acpi_enter_sleep_state(u8 state)
+acpi_status asmlinkage __visible x86_acpi_enter_sleep_state(u8 state)
 {
        return acpi_enter_sleep_state(state);
 }
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 6ad4658de705..992060e09897 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2189,7 +2189,7 @@ void send_cleanup_vector(struct irq_cfg *cfg)
        cfg->move_in_progress = 0;
 }
-asmlinkage void smp_irq_move_cleanup_interrupt(void)
+asmlinkage __visible void smp_irq_move_cleanup_interrupt(void)
 {
        unsigned vector, me;
@@ -3425,6 +3425,11 @@ int get_nr_irqs_gsi(void)
        return nr_irqs_gsi;
 }
+unsigned int arch_dynirq_lower_bound(unsigned int from)
+{
+        return from < nr_irqs_gsi ? nr_irqs_gsi : from;
+}
 int __init arch_probe_nr_irqs(void)
 {
        int nr;
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index d921b7ee6595..36a1bb6d1ee0 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -429,14 +429,14 @@ static inline void __smp_thermal_interrupt(void)
        smp_thermal_vector();
 }
-asmlinkage void smp_thermal_interrupt(struct pt_regs *regs)
+asmlinkage __visible void smp_thermal_interrupt(struct pt_regs *regs)
 {
        entering_irq();
        __smp_thermal_interrupt();
        exiting_ack_irq();
 }
-asmlinkage void smp_trace_thermal_interrupt(struct pt_regs *regs)
+asmlinkage __visible void smp_trace_thermal_interrupt(struct pt_regs *regs)
 {
        entering_irq();
        trace_thermal_apic_entry(THERMAL_APIC_VECTOR);
diff --git a/arch/x86/kernel/cpu/mcheck/threshold.c b/arch/x86/kernel/cpu/mcheck/threshold.c
index fe6b1c86645b..7245980186ee 100644
--- a/arch/x86/kernel/cpu/mcheck/threshold.c
+++ b/arch/x86/kernel/cpu/mcheck/threshold.c
@@ -24,14 +24,14 @@ static inline void __smp_threshold_interrupt(void)
        mce_threshold_vector();
 }
-asmlinkage void smp_threshold_interrupt(void)
+asmlinkage __visible void smp_threshold_interrupt(void)
 {
        entering_irq();
        __smp_threshold_interrupt();
        exiting_ack_irq();
 }
-asmlinkage void smp_trace_threshold_interrupt(void)
+asmlinkage __visible void smp_trace_threshold_interrupt(void)
 {
        entering_irq();
        trace_threshold_apic_entry(THRESHOLD_APIC_VECTOR);
diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
index 7c87424d4140..619f7699487a 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
@@ -543,7 +543,8 @@ static int rapl_cpu_prepare(int cpu)
        if (phys_id < 0)
                return -1;
-        if (!rdmsrl_safe(MSR_RAPL_POWER_UNIT, &msr_rapl_power_unit_bits))
+        /* protect rdmsrl() to handle virtualization */
+        if (rdmsrl_safe(MSR_RAPL_POWER_UNIT, &msr_rapl_power_unit_bits))
                return -1;
        pmu = kzalloc_node(sizeof(*pmu), GFP_KERNEL, cpu_to_node(cpu));
diff --git a/arch/x86/kernel/cpu/rdrand.c b/arch/x86/kernel/cpu/rdrand.c
index 384df5105fbc..136ac74dee82 100644
--- a/arch/x86/kernel/cpu/rdrand.c
+++ b/arch/x86/kernel/cpu/rdrand.c
@@ -27,6 +27,7 @@
 static int __init x86_rdrand_setup(char *s)
 {
        setup_clear_cpu_cap(X86_FEATURE_RDRAND);
+        setup_clear_cpu_cap(X86_FEATURE_RDSEED);
        return 1;
 }
 __setup("nordrand", x86_rdrand_setup);
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 6e2537c32190..6cda0baeac9d 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -17,6 +17,7 @@
 #include <asm/dma.h>
 #include <asm/io_apic.h>
 #include <asm/apic.h>
+#include <asm/hpet.h>
 #include <asm/iommu.h>
 #include <asm/gart.h>
 #include <asm/irq_remapping.h>
@@ -530,6 +531,15 @@ static void __init intel_graphics_stolen(int num, int slot, int func)
        }
 }
+static void __init force_disable_hpet(int num, int slot, int func)
+{
+#ifdef CONFIG_HPET_TIMER
+        boot_hpet_disable = 1;
+        pr_info("x86/hpet: Will disable the HPET for this platform because it's not reliable\n");
+#endif
+}
 #define QFLAG_APPLY_ONCE        0x1
 #define QFLAG_APPLIED           0x2
 #define QFLAG_DONE              (QFLAG_APPLY_ONCE|QFLAG_APPLIED)
@@ -567,6 +577,12 @@ static struct chipset early_qrk[] __initdata = {
          PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
        { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID,
          QFLAG_APPLY_ONCE, intel_graphics_stolen },
+        /*
+         * HPET on current version of Baytrail platform has accuracy
+         * problems, disable it for now:
+         */
+        { PCI_VENDOR_ID_INTEL, 0x0f00,
+                PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
        {}
 };
diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
index c61a14a4a310..d6c1b9836995 100644
--- a/arch/x86/kernel/head32.c
+++ b/arch/x86/kernel/head32.c
@@ -29,7 +29,7 @@ static void __init i386_default_early_setup(void)
        reserve_ebda_region();
 }
-asmlinkage void __init i386_start_kernel(void)
+asmlinkage __visible void __init i386_start_kernel(void)
 {
        sanitize_boot_params(&boot_params);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 85126ccbdf6b..068054f4bf20 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -137,7 +137,7 @@ static void __init copy_bootdata(char *real_mode_data)
        }
 }
-asmlinkage void __init x86_64_start_kernel(char * real_mode_data)
+asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
 {
        int i;
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 8d80ae011603..4177bfbc80b0 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -88,7 +88,7 @@ static inline void hpet_clear_mapping(void)
 /*
 * HPET command line enable / disable
 */
-static int boot_hpet_disable;
+int boot_hpet_disable;
 int hpet_force_user;
 static int hpet_verbose;
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index af1d14a9ebda..dcbbaa165bde 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -20,6 +20,8 @@
 #include <asm/mmu_context.h>
 #include <asm/syscalls.h>
+int sysctl_ldt16 = 0;
 #ifdef CONFIG_SMP
 static void flush_ldt(void *current_mm)
 {
@@ -234,7 +236,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
         * IRET leaking the high bits of the kernel stack address.
         */
 #ifdef CONFIG_X86_64
-        if (!ldt_info.seg_32bit) {
+        if (!ldt_info.seg_32bit && !sysctl_ldt16) {
                error = -EINVAL;
                goto out_unlock;
        }
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 9c0280f93d05..898d077617a9 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -52,7 +52,7 @@
 asmlinkage extern void ret_from_fork(void);
-asmlinkage DEFINE_PER_CPU(unsigned long, old_rsp);
+__visible DEFINE_PER_CPU(unsigned long, old_rsp);
 /* Prints also some state that isn't saved in the pt_regs */
 void __show_regs(struct pt_regs *regs, int all)
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 3399d3a99730..52b1157c53eb 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -191,6 +191,16 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                },
        },
+        /* Certec */
+        {       /* Handle problems with rebooting on Certec BPC600 */
+                .callback = set_pci_reboot,
+                .ident = "Certec BPC600",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Certec"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "BPC600"),
+                },
+        },
        /* Dell */
        {       /* Handle problems with rebooting on Dell DXP061 */
                .callback = set_bios_reboot,
diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
index 7c3a5a61f2e4..be8e1bde07aa 100644
--- a/arch/x86/kernel/smp.c
+++ b/arch/x86/kernel/smp.c
@@ -168,7 +168,7 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs)
 * this function calls the 'stop' function on all other CPUs in the system.
 */
-asmlinkage void smp_reboot_interrupt(void)
+asmlinkage __visible void smp_reboot_interrupt(void)
 {
        ack_APIC_irq();
        irq_enter();
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 57409f6b8c62..f73b5d435bdc 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -357,7 +357,7 @@ exit:
 * for scheduling or signal handling. The actual stack switch is done in
 * entry.S
 */
-asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
+asmlinkage __visible __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
 {
        struct pt_regs *regs = eregs;
        /* Did already sync */
@@ -601,11 +601,11 @@ do_spurious_interrupt_bug(struct pt_regs *regs, long error_code)
 #endif
 }
-asmlinkage void __attribute__((weak)) smp_thermal_interrupt(void)
+asmlinkage __visible void __attribute__((weak)) smp_thermal_interrupt(void)
 {
 }
-asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
+asmlinkage __visible void __attribute__((weak)) smp_threshold_interrupt(void)
 {
 }
diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
index f6584a90aba3..b99b9ad8540c 100644
--- a/arch/x86/kernel/vsmp_64.c
+++ b/arch/x86/kernel/vsmp_64.c
@@ -26,6 +26,9 @@
 #define TOPOLOGY_REGISTER_OFFSET 0x10
+/* Flag below is initialized once during vSMP PCI initialization. */
+static int irq_routing_comply = 1;
 #if defined CONFIG_PCI && defined CONFIG_PARAVIRT
 /*
 * Interrupt control on vSMPowered systems:
@@ -33,7 +36,7 @@
 * and vice versa.
 */
-asmlinkage unsigned long vsmp_save_fl(void)
+asmlinkage __visible unsigned long vsmp_save_fl(void)
 {
        unsigned long flags = native_save_fl();
@@ -53,7 +56,7 @@ __visible void vsmp_restore_fl(unsigned long flags)
 }
 PV_CALLEE_SAVE_REGS_THUNK(vsmp_restore_fl);
-asmlinkage void vsmp_irq_disable(void)
+asmlinkage __visible void vsmp_irq_disable(void)
 {
        unsigned long flags = native_save_fl();
@@ -61,7 +64,7 @@ asmlinkage void vsmp_irq_disable(void)
 }
 PV_CALLEE_SAVE_REGS_THUNK(vsmp_irq_disable);
-asmlinkage void vsmp_irq_enable(void)
+asmlinkage __visible void vsmp_irq_enable(void)
 {
        unsigned long flags = native_save_fl();
@@ -101,6 +104,10 @@ static void __init set_vsmp_pv_ops(void)
 #ifdef CONFIG_SMP
        if (cap & ctl & BIT(8)) {
                ctl &= ~BIT(8);
+                /* Interrupt routing set to ignore */
+                irq_routing_comply = 0;
 #ifdef CONFIG_PROC_FS
                /* Don't let users change irq affinity via procfs */
                no_irq_affinity = 1;
@@ -218,7 +225,9 @@ static void vsmp_apic_post_init(void)
 {
        /* need to update phys_pkg_id */
        apic->phys_pkg_id = apicid_phys_pkg_id;
-        apic->vector_allocation_domain = fill_vector_allocation_domain;
+        if (!irq_routing_comply)
+                apic->vector_allocation_domain = fill_vector_allocation_domain;
 }
 void __init vsmp_init(void)
diff --git a/arch/x86/kernel/vsyscall_gtod.c b/arch/x86/kernel/vsyscall_gtod.c
index f9c6e56e14b5..9531fbb123ba 100644
--- a/arch/x86/kernel/vsyscall_gtod.c
+++ b/arch/x86/kernel/vsyscall_gtod.c
@@ -43,7 +43,7 @@ void update_vsyscall(struct timekeeper *tk)
        vdata->monotonic_time_sec       = tk->xtime_sec
                                        + tk->wall_to_monotonic.tv_sec;
        vdata->monotonic_time_snsec     = tk->xtime_nsec
-                                        + (tk->wall_to_monotonic.tv_nsec
+                                        + ((u64)tk->wall_to_monotonic.tv_nsec
                                                << tk->shift);
        while (vdata->monotonic_time_snsec >=
                                        (((u64)NSEC_PER_SEC) << tk->shift)) {
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 1f68c5831924..33e8c028842f 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -503,7 +503,7 @@ static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
                                [number##_HIGH] = VMCS12_OFFSET(name)+4
-static const unsigned long shadow_read_only_fields[] = {
+static unsigned long shadow_read_only_fields[] = {
        /*
         * We do NOT shadow fields that are modified when L0
         * traps and emulates any vmx instruction (e.g. VMPTRLD,
@@ -526,10 +526,10 @@ static const unsigned long shadow_read_only_fields[] = {
        GUEST_LINEAR_ADDRESS,
        GUEST_PHYSICAL_ADDRESS
 };
-static const int max_shadow_read_only_fields =
+static int max_shadow_read_only_fields =
        ARRAY_SIZE(shadow_read_only_fields);
-static const unsigned long shadow_read_write_fields[] = {
+static unsigned long shadow_read_write_fields[] = {
        GUEST_RIP,
        GUEST_RSP,
        GUEST_CR0,
@@ -558,7 +558,7 @@ static const unsigned long shadow_read_write_fields[] = {
        HOST_FS_SELECTOR,
        HOST_GS_SELECTOR
 };
-static const int max_shadow_read_write_fields =
+static int max_shadow_read_write_fields =
        ARRAY_SIZE(shadow_read_write_fields);
 static const unsigned short vmcs_field_to_offset_table[] = {
@@ -3009,6 +3009,41 @@ static void free_kvm_area(void)
        }
 }
+static void init_vmcs_shadow_fields(void)
+{
+        int i, j;
+        /* No checks for read only fields yet */
+        for (i = j = 0; i < max_shadow_read_write_fields; i++) {
+                switch (shadow_read_write_fields[i]) {
+                case GUEST_BNDCFGS:
+                        if (!vmx_mpx_supported())
+                                continue;
+                        break;
+                default:
+                        break;
+                }
+                if (j < i)
+                        shadow_read_write_fields[j] =
+                                shadow_read_write_fields[i];
+                j++;
+        }
+        max_shadow_read_write_fields = j;
+        /* shadowed fields guest access without vmexit */
+        for (i = 0; i < max_shadow_read_write_fields; i++) {
+                clear_bit(shadow_read_write_fields[i],
+                          vmx_vmwrite_bitmap);
+                clear_bit(shadow_read_write_fields[i],
+                          vmx_vmread_bitmap);
+        }
+        for (i = 0; i < max_shadow_read_only_fields; i++)
+                clear_bit(shadow_read_only_fields[i],
+                          vmx_vmread_bitmap);
+}
 static __init int alloc_kvm_area(void)
 {
        int cpu;
@@ -3039,6 +3074,8 @@ static __init int hardware_setup(void)
                enable_vpid = 0;
        if (!cpu_has_vmx_shadow_vmcs())
                enable_shadow_vmcs = 0;
+        if (enable_shadow_vmcs)
+                init_vmcs_shadow_fields();
        if (!cpu_has_vmx_ept() ||
            !cpu_has_vmx_ept_4levels()) {
@@ -8803,14 +8840,6 @@ static int __init vmx_init(void)
        memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE);
        memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE);
-        /* shadowed read/write fields */
-        for (i = 0; i < max_shadow_read_write_fields; i++) {
-                clear_bit(shadow_read_write_fields[i], vmx_vmwrite_bitmap);
-                clear_bit(shadow_read_write_fields[i], vmx_vmread_bitmap);
-        }
-        /* shadowed read only fields */
-        for (i = 0; i < max_shadow_read_only_fields; i++)
-                clear_bit(shadow_read_only_fields[i], vmx_vmread_bitmap);
        /*
         * Allow direct access to the PC debug port (it is often used for I/O
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 8b8fc0b792ba..b6c0bacca9bd 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -280,7 +280,7 @@ int kvm_set_apic_base(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 }
 EXPORT_SYMBOL_GPL(kvm_set_apic_base);
-asmlinkage void kvm_spurious_fault(void)
+asmlinkage __visible void kvm_spurious_fault(void)
 {
        /* Fault while not rebooting.  We want the trace. */
        BUG();
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index ad1fb5f53925..aae94132bc24 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -233,13 +233,13 @@ static void lguest_end_context_switch(struct task_struct *next)
 * flags word contains all kind of stuff, but in practice Linux only cares
 * about the interrupt flag.  Our "save_flags()" just returns that.
 */
-asmlinkage unsigned long lguest_save_fl(void)
+asmlinkage __visible unsigned long lguest_save_fl(void)
 {
        return lguest_data.irq_enabled;
 }
 /* Interrupts go off... */
-asmlinkage void lguest_irq_disable(void)
+asmlinkage __visible void lguest_irq_disable(void)
 {
        lguest_data.irq_enabled = 0;
 }
diff --git a/arch/x86/lib/msr.c b/arch/x86/lib/msr.c
index db9db446b71a..43623739c7cf 100644
--- a/arch/x86/lib/msr.c
+++ b/arch/x86/lib/msr.c
@@ -76,7 +76,7 @@ static inline int __flip_bit(u32 msr, u8 bit, bool set)
        if (m1.q == m.q)
                return 0;
-        err = msr_write(msr, &m);
+        err = msr_write(msr, &m1);
        if (err)
                return err;
diff --git a/arch/x86/math-emu/errors.c b/arch/x86/math-emu/errors.c
index a5449089cd9f..9e6545f269e5 100644
--- a/arch/x86/math-emu/errors.c
+++ b/arch/x86/math-emu/errors.c
@@ -302,7 +302,7 @@ static struct {
              0x242  in div_Xsig.S
 */
-asmlinkage void FPU_exception(int n)
+asmlinkage __visible void FPU_exception(int n)
 {
        int i, int_type;
@@ -492,7 +492,7 @@ int real_2op_NaN(FPU_REG const *b, u_char tagb,
 /* Invalid arith operation on Valid registers */
 /* Returns < 0 if the exception is unmasked */
-asmlinkage int arith_invalid(int deststnr)
+asmlinkage __visible int arith_invalid(int deststnr)
 {
        EXCEPTION(EX_Invalid);
@@ -507,7 +507,7 @@ asmlinkage int arith_invalid(int deststnr)
 }
 /* Divide a finite number by zero */
-asmlinkage int FPU_divide_by_zero(int deststnr, u_char sign)
+asmlinkage __visible int FPU_divide_by_zero(int deststnr, u_char sign)
 {
        FPU_REG *dest = &st(deststnr);
        int tag = TAG_Valid;
@@ -539,7 +539,7 @@ int set_precision_flag(int flags)
 }
 /* This may be called often, so keep it lean */
-asmlinkage void set_precision_flag_up(void)
+asmlinkage __visible void set_precision_flag_up(void)
 {
        if (control_word & CW_Precision)
                partial_status |= (SW_Precision | SW_C1);       /* The masked response */
@@ -548,7 +548,7 @@ asmlinkage void set_precision_flag_up(void)
 }
 /* This may be called often, so keep it lean */
-asmlinkage void set_precision_flag_down(void)
+asmlinkage __visible void set_precision_flag_down(void)
 {
        if (control_word & CW_Precision) {      /* The masked response */
                partial_status &= ~SW_C1;
@@ -557,7 +557,7 @@ asmlinkage void set_precision_flag_down(void)
                EXCEPTION(EX_Precision);
 }
-asmlinkage int denormal_operand(void)
+asmlinkage __visible int denormal_operand(void)
 {
        if (control_word & CW_Denormal) {       /* The masked response */
                partial_status |= SW_Denorm_Op;
@@ -568,7 +568,7 @@ asmlinkage int denormal_operand(void)
        }
 }
-asmlinkage int arith_overflow(FPU_REG *dest)
+asmlinkage __visible int arith_overflow(FPU_REG *dest)
 {
        int tag = TAG_Valid;
@@ -596,7 +596,7 @@ asmlinkage int arith_overflow(FPU_REG *dest)
 }
-asmlinkage int arith_underflow(FPU_REG *dest)
+asmlinkage __visible int arith_underflow(FPU_REG *dest)
 {
        int tag = TAG_Valid;
diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c
index 81b506d5befd..524142117296 100644
--- a/arch/x86/platform/efi/early_printk.c
+++ b/arch/x86/platform/efi/early_printk.c
@@ -14,48 +14,92 @@
 static const struct font_desc *font;
 static u32 efi_x, efi_y;
+static void *efi_fb;
+static bool early_efi_keep;
-static __init void early_efi_clear_scanline(unsigned int y)
+/*
+ * efi earlyprintk need use early_ioremap to map the framebuffer.
+ * But early_ioremap is not usable for earlyprintk=efi,keep, ioremap should
+ * be used instead. ioremap will be available after paging_init() which is
+ * earlier than initcall callbacks. Thus adding this early initcall function
+ * early_efi_map_fb to map the whole efi framebuffer.
+ */
+static __init int early_efi_map_fb(void)
 {
-        unsigned long base, *dst;
+        unsigned long base, size;
-        u16 len;
+        if (!early_efi_keep)
+                return 0;
        base = boot_params.screen_info.lfb_base;
-        len = boot_params.screen_info.lfb_linelength;
+        size = boot_params.screen_info.lfb_size;
+        efi_fb = ioremap(base, size);
+        return efi_fb ? 0 : -ENOMEM;
+}
+early_initcall(early_efi_map_fb);
+/*
+ * early_efi_map maps efi framebuffer region [start, start + len -1]
+ * In case earlyprintk=efi,keep we have the whole framebuffer mapped already
+ * so just return the offset efi_fb + start.
+ */
+static __init_refok void *early_efi_map(unsigned long start, unsigned long len)
+{
+        unsigned long base;
+        base = boot_params.screen_info.lfb_base;
+        if (efi_fb)
+                return (efi_fb + start);
+        else
+                return early_ioremap(base + start, len);
+}
-        dst = early_ioremap(base + y*len, len);
+static __init_refok void early_efi_unmap(void *addr, unsigned long len)
+{
+        if (!efi_fb)
+                early_iounmap(addr, len);
+}
+static void early_efi_clear_scanline(unsigned int y)
+{
+        unsigned long *dst;
+        u16 len;
+        len = boot_params.screen_info.lfb_linelength;
+        dst = early_efi_map(y*len, len);
        if (!dst)
                return;
        memset(dst, 0, len);
-        early_iounmap(dst, len);
+        early_efi_unmap(dst, len);
 }
-static __init void early_efi_scroll_up(void)
+static void early_efi_scroll_up(void)
 {
-        unsigned long base, *dst, *src;
+        unsigned long *dst, *src;
        u16 len;
        u32 i, height;
-        base = boot_params.screen_info.lfb_base;
        len = boot_params.screen_info.lfb_linelength;
        height = boot_params.screen_info.lfb_height;
        for (i = 0; i < height - font->height; i++) {
-                dst = early_ioremap(base + i*len, len);
+                dst = early_efi_map(i*len, len);
                if (!dst)
                        return;
-                src = early_ioremap(base + (i + font->height) * len, len);
+                src = early_efi_map((i + font->height) * len, len);
                if (!src) {
-                        early_iounmap(dst, len);
+                        early_efi_unmap(dst, len);
                        return;
                }
                memmove(dst, src, len);
-                early_iounmap(src, len);
+                early_efi_unmap(src, len);
-                early_iounmap(dst, len);
+                early_efi_unmap(dst, len);
        }
 }
@@ -79,16 +123,14 @@ static void early_efi_write_char(u32 *dst, unsigned char c, unsigned int h)
        }
 }
-static __init void
+static void
 early_efi_write(struct console *con, const char *str, unsigned int num)
 {
        struct screen_info *si;
-        unsigned long base;
        unsigned int len;
        const char *s;
        void *dst;
-        base = boot_params.screen_info.lfb_base;
        si = &boot_params.screen_info;
        len = si->lfb_linelength;
@@ -109,7 +151,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
                for (h = 0; h < font->height; h++) {
                        unsigned int n, x;
-                        dst = early_ioremap(base + (efi_y + h) * len, len);
+                        dst = early_efi_map((efi_y + h) * len, len);
                        if (!dst)
                                return;
@@ -123,7 +165,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
                                s++;
                        }
-                        early_iounmap(dst, len);
+                        early_efi_unmap(dst, len);
                }
                num -= count;
@@ -179,6 +221,9 @@ static __init int early_efi_setup(struct console *con, char *options)
        for (i = 0; i < (yres - efi_y) / font->height; i++)
                early_efi_scroll_up();
+        /* early_console_register will unset CON_BOOT in case ,keep */
+        if (!(con->flags & CON_BOOT))
+                early_efi_keep = true;
        return 0;
 }
diff --git a/arch/x86/platform/olpc/olpc-xo1-pm.c b/arch/x86/platform/olpc/olpc-xo1-pm.c
index ff0174dda810..a9acde72d4ed 100644
--- a/arch/x86/platform/olpc/olpc-xo1-pm.c
+++ b/arch/x86/platform/olpc/olpc-xo1-pm.c
@@ -75,7 +75,7 @@ static int xo1_power_state_enter(suspend_state_t pm_state)
        return 0;
 }
-asmlinkage int xo1_do_sleep(u8 sleep_state)
+asmlinkage __visible int xo1_do_sleep(u8 sleep_state)
 {
        void *pgd_addr = __va(read_cr3());
diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index 304fca20d96e..35e2bb6c0f37 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -23,7 +23,7 @@
 extern __visible const void __nosave_begin, __nosave_end;
 /* Defined in hibernate_asm_64.S */
-extern asmlinkage int restore_image(void);
+extern asmlinkage __visible int restore_image(void);
 /*
 * Address to jump to in the last phase of restore in order to get to the image
diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
index 00348980a3a6..e1f220e3ca68 100644
--- a/arch/x86/vdso/vdso32-setup.c
+++ b/arch/x86/vdso/vdso32-setup.c
@@ -39,6 +39,7 @@
 #ifdef CONFIG_X86_64
 #define vdso_enabled                    sysctl_vsyscall32
 #define arch_setup_additional_pages     syscall32_setup_pages
+extern int sysctl_ldt16;
 #endif
 /*
@@ -249,6 +250,13 @@ static struct ctl_table abi_table2[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
+        {
+                .procname       = "ldt16",
+                .data           = &sysctl_ldt16,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
        {}
 };
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 201d09a7c46b..c34bfc4bbe7f 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1515,7 +1515,7 @@ static void __init xen_pvh_early_guest_init(void)
 }
 /* First C function to be called on Xen boot */
-asmlinkage void __init xen_start_kernel(void)
+asmlinkage __visible void __init xen_start_kernel(void)
 {
        struct physdev_set_iopl set_iopl;
        int rc;
diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
index 08f763de26fe..a1207cb6472a 100644
--- a/arch/x86/xen/irq.c
+++ b/arch/x86/xen/irq.c
@@ -23,7 +23,7 @@ void xen_force_evtchn_callback(void)
        (void)HYPERVISOR_xen_version(0, NULL);
 }
-asmlinkage unsigned long xen_save_fl(void)
+asmlinkage __visible unsigned long xen_save_fl(void)
 {
        struct vcpu_info *vcpu;
        unsigned long flags;
@@ -63,7 +63,7 @@ __visible void xen_restore_fl(unsigned long flags)
 }
 PV_CALLEE_SAVE_REGS_THUNK(xen_restore_fl);
-asmlinkage void xen_irq_disable(void)
+asmlinkage __visible void xen_irq_disable(void)
 {
        /* There's a one instruction preempt window here.  We need to
           make sure we're don't switch CPUs between getting the vcpu
@@ -74,7 +74,7 @@ asmlinkage void xen_irq_disable(void)
 }
 PV_CALLEE_SAVE_REGS_THUNK(xen_irq_disable);
-asmlinkage void xen_irq_enable(void)
+asmlinkage __visible void xen_irq_enable(void)
 {
        struct vcpu_info *vcpu;
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 02d6d29a63c1..3a617af60d46 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -14,6 +14,7 @@ config XTENSA
        select GENERIC_PCI_IOMAP
        select ARCH_WANT_IPC_PARSE_VERSION
        select ARCH_WANT_OPTIONAL_GPIOLIB
+        select BUILDTIME_EXTABLE_SORT
        select CLONE_BACKWARDS
        select IRQ_DOMAIN
        select HAVE_OPROFILE
@@ -189,6 +190,24 @@ config INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX
          If in doubt, say Y.
+config HIGHMEM
+        bool "High Memory Support"
+        help
+          Linux can use the full amount of RAM in the system by
+          default. However, the default MMUv2 setup only maps the
+          lowermost 128 MB of memory linearly to the areas starting
+          at 0xd0000000 (cached) and 0xd8000000 (uncached).
+          When there are more than 128 MB memory in the system not
+          all of it can be "permanently mapped" by the kernel.
+          The physical memory that's not permanently mapped is called
+          "high memory".
+          If you are compiling a kernel which will never run on a
+          machine with more than 128 MB total physical RAM, answer
+          N here.
+          If unsure, say Y.
 endmenu
 config XTENSA_CALIBRATE_CCOUNT
@@ -224,7 +243,6 @@ choice
 config XTENSA_PLATFORM_ISS
        bool "ISS"
-        depends on TTY
        select XTENSA_CALIBRATE_CCOUNT
        select SERIAL_CONSOLE
        help
diff --git a/arch/xtensa/boot/dts/kc705.dts b/arch/xtensa/boot/dts/kc705.dts
new file mode 100644
index 000000000000..742a347be67a
--- /dev/null
+++ b/arch/xtensa/boot/dts/kc705.dts
@@ -0,0 +1,11 @@
+/dts-v1/;
+/include/ "xtfpga.dtsi"
+/include/ "xtfpga-flash-128m.dtsi"
+/ {
+        compatible = "cdns,xtensa-kc705";
+        memory@0 {
+                device_type = "memory";
+                reg = <0x00000000 0x08000000>;
+        };
+};
diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi
new file mode 100644
index 000000000000..d3a88e029873
--- /dev/null
+++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi
@@ -0,0 +1,28 @@
+/ {
+        soc {
+                flash: flash@00000000 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "cfi-flash";
+                        reg = <0x00000000 0x08000000>;
+                        bank-width = <2>;
+                        device-width = <2>;
+                        partition@0x0 {
+                                label = "data";
+                                reg = <0x00000000 0x06000000>;
+                        };
+                        partition@0x6000000 {
+                                label = "boot loader area";
+                                reg = <0x06000000 0x00800000>;
+                        };
+                        partition@0x6800000 {
+                                label = "kernel image";
+                                reg = <0x06800000 0x017e0000>;
+                        };
+                        partition@0x7fe0000 {
+                                label = "boot environment";
+                                reg = <0x07fe0000 0x00020000>;
+                        };
+                };
+        };
+};
diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi
index e5703c7beeb6..1d97203c18e7 100644
--- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi
+++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi
@@ -1,26 +1,28 @@
 / {
-        flash: flash@f8000000 {
+        soc {
-                #address-cells = <1>;
+                flash: flash@08000000 {
-                #size-cells = <1>;
+                        #address-cells = <1>;
-                compatible = "cfi-flash";
+                        #size-cells = <1>;
-                reg = <0xf8000000 0x01000000>;
+                        compatible = "cfi-flash";
-                bank-width = <2>;
+                        reg = <0x08000000 0x01000000>;
-                device-width = <2>;
+                        bank-width = <2>;
-                partition@0x0 {
+                        device-width = <2>;
-                        label = "boot loader area";
+                        partition@0x0 {
-                        reg = <0x00000000 0x00400000>;
+                                label = "boot loader area";
+                                reg = <0x00000000 0x00400000>;
+                        };
+                        partition@0x400000 {
+                                label = "kernel image";
+                                reg = <0x00400000 0x00600000>;
+                        };
+                        partition@0xa00000 {
+                                label = "data";
+                                reg = <0x00a00000 0x005e0000>;
+                        };
+                        partition@0xfe0000 {
+                                label = "boot environment";
+                                reg = <0x00fe0000 0x00020000>;
+                        };
                };
-                partition@0x400000 {
+        };
-                        label = "kernel image";
-                        reg = <0x00400000 0x00600000>;
-                };
-                partition@0xa00000 {
-                        label = "data";
-                        reg = <0x00a00000 0x005e0000>;
-                };
-                partition@0xfe0000 {
-                        label = "boot environment";
-                        reg = <0x00fe0000 0x00020000>;
-                };
-        };
 };
diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi
index 6f9c10d6b689..d1c621ca8be1 100644
--- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi
+++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi
@@ -1,18 +1,20 @@
 / {
-        flash: flash@f8000000 {
+        soc {
-                #address-cells = <1>;
+                flash: flash@08000000 {
-                #size-cells = <1>;
+                        #address-cells = <1>;
-                compatible = "cfi-flash";
+                        #size-cells = <1>;
-                reg = <0xf8000000 0x00400000>;
+                        compatible = "cfi-flash";
-                bank-width = <2>;
+                        reg = <0x08000000 0x00400000>;
-                device-width = <2>;
+                        bank-width = <2>;
-                partition@0x0 {
+                        device-width = <2>;
-                        label = "boot loader area";
+                        partition@0x0 {
-                        reg = <0x00000000 0x003f0000>;
+                                label = "boot loader area";
+                                reg = <0x00000000 0x003f0000>;
+                        };
+                        partition@0x3f0000 {
+                                label = "boot environment";
+                                reg = <0x003f0000 0x00010000>;
+                        };
                };
-                partition@0x3f0000 {
+        };
-                        label = "boot environment";
-                        reg = <0x003f0000 0x00010000>;
-                };
-        };
 };
diff --git a/arch/xtensa/boot/dts/xtfpga.dtsi b/arch/xtensa/boot/dts/xtfpga.dtsi
index e7370b11348e..dec9178840f6 100644
--- a/arch/xtensa/boot/dts/xtfpga.dtsi
+++ b/arch/xtensa/boot/dts/xtfpga.dtsi
@@ -42,21 +42,28 @@
                };
        };
-        serial0: serial@fd050020 {
+        soc {
-                device_type = "serial";
+                #address-cells = <1>;
-                compatible = "ns16550a";
+                #size-cells = <1>;
-                no-loopback-test;
+                compatible = "simple-bus";
-                reg = <0xfd050020 0x20>;
+                ranges = <0x00000000 0xf0000000 0x10000000>;
-                reg-shift = <2>;
-                interrupts = <0 1>; /* external irq 0 */
-                clocks = <&osc>;
-        };
-        enet0: ethoc@fd030000 {
+                serial0: serial@0d050020 {
-                compatible = "opencores,ethoc";
+                        device_type = "serial";
-                reg = <0xfd030000 0x4000 0xfd800000 0x4000>;
+                        compatible = "ns16550a";
-                interrupts = <1 1>; /* external irq 1 */
+                        no-loopback-test;
-                local-mac-address = [00 50 c2 13 6f 00];
+                        reg = <0x0d050020 0x20>;
-                clocks = <&osc>;
+                        reg-shift = <2>;
+                        interrupts = <0 1>; /* external irq 0 */
+                        clocks = <&osc>;
+                };
+                enet0: ethoc@0d030000 {
+                        compatible = "opencores,ethoc";
+                        reg = <0x0d030000 0x4000 0x0d800000 0x4000>;
+                        interrupts = <1 1>; /* external irq 1 */
+                        local-mac-address = [00 50 c2 13 6f 00];
+                        clocks = <&osc>;
+                };
        };
 };
diff --git a/arch/xtensa/include/asm/bootparam.h b/arch/xtensa/include/asm/bootparam.h
index 23392c5630ce..892aab399ac8 100644
--- a/arch/xtensa/include/asm/bootparam.h
+++ b/arch/xtensa/include/asm/bootparam.h
@@ -37,23 +37,14 @@ typedef struct bp_tag {
        unsigned long data[0];  /* data */
 } bp_tag_t;
-typedef struct meminfo {
+struct bp_meminfo {
        unsigned long type;
        unsigned long start;
        unsigned long end;
-} meminfo_t;
+};
-#define SYSMEM_BANKS_MAX 5
 #define MEMORY_TYPE_CONVENTIONAL        0x1000
 #define MEMORY_TYPE_NONE                0x2000
-typedef struct sysmem_info {
-        int nr_banks;
-        meminfo_t bank[SYSMEM_BANKS_MAX];
-} sysmem_info_t;
-extern sysmem_info_t sysmem;
 #endif
 #endif
diff --git a/arch/xtensa/include/asm/fixmap.h b/arch/xtensa/include/asm/fixmap.h
new file mode 100644
index 000000000000..9f6c33d0428a
--- /dev/null
+++ b/arch/xtensa/include/asm/fixmap.h
@@ -0,0 +1,58 @@
+/*
+ * fixmap.h: compile-time virtual memory allocation
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 1998 Ingo Molnar
+ *
+ * Support of BIGMEM added by Gerhard Wichert, Siemens AG, July 1999
+ */
+#ifndef _ASM_FIXMAP_H
+#define _ASM_FIXMAP_H
+#include <asm/pgtable.h>
+#ifdef CONFIG_HIGHMEM
+#include <linux/threads.h>
+#include <asm/kmap_types.h>
+#endif
+/*
+ * Here we define all the compile-time 'special' virtual
+ * addresses. The point is to have a constant address at
+ * compile time, but to set the physical address only
+ * in the boot process. We allocate these special  addresses
+ * from the end of the consistent memory region backwards.
+ * Also this lets us do fail-safe vmalloc(), we
+ * can guarantee that these special addresses and
+ * vmalloc()-ed addresses never overlap.
+ *
+ * these 'compile-time allocated' memory buffers are
+ * fixed-size 4k pages. (or larger if used with an increment
+ * higher than 1) use fixmap_set(idx,phys) to associate
+ * physical memory with fixmap indices.
+ */
+enum fixed_addresses {
+#ifdef CONFIG_HIGHMEM
+        /* reserved pte's for temporary kernel mappings */
+        FIX_KMAP_BEGIN,
+        FIX_KMAP_END = FIX_KMAP_BEGIN + (KM_TYPE_NR * NR_CPUS) - 1,
+#endif
+        __end_of_fixed_addresses
+};
+#define FIXADDR_TOP     (VMALLOC_START - PAGE_SIZE)
+#define FIXADDR_SIZE    (__end_of_fixed_addresses << PAGE_SHIFT)
+#define FIXADDR_START   ((FIXADDR_TOP - FIXADDR_SIZE) & PMD_MASK)
+#include <asm-generic/fixmap.h>
+#define kmap_get_fixmap_pte(vaddr) \
+        pte_offset_kernel( \
+                pmd_offset(pud_offset(pgd_offset_k(vaddr), (vaddr)), (vaddr)), \
+                (vaddr) \
+        )
+#endif
diff --git a/arch/xtensa/include/asm/highmem.h b/arch/xtensa/include/asm/highmem.h
index 80be15124697..2653ef5d55f1 100644
--- a/arch/xtensa/include/asm/highmem.h
+++ b/arch/xtensa/include/asm/highmem.h
@@ -6,11 +6,54 @@
 * this archive for more details.
 *
 * Copyright (C) 2003 - 2005 Tensilica Inc.
+ * Copyright (C) 2014 Cadence Design Systems Inc.
 */
 #ifndef _XTENSA_HIGHMEM_H
 #define _XTENSA_HIGHMEM_H
-extern void flush_cache_kmaps(void);
+#include <asm/cacheflush.h>
+#include <asm/fixmap.h>
+#include <asm/kmap_types.h>
+#include <asm/pgtable.h>
+#define PKMAP_BASE              (FIXADDR_START - PMD_SIZE)
+#define LAST_PKMAP              PTRS_PER_PTE
+#define LAST_PKMAP_MASK         (LAST_PKMAP - 1)
+#define PKMAP_NR(virt)          (((virt) - PKMAP_BASE) >> PAGE_SHIFT)
+#define PKMAP_ADDR(nr)          (PKMAP_BASE + ((nr) << PAGE_SHIFT))
+#define kmap_prot               PAGE_KERNEL
+extern pte_t *pkmap_page_table;
+void *kmap_high(struct page *page);
+void kunmap_high(struct page *page);
+static inline void *kmap(struct page *page)
+{
+        BUG_ON(in_interrupt());
+        if (!PageHighMem(page))
+                return page_address(page);
+        return kmap_high(page);
+}
+static inline void kunmap(struct page *page)
+{
+        BUG_ON(in_interrupt());
+        if (!PageHighMem(page))
+                return;
+        kunmap_high(page);
+}
+static inline void flush_cache_kmaps(void)
+{
+        flush_cache_all();
+}
+void *kmap_atomic(struct page *page);
+void __kunmap_atomic(void *kvaddr);
+void kmap_init(void);
 #endif
diff --git a/arch/xtensa/include/asm/pgtable.h b/arch/xtensa/include/asm/pgtable.h
index 216446295ada..4b0ca35a93b1 100644
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -310,6 +310,10 @@ set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep, pte_t pteval)
        update_pte(ptep, pteval);
 }
+static inline void set_pte(pte_t *ptep, pte_t pteval)
+{
+        update_pte(ptep, pteval);
+}
 static inline void
 set_pmd(pmd_t *pmdp, pmd_t pmdval)
diff --git a/arch/xtensa/include/asm/sysmem.h b/arch/xtensa/include/asm/sysmem.h
new file mode 100644
index 000000000000..c015c5c8e3f7
--- /dev/null
+++ b/arch/xtensa/include/asm/sysmem.h
@@ -0,0 +1,38 @@
+/*
+ * sysmem-related prototypes.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2014 Cadence Design Systems Inc.
+ */
+#ifndef _XTENSA_SYSMEM_H
+#define _XTENSA_SYSMEM_H
+#define SYSMEM_BANKS_MAX 31
+struct meminfo {
+        unsigned long start;
+        unsigned long end;
+};
+/*
+ * Bank array is sorted by .start.
+ * Banks don't overlap and there's at least one page gap
+ * between adjacent bank entries.
+ */
+struct sysmem_info {
+        int nr_banks;
+        struct meminfo bank[SYSMEM_BANKS_MAX];
+};
+extern struct sysmem_info sysmem;
+int add_sysmem_bank(unsigned long start, unsigned long end);
+int mem_reserve(unsigned long, unsigned long, int);
+void bootmem_init(void);
+void zones_init(void);
+#endif /* _XTENSA_SYSMEM_H */
diff --git a/arch/xtensa/include/asm/tlbflush.h b/arch/xtensa/include/asm/tlbflush.h
index fc34274ce41b..06875feb27c2 100644
--- a/arch/xtensa/include/asm/tlbflush.h
+++ b/arch/xtensa/include/asm/tlbflush.h
@@ -36,6 +36,7 @@ void local_flush_tlb_page(struct vm_area_struct *vma,
                unsigned long page);
 void local_flush_tlb_range(struct vm_area_struct *vma,
                unsigned long start, unsigned long end);
+void local_flush_tlb_kernel_range(unsigned long start, unsigned long end);
 #ifdef CONFIG_SMP
@@ -44,12 +45,7 @@ void flush_tlb_mm(struct mm_struct *);
 void flush_tlb_page(struct vm_area_struct *, unsigned long);
 void flush_tlb_range(struct vm_area_struct *, unsigned long,
                unsigned long);
+void flush_tlb_kernel_range(unsigned long start, unsigned long end);
-static inline void flush_tlb_kernel_range(unsigned long start,
-                unsigned long end)
-{
-        flush_tlb_all();
-}
 #else /* !CONFIG_SMP */
@@ -58,7 +54,8 @@ static inline void flush_tlb_kernel_range(unsigned long start,
 #define flush_tlb_page(vma, page)          local_flush_tlb_page(vma, page)
 #define flush_tlb_range(vma, vmaddr, end)  local_flush_tlb_range(vma, vmaddr, \
                                                                 end)
-#define flush_tlb_kernel_range(start, end) local_flush_tlb_all()
+#define flush_tlb_kernel_range(start, end) local_flush_tlb_kernel_range(start, \
+                                                                        end)
 #endif /* CONFIG_SMP */
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 84fe931bb60e..9757bb74e532 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -50,6 +50,7 @@
 #include <asm/param.h>
 #include <asm/traps.h>
 #include <asm/smp.h>
+#include <asm/sysmem.h>
 #include <platform/hardware.h>
@@ -88,12 +89,6 @@ static char __initdata command_line[COMMAND_LINE_SIZE];
 static char default_command_line[COMMAND_LINE_SIZE] __initdata = CONFIG_CMDLINE;
 #endif
-sysmem_info_t __initdata sysmem;
-extern int mem_reserve(unsigned long, unsigned long, int);
-extern void bootmem_init(void);
-extern void zones_init(void);
 /*
 * Boot parameter parsing.
 *
@@ -113,31 +108,14 @@ typedef struct tagtable {
 /* parse current tag */
-static int __init add_sysmem_bank(unsigned long type, unsigned long start,
-                unsigned long end)
-{
-        if (sysmem.nr_banks >= SYSMEM_BANKS_MAX) {
-                printk(KERN_WARNING
-                                "Ignoring memory bank 0x%08lx size %ldKB\n",
-                                start, end - start);
-                return -EINVAL;
-        }
-        sysmem.bank[sysmem.nr_banks].type  = type;
-        sysmem.bank[sysmem.nr_banks].start = PAGE_ALIGN(start);
-        sysmem.bank[sysmem.nr_banks].end   = end & PAGE_MASK;
-        sysmem.nr_banks++;
-        return 0;
-}
 static int __init parse_tag_mem(const bp_tag_t *tag)
 {
-        meminfo_t *mi = (meminfo_t *)(tag->data);
+        struct bp_meminfo *mi = (struct bp_meminfo *)(tag->data);
        if (mi->type != MEMORY_TYPE_CONVENTIONAL)
                return -1;
-        return add_sysmem_bank(mi->type, mi->start, mi->end);
+        return add_sysmem_bank(mi->start, mi->end);
 }
 __tagtable(BP_TAG_MEMORY, parse_tag_mem);
@@ -146,8 +124,8 @@ __tagtable(BP_TAG_MEMORY, parse_tag_mem);
 static int __init parse_tag_initrd(const bp_tag_t* tag)
 {
-        meminfo_t* mi;
+        struct bp_meminfo *mi = (struct bp_meminfo *)(tag->data);
-        mi = (meminfo_t*)(tag->data);
        initrd_start = (unsigned long)__va(mi->start);
        initrd_end = (unsigned long)__va(mi->end);
@@ -255,7 +233,7 @@ void __init early_init_dt_add_memory_arch(u64 base, u64 size)
                return;
        size &= PAGE_MASK;
-        add_sysmem_bank(MEMORY_TYPE_CONVENTIONAL, base, base + size);
+        add_sysmem_bank(base, base + size);
 }
 void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
@@ -292,8 +270,6 @@ device_initcall(xtensa_device_probe);
 void __init init_arch(bp_tag_t *bp_start)
 {
-        sysmem.nr_banks = 0;
        /* Parse boot parameters */
        if (bp_start)
@@ -304,10 +280,9 @@ void __init init_arch(bp_tag_t *bp_start)
 #endif
        if (sysmem.nr_banks == 0) {
-                sysmem.nr_banks = 1;
+                add_sysmem_bank(PLATFORM_DEFAULT_MEM_START,
-                sysmem.bank[0].start = PLATFORM_DEFAULT_MEM_START;
+                                PLATFORM_DEFAULT_MEM_START +
-                sysmem.bank[0].end = PLATFORM_DEFAULT_MEM_START
+                                PLATFORM_DEFAULT_MEM_SIZE);
-                                     + PLATFORM_DEFAULT_MEM_SIZE;
        }
 #ifdef CONFIG_CMDLINE_BOOL
@@ -487,7 +462,7 @@ void __init setup_arch(char **cmdline_p)
 #ifdef CONFIG_BLK_DEV_INITRD
        if (initrd_start < initrd_end) {
                initrd_is_mapped = mem_reserve(__pa(initrd_start),
-                                               __pa(initrd_end), 0);
+                                               __pa(initrd_end), 0) == 0;
                initrd_below_start_ok = 1;
        } else {
                initrd_start = 0;
@@ -532,6 +507,7 @@ void __init setup_arch(char **cmdline_p)
                    __pa(&_Level6InterruptVector_text_end), 0);
 #endif
+        parse_early_param();
        bootmem_init();
        unflatten_and_copy_device_tree();
diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c
index aa8bd8717927..40b5a3771fb0 100644
--- a/arch/xtensa/kernel/smp.c
+++ b/arch/xtensa/kernel/smp.c
@@ -496,6 +496,21 @@ void flush_tlb_range(struct vm_area_struct *vma,
        on_each_cpu(ipi_flush_tlb_range, &fd, 1);
 }
+static void ipi_flush_tlb_kernel_range(void *arg)
+{
+        struct flush_data *fd = arg;
+        local_flush_tlb_kernel_range(fd->addr1, fd->addr2);
+}
+void flush_tlb_kernel_range(unsigned long start, unsigned long end)
+{
+        struct flush_data fd = {
+                .addr1 = start,
+                .addr2 = end,
+        };
+        on_each_cpu(ipi_flush_tlb_kernel_range, &fd, 1);
+}
 /* Cache flush functions */
 static void ipi_flush_cache_all(void *arg)
diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index 80b33ed51f31..4d2872fd9bb5 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -20,6 +20,7 @@
 #include <linux/in6.h>
 #include <asm/uaccess.h>
+#include <asm/cacheflush.h>
 #include <asm/checksum.h>
 #include <asm/dma.h>
 #include <asm/io.h>
@@ -105,6 +106,7 @@ EXPORT_SYMBOL(csum_partial_copy_generic);
 * Architecture-specific symbols
 */
 EXPORT_SYMBOL(__xtensa_copy_user);
+EXPORT_SYMBOL(__invalidate_icache_range);
 /*
 * Kernel hacking ...
@@ -127,3 +129,8 @@ EXPORT_SYMBOL(common_exception_return);
 #ifdef CONFIG_FUNCTION_TRACER
 EXPORT_SYMBOL(_mcount);
 #endif
+EXPORT_SYMBOL(__invalidate_dcache_range);
+#if XCHAL_DCACHE_IS_WRITEBACK
+EXPORT_SYMBOL(__flush_dcache_range);
+#endif
diff --git a/arch/xtensa/mm/Makefile b/arch/xtensa/mm/Makefile
index f0b646d2f843..f54f78e24d7b 100644
--- a/arch/xtensa/mm/Makefile
+++ b/arch/xtensa/mm/Makefile
@@ -4,3 +4,4 @@
 obj-y                   := init.o cache.o misc.o
 obj-$(CONFIG_MMU)       += fault.o mmu.o tlb.o
+obj-$(CONFIG_HIGHMEM)   += highmem.o
diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
index ba4c47f291b1..63cbb867dadd 100644
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -59,6 +59,10 @@
 *
 */
+#if (DCACHE_WAY_SIZE > PAGE_SIZE) && defined(CONFIG_HIGHMEM)
+#error "HIGHMEM is not supported on cores with aliasing cache."
+#endif
 #if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
 /*
@@ -179,10 +183,11 @@ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
 #else
        if (!PageReserved(page) && !test_bit(PG_arch_1, &page->flags)
            && (vma->vm_flags & VM_EXEC) != 0) {
-                unsigned long paddr = (unsigned long) page_address(page);
+                unsigned long paddr = (unsigned long)kmap_atomic(page);
                __flush_dcache_page(paddr);
                __invalidate_icache_page(paddr);
                set_bit(PG_arch_1, &page->flags);
+                kunmap_atomic((void *)paddr);
        }
 #endif
 }
diff --git a/arch/xtensa/mm/highmem.c b/arch/xtensa/mm/highmem.c
new file mode 100644
index 000000000000..17a8c0d6fd17
--- /dev/null
+++ b/arch/xtensa/mm/highmem.c
@@ -0,0 +1,72 @@
+/*
+ * High memory support for Xtensa architecture
+ *
+ * This file is subject to the terms and conditions of the GNU General
+ * Public License.  See the file "COPYING" in the main directory of
+ * this archive for more details.
+ *
+ * Copyright (C) 2014 Cadence Design Systems Inc.
+ */
+#include <linux/export.h>
+#include <linux/highmem.h>
+#include <asm/tlbflush.h>
+static pte_t *kmap_pte;
+void *kmap_atomic(struct page *page)
+{
+        enum fixed_addresses idx;
+        unsigned long vaddr;
+        int type;
+        pagefault_disable();
+        if (!PageHighMem(page))
+                return page_address(page);
+        type = kmap_atomic_idx_push();
+        idx = type + KM_TYPE_NR * smp_processor_id();
+        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+#ifdef CONFIG_DEBUG_HIGHMEM
+        BUG_ON(!pte_none(*(kmap_pte - idx)));
+#endif
+        set_pte(kmap_pte - idx, mk_pte(page, PAGE_KERNEL_EXEC));
+        return (void *)vaddr;
+}
+EXPORT_SYMBOL(kmap_atomic);
+void __kunmap_atomic(void *kvaddr)
+{
+        int idx, type;
+        if (kvaddr >= (void *)FIXADDR_START &&
+            kvaddr < (void *)FIXADDR_TOP) {
+                type = kmap_atomic_idx();
+                idx = type + KM_TYPE_NR * smp_processor_id();
+                /*
+                 * Force other mappings to Oops if they'll try to access this
+                 * pte without first remap it.  Keeping stale mappings around
+                 * is a bad idea also, in case the page changes cacheability
+                 * attributes or becomes a protected page in a hypervisor.
+                 */
+                pte_clear(&init_mm, kvaddr, kmap_pte - idx);
+                local_flush_tlb_kernel_range((unsigned long)kvaddr,
+                                             (unsigned long)kvaddr + PAGE_SIZE);
+                kmap_atomic_idx_pop();
+        }
+        pagefault_enable();
+}
+EXPORT_SYMBOL(__kunmap_atomic);
+void __init kmap_init(void)
+{
+        unsigned long kmap_vstart;
+        /* cache the first kmap pte */
+        kmap_vstart = __fix_to_virt(FIX_KMAP_BEGIN);
+        kmap_pte = kmap_get_fixmap_pte(kmap_vstart);
+}
diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
index aff108df92d3..4224256bb215 100644
--- a/arch/xtensa/mm/init.c
+++ b/arch/xtensa/mm/init.c
@@ -8,6 +8,7 @@
 * for more details.
 *
 * Copyright (C) 2001 - 2005 Tensilica Inc.
+ * Copyright (C) 2014 Cadence Design Systems Inc.
 *
 * Chris Zankel <chris@zankel.net>
 * Joe Taylor   <joe@tensilica.com, joetylr@yahoo.com>
@@ -19,6 +20,7 @@
 #include <linux/errno.h>
 #include <linux/bootmem.h>
 #include <linux/gfp.h>
+#include <linux/highmem.h>
 #include <linux/swap.h>
 #include <linux/mman.h>
 #include <linux/nodemask.h>
@@ -27,11 +29,133 @@
 #include <asm/bootparam.h>
 #include <asm/page.h>
 #include <asm/sections.h>
+#include <asm/sysmem.h>
+struct sysmem_info sysmem __initdata;
+static void __init sysmem_dump(void)
+{
+        unsigned i;
+        pr_debug("Sysmem:\n");
+        for (i = 0; i < sysmem.nr_banks; ++i)
+                pr_debug("  0x%08lx - 0x%08lx (%ldK)\n",
+                         sysmem.bank[i].start, sysmem.bank[i].end,
+                         (sysmem.bank[i].end - sysmem.bank[i].start) >> 10);
+}
+/*
+ * Find bank with maximal .start such that bank.start <= start
+ */
+static inline struct meminfo * __init find_bank(unsigned long start)
+{
+        unsigned i;
+        struct meminfo *it = NULL;
+        for (i = 0; i < sysmem.nr_banks; ++i)
+                if (sysmem.bank[i].start <= start)
+                        it = sysmem.bank + i;
+                else
+                        break;
+        return it;
+}
+/*
+ * Move all memory banks starting at 'from' to a new place at 'to',
+ * adjust nr_banks accordingly.
+ * Both 'from' and 'to' must be inside the sysmem.bank.
+ *
+ * Returns: 0 (success), -ENOMEM (not enough space in the sysmem.bank).
+ */
+static int __init move_banks(struct meminfo *to, struct meminfo *from)
+{
+        unsigned n = sysmem.nr_banks - (from - sysmem.bank);
+        if (to > from && to - from + sysmem.nr_banks > SYSMEM_BANKS_MAX)
+                return -ENOMEM;
+        if (to != from)
+                memmove(to, from, n * sizeof(struct meminfo));
+        sysmem.nr_banks += to - from;
+        return 0;
+}
+/*
+ * Add new bank to sysmem. Resulting sysmem is the union of bytes of the
+ * original sysmem and the new bank.
+ *
+ * Returns: 0 (success), < 0 (error)
+ */
+int __init add_sysmem_bank(unsigned long start, unsigned long end)
+{
+        unsigned i;
+        struct meminfo *it = NULL;
+        unsigned long sz;
+        unsigned long bank_sz = 0;
+        if (start == end ||
+            (start < end) != (PAGE_ALIGN(start) < (end & PAGE_MASK))) {
+                pr_warn("Ignoring small memory bank 0x%08lx size: %ld bytes\n",
+                        start, end - start);
+                return -EINVAL;
+        }
+        start = PAGE_ALIGN(start);
+        end &= PAGE_MASK;
+        sz = end - start;
+        it = find_bank(start);
+        if (it)
+                bank_sz = it->end - it->start;
+        if (it && bank_sz >= start - it->start) {
+                if (end - it->start > bank_sz)
+                        it->end = end;
+                else
+                        return 0;
+        } else {
+                if (!it)
+                        it = sysmem.bank;
+                else
+                        ++it;
+                if (it - sysmem.bank < sysmem.nr_banks &&
+                    it->start - start <= sz) {
+                        it->start = start;
+                        if (it->end - it->start < sz)
+                                it->end = end;
+                        else
+                                return 0;
+                } else {
+                        if (move_banks(it + 1, it) < 0) {
+                                pr_warn("Ignoring memory bank 0x%08lx size %ld bytes\n",
+                                        start, end - start);
+                                return -EINVAL;
+                        }
+                        it->start = start;
+                        it->end = end;
+                        return 0;
+                }
+        }
+        sz = it->end - it->start;
+        for (i = it + 1 - sysmem.bank; i < sysmem.nr_banks; ++i)
+                if (sysmem.bank[i].start - it->start <= sz) {
+                        if (sz < sysmem.bank[i].end - it->start)
+                                it->end = sysmem.bank[i].end;
+                } else {
+                        break;
+                }
+        move_banks(it + 1, sysmem.bank + i);
+        return 0;
+}
 /*
 * mem_reserve(start, end, must_exist)
 *
 * Reserve some memory from the memory pool.
+ * If must_exist is set and a part of the region being reserved does not exist
+ * memory map is not altered.
 *
 * Parameters:
 *  start       Start of region,
@@ -39,53 +163,69 @@
 *  must_exist  Must exist in memory pool.
 *
 * Returns:
- *  0 (memory area couldn't be mapped)
+ *  0 (success)
- * -1 (success)
+ *  < 0 (error)
 */
 int __init mem_reserve(unsigned long start, unsigned long end, int must_exist)
 {
-        int i;
+        struct meminfo *it;
+        struct meminfo *rm = NULL;
-        if (start == end)
+        unsigned long sz;
-                return 0;
+        unsigned long bank_sz = 0;
        start = start & PAGE_MASK;
        end = PAGE_ALIGN(end);
+        sz = end - start;
+        if (!sz)
+                return -EINVAL;
-        for (i = 0; i < sysmem.nr_banks; i++)
+        it = find_bank(start);
-                if (start < sysmem.bank[i].end
-                    && end >= sysmem.bank[i].start)
+        if (it)
-                        break;
+                bank_sz = it->end - it->start;
-        if (i == sysmem.nr_banks) {
+        if ((!it || end - it->start > bank_sz) && must_exist) {
-                if (must_exist)
+                pr_warn("mem_reserve: [0x%0lx, 0x%0lx) not in any region!\n",
-                        printk (KERN_WARNING "mem_reserve: [0x%0lx, 0x%0lx) "
+                        start, end);
-                                "not in any region!\n", start, end);
+                return -EINVAL;
-                return 0;
        }
-        if (start > sysmem.bank[i].start) {
+        if (it && start - it->start < bank_sz) {
-                if (end < sysmem.bank[i].end) {
+                if (start == it->start) {
-                        /* split entry */
+                        if (end - it->start < bank_sz) {
-                        if (sysmem.nr_banks >= SYSMEM_BANKS_MAX)
+                                it->start = end;
-                                panic("meminfo overflow\n");
+                                return 0;
-                        sysmem.bank[sysmem.nr_banks].start = end;
+                        } else {
-                        sysmem.bank[sysmem.nr_banks].end = sysmem.bank[i].end;
+                                rm = it;
-                        sysmem.nr_banks++;
+                        }
+                } else {
+                        it->end = start;
+                        if (end - it->start < bank_sz)
+                                return add_sysmem_bank(end,
+                                                       it->start + bank_sz);
+                        ++it;
                }
-                sysmem.bank[i].end = start;
+        }
-        } else if (end < sysmem.bank[i].end) {
+        if (!it)
-                sysmem.bank[i].start = end;
+                it = sysmem.bank;
-        } else {
+        for (; it < sysmem.bank + sysmem.nr_banks; ++it) {
-                /* remove entry */
+                if (it->end - start <= sz) {
-                sysmem.nr_banks--;
+                        if (!rm)
-                sysmem.bank[i].start = sysmem.bank[sysmem.nr_banks].start;
+                                rm = it;
-                sysmem.bank[i].end   = sysmem.bank[sysmem.nr_banks].end;
+                } else {
+                        if (it->start - start < sz)
+                                it->start = end;
+                        break;
+                }
        }
-        return -1;
+        if (rm)
+                move_banks(rm, it);
+        return 0;
 }
@@ -99,6 +239,7 @@ void __init bootmem_init(void)
        unsigned long bootmap_start, bootmap_size;
        int i;
+        sysmem_dump();
        max_low_pfn = max_pfn = 0;
        min_low_pfn = ~0;
@@ -156,19 +297,13 @@ void __init bootmem_init(void)
 void __init zones_init(void)
 {
-        unsigned long zones_size[MAX_NR_ZONES];
-        int i;
        /* All pages are DMA-able, so we put them all in the DMA zone. */
+        unsigned long zones_size[MAX_NR_ZONES] = {
-        zones_size[ZONE_DMA] = max_low_pfn - ARCH_PFN_OFFSET;
+                [ZONE_DMA] = max_low_pfn - ARCH_PFN_OFFSET,
-        for (i = 1; i < MAX_NR_ZONES; i++)
-                zones_size[i] = 0;
 #ifdef CONFIG_HIGHMEM
-        zones_size[ZONE_HIGHMEM] = max_pfn - max_low_pfn;
+                [ZONE_HIGHMEM] = max_pfn - max_low_pfn,
 #endif
+        };
        free_area_init_node(0, zones_size, ARCH_PFN_OFFSET, NULL);
 }
@@ -178,16 +313,38 @@ void __init zones_init(void)
 void __init mem_init(void)
 {
-        max_mapnr = max_low_pfn - ARCH_PFN_OFFSET;
-        high_memory = (void *) __va(max_low_pfn << PAGE_SHIFT);
 #ifdef CONFIG_HIGHMEM
-#error HIGHGMEM not implemented in init.c
+        unsigned long tmp;
+        reset_all_zones_managed_pages();
+        for (tmp = max_low_pfn; tmp < max_pfn; tmp++)
+                free_highmem_page(pfn_to_page(tmp));
 #endif
+        max_mapnr = max_pfn - ARCH_PFN_OFFSET;
+        high_memory = (void *)__va(max_low_pfn << PAGE_SHIFT);
        free_all_bootmem();
        mem_init_print_info(NULL);
+        pr_info("virtual kernel memory layout:\n"
+#ifdef CONFIG_HIGHMEM
+                "    pkmap   : 0x%08lx - 0x%08lx  (%5lu kB)\n"
+                "    fixmap  : 0x%08lx - 0x%08lx  (%5lu kB)\n"
+#endif
+                "    vmalloc : 0x%08x - 0x%08x  (%5u MB)\n"
+                "    lowmem  : 0x%08x - 0x%08lx  (%5lu MB)\n",
+#ifdef CONFIG_HIGHMEM
+                PKMAP_BASE, PKMAP_BASE + LAST_PKMAP * PAGE_SIZE,
+                (LAST_PKMAP*PAGE_SIZE) >> 10,
+                FIXADDR_START, FIXADDR_TOP,
+                (FIXADDR_TOP - FIXADDR_START) >> 10,
+#endif
+                VMALLOC_START, VMALLOC_END,
+                (VMALLOC_END - VMALLOC_START) >> 20,
+                PAGE_OFFSET, PAGE_OFFSET +
+                (max_low_pfn - min_low_pfn) * PAGE_SIZE,
+                ((max_low_pfn - min_low_pfn) * PAGE_SIZE) >> 20);
 }
 #ifdef CONFIG_BLK_DEV_INITRD
@@ -204,3 +361,53 @@ void free_initmem(void)
 {
        free_initmem_default(-1);
 }
+static void __init parse_memmap_one(char *p)
+{
+        char *oldp;
+        unsigned long start_at, mem_size;
+        if (!p)
+                return;
+        oldp = p;
+        mem_size = memparse(p, &p);
+        if (p == oldp)
+                return;
+        switch (*p) {
+        case '@':
+                start_at = memparse(p + 1, &p);
+                add_sysmem_bank(start_at, start_at + mem_size);
+                break;
+        case '$':
+                start_at = memparse(p + 1, &p);
+                mem_reserve(start_at, start_at + mem_size, 0);
+                break;
+        case 0:
+                mem_reserve(mem_size, 0, 0);
+                break;
+        default:
+                pr_warn("Unrecognized memmap syntax: %s\n", p);
+                break;
+        }
+}
+static int __init parse_memmap_opt(char *str)
+{
+        while (str) {
+                char *k = strchr(str, ',');
+                if (k)
+                        *k++ = 0;
+                parse_memmap_one(str);
+                str = k;
+        }
+        return 0;
+}
+early_param("memmap", parse_memmap_opt);
diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
index 861203e958da..3429b483d9f8 100644
--- a/arch/xtensa/mm/mmu.c
+++ b/arch/xtensa/mm/mmu.c
@@ -3,6 +3,7 @@
 *
 * Extracted from init.c
 */
+#include <linux/bootmem.h>
 #include <linux/percpu.h>
 #include <linux/init.h>
 #include <linux/string.h>
@@ -16,9 +17,44 @@
 #include <asm/initialize_mmu.h>
 #include <asm/io.h>
+#if defined(CONFIG_HIGHMEM)
+static void * __init init_pmd(unsigned long vaddr)
+{
+        pgd_t *pgd = pgd_offset_k(vaddr);
+        pmd_t *pmd = pmd_offset(pgd, vaddr);
+        if (pmd_none(*pmd)) {
+                unsigned i;
+                pte_t *pte = alloc_bootmem_low_pages(PAGE_SIZE);
+                for (i = 0; i < 1024; i++)
+                        pte_clear(NULL, 0, pte + i);
+                set_pmd(pmd, __pmd(((unsigned long)pte) & PAGE_MASK));
+                BUG_ON(pte != pte_offset_kernel(pmd, 0));
+                pr_debug("%s: vaddr: 0x%08lx, pmd: 0x%p, pte: 0x%p\n",
+                         __func__, vaddr, pmd, pte);
+                return pte;
+        } else {
+                return pte_offset_kernel(pmd, 0);
+        }
+}
+static void __init fixedrange_init(void)
+{
+        BUILD_BUG_ON(FIXADDR_SIZE > PMD_SIZE);
+        init_pmd(__fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK);
+}
+#endif
 void __init paging_init(void)
 {
        memset(swapper_pg_dir, 0, PAGE_SIZE);
+#ifdef CONFIG_HIGHMEM
+        fixedrange_init();
+        pkmap_page_table = init_pmd(PKMAP_BASE);
+        kmap_init();
+#endif
 }
 /*
diff --git a/arch/xtensa/mm/tlb.c b/arch/xtensa/mm/tlb.c
index ade623826788..5ece856c5725 100644
--- a/arch/xtensa/mm/tlb.c
+++ b/arch/xtensa/mm/tlb.c
@@ -149,6 +149,21 @@ void local_flush_tlb_page(struct vm_area_struct *vma, unsigned long page)
        local_irq_restore(flags);
 }
+void local_flush_tlb_kernel_range(unsigned long start, unsigned long end)
+{
+        if (end > start && start >= TASK_SIZE && end <= PAGE_OFFSET &&
+            end - start < _TLB_ENTRIES << PAGE_SHIFT) {
+                start &= PAGE_MASK;
+                while (start < end) {
+                        invalidate_itlb_mapping(start);
+                        invalidate_dtlb_mapping(start);
+                        start += PAGE_SIZE;
+                }
+        } else {
+                local_flush_tlb_all();
+        }
+}
 #ifdef CONFIG_DEBUG_TLB_SANITY
 static unsigned get_pte_for_vaddr(unsigned vaddr)
diff --git a/arch/xtensa/platforms/iss/Makefile b/arch/xtensa/platforms/iss/Makefile
index d2369b799c50..b3e89291cfba 100644
--- a/arch/xtensa/platforms/iss/Makefile
+++ b/arch/xtensa/platforms/iss/Makefile
@@ -4,6 +4,7 @@
 # "prom monitor" library routines under Linux.
 #
-obj-y                   = console.o setup.o
+obj-y                   = setup.o
+obj-$(CONFIG_TTY)       += console.o
 obj-$(CONFIG_NET)       += network.o
 obj-$(CONFIG_BLK_DEV_SIMDISK) += simdisk.o
diff --git a/arch/xtensa/platforms/xt2000/setup.c b/arch/xtensa/platforms/xt2000/setup.c
index f9bc87966290..b90555cb8089 100644
--- a/arch/xtensa/platforms/xt2000/setup.c
+++ b/arch/xtensa/platforms/xt2000/setup.c
@@ -92,18 +92,8 @@ void __init platform_setup(char** cmdline)
 /* early initialization */
-extern sysmem_info_t __initdata sysmem;
+void __init platform_init(bp_tag_t *first)
-void platform_init(bp_tag_t* first)
 {
-        /* Set default memory block if not provided by the bootloader. */
-        if (sysmem.nr_banks == 0) {
-                sysmem.nr_banks = 1;
-                sysmem.bank[0].start = PLATFORM_DEFAULT_MEM_START;
-                sysmem.bank[0].end = PLATFORM_DEFAULT_MEM_START
-                                     + PLATFORM_DEFAULT_MEM_SIZE;
-        }
 }
 /* Heartbeat. Let the LED blink. */
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index e4a4145926f6..1039fb9ff5f5 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -451,7 +451,20 @@ static int blkcg_reset_stats(struct cgroup_subsys_state *css,
        struct blkcg_gq *blkg;
        int i;
-        mutex_lock(&blkcg_pol_mutex);
+        /*
+         * XXX: We invoke cgroup_add/rm_cftypes() under blkcg_pol_mutex
+         * which ends up putting cgroup's internal cgroup_tree_mutex under
+         * it; however, cgroup_tree_mutex is nested above cgroup file
+         * active protection and grabbing blkcg_pol_mutex from a cgroup
+         * file operation creates a possible circular dependency.  cgroup
+         * internal locking is planned to go through further simplification
+         * and this issue should go away soon.  For now, let's trylock
+         * blkcg_pol_mutex and restart the write on failure.
+         *
+         * http://lkml.kernel.org/g/5363C04B.4010400@oracle.com
+         */
+        if (!mutex_trylock(&blkcg_pol_mutex))
+                return restart_syscall();
        spin_lock_irq(&blkcg->lock);
        /*
diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index 1512e41cd93d..43665d0d0905 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -466,7 +466,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        type -= CRYPTO_MSG_BASE;
        link = &crypto_dispatch[type];
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
diff --git a/drivers/Makefile b/drivers/Makefile
index d05d81b19b50..7183b6af5dac 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -119,7 +119,7 @@ obj-$(CONFIG_SGI_SN)		+= sn/
 obj-y                           += firmware/
 obj-$(CONFIG_CRYPTO)            += crypto/
 obj-$(CONFIG_SUPERH)            += sh/
-obj-$(CONFIG_ARCH_SHMOBILE_LEGACY)      += sh/
+obj-$(CONFIG_ARCH_SHMOBILE)     += sh/
 ifndef CONFIG_ARCH_USES_GETTIMEOFFSET
 obj-y                           += clocksource/
 endif
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index ab686b310100..a34a22841002 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -47,6 +47,23 @@ config ACPI_SLEEP
        depends on SUSPEND || HIBERNATION
        default y
+config ACPI_PROCFS_POWER
+        bool "Deprecated power /proc/acpi directories"
+        depends on PROC_FS
+        help
+          For backwards compatibility, this option allows
+          deprecated power /proc/acpi/ directories to exist, even when
+          they have been replaced by functions in /sys.
+          The deprecated directories (and their replacements) include:
+          /proc/acpi/battery/* (/sys/class/power_supply/*)
+          /proc/acpi/ac_adapter/* (sys/class/power_supply/*)
+          This option has no effect on /proc/acpi/ directories
+          and functions, which do not yet exist in /sys
+          This option, together with the proc directories, will be
+          deleted in the future.
+          Say N to delete power /proc/acpi/ directories that have moved to /sys/
 config ACPI_EC_DEBUGFS
        tristate "EC read/write access through /sys/kernel/debug/ec"
        default n
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 0331f91d56e6..bce34afadcd0 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -47,6 +47,7 @@ acpi-y				+= sysfs.o
 acpi-$(CONFIG_X86)              += acpi_cmos_rtc.o
 acpi-$(CONFIG_DEBUG_FS)         += debugfs.o
 acpi-$(CONFIG_ACPI_NUMA)        += numa.o
+acpi-$(CONFIG_ACPI_PROCFS_POWER) += cm_sbs.o
 ifdef CONFIG_ACPI_VIDEO
 acpi-y                          += video_detect.o
 endif
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 2c01c1da29ce..c67f6f5ad611 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -52,11 +52,39 @@ MODULE_AUTHOR("Paul Diefenbaugh");
 MODULE_DESCRIPTION("ACPI AC Adapter Driver");
 MODULE_LICENSE("GPL");
+static int acpi_ac_add(struct acpi_device *device);
+static int acpi_ac_remove(struct acpi_device *device);
+static void acpi_ac_notify(struct acpi_device *device, u32 event);
+static const struct acpi_device_id ac_device_ids[] = {
+        {"ACPI0003", 0},
+        {"", 0},
+};
+MODULE_DEVICE_TABLE(acpi, ac_device_ids);
+#ifdef CONFIG_PM_SLEEP
+static int acpi_ac_resume(struct device *dev);
+#endif
+static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
 static int ac_sleep_before_get_state_ms;
+static struct acpi_driver acpi_ac_driver = {
+        .name = "ac",
+        .class = ACPI_AC_CLASS,
+        .ids = ac_device_ids,
+        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
+        .ops = {
+                .add = acpi_ac_add,
+                .remove = acpi_ac_remove,
+                .notify = acpi_ac_notify,
+                },
+        .drv.pm = &acpi_ac_pm,
+};
 struct acpi_ac {
        struct power_supply charger;
-        struct platform_device *pdev;
+        struct acpi_device * device;
        unsigned long long state;
        struct notifier_block battery_nb;
 };
@@ -69,10 +97,12 @@ struct acpi_ac {
 static int acpi_ac_get_state(struct acpi_ac *ac)
 {
-        acpi_status status;
+        acpi_status status = AE_OK;
-        acpi_handle handle = ACPI_HANDLE(&ac->pdev->dev);
+        if (!ac)
+                return -EINVAL;
-        status = acpi_evaluate_integer(handle, "_PSR", NULL,
+        status = acpi_evaluate_integer(ac->device->handle, "_PSR", NULL,
                                       &ac->state);
        if (ACPI_FAILURE(status)) {
                ACPI_EXCEPTION((AE_INFO, status,
@@ -117,10 +147,9 @@ static enum power_supply_property ac_props[] = {
                                   Driver Model
   -------------------------------------------------------------------------- */
-static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
+static void acpi_ac_notify(struct acpi_device *device, u32 event)
 {
-        struct acpi_ac *ac = data;
+        struct acpi_ac *ac = acpi_driver_data(device);
-        struct acpi_device *adev;
        if (!ac)
                return;
@@ -143,11 +172,10 @@ static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
                        msleep(ac_sleep_before_get_state_ms);
                acpi_ac_get_state(ac);
-                adev = ACPI_COMPANION(&ac->pdev->dev);
+                acpi_bus_generate_netlink_event(device->pnp.device_class,
-                acpi_bus_generate_netlink_event(adev->pnp.device_class,
+                                                  dev_name(&device->dev), event,
-                                                dev_name(&ac->pdev->dev),
+                                                  (u32) ac->state);
-                                                event, (u32) ac->state);
+                acpi_notifier_call_chain(device, event, (u32) ac->state);
-                acpi_notifier_call_chain(adev, event, (u32) ac->state);
                kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
        }
@@ -192,49 +220,39 @@ static struct dmi_system_id ac_dmi_table[] = {
        {},
 };
-static int acpi_ac_probe(struct platform_device *pdev)
+static int acpi_ac_add(struct acpi_device *device)
 {
        int result = 0;
        struct acpi_ac *ac = NULL;
-        struct acpi_device *adev;
-        if (!pdev)
-                return -EINVAL;
-        adev = ACPI_COMPANION(&pdev->dev);
+        if (!device)
-        if (!adev)
+                return -EINVAL;
-                return -ENODEV;
        ac = kzalloc(sizeof(struct acpi_ac), GFP_KERNEL);
        if (!ac)
                return -ENOMEM;
-        strcpy(acpi_device_name(adev), ACPI_AC_DEVICE_NAME);
+        ac->device = device;
-        strcpy(acpi_device_class(adev), ACPI_AC_CLASS);
+        strcpy(acpi_device_name(device), ACPI_AC_DEVICE_NAME);
-        ac->pdev = pdev;
+        strcpy(acpi_device_class(device), ACPI_AC_CLASS);
-        platform_set_drvdata(pdev, ac);
+        device->driver_data = ac;
        result = acpi_ac_get_state(ac);
        if (result)
                goto end;
-        ac->charger.name = acpi_device_bid(adev);
+        ac->charger.name = acpi_device_bid(device);
        ac->charger.type = POWER_SUPPLY_TYPE_MAINS;
        ac->charger.properties = ac_props;
        ac->charger.num_properties = ARRAY_SIZE(ac_props);
        ac->charger.get_property = get_ac_property;
-        result = power_supply_register(&pdev->dev, &ac->charger);
+        result = power_supply_register(&ac->device->dev, &ac->charger);
        if (result)
                goto end;
-        result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler, ac);
-        if (result) {
-                power_supply_unregister(&ac->charger);
-                goto end;
-        }
        printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
-               acpi_device_name(adev), acpi_device_bid(adev),
+               acpi_device_name(device), acpi_device_bid(device),
               ac->state ? "on-line" : "off-line");
        ac->battery_nb.notifier_call = acpi_ac_battery_notify;
@@ -256,7 +274,7 @@ static int acpi_ac_resume(struct device *dev)
        if (!dev)
                return -EINVAL;
-        ac = platform_get_drvdata(to_platform_device(dev));
+        ac = acpi_driver_data(to_acpi_device(dev));
        if (!ac)
                return -EINVAL;
@@ -270,19 +288,17 @@ static int acpi_ac_resume(struct device *dev)
 #else
 #define acpi_ac_resume NULL
 #endif
-static SIMPLE_DEV_PM_OPS(acpi_ac_pm_ops, NULL, acpi_ac_resume);
-static int acpi_ac_remove(struct platform_device *pdev)
+static int acpi_ac_remove(struct acpi_device *device)
 {
-        struct acpi_ac *ac;
+        struct acpi_ac *ac = NULL;
-        if (!pdev)
+        if (!device || !acpi_driver_data(device))
                return -EINVAL;
-        acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
+        ac = acpi_driver_data(device);
-                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler);
-        ac = platform_get_drvdata(pdev);
        if (ac->charger.dev)
                power_supply_unregister(&ac->charger);
        unregister_acpi_notifier(&ac->battery_nb);
@@ -292,23 +308,6 @@ static int acpi_ac_remove(struct platform_device *pdev)
        return 0;
 }
-static const struct acpi_device_id acpi_ac_match[] = {
-        { "ACPI0003", 0 },
-        { }
-};
-MODULE_DEVICE_TABLE(acpi, acpi_ac_match);
-static struct platform_driver acpi_ac_driver = {
-        .probe          = acpi_ac_probe,
-        .remove         = acpi_ac_remove,
-        .driver         = {
-                .name   = "acpi-ac",
-                .owner  = THIS_MODULE,
-                .pm     = &acpi_ac_pm_ops,
-                .acpi_match_table = ACPI_PTR(acpi_ac_match),
-        },
-};
 static int __init acpi_ac_init(void)
 {
        int result;
@@ -316,7 +315,7 @@ static int __init acpi_ac_init(void)
        if (acpi_disabled)
                return -ENODEV;
-        result = platform_driver_register(&acpi_ac_driver);
+        result = acpi_bus_register_driver(&acpi_ac_driver);
        if (result < 0)
                return -ENODEV;
@@ -325,7 +324,7 @@ static int __init acpi_ac_init(void)
 static void __exit acpi_ac_exit(void)
 {
-        platform_driver_unregister(&acpi_ac_driver);
+        acpi_bus_unregister_driver(&acpi_ac_driver);
 }
 module_init(acpi_ac_init);
 module_exit(acpi_ac_exit);
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index dbfe49e5fd63..1d4950388fa1 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -29,7 +29,6 @@ ACPI_MODULE_NAME("platform");
 static const struct acpi_device_id acpi_platform_device_ids[] = {
        { "PNP0D40" },
-        { "ACPI0003" },
        { "VPC2004" },
        { "BCM4752" },
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index c29c2c3ec0ad..52c81c49cc7d 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -170,6 +170,9 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
        acpi_status status;
        int ret;
+        if (pr->apic_id == -1)
+                return -ENODEV;
        status = acpi_evaluate_integer(pr->handle, "_STA", NULL, &sta);
        if (ACPI_FAILURE(status) || !(sta & ACPI_STA_DEVICE_PRESENT))
                return -ENODEV;
@@ -260,10 +263,8 @@ static int acpi_processor_get_info(struct acpi_device *device)
        }
        apic_id = acpi_get_apicid(pr->handle, device_declaration, pr->acpi_id);
-        if (apic_id < 0) {
+        if (apic_id < 0)
                acpi_handle_debug(pr->handle, "failed to get CPU APIC ID.\n");
-                return -ENODEV;
-        }
        pr->apic_id = apic_id;
        cpu_index = acpi_map_cpuid(pr->apic_id, pr->acpi_id);
@@ -404,7 +405,6 @@ static int acpi_processor_add(struct acpi_device *device,
                goto err;
        pr->dev = dev;
-        dev->offline = pr->flags.need_hotplug_init;
        /* Trigger the processor driver's .probe() if present. */
        if (device_attach(dev) >= 0)
diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
index 49bbc71fad54..a08a448068dd 100644
--- a/drivers/acpi/acpica/acglobal.h
+++ b/drivers/acpi/acpica/acglobal.h
@@ -141,9 +141,9 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE);
 * address. Although ACPICA adheres to the ACPI specification which
 * requires the use of the corresponding 64-bit address if it is non-zero,
 * some machines have been found to have a corrupted non-zero 64-bit
- * address. Default is FALSE, do not favor the 32-bit addresses.
+ * address. Default is TRUE, favor the 32-bit addresses.
 */
-ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, FALSE);
+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
 /*
 * Optionally truncate I/O addresses to 16 bits. Provides compatibility
diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c
index 68d97441432c..12878e1982f7 100644
--- a/drivers/acpi/acpica/exfield.c
+++ b/drivers/acpi/acpica/exfield.c
@@ -45,10 +45,71 @@
 #include "accommon.h"
 #include "acdispat.h"
 #include "acinterp.h"
+#include "amlcode.h"
 #define _COMPONENT          ACPI_EXECUTER
 ACPI_MODULE_NAME("exfield")
+/* Local prototypes */
+static u32
+acpi_ex_get_serial_access_length(u32 accessor_type, u32 access_length);
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_get_serial_access_bytes
+ *
+ * PARAMETERS:  accessor_type   - The type of the protocol indicated by region
+ *                                field access attributes
+ *              access_length   - The access length of the region field
+ *
+ * RETURN:      Decoded access length
+ *
+ * DESCRIPTION: This routine returns the length of the generic_serial_bus
+ *              protocol bytes
+ *
+ ******************************************************************************/
+static u32
+acpi_ex_get_serial_access_length(u32 accessor_type, u32 access_length)
+{
+        u32 length;
+        switch (accessor_type) {
+        case AML_FIELD_ATTRIB_QUICK:
+                length = 0;
+                break;
+        case AML_FIELD_ATTRIB_SEND_RCV:
+        case AML_FIELD_ATTRIB_BYTE:
+                length = 1;
+                break;
+        case AML_FIELD_ATTRIB_WORD:
+        case AML_FIELD_ATTRIB_WORD_CALL:
+                length = 2;
+                break;
+        case AML_FIELD_ATTRIB_MULTIBYTE:
+        case AML_FIELD_ATTRIB_RAW_BYTES:
+        case AML_FIELD_ATTRIB_RAW_PROCESS:
+                length = access_length;
+                break;
+        case AML_FIELD_ATTRIB_BLOCK:
+        case AML_FIELD_ATTRIB_BLOCK_CALL:
+        default:
+                length = ACPI_GSBUS_BUFFER_SIZE;
+                break;
+        }
+        return (length);
+}
 /*******************************************************************************
 *
 * FUNCTION:    acpi_ex_read_data_from_field
@@ -63,8 +124,9 @@ ACPI_MODULE_NAME("exfield")
 *              Buffer, depending on the size of the field.
 *
 ******************************************************************************/
 acpi_status
-acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
+acpi_ex_read_data_from_field(struct acpi_walk_state * walk_state,
                             union acpi_operand_object *obj_desc,
                             union acpi_operand_object **ret_buffer_desc)
 {
@@ -73,6 +135,7 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
        acpi_size length;
        void *buffer;
        u32 function;
+        u16 accessor_type;
        ACPI_FUNCTION_TRACE_PTR(ex_read_data_from_field, obj_desc);
@@ -116,9 +179,22 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
                            ACPI_READ | (obj_desc->field.attribute << 16);
                } else if (obj_desc->field.region_obj->region.space_id ==
                           ACPI_ADR_SPACE_GSBUS) {
-                        length = ACPI_GSBUS_BUFFER_SIZE;
+                        accessor_type = obj_desc->field.attribute;
-                        function =
+                        length = acpi_ex_get_serial_access_length(accessor_type,
-                            ACPI_READ | (obj_desc->field.attribute << 16);
+                                                                  obj_desc->
+                                                                  field.
+                                                                  access_length);
+                        /*
+                         * Add additional 2 bytes for modeled generic_serial_bus data buffer:
+                         * typedef struct {
+                         *     BYTEStatus; // Byte 0 of the data buffer
+                         *     BYTELength; // Byte 1 of the data buffer
+                         *     BYTE[x-1]Data; // Bytes 2-x of the arbitrary length data buffer,
+                         * }
+                         */
+                        length += 2;
+                        function = ACPI_READ | (accessor_type << 16);
                } else {        /* IPMI */
                        length = ACPI_IPMI_BUFFER_SIZE;
@@ -231,6 +307,7 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc,
        void *buffer;
        union acpi_operand_object *buffer_desc;
        u32 function;
+        u16 accessor_type;
        ACPI_FUNCTION_TRACE_PTR(ex_write_data_to_field, obj_desc);
@@ -284,9 +361,22 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc,
                            ACPI_WRITE | (obj_desc->field.attribute << 16);
                } else if (obj_desc->field.region_obj->region.space_id ==
                           ACPI_ADR_SPACE_GSBUS) {
-                        length = ACPI_GSBUS_BUFFER_SIZE;
+                        accessor_type = obj_desc->field.attribute;
-                        function =
+                        length = acpi_ex_get_serial_access_length(accessor_type,
-                            ACPI_WRITE | (obj_desc->field.attribute << 16);
+                                                                  obj_desc->
+                                                                  field.
+                                                                  access_length);
+                        /*
+                         * Add additional 2 bytes for modeled generic_serial_bus data buffer:
+                         * typedef struct {
+                         *     BYTEStatus; // Byte 0 of the data buffer
+                         *     BYTELength; // Byte 1 of the data buffer
+                         *     BYTE[x-1]Data; // Bytes 2-x of the arbitrary length data buffer,
+                         * }
+                         */
+                        length += 2;
+                        function = ACPI_WRITE | (accessor_type << 16);
                } else {        /* IPMI */
                        length = ACPI_IPMI_BUFFER_SIZE;
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index a4702eee91a8..9fb85f38de90 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -461,6 +461,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
        u32 table_count;
        struct acpi_table_header *table;
        acpi_physical_address address;
+        acpi_physical_address rsdt_address;
        u32 length;
        u8 *table_entry;
        acpi_status status;
@@ -488,11 +489,14 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
                 * as per the ACPI specification.
                 */
                address = (acpi_physical_address) rsdp->xsdt_physical_address;
+                rsdt_address =
+                    (acpi_physical_address) rsdp->rsdt_physical_address;
                table_entry_size = ACPI_XSDT_ENTRY_SIZE;
        } else {
                /* Root table is an RSDT (32-bit physical addresses) */
                address = (acpi_physical_address) rsdp->rsdt_physical_address;
+                rsdt_address = address;
                table_entry_size = ACPI_RSDT_ENTRY_SIZE;
        }
@@ -515,8 +519,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
                        /* Fall back to the RSDT */
-                        address =
+                        address = rsdt_address;
-                            (acpi_physical_address) rsdp->rsdt_physical_address;
                        table_entry_size = ACPI_RSDT_ENTRY_SIZE;
                }
        }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 9a2c63b20050..6e7b2a12860d 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -36,6 +36,12 @@
 #include <linux/suspend.h>
 #include <asm/unaligned.h>
+#ifdef CONFIG_ACPI_PROCFS_POWER
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <asm/uaccess.h>
+#endif
 #include <linux/acpi.h>
 #include <linux/power_supply.h>
@@ -64,6 +70,19 @@ static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
+#ifdef CONFIG_ACPI_PROCFS_POWER
+extern struct proc_dir_entry *acpi_lock_battery_dir(void);
+extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
+enum acpi_battery_files {
+        info_tag = 0,
+        state_tag,
+        alarm_tag,
+        ACPI_BATTERY_NUMFILES,
+};
+#endif
 static const struct acpi_device_id battery_device_ids[] = {
        {"PNP0C0A", 0},
        {"", 0},
@@ -299,6 +318,14 @@ static enum power_supply_property energy_battery_props[] = {
        POWER_SUPPLY_PROP_SERIAL_NUMBER,
 };
+#ifdef CONFIG_ACPI_PROCFS_POWER
+inline char *acpi_battery_units(struct acpi_battery *battery)
+{
+        return (battery->power_unit == ACPI_BATTERY_POWER_UNIT_MA) ?
+                "mA" : "mW";
+}
+#endif
 /* --------------------------------------------------------------------------
                               Battery Management
   -------------------------------------------------------------------------- */
@@ -717,6 +744,279 @@ static void acpi_battery_refresh(struct acpi_battery *battery)
 }
 /* --------------------------------------------------------------------------
+                              FS Interface (/proc)
+   -------------------------------------------------------------------------- */
+#ifdef CONFIG_ACPI_PROCFS_POWER
+static struct proc_dir_entry *acpi_battery_dir;
+static int acpi_battery_print_info(struct seq_file *seq, int result)
+{
+        struct acpi_battery *battery = seq->private;
+        if (result)
+                goto end;
+        seq_printf(seq, "present:                 %s\n",
+                   acpi_battery_present(battery) ? "yes" : "no");
+        if (!acpi_battery_present(battery))
+                goto end;
+        if (battery->design_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "design capacity:         unknown\n");
+        else
+                seq_printf(seq, "design capacity:         %d %sh\n",
+                           battery->design_capacity,
+                           acpi_battery_units(battery));
+        if (battery->full_charge_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "last full capacity:      unknown\n");
+        else
+                seq_printf(seq, "last full capacity:      %d %sh\n",
+                           battery->full_charge_capacity,
+                           acpi_battery_units(battery));
+        seq_printf(seq, "battery technology:      %srechargeable\n",
+                   (!battery->technology)?"non-":"");
+        if (battery->design_voltage == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "design voltage:          unknown\n");
+        else
+                seq_printf(seq, "design voltage:          %d mV\n",
+                           battery->design_voltage);
+        seq_printf(seq, "design capacity warning: %d %sh\n",
+                   battery->design_capacity_warning,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "design capacity low:     %d %sh\n",
+                   battery->design_capacity_low,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "cycle count:             %i\n", battery->cycle_count);
+        seq_printf(seq, "capacity granularity 1:  %d %sh\n",
+                   battery->capacity_granularity_1,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "capacity granularity 2:  %d %sh\n",
+                   battery->capacity_granularity_2,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "model number:            %s\n", battery->model_number);
+        seq_printf(seq, "serial number:           %s\n", battery->serial_number);
+        seq_printf(seq, "battery type:            %s\n", battery->type);
+        seq_printf(seq, "OEM info:                %s\n", battery->oem_info);
+      end:
+        if (result)
+                seq_printf(seq, "ERROR: Unable to read battery info\n");
+        return result;
+}
+static int acpi_battery_print_state(struct seq_file *seq, int result)
+{
+        struct acpi_battery *battery = seq->private;
+        if (result)
+                goto end;
+        seq_printf(seq, "present:                 %s\n",
+                   acpi_battery_present(battery) ? "yes" : "no");
+        if (!acpi_battery_present(battery))
+                goto end;
+        seq_printf(seq, "capacity state:          %s\n",
+                        (battery->state & 0x04) ? "critical" : "ok");
+        if ((battery->state & 0x01) && (battery->state & 0x02))
+                seq_printf(seq,
+                           "charging state:          charging/discharging\n");
+        else if (battery->state & 0x01)
+                seq_printf(seq, "charging state:          discharging\n");
+        else if (battery->state & 0x02)
+                seq_printf(seq, "charging state:          charging\n");
+        else
+                seq_printf(seq, "charging state:          charged\n");
+        if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "present rate:            unknown\n");
+        else
+                seq_printf(seq, "present rate:            %d %s\n",
+                           battery->rate_now, acpi_battery_units(battery));
+        if (battery->capacity_now == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "remaining capacity:      unknown\n");
+        else
+                seq_printf(seq, "remaining capacity:      %d %sh\n",
+                           battery->capacity_now, acpi_battery_units(battery));
+        if (battery->voltage_now == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "present voltage:         unknown\n");
+        else
+                seq_printf(seq, "present voltage:         %d mV\n",
+                           battery->voltage_now);
+      end:
+        if (result)
+                seq_printf(seq, "ERROR: Unable to read battery state\n");
+        return result;
+}
+static int acpi_battery_print_alarm(struct seq_file *seq, int result)
+{
+        struct acpi_battery *battery = seq->private;
+        if (result)
+                goto end;
+        if (!acpi_battery_present(battery)) {
+                seq_printf(seq, "present:                 no\n");
+                goto end;
+        }
+        seq_printf(seq, "alarm:                   ");
+        if (!battery->alarm)
+                seq_printf(seq, "unsupported\n");
+        else
+                seq_printf(seq, "%u %sh\n", battery->alarm,
+                                acpi_battery_units(battery));
+      end:
+        if (result)
+                seq_printf(seq, "ERROR: Unable to read battery alarm\n");
+        return result;
+}
+static ssize_t acpi_battery_write_alarm(struct file *file,
+                                        const char __user * buffer,
+                                        size_t count, loff_t * ppos)
+{
+        int result = 0;
+        char alarm_string[12] = { '\0' };
+        struct seq_file *m = file->private_data;
+        struct acpi_battery *battery = m->private;
+        if (!battery || (count > sizeof(alarm_string) - 1))
+                return -EINVAL;
+        if (!acpi_battery_present(battery)) {
+                result = -ENODEV;
+                goto end;
+        }
+        if (copy_from_user(alarm_string, buffer, count)) {
+                result = -EFAULT;
+                goto end;
+        }
+        alarm_string[count] = '\0';
+        battery->alarm = simple_strtol(alarm_string, NULL, 0);
+        result = acpi_battery_set_alarm(battery);
+      end:
+        if (!result)
+                return count;
+        return result;
+}
+typedef int(*print_func)(struct seq_file *seq, int result);
+static print_func acpi_print_funcs[ACPI_BATTERY_NUMFILES] = {
+        acpi_battery_print_info,
+        acpi_battery_print_state,
+        acpi_battery_print_alarm,
+};
+static int acpi_battery_read(int fid, struct seq_file *seq)
+{
+        struct acpi_battery *battery = seq->private;
+        int result = acpi_battery_update(battery);
+        return acpi_print_funcs[fid](seq, result);
+}
+#define DECLARE_FILE_FUNCTIONS(_name) \
+static int acpi_battery_read_##_name(struct seq_file *seq, void *offset) \
+{ \
+        return acpi_battery_read(_name##_tag, seq); \
+} \
+static int acpi_battery_##_name##_open_fs(struct inode *inode, struct file *file) \
+{ \
+        return single_open(file, acpi_battery_read_##_name, PDE_DATA(inode)); \
+}
+DECLARE_FILE_FUNCTIONS(info);
+DECLARE_FILE_FUNCTIONS(state);
+DECLARE_FILE_FUNCTIONS(alarm);
+#undef DECLARE_FILE_FUNCTIONS
+#define FILE_DESCRIPTION_RO(_name) \
+        { \
+        .name = __stringify(_name), \
+        .mode = S_IRUGO, \
+        .ops = { \
+                .open = acpi_battery_##_name##_open_fs, \
+                .read = seq_read, \
+                .llseek = seq_lseek, \
+                .release = single_release, \
+                .owner = THIS_MODULE, \
+                }, \
+        }
+#define FILE_DESCRIPTION_RW(_name) \
+        { \
+        .name = __stringify(_name), \
+        .mode = S_IFREG | S_IRUGO | S_IWUSR, \
+        .ops = { \
+                .open = acpi_battery_##_name##_open_fs, \
+                .read = seq_read, \
+                .llseek = seq_lseek, \
+                .write = acpi_battery_write_##_name, \
+                .release = single_release, \
+                .owner = THIS_MODULE, \
+                }, \
+        }
+static const struct battery_file {
+        struct file_operations ops;
+        umode_t mode;
+        const char *name;
+} acpi_battery_file[] = {
+        FILE_DESCRIPTION_RO(info),
+        FILE_DESCRIPTION_RO(state),
+        FILE_DESCRIPTION_RW(alarm),
+};
+#undef FILE_DESCRIPTION_RO
+#undef FILE_DESCRIPTION_RW
+static int acpi_battery_add_fs(struct acpi_device *device)
+{
+        struct proc_dir_entry *entry = NULL;
+        int i;
+        printk(KERN_WARNING PREFIX "Deprecated procfs I/F for battery is loaded,"
+                        " please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
+        if (!acpi_device_dir(device)) {
+                acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device),
+                                                     acpi_battery_dir);
+                if (!acpi_device_dir(device))
+                        return -ENODEV;
+        }
+        for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i) {
+                entry = proc_create_data(acpi_battery_file[i].name,
+                                         acpi_battery_file[i].mode,
+                                         acpi_device_dir(device),
+                                         &acpi_battery_file[i].ops,
+                                         acpi_driver_data(device));
+                if (!entry)
+                        return -ENODEV;
+        }
+        return 0;
+}
+static void acpi_battery_remove_fs(struct acpi_device *device)
+{
+        int i;
+        if (!acpi_device_dir(device))
+                return;
+        for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i)
+                remove_proc_entry(acpi_battery_file[i].name,
+                                  acpi_device_dir(device));
+        remove_proc_entry(acpi_device_bid(device), acpi_battery_dir);
+        acpi_device_dir(device) = NULL;
+}
+#endif
+/* --------------------------------------------------------------------------
                                 Driver Interface
   -------------------------------------------------------------------------- */
@@ -790,6 +1090,15 @@ static int acpi_battery_add(struct acpi_device *device)
        result = acpi_battery_update(battery);
        if (result)
                goto fail;
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        result = acpi_battery_add_fs(device);
+#endif
+        if (result) {
+#ifdef CONFIG_ACPI_PROCFS_POWER
+                acpi_battery_remove_fs(device);
+#endif
+                goto fail;
+        }
        printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
                ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
@@ -816,6 +1125,9 @@ static int acpi_battery_remove(struct acpi_device *device)
                return -EINVAL;
        battery = acpi_driver_data(device);
        unregister_pm_notifier(&battery->pm_nb);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_battery_remove_fs(device);
+#endif
        sysfs_remove_battery(battery);
        mutex_destroy(&battery->lock);
        mutex_destroy(&battery->sysfs_lock);
@@ -866,7 +1178,19 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
        if (dmi_check_system(bat_dmi_table))
                battery_bix_broken_package = 1;
-        acpi_bus_register_driver(&acpi_battery_driver);
+        
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_battery_dir = acpi_lock_battery_dir();
+        if (!acpi_battery_dir)
+                return;
+#endif
+        if (acpi_bus_register_driver(&acpi_battery_driver) < 0) {
+#ifdef CONFIG_ACPI_PROCFS_POWER
+                acpi_unlock_battery_dir(acpi_battery_dir);
+#endif
+                return;
+        }
+        return;
 }
 static int __init acpi_battery_init(void)
@@ -878,6 +1202,9 @@ static int __init acpi_battery_init(void)
 static void __exit acpi_battery_exit(void)
 {
        acpi_bus_unregister_driver(&acpi_battery_driver);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_unlock_battery_dir(acpi_battery_dir);
+#endif
 }
 module_init(acpi_battery_init);
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index afec4526c48a..3d8413d02a97 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -314,6 +314,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
                },
        },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "Dell Inspiron 7737",
+        .matches = {
+                    DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                    DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7737"),
+                },
+        },
        /*
         * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
@@ -374,6 +382,19 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
                },
        },
+        /*
+         * Without this this EEEpc exports a non working WMI interface, with
+         * this it exports a working "good old" eeepc_laptop interface, fixing
+         * both brightness control, and rfkill not working.
+         */
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Asus EEE PC 1015PX",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"),
+                },
+        },
        {}
 };
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index e7e5844c87d0..cf925c4f36b7 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -380,9 +380,8 @@ static void acpi_bus_notify(acpi_handle handle, u32 type, void *data)
                break;
        default:
-                acpi_handle_warn(handle, "Unsupported event type 0x%x\n", type);
+                acpi_handle_debug(handle, "Unknown event type 0x%x\n", type);
-                ost_code = ACPI_OST_SC_UNRECOGNIZED_NOTIFY;
+                break;
-                goto err;
        }
        adev = acpi_bus_get_acpi_device(handle);
diff --git a/drivers/acpi/cm_sbs.c b/drivers/acpi/cm_sbs.c
new file mode 100644
index 000000000000..6c9ee68e46fb
--- /dev/null
+++ b/drivers/acpi/cm_sbs.c
@@ -0,0 +1,105 @@
+/*
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or (at
+ *  your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/acpi.h>
+#include <linux/types.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <acpi/acpi_bus.h>
+#include <acpi/acpi_drivers.h>
+#define PREFIX "ACPI: "
+ACPI_MODULE_NAME("cm_sbs");
+#define ACPI_AC_CLASS           "ac_adapter"
+#define ACPI_BATTERY_CLASS      "battery"
+#define _COMPONENT              ACPI_SBS_COMPONENT
+static struct proc_dir_entry *acpi_ac_dir;
+static struct proc_dir_entry *acpi_battery_dir;
+static DEFINE_MUTEX(cm_sbs_mutex);
+static int lock_ac_dir_cnt;
+static int lock_battery_dir_cnt;
+struct proc_dir_entry *acpi_lock_ac_dir(void)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (!acpi_ac_dir)
+                acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir);
+        if (acpi_ac_dir) {
+                lock_ac_dir_cnt++;
+        } else {
+                printk(KERN_ERR PREFIX
+                                  "Cannot create %s\n", ACPI_AC_CLASS);
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return acpi_ac_dir;
+}
+EXPORT_SYMBOL(acpi_lock_ac_dir);
+void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir_param)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (acpi_ac_dir_param)
+                lock_ac_dir_cnt--;
+        if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) {
+                remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
+                acpi_ac_dir = NULL;
+        }
+        mutex_unlock(&cm_sbs_mutex);
+}
+EXPORT_SYMBOL(acpi_unlock_ac_dir);
+struct proc_dir_entry *acpi_lock_battery_dir(void)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (!acpi_battery_dir) {
+                acpi_battery_dir =
+                    proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir);
+        }
+        if (acpi_battery_dir) {
+                lock_battery_dir_cnt++;
+        } else {
+                printk(KERN_ERR PREFIX
+                                  "Cannot create %s\n", ACPI_BATTERY_CLASS);
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return acpi_battery_dir;
+}
+EXPORT_SYMBOL(acpi_lock_battery_dir);
+void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir_param)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (acpi_battery_dir_param)
+                lock_battery_dir_cnt--;
+        if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param
+            && acpi_battery_dir) {
+                remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
+                acpi_battery_dir = NULL;
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return;
+}
+EXPORT_SYMBOL(acpi_unlock_battery_dir);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index d7d32c28829b..ad11ba4a412d 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -206,13 +206,13 @@ unlock:
        spin_unlock_irqrestore(&ec->lock, flags);
 }
-static int acpi_ec_sync_query(struct acpi_ec *ec);
+static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data);
 static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
 {
        if (state & ACPI_EC_FLAG_SCI) {
                if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
-                        return acpi_ec_sync_query(ec);
+                        return acpi_ec_sync_query(ec, NULL);
        }
        return 0;
 }
@@ -443,10 +443,8 @@ acpi_handle ec_get_handle(void)
 EXPORT_SYMBOL(ec_get_handle);
-static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
 /*
- * Clears stale _Q events that might have accumulated in the EC.
+ * Process _Q events that might have accumulated in the EC.
 * Run with locked ec mutex.
 */
 static void acpi_ec_clear(struct acpi_ec *ec)
@@ -455,7 +453,7 @@ static void acpi_ec_clear(struct acpi_ec *ec)
        u8 value = 0;
        for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
-                status = acpi_ec_query_unlocked(ec, &value);
+                status = acpi_ec_sync_query(ec, &value);
                if (status || !value)
                        break;
        }
@@ -582,13 +580,18 @@ static void acpi_ec_run(void *cxt)
        kfree(handler);
 }
-static int acpi_ec_sync_query(struct acpi_ec *ec)
+static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data)
 {
        u8 value = 0;
        int status;
        struct acpi_ec_query_handler *handler, *copy;
-        if ((status = acpi_ec_query_unlocked(ec, &value)))
+        status = acpi_ec_query_unlocked(ec, &value);
+        if (data)
+                *data = value;
+        if (status)
                return status;
        list_for_each_entry(handler, &ec->list, node) {
                if (value == handler->query_bit) {
                        /* have custom handler for this bit */
@@ -612,7 +615,7 @@ static void acpi_ec_gpe_query(void *ec_cxt)
        if (!ec)
                return;
        mutex_lock(&ec->mutex);
-        acpi_ec_sync_query(ec);
+        acpi_ec_sync_query(ec, NULL);
        mutex_unlock(&ec->mutex);
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 8b6990e417ec..f8bc5a755dda 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -457,10 +457,10 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
        },
        {
         .callback = video_set_use_native_backlight,
-         .ident = "ThinkPad T430s",
+         .ident = "ThinkPad T430 and T430s",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430"),
                },
        },
        {
@@ -472,7 +472,7 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                },
        },
        {
-        .callback = video_set_use_native_backlight,
+         .callback = video_set_use_native_backlight,
        .ident = "ThinkPad X1 Carbon",
        .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -500,7 +500,7 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
         .ident = "Dell Inspiron 7520",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "Inspiron 7520"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7520"),
                },
        },
        {
@@ -513,6 +513,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
        },
        {
         .callback = video_set_use_native_backlight,
+         .ident = "Acer Aspire 5742G",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5742G"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
         .ident = "Acer Aspire V5-431",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 20e03a7eb8b4..0033fafc470b 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -116,7 +116,7 @@ config AHCI_ST
 config AHCI_IMX
        tristate "Freescale i.MX AHCI SATA support"
-        depends on MFD_SYSCON
+        depends on MFD_SYSCON && (ARCH_MXC || COMPILE_TEST)
        help
          This option enables support for the Freescale i.MX SoC's
          onboard AHCI SATA.
@@ -134,8 +134,7 @@ config AHCI_SUNXI
 config AHCI_XGENE
        tristate "APM X-Gene 6.0Gbps AHCI SATA host controller support"
-        depends on ARM64 || COMPILE_TEST
+        depends on PHY_XGENE
-        select PHY_XGENE
        help
         This option enables support for APM X-Gene SoC SATA host controller.
@@ -816,7 +815,7 @@ config PATA_AT32
 config PATA_AT91
        tristate "PATA support for AT91SAM9260"
-        depends on ARM && ARCH_AT91
+        depends on ARM && SOC_AT91SAM9
        help
          This option enables support for IDE devices on the Atmel AT91SAM9260 SoC.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 5a0bf8ed649b..60707814a84b 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1115,6 +1115,17 @@ static bool ahci_broken_online(struct pci_dev *pdev)
        return pdev->bus->number == (val >> 8) && pdev->devfn == (val & 0xff);
 }
+static bool ahci_broken_devslp(struct pci_dev *pdev)
+{
+        /* device with broken DEVSLP but still showing SDS capability */
+        static const struct pci_device_id ids[] = {
+                { PCI_VDEVICE(INTEL, 0x0f23)}, /* Valleyview SoC */
+                {}
+        };
+        return pci_match_id(ids, pdev);
+}
 #ifdef CONFIG_ATA_ACPI
 static void ahci_gtf_filter_workaround(struct ata_host *host)
 {
@@ -1164,9 +1175,9 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 #endif
 static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
-                         struct ahci_host_priv *hpriv)
+                                struct ahci_host_priv *hpriv)
 {
-        int nvec;
+        int rc, nvec;
        if (hpriv->flags & AHCI_HFLAG_NO_MSI)
                goto intx;
@@ -1183,12 +1194,19 @@ static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
        if (nvec < n_ports)
                goto single_msi;
-        nvec = pci_enable_msi_range(pdev, nvec, nvec);
+        rc = pci_enable_msi_exact(pdev, nvec);
-        if (nvec == -ENOSPC)
+        if (rc == -ENOSPC)
                goto single_msi;
-        else if (nvec < 0)
+        else if (rc < 0)
                goto intx;
+        /* fallback to single MSI mode if the controller enforced MRSM mode */
+        if (readl(hpriv->mmio + HOST_CTL) & HOST_MRSM) {
+                pci_disable_msi(pdev);
+                printk(KERN_INFO "ahci: MRSM is on, fallback to single MSI\n");
+                goto single_msi;
+        }
        return nvec;
 single_msi:
@@ -1232,18 +1250,18 @@ int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis)
                return rc;
        for (i = 0; i < host->n_ports; i++) {
-                const char* desc;
                struct ahci_port_priv *pp = host->ports[i]->private_data;
-                /* pp is NULL for dummy ports */
+                /* Do not receive interrupts sent by dummy ports */
-                if (pp)
+                if (!pp) {
-                        desc = pp->irq_desc;
+                        disable_irq(irq + i);
-                else
+                        continue;
-                        desc = dev_driver_string(host->dev);
+                }
-                rc = devm_request_threaded_irq(host->dev,
+                rc = devm_request_threaded_irq(host->dev, irq + i,
-                        irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED,
+                                               ahci_hw_interrupt,
-                        desc, host->ports[i]);
+                                               ahci_thread_fn, IRQF_SHARED,
+                                               pp->irq_desc, host->ports[i]);
                if (rc)
                        goto out_free_irqs;
        }
@@ -1357,6 +1375,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        hpriv->mmio = pcim_iomap_table(pdev)[ahci_pci_bar];
+        /* must set flag prior to save config in order to take effect */
+        if (ahci_broken_devslp(pdev))
+                hpriv->flags |= AHCI_HFLAG_NO_DEVSLP;
        /* save initial config */
        ahci_pci_save_initial_config(pdev, hpriv);
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 51af275b3388..af63c75c2001 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -94,6 +94,7 @@ enum {
        /* HOST_CTL bits */
        HOST_RESET              = (1 << 0),  /* reset controller; self-clear */
        HOST_IRQ_EN             = (1 << 1),  /* global IRQ enable */
+        HOST_MRSM               = (1 << 2),  /* MSI Revert to Single Message */
        HOST_AHCI_EN            = (1 << 31), /* AHCI enabled */
        /* HOST_CAP bits */
@@ -235,6 +236,7 @@ enum {
                                                        port start (wait until
                                                        error-handling stage) */
        AHCI_HFLAG_MULTI_MSI            = (1 << 16), /* multiple PCI MSIs */
+        AHCI_HFLAG_NO_DEVSLP            = (1 << 17), /* no device sleep */
        /* ap->flags bits */
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
index 497c7abe1c7d..8befeb69eeb1 100644
--- a/drivers/ata/ahci_imx.c
+++ b/drivers/ata/ahci_imx.c
@@ -29,9 +29,25 @@
 #include "ahci.h"
 enum {
-        PORT_PHY_CTL = 0x178,                   /* Port0 PHY Control */
+        /* Timer 1-ms Register */
-        PORT_PHY_CTL_PDDQ_LOC = 0x100000,       /* PORT_PHY_CTL bits */
+        IMX_TIMER1MS                            = 0x00e0,
-        HOST_TIMER1MS = 0xe0,                   /* Timer 1-ms */
+        /* Port0 PHY Control Register */
+        IMX_P0PHYCR                             = 0x0178,
+        IMX_P0PHYCR_TEST_PDDQ                   = 1 << 20,
+        IMX_P0PHYCR_CR_READ                     = 1 << 19,
+        IMX_P0PHYCR_CR_WRITE                    = 1 << 18,
+        IMX_P0PHYCR_CR_CAP_DATA                 = 1 << 17,
+        IMX_P0PHYCR_CR_CAP_ADDR                 = 1 << 16,
+        /* Port0 PHY Status Register */
+        IMX_P0PHYSR                             = 0x017c,
+        IMX_P0PHYSR_CR_ACK                      = 1 << 18,
+        IMX_P0PHYSR_CR_DATA_OUT                 = 0xffff << 0,
+        /* Lane0 Output Status Register */
+        IMX_LANE0_OUT_STAT                      = 0x2003,
+        IMX_LANE0_OUT_STAT_RX_PLL_STATE         = 1 << 1,
+        /* Clock Reset Register */
+        IMX_CLOCK_RESET                         = 0x7f3f,
+        IMX_CLOCK_RESET_RESET                   = 1 << 0,
 };
 enum ahci_imx_type {
@@ -54,9 +70,149 @@ MODULE_PARM_DESC(hotplug, "AHCI IMX hot-plug support (0=Don't support, 1=support
 static void ahci_imx_host_stop(struct ata_host *host);
+static int imx_phy_crbit_assert(void __iomem *mmio, u32 bit, bool assert)
+{
+        int timeout = 10;
+        u32 crval;
+        u32 srval;
+        /* Assert or deassert the bit */
+        crval = readl(mmio + IMX_P0PHYCR);
+        if (assert)
+                crval |= bit;
+        else
+                crval &= ~bit;
+        writel(crval, mmio + IMX_P0PHYCR);
+        /* Wait for the cr_ack signal */
+        do {
+                srval = readl(mmio + IMX_P0PHYSR);
+                if ((assert ? srval : ~srval) & IMX_P0PHYSR_CR_ACK)
+                        break;
+                usleep_range(100, 200);
+        } while (--timeout);
+        return timeout ? 0 : -ETIMEDOUT;
+}
+static int imx_phy_reg_addressing(u16 addr, void __iomem *mmio)
+{
+        u32 crval = addr;
+        int ret;
+        /* Supply the address on cr_data_in */
+        writel(crval, mmio + IMX_P0PHYCR);
+        /* Assert the cr_cap_addr signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_ADDR, true);
+        if (ret)
+                return ret;
+        /* Deassert cr_cap_addr */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_ADDR, false);
+        if (ret)
+                return ret;
+        return 0;
+}
+static int imx_phy_reg_write(u16 val, void __iomem *mmio)
+{
+        u32 crval = val;
+        int ret;
+        /* Supply the data on cr_data_in */
+        writel(crval, mmio + IMX_P0PHYCR);
+        /* Assert the cr_cap_data signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_DATA, true);
+        if (ret)
+                return ret;
+        /* Deassert cr_cap_data */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_DATA, false);
+        if (ret)
+                return ret;
+        if (val & IMX_CLOCK_RESET_RESET) {
+                /*
+                 * In case we're resetting the phy, it's unable to acknowledge,
+                 * so we return immediately here.
+                 */
+                crval |= IMX_P0PHYCR_CR_WRITE;
+                writel(crval, mmio + IMX_P0PHYCR);
+                goto out;
+        }
+        /* Assert the cr_write signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_WRITE, true);
+        if (ret)
+                return ret;
+        /* Deassert cr_write */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_WRITE, false);
+        if (ret)
+                return ret;
+out:
+        return 0;
+}
+static int imx_phy_reg_read(u16 *val, void __iomem *mmio)
+{
+        int ret;
+        /* Assert the cr_read signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_READ, true);
+        if (ret)
+                return ret;
+        /* Capture the data from cr_data_out[] */
+        *val = readl(mmio + IMX_P0PHYSR) & IMX_P0PHYSR_CR_DATA_OUT;
+        /* Deassert cr_read */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_READ, false);
+        if (ret)
+                return ret;
+        return 0;
+}
+static int imx_sata_phy_reset(struct ahci_host_priv *hpriv)
+{
+        void __iomem *mmio = hpriv->mmio;
+        int timeout = 10;
+        u16 val;
+        int ret;
+        /* Reset SATA PHY by setting RESET bit of PHY register CLOCK_RESET */
+        ret = imx_phy_reg_addressing(IMX_CLOCK_RESET, mmio);
+        if (ret)
+                return ret;
+        ret = imx_phy_reg_write(IMX_CLOCK_RESET_RESET, mmio);
+        if (ret)
+                return ret;
+        /* Wait for PHY RX_PLL to be stable */
+        do {
+                usleep_range(100, 200);
+                ret = imx_phy_reg_addressing(IMX_LANE0_OUT_STAT, mmio);
+                if (ret)
+                        return ret;
+                ret = imx_phy_reg_read(&val, mmio);
+                if (ret)
+                        return ret;
+                if (val & IMX_LANE0_OUT_STAT_RX_PLL_STATE)
+                        break;
+        } while (--timeout);
+        return timeout ? 0 : -ETIMEDOUT;
+}
 static int imx_sata_enable(struct ahci_host_priv *hpriv)
 {
        struct imx_ahci_priv *imxpriv = hpriv->plat_data;
+        struct device *dev = &imxpriv->ahci_pdev->dev;
        int ret;
        if (imxpriv->no_device)
@@ -101,6 +257,14 @@ static int imx_sata_enable(struct ahci_host_priv *hpriv)
                regmap_update_bits(imxpriv->gpr, IOMUXC_GPR13,
                                   IMX6Q_GPR13_SATA_MPLL_CLK_EN,
                                   IMX6Q_GPR13_SATA_MPLL_CLK_EN);
+                usleep_range(100, 200);
+                ret = imx_sata_phy_reset(hpriv);
+                if (ret) {
+                        dev_err(dev, "failed to reset phy: %d\n", ret);
+                        goto disable_regulator;
+                }
        }
        usleep_range(1000, 2000);
@@ -156,8 +320,8 @@ static void ahci_imx_error_handler(struct ata_port *ap)
         * without full reset once the pddq mode is enabled making it
         * impossible to use as part of libata LPM.
         */
-        reg_val = readl(mmio + PORT_PHY_CTL);
+        reg_val = readl(mmio + IMX_P0PHYCR);
-        writel(reg_val | PORT_PHY_CTL_PDDQ_LOC, mmio + PORT_PHY_CTL);
+        writel(reg_val | IMX_P0PHYCR_TEST_PDDQ, mmio + IMX_P0PHYCR);
        imx_sata_disable(hpriv);
        imxpriv->no_device = true;
 }
@@ -217,6 +381,7 @@ static int imx_ahci_probe(struct platform_device *pdev)
        if (!imxpriv)
                return -ENOMEM;
+        imxpriv->ahci_pdev = pdev;
        imxpriv->no_device = false;
        imxpriv->first_time = true;
        imxpriv->type = (enum ahci_imx_type)of_id->data;
@@ -248,7 +413,7 @@ static int imx_ahci_probe(struct platform_device *pdev)
        /*
         * Configure the HWINIT bits of the HOST_CAP and HOST_PORTS_IMPL,
-         * and IP vendor specific register HOST_TIMER1MS.
+         * and IP vendor specific register IMX_TIMER1MS.
         * Configure CAP_SSS (support stagered spin up).
         * Implement the port0.
         * Get the ahb clock rate, and configure the TIMER1MS register.
@@ -265,7 +430,7 @@ static int imx_ahci_probe(struct platform_device *pdev)
        }
        reg_val = clk_get_rate(imxpriv->ahb_clk) / 1000;
-        writel(reg_val, hpriv->mmio + HOST_TIMER1MS);
+        writel(reg_val, hpriv->mmio + IMX_TIMER1MS);
        ret = ahci_platform_init_host(pdev, hpriv, &ahci_imx_port_info, 0, 0);
        if (ret)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 6bd4f660b4e1..b9861453fc81 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -452,6 +452,13 @@ void ahci_save_initial_config(struct device *dev,
                cap &= ~HOST_CAP_SNTF;
        }
+        if ((cap2 & HOST_CAP2_SDS) && (hpriv->flags & AHCI_HFLAG_NO_DEVSLP)) {
+                dev_info(dev,
+                         "controller can't do DEVSLP, turning off\n");
+                cap2 &= ~HOST_CAP2_SDS;
+                cap2 &= ~HOST_CAP2_SADM;
+        }
        if (!(cap & HOST_CAP_FBS) && (hpriv->flags & AHCI_HFLAG_YES_FBS)) {
                dev_info(dev, "controller can do FBS, turning on CAP_FBS\n");
                cap |= HOST_CAP_FBS;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index c19734d96d7e..ea83828bfea9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4224,8 +4224,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
        /* devices that don't properly handle queued TRIM commands */
-        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M500*",               "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M550*",               NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M550SSD*",      NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
        /*
         * Some WD SATA-I drives spin up and down erratically when the link
@@ -4792,21 +4794,26 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
 {
        struct ata_queued_cmd *qc = NULL;
-        unsigned int i;
+        unsigned int i, tag;
        /* no command while frozen */
        if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
                return NULL;
-        /* the last tag is reserved for internal command. */
+        for (i = 0; i < ATA_MAX_QUEUE; i++) {
-        for (i = 0; i < ATA_MAX_QUEUE - 1; i++)
+                tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
-                if (!test_and_set_bit(i, &ap->qc_allocated)) {
-                        qc = __ata_qc_from_tag(ap, i);
+                /* the last tag is reserved for internal command. */
+                if (tag == ATA_TAG_INTERNAL)
+                        continue;
+                if (!test_and_set_bit(tag, &ap->qc_allocated)) {
+                        qc = __ata_qc_from_tag(ap, tag);
+                        qc->tag = tag;
+                        ap->last_tag = tag;
                        break;
                }
+        }
-        if (qc)
-                qc->tag = i;
        return qc;
 }
@@ -6307,6 +6314,8 @@ int ata_host_activate(struct ata_host *host, int irq,
 static void ata_port_detach(struct ata_port *ap)
 {
        unsigned long flags;
+        struct ata_link *link;
+        struct ata_device *dev;
        if (!ap->ops->error_handler)
                goto skip_eh;
@@ -6326,6 +6335,13 @@ static void ata_port_detach(struct ata_port *ap)
        cancel_delayed_work_sync(&ap->hotplug_task);
 skip_eh:
+        /* clean up zpodd on port removal */
+        ata_for_each_link(link, ap, HOST_FIRST) {
+                ata_for_each_dev(dev, link, ALL) {
+                        if (zpodd_dev_enabled(dev))
+                                zpodd_exit(dev);
+                }
+        }
        if (ap->pmp_link) {
                int i;
                for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index 6fac524c2f50..4edb1a81f63f 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -898,9 +898,12 @@ static int arasan_cf_probe(struct platform_device *pdev)
        cf_card_detect(acdev, 0);
-        return ata_host_activate(host, acdev->irq, irq_handler, 0,
+        ret = ata_host_activate(host, acdev->irq, irq_handler, 0,
-                        &arasan_cf_sht);
+                                &arasan_cf_sht);
+        if (!ret)
+                return 0;
+        cf_exit(acdev);
 free_clk:
        clk_put(acdev->clk);
        return ret;
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index e9c87274a781..8a66f23af4c4 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -407,12 +407,13 @@ static int pata_at91_probe(struct platform_device *pdev)
        host->private_data = info;
-        return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
+        ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
-                        gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
+                                gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
-                        irq_flags, &pata_at91_sht);
+                                irq_flags, &pata_at91_sht);
+        if (ret)
+                goto err_put;
-        if (!ret)
+        return 0;
-                return 0;
 err_put:
        clk_put(info->mck);
diff --git a/drivers/ata/pata_samsung_cf.c b/drivers/ata/pata_samsung_cf.c
index a79566d05666..0610e78c8a2a 100644
--- a/drivers/ata/pata_samsung_cf.c
+++ b/drivers/ata/pata_samsung_cf.c
@@ -594,9 +594,13 @@ static int __init pata_s3c_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, host);
-        return ata_host_activate(host, info->irq,
+        ret = ata_host_activate(host, info->irq,
-                        info->irq ? pata_s3c_irq : NULL,
+                                info->irq ? pata_s3c_irq : NULL,
-                        0, &pata_s3c_sht);
+                                0, &pata_s3c_sht);
+        if (ret)
+                goto stop_clk;
+        return 0;
 stop_clk:
        clk_disable(info->clk);
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 8986b9f22781..62ec61e8f84a 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -52,6 +52,7 @@ static DEFINE_MUTEX(deferred_probe_mutex);
 static LIST_HEAD(deferred_probe_pending_list);
 static LIST_HEAD(deferred_probe_active_list);
 static struct workqueue_struct *deferred_wq;
+static atomic_t deferred_trigger_count = ATOMIC_INIT(0);
 /**
 * deferred_probe_work_func() - Retry probing devices in the active list.
@@ -135,6 +136,17 @@ static bool driver_deferred_probe_enable = false;
 * This functions moves all devices from the pending list to the active
 * list and schedules the deferred probe workqueue to process them.  It
 * should be called anytime a driver is successfully bound to a device.
+ *
+ * Note, there is a race condition in multi-threaded probe. In the case where
+ * more than one device is probing at the same time, it is possible for one
+ * probe to complete successfully while another is about to defer. If the second
+ * depends on the first, then it will get put on the pending list after the
+ * trigger event has already occured and will be stuck there.
+ *
+ * The atomic 'deferred_trigger_count' is used to determine if a successful
+ * trigger has occurred in the midst of probing a driver. If the trigger count
+ * changes in the midst of a probe, then deferred processing should be triggered
+ * again.
 */
 static void driver_deferred_probe_trigger(void)
 {
@@ -147,6 +159,7 @@ static void driver_deferred_probe_trigger(void)
         * into the active list so they can be retried by the workqueue
         */
        mutex_lock(&deferred_probe_mutex);
+        atomic_inc(&deferred_trigger_count);
        list_splice_tail_init(&deferred_probe_pending_list,
                              &deferred_probe_active_list);
        mutex_unlock(&deferred_probe_mutex);
@@ -265,6 +278,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_waitqueue);
 static int really_probe(struct device *dev, struct device_driver *drv)
 {
        int ret = 0;
+        int local_trigger_count = atomic_read(&deferred_trigger_count);
        atomic_inc(&probe_count);
        pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
@@ -310,6 +324,9 @@ probe_failed:
                /* Driver requested deferred probing */
                dev_info(dev, "Driver %s requests probe deferral\n", drv->name);
                driver_deferred_probe_add(dev);
+                /* Did a trigger occur while probing? Need to re-trigger if yes */
+                if (local_trigger_count != atomic_read(&deferred_trigger_count))
+                        driver_deferred_probe_trigger();
        } else if (ret != -ENODEV && ret != -ENXIO) {
                /* driver matched but the probe failed */
                printk(KERN_WARNING
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index e714709704e4..5b47210889e0 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -13,6 +13,7 @@
 #include <linux/string.h>
 #include <linux/platform_device.h>
 #include <linux/of_device.h>
+#include <linux/of_irq.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/dma-mapping.h>
@@ -87,7 +88,11 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
                return -ENXIO;
        return dev->archdata.irqs[num];
 #else
-        struct resource *r = platform_get_resource(dev, IORESOURCE_IRQ, num);
+        struct resource *r;
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
+                return of_irq_get(dev->dev.of_node, num);
+        r = platform_get_resource(dev, IORESOURCE_IRQ, num);
        return r ? r->start : -ENXIO;
 #endif
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 8f5565bf34cd..fa9bb742df6e 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3067,7 +3067,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
        int ret;
        while (ptr) {
-                ret = copy_to_user(param, ptr, sizeof(*ptr));
+                struct floppy_raw_cmd cmd = *ptr;
+                cmd.next = NULL;
+                cmd.kernel_data = NULL;
+                ret = copy_to_user(param, &cmd, sizeof(cmd));
                if (ret)
                        return -EFAULT;
                param += sizeof(struct floppy_raw_cmd);
@@ -3121,10 +3124,11 @@ loop:
                return -ENOMEM;
        *rcmd = ptr;
        ret = copy_from_user(ptr, param, sizeof(*ptr));
-        if (ret)
-                return -EFAULT;
        ptr->next = NULL;
        ptr->buffer_length = 0;
+        ptr->kernel_data = NULL;
+        if (ret)
+                return -EFAULT;
        param += sizeof(struct floppy_raw_cmd);
        if (ptr->cmd_count > 33)
                        /* the command may now also take up the space
@@ -3140,7 +3144,6 @@ loop:
        for (i = 0; i < 16; i++)
                ptr->reply[i] = 0;
        ptr->resultcode = 0;
-        ptr->kernel_data = NULL;
        if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
                if (ptr->length <= 0)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index be571fef185d..a83b57e57b63 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x04CA, 0x3004) },
        { USB_DEVICE(0x04CA, 0x3005) },
        { USB_DEVICE(0x04CA, 0x3006) },
+        { USB_DEVICE(0x04CA, 0x3007) },
        { USB_DEVICE(0x04CA, 0x3008) },
        { USB_DEVICE(0x04CA, 0x300b) },
        { USB_DEVICE(0x0930, 0x0219) },
@@ -131,6 +132,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f338b0c5a8de..a7dfbf9a3afb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -152,6 +152,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
@@ -1485,10 +1486,8 @@ static int btusb_probe(struct usb_interface *intf,
        if (id->driver_info & BTUSB_BCM92035)
                hdev->setup = btusb_setup_bcm92035;
-        if (id->driver_info & BTUSB_INTEL) {
+        if (id->driver_info & BTUSB_INTEL)
-                usb_enable_autosuspend(data->udev);
                hdev->setup = btusb_setup_intel;
-        }
        /* Interface numbers are hardcoded in the specification */
        data->isoc = usb_ifnum_to_if(data->udev, 1);
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index 293e2e0a0a87..00b73448b22e 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -56,6 +56,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/debugfs.h>
+#include <linux/log2.h>
 /*
 * DDR target is the same on all platforms.
@@ -222,12 +223,6 @@ static int mvebu_mbus_window_conflicts(struct mvebu_mbus_state *mbus,
                 */
                if ((u64)base < wend && end > wbase)
                        return 0;
-                /*
-                 * Check if target/attribute conflicts
-                 */
-                if (target == wtarget && attr == wattr)
-                        return 0;
        }
        return 1;
@@ -266,6 +261,17 @@ static int mvebu_mbus_setup_window(struct mvebu_mbus_state *mbus,
                mbus->soc->win_cfg_offset(win);
        u32 ctrl, remap_addr;
+        if (!is_power_of_2(size)) {
+                WARN(true, "Invalid MBus window size: 0x%zx\n", size);
+                return -EINVAL;
+        }
+        if ((base & (phys_addr_t)(size - 1)) != 0) {
+                WARN(true, "Invalid MBus base/size: %pa len 0x%zx\n", &base,
+                     size);
+                return -EINVAL;
+        }
        ctrl = ((size - 1) & WIN_CTRL_SIZE_MASK) |
                (attr << WIN_CTRL_ATTR_SHIFT)    |
                (target << WIN_CTRL_TGT_SHIFT)   |
@@ -413,6 +419,10 @@ static int mvebu_devs_debug_show(struct seq_file *seq, void *v)
                           win, (unsigned long long)wbase,
                           (unsigned long long)(wbase + wsize), wtarget, wattr);
+                if (!is_power_of_2(wsize) ||
+                    ((wbase & (u64)(wsize - 1)) != 0))
+                        seq_puts(seq, " (Invalid base/size!!)");
                if (win < mbus->soc->num_remappable_wins) {
                        seq_printf(seq, " (remap %016llx)\n",
                                   (unsigned long long)wremap);
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index 8121b4c70ede..b29703324e94 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -730,6 +730,7 @@ static int agpioc_info_wrap(struct agp_file_private *priv, void __user *arg)
        agp_copy_info(agp_bridge, &kerninfo);
+        memset(&userinfo, 0, sizeof(userinfo));
        userinfo.version.major = kerninfo.version.major;
        userinfo.version.minor = kerninfo.version.minor;
        userinfo.bridge_id = kerninfo.device->vendor |
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 6b75713d953a..102c50d38902 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -995,8 +995,11 @@ retry:
                ibytes = min_t(size_t, ibytes, have_bytes - reserved);
        if (ibytes < min)
                ibytes = 0;
-        entropy_count = max_t(int, 0,
+        if (have_bytes >= ibytes + reserved)
-                              entropy_count - (ibytes << (ENTROPY_SHIFT + 3)));
+                entropy_count -= ibytes << (ENTROPY_SHIFT + 3);
+        else
+                entropy_count = reserved << (ENTROPY_SHIFT + 3);
        if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
                goto retry;
diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
index b3ea223585bd..61dcc8011ec7 100644
--- a/drivers/char/tpm/tpm_ppi.c
+++ b/drivers/char/tpm/tpm_ppi.c
@@ -328,13 +328,11 @@ int tpm_add_ppi(struct kobject *parent)
        /* Cache TPM ACPI handle and version string */
        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
                            ppi_callback, NULL, NULL, &tpm_ppi_handle);
-        if (tpm_ppi_handle == NULL)
+        return tpm_ppi_handle ? sysfs_create_group(parent, &ppi_attr_grp) : 0;
-                return -ENODEV;
-        return sysfs_create_group(parent, &ppi_attr_grp);
 }
 void tpm_remove_ppi(struct kobject *parent)
 {
-        sysfs_remove_group(parent, &ppi_attr_grp);
+        if (tpm_ppi_handle)
+                sysfs_remove_group(parent, &ppi_attr_grp);
 }
diff --git a/drivers/clk/bcm/clk-kona-setup.c b/drivers/clk/bcm/clk-kona-setup.c
index c7607feb18dd..54a06526f64f 100644
--- a/drivers/clk/bcm/clk-kona-setup.c
+++ b/drivers/clk/bcm/clk-kona-setup.c
@@ -27,7 +27,7 @@ LIST_HEAD(ccu_list);	/* The list of set up CCUs */
 static bool clk_requires_trigger(struct kona_clk *bcm_clk)
 {
-        struct peri_clk_data *peri = bcm_clk->peri;
+        struct peri_clk_data *peri = bcm_clk->u.peri;
        struct bcm_clk_sel *sel;
        struct bcm_clk_div *div;
@@ -63,7 +63,7 @@ static bool peri_clk_data_offsets_valid(struct kona_clk *bcm_clk)
        u32 limit;
        BUG_ON(bcm_clk->type != bcm_clk_peri);
-        peri = bcm_clk->peri;
+        peri = bcm_clk->u.peri;
        name = bcm_clk->name;
        range = bcm_clk->ccu->range;
@@ -81,19 +81,19 @@ static bool peri_clk_data_offsets_valid(struct kona_clk *bcm_clk)
        div = &peri->div;
        if (divider_exists(div)) {
-                if (div->offset > limit) {
+                if (div->u.s.offset > limit) {
                        pr_err("%s: bad divider offset for %s (%u > %u)\n",
-                                __func__, name, div->offset, limit);
+                                __func__, name, div->u.s.offset, limit);
                        return false;
                }
        }
        div = &peri->pre_div;
        if (divider_exists(div)) {
-                if (div->offset > limit) {
+                if (div->u.s.offset > limit) {
                        pr_err("%s: bad pre-divider offset for %s "
                                        "(%u > %u)\n",
-                                __func__, name, div->offset, limit);
+                                __func__, name, div->u.s.offset, limit);
                        return false;
                }
        }
@@ -249,21 +249,22 @@ static bool div_valid(struct bcm_clk_div *div, const char *field_name,
 {
        if (divider_is_fixed(div)) {
                /* Any fixed divider value but 0 is OK */
-                if (div->fixed == 0) {
+                if (div->u.fixed == 0) {
                        pr_err("%s: bad %s fixed value 0 for %s\n", __func__,
                                field_name, clock_name);
                        return false;
                }
                return true;
        }
-        if (!bitfield_valid(div->shift, div->width, field_name, clock_name))
+        if (!bitfield_valid(div->u.s.shift, div->u.s.width,
+                                field_name, clock_name))
                return false;
        if (divider_has_fraction(div))
-                if (div->frac_width > div->width) {
+                if (div->u.s.frac_width > div->u.s.width) {
                        pr_warn("%s: bad %s fraction width for %s (%u > %u)\n",
                                __func__, field_name, clock_name,
-                                div->frac_width, div->width);
+                                div->u.s.frac_width, div->u.s.width);
                        return false;
                }
@@ -278,7 +279,7 @@ static bool div_valid(struct bcm_clk_div *div, const char *field_name,
 */
 static bool kona_dividers_valid(struct kona_clk *bcm_clk)
 {
-        struct peri_clk_data *peri = bcm_clk->peri;
+        struct peri_clk_data *peri = bcm_clk->u.peri;
        struct bcm_clk_div *div;
        struct bcm_clk_div *pre_div;
        u32 limit;
@@ -295,7 +296,7 @@ static bool kona_dividers_valid(struct kona_clk *bcm_clk)
        limit = BITS_PER_BYTE * sizeof(u32);
-        return div->frac_width + pre_div->frac_width <= limit;
+        return div->u.s.frac_width + pre_div->u.s.frac_width <= limit;
 }
@@ -328,7 +329,7 @@ peri_clk_data_valid(struct kona_clk *bcm_clk)
        if (!peri_clk_data_offsets_valid(bcm_clk))
                return false;
-        peri = bcm_clk->peri;
+        peri = bcm_clk->u.peri;
        name = bcm_clk->name;
        gate = &peri->gate;
        if (gate_exists(gate) && !gate_valid(gate, "gate", name))
@@ -588,12 +589,12 @@ static void bcm_clk_teardown(struct kona_clk *bcm_clk)
 {
        switch (bcm_clk->type) {
        case bcm_clk_peri:
-                peri_clk_teardown(bcm_clk->data, &bcm_clk->init_data);
+                peri_clk_teardown(bcm_clk->u.data, &bcm_clk->init_data);
                break;
        default:
                break;
        }
-        bcm_clk->data = NULL;
+        bcm_clk->u.data = NULL;
        bcm_clk->type = bcm_clk_none;
 }
@@ -644,7 +645,7 @@ struct clk *kona_clk_setup(struct ccu_data *ccu, const char *name,
                break;
        }
        bcm_clk->type = type;
-        bcm_clk->data = data;
+        bcm_clk->u.data = data;
        /* Make sure everything makes sense before we set it up */
        if (!kona_clk_valid(bcm_clk)) {
diff --git a/drivers/clk/bcm/clk-kona.c b/drivers/clk/bcm/clk-kona.c
index e3d339e08309..db11a87449f2 100644
--- a/drivers/clk/bcm/clk-kona.c
+++ b/drivers/clk/bcm/clk-kona.c
@@ -61,7 +61,7 @@ u64 do_div_round_closest(u64 dividend, unsigned long divisor)
 /* Convert a divider into the scaled divisor value it represents. */
 static inline u64 scaled_div_value(struct bcm_clk_div *div, u32 reg_div)
 {
-        return (u64)reg_div + ((u64)1 << div->frac_width);
+        return (u64)reg_div + ((u64)1 << div->u.s.frac_width);
 }
 /*
@@ -77,7 +77,7 @@ u64 scaled_div_build(struct bcm_clk_div *div, u32 div_value, u32 billionths)
        BUG_ON(billionths >= BILLION);
        combined = (u64)div_value * BILLION + billionths;
-        combined <<= div->frac_width;
+        combined <<= div->u.s.frac_width;
        return do_div_round_closest(combined, BILLION);
 }
@@ -87,7 +87,7 @@ static inline u64
 scaled_div_min(struct bcm_clk_div *div)
 {
        if (divider_is_fixed(div))
-                return (u64)div->fixed;
+                return (u64)div->u.fixed;
        return scaled_div_value(div, 0);
 }
@@ -98,9 +98,9 @@ u64 scaled_div_max(struct bcm_clk_div *div)
        u32 reg_div;
        if (divider_is_fixed(div))
-                return (u64)div->fixed;
+                return (u64)div->u.fixed;
-        reg_div = ((u32)1 << div->width) - 1;
+        reg_div = ((u32)1 << div->u.s.width) - 1;
        return scaled_div_value(div, reg_div);
 }
@@ -115,7 +115,7 @@ divider(struct bcm_clk_div *div, u64 scaled_div)
        BUG_ON(scaled_div < scaled_div_min(div));
        BUG_ON(scaled_div > scaled_div_max(div));
-        return (u32)(scaled_div - ((u64)1 << div->frac_width));
+        return (u32)(scaled_div - ((u64)1 << div->u.s.frac_width));
 }
 /* Return a rate scaled for use when dividing by a scaled divisor. */
@@ -125,7 +125,7 @@ scale_rate(struct bcm_clk_div *div, u32 rate)
        if (divider_is_fixed(div))
                return (u64)rate;
-        return (u64)rate << div->frac_width;
+        return (u64)rate << div->u.s.frac_width;
 }
 /* CCU access */
@@ -398,14 +398,14 @@ static u64 divider_read_scaled(struct ccu_data *ccu, struct bcm_clk_div *div)
        u32 reg_div;
        if (divider_is_fixed(div))
-                return (u64)div->fixed;
+                return (u64)div->u.fixed;
        flags = ccu_lock(ccu);
-        reg_val = __ccu_read(ccu, div->offset);
+        reg_val = __ccu_read(ccu, div->u.s.offset);
        ccu_unlock(ccu, flags);
        /* Extract the full divider field from the register value */
-        reg_div = bitfield_extract(reg_val, div->shift, div->width);
+        reg_div = bitfield_extract(reg_val, div->u.s.shift, div->u.s.width);
        /* Return the scaled divisor value it represents */
        return scaled_div_value(div, reg_div);
@@ -433,16 +433,17 @@ static int __div_commit(struct ccu_data *ccu, struct bcm_clk_gate *gate,
         * state was defined in the device tree, we just find out
         * what its current value is rather than updating it.
         */
-        if (div->scaled_div == BAD_SCALED_DIV_VALUE) {
+        if (div->u.s.scaled_div == BAD_SCALED_DIV_VALUE) {
-                reg_val = __ccu_read(ccu, div->offset);
+                reg_val = __ccu_read(ccu, div->u.s.offset);
-                reg_div = bitfield_extract(reg_val, div->shift, div->width);
+                reg_div = bitfield_extract(reg_val, div->u.s.shift,
-                div->scaled_div = scaled_div_value(div, reg_div);
+                                                div->u.s.width);
+                div->u.s.scaled_div = scaled_div_value(div, reg_div);
                return 0;
        }
        /* Convert the scaled divisor to the value we need to record */
-        reg_div = divider(div, div->scaled_div);
+        reg_div = divider(div, div->u.s.scaled_div);
        /* Clock needs to be enabled before changing the rate */
        enabled = __is_clk_gate_enabled(ccu, gate);
@@ -452,9 +453,10 @@ static int __div_commit(struct ccu_data *ccu, struct bcm_clk_gate *gate,
        }
        /* Replace the divider value and record the result */
-        reg_val = __ccu_read(ccu, div->offset);
+        reg_val = __ccu_read(ccu, div->u.s.offset);
-        reg_val = bitfield_replace(reg_val, div->shift, div->width, reg_div);
+        reg_val = bitfield_replace(reg_val, div->u.s.shift, div->u.s.width,
-        __ccu_write(ccu, div->offset, reg_val);
+                                        reg_div);
+        __ccu_write(ccu, div->u.s.offset, reg_val);
        /* If the trigger fails we still want to disable the gate */
        if (!__clk_trigger(ccu, trig))
@@ -490,11 +492,11 @@ static int divider_write(struct ccu_data *ccu, struct bcm_clk_gate *gate,
        BUG_ON(divider_is_fixed(div));
-        previous = div->scaled_div;
+        previous = div->u.s.scaled_div;
        if (previous == scaled_div)
                return 0;       /* No change */
-        div->scaled_div = scaled_div;
+        div->u.s.scaled_div = scaled_div;
        flags = ccu_lock(ccu);
        __ccu_write_enable(ccu);
@@ -505,7 +507,7 @@ static int divider_write(struct ccu_data *ccu, struct bcm_clk_gate *gate,
        ccu_unlock(ccu, flags);
        if (ret)
-                div->scaled_div = previous;             /* Revert the change */
+                div->u.s.scaled_div = previous;         /* Revert the change */
        return ret;
@@ -802,7 +804,7 @@ static int selector_write(struct ccu_data *ccu, struct bcm_clk_gate *gate,
 static int kona_peri_clk_enable(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_gate *gate = &bcm_clk->peri->gate;
+        struct bcm_clk_gate *gate = &bcm_clk->u.peri->gate;
        return clk_gate(bcm_clk->ccu, bcm_clk->name, gate, true);
 }
@@ -810,7 +812,7 @@ static int kona_peri_clk_enable(struct clk_hw *hw)
 static void kona_peri_clk_disable(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_gate *gate = &bcm_clk->peri->gate;
+        struct bcm_clk_gate *gate = &bcm_clk->u.peri->gate;
        (void)clk_gate(bcm_clk->ccu, bcm_clk->name, gate, false);
 }
@@ -818,7 +820,7 @@ static void kona_peri_clk_disable(struct clk_hw *hw)
 static int kona_peri_clk_is_enabled(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_gate *gate = &bcm_clk->peri->gate;
+        struct bcm_clk_gate *gate = &bcm_clk->u.peri->gate;
        return is_clk_gate_enabled(bcm_clk->ccu, gate) ? 1 : 0;
 }
@@ -827,7 +829,7 @@ static unsigned long kona_peri_clk_recalc_rate(struct clk_hw *hw,
                        unsigned long parent_rate)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        return clk_recalc_rate(bcm_clk->ccu, &data->div, &data->pre_div,
                                parent_rate);
@@ -837,20 +839,20 @@ static long kona_peri_clk_round_rate(struct clk_hw *hw, unsigned long rate,
                        unsigned long *parent_rate)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_div *div = &bcm_clk->peri->div;
+        struct bcm_clk_div *div = &bcm_clk->u.peri->div;
        if (!divider_exists(div))
                return __clk_get_rate(hw->clk);
        /* Quietly avoid a zero rate */
-        return round_rate(bcm_clk->ccu, div, &bcm_clk->peri->pre_div,
+        return round_rate(bcm_clk->ccu, div, &bcm_clk->u.peri->pre_div,
                                rate ? rate : 1, *parent_rate, NULL);
 }
 static int kona_peri_clk_set_parent(struct clk_hw *hw, u8 index)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        struct bcm_clk_sel *sel = &data->sel;
        struct bcm_clk_trig *trig;
        int ret;
@@ -884,7 +886,7 @@ static int kona_peri_clk_set_parent(struct clk_hw *hw, u8 index)
 static u8 kona_peri_clk_get_parent(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        u8 index;
        index = selector_read_index(bcm_clk->ccu, &data->sel);
@@ -897,7 +899,7 @@ static int kona_peri_clk_set_rate(struct clk_hw *hw, unsigned long rate,
                        unsigned long parent_rate)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        struct bcm_clk_div *div = &data->div;
        u64 scaled_div = 0;
        int ret;
@@ -958,7 +960,7 @@ struct clk_ops kona_peri_clk_ops = {
 static bool __peri_clk_init(struct kona_clk *bcm_clk)
 {
        struct ccu_data *ccu = bcm_clk->ccu;
-        struct peri_clk_data *peri = bcm_clk->peri;
+        struct peri_clk_data *peri = bcm_clk->u.peri;
        const char *name = bcm_clk->name;
        struct bcm_clk_trig *trig;
diff --git a/drivers/clk/bcm/clk-kona.h b/drivers/clk/bcm/clk-kona.h
index 5e139adc3dc5..dee690951bb6 100644
--- a/drivers/clk/bcm/clk-kona.h
+++ b/drivers/clk/bcm/clk-kona.h
@@ -57,7 +57,7 @@
 #define divider_exists(div)             FLAG_TEST(div, DIV, EXISTS)
 #define divider_is_fixed(div)           FLAG_TEST(div, DIV, FIXED)
 #define divider_has_fraction(div)       (!divider_is_fixed(div) && \
-                                                (div)->frac_width > 0)
+                                                (div)->u.s.frac_width > 0)
 #define selector_exists(sel)            ((sel)->width != 0)
 #define trigger_exists(trig)            FLAG_TEST(trig, TRIG, EXISTS)
@@ -244,9 +244,9 @@ struct bcm_clk_div {
                        u32 frac_width; /* field fraction width */
                        u64 scaled_div; /* scaled divider value */
-                };
+                } s;
                u32 fixed;      /* non-zero fixed divider value */
-        };
+        } u;
        u32 flags;              /* BCM_CLK_DIV_FLAGS_* below */
 };
@@ -263,28 +263,28 @@ struct bcm_clk_div {
 /* A fixed (non-zero) divider */
 #define FIXED_DIVIDER(_value)                                           \
        {                                                               \
-                .fixed = (_value),                                      \
+                .u.fixed = (_value),                                    \
                .flags = FLAG(DIV, EXISTS)|FLAG(DIV, FIXED),            \
        }
 /* A divider with an integral divisor */
 #define DIVIDER(_offset, _shift, _width)                                \
        {                                                               \
-                .offset = (_offset),                                    \
+                .u.s.offset = (_offset),                                \
-                .shift = (_shift),                                      \
+                .u.s.shift = (_shift),                                  \
-                .width = (_width),                                      \
+                .u.s.width = (_width),                                  \
-                .scaled_div = BAD_SCALED_DIV_VALUE,                     \
+                .u.s.scaled_div = BAD_SCALED_DIV_VALUE,                 \
                .flags = FLAG(DIV, EXISTS),                             \
        }
 /* A divider whose divisor has an integer and fractional part */
 #define FRAC_DIVIDER(_offset, _shift, _width, _frac_width)              \
        {                                                               \
-                .offset = (_offset),                                    \
+                .u.s.offset = (_offset),                                \
-                .shift = (_shift),                                      \
+                .u.s.shift = (_shift),                                  \
-                .width = (_width),                                      \
+                .u.s.width = (_width),                                  \
-                .frac_width = (_frac_width),                            \
+                .u.s.frac_width = (_frac_width),                        \
-                .scaled_div = BAD_SCALED_DIV_VALUE,                     \
+                .u.s.scaled_div = BAD_SCALED_DIV_VALUE,                 \
                .flags = FLAG(DIV, EXISTS),                             \
        }
@@ -380,7 +380,7 @@ struct kona_clk {
        union {
                void *data;
                struct peri_clk_data *peri;
-        };
+        } u;
 };
 #define to_kona_clk(_hw) \
        container_of(_hw, struct kona_clk, hw)
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index ec22112e569f..4637697c139f 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -144,6 +144,37 @@ static bool _is_valid_div(struct clk_divider *divider, unsigned int div)
        return true;
 }
+static int _round_up_table(const struct clk_div_table *table, int div)
+{
+        const struct clk_div_table *clkt;
+        int up = _get_table_maxdiv(table);
+        for (clkt = table; clkt->div; clkt++) {
+                if (clkt->div == div)
+                        return clkt->div;
+                else if (clkt->div < div)
+                        continue;
+                if ((clkt->div - div) < (up - div))
+                        up = clkt->div;
+        }
+        return up;
+}
+static int _div_round_up(struct clk_divider *divider,
+                unsigned long parent_rate, unsigned long rate)
+{
+        int div = DIV_ROUND_UP(parent_rate, rate);
+        if (divider->flags & CLK_DIVIDER_POWER_OF_TWO)
+                div = __roundup_pow_of_two(div);
+        if (divider->table)
+                div = _round_up_table(divider->table, div);
+        return div;
+}
 static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
                unsigned long *best_parent_rate)
 {
@@ -159,7 +190,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
        if (!(__clk_get_flags(hw->clk) & CLK_SET_RATE_PARENT)) {
                parent_rate = *best_parent_rate;
-                bestdiv = DIV_ROUND_UP(parent_rate, rate);
+                bestdiv = _div_round_up(divider, parent_rate, rate);
                bestdiv = bestdiv == 0 ? 1 : bestdiv;
                bestdiv = bestdiv > maxdiv ? maxdiv : bestdiv;
                return bestdiv;
@@ -219,6 +250,10 @@ static int clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
        u32 val;
        div = DIV_ROUND_UP(parent_rate, rate);
+        if (!_is_valid_div(divider, div))
+                return -EINVAL;
        value = _get_val(divider, div);
        if (value > div_mask(divider))
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index dff0373f53c1..7cf2c093cc54 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1984,9 +1984,28 @@ struct clk *__clk_register(struct device *dev, struct clk_hw *hw)
 }
 EXPORT_SYMBOL_GPL(__clk_register);
-static int _clk_register(struct device *dev, struct clk_hw *hw, struct clk *clk)
+/**
+ * clk_register - allocate a new clock, register it and return an opaque cookie
+ * @dev: device that is registering this clock
+ * @hw: link to hardware-specific clock data
+ *
+ * clk_register is the primary interface for populating the clock tree with new
+ * clock nodes.  It returns a pointer to the newly allocated struct clk which
+ * cannot be dereferenced by driver code but may be used in conjuction with the
+ * rest of the clock API.  In the event of an error clk_register will return an
+ * error code; drivers must test for an error code after calling clk_register.
+ */
+struct clk *clk_register(struct device *dev, struct clk_hw *hw)
 {
        int i, ret;
+        struct clk *clk;
+        clk = kzalloc(sizeof(*clk), GFP_KERNEL);
+        if (!clk) {
+                pr_err("%s: could not allocate clk\n", __func__);
+                ret = -ENOMEM;
+                goto fail_out;
+        }
        clk->name = kstrdup(hw->init->name, GFP_KERNEL);
        if (!clk->name) {
@@ -2026,7 +2045,7 @@ static int _clk_register(struct device *dev, struct clk_hw *hw, struct clk *clk)
        ret = __clk_init(dev, clk);
        if (!ret)
-                return 0;
+                return clk;
 fail_parent_names_copy:
        while (--i >= 0)
@@ -2035,36 +2054,6 @@ fail_parent_names_copy:
 fail_parent_names:
        kfree(clk->name);
 fail_name:
-        return ret;
-}
-/**
- * clk_register - allocate a new clock, register it and return an opaque cookie
- * @dev: device that is registering this clock
- * @hw: link to hardware-specific clock data
- *
- * clk_register is the primary interface for populating the clock tree with new
- * clock nodes.  It returns a pointer to the newly allocated struct clk which
- * cannot be dereferenced by driver code but may be used in conjuction with the
- * rest of the clock API.  In the event of an error clk_register will return an
- * error code; drivers must test for an error code after calling clk_register.
- */
-struct clk *clk_register(struct device *dev, struct clk_hw *hw)
-{
-        int ret;
-        struct clk *clk;
-        clk = kzalloc(sizeof(*clk), GFP_KERNEL);
-        if (!clk) {
-                pr_err("%s: could not allocate clk\n", __func__);
-                ret = -ENOMEM;
-                goto fail_out;
-        }
-        ret = _clk_register(dev, hw, clk);
-        if (!ret)
-                return clk;
        kfree(clk);
 fail_out:
        return ERR_PTR(ret);
@@ -2151,9 +2140,10 @@ void clk_unregister(struct clk *clk)
        if (!hlist_empty(&clk->children)) {
                struct clk *child;
+                struct hlist_node *t;
                /* Reparent all children to the orphan list. */
-                hlist_for_each_entry(child, &clk->children, child_node)
+                hlist_for_each_entry_safe(child, t, &clk->children, child_node)
                        clk_set_parent(child, NULL);
        }
@@ -2173,7 +2163,7 @@ EXPORT_SYMBOL_GPL(clk_unregister);
 static void devm_clk_release(struct device *dev, void *res)
 {
-        clk_unregister(res);
+        clk_unregister(*(struct clk **)res);
 }
 /**
@@ -2188,18 +2178,18 @@ static void devm_clk_release(struct device *dev, void *res)
 struct clk *devm_clk_register(struct device *dev, struct clk_hw *hw)
 {
        struct clk *clk;
-        int ret;
+        struct clk **clkp;
-        clk = devres_alloc(devm_clk_release, sizeof(*clk), GFP_KERNEL);
+        clkp = devres_alloc(devm_clk_release, sizeof(*clkp), GFP_KERNEL);
-        if (!clk)
+        if (!clkp)
                return ERR_PTR(-ENOMEM);
-        ret = _clk_register(dev, hw, clk);
+        clk = clk_register(dev, hw);
-        if (!ret) {
+        if (!IS_ERR(clk)) {
-                devres_add(dev, clk);
+                *clkp = clk;
+                devres_add(dev, clkp);
        } else {
-                devres_free(clk);
+                devres_free(clkp);
-                clk = ERR_PTR(ret);
        }
        return clk;
diff --git a/drivers/clk/shmobile/clk-mstp.c b/drivers/clk/shmobile/clk-mstp.c
index 2e5810c88d11..1f6324e29a80 100644
--- a/drivers/clk/shmobile/clk-mstp.c
+++ b/drivers/clk/shmobile/clk-mstp.c
@@ -156,6 +156,7 @@ cpg_mstp_clock_register(const char *name, const char *parent_name,
 static void __init cpg_mstp_clocks_init(struct device_node *np)
 {
        struct mstp_clock_group *group;
+        const char *idxname;
        struct clk **clks;
        unsigned int i;
@@ -184,6 +185,11 @@ static void __init cpg_mstp_clocks_init(struct device_node *np)
        for (i = 0; i < MSTP_MAX_CLOCKS; ++i)
                clks[i] = ERR_PTR(-ENOENT);
+        if (of_find_property(np, "clock-indices", &i))
+                idxname = "clock-indices";
+        else
+                idxname = "renesas,clock-indices";
        for (i = 0; i < MSTP_MAX_CLOCKS; ++i) {
                const char *parent_name;
                const char *name;
@@ -197,8 +203,7 @@ static void __init cpg_mstp_clocks_init(struct device_node *np)
                        continue;
                parent_name = of_clk_get_parent_name(np, i);
-                ret = of_property_read_u32_index(np, "renesas,clock-indices", i,
+                ret = of_property_read_u32_index(np, idxname, i, &clkidx);
-                                                 &clkidx);
                if (parent_name == NULL || ret < 0)
                        break;
diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
index 88dafb5e9627..de6da957a09d 100644
--- a/drivers/clk/socfpga/clk-pll.c
+++ b/drivers/clk/socfpga/clk-pll.c
@@ -20,6 +20,7 @@
 #include <linux/clk-provider.h>
 #include <linux/io.h>
 #include <linux/of.h>
+#include <linux/of_address.h>
 #include "clk.h"
@@ -43,6 +44,8 @@
 #define to_socfpga_clk(p) container_of(p, struct socfpga_pll, hw.hw)
+void __iomem *clk_mgr_base_addr;
 static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
                                         unsigned long parent_rate)
 {
@@ -87,6 +90,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
        const char *clk_name = node->name;
        const char *parent_name[SOCFPGA_MAX_PARENTS];
        struct clk_init_data init;
+        struct device_node *clkmgr_np;
        int rc;
        int i = 0;
@@ -96,6 +100,9 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
        if (WARN_ON(!pll_clk))
                return NULL;
+        clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+        clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
+        BUG_ON(!clk_mgr_base_addr);
        pll_clk->hw.reg = clk_mgr_base_addr + reg;
        of_property_read_string(node, "clock-output-names", &clk_name);
diff --git a/drivers/clk/socfpga/clk.c b/drivers/clk/socfpga/clk.c
index 35a960a993f9..43db947e5f0e 100644
--- a/drivers/clk/socfpga/clk.c
+++ b/drivers/clk/socfpga/clk.c
@@ -17,28 +17,11 @@
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
-#include <linux/clk.h>
-#include <linux/clkdev.h>
-#include <linux/clk-provider.h>
-#include <linux/io.h>
 #include <linux/of.h>
-#include <linux/of_address.h>
 #include "clk.h"
-void __iomem *clk_mgr_base_addr;
+CLK_OF_DECLARE(socfpga_pll_clk, "altr,socfpga-pll-clock", socfpga_pll_init);
+CLK_OF_DECLARE(socfpga_perip_clk, "altr,socfpga-perip-clk", socfpga_periph_init);
-static const struct of_device_id socfpga_child_clocks[] __initconst = {
+CLK_OF_DECLARE(socfpga_gate_clk, "altr,socfpga-gate-clk", socfpga_gate_init);
-        { .compatible = "altr,socfpga-pll-clock", socfpga_pll_init, },
-        { .compatible = "altr,socfpga-perip-clk", socfpga_periph_init, },
-        { .compatible = "altr,socfpga-gate-clk", socfpga_gate_init, },
-        {},
-};
-static void __init socfpga_clkmgr_init(struct device_node *node)
-{
-        clk_mgr_base_addr = of_iomap(node, 0);
-        of_clk_init(socfpga_child_clocks);
-}
-CLK_OF_DECLARE(socfpga_mgr, "altr,clk-mgr", socfpga_clkmgr_init);
diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index 0d20241e0770..e1769addf435 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -1718,7 +1718,7 @@ struct clk *tegra_clk_register_plle_tegra114(const char *name,
                                        "pll_re_vco");
        } else {
                val_aux &= ~(PLLE_AUX_PLLRE_SEL | PLLE_AUX_PLLP_SEL);
-                pll_writel(val, pll_params->aux_reg, pll);
+                pll_writel(val_aux, pll_params->aux_reg, pll);
        }
        clk = _tegra_clk_register_pll(pll, name, parent_name, flags,
diff --git a/drivers/clk/tegra/clk-tegra124.c b/drivers/clk/tegra/clk-tegra124.c
index 166e02f16c8a..cc37c342c4cb 100644
--- a/drivers/clk/tegra/clk-tegra124.c
+++ b/drivers/clk/tegra/clk-tegra124.c
@@ -764,7 +764,6 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
        [tegra_clk_i2s1] = { .dt_id = TEGRA124_CLK_I2S1, .present = true },
        [tegra_clk_i2c1] = { .dt_id = TEGRA124_CLK_I2C1, .present = true },
-        [tegra_clk_ndflash] = { .dt_id = TEGRA124_CLK_NDFLASH, .present = true },
        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
        [tegra_clk_pwm] = { .dt_id = TEGRA124_CLK_PWM, .present = true },
@@ -809,7 +808,6 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
        [tegra_clk_trace] = { .dt_id = TEGRA124_CLK_TRACE, .present = true },
        [tegra_clk_soc_therm] = { .dt_id = TEGRA124_CLK_SOC_THERM, .present = true },
        [tegra_clk_dtv] = { .dt_id = TEGRA124_CLK_DTV, .present = true },
-        [tegra_clk_ndspeed] = { .dt_id = TEGRA124_CLK_NDSPEED, .present = true },
        [tegra_clk_i2cslow] = { .dt_id = TEGRA124_CLK_I2CSLOW, .present = true },
        [tegra_clk_dsib] = { .dt_id = TEGRA124_CLK_DSIB, .present = true },
        [tegra_clk_tsec] = { .dt_id = TEGRA124_CLK_TSEC, .present = true },
@@ -952,7 +950,6 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
        [tegra_clk_clk_out_3_mux] = { .dt_id = TEGRA124_CLK_CLK_OUT_3_MUX, .present = true },
        [tegra_clk_dsia_mux] = { .dt_id = TEGRA124_CLK_DSIA_MUX, .present = true },
        [tegra_clk_dsib_mux] = { .dt_id = TEGRA124_CLK_DSIB_MUX, .present = true },
-        [tegra_clk_uarte] = { .dt_id = TEGRA124_CLK_UARTE, .present = true },
 };
 static struct tegra_devclk devclks[] __initdata = {
diff --git a/drivers/clk/versatile/clk-vexpress-osc.c b/drivers/clk/versatile/clk-vexpress-osc.c
index 2dc8b41a339d..422391242b39 100644
--- a/drivers/clk/versatile/clk-vexpress-osc.c
+++ b/drivers/clk/versatile/clk-vexpress-osc.c
@@ -100,9 +100,11 @@ void __init vexpress_osc_of_setup(struct device_node *node)
        struct clk *clk;
        u32 range[2];
+        vexpress_sysreg_of_early_init();
        osc = kzalloc(sizeof(*osc), GFP_KERNEL);
        if (!osc)
-                goto error;
+                return;
        osc->func = vexpress_config_func_get_by_node(node);
        if (!osc->func) {
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 57e823c44d2a..5163ec13429d 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -66,6 +66,7 @@ static int arch_timer_ppi[MAX_TIMER_PPI];
 static struct clock_event_device __percpu *arch_timer_evt;
 static bool arch_timer_use_virtual = true;
+static bool arch_timer_c3stop;
 static bool arch_timer_mem_use_virtual;
 /*
@@ -263,7 +264,8 @@ static void __arch_timer_setup(unsigned type,
        clk->features = CLOCK_EVT_FEAT_ONESHOT;
        if (type == ARCH_CP15_TIMER) {
-                clk->features |= CLOCK_EVT_FEAT_C3STOP;
+                if (arch_timer_c3stop)
+                        clk->features |= CLOCK_EVT_FEAT_C3STOP;
                clk->name = "arch_sys_timer";
                clk->rating = 450;
                clk->cpumask = cpumask_of(smp_processor_id());
@@ -665,6 +667,8 @@ static void __init arch_timer_init(struct device_node *np)
                }
        }
+        arch_timer_c3stop = !of_property_read_bool(np, "always-on");
        arch_timer_register();
        arch_timer_common_init();
 }
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index a6ee6d7cd63f..acf5a329d538 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -416,8 +416,6 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
        evt->set_mode = exynos4_tick_set_mode;
        evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
        evt->rating = 450;
-        clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
-                                        0xf, 0x7fffffff);
        exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
@@ -430,9 +428,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
                                evt->irq);
                        return -EIO;
                }
+                irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
        } else {
                enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
        }
+        clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
+                                        0xf, 0x7fffffff);
        return 0;
 }
@@ -450,7 +451,6 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                                           unsigned long action, void *hcpu)
 {
        struct mct_clock_event_device *mevt;
-        unsigned int cpu;
        /*
         * Grab cpu pointer in each case to avoid spurious
@@ -461,12 +461,6 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_setup(&mevt->evt);
                break;
-        case CPU_ONLINE:
-                cpu = (unsigned long)hcpu;
-                if (mct_int_type == MCT_INT_SPI)
-                        irq_set_affinity(mct_irqs[MCT_L0_IRQ + cpu],
-                                                cpumask_of(cpu));
-                break;
        case CPU_DYING:
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_stop(&mevt->evt);
diff --git a/drivers/clocksource/zevio-timer.c b/drivers/clocksource/zevio-timer.c
index ca81809d159d..7ce442148c3f 100644
--- a/drivers/clocksource/zevio-timer.c
+++ b/drivers/clocksource/zevio-timer.c
@@ -212,4 +212,9 @@ error_free:
        return ret;
 }
-CLOCKSOURCE_OF_DECLARE(zevio_timer, "lsi,zevio-timer", zevio_timer_add);
+static void __init zevio_timer_init(struct device_node *node)
+{
+        BUG_ON(zevio_timer_add(node));
+}
+CLOCKSOURCE_OF_DECLARE(zevio_timer, "lsi,zevio-timer", zevio_timer_init);
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 148d707a1d43..ccdd4c7e748b 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
                return;
        /* Can only change if privileged. */
-        if (!capable(CAP_NET_ADMIN)) {
+        if (!__netlink_ns_capable(nsp, &init_user_ns, CAP_NET_ADMIN)) {
                err = EPERM;
                goto out;
        }
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 0e9cce82844b..580503513f0f 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -92,11 +92,7 @@ config ARM_EXYNOS_CPU_FREQ_BOOST_SW
 config ARM_HIGHBANK_CPUFREQ
        tristate "Calxeda Highbank-based"
-        depends on ARCH_HIGHBANK
+        depends on ARCH_HIGHBANK && GENERIC_CPUFREQ_CPU0 && REGULATOR
-        select GENERIC_CPUFREQ_CPU0
-        select PM_OPP
-        select REGULATOR
        default m
        help
          This adds the CPUFreq driver for Calxeda Highbank SoC
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 099967302bf2..eab8ccfe6beb 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -37,6 +37,7 @@
 #define BYT_RATIOS              0x66a
 #define BYT_VIDS                0x66b
 #define BYT_TURBO_RATIOS        0x66c
+#define BYT_TURBO_VIDS          0x66d
 #define FRAC_BITS 6
@@ -70,8 +71,9 @@ struct pstate_data {
 };
 struct vid_data {
-        int32_t min;
+        int min;
-        int32_t max;
+        int max;
+        int turbo;
        int32_t ratio;
 };
@@ -359,14 +361,14 @@ static int byt_get_min_pstate(void)
 {
        u64 value;
        rdmsrl(BYT_RATIOS, value);
-        return (value >> 8) & 0xFF;
+        return (value >> 8) & 0x3F;
 }
 static int byt_get_max_pstate(void)
 {
        u64 value;
        rdmsrl(BYT_RATIOS, value);
-        return (value >> 16) & 0xFF;
+        return (value >> 16) & 0x3F;
 }
 static int byt_get_turbo_pstate(void)
@@ -393,6 +395,9 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
        vid_fp = clamp_t(int32_t, vid_fp, cpudata->vid.min, cpudata->vid.max);
        vid = fp_toint(vid_fp);
+        if (pstate > cpudata->pstate.max_pstate)
+                vid = cpudata->vid.turbo;
        val |= vid;
        wrmsrl(MSR_IA32_PERF_CTL, val);
@@ -402,13 +407,17 @@ static void byt_get_vid(struct cpudata *cpudata)
 {
        u64 value;
        rdmsrl(BYT_VIDS, value);
-        cpudata->vid.min = int_tofp((value >> 8) & 0x7f);
+        cpudata->vid.min = int_tofp((value >> 8) & 0x3f);
-        cpudata->vid.max = int_tofp((value >> 16) & 0x7f);
+        cpudata->vid.max = int_tofp((value >> 16) & 0x3f);
        cpudata->vid.ratio = div_fp(
                cpudata->vid.max - cpudata->vid.min,
                int_tofp(cpudata->pstate.max_pstate -
                        cpudata->pstate.min_pstate));
+        rdmsrl(BYT_TURBO_VIDS, value);
+        cpudata->vid.turbo = value & 0x7f;
 }
@@ -545,12 +554,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
        if (pstate_funcs.get_vid)
                pstate_funcs.get_vid(cpu);
+        intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
-        /*
-         * goto max pstate so we don't slow up boot if we are built-in if we are
-         * a module we will take care of it during normal operation
-         */
-        intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
 }
 static inline void intel_pstate_calc_busy(struct cpudata *cpu,
@@ -695,11 +699,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu = all_cpu_data[cpunum];
        intel_pstate_get_cpu_pstates(cpu);
-        if (!cpu->pstate.current_pstate) {
-                all_cpu_data[cpunum] = NULL;
-                kfree(cpu);
-                return -ENODATA;
-        }
        cpu->cpu = cpunum;
@@ -710,7 +709,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu->timer.expires = jiffies + HZ/100;
        intel_pstate_busy_pid_reset(cpu);
        intel_pstate_sample(cpu);
-        intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
        add_timer_on(&cpu->timer, cpunum);
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index d00e5d1abd25..5c4369b5d834 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -242,7 +242,7 @@ static void do_powersaver(int cx_address, unsigned int mults_index,
 * Sets a new clock ratio.
 */
-static void longhaul_setstate(struct cpufreq_policy *policy,
+static int longhaul_setstate(struct cpufreq_policy *policy,
                unsigned int table_index)
 {
        unsigned int mults_index;
@@ -258,10 +258,12 @@ static void longhaul_setstate(struct cpufreq_policy *policy,
        /* Safety precautions */
        mult = mults[mults_index & 0x1f];
        if (mult == -1)
-                return;
+                return -EINVAL;
        speed = calc_speed(mult);
        if ((speed > highest_speed) || (speed < lowest_speed))
-                return;
+                return -EINVAL;
        /* Voltage transition before frequency transition? */
        if (can_scale_voltage && longhaul_index < table_index)
                dir = 1;
@@ -269,8 +271,6 @@ static void longhaul_setstate(struct cpufreq_policy *policy,
        freqs.old = calc_speed(longhaul_get_cpu_mult());
        freqs.new = speed;
-        cpufreq_freq_transition_begin(policy, &freqs);
        pr_debug("Setting to FSB:%dMHz Mult:%d.%dx (%s)\n",
                        fsb, mult/10, mult%10, print_speed(speed/1000));
 retry_loop:
@@ -385,12 +385,14 @@ retry_loop:
                        goto retry_loop;
                }
        }
-        /* Report true CPU frequency */
-        cpufreq_freq_transition_end(policy, &freqs, 0);
-        if (!bm_timeout)
+        if (!bm_timeout) {
                printk(KERN_INFO PFX "Warning: Timeout while waiting for "
                                "idle PCI bus.\n");
+                return -EBUSY;
+        }
+        return 0;
 }
 /*
@@ -631,9 +633,10 @@ static int longhaul_target(struct cpufreq_policy *policy,
        unsigned int i;
        unsigned int dir = 0;
        u8 vid, current_vid;
+        int retval = 0;
        if (!can_scale_voltage)
-                longhaul_setstate(policy, table_index);
+                retval = longhaul_setstate(policy, table_index);
        else {
                /* On test system voltage transitions exceeding single
                 * step up or down were turning motherboard off. Both
@@ -648,7 +651,7 @@ static int longhaul_target(struct cpufreq_policy *policy,
                while (i != table_index) {
                        vid = (longhaul_table[i].driver_data >> 8) & 0x1f;
                        if (vid != current_vid) {
-                                longhaul_setstate(policy, i);
+                                retval = longhaul_setstate(policy, i);
                                current_vid = vid;
                                msleep(200);
                        }
@@ -657,10 +660,11 @@ static int longhaul_target(struct cpufreq_policy *policy,
                        else
                                i--;
                }
-                longhaul_setstate(policy, table_index);
+                retval = longhaul_setstate(policy, table_index);
        }
        longhaul_index = table_index;
-        return 0;
+        return retval;
 }
@@ -968,7 +972,15 @@ static void __exit longhaul_exit(void)
        for (i = 0; i < numscales; i++) {
                if (mults[i] == maxmult) {
+                        struct cpufreq_freqs freqs;
+                        freqs.old = policy->cur;
+                        freqs.new = longhaul_table[i].frequency;
+                        freqs.flags = 0;
+                        cpufreq_freq_transition_begin(policy, &freqs);
                        longhaul_setstate(policy, i);
+                        cpufreq_freq_transition_end(policy, &freqs, 0);
                        break;
                }
        }
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index f0bc31f5db27..d4add8621944 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -62,7 +62,7 @@ static int loongson2_cpufreq_target(struct cpufreq_policy *policy,
        set_cpus_allowed_ptr(current, &cpus_allowed);
        /* setting the cpu frequency */
-        clk_set_rate(policy->clk, freq);
+        clk_set_rate(policy->clk, freq * 1000);
        return 0;
 }
@@ -92,7 +92,7 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
             i++)
                loongson2_clockmod_table[i].frequency = (rate * i) / 8;
-        ret = clk_set_rate(cpuclk, rate);
+        ret = clk_set_rate(cpuclk, rate * 1000);
        if (ret) {
                clk_put(cpuclk);
                return ret;
diff --git a/drivers/cpufreq/powernow-k6.c b/drivers/cpufreq/powernow-k6.c
index 49f120e1bc7b..78904e6ca4a0 100644
--- a/drivers/cpufreq/powernow-k6.c
+++ b/drivers/cpufreq/powernow-k6.c
@@ -138,22 +138,14 @@ static void powernow_k6_set_cpu_multiplier(unsigned int best_i)
 static int powernow_k6_target(struct cpufreq_policy *policy,
                unsigned int best_i)
 {
-        struct cpufreq_freqs freqs;
        if (clock_ratio[best_i].driver_data > max_multiplier) {
                printk(KERN_ERR PFX "invalid target frequency\n");
                return -EINVAL;
        }
-        freqs.old = busfreq * powernow_k6_get_cpu_multiplier();
-        freqs.new = busfreq * clock_ratio[best_i].driver_data;
-        cpufreq_freq_transition_begin(policy, &freqs);
        powernow_k6_set_cpu_multiplier(best_i);
-        cpufreq_freq_transition_end(policy, &freqs, 0);
        return 0;
 }
@@ -227,9 +219,20 @@ have_busfreq:
 static int powernow_k6_cpu_exit(struct cpufreq_policy *policy)
 {
        unsigned int i;
-        for (i = 0; i < 8; i++) {
-                if (i == max_multiplier)
+        for (i = 0; (clock_ratio[i].frequency != CPUFREQ_TABLE_END); i++) {
+                if (clock_ratio[i].driver_data == max_multiplier) {
+                        struct cpufreq_freqs freqs;
+                        freqs.old = policy->cur;
+                        freqs.new = clock_ratio[i].frequency;
+                        freqs.flags = 0;
+                        cpufreq_freq_transition_begin(policy, &freqs);
                        powernow_k6_target(policy, i);
+                        cpufreq_freq_transition_end(policy, &freqs, 0);
+                        break;
+                }
        }
        return 0;
 }
diff --git a/drivers/cpufreq/powernow-k7.c b/drivers/cpufreq/powernow-k7.c
index f911645c3f6d..e61e224475ad 100644
--- a/drivers/cpufreq/powernow-k7.c
+++ b/drivers/cpufreq/powernow-k7.c
@@ -269,8 +269,6 @@ static int powernow_target(struct cpufreq_policy *policy, unsigned int index)
        freqs.new = powernow_table[index].frequency;
-        cpufreq_freq_transition_begin(policy, &freqs);
        /* Now do the magic poking into the MSRs.  */
        if (have_a0 == 1)       /* A0 errata 5 */
@@ -290,8 +288,6 @@ static int powernow_target(struct cpufreq_policy *policy, unsigned int index)
        if (have_a0 == 1)
                local_irq_enable();
-        cpufreq_freq_transition_end(policy, &freqs, 0);
        return 0;
 }
diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
index 9edccc63245d..af4968813e76 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -29,6 +29,7 @@
 #include <asm/cputhreads.h>
 #include <asm/reg.h>
+#include <asm/smp.h> /* Required for cpu_sibling_mask() in UP configs */
 #define POWERNV_MAX_PSTATES     256
diff --git a/drivers/cpufreq/ppc-corenet-cpufreq.c b/drivers/cpufreq/ppc-corenet-cpufreq.c
index b7e677be1df0..0af618abebaf 100644
--- a/drivers/cpufreq/ppc-corenet-cpufreq.c
+++ b/drivers/cpufreq/ppc-corenet-cpufreq.c
@@ -138,6 +138,7 @@ static int corenet_cpufreq_cpu_init(struct cpufreq_policy *policy)
        struct cpufreq_frequency_table *table;
        struct cpu_data *data;
        unsigned int cpu = policy->cpu;
+        u64 transition_latency_hz;
        np = of_get_cpu_node(cpu, NULL);
        if (!np)
@@ -205,8 +206,10 @@ static int corenet_cpufreq_cpu_init(struct cpufreq_policy *policy)
        for_each_cpu(i, per_cpu(cpu_mask, cpu))
                per_cpu(cpu_data, i) = data;
+        transition_latency_hz = 12ULL * NSEC_PER_SEC;
        policy->cpuinfo.transition_latency =
-                                (12 * NSEC_PER_SEC) / fsl_get_sys_freq();
+                do_div(transition_latency_hz, fsl_get_sys_freq());
        of_node_put(np);
        return 0;
diff --git a/drivers/cpufreq/unicore2-cpufreq.c b/drivers/cpufreq/unicore2-cpufreq.c
index 8d045afa7fb4..6f9dfa80563a 100644
--- a/drivers/cpufreq/unicore2-cpufreq.c
+++ b/drivers/cpufreq/unicore2-cpufreq.c
@@ -60,9 +60,7 @@ static int __init ucv2_cpu_init(struct cpufreq_policy *policy)
        policy->max = policy->cpuinfo.max_freq = 1000000;
        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
        policy->clk = clk_get(NULL, "MAIN_CLK");
-        if (IS_ERR(policy->clk))
+        return PTR_ERR_OR_ZERO(policy->clk);
-                return PTR_ERR(policy->clk);
-        return 0;
 }
 static struct cpufreq_driver ucv2_driver = {
diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
index 9f25f5296029..0eabd81e1a90 100644
--- a/drivers/crypto/caam/error.c
+++ b/drivers/crypto/caam/error.c
@@ -16,9 +16,13 @@
        char *tmp;                                              \
                                                                \
        tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC);  \
-        sprintf(tmp, format, param);                            \
+        if (likely(tmp)) {                                      \
-        strcat(str, tmp);                                       \
+                sprintf(tmp, format, param);                    \
-        kfree(tmp);                                             \
+                strcat(str, tmp);                               \
+                kfree(tmp);                                     \
+        } else {                                                \
+                strcat(str, "kmalloc failure in SPRINTFCAT");   \
+        }                                                       \
 }
 static void report_jump_idx(u32 status, char *outstr)
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index 3ee852c9925b..071c2c969eec 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -756,6 +756,7 @@ static const struct {
         */
        { ACPI_SIG_IBFT },
        { "iBFT" },
+        { "BIFT" },     /* Broadcom iSCSI Offload */
 };
 static void __init acpi_find_ibft_region(void)
diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
index e73c6755a5eb..70304220a479 100644
--- a/drivers/gpio/gpio-ich.c
+++ b/drivers/gpio/gpio-ich.c
@@ -305,6 +305,8 @@ static struct ichx_desc ich6_desc = {
        .ngpio = 50,
        .have_blink = true,
+        .regs = ichx_regs,
+        .reglen = ichx_reglen,
 };
 /* Intel 3100 */
@@ -324,6 +326,8 @@ static struct ichx_desc i3100_desc = {
        .uses_gpe0 = true,
        .ngpio = 50,
+        .regs = ichx_regs,
+        .reglen = ichx_reglen,
 };
 /* ICH7 and ICH8-based */
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index 99a68310e7c0..3d53fd6880d1 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -894,9 +894,11 @@ static int mcp23s08_probe(struct spi_device *spi)
                        dev_err(&spi->dev, "invalid spi-present-mask\n");
                        return -ENODEV;
                }
+                for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
-                for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++)
+                        if ((spi_present_mask & (1 << addr)))
+                                chips++;
                        pullups[addr] = 0;
+                }
        } else {
                type = spi_get_device_id(spi)->driver_data;
                pdata = dev_get_platdata(&spi->dev);
@@ -919,12 +921,12 @@ static int mcp23s08_probe(struct spi_device *spi)
                        pullups[addr] = pdata->chip[addr].pullups;
                }
-                if (!chips)
-                        return -ENODEV;
                base = pdata->base;
        }
+        if (!chips)
+                return -ENODEV;
        data = kzalloc(sizeof(*data) + chips * sizeof(struct mcp23s08),
                        GFP_KERNEL);
        if (!data)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index e930d4fe29c7..1ef5ab9c9d51 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -145,6 +145,7 @@ exynos_drm_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mode,
        plane->crtc = crtc;
        plane->fb = crtc->primary->fb;
+        drm_framebuffer_reference(plane->fb);
        return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index c786cd4f457b..2a3ad24276f8 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -263,7 +263,7 @@ struct drm_gem_object *exynos_dmabuf_prime_import(struct drm_device *drm_dev,
        buffer->sgt = sgt;
        exynos_gem_obj->base.import_attach = attach;
-        DRM_DEBUG_PRIME("dma_addr = 0x%x, size = 0x%lx\n", buffer->dma_addr,
+        DRM_DEBUG_PRIME("dma_addr = %pad, size = 0x%lx\n", &buffer->dma_addr,
                                                                buffer->size);
        return &exynos_gem_obj->base;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index eb73e3bf2a0c..4ac438187568 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1426,9 +1426,9 @@ static int exynos_dsi_probe(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        dsi->reg_base = devm_ioremap_resource(&pdev->dev, res);
-        if (!dsi->reg_base) {
+        if (IS_ERR(dsi->reg_base)) {
                dev_err(&pdev->dev, "failed to remap io region\n");
-                return -EADDRNOTAVAIL;
+                return PTR_ERR(dsi->reg_base);
        }
        dsi->phy = devm_phy_get(&pdev->dev, "dsim");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 7afead9c3f30..852f2dadaebd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -220,7 +220,7 @@ static void vidi_win_commit(struct exynos_drm_manager *mgr, int zpos)
        win_data->enabled = true;
-        DRM_DEBUG_KMS("dma_addr = 0x%x\n", win_data->dma_addr);
+        DRM_DEBUG_KMS("dma_addr = %pad\n", &win_data->dma_addr);
        if (ctx->vblank_on)
                schedule_work(&ctx->work);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index ec82f6bff122..108e1ec2fa4b 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1954,6 +1954,9 @@ struct drm_i915_cmd_table {
 #define IS_ULT(dev)             (IS_HSW_ULT(dev) || IS_BDW_ULT(dev))
 #define IS_HSW_GT3(dev)         (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0x00F0) == 0x0020)
+/* ULX machines are also considered ULT. */
+#define IS_HSW_ULX(dev)         ((dev)->pdev->device == 0x0A0E || \
+                                 (dev)->pdev->device == 0x0A1E)
 #define IS_PRELIMINARY_HW(intel_info) ((intel_info)->is_preliminary)
 /*
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index ab5e93c30aa2..154b0f8bb88d 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -34,25 +34,35 @@ static void gen8_setup_private_ppat(struct drm_i915_private *dev_priv);
 bool intel_enable_ppgtt(struct drm_device *dev, bool full)
 {
-        if (i915.enable_ppgtt == 0 || !HAS_ALIASING_PPGTT(dev))
+        if (i915.enable_ppgtt == 0)
                return false;
        if (i915.enable_ppgtt == 1 && full)
                return false;
+        return true;
+}
+static int sanitize_enable_ppgtt(struct drm_device *dev, int enable_ppgtt)
+{
+        if (enable_ppgtt == 0 || !HAS_ALIASING_PPGTT(dev))
+                return 0;
+        if (enable_ppgtt == 1)
+                return 1;
+        if (enable_ppgtt == 2 && HAS_PPGTT(dev))
+                return 2;
 #ifdef CONFIG_INTEL_IOMMU
        /* Disable ppgtt on SNB if VT-d is on. */
        if (INTEL_INFO(dev)->gen == 6 && intel_iommu_gfx_mapped) {
                DRM_INFO("Disabling PPGTT because VT-d is on\n");
-                return false;
+                return 0;
        }
 #endif
-        /* Full ppgtt disabled by default for now due to issues. */
+        return HAS_ALIASING_PPGTT(dev) ? 1 : 0;
-        if (full)
-                return false; /* HAS_PPGTT(dev) */
-        else
-                return HAS_ALIASING_PPGTT(dev);
 }
 #define GEN6_PPGTT_PD_ENTRIES 512
@@ -2031,6 +2041,14 @@ int i915_gem_gtt_init(struct drm_device *dev)
                 gtt->base.total >> 20);
        DRM_DEBUG_DRIVER("GMADR size = %ldM\n", gtt->mappable_end >> 20);
        DRM_DEBUG_DRIVER("GTT stolen size = %zdM\n", gtt->stolen_size >> 20);
+        /*
+         * i915.enable_ppgtt is read-only, so do an early pass to validate the
+         * user's requested state against the hardware/driver capabilities.  We
+         * do this now so that we can print out any log messages once rather
+         * than every time we check intel_enable_ppgtt().
+         */
+        i915.enable_ppgtt = sanitize_enable_ppgtt(dev, i915.enable_ppgtt);
+        DRM_DEBUG_DRIVER("ppgtt mode: %i\n", i915.enable_ppgtt);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 7753249b3a95..f98ba4e6e70b 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1362,10 +1362,20 @@ static inline void intel_hpd_irq_handler(struct drm_device *dev,
        spin_lock(&dev_priv->irq_lock);
        for (i = 1; i < HPD_NUM_PINS; i++) {
-                WARN_ONCE(hpd[i] & hotplug_trigger &&
+                if (hpd[i] & hotplug_trigger &&
-                          dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED,
+                    dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED) {
-                          "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
+                        /*
-                          hotplug_trigger, i, hpd[i]);
+                         * On GMCH platforms the interrupt mask bits only
+                         * prevent irq generation, not the setting of the
+                         * hotplug bits itself. So only WARN about unexpected
+                         * interrupts on saner platforms.
+                         */
+                        WARN_ONCE(INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev),
+                                  "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
+                                  hotplug_trigger, i, hpd[i]);
+                        continue;
+                }
                if (!(hpd[i] & hotplug_trigger) ||
                    dev_priv->hpd_stats[i].hpd_mark != HPD_ENABLED)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 9f5b18d9d885..c77af69c2d8f 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -827,6 +827,7 @@ enum punit_power_well {
 # define MI_FLUSH_ENABLE                                (1 << 12)
 # define ASYNC_FLIP_PERF_DISABLE                        (1 << 14)
 # define MODE_IDLE                                      (1 << 9)
+# define STOP_RING                                      (1 << 8)
 #define GEN6_GT_MODE    0x20d0
 #define GEN7_GT_MODE    0x7008
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index fa486c5fbb02..aff4a113cda3 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -560,47 +560,71 @@ parse_edp(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
        dev_priv->vbt.edp_pps = *edp_pps;
-        dev_priv->vbt.edp_rate = edp_link_params->rate ? DP_LINK_BW_2_7 :
+        switch (edp_link_params->rate) {
-                DP_LINK_BW_1_62;
+        case EDP_RATE_1_62:
+                dev_priv->vbt.edp_rate = DP_LINK_BW_1_62;
+                break;
+        case EDP_RATE_2_7:
+                dev_priv->vbt.edp_rate = DP_LINK_BW_2_7;
+                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP link rate value %u\n",
+                              edp_link_params->rate);
+                break;
+        }
        switch (edp_link_params->lanes) {
-        case 0:
+        case EDP_LANE_1:
                dev_priv->vbt.edp_lanes = 1;
                break;
-        case 1:
+        case EDP_LANE_2:
                dev_priv->vbt.edp_lanes = 2;
                break;
-        case 3:
+        case EDP_LANE_4:
-        default:
                dev_priv->vbt.edp_lanes = 4;
                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP lane count value %u\n",
+                              edp_link_params->lanes);
+                break;
        }
        switch (edp_link_params->preemphasis) {
-        case 0:
+        case EDP_PREEMPHASIS_NONE:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_0;
                break;
-        case 1:
+        case EDP_PREEMPHASIS_3_5dB:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_3_5;
                break;
-        case 2:
+        case EDP_PREEMPHASIS_6dB:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_6;
                break;
-        case 3:
+        case EDP_PREEMPHASIS_9_5dB:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_9_5;
                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP pre-emphasis value %u\n",
+                              edp_link_params->preemphasis);
+                break;
        }
        switch (edp_link_params->vswing) {
-        case 0:
+        case EDP_VSWING_0_4V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_400;
                break;
-        case 1:
+        case EDP_VSWING_0_6V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_600;
                break;
-        case 2:
+        case EDP_VSWING_0_8V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_800;
                break;
-        case 3:
+        case EDP_VSWING_1_2V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_1200;
                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP voltage swing value %u\n",
+                              edp_link_params->vswing);
+                break;
        }
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index dae976f51d83..48aa516a1ac0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9654,11 +9654,22 @@ intel_pipe_config_compare(struct drm_device *dev,
        PIPE_CONF_CHECK_I(pipe_src_w);
        PIPE_CONF_CHECK_I(pipe_src_h);
-        PIPE_CONF_CHECK_I(gmch_pfit.control);
+        /*
-        /* pfit ratios are autocomputed by the hw on gen4+ */
+         * FIXME: BIOS likes to set up a cloned config with lvds+external
-        if (INTEL_INFO(dev)->gen < 4)
+         * screen. Since we don't yet re-compute the pipe config when moving
-                PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
+         * just the lvds port away to another pipe the sw tracking won't match.
-        PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
+         *
+         * Proper atomic modesets with recomputed global state will fix this.
+         * Until then just don't check gmch state for inherited modes.
+         */
+        if (!PIPE_CONF_QUIRK(PIPE_CONFIG_QUIRK_INHERITED_MODE)) {
+                PIPE_CONF_CHECK_I(gmch_pfit.control);
+                /* pfit ratios are autocomputed by the hw on gen4+ */
+                if (INTEL_INFO(dev)->gen < 4)
+                        PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
+                PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
+        }
        PIPE_CONF_CHECK_I(pch_pfit.enabled);
        if (current_config->pch_pfit.enabled) {
                PIPE_CONF_CHECK_I(pch_pfit.pos);
@@ -11384,15 +11395,6 @@ void intel_modeset_init(struct drm_device *dev)
        }
 }
-static void
-intel_connector_break_all_links(struct intel_connector *connector)
-{
-        connector->base.dpms = DRM_MODE_DPMS_OFF;
-        connector->base.encoder = NULL;
-        connector->encoder->connectors_active = false;
-        connector->encoder->base.crtc = NULL;
-}
 static void intel_enable_pipe_a(struct drm_device *dev)
 {
        struct intel_connector *connector;
@@ -11474,8 +11476,17 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                        if (connector->encoder->base.crtc != &crtc->base)
                                continue;
-                        intel_connector_break_all_links(connector);
+                        connector->base.dpms = DRM_MODE_DPMS_OFF;
+                        connector->base.encoder = NULL;
                }
+                /* multiple connectors may have the same encoder:
+                 *  handle them and break crtc link separately */
+                list_for_each_entry(connector, &dev->mode_config.connector_list,
+                                    base.head)
+                        if (connector->encoder->base.crtc == &crtc->base) {
+                                connector->encoder->base.crtc = NULL;
+                                connector->encoder->connectors_active = false;
+                        }
                WARN_ON(crtc->active);
                crtc->base.enabled = false;
@@ -11557,6 +11568,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
                                      drm_get_encoder_name(&encoder->base));
                        encoder->disable(encoder);
                }
+                encoder->base.crtc = NULL;
+                encoder->connectors_active = false;
                /* Inconsistent output/port/pipe state happens presumably due to
                 * a bug in one of the get_hw_state functions. Or someplace else
@@ -11567,8 +11580,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
                                    base.head) {
                        if (connector->encoder != encoder)
                                continue;
+                        connector->base.dpms = DRM_MODE_DPMS_OFF;
-                        intel_connector_break_all_links(connector);
+                        connector->base.encoder = NULL;
                }
        }
        /* Enabled encoders without active connectors will be fixed in
@@ -11616,6 +11629,8 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
                            base.head) {
                memset(&crtc->config, 0, sizeof(crtc->config));
+                crtc->config.quirks |= PIPE_CONFIG_QUIRK_INHERITED_MODE;
                crtc->active = dev_priv->display.get_pipe_config(crtc,
                                                                 &crtc->config);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index d2a55884ad52..2a00cb828d20 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -105,7 +105,8 @@ intel_dp_max_link_bw(struct intel_dp *intel_dp)
        case DP_LINK_BW_2_7:
                break;
        case DP_LINK_BW_5_4: /* 1.2 capable displays may advertise higher bw */
-                if ((IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8) &&
+                if (((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) ||
+                     INTEL_INFO(dev)->gen >= 8) &&
                    intel_dp->dpcd[DP_DPCD_REV] >= 0x12)
                        max_link_bw = DP_LINK_BW_5_4;
                else
@@ -120,6 +121,22 @@ intel_dp_max_link_bw(struct intel_dp *intel_dp)
        return max_link_bw;
 }
+static u8 intel_dp_max_lane_count(struct intel_dp *intel_dp)
+{
+        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+        struct drm_device *dev = intel_dig_port->base.base.dev;
+        u8 source_max, sink_max;
+        source_max = 4;
+        if (HAS_DDI(dev) && intel_dig_port->port == PORT_A &&
+            (intel_dig_port->saved_port_bits & DDI_A_4_LANES) == 0)
+                source_max = 2;
+        sink_max = drm_dp_max_lane_count(intel_dp->dpcd);
+        return min(source_max, sink_max);
+}
 /*
 * The units on the numbers in the next two are... bizarre.  Examples will
 * make it clearer; this one parallels an example in the eDP spec.
@@ -170,7 +187,7 @@ intel_dp_mode_valid(struct drm_connector *connector,
        }
        max_link_clock = drm_dp_bw_code_to_link_rate(intel_dp_max_link_bw(intel_dp));
-        max_lanes = drm_dp_max_lane_count(intel_dp->dpcd);
+        max_lanes = intel_dp_max_lane_count(intel_dp);
        max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
        mode_rate = intel_dp_link_required(target_clock, 18);
@@ -750,8 +767,10 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        struct intel_crtc *intel_crtc = encoder->new_crtc;
        struct intel_connector *intel_connector = intel_dp->attached_connector;
        int lane_count, clock;
-        int max_lane_count = drm_dp_max_lane_count(intel_dp->dpcd);
+        int min_lane_count = 1;
+        int max_lane_count = intel_dp_max_lane_count(intel_dp);
        /* Conveniently, the link BW constants become indices with a shift...*/
+        int min_clock = 0;
        int max_clock = intel_dp_max_link_bw(intel_dp) >> 3;
        int bpp, mode_rate;
        static int bws[] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7, DP_LINK_BW_5_4 };
@@ -784,19 +803,38 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        /* Walk through all bpp values. Luckily they're all nicely spaced with 2
         * bpc in between. */
        bpp = pipe_config->pipe_bpp;
-        if (is_edp(intel_dp) && dev_priv->vbt.edp_bpp &&
+        if (is_edp(intel_dp)) {
-            dev_priv->vbt.edp_bpp < bpp) {
+                if (dev_priv->vbt.edp_bpp && dev_priv->vbt.edp_bpp < bpp) {
-                DRM_DEBUG_KMS("clamping bpp for eDP panel to BIOS-provided %i\n",
+                        DRM_DEBUG_KMS("clamping bpp for eDP panel to BIOS-provided %i\n",
-                              dev_priv->vbt.edp_bpp);
+                                      dev_priv->vbt.edp_bpp);
-                bpp = dev_priv->vbt.edp_bpp;
+                        bpp = dev_priv->vbt.edp_bpp;
+                }
+                if (IS_BROADWELL(dev)) {
+                        /* Yes, it's an ugly hack. */
+                        min_lane_count = max_lane_count;
+                        DRM_DEBUG_KMS("forcing lane count to max (%u) on BDW\n",
+                                      min_lane_count);
+                } else if (dev_priv->vbt.edp_lanes) {
+                        min_lane_count = min(dev_priv->vbt.edp_lanes,
+                                             max_lane_count);
+                        DRM_DEBUG_KMS("using min %u lanes per VBT\n",
+                                      min_lane_count);
+                }
+                if (dev_priv->vbt.edp_rate) {
+                        min_clock = min(dev_priv->vbt.edp_rate >> 3, max_clock);
+                        DRM_DEBUG_KMS("using min %02x link bw per VBT\n",
+                                      bws[min_clock]);
+                }
        }
        for (; bpp >= 6*3; bpp -= 2*3) {
                mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock,
                                                   bpp);
-                for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
+                for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
-                        for (clock = 0; clock <= max_clock; clock++) {
+                        for (clock = min_clock; clock <= max_clock; clock++) {
                                link_clock = drm_dp_bw_code_to_link_rate(bws[clock]);
                                link_avail = intel_dp_max_data_rate(link_clock,
                                                                    lane_count);
@@ -3619,7 +3657,8 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
 {
        struct drm_connector *connector = &intel_connector->base;
        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
-        struct drm_device *dev = intel_dig_port->base.base.dev;
+        struct intel_encoder *intel_encoder = &intel_dig_port->base;
+        struct drm_device *dev = intel_encoder->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_display_mode *fixed_mode = NULL;
        bool has_dpcd;
@@ -3629,6 +3668,14 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
        if (!is_edp(intel_dp))
                return true;
+        /* The VDD bit needs a power domain reference, so if the bit is already
+         * enabled when we boot, grab this reference. */
+        if (edp_have_panel_vdd(intel_dp)) {
+                enum intel_display_power_domain power_domain;
+                power_domain = intel_display_port_power_domain(intel_encoder);
+                intel_display_power_get(dev_priv, power_domain);
+        }
        /* Cache DPCD and EDID for edp. */
        intel_edp_panel_vdd_on(intel_dp);
        has_dpcd = intel_dp_get_dpcd(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0542de982260..328b1a70264b 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -236,7 +236,8 @@ struct intel_crtc_config {
         * tracked with quirk flags so that fastboot and state checker can act
         * accordingly.
         */
-#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS (1<<0) /* unreliable sync mode.flags */
+#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS       (1<<0) /* unreliable sync mode.flags */
+#define PIPE_CONFIG_QUIRK_INHERITED_MODE        (1<<1) /* mode inherited from firmware */
        unsigned long quirks;
        /* User requested mode, only valid as a starting point to
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index b4d44e62f0c7..f73ba5e6b7a8 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -132,6 +132,16 @@ static int intelfb_create(struct drm_fb_helper *helper,
        mutex_lock(&dev->struct_mutex);
+        if (intel_fb &&
+            (sizes->fb_width > intel_fb->base.width ||
+             sizes->fb_height > intel_fb->base.height)) {
+                DRM_DEBUG_KMS("BIOS fb too small (%dx%d), we require (%dx%d),"
+                              " releasing it\n",
+                              intel_fb->base.width, intel_fb->base.height,
+                              sizes->fb_width, sizes->fb_height);
+                drm_framebuffer_unreference(&intel_fb->base);
+                intel_fb = ifbdev->fb = NULL;
+        }
        if (!intel_fb || WARN_ON(!intel_fb->obj)) {
                DRM_DEBUG_KMS("no BIOS fb, allocating a new one\n");
                ret = intelfb_alloc(helper, sizes);
@@ -377,6 +387,15 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                                                          height);
                }
+                /* No preferred mode marked by the EDID? Are there any modes? */
+                if (!modes[i] && !list_empty(&connector->modes)) {
+                        DRM_DEBUG_KMS("using first mode listed on connector %s\n",
+                                      drm_get_connector_name(connector));
+                        modes[i] = list_first_entry(&connector->modes,
+                                                    struct drm_display_mode,
+                                                    head);
+                }
                /* last resort: use current mode */
                if (!modes[i]) {
                        /*
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index b0413e190625..157267aa3561 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -821,11 +821,11 @@ static void intel_disable_hdmi(struct intel_encoder *encoder)
        }
 }
-static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
+static int hdmi_portclock_limit(struct intel_hdmi *hdmi, bool respect_dvi_limit)
 {
        struct drm_device *dev = intel_hdmi_to_dev(hdmi);
-        if (!hdmi->has_hdmi_sink || IS_G4X(dev))
+        if ((respect_dvi_limit && !hdmi->has_hdmi_sink) || IS_G4X(dev))
                return 165000;
        else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
                return 300000;
@@ -837,7 +837,8 @@ static enum drm_mode_status
 intel_hdmi_mode_valid(struct drm_connector *connector,
                      struct drm_display_mode *mode)
 {
-        if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector)))
+        if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector),
+                                               true))
                return MODE_CLOCK_HIGH;
        if (mode->clock < 20000)
                return MODE_CLOCK_LOW;
@@ -879,7 +880,7 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
        struct drm_device *dev = encoder->base.dev;
        struct drm_display_mode *adjusted_mode = &pipe_config->adjusted_mode;
        int clock_12bpc = pipe_config->adjusted_mode.crtc_clock * 3 / 2;
-        int portclock_limit = hdmi_portclock_limit(intel_hdmi);
+        int portclock_limit = hdmi_portclock_limit(intel_hdmi, false);
        int desired_bpp;
        if (intel_hdmi->color_range_auto) {
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 0eead16aeda7..cb8cfb7e0974 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -492,6 +492,7 @@ void intel_panel_set_backlight(struct intel_connector *connector, u32 level,
        enum pipe pipe = intel_get_pipe_from_connector(connector);
        u32 freq;
        unsigned long flags;
+        u64 n;
        if (!panel->backlight.present || pipe == INVALID_PIPE)
                return;
@@ -502,10 +503,9 @@ void intel_panel_set_backlight(struct intel_connector *connector, u32 level,
        /* scale to hardware max, but be careful to not overflow */
        freq = panel->backlight.max;
-        if (freq < max)
+        n = (u64)level * freq;
-                level = level * freq / max;
+        do_div(n, max);
-        else
+        level = n;
-                level = freq / max * level;
        panel->backlight.level = level;
        if (panel->backlight.device)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 19e94c3edc19..d93dcf683e8c 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2095,6 +2095,43 @@ static void intel_print_wm_latency(struct drm_device *dev,
        }
 }
+static bool ilk_increase_wm_latency(struct drm_i915_private *dev_priv,
+                                    uint16_t wm[5], uint16_t min)
+{
+        int level, max_level = ilk_wm_max_level(dev_priv->dev);
+        if (wm[0] >= min)
+                return false;
+        wm[0] = max(wm[0], min);
+        for (level = 1; level <= max_level; level++)
+                wm[level] = max_t(uint16_t, wm[level], DIV_ROUND_UP(min, 5));
+        return true;
+}
+static void snb_wm_latency_quirk(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        bool changed;
+        /*
+         * The BIOS provided WM memory latency values are often
+         * inadequate for high resolution displays. Adjust them.
+         */
+        changed = ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 12) |
+                ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12) |
+                ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12);
+        if (!changed)
+                return;
+        DRM_DEBUG_KMS("WM latency values increased to avoid potential underruns\n");
+        intel_print_wm_latency(dev, "Primary", dev_priv->wm.pri_latency);
+        intel_print_wm_latency(dev, "Sprite", dev_priv->wm.spr_latency);
+        intel_print_wm_latency(dev, "Cursor", dev_priv->wm.cur_latency);
+}
 static void ilk_setup_wm_latency(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -2112,6 +2149,9 @@ static void ilk_setup_wm_latency(struct drm_device *dev)
        intel_print_wm_latency(dev, "Primary", dev_priv->wm.pri_latency);
        intel_print_wm_latency(dev, "Sprite", dev_priv->wm.spr_latency);
        intel_print_wm_latency(dev, "Cursor", dev_priv->wm.cur_latency);
+        if (IS_GEN6(dev))
+                snb_wm_latency_quirk(dev);
 }
 static void ilk_compute_wm_parameters(struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 6bc68bdcf433..79fb4cc2137c 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -437,32 +437,41 @@ static void ring_setup_phys_status_page(struct intel_ring_buffer *ring)
        I915_WRITE(HWS_PGA, addr);
 }
-static int init_ring_common(struct intel_ring_buffer *ring)
+static bool stop_ring(struct intel_ring_buffer *ring)
 {
-        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = to_i915(ring->dev);
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj = ring->obj;
-        int ret = 0;
-        u32 head;
-        gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
+        if (!IS_GEN2(ring->dev)) {
+                I915_WRITE_MODE(ring, _MASKED_BIT_ENABLE(STOP_RING));
+                if (wait_for_atomic((I915_READ_MODE(ring) & MODE_IDLE) != 0, 1000)) {
+                        DRM_ERROR("%s :timed out trying to stop ring\n", ring->name);
+                        return false;
+                }
+        }
-        /* Stop the ring if it's running. */
        I915_WRITE_CTL(ring, 0);
        I915_WRITE_HEAD(ring, 0);
        ring->write_tail(ring, 0);
-        if (wait_for_atomic((I915_READ_MODE(ring) & MODE_IDLE) != 0, 1000))
-                DRM_ERROR("%s :timed out trying to stop ring\n", ring->name);
-        if (I915_NEED_GFX_HWS(dev))
+        if (!IS_GEN2(ring->dev)) {
-                intel_ring_setup_status_page(ring);
+                (void)I915_READ_CTL(ring);
-        else
+                I915_WRITE_MODE(ring, _MASKED_BIT_DISABLE(STOP_RING));
-                ring_setup_phys_status_page(ring);
+        }
-        head = I915_READ_HEAD(ring) & HEAD_ADDR;
+        return (I915_READ_HEAD(ring) & HEAD_ADDR) == 0;
+}
-        /* G45 ring initialization fails to reset head to zero */
+static int init_ring_common(struct intel_ring_buffer *ring)
-        if (head != 0) {
+{
+        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj = ring->obj;
+        int ret = 0;
+        gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
+        if (!stop_ring(ring)) {
+                /* G45 ring initialization often fails to reset head to zero */
                DRM_DEBUG_KMS("%s head not reset to zero "
                              "ctl %08x head %08x tail %08x start %08x\n",
                              ring->name,
@@ -471,9 +480,7 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                              I915_READ_TAIL(ring),
                              I915_READ_START(ring));
-                I915_WRITE_HEAD(ring, 0);
+                if (!stop_ring(ring)) {
-                if (I915_READ_HEAD(ring) & HEAD_ADDR) {
                        DRM_ERROR("failed to set %s head to zero "
                                  "ctl %08x head %08x tail %08x start %08x\n",
                                  ring->name,
@@ -481,9 +488,16 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                                  I915_READ_HEAD(ring),
                                  I915_READ_TAIL(ring),
                                  I915_READ_START(ring));
+                        ret = -EIO;
+                        goto out;
                }
        }
+        if (I915_NEED_GFX_HWS(dev))
+                intel_ring_setup_status_page(ring);
+        else
+                ring_setup_phys_status_page(ring);
        /* Initialize the ring. This must happen _after_ we've cleared the ring
         * registers with the above sequence (the readback of the HEAD registers
         * also enforces ordering), otherwise the hw might lose the new ring
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 270a6a973438..2b91c4b4d34b 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -34,6 +34,7 @@ struct  intel_hw_status_page {
 #define I915_WRITE_IMR(ring, val) I915_WRITE(RING_IMR((ring)->mmio_base), val)
 #define I915_READ_MODE(ring) I915_READ(RING_MI_MODE((ring)->mmio_base))
+#define I915_WRITE_MODE(ring, val) I915_WRITE(RING_MI_MODE((ring)->mmio_base), val)
 enum intel_ring_hangcheck_action {
        HANGCHECK_IDLE = 0,
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index d27155adf5db..46be00d66df3 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2424,8 +2424,8 @@ intel_sdvo_connector_init(struct intel_sdvo_connector *connector,
        if (ret < 0)
                goto err1;
-        ret = sysfs_create_link(&encoder->ddc.dev.kobj,
+        ret = sysfs_create_link(&drm_connector->kdev->kobj,
-                                &drm_connector->kdev->kobj,
+                                &encoder->ddc.dev.kobj,
                                encoder->ddc.dev.kobj.name);
        if (ret < 0)
                goto err2;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index f729dc71d5be..d0c75779d3f6 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -185,6 +185,8 @@ static void vlv_force_wake_reset(struct drm_i915_private *dev_priv)
 {
        __raw_i915_write32(dev_priv, FORCEWAKE_VLV,
                           _MASKED_BIT_DISABLE(0xffff));
+        __raw_i915_write32(dev_priv, FORCEWAKE_MEDIA_VLV,
+                           _MASKED_BIT_DISABLE(0xffff));
        /* something from same cacheline, but !FORCEWAKE_VLV */
        __raw_posting_read(dev_priv, FORCEWAKE_ACK_VLV);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
index 3e6c0f3ed592..ef9957dbac94 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
@@ -510,9 +510,8 @@ static void update_cursor(struct drm_crtc *crtc)
                                        MDP4_DMA_CURSOR_BLEND_CONFIG_CURSOR_EN);
                } else {
                        /* disable cursor: */
-                        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma), 0);
+                        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma),
-                        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BLEND_CONFIG(dma),
+                                        mdp4_kms->blank_cursor_iova);
-                                        MDP4_DMA_CURSOR_BLEND_CONFIG_FORMAT(CURSOR_ARGB));
                }
                /* and drop the iova ref + obj rev when done scanning out: */
@@ -574,11 +573,9 @@ static int mdp4_crtc_cursor_set(struct drm_crtc *crtc,
        if (old_bo) {
                /* drop our previous reference: */
-                msm_gem_put_iova(old_bo, mdp4_kms->id);
+                drm_flip_work_queue(&mdp4_crtc->unref_cursor_work, old_bo);
-                drm_gem_object_unreference_unlocked(old_bo);
        }
-        crtc_flush(crtc);
        request_pending(crtc, PENDING_CURSOR);
        return 0;
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
index c740ccd1cc67..8edd531cb621 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
@@ -70,12 +70,12 @@ irqreturn_t mdp4_irq(struct msm_kms *kms)
        VERB("status=%08x", status);
+        mdp_dispatch_irqs(mdp_kms, status);
        for (id = 0; id < priv->num_crtcs; id++)
                if (status & mdp4_crtc_vblank(priv->crtcs[id]))
                        drm_handle_vblank(dev, id);
-        mdp_dispatch_irqs(mdp_kms, status);
        return IRQ_HANDLED;
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c
index 272e707c9487..0bb4faa17523 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c
@@ -144,6 +144,10 @@ static void mdp4_preclose(struct msm_kms *kms, struct drm_file *file)
 static void mdp4_destroy(struct msm_kms *kms)
 {
        struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+        if (mdp4_kms->blank_cursor_iova)
+                msm_gem_put_iova(mdp4_kms->blank_cursor_bo, mdp4_kms->id);
+        if (mdp4_kms->blank_cursor_bo)
+                drm_gem_object_unreference(mdp4_kms->blank_cursor_bo);
        kfree(mdp4_kms);
 }
@@ -372,6 +376,23 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
                goto fail;
        }
+        mutex_lock(&dev->struct_mutex);
+        mdp4_kms->blank_cursor_bo = msm_gem_new(dev, SZ_16K, MSM_BO_WC);
+        mutex_unlock(&dev->struct_mutex);
+        if (IS_ERR(mdp4_kms->blank_cursor_bo)) {
+                ret = PTR_ERR(mdp4_kms->blank_cursor_bo);
+                dev_err(dev->dev, "could not allocate blank-cursor bo: %d\n", ret);
+                mdp4_kms->blank_cursor_bo = NULL;
+                goto fail;
+        }
+        ret = msm_gem_get_iova(mdp4_kms->blank_cursor_bo, mdp4_kms->id,
+                        &mdp4_kms->blank_cursor_iova);
+        if (ret) {
+                dev_err(dev->dev, "could not pin blank-cursor bo: %d\n", ret);
+                goto fail;
+        }
        return kms;
 fail:
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h
index 66a4d31aec80..715520c54cde 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h
@@ -44,6 +44,10 @@ struct mdp4_kms {
        struct clk *lut_clk;
        struct mdp_irq error_handler;
+        /* empty/blank cursor bo to use when cursor is "disabled" */
+        struct drm_gem_object *blank_cursor_bo;
+        uint32_t blank_cursor_iova;
 };
 #define to_mdp4_kms(x) container_of(x, struct mdp4_kms, base)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
index 353d494a497f..f2b985bc2adf 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
@@ -71,11 +71,11 @@ static void mdp5_irq_mdp(struct mdp_kms *mdp_kms)
        VERB("status=%08x", status);
+        mdp_dispatch_irqs(mdp_kms, status);
        for (id = 0; id < priv->num_crtcs; id++)
                if (status & mdp5_crtc_vblank(priv->crtcs[id]))
                        drm_handle_vblank(dev, id);
-        mdp_dispatch_irqs(mdp_kms, status);
 }
 irqreturn_t mdp5_irq(struct msm_kms *kms)
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index 6c6d7d4c9b4e..a752ab83b810 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -62,11 +62,8 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
        dma_addr_t paddr;
        int ret, size;
-        /* only doing ARGB32 since this is what is needed to alpha-blend
-         * with video overlays:
-         */
        sizes->surface_bpp = 32;
-        sizes->surface_depth = 32;
+        sizes->surface_depth = 24;
        DBG("create fbdev: %dx%d@%d (%dx%d)", sizes->surface_width,
                        sizes->surface_height, sizes->surface_bpp,
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 3da8264d3039..bb8026daebc9 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -118,8 +118,10 @@ static void put_pages(struct drm_gem_object *obj)
                if (iommu_present(&platform_bus_type))
                        drm_gem_put_pages(obj, msm_obj->pages, true, false);
-                else
+                else {
                        drm_mm_remove_node(msm_obj->vram_node);
+                        drm_free_large(msm_obj->pages);
+                }
                msm_obj->pages = NULL;
        }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c
index 1dc37b1ddbfa..b0d0fb2f4d08 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c
@@ -863,7 +863,7 @@ gm107_grctx_generate_mods(struct nvc0_graph_priv *priv, struct nvc0_grctx *info)
 {
        mmio_data(0x003000, 0x0100, NV_MEM_ACCESS_RW | NV_MEM_ACCESS_SYS);
        mmio_data(0x008000, 0x0100, NV_MEM_ACCESS_RW | NV_MEM_ACCESS_SYS);
-        mmio_data(0x060000, 0x1000, NV_MEM_ACCESS_RW);
+        mmio_data(0x200000, 0x1000, NV_MEM_ACCESS_RW);
        mmio_list(0x40800c, 0x00000000,  8, 1);
        mmio_list(0x408010, 0x80000000,  0, 0);
@@ -877,6 +877,8 @@ gm107_grctx_generate_mods(struct nvc0_graph_priv *priv, struct nvc0_grctx *info)
        mmio_list(0x418e24, 0x00000000,  8, 0);
        mmio_list(0x418e28, 0x80000030,  0, 0);
+        mmio_list(0x4064c8, 0x018002c0,  0, 0);
        mmio_list(0x418810, 0x80000000, 12, 2);
        mmio_list(0x419848, 0x10000000, 12, 2);
        mmio_list(0x419c2c, 0x10000000, 12, 2);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
index fb0b6b2d1427..222e8ebb669d 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
@@ -168,7 +168,8 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
         */
        i = 16;
        do {
-                if ((nv_rd32(bios, 0x300000) & 0xffff) == 0xaa55)
+                u32 data = le32_to_cpu(nv_rd32(bios, 0x300000)) & 0xffff;
+                if (data == 0xaa55)
                        break;
        } while (i--);
@@ -176,14 +177,15 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
                goto out;
        /* read entire bios image to system memory */
-        bios->size = ((nv_rd32(bios, 0x300000) >> 16) & 0xff) * 512;
+        bios->size = (le32_to_cpu(nv_rd32(bios, 0x300000)) >> 16) & 0xff;
+        bios->size = bios->size * 512;
        if (!bios->size)
                goto out;
        bios->data = kmalloc(bios->size, GFP_KERNEL);
        if (bios->data) {
-                for (i = 0; i < bios->size; i+=4)
+                for (i = 0; i < bios->size; i += 4)
-                        nv_wo32(bios, i, nv_rd32(bios, 0x300000 + i));
+                        ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
        }
        /* check the PCI record header */
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 83face3f608f..279206997e5c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -389,9 +389,6 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev)
        acpi_status status;
        acpi_handle dhandle, rom_handle;
-        if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
-                return false;
        dhandle = ACPI_HANDLE(&pdev->dev);
        if (!dhandle)
                return false;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 3ff030dc1ee3..da764a4ed958 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -764,9 +764,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        }
        ret = nouveau_page_flip_emit(chan, old_bo, new_bo, s, &fence);
-        mutex_unlock(&chan->cli->mutex);
        if (ret)
                goto fail_unreserve;
+        mutex_unlock(&chan->cli->mutex);
        /* Update the crtc struct and cleanup */
        crtc->primary->fb = fb;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index fb187c78978f..c31c12b4e666 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1177,27 +1177,43 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                /* Set NUM_BANKS. */
                if (rdev->family >= CHIP_TAHITI) {
-                        unsigned tileb, index, num_banks, tile_split_bytes;
+                        unsigned index, num_banks;
-                        /* Calculate the macrotile mode index. */
+                        if (rdev->family >= CHIP_BONAIRE) {
-                        tile_split_bytes = 64 << tile_split;
+                                unsigned tileb, tile_split_bytes;
-                        tileb = 8 * 8 * target_fb->bits_per_pixel / 8;
-                        tileb = min(tile_split_bytes, tileb);
-                        for (index = 0; tileb > 64; index++) {
+                                /* Calculate the macrotile mode index. */
-                                tileb >>= 1;
+                                tile_split_bytes = 64 << tile_split;
-                        }
+                                tileb = 8 * 8 * target_fb->bits_per_pixel / 8;
+                                tileb = min(tile_split_bytes, tileb);
-                        if (index >= 16) {
+                                for (index = 0; tileb > 64; index++)
-                                DRM_ERROR("Wrong screen bpp (%u) or tile split (%u)\n",
+                                        tileb >>= 1;
-                                          target_fb->bits_per_pixel, tile_split);
-                                return -EINVAL;
+                                if (index >= 16) {
-                        }
+                                        DRM_ERROR("Wrong screen bpp (%u) or tile split (%u)\n",
+                                                  target_fb->bits_per_pixel, tile_split);
+                                        return -EINVAL;
+                                }
-                        if (rdev->family >= CHIP_BONAIRE)
                                num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
-                        else
+                        } else {
+                                switch (target_fb->bits_per_pixel) {
+                                case 8:
+                                        index = 10;
+                                        break;
+                                case 16:
+                                        index = SI_TILE_MODE_COLOR_2D_SCANOUT_16BPP;
+                                        break;
+                                default:
+                                case 32:
+                                        index = SI_TILE_MODE_COLOR_2D_SCANOUT_32BPP;
+                                        break;
+                                }
                                num_banks = (rdev->config.si.tile_mode_array[index] >> 20) & 0x3;
+                        }
                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(num_banks);
                } else {
                        /* NI and older. */
@@ -1720,8 +1736,9 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                }
                /* otherwise, pick one of the plls */
                if ((rdev->family == CHIP_KAVERI) ||
-                    (rdev->family == CHIP_KABINI)) {
+                    (rdev->family == CHIP_KABINI) ||
-                        /* KB/KV has PPLL1 and PPLL2 */
+                    (rdev->family == CHIP_MULLINS)) {
+                        /* KB/KV/ML has PPLL1 and PPLL2 */
                        pll_in_use = radeon_get_pll_use_mask(crtc);
                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                return ATOM_PPLL2;
@@ -1885,6 +1902,9 @@ int atombios_crtc_mode_set(struct drm_crtc *crtc,
            (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT))
                is_tvcv = true;
+        if (!radeon_crtc->adjusted_clock)
+                return -EINVAL;
        atombios_crtc_set_pll(crtc, adjusted_mode);
        if (ASIC_IS_DCE4(rdev))
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 15936524f226..54e4f52549af 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -209,6 +209,7 @@ void radeon_dp_aux_init(struct radeon_connector *radeon_connector)
 {
        int ret;
+        radeon_connector->ddc_bus->rec.hpd = radeon_connector->hpd.hpd;
        radeon_connector->ddc_bus->aux.dev = radeon_connector->base.kdev;
        radeon_connector->ddc_bus->aux.transfer = radeon_dp_aux_transfer;
        ret = drm_dp_aux_register_i2c_bus(&radeon_connector->ddc_bus->aux);
@@ -365,11 +366,11 @@ static void radeon_dp_probe_oui(struct radeon_connector *radeon_connector)
        if (!(dig_connector->dpcd[DP_DOWN_STREAM_PORT_COUNT] & DP_OUI_SUPPORT))
                return;
-        if (drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_SINK_OUI, buf, 3))
+        if (drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_SINK_OUI, buf, 3) == 3)
                DRM_DEBUG_KMS("Sink OUI: %02hx%02hx%02hx\n",
                              buf[0], buf[1], buf[2]);
-        if (drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_BRANCH_OUI, buf, 3))
+        if (drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_BRANCH_OUI, buf, 3) == 3)
                DRM_DEBUG_KMS("Branch OUI: %02hx%02hx%02hx\n",
                              buf[0], buf[1], buf[2]);
 }
@@ -418,21 +419,23 @@ int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
        if (dp_bridge != ENCODER_OBJECT_ID_NONE) {
                /* DP bridge chips */
-                drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux,
+                if (drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux,
-                                  DP_EDP_CONFIGURATION_CAP, &tmp);
+                                      DP_EDP_CONFIGURATION_CAP, &tmp) == 1) {
-                if (tmp & 1)
+                        if (tmp & 1)
-                        panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+                                panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
-                else if ((dp_bridge == ENCODER_OBJECT_ID_NUTMEG) ||
+                        else if ((dp_bridge == ENCODER_OBJECT_ID_NUTMEG) ||
-                         (dp_bridge == ENCODER_OBJECT_ID_TRAVIS))
+                                 (dp_bridge == ENCODER_OBJECT_ID_TRAVIS))
-                        panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
+                                panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
-                else
+                        else
-                        panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+                                panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+                }
        } else if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
                /* eDP */
-                drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux,
+                if (drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux,
-                                  DP_EDP_CONFIGURATION_CAP, &tmp);
+                                      DP_EDP_CONFIGURATION_CAP, &tmp) == 1) {
-                if (tmp & 1)
+                        if (tmp & 1)
-                        panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+                                panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+                }
        }
        return panel_mode;
@@ -808,11 +811,15 @@ void radeon_dp_link_train(struct drm_encoder *encoder,
        else
                dp_info.enc_id |= ATOM_DP_CONFIG_LINK_A;
-        drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux, DP_MAX_LANE_COUNT, &tmp);
+        if (drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux, DP_MAX_LANE_COUNT, &tmp)
-        if (ASIC_IS_DCE5(rdev) && (tmp & DP_TPS3_SUPPORTED))
+            == 1) {
-                dp_info.tp3_supported = true;
+                if (ASIC_IS_DCE5(rdev) && (tmp & DP_TPS3_SUPPORTED))
-        else
+                        dp_info.tp3_supported = true;
+                else
+                        dp_info.tp3_supported = false;
+        } else {
                dp_info.tp3_supported = false;
+        }
        memcpy(dp_info.dpcd, dig_connector->dpcd, DP_RECEIVER_CAP_SIZE);
        dp_info.rdev = rdev;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 199eb194716f..d2fd98968085 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -63,6 +63,12 @@ MODULE_FIRMWARE("radeon/KABINI_ce.bin");
 MODULE_FIRMWARE("radeon/KABINI_mec.bin");
 MODULE_FIRMWARE("radeon/KABINI_rlc.bin");
 MODULE_FIRMWARE("radeon/KABINI_sdma.bin");
+MODULE_FIRMWARE("radeon/MULLINS_pfp.bin");
+MODULE_FIRMWARE("radeon/MULLINS_me.bin");
+MODULE_FIRMWARE("radeon/MULLINS_ce.bin");
+MODULE_FIRMWARE("radeon/MULLINS_mec.bin");
+MODULE_FIRMWARE("radeon/MULLINS_rlc.bin");
+MODULE_FIRMWARE("radeon/MULLINS_sdma.bin");
 extern int r600_ih_ring_alloc(struct radeon_device *rdev);
 extern void r600_ih_ring_fini(struct radeon_device *rdev);
@@ -1473,6 +1479,43 @@ static const u32 hawaii_mgcg_cgcg_init[] =
        0xd80c, 0xff000ff0, 0x00000100
 };
+static const u32 godavari_golden_registers[] =
+{
+        0x55e4, 0xff607fff, 0xfc000100,
+        0x6ed8, 0x00010101, 0x00010000,
+        0x9830, 0xffffffff, 0x00000000,
+        0x98302, 0xf00fffff, 0x00000400,
+        0x6130, 0xffffffff, 0x00010000,
+        0x5bb0, 0x000000f0, 0x00000070,
+        0x5bc0, 0xf0311fff, 0x80300000,
+        0x98f8, 0x73773777, 0x12010001,
+        0x98fc, 0xffffffff, 0x00000010,
+        0x8030, 0x00001f0f, 0x0000100a,
+        0x2f48, 0x73773777, 0x12010001,
+        0x2408, 0x000fffff, 0x000c007f,
+        0x8a14, 0xf000003f, 0x00000007,
+        0x8b24, 0xffffffff, 0x00ff0fff,
+        0x30a04, 0x0000ff0f, 0x00000000,
+        0x28a4c, 0x07ffffff, 0x06000000,
+        0x4d8, 0x00000fff, 0x00000100,
+        0xd014, 0x00010000, 0x00810001,
+        0xd814, 0x00010000, 0x00810001,
+        0x3e78, 0x00000001, 0x00000002,
+        0xc768, 0x00000008, 0x00000008,
+        0xc770, 0x00000f00, 0x00000800,
+        0xc774, 0x00000f00, 0x00000800,
+        0xc798, 0x00ffffff, 0x00ff7fbf,
+        0xc79c, 0x00ffffff, 0x00ff7faf,
+        0x8c00, 0x000000ff, 0x00000001,
+        0x214f8, 0x01ff01ff, 0x00000002,
+        0x21498, 0x007ff800, 0x00200000,
+        0x2015c, 0xffffffff, 0x00000f40,
+        0x88c4, 0x001f3ae3, 0x00000082,
+        0x88d4, 0x0000001f, 0x00000010,
+        0x30934, 0xffffffff, 0x00000000
+};
 static void cik_init_golden_registers(struct radeon_device *rdev)
 {
        switch (rdev->family) {
@@ -1504,6 +1547,20 @@ static void cik_init_golden_registers(struct radeon_device *rdev)
                                                 kalindi_golden_spm_registers,
                                                 (const u32)ARRAY_SIZE(kalindi_golden_spm_registers));
                break;
+        case CHIP_MULLINS:
+                radeon_program_register_sequence(rdev,
+                                                 kalindi_mgcg_cgcg_init,
+                                                 (const u32)ARRAY_SIZE(kalindi_mgcg_cgcg_init));
+                radeon_program_register_sequence(rdev,
+                                                 godavari_golden_registers,
+                                                 (const u32)ARRAY_SIZE(godavari_golden_registers));
+                radeon_program_register_sequence(rdev,
+                                                 kalindi_golden_common_registers,
+                                                 (const u32)ARRAY_SIZE(kalindi_golden_common_registers));
+                radeon_program_register_sequence(rdev,
+                                                 kalindi_golden_spm_registers,
+                                                 (const u32)ARRAY_SIZE(kalindi_golden_spm_registers));
+                break;
        case CHIP_KAVERI:
                radeon_program_register_sequence(rdev,
                                                 spectre_mgcg_cgcg_init,
@@ -1834,6 +1891,15 @@ static int cik_init_microcode(struct radeon_device *rdev)
                rlc_req_size = KB_RLC_UCODE_SIZE * 4;
                sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
                break;
+        case CHIP_MULLINS:
+                chip_name = "MULLINS";
+                pfp_req_size = CIK_PFP_UCODE_SIZE * 4;
+                me_req_size = CIK_ME_UCODE_SIZE * 4;
+                ce_req_size = CIK_CE_UCODE_SIZE * 4;
+                mec_req_size = CIK_MEC_UCODE_SIZE * 4;
+                rlc_req_size = ML_RLC_UCODE_SIZE * 4;
+                sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
+                break;
        default: BUG();
        }
@@ -3272,6 +3338,7 @@ static void cik_gpu_init(struct radeon_device *rdev)
                gb_addr_config = BONAIRE_GB_ADDR_CONFIG_GOLDEN;
                break;
        case CHIP_KABINI:
+        case CHIP_MULLINS:
        default:
                rdev->config.cik.max_shader_engines = 1;
                rdev->config.cik.max_tile_pipes = 2;
@@ -3702,6 +3769,7 @@ int cik_copy_cpdma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
@@ -5800,6 +5868,9 @@ static int cik_rlc_resume(struct radeon_device *rdev)
        case CHIP_KABINI:
                size = KB_RLC_UCODE_SIZE;
                break;
+        case CHIP_MULLINS:
+                size = ML_RLC_UCODE_SIZE;
+                break;
        }
        cik_rlc_stop(rdev);
@@ -6548,6 +6619,7 @@ void cik_get_csb_buffer(struct radeon_device *rdev, volatile u32 *buffer)
                buffer[count++] = cpu_to_le32(0x00000000);
                break;
        case CHIP_KABINI:
+        case CHIP_MULLINS:
                buffer[count++] = cpu_to_le32(0x00000000); /* XXX */
                buffer[count++] = cpu_to_le32(0x00000000);
                break;
@@ -6693,6 +6765,19 @@ static void cik_disable_interrupt_state(struct radeon_device *rdev)
                WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC4_REGISTER_OFFSET, 0);
                WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, 0);
        }
+        /* pflip */
+        if (rdev->num_crtc >= 2) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
+        }
+        if (rdev->num_crtc >= 4) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, 0);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, 0);
+        }
+        if (rdev->num_crtc >= 6) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, 0);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, 0);
+        }
        /* dac hotplug */
        WREG32(DAC_AUTODETECT_INT_CONTROL, 0);
@@ -7049,6 +7134,25 @@ int cik_irq_set(struct radeon_device *rdev)
                WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, crtc6);
        }
+        if (rdev->num_crtc >= 2) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+        }
+        if (rdev->num_crtc >= 4) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+        }
+        if (rdev->num_crtc >= 6) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+        }
        WREG32(DC_HPD1_INT_CONTROL, hpd1);
        WREG32(DC_HPD2_INT_CONTROL, hpd2);
        WREG32(DC_HPD3_INT_CONTROL, hpd3);
@@ -7085,6 +7189,29 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
        rdev->irq.stat_regs.cik.disp_int_cont5 = RREG32(DISP_INTERRUPT_STATUS_CONTINUE5);
        rdev->irq.stat_regs.cik.disp_int_cont6 = RREG32(DISP_INTERRUPT_STATUS_CONTINUE6);
+        rdev->irq.stat_regs.cik.d1grph_int = RREG32(GRPH_INT_STATUS +
+                EVERGREEN_CRTC0_REGISTER_OFFSET);
+        rdev->irq.stat_regs.cik.d2grph_int = RREG32(GRPH_INT_STATUS +
+                EVERGREEN_CRTC1_REGISTER_OFFSET);
+        if (rdev->num_crtc >= 4) {
+                rdev->irq.stat_regs.cik.d3grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC2_REGISTER_OFFSET);
+                rdev->irq.stat_regs.cik.d4grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC3_REGISTER_OFFSET);
+        }
+        if (rdev->num_crtc >= 6) {
+                rdev->irq.stat_regs.cik.d5grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC4_REGISTER_OFFSET);
+                rdev->irq.stat_regs.cik.d6grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC5_REGISTER_OFFSET);
+        }
+        if (rdev->irq.stat_regs.cik.d1grph_int & GRPH_PFLIP_INT_OCCURRED)
+                WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC0_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_CLEAR);
+        if (rdev->irq.stat_regs.cik.d2grph_int & GRPH_PFLIP_INT_OCCURRED)
+                WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC1_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_CLEAR);
        if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT)
                WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC0_REGISTER_OFFSET, VBLANK_ACK);
        if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT)
@@ -7095,6 +7222,12 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                WREG32(LB_VLINE_STATUS + EVERGREEN_CRTC1_REGISTER_OFFSET, VLINE_ACK);
        if (rdev->num_crtc >= 4) {
+                if (rdev->irq.stat_regs.cik.d3grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC2_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
+                if (rdev->irq.stat_regs.cik.d4grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
                if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT)
                        WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC2_REGISTER_OFFSET, VBLANK_ACK);
                if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT)
@@ -7106,6 +7239,12 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
        }
        if (rdev->num_crtc >= 6) {
+                if (rdev->irq.stat_regs.cik.d5grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC4_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
+                if (rdev->irq.stat_regs.cik.d6grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
                if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT)
                        WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC4_REGISTER_OFFSET, VBLANK_ACK);
                if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT)
@@ -7457,6 +7596,15 @@ restart_ih:
                                break;
                        }
                        break;
+                case 8: /* D1 page flip */
+                case 10: /* D2 page flip */
+                case 12: /* D3 page flip */
+                case 14: /* D4 page flip */
+                case 16: /* D5 page flip */
+                case 18: /* D6 page flip */
+                        DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
+                        radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
+                        break;
                case 42: /* HPD hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 89b4afa5041c..72e464c79a88 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -562,6 +562,7 @@ int cik_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
@@ -597,7 +598,7 @@ int cik_sdma_ring_test(struct radeon_device *rdev,
        tmp = 0xCAFEDEAD;
        writel(tmp, ptr);
-        r = radeon_ring_lock(rdev, ring, 4);
+        r = radeon_ring_lock(rdev, ring, 5);
        if (r) {
                DRM_ERROR("radeon: dma failed to lock ring %d (%d).\n", ring->idx, r);
                return r;
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index 213873270d5f..dd7926394a8f 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -888,6 +888,15 @@
 #       define DC_HPD6_RX_INTERRUPT                     (1 << 18)
 #define DISP_INTERRUPT_STATUS_CONTINUE6                 0x6780
+/* 0x6858, 0x7458, 0x10058, 0x10c58, 0x11858, 0x12458 */
+#define GRPH_INT_STATUS                                 0x6858
+#       define GRPH_PFLIP_INT_OCCURRED                  (1 << 0)
+#       define GRPH_PFLIP_INT_CLEAR                     (1 << 8)
+/* 0x685c, 0x745c, 0x1005c, 0x10c5c, 0x1185c, 0x1245c */
+#define GRPH_INT_CONTROL                                0x685c
+#       define GRPH_PFLIP_INT_MASK                      (1 << 0)
+#       define GRPH_PFLIP_INT_TYPE                      (1 << 8)
 #define DAC_AUTODETECT_INT_CONTROL                      0x67c8
 #define DC_HPD1_INT_STATUS                              0x601c
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index b406546440da..0f7a51a3694f 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -4371,7 +4371,6 @@ int evergreen_irq_set(struct radeon_device *rdev)
        u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
        u32 hpd1, hpd2, hpd3, hpd4, hpd5, hpd6;
        u32 grbm_int_cntl = 0;
-        u32 grph1 = 0, grph2 = 0, grph3 = 0, grph4 = 0, grph5 = 0, grph6 = 0;
        u32 afmt1 = 0, afmt2 = 0, afmt3 = 0, afmt4 = 0, afmt5 = 0, afmt6 = 0;
        u32 dma_cntl, dma_cntl1 = 0;
        u32 thermal_int = 0;
@@ -4554,15 +4553,21 @@ int evergreen_irq_set(struct radeon_device *rdev)
                WREG32(INT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, crtc6);
        }
-        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, grph1);
+        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
-        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, grph2);
+               GRPH_PFLIP_INT_MASK);
+        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
+               GRPH_PFLIP_INT_MASK);
        if (rdev->num_crtc >= 4) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, grph3);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, grph4);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (rdev->num_crtc >= 6) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, grph5);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, grph6);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        WREG32(DC_HPD1_INT_CONTROL, hpd1);
@@ -4951,6 +4956,15 @@ restart_ih:
                                break;
                        }
                        break;
+                case 8: /* D1 page flip */
+                case 10: /* D2 page flip */
+                case 12: /* D3 page flip */
+                case 14: /* D4 page flip */
+                case 16: /* D5 page flip */
+                case 18: /* D6 page flip */
+                        DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
+                        radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
+                        break;
                case 42: /* HPD hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/evergreen_dma.c b/drivers/gpu/drm/radeon/evergreen_dma.c
index 287fe966d7de..478caefe0fef 100644
--- a/drivers/gpu/drm/radeon/evergreen_dma.c
+++ b/drivers/gpu/drm/radeon/evergreen_dma.c
@@ -151,6 +151,7 @@ int evergreen_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 16ec9d56a234..3f6e817d97ee 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -546,6 +546,52 @@ static int kv_set_divider_value(struct radeon_device *rdev,
        return 0;
 }
+static u32 kv_convert_vid2_to_vid7(struct radeon_device *rdev,
+                                   struct sumo_vid_mapping_table *vid_mapping_table,
+                                   u32 vid_2bit)
+{
+        struct radeon_clock_voltage_dependency_table *vddc_sclk_table =
+                &rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
+        u32 i;
+        if (vddc_sclk_table && vddc_sclk_table->count) {
+                if (vid_2bit < vddc_sclk_table->count)
+                        return vddc_sclk_table->entries[vid_2bit].v;
+                else
+                        return vddc_sclk_table->entries[vddc_sclk_table->count - 1].v;
+        } else {
+                for (i = 0; i < vid_mapping_table->num_entries; i++) {
+                        if (vid_mapping_table->entries[i].vid_2bit == vid_2bit)
+                                return vid_mapping_table->entries[i].vid_7bit;
+                }
+                return vid_mapping_table->entries[vid_mapping_table->num_entries - 1].vid_7bit;
+        }
+}
+static u32 kv_convert_vid7_to_vid2(struct radeon_device *rdev,
+                                   struct sumo_vid_mapping_table *vid_mapping_table,
+                                   u32 vid_7bit)
+{
+        struct radeon_clock_voltage_dependency_table *vddc_sclk_table =
+                &rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
+        u32 i;
+        if (vddc_sclk_table && vddc_sclk_table->count) {
+                for (i = 0; i < vddc_sclk_table->count; i++) {
+                        if (vddc_sclk_table->entries[i].v == vid_7bit)
+                                return i;
+                }
+                return vddc_sclk_table->count - 1;
+        } else {
+                for (i = 0; i < vid_mapping_table->num_entries; i++) {
+                        if (vid_mapping_table->entries[i].vid_7bit == vid_7bit)
+                                return vid_mapping_table->entries[i].vid_2bit;
+                }
+                return vid_mapping_table->entries[vid_mapping_table->num_entries - 1].vid_2bit;
+        }
+}
 static u16 kv_convert_8bit_index_to_voltage(struct radeon_device *rdev,
                                            u16 voltage)
 {
@@ -556,9 +602,9 @@ static u16 kv_convert_2bit_index_to_voltage(struct radeon_device *rdev,
                                            u32 vid_2bit)
 {
        struct kv_power_info *pi = kv_get_pi(rdev);
-        u32 vid_8bit = sumo_convert_vid2_to_vid7(rdev,
+        u32 vid_8bit = kv_convert_vid2_to_vid7(rdev,
-                                                 &pi->sys_info.vid_mapping_table,
+                                               &pi->sys_info.vid_mapping_table,
-                                                 vid_2bit);
+                                               vid_2bit);
        return kv_convert_8bit_index_to_voltage(rdev, (u16)vid_8bit);
 }
@@ -639,7 +685,7 @@ static int kv_force_lowest_valid(struct radeon_device *rdev)
 static int kv_unforce_levels(struct radeon_device *rdev)
 {
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return kv_notify_message_to_smu(rdev, PPSMC_MSG_NoForcedLevel);
        else
                return kv_set_enabled_levels(rdev);
@@ -1362,13 +1408,20 @@ static int kv_update_uvd_dpm(struct radeon_device *rdev, bool gate)
        struct radeon_uvd_clock_voltage_dependency_table *table =
                &rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table;
        int ret;
+        u32 mask;
        if (!gate) {
-                if (!pi->caps_uvd_dpm || table->count || pi->caps_stable_p_state)
+                if (table->count)
                        pi->uvd_boot_level = table->count - 1;
                else
                        pi->uvd_boot_level = 0;
+                if (!pi->caps_uvd_dpm || pi->caps_stable_p_state) {
+                        mask = 1 << pi->uvd_boot_level;
+                } else {
+                        mask = 0x1f;
+                }
                ret = kv_copy_bytes_to_smc(rdev,
                                           pi->dpm_table_start +
                                           offsetof(SMU7_Fusion_DpmTable, UvdBootLevel),
@@ -1377,11 +1430,9 @@ static int kv_update_uvd_dpm(struct radeon_device *rdev, bool gate)
                if (ret)
                        return ret;
-                if (!pi->caps_uvd_dpm ||
+                kv_send_msg_to_smc_with_parameter(rdev,
-                    pi->caps_stable_p_state)
+                                                  PPSMC_MSG_UVDDPM_SetEnabledMask,
-                        kv_send_msg_to_smc_with_parameter(rdev,
+                                                  mask);
-                                                          PPSMC_MSG_UVDDPM_SetEnabledMask,
-                                                          (1 << pi->uvd_boot_level));
        }
        return kv_enable_uvd_dpm(rdev, !gate);
@@ -1617,7 +1668,7 @@ static void kv_dpm_powergate_acp(struct radeon_device *rdev, bool gate)
        if (pi->acp_power_gated == gate)
                return;
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return;
        pi->acp_power_gated = gate;
@@ -1786,7 +1837,7 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                }
        }
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                if (pi->enable_dpm) {
                        kv_set_valid_clock_range(rdev, new_ps);
                        kv_update_dfs_bypass_settings(rdev, new_ps);
@@ -1812,6 +1863,8 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                                return ret;
                        }
                        kv_update_sclk_t(rdev);
+                        if (rdev->family == CHIP_MULLINS)
+                                kv_enable_nb_dpm(rdev);
                }
        } else {
                if (pi->enable_dpm) {
@@ -1862,7 +1915,7 @@ void kv_dpm_reset_asic(struct radeon_device *rdev)
 {
        struct kv_power_info *pi = kv_get_pi(rdev);
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                kv_force_lowest_valid(rdev);
                kv_init_graphics_levels(rdev);
                kv_program_bootup_state(rdev);
@@ -1901,14 +1954,41 @@ static void kv_construct_max_power_limits_table(struct radeon_device *rdev,
 static void kv_patch_voltage_values(struct radeon_device *rdev)
 {
        int i;
-        struct radeon_uvd_clock_voltage_dependency_table *table =
+        struct radeon_uvd_clock_voltage_dependency_table *uvd_table =
                &rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table;
+        struct radeon_vce_clock_voltage_dependency_table *vce_table =
+                &rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table;
+        struct radeon_clock_voltage_dependency_table *samu_table =
+                &rdev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table;
+        struct radeon_clock_voltage_dependency_table *acp_table =
+                &rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table;
-        if (table->count) {
+        if (uvd_table->count) {
-                for (i = 0; i < table->count; i++)
+                for (i = 0; i < uvd_table->count; i++)
-                        table->entries[i].v =
+                        uvd_table->entries[i].v =
                                kv_convert_8bit_index_to_voltage(rdev,
-                                                                 table->entries[i].v);
+                                                                 uvd_table->entries[i].v);
+        }
+        if (vce_table->count) {
+                for (i = 0; i < vce_table->count; i++)
+                        vce_table->entries[i].v =
+                                kv_convert_8bit_index_to_voltage(rdev,
+                                                                 vce_table->entries[i].v);
+        }
+        if (samu_table->count) {
+                for (i = 0; i < samu_table->count; i++)
+                        samu_table->entries[i].v =
+                                kv_convert_8bit_index_to_voltage(rdev,
+                                                                 samu_table->entries[i].v);
+        }
+        if (acp_table->count) {
+                for (i = 0; i < acp_table->count; i++)
+                        acp_table->entries[i].v =
+                                kv_convert_8bit_index_to_voltage(rdev,
+                                                                 acp_table->entries[i].v);
        }
 }
@@ -1941,7 +2021,7 @@ static int kv_force_dpm_highest(struct radeon_device *rdev)
                        break;
        }
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
        else
                return kv_set_enabled_level(rdev, i);
@@ -1961,7 +2041,7 @@ static int kv_force_dpm_lowest(struct radeon_device *rdev)
                        break;
        }
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
        else
                return kv_set_enabled_level(rdev, i);
@@ -2118,7 +2198,7 @@ static void kv_apply_state_adjust_rules(struct radeon_device *rdev,
        else
                pi->battery_state = false;
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                ps->dpm0_pg_nb_ps_lo = 0x1;
                ps->dpm0_pg_nb_ps_hi = 0x0;
                ps->dpmx_nb_ps_lo = 0x1;
@@ -2179,7 +2259,7 @@ static int kv_calculate_nbps_level_settings(struct radeon_device *rdev)
        if (pi->lowest_valid > pi->highest_valid)
                return -EINVAL;
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                for (i = pi->lowest_valid; i <= pi->highest_valid; i++) {
                        pi->graphics_level[i].GnbSlow = 1;
                        pi->graphics_level[i].ForceNbPs1 = 0;
@@ -2253,9 +2333,9 @@ static void kv_init_graphics_levels(struct radeon_device *rdev)
                                break;
                        kv_set_divider_value(rdev, i, table->entries[i].clk);
-                        vid_2bit = sumo_convert_vid7_to_vid2(rdev,
+                        vid_2bit = kv_convert_vid7_to_vid2(rdev,
-                                                             &pi->sys_info.vid_mapping_table,
+                                                           &pi->sys_info.vid_mapping_table,
-                                                             table->entries[i].v);
+                                                           table->entries[i].v);
                        kv_set_vid(rdev, i, vid_2bit);
                        kv_set_at(rdev, i, pi->at[i]);
                        kv_dpm_power_level_enabled_for_throttle(rdev, i, true);
@@ -2324,7 +2404,7 @@ static void kv_program_nbps_index_settings(struct radeon_device *rdev,
        struct kv_power_info *pi = kv_get_pi(rdev);
        u32 nbdpmconfig1;
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return;
        if (pi->sys_info.nb_dpm_enable) {
@@ -2631,9 +2711,6 @@ int kv_dpm_init(struct radeon_device *rdev)
        pi->sram_end = SMC_RAM_END;
-        if (rdev->family == CHIP_KABINI)
-                pi->high_voltage_t = 4001;
        pi->enable_nb_dpm = true;
        pi->caps_power_containment = true;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 6e887d004eba..bbc189fd3ddc 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2839,6 +2839,7 @@ int r600_copy_cpdma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
@@ -3505,7 +3506,6 @@ int r600_irq_set(struct radeon_device *rdev)
        u32 hpd1, hpd2, hpd3, hpd4 = 0, hpd5 = 0, hpd6 = 0;
        u32 grbm_int_cntl = 0;
        u32 hdmi0, hdmi1;
-        u32 d1grph = 0, d2grph = 0;
        u32 dma_cntl;
        u32 thermal_int = 0;
@@ -3614,8 +3614,8 @@ int r600_irq_set(struct radeon_device *rdev)
        WREG32(CP_INT_CNTL, cp_int_cntl);
        WREG32(DMA_CNTL, dma_cntl);
        WREG32(DxMODE_INT_MASK, mode_int);
-        WREG32(D1GRPH_INTERRUPT_CONTROL, d1grph);
+        WREG32(D1GRPH_INTERRUPT_CONTROL, DxGRPH_PFLIP_INT_MASK);
-        WREG32(D2GRPH_INTERRUPT_CONTROL, d2grph);
+        WREG32(D2GRPH_INTERRUPT_CONTROL, DxGRPH_PFLIP_INT_MASK);
        WREG32(GRBM_INT_CNTL, grbm_int_cntl);
        if (ASIC_IS_DCE3(rdev)) {
                WREG32(DC_HPD1_INT_CONTROL, hpd1);
@@ -3918,6 +3918,14 @@ restart_ih:
                                break;
                        }
                        break;
+                case 9: /* D1 pflip */
+                        DRM_DEBUG("IH: D1 flip\n");
+                        radeon_crtc_handle_flip(rdev, 0);
+                        break;
+                case 11: /* D2 pflip */
+                        DRM_DEBUG("IH: D2 flip\n");
+                        radeon_crtc_handle_flip(rdev, 1);
+                        break;
                case 19: /* HPD/DAC hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index 53fcb28f5578..4969cef44a19 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -489,6 +489,7 @@ int r600_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index cbf7e3269f84..9c61b74ef441 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -158,16 +158,18 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
        u32 line_time_us, vblank_lines;
        u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                radeon_crtc = to_radeon_crtc(crtc);
+                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
+                        if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-                                radeon_crtc->hw_mode.clock;
+                                line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
-                        vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
+                                        radeon_crtc->hw_mode.clock;
-                                radeon_crtc->hw_mode.crtc_vdisplay +
+                                vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
-                                (radeon_crtc->v_border * 2);
+                                        radeon_crtc->hw_mode.crtc_vdisplay +
-                        vblank_time_us = vblank_lines * line_time_us;
+                                        (radeon_crtc->v_border * 2);
-                        break;
+                                vblank_time_us = vblank_lines * line_time_us;
+                                break;
+                        }
                }
        }
@@ -181,14 +183,15 @@ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
        struct radeon_crtc *radeon_crtc;
        u32 vrefresh = 0;
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                radeon_crtc = to_radeon_crtc(crtc);
+                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        vrefresh = radeon_crtc->hw_mode.vrefresh;
+                        if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-                        break;
+                                vrefresh = radeon_crtc->hw_mode.vrefresh;
+                                break;
+                        }
                }
        }
        return vrefresh;
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b58e1afdda76..68528619834a 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -730,6 +730,12 @@ struct cik_irq_stat_regs {
        u32 disp_int_cont4;
        u32 disp_int_cont5;
        u32 disp_int_cont6;
+        u32 d1grph_int;
+        u32 d2grph_int;
+        u32 d3grph_int;
+        u32 d4grph_int;
+        u32 d5grph_int;
+        u32 d6grph_int;
 };
 union radeon_irq_stat_regs {
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index b8a24a75d4ff..be20e62dac83 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -2516,6 +2516,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                break;
        case CHIP_KAVERI:
        case CHIP_KABINI:
+        case CHIP_MULLINS:
                rdev->asic = &kv_asic;
                /* set num crtcs */
                if (rdev->family == CHIP_KAVERI) {
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index dedea72f48c4..a9fb0d016d38 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -528,6 +528,13 @@ static bool radeon_atpx_detect(void)
                has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
        }
+        /* some newer PX laptops mark the dGPU as a non-VGA display device */
+        while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
+                vga_count++;
+                has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+        }
        if (has_atpx && vga_count == 2) {
                acpi_get_name(radeon_atpx_priv.atpx.handle, ACPI_FULL_PATHNAME, &buffer);
                printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 511fe26198e4..0e770bbf7e29 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -99,6 +99,7 @@ static const char radeon_family_name[][16] = {
        "KAVERI",
        "KABINI",
        "HAWAII",
+        "MULLINS",
        "LAST",
 };
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 2f7cbb901fb1..408b6ac53f0b 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -284,6 +284,10 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
        u32 update_pending;
        int vpos, hpos;
+        /* can happen during initialization */
+        if (radeon_crtc == NULL)
+                return;
        spin_lock_irqsave(&rdev->ddev->event_lock, flags);
        work = radeon_crtc->unpin_work;
        if (work == NULL ||
@@ -826,20 +830,52 @@ static void avivo_reduce_ratio(unsigned *nom, unsigned *den,
        /* make sure nominator is large enough */
        if (*nom < nom_min) {
-                tmp = (nom_min + *nom - 1) / *nom;
+                tmp = DIV_ROUND_UP(nom_min, *nom);
                *nom *= tmp;
                *den *= tmp;
        }
        /* make sure the denominator is large enough */
        if (*den < den_min) {
-                tmp = (den_min + *den - 1) / *den;
+                tmp = DIV_ROUND_UP(den_min, *den);
                *nom *= tmp;
                *den *= tmp;
        }
 }
 /**
+ * avivo_get_fb_ref_div - feedback and ref divider calculation
+ *
+ * @nom: nominator
+ * @den: denominator
+ * @post_div: post divider
+ * @fb_div_max: feedback divider maximum
+ * @ref_div_max: reference divider maximum
+ * @fb_div: resulting feedback divider
+ * @ref_div: resulting reference divider
+ *
+ * Calculate feedback and reference divider for a given post divider. Makes
+ * sure we stay within the limits.
+ */
+static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
+                                 unsigned fb_div_max, unsigned ref_div_max,
+                                 unsigned *fb_div, unsigned *ref_div)
+{
+        /* limit reference * post divider to a maximum */
+        ref_div_max = min(128 / post_div, ref_div_max);
+        /* get matching reference and feedback divider */
+        *ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
+        *fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den);
+        /* limit fb divider to its maximum */
+        if (*fb_div > fb_div_max) {
+                *ref_div = DIV_ROUND_CLOSEST(*ref_div * fb_div_max, *fb_div);
+                *fb_div = fb_div_max;
+        }
+}
+/**
 * radeon_compute_pll_avivo - compute PLL paramaters
 *
 * @pll: information about the PLL
@@ -860,6 +896,9 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
                              u32 *ref_div_p,
                              u32 *post_div_p)
 {
+        unsigned target_clock = pll->flags & RADEON_PLL_USE_FRAC_FB_DIV ?
+                freq : freq / 10;
        unsigned fb_div_min, fb_div_max, fb_div;
        unsigned post_div_min, post_div_max, post_div;
        unsigned ref_div_min, ref_div_max, ref_div;
@@ -880,14 +919,18 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
                ref_div_min = pll->reference_div;
        else
                ref_div_min = pll->min_ref_div;
-        ref_div_max = pll->max_ref_div;
+        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV &&
+            pll->flags & RADEON_PLL_USE_REF_DIV)
+                ref_div_max = pll->reference_div;
+        else
+                ref_div_max = pll->max_ref_div;
        /* determine allowed post divider range */
        if (pll->flags & RADEON_PLL_USE_POST_DIV) {
                post_div_min = pll->post_div;
                post_div_max = pll->post_div;
        } else {
-                unsigned target_clock = freq / 10;
                unsigned vco_min, vco_max;
                if (pll->flags & RADEON_PLL_IS_LCD) {
@@ -898,6 +941,11 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
                        vco_max = pll->pll_out_max;
                }
+                if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV) {
+                        vco_min *= 10;
+                        vco_max *= 10;
+                }
                post_div_min = vco_min / target_clock;
                if ((target_clock * post_div_min) < vco_min)
                        ++post_div_min;
@@ -912,7 +960,7 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        }
        /* represent the searched ratio as fractional number */
-        nom = pll->flags & RADEON_PLL_USE_FRAC_FB_DIV ? freq : freq / 10;
+        nom = target_clock;
        den = pll->reference_freq;
        /* reduce the numbers to a simpler ratio */
@@ -926,7 +974,12 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        diff_best = ~0;
        for (post_div = post_div_min; post_div <= post_div_max; ++post_div) {
-                unsigned diff = abs(den - den / post_div * post_div);
+                unsigned diff;
+                avivo_get_fb_ref_div(nom, den, post_div, fb_div_max,
+                                     ref_div_max, &fb_div, &ref_div);
+                diff = abs(target_clock - (pll->reference_freq * fb_div) /
+                        (ref_div * post_div));
                if (diff < diff_best || (diff == diff_best &&
                    !(pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP))) {
@@ -936,33 +989,24 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        }
        post_div = post_div_best;
-        /* limit reference * post divider to a maximum */
+        /* get the feedback and reference divider for the optimal value */
-        ref_div_max = min(210 / post_div, ref_div_max);
+        avivo_get_fb_ref_div(nom, den, post_div, fb_div_max, ref_div_max,
+                             &fb_div, &ref_div);
-        /* get matching reference and feedback divider */
-        ref_div = max(DIV_ROUND_CLOSEST(den, post_div), 1u);
-        fb_div = DIV_ROUND_CLOSEST(nom * ref_div * post_div, den);
-        /* we're almost done, but reference and feedback
-           divider might be to large now */
-        nom = fb_div;
-        den = ref_div;
-        if (fb_div > fb_div_max) {
-                ref_div = DIV_ROUND_CLOSEST(den * fb_div_max, nom);
-                fb_div = fb_div_max;
-        }
-        if (ref_div > ref_div_max) {
-                ref_div = ref_div_max;
-                fb_div = DIV_ROUND_CLOSEST(nom * ref_div_max, den);
-        }
        /* reduce the numbers to a simpler ratio once more */
        /* this also makes sure that the reference divider is large enough */
        avivo_reduce_ratio(&fb_div, &ref_div, fb_div_min, ref_div_min);
+        /* avoid high jitter with small fractional dividers */
+        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV && (fb_div % 10)) {
+                fb_div_min = max(fb_div_min, (9 - (fb_div % 10)) * 20 + 60);
+                if (fb_div < fb_div_min) {
+                        unsigned tmp = DIV_ROUND_UP(fb_div_min, fb_div);
+                        fb_div *= tmp;
+                        ref_div *= tmp;
+                }
+        }
        /* and finally save the result */
        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV) {
                *fb_div_p = fb_div / 10;
@@ -979,7 +1023,7 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        *post_div_p = post_div;
        DRM_DEBUG_KMS("%d - %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
-                      freq, *dot_clock_p, *fb_div_p, *frac_fb_div_p,
+                      freq, *dot_clock_p * 10, *fb_div_p, *frac_fb_div_p,
                      ref_div, post_div);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_family.h b/drivers/gpu/drm/radeon/radeon_family.h
index 9da5da4ffd17..4b7b87f71a63 100644
--- a/drivers/gpu/drm/radeon/radeon_family.h
+++ b/drivers/gpu/drm/radeon/radeon_family.h
@@ -97,6 +97,7 @@ enum radeon_family {
        CHIP_KAVERI,
        CHIP_KABINI,
        CHIP_HAWAII,
+        CHIP_MULLINS,
        CHIP_LAST,
 };
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index fb3d13f693dd..0cc47f12d995 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -107,11 +107,9 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
                flags |= RADEON_IS_PCI;
        }
-        if (radeon_runtime_pm == 1)
+        if ((radeon_runtime_pm != 0) &&
-                flags |= RADEON_IS_PX;
+            radeon_has_atpx() &&
-        else if ((radeon_runtime_pm == -1) &&
+            ((flags & RADEON_IS_IGP) == 0))
-                 radeon_has_atpx() &&
-                 ((flags & RADEON_IS_IGP) == 0))
                flags |= RADEON_IS_PX;
        /* radeon_device_init should report only fatal error
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index ee738a524639..f30b8426eee2 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -603,7 +603,6 @@ static const struct attribute_group *hwmon_groups[] = {
 static int radeon_hwmon_init(struct radeon_device *rdev)
 {
        int err = 0;
-        struct device *hwmon_dev;
        switch (rdev->pm.int_thermal_type) {
        case THERMAL_TYPE_RV6XX:
@@ -616,11 +615,11 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
        case THERMAL_TYPE_KV:
                if (rdev->asic->pm.get_temperature == NULL)
                        return err;
-                hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
+                rdev->pm.int_hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
-                                                              "radeon", rdev,
+                                                                           "radeon", rdev,
-                                                              hwmon_groups);
+                                                                           hwmon_groups);
-                if (IS_ERR(hwmon_dev)) {
+                if (IS_ERR(rdev->pm.int_hwmon_dev)) {
-                        err = PTR_ERR(hwmon_dev);
+                        err = PTR_ERR(rdev->pm.int_hwmon_dev);
                        dev_err(rdev->dev,
                                "Unable to register hwmon device: %d\n", err);
                }
@@ -632,6 +631,12 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
        return err;
 }
+static void radeon_hwmon_fini(struct radeon_device *rdev)
+{
+        if (rdev->pm.int_hwmon_dev)
+                hwmon_device_unregister(rdev->pm.int_hwmon_dev);
+}
 static void radeon_dpm_thermal_work_handler(struct work_struct *work)
 {
        struct radeon_device *rdev =
@@ -1257,6 +1262,7 @@ int radeon_pm_init(struct radeon_device *rdev)
        case CHIP_RV670:
        case CHIP_RS780:
        case CHIP_RS880:
+        case CHIP_RV770:
        case CHIP_BARTS:
        case CHIP_TURKS:
        case CHIP_CAICOS:
@@ -1273,7 +1279,6 @@ int radeon_pm_init(struct radeon_device *rdev)
                else
                        rdev->pm.pm_method = PM_METHOD_PROFILE;
                break;
-        case CHIP_RV770:
        case CHIP_RV730:
        case CHIP_RV710:
        case CHIP_RV740:
@@ -1295,6 +1300,7 @@ int radeon_pm_init(struct radeon_device *rdev)
        case CHIP_KABINI:
        case CHIP_KAVERI:
        case CHIP_HAWAII:
+        case CHIP_MULLINS:
                /* DPM requires the RLC, RV770+ dGPU requires SMC */
                if (!rdev->rlc_fw)
                        rdev->pm.pm_method = PM_METHOD_PROFILE;
@@ -1353,6 +1359,8 @@ static void radeon_pm_fini_old(struct radeon_device *rdev)
                device_remove_file(rdev->dev, &dev_attr_power_method);
        }
+        radeon_hwmon_fini(rdev);
        if (rdev->pm.power_state)
                kfree(rdev->pm.power_state);
 }
@@ -1372,6 +1380,8 @@ static void radeon_pm_fini_dpm(struct radeon_device *rdev)
        }
        radeon_dpm_fini(rdev);
+        radeon_hwmon_fini(rdev);
        if (rdev->pm.power_state)
                kfree(rdev->pm.power_state);
 }
@@ -1397,12 +1407,14 @@ static void radeon_pm_compute_clocks_old(struct radeon_device *rdev)
        rdev->pm.active_crtcs = 0;
        rdev->pm.active_crtc_count = 0;
-        list_for_each_entry(crtc,
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                &ddev->mode_config.crtc_list, head) {
+                list_for_each_entry(crtc,
-                radeon_crtc = to_radeon_crtc(crtc);
+                                    &ddev->mode_config.crtc_list, head) {
-                if (radeon_crtc->enabled) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        rdev->pm.active_crtcs |= (1 << radeon_crtc->crtc_id);
+                        if (radeon_crtc->enabled) {
-                        rdev->pm.active_crtc_count++;
+                                rdev->pm.active_crtcs |= (1 << radeon_crtc->crtc_id);
+                                rdev->pm.active_crtc_count++;
+                        }
                }
        }
@@ -1469,12 +1481,14 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
        /* update active crtc counts */
        rdev->pm.dpm.new_active_crtcs = 0;
        rdev->pm.dpm.new_active_crtc_count = 0;
-        list_for_each_entry(crtc,
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                &ddev->mode_config.crtc_list, head) {
+                list_for_each_entry(crtc,
-                radeon_crtc = to_radeon_crtc(crtc);
+                                    &ddev->mode_config.crtc_list, head) {
-                if (crtc->enabled) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id);
+                        if (crtc->enabled) {
-                        rdev->pm.dpm.new_active_crtc_count++;
+                                rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id);
+                                rdev->pm.dpm.new_active_crtc_count++;
+                        }
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_ucode.h b/drivers/gpu/drm/radeon/radeon_ucode.h
index 58d12938c0b8..4e7c3269b183 100644
--- a/drivers/gpu/drm/radeon/radeon_ucode.h
+++ b/drivers/gpu/drm/radeon/radeon_ucode.h
@@ -52,6 +52,7 @@
 #define BONAIRE_RLC_UCODE_SIZE       2048
 #define KB_RLC_UCODE_SIZE            2560
 #define KV_RLC_UCODE_SIZE            2560
+#define ML_RLC_UCODE_SIZE            2560
 /* MC */
 #define BTC_MC_UCODE_SIZE            6024
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 5748bdaeacce..1b65ae2433cd 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -99,6 +99,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
        case CHIP_KABINI:
        case CHIP_KAVERI:
        case CHIP_HAWAII:
+        case CHIP_MULLINS:
                fw_name = FIRMWARE_BONAIRE;
                break;
@@ -465,6 +466,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
        cmd = radeon_get_ib_value(p, p->idx) >> 1;
        if (cmd < 0x4) {
+                if (end <= start) {
+                        DRM_ERROR("invalid reloc offset %X!\n", offset);
+                        return -EINVAL;
+                }
                if ((end - start) < buf_sizes[cmd]) {
                        DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd,
                                  (unsigned)(end - start), buf_sizes[cmd]);
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index ced53dd03e7c..f73324c81491 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -66,6 +66,7 @@ int radeon_vce_init(struct radeon_device *rdev)
        case CHIP_BONAIRE:
        case CHIP_KAVERI:
        case CHIP_KABINI:
+        case CHIP_MULLINS:
                fw_name = FIRMWARE_BONAIRE;
                break;
diff --git a/drivers/gpu/drm/radeon/rv770_dma.c b/drivers/gpu/drm/radeon/rv770_dma.c
index aca8cbe8a335..bbf2e076ee45 100644
--- a/drivers/gpu/drm/radeon/rv770_dma.c
+++ b/drivers/gpu/drm/radeon/rv770_dma.c
@@ -86,6 +86,7 @@ int rv770_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index ac708e006180..22a63c98ba14 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -5780,7 +5780,6 @@ int si_irq_set(struct radeon_device *rdev)
        u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
        u32 hpd1 = 0, hpd2 = 0, hpd3 = 0, hpd4 = 0, hpd5 = 0, hpd6 = 0;
        u32 grbm_int_cntl = 0;
-        u32 grph1 = 0, grph2 = 0, grph3 = 0, grph4 = 0, grph5 = 0, grph6 = 0;
        u32 dma_cntl, dma_cntl1;
        u32 thermal_int = 0;
@@ -5919,16 +5918,22 @@ int si_irq_set(struct radeon_device *rdev)
        }
        if (rdev->num_crtc >= 2) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, grph1);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, grph2);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (rdev->num_crtc >= 4) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, grph3);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, grph4);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (rdev->num_crtc >= 6) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, grph5);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, grph6);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (!ASIC_IS_NODCE(rdev)) {
@@ -6292,6 +6297,15 @@ restart_ih:
                                break;
                        }
                        break;
+                case 8: /* D1 page flip */
+                case 10: /* D2 page flip */
+                case 12: /* D3 page flip */
+                case 14: /* D4 page flip */
+                case 16: /* D5 page flip */
+                case 18: /* D6 page flip */
+                        DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
+                        radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
+                        break;
                case 42: /* HPD hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/si_dma.c b/drivers/gpu/drm/radeon/si_dma.c
index cf0fdad8c278..de0ca070122f 100644
--- a/drivers/gpu/drm/radeon/si_dma.c
+++ b/drivers/gpu/drm/radeon/si_dma.c
@@ -213,6 +213,7 @@ int si_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index 0a243f0e5d68..be42c8125203 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -83,7 +83,10 @@ int uvd_v1_0_init(struct radeon_device *rdev)
        int r;
        /* raise clocks while booting up the VCPU */
-        radeon_set_uvd_clocks(rdev, 53300, 40000);
+        if (rdev->family < CHIP_RV740)
+                radeon_set_uvd_clocks(rdev, 10000, 10000);
+        else
+                radeon_set_uvd_clocks(rdev, 53300, 40000);
        r = uvd_v1_0_start(rdev);
        if (r)
@@ -407,7 +410,10 @@ int uvd_v1_0_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
        struct radeon_fence *fence = NULL;
        int r;
-        r = radeon_set_uvd_clocks(rdev, 53300, 40000);
+        if (rdev->family < CHIP_RV740)
+                r = radeon_set_uvd_clocks(rdev, 10000, 10000);
+        else
+                r = radeon_set_uvd_clocks(rdev, 53300, 40000);
        if (r) {
                DRM_ERROR("radeon: failed to raise UVD clocks (%d).\n", r);
                return r;
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 36c717af6cf9..edb871d7d395 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -312,7 +312,7 @@ static void tegra_crtc_disable(struct drm_crtc *crtc)
        struct drm_device *drm = crtc->dev;
        struct drm_plane *plane;
-        list_for_each_entry(plane, &drm->mode_config.plane_list, head) {
+        drm_for_each_legacy_plane(plane, &drm->mode_config.plane_list) {
                if (plane->crtc == crtc) {
                        tegra_plane_disable(plane);
                        plane->crtc = NULL;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 931490b9cfed..87df0b3674fd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1214,14 +1214,36 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
                SVGA3dCmdSurfaceDMA dma;
        } *cmd;
        int ret;
+        SVGA3dCmdSurfaceDMASuffix *suffix;
+        uint32_t bo_size;
        cmd = container_of(header, struct vmw_dma_cmd, header);
+        suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
+                                               header->size - sizeof(*suffix));
+        /* Make sure device and verifier stays in sync. */
+        if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
+                DRM_ERROR("Invalid DMA suffix size.\n");
+                return -EINVAL;
+        }
        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
                                      &cmd->dma.guest.ptr,
                                      &vmw_bo);
        if (unlikely(ret != 0))
                return ret;
+        /* Make sure DMA doesn't cross BO boundaries. */
+        bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
+        if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
+                DRM_ERROR("Invalid DMA offset.\n");
+                return -EINVAL;
+        }
+        bo_size -= cmd->dma.guest.ptr.offset;
+        if (unlikely(suffix->maximumOffset > bo_size))
+                suffix->maximumOffset = bo_size;
        ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
                                user_surface_converter, &cmd->dma.host.sid,
                                NULL);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 10a2c0866459..da52279de939 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1253,7 +1253,8 @@ EXPORT_SYMBOL_GPL(hid_output_report);
 static int hid_report_len(struct hid_report *report)
 {
-        return ((report->size - 1) >> 3) + 1 + (report->id > 0) + 7;
+        /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
+        return ((report->size - 1) >> 3) + 1 + (report->id > 0);
 }
 /*
@@ -1266,7 +1267,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
         * of implement() working on 8 byte chunks
         */
-        int len = hid_report_len(report);
+        int len = hid_report_len(report) + 7;
        return kmalloc(len, flags);
 }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index c8af7202c28d..34bb2205d2ea 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -301,6 +301,9 @@
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
+#define USB_VENDOR_ID_ELITEGROUP        0x03fc
+#define USB_DEVICE_ID_ELITEGROUP_05D8   0x05d8
 #define USB_VENDOR_ID_ELO               0x04E7
 #define USB_DEVICE_ID_ELO_TS2515        0x0022
 #define USB_DEVICE_ID_ELO_TS2700        0x0020
@@ -834,6 +837,10 @@
 #define USB_DEVICE_ID_SYNAPTICS_LTS2    0x1d10
 #define USB_DEVICE_ID_SYNAPTICS_HD      0x0ac3
 #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
+#define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+#define USB_VENDOR_ID_TEXAS_INSTRUMENTS 0x2047
+#define USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA     0x0855
 #define USB_VENDOR_ID_THINGM            0x27b8
 #define USB_DEVICE_ID_BLINK1            0x01ed
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 35278e43c7a4..51e25b9407f2 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1155,6 +1155,11 @@ static const struct hid_device_id mt_devices[] = {
                MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+        /* Elitegroup panel */
+        { .driver_data = MT_CLS_SERIAL,
+                MT_USB_DEVICE(USB_VENDOR_ID_ELITEGROUP,
+                        USB_DEVICE_ID_ELITEGROUP_05D8) },
        /* Flatfrog Panels */
        { .driver_data = MT_CLS_FLATFROG,
                MT_USB_DEVICE(USB_VENDOR_ID_FLATFROG,
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index af8244b1c1f4..be14b5690e94 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -708,6 +708,9 @@ static const struct hid_device_id sensor_hub_devices[] = {
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_STM_0,
                        USB_DEVICE_ID_STM_HID_SENSOR),
                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
+        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_TEXAS_INSTRUMENTS,
+                        USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA),
+                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, HID_ANY_ID,
                     HID_ANY_ID) },
        { }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index dbd83878ff99..8e4ddb369883 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -119,6 +119,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
        { 0, 0 }
 };
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 6d02e3b06375..d76f0b70c6e0 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -365,12 +365,12 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
                if (cpu_has_tjmax(c))
                        dev_warn(dev, "Unable to read TjMax from CPU %u\n", id);
        } else {
-                val = (eax >> 16) & 0x7f;
+                val = (eax >> 16) & 0xff;
                /*
                 * If the TjMax is not plausible, an assumption
                 * will be used
                 */
-                if (val >= 85) {
+                if (val) {
                        dev_dbg(dev, "TjMax is %d degrees C\n", val);
                        return val * 1000;
                }
diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
index 90ec1173b8a1..01723f04fe45 100644
--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -163,7 +163,7 @@ static ssize_t store_hyst(struct device *dev,
        if (retval < 0)
                goto fail;
-        hyst = val - retval * 1000;
+        hyst = retval * 1000 - val;
        hyst = DIV_ROUND_CLOSEST(hyst, 1000);
        if (hyst < 0 || hyst > 255) {
                retval = -ERANGE;
@@ -330,7 +330,7 @@ static int emc1403_detect(struct i2c_client *client,
        }
        id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
-        if (id != 0x01)
+        if (id < 0x01 || id > 0x04)
                return -ENODEV;
        return 0;
@@ -355,9 +355,9 @@ static int emc1403_probe(struct i2c_client *client,
        if (id->driver_data)
                data->groups[1] = &emc1404_group;
-        hwmon_dev = hwmon_device_register_with_groups(&client->dev,
+        hwmon_dev = devm_hwmon_device_register_with_groups(&client->dev,
-                                                      client->name, data,
+                                                           client->name, data,
-                                                      data->groups);
+                                                           data->groups);
        if (IS_ERR(hwmon_dev))
                return PTR_ERR(hwmon_dev);
diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c
index c104cc32989d..c9cddf5f056b 100644
--- a/drivers/hwmon/ltc2945.c
+++ b/drivers/hwmon/ltc2945.c
@@ -1,4 +1,4 @@
-/*
+    /*
 * Driver for Linear Technology LTC2945 I2C Power Monitor
 *
 * Copyright (c) 2014 Guenter Roeck
@@ -314,8 +314,8 @@ static ssize_t ltc2945_reset_history(struct device *dev,
                reg = LTC2945_MAX_ADIN_H;
                break;
        default:
-                BUG();
+                WARN_ONCE(1, "Bad register: 0x%x\n", reg);
-                break;
+                return -EINVAL;
        }
        /* Reset maximum */
        ret = regmap_bulk_write(regmap, reg, buf_max, num_regs);
diff --git a/drivers/hwmon/vexpress.c b/drivers/hwmon/vexpress.c
index d867e6bb2be1..8242b75d96c8 100644
--- a/drivers/hwmon/vexpress.c
+++ b/drivers/hwmon/vexpress.c
@@ -27,15 +27,15 @@
 struct vexpress_hwmon_data {
        struct device *hwmon_dev;
        struct vexpress_config_func *func;
+        const char *name;
 };
 static ssize_t vexpress_hwmon_name_show(struct device *dev,
                struct device_attribute *dev_attr, char *buffer)
 {
-        const char *compatible = of_get_property(dev->of_node, "compatible",
+        struct vexpress_hwmon_data *data = dev_get_drvdata(dev);
-                        NULL);
-        return sprintf(buffer, "%s\n", compatible);
+        return sprintf(buffer, "%s\n", data->name);
 }
 static ssize_t vexpress_hwmon_label_show(struct device *dev,
@@ -43,9 +43,6 @@ static ssize_t vexpress_hwmon_label_show(struct device *dev,
 {
        const char *label = of_get_property(dev->of_node, "label", NULL);
-        if (!label)
-                return -ENOENT;
        return snprintf(buffer, PAGE_SIZE, "%s\n", label);
 }
@@ -84,6 +81,20 @@ static ssize_t vexpress_hwmon_u64_show(struct device *dev,
                        to_sensor_dev_attr(dev_attr)->index));
 }
+static umode_t vexpress_hwmon_attr_is_visible(struct kobject *kobj,
+                struct attribute *attr, int index)
+{
+        struct device *dev = kobj_to_dev(kobj);
+        struct device_attribute *dev_attr = container_of(attr,
+                                struct device_attribute, attr);
+        if (dev_attr->show == vexpress_hwmon_label_show &&
+                        !of_get_property(dev->of_node, "label", NULL))
+                return 0;
+        return attr->mode;
+}
 static DEVICE_ATTR(name, S_IRUGO, vexpress_hwmon_name_show, NULL);
 #define VEXPRESS_HWMON_ATTRS(_name, _label_attr, _input_attr)   \
@@ -94,14 +105,27 @@ struct attribute *vexpress_hwmon_attrs_##_name[] = {		\
        NULL                                                    \
 }
+struct vexpress_hwmon_type {
+        const char *name;
+        const struct attribute_group **attr_groups;
+};
 #if !defined(CONFIG_REGULATOR_VEXPRESS)
 static DEVICE_ATTR(in1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1000);
 static VEXPRESS_HWMON_ATTRS(volt, in1_label, in1_input);
 static struct attribute_group vexpress_hwmon_group_volt = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_volt,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_volt = {
+        .name = "vexpress_volt",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_volt,
+                NULL,
+        },
+};
 #endif
 static DEVICE_ATTR(curr1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
@@ -109,52 +133,84 @@ static SENSOR_DEVICE_ATTR(curr1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1000);
 static VEXPRESS_HWMON_ATTRS(amp, curr1_label, curr1_input);
 static struct attribute_group vexpress_hwmon_group_amp = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_amp,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_amp = {
+        .name = "vexpress_amp",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_amp,
+                NULL
+        },
+};
 static DEVICE_ATTR(temp1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1000);
 static VEXPRESS_HWMON_ATTRS(temp, temp1_label, temp1_input);
 static struct attribute_group vexpress_hwmon_group_temp = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_temp,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_temp = {
+        .name = "vexpress_temp",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_temp,
+                NULL
+        },
+};
 static DEVICE_ATTR(power1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1);
 static VEXPRESS_HWMON_ATTRS(power, power1_label, power1_input);
 static struct attribute_group vexpress_hwmon_group_power = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_power,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_power = {
+        .name = "vexpress_power",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_power,
+                NULL
+        },
+};
 static DEVICE_ATTR(energy1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(energy1_input, S_IRUGO, vexpress_hwmon_u64_show,
                NULL, 1);
 static VEXPRESS_HWMON_ATTRS(energy, energy1_label, energy1_input);
 static struct attribute_group vexpress_hwmon_group_energy = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_energy,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_energy = {
+        .name = "vexpress_energy",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_energy,
+                NULL
+        },
+};
 static struct of_device_id vexpress_hwmon_of_match[] = {
 #if !defined(CONFIG_REGULATOR_VEXPRESS)
        {
                .compatible = "arm,vexpress-volt",
-                .data = &vexpress_hwmon_group_volt,
+                .data = &vexpress_hwmon_volt,
        },
 #endif
        {
                .compatible = "arm,vexpress-amp",
-                .data = &vexpress_hwmon_group_amp,
+                .data = &vexpress_hwmon_amp,
        }, {
                .compatible = "arm,vexpress-temp",
-                .data = &vexpress_hwmon_group_temp,
+                .data = &vexpress_hwmon_temp,
        }, {
                .compatible = "arm,vexpress-power",
-                .data = &vexpress_hwmon_group_power,
+                .data = &vexpress_hwmon_power,
        }, {
                .compatible = "arm,vexpress-energy",
-                .data = &vexpress_hwmon_group_energy,
+                .data = &vexpress_hwmon_energy,
        },
        {}
 };
@@ -165,6 +221,7 @@ static int vexpress_hwmon_probe(struct platform_device *pdev)
        int err;
        const struct of_device_id *match;
        struct vexpress_hwmon_data *data;
+        const struct vexpress_hwmon_type *type;
        data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
        if (!data)
@@ -174,12 +231,14 @@ static int vexpress_hwmon_probe(struct platform_device *pdev)
        match = of_match_device(vexpress_hwmon_of_match, &pdev->dev);
        if (!match)
                return -ENODEV;
+        type = match->data;
+        data->name = type->name;
        data->func = vexpress_config_func_get_by_dev(&pdev->dev);
        if (!data->func)
                return -ENODEV;
-        err = sysfs_create_group(&pdev->dev.kobj, match->data);
+        err = sysfs_create_groups(&pdev->dev.kobj, type->attr_groups);
        if (err)
                goto error;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 22e92c3d3d07..3c20e4bd6dd1 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -422,6 +422,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
         */
        dw_writel(dev, msgs[dev->msg_write_idx].addr | ic_tar, DW_IC_TAR);
+        /* enforce disabled interrupts (due to HW issues) */
+        i2c_dw_disable_int(dev);
        /* Enable the adapter */
        __i2c_dw_enable(dev, true);
diff --git a/drivers/i2c/busses/i2c-nomadik.c b/drivers/i2c/busses/i2c-nomadik.c
index 28cbe1b2a2ec..32c85e9ecdae 100644
--- a/drivers/i2c/busses/i2c-nomadik.c
+++ b/drivers/i2c/busses/i2c-nomadik.c
@@ -999,7 +999,7 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id)
        dev->virtbase = devm_ioremap(&adev->dev, adev->res.start,
                                resource_size(&adev->res));
-        if (IS_ERR(dev->virtbase)) {
+        if (!dev->virtbase) {
                ret = -ENOMEM;
                goto err_no_mem;
        }
diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
index 1b4cf14f1106..2a5efb5b487c 100644
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -479,7 +479,7 @@ static int qup_i2c_xfer(struct i2c_adapter *adap,
        int ret, idx;
        ret = pm_runtime_get_sync(qup->dev);
-        if (ret)
+        if (ret < 0)
                goto out;
        writel(1, qup->base + QUP_SW_RESET);
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index d4fa8eba6e9d..06d47aafbb79 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -561,6 +561,12 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
        ret = -EINVAL;
        for (i = 0; i < num; i++) {
+                /* This HW can't send STOP after address phase */
+                if (msgs[i].len == 0) {
+                        ret = -EOPNOTSUPP;
+                        break;
+                }
                /*-------------- spin lock -----------------*/
                spin_lock_irqsave(&priv->lock, flags);
@@ -625,7 +631,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 static u32 rcar_i2c_func(struct i2c_adapter *adap)
 {
-        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+        /* This HW can't do SMBUS_QUICK and NOSTART */
+        return I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK);
 }
 static const struct i2c_algorithm rcar_i2c_algo = {
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index ae4491062e41..bb3a9964f7e0 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1276,10 +1276,10 @@ static int s3c24xx_i2c_resume(struct device *dev)
        struct platform_device *pdev = to_platform_device(dev);
        struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
-        i2c->suspended = 0;
        clk_prepare_enable(i2c->clk);
        s3c24xx_i2c_init(i2c);
        clk_disable_unprepare(i2c->clk);
+        i2c->suspended = 0;
        return 0;
 }
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index a43220c2e3d9..4d140bbbe100 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -750,9 +750,10 @@ void intel_idle_state_table_update(void)
                        if (package_num + 1 > num_sockets) {
                                num_sockets = package_num + 1;
-                                if (num_sockets > 4)
+                                if (num_sockets > 4) {
                                        cpuidle_state_table = ivt_cstates_8s;
                                        return;
+                                }
                        }
                }
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index d86196cfe4b4..24c28e3f93a3 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -106,7 +106,7 @@ config AT91_ADC
          Say yes here to build support for Atmel AT91 ADC.
 config EXYNOS_ADC
-        bool "Exynos ADC driver support"
+        tristate "Exynos ADC driver support"
        depends on OF
        help
          Core support for the ADC block found in the Samsung EXYNOS series
@@ -114,7 +114,7 @@ config EXYNOS_ADC
          this resource.
 config LP8788_ADC
-        bool "LP8788 ADC driver"
+        tristate "LP8788 ADC driver"
        depends on MFD_LP8788
        help
          Say yes here to build support for TI LP8788 ADC.
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 5b1aa027c034..89777ed9abd8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -765,14 +765,17 @@ static int at91_adc_probe_pdata(struct at91_adc_state *st,
        if (!pdata)
                return -EINVAL;
+        st->caps = (struct at91_adc_caps *)
+                        platform_get_device_id(pdev)->driver_data;
        st->use_external = pdata->use_external_triggers;
        st->vref_mv = pdata->vref;
        st->channels_mask = pdata->channels_used;
-        st->num_channels = pdata->num_channels;
+        st->num_channels = st->caps->num_channels;
        st->startup_time = pdata->startup_time;
        st->trigger_number = pdata->trigger_number;
        st->trigger_list = pdata->trigger_list;
-        st->registers = pdata->registers;
+        st->registers = &st->caps->registers;
        return 0;
 }
@@ -1004,8 +1007,11 @@ static int at91_adc_probe(struct platform_device *pdev)
         * the best converted final value between two channels selection
         * The formula thus is : Sample and Hold Time = (shtim + 1) / ADCClock
         */
-        shtim = round_up((st->sample_hold_time * adc_clk_khz /
+        if (st->sample_hold_time > 0)
-                          1000) - 1, 1);
+                shtim = round_up((st->sample_hold_time * adc_clk_khz / 1000)
+                                 - 1, 1);
+        else
+                shtim = 0;
        reg = AT91_ADC_PRESCAL_(prsc) & st->registers->mr_prescal_mask;
        reg |= AT91_ADC_STARTUP_(ticks) & st->registers->mr_startup_mask;
@@ -1101,7 +1107,6 @@ static int at91_adc_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_OF
 static struct at91_adc_caps at91sam9260_caps = {
        .calc_startup_ticks = calc_startup_ticks_9260,
        .num_channels = 4,
@@ -1154,11 +1159,27 @@ static const struct of_device_id at91_adc_dt_ids[] = {
        {},
 };
 MODULE_DEVICE_TABLE(of, at91_adc_dt_ids);
-#endif
+static const struct platform_device_id at91_adc_ids[] = {
+        {
+                .name = "at91sam9260-adc",
+                .driver_data = (unsigned long)&at91sam9260_caps,
+        }, {
+                .name = "at91sam9g45-adc",
+                .driver_data = (unsigned long)&at91sam9g45_caps,
+        }, {
+                .name = "at91sam9x5-adc",
+                .driver_data = (unsigned long)&at91sam9x5_caps,
+        }, {
+                /* terminator */
+        }
+};
+MODULE_DEVICE_TABLE(platform, at91_adc_ids);
 static struct platform_driver at91_adc_driver = {
        .probe = at91_adc_probe,
        .remove = at91_adc_remove,
+        .id_table = at91_adc_ids,
        .driver = {
                   .name = DRIVER_NAME,
                   .of_match_table = of_match_ptr(at91_adc_dt_ids),
diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c
index d25b262193a7..affa93f51789 100644
--- a/drivers/iio/adc/exynos_adc.c
+++ b/drivers/iio/adc/exynos_adc.c
@@ -344,7 +344,7 @@ static int exynos_adc_probe(struct platform_device *pdev)
        exynos_adc_hw_init(info);
-        ret = of_platform_populate(np, exynos_adc_match, NULL, &pdev->dev);
+        ret = of_platform_populate(np, exynos_adc_match, NULL, &indio_dev->dev);
        if (ret < 0) {
                dev_err(&pdev->dev, "failed adding child nodes\n");
                goto err_of_populate;
@@ -353,7 +353,7 @@ static int exynos_adc_probe(struct platform_device *pdev)
        return 0;
 err_of_populate:
-        device_for_each_child(&pdev->dev, NULL,
+        device_for_each_child(&indio_dev->dev, NULL,
                                exynos_adc_remove_devices);
        regulator_disable(info->vdd);
        clk_disable_unprepare(info->clk);
@@ -369,7 +369,7 @@ static int exynos_adc_remove(struct platform_device *pdev)
        struct iio_dev *indio_dev = platform_get_drvdata(pdev);
        struct exynos_adc *info = iio_priv(indio_dev);
-        device_for_each_child(&pdev->dev, NULL,
+        device_for_each_child(&indio_dev->dev, NULL,
                                exynos_adc_remove_devices);
        regulator_disable(info->vdd);
        clk_disable_unprepare(info->clk);
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index cb9f96b446a5..d8ad606c7cd0 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -660,6 +660,7 @@ static int inv_mpu_probe(struct i2c_client *client,
 {
        struct inv_mpu6050_state *st;
        struct iio_dev *indio_dev;
+        struct inv_mpu6050_platform_data *pdata;
        int result;
        if (!i2c_check_functionality(client->adapter,
@@ -672,8 +673,10 @@ static int inv_mpu_probe(struct i2c_client *client,
        st = iio_priv(indio_dev);
        st->client = client;
-        st->plat_data = *(struct inv_mpu6050_platform_data
+        pdata = (struct inv_mpu6050_platform_data
-                                *)dev_get_platdata(&client->dev);
+                        *)dev_get_platdata(&client->dev);
+        if (pdata)
+                st->plat_data = *pdata;
        /* power is turned on inside check chip type*/
        result = inv_check_and_setup_chip(st, id);
        if (result)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index e108f2a9d827..e472cff6eeae 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -165,7 +165,8 @@ static ssize_t iio_scan_el_show(struct device *dev,
        int ret;
        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-        ret = test_bit(to_iio_dev_attr(attr)->address,
+        /* Ensure ret is 0 or 1. */
+        ret = !!test_bit(to_iio_dev_attr(attr)->address,
                       indio_dev->buffer->scan_mask);
        return sprintf(buf, "%d\n", ret);
@@ -862,7 +863,8 @@ int iio_scan_mask_query(struct iio_dev *indio_dev,
        if (!buffer->scan_mask)
                return 0;
-        return test_bit(bit, buffer->scan_mask);
+        /* Ensure return value is 0 or 1. */
+        return !!test_bit(bit, buffer->scan_mask);
 };
 EXPORT_SYMBOL_GPL(iio_scan_mask_query);
diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
index 47a6dbac2d0c..d976e6ce60db 100644
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -221,6 +221,7 @@ static int cm32181_read_raw(struct iio_dev *indio_dev,
                *val = cm32181->calibscale;
                return IIO_VAL_INT;
        case IIO_CHAN_INFO_INT_TIME:
+                *val = 0;
                ret = cm32181_read_als_it(cm32181, val2);
                return ret;
        }
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index a45e07492db3..39fc67e82138 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -652,7 +652,19 @@ static int cm36651_probe(struct i2c_client *client,
        cm36651->client = client;
        cm36651->ps_client = i2c_new_dummy(client->adapter,
                                                     CM36651_I2C_ADDR_PS);
+        if (!cm36651->ps_client) {
+                dev_err(&client->dev, "%s: new i2c device failed\n", __func__);
+                ret = -ENODEV;
+                goto error_disable_reg;
+        }
        cm36651->ara_client = i2c_new_dummy(client->adapter, CM36651_ARA);
+        if (!cm36651->ara_client) {
+                dev_err(&client->dev, "%s: new i2c device failed\n", __func__);
+                ret = -ENODEV;
+                goto error_i2c_unregister_ps;
+        }
        mutex_init(&cm36651->lock);
        indio_dev->dev.parent = &client->dev;
        indio_dev->channels = cm36651_channels;
@@ -664,7 +676,7 @@ static int cm36651_probe(struct i2c_client *client,
        ret = cm36651_setup_reg(cm36651);
        if (ret) {
                dev_err(&client->dev, "%s: register setup failed\n", __func__);
-                goto error_disable_reg;
+                goto error_i2c_unregister_ara;
        }
        ret = request_threaded_irq(client->irq, NULL, cm36651_irq_handler,
@@ -672,7 +684,7 @@ static int cm36651_probe(struct i2c_client *client,
                                                        "cm36651", indio_dev);
        if (ret) {
                dev_err(&client->dev, "%s: request irq failed\n", __func__);
-                goto error_disable_reg;
+                goto error_i2c_unregister_ara;
        }
        ret = iio_device_register(indio_dev);
@@ -685,6 +697,10 @@ static int cm36651_probe(struct i2c_client *client,
 error_free_irq:
        free_irq(client->irq, indio_dev);
+error_i2c_unregister_ara:
+        i2c_unregister_device(cm36651->ara_client);
+error_i2c_unregister_ps:
+        i2c_unregister_device(cm36651->ps_client);
 error_disable_reg:
        regulator_disable(cm36651->vled_reg);
        return ret;
@@ -698,6 +714,8 @@ static int cm36651_remove(struct i2c_client *client)
        iio_device_unregister(indio_dev);
        regulator_disable(cm36651->vled_reg);
        free_irq(client->irq, indio_dev);
+        i2c_unregister_device(cm36651->ps_client);
+        i2c_unregister_device(cm36651->ara_client);
        return 0;
 }
diff --git a/drivers/infiniband/hw/cxgb4/Kconfig b/drivers/infiniband/hw/cxgb4/Kconfig
index d4e8983fba53..23f38cf2c5cd 100644
--- a/drivers/infiniband/hw/cxgb4/Kconfig
+++ b/drivers/infiniband/hw/cxgb4/Kconfig
@@ -1,10 +1,10 @@
 config INFINIBAND_CXGB4
-        tristate "Chelsio T4 RDMA Driver"
+        tristate "Chelsio T4/T5 RDMA Driver"
        depends on CHELSIO_T4 && INET && (IPV6 || IPV6=n)
        select GENERIC_ALLOCATOR
        ---help---
-          This is an iWARP/RDMA driver for the Chelsio T4 1GbE and
+          This is an iWARP/RDMA driver for the Chelsio T4 and T5
-          10GbE adapters.
+          1GbE, 10GbE adapters and T5 40GbE adapter.
          For general information about Chelsio and our products, visit
          our website at <http://www.chelsio.com>.
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 185452abf32c..1f863a96a480 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -587,6 +587,10 @@ static int send_connect(struct c4iw_ep *ep)
                opt2 |= SACK_EN(1);
        if (wscale && enable_tcp_window_scaling)
                opt2 |= WND_SCALE_EN(1);
+        if (is_t5(ep->com.dev->rdev.lldi.adapter_type)) {
+                opt2 |= T5_OPT_2_VALID;
+                opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
+        }
        t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
        if (is_t4(ep->com.dev->rdev.lldi.adapter_type)) {
@@ -996,7 +1000,7 @@ static void close_complete_upcall(struct c4iw_ep *ep, int status)
 static int abort_connection(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
 {
        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
-        state_set(&ep->com, ABORTING);
+        __state_set(&ep->com, ABORTING);
        set_bit(ABORT_CONN, &ep->com.history);
        return send_abort(ep, skb, gfp);
 }
@@ -1154,7 +1158,7 @@ static int update_rx_credits(struct c4iw_ep *ep, u32 credits)
        return credits;
 }
-static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
+static int process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
 {
        struct mpa_message *mpa;
        struct mpa_v2_conn_params *mpa_v2_params;
@@ -1164,6 +1168,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
        struct c4iw_qp_attributes attrs;
        enum c4iw_qp_attr_mask mask;
        int err;
+        int disconnect = 0;
        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
@@ -1173,7 +1178,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
         * will abort the connection.
         */
        if (stop_ep_timer(ep))
-                return;
+                return 0;
        /*
         * If we get more than the supported amount of private data
@@ -1195,7 +1200,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
         * if we don't even have the mpa message, then bail.
         */
        if (ep->mpa_pkt_len < sizeof(*mpa))
-                return;
+                return 0;
        mpa = (struct mpa_message *) ep->mpa_pkt;
        /* Validate MPA header. */
@@ -1235,7 +1240,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
         * We'll continue process when more data arrives.
         */
        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
-                return;
+                return 0;
        if (mpa->flags & MPA_REJECT) {
                err = -ECONNREFUSED;
@@ -1337,9 +1342,11 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
                attrs.layer_etype = LAYER_MPA | DDP_LLP;
                attrs.ecode = MPA_NOMATCH_RTR;
                attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                attrs.send_term = 1;
                err = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
                err = -ENOMEM;
+                disconnect = 1;
                goto out;
        }
@@ -1355,9 +1362,11 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
                attrs.layer_etype = LAYER_MPA | DDP_LLP;
                attrs.ecode = MPA_INSUFF_IRD;
                attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                attrs.send_term = 1;
                err = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
                err = -ENOMEM;
+                disconnect = 1;
                goto out;
        }
        goto out;
@@ -1366,7 +1375,7 @@ err:
        send_abort(ep, skb, GFP_KERNEL);
 out:
        connect_reply_upcall(ep, err);
-        return;
+        return disconnect;
 }
 static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
@@ -1524,6 +1533,7 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
        unsigned int tid = GET_TID(hdr);
        struct tid_info *t = dev->rdev.lldi.tids;
        __u8 status = hdr->status;
+        int disconnect = 0;
        ep = lookup_tid(t, tid);
        if (!ep)
@@ -1539,7 +1549,7 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
        switch (ep->com.state) {
        case MPA_REQ_SENT:
                ep->rcv_seq += dlen;
-                process_mpa_reply(ep, skb);
+                disconnect = process_mpa_reply(ep, skb);
                break;
        case MPA_REQ_WAIT:
                ep->rcv_seq += dlen;
@@ -1555,13 +1565,16 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
                               ep->com.state, ep->hwtid, status);
                attrs.next_state = C4IW_QP_STATE_TERMINATE;
                c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+                disconnect = 1;
                break;
        }
        default:
                break;
        }
        mutex_unlock(&ep->com.mutex);
+        if (disconnect)
+                c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
        return 0;
 }
@@ -2009,6 +2022,10 @@ static void accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
                if (tcph->ece && tcph->cwr)
                        opt2 |= CCTRL_ECN(1);
        }
+        if (is_t5(ep->com.dev->rdev.lldi.adapter_type)) {
+                opt2 |= T5_OPT_2_VALID;
+                opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
+        }
        rpl = cplhdr(skb);
        INIT_TP_WR(rpl, ep->hwtid);
@@ -3482,9 +3499,9 @@ static void process_timeout(struct c4iw_ep *ep)
                        __func__, ep, ep->hwtid, ep->com.state);
                abort = 0;
        }
-        mutex_unlock(&ep->com.mutex);
        if (abort)
                abort_connection(ep, NULL, GFP_KERNEL);
+        mutex_unlock(&ep->com.mutex);
        c4iw_put_ep(&ep->com);
 }
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 7b8c5806a09d..7474b490760a 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -435,6 +435,7 @@ struct c4iw_qp_attributes {
        u8 ecode;
        u16 sq_db_inc;
        u16 rq_db_inc;
+        u8 send_term;
 };
 struct c4iw_qp {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 7b5114cb486f..086f62f5dc9e 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1388,11 +1388,12 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                        qhp->attr.layer_etype = attrs->layer_etype;
                        qhp->attr.ecode = attrs->ecode;
                        ep = qhp->ep;
-                        disconnect = 1;
+                        if (!internal) {
-                        c4iw_get_ep(&qhp->ep->com);
+                                c4iw_get_ep(&qhp->ep->com);
-                        if (!internal)
                                terminate = 1;
-                        else {
+                                disconnect = 1;
+                        } else {
+                                terminate = qhp->attr.send_term;
                                ret = rdma_fini(rhp, qhp, ep);
                                if (ret)
                                        goto err;
@@ -1776,11 +1777,15 @@ int c4iw_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        /*
         * Use SQ_PSN and RQ_PSN to pass in IDX_INC values for
         * ringing the queue db when we're in DB_FULL mode.
+         * Only allow this on T4 devices.
         */
        attrs.sq_db_inc = attr->sq_psn;
        attrs.rq_db_inc = attr->rq_psn;
        mask |= (attr_mask & IB_QP_SQ_PSN) ? C4IW_QP_ATTR_SQ_DB : 0;
        mask |= (attr_mask & IB_QP_RQ_PSN) ? C4IW_QP_ATTR_RQ_DB : 0;
+        if (is_t5(to_c4iw_qp(ibqp)->rhp->rdev.lldi.adapter_type) &&
+            (mask & (C4IW_QP_ATTR_SQ_DB|C4IW_QP_ATTR_RQ_DB)))
+                return -EINVAL;
        return c4iw_modify_qp(rhp, qhp, mask, &attrs, 0);
 }
diff --git a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
index dc193c292671..6121ca08fe58 100644
--- a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
+++ b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
@@ -836,4 +836,18 @@ struct ulptx_idata {
 #define V_RX_DACK_CHANGE(x) ((x) << S_RX_DACK_CHANGE)
 #define F_RX_DACK_CHANGE    V_RX_DACK_CHANGE(1U)
+enum {                     /* TCP congestion control algorithms */
+        CONG_ALG_RENO,
+        CONG_ALG_TAHOE,
+        CONG_ALG_NEWRENO,
+        CONG_ALG_HIGHSPEED
+};
+#define S_CONG_CNTRL    14
+#define M_CONG_CNTRL    0x3
+#define V_CONG_CNTRL(x) ((x) << S_CONG_CNTRL)
+#define G_CONG_CNTRL(x) (((x) >> S_CONG_CNTRL) & M_CONG_CNTRL)
+#define T5_OPT_2_VALID       (1 << 31)
 #endif /* _T4FW_RI_API_H_ */
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index c98fdb185931..a1710465faaf 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -28,6 +28,7 @@
 #include <target/target_core_base.h>
 #include <target/target_core_fabric.h>
 #include <target/iscsi/iscsi_transport.h>
+#include <linux/semaphore.h>
 #include "isert_proto.h"
 #include "ib_isert.h"
@@ -561,7 +562,15 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
        struct isert_device *device;
        struct ib_device *ib_dev = cma_id->device;
        int ret = 0;
-        u8 pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
+        u8 pi_support;
+        spin_lock_bh(&np->np_thread_lock);
+        if (!np->enabled) {
+                spin_unlock_bh(&np->np_thread_lock);
+                pr_debug("iscsi_np is not enabled, reject connect request\n");
+                return rdma_reject(cma_id, NULL, 0);
+        }
+        spin_unlock_bh(&np->np_thread_lock);
        pr_debug("Entering isert_connect_request cma_id: %p, context: %p\n",
                 cma_id, cma_id->context);
@@ -652,6 +661,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                goto out_mr;
        }
+        pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
        if (pi_support && !device->pi_capable) {
                pr_err("Protection information requested but not supported\n");
                ret = -EINVAL;
@@ -663,11 +673,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                goto out_conn_dev;
        mutex_lock(&isert_np->np_accept_mutex);
-        list_add_tail(&isert_np->np_accept_list, &isert_conn->conn_accept_node);
+        list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list);
        mutex_unlock(&isert_np->np_accept_mutex);
-        pr_debug("isert_connect_request() waking up np_accept_wq: %p\n", np);
+        pr_debug("isert_connect_request() up np_sem np: %p\n", np);
-        wake_up(&isert_np->np_accept_wq);
+        up(&isert_np->np_sem);
        return 0;
 out_conn_dev:
@@ -2999,7 +3009,7 @@ isert_setup_np(struct iscsi_np *np,
                pr_err("Unable to allocate struct isert_np\n");
                return -ENOMEM;
        }
-        init_waitqueue_head(&isert_np->np_accept_wq);
+        sema_init(&isert_np->np_sem, 0);
        mutex_init(&isert_np->np_accept_mutex);
        INIT_LIST_HEAD(&isert_np->np_accept_list);
        init_completion(&isert_np->np_login_comp);
@@ -3048,18 +3058,6 @@ out:
 }
 static int
-isert_check_accept_queue(struct isert_np *isert_np)
-{
-        int empty;
-        mutex_lock(&isert_np->np_accept_mutex);
-        empty = list_empty(&isert_np->np_accept_list);
-        mutex_unlock(&isert_np->np_accept_mutex);
-        return empty;
-}
-static int
 isert_rdma_accept(struct isert_conn *isert_conn)
 {
        struct rdma_cm_id *cm_id = isert_conn->conn_cm_id;
@@ -3151,16 +3149,14 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
        int max_accept = 0, ret;
 accept_wait:
-        ret = wait_event_interruptible(isert_np->np_accept_wq,
+        ret = down_interruptible(&isert_np->np_sem);
-                        !isert_check_accept_queue(isert_np) ||
-                        np->np_thread_state == ISCSI_NP_THREAD_RESET);
        if (max_accept > 5)
                return -ENODEV;
        spin_lock_bh(&np->np_thread_lock);
        if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                spin_unlock_bh(&np->np_thread_lock);
-                pr_err("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
+                pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
                return -ENODEV;
        }
        spin_unlock_bh(&np->np_thread_lock);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 4c072ae34c01..da6612e68000 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -182,7 +182,7 @@ struct isert_device {
 };
 struct isert_np {
-        wait_queue_head_t       np_accept_wq;
+        struct semaphore        np_sem;
        struct rdma_cm_id       *np_cm_id;
        struct mutex            np_accept_mutex;
        struct list_head        np_accept_list;
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 2626773ff29b..2dd1d0dd4f7d 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -243,6 +243,12 @@ static void (*atkbd_platform_fixup)(struct atkbd *, const void *data);
 static void *atkbd_platform_fixup_data;
 static unsigned int (*atkbd_platform_scancode_fixup)(struct atkbd *, unsigned int);
+/*
+ * Certain keyboards to not like ATKBD_CMD_RESET_DIS and stop responding
+ * to many commands until full reset (ATKBD_CMD_RESET_BAT) is performed.
+ */
+static bool atkbd_skip_deactivate;
 static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
                                ssize_t (*handler)(struct atkbd *, char *));
 static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t count,
@@ -768,7 +774,8 @@ static int atkbd_probe(struct atkbd *atkbd)
 * Make sure nothing is coming from the keyboard and disturbs our
 * internal state.
 */
-        atkbd_deactivate(atkbd);
+        if (!atkbd_skip_deactivate)
+                atkbd_deactivate(atkbd);
        return 0;
 }
@@ -1638,6 +1645,12 @@ static int __init atkbd_setup_scancode_fixup(const struct dmi_system_id *id)
        return 1;
 }
+static int __init atkbd_deactivate_fixup(const struct dmi_system_id *id)
+{
+        atkbd_skip_deactivate = true;
+        return 1;
+}
 static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
        {
                .matches = {
@@ -1775,6 +1788,20 @@ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
                .callback = atkbd_setup_scancode_fixup,
                .driver_data = atkbd_oqo_01plus_scancode_fixup,
        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"),
+                },
+                .callback = atkbd_deactivate_fixup,
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"),
+                },
+                .callback = atkbd_deactivate_fixup,
+        },
        { }
 };
diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c
index 55c15304ddbc..4e491c1762cf 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -392,6 +392,13 @@ static const struct of_device_id tca8418_dt_ids[] = {
        { }
 };
 MODULE_DEVICE_TABLE(of, tca8418_dt_ids);
+/*
+ * The device tree based i2c loader looks for
+ * "i2c:" + second_component_of(property("compatible"))
+ * and therefore we need an alias to be found.
+ */
+MODULE_ALIAS("i2c:tca8418");
 #endif
 static struct i2c_driver tca8418_keypad_driver = {
diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c
index 52d3a9b28f0b..b36831c828d3 100644
--- a/drivers/input/misc/bma150.c
+++ b/drivers/input/misc/bma150.c
@@ -70,6 +70,7 @@
 #define BMA150_CFG_5_REG        0x11
 #define BMA150_CHIP_ID          2
+#define BMA180_CHIP_ID          3
 #define BMA150_CHIP_ID_REG      BMA150_DATA_0_REG
 #define BMA150_ACC_X_LSB_REG    BMA150_DATA_2_REG
@@ -539,7 +540,7 @@ static int bma150_probe(struct i2c_client *client,
        }
        chip_id = i2c_smbus_read_byte_data(client, BMA150_CHIP_ID_REG);
-        if (chip_id != BMA150_CHIP_ID) {
+        if (chip_id != BMA150_CHIP_ID && chip_id != BMA180_CHIP_ID) {
                dev_err(&client->dev, "BMA150 chip id error: %d\n", chip_id);
                return -EINVAL;
        }
@@ -643,6 +644,7 @@ static UNIVERSAL_DEV_PM_OPS(bma150_pm, bma150_suspend, bma150_resume, NULL);
 static const struct i2c_device_id bma150_id[] = {
        { "bma150", 0 },
+        { "bma180", 0 },
        { "smb380", 0 },
        { "bma023", 0 },
        { }
diff --git a/drivers/input/misc/da9055_onkey.c b/drivers/input/misc/da9055_onkey.c
index 4b11ede34950..4765799fef74 100644
--- a/drivers/input/misc/da9055_onkey.c
+++ b/drivers/input/misc/da9055_onkey.c
@@ -109,7 +109,6 @@ static int da9055_onkey_probe(struct platform_device *pdev)
        INIT_DELAYED_WORK(&onkey->work, da9055_onkey_work);
-        irq = regmap_irq_get_virq(da9055->irq_data, irq);
        err = request_threaded_irq(irq, NULL, da9055_onkey_irq,
                                   IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
                                   "ONKEY", onkey);
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index 08ead2aaede5..20c80f543d5e 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -169,6 +169,7 @@ static int soc_button_pnp_probe(struct pnp_dev *pdev,
                                soc_button_remove(pdev);
                                return error;
                        }
+                        continue;
                }
                priv->children[i] = pd;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index ef1cf52f8bb9..b96e978a37b7 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -11,6 +11,7 @@
 */
 #include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/input.h>
@@ -831,7 +832,11 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
                break;
        case 3:
-                etd->reg_10 = 0x0b;
+                if (etd->set_hw_resolution)
+                        etd->reg_10 = 0x0b;
+                else
+                        etd->reg_10 = 0x03;
                if (elantech_write_reg(psmouse, 0x10, etd->reg_10))
                        rc = -1;
@@ -1331,6 +1336,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
 }
 /*
+ * Some hw_version 3 models go into error state when we try to set bit 3 of r10
+ */
+static const struct dmi_system_id no_hw_res_dmi_table[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Gigabyte U2442 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "U2442"),
+                },
+        },
+#endif
+        { }
+};
+/*
 * determine hardware version and set some properties according to it.
 */
 static int elantech_set_properties(struct elantech_data *etd)
@@ -1353,6 +1374,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                case 6:
                case 7:
                case 8:
+                case 9:
                        etd->hw_version = 4;
                        break;
                default:
@@ -1389,6 +1411,9 @@ static int elantech_set_properties(struct elantech_data *etd)
         */
        etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
+        /* Enable real hardware resolution on hw_version 3 ? */
+        etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
        return 0;
 }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index 036a04abaef7..9e0e2a1f340d 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -130,6 +130,7 @@ struct elantech_data {
        bool jumpy_cursor;
        bool reports_pressure;
        bool crc_enabled;
+        bool set_hw_resolution;
        unsigned char hw_version;
        unsigned int fw_version;
        unsigned int single_finger_reports;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index d8d49d10f9bb..d68d33fb5ac2 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -117,6 +117,44 @@ void synaptics_reset(struct psmouse *psmouse)
 }
 #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
+/* This list has been kindly provided by Synaptics. */
+static const char * const topbuttonpad_pnp_ids[] = {
+        "LEN0017",
+        "LEN0018",
+        "LEN0019",
+        "LEN0023",
+        "LEN002A",
+        "LEN002B",
+        "LEN002C",
+        "LEN002D",
+        "LEN002E",
+        "LEN0033", /* Helix */
+        "LEN0034", /* T431s, T540, X1 Carbon 2nd */
+        "LEN0035", /* X240 */
+        "LEN0036", /* T440 */
+        "LEN0037",
+        "LEN0038",
+        "LEN0041",
+        "LEN0042", /* Yoga */
+        "LEN0045",
+        "LEN0046",
+        "LEN0047",
+        "LEN0048",
+        "LEN0049",
+        "LEN2000",
+        "LEN2001",
+        "LEN2002",
+        "LEN2003",
+        "LEN2004", /* L440 */
+        "LEN2005",
+        "LEN2006",
+        "LEN2007",
+        "LEN2008",
+        "LEN2009",
+        "LEN200A",
+        "LEN200B",
+        NULL
+};
 /*****************************************************************************
 *      Synaptics communications functions
@@ -1255,8 +1293,10 @@ static void set_abs_position_params(struct input_dev *dev,
        input_abs_set_res(dev, y_code, priv->y_res);
 }
-static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
+static void set_input_params(struct psmouse *psmouse,
+                             struct synaptics_data *priv)
 {
+        struct input_dev *dev = psmouse->dev;
        int i;
        /* Things that apply to both modes */
@@ -1325,6 +1365,17 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
+                /* See if this buttonpad has a top button area */
+                if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4)) {
+                        for (i = 0; topbuttonpad_pnp_ids[i]; i++) {
+                                if (strstr(psmouse->ps2dev.serio->firmware_id,
+                                           topbuttonpad_pnp_ids[i])) {
+                                        __set_bit(INPUT_PROP_TOPBUTTONPAD,
+                                                  dev->propbit);
+                                        break;
+                                }
+                        }
+                }
                /* Clickpads report only left button */
                __clear_bit(BTN_RIGHT, dev->keybit);
                __clear_bit(BTN_MIDDLE, dev->keybit);
@@ -1515,6 +1566,22 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
                .driver_data = (int []){1232, 5710, 1156, 4696},
        },
        {
+                /* Lenovo ThinkPad Edge E431 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"),
+                },
+                .driver_data = (int []){1024, 5022, 2508, 4832},
+        },
+        {
+                /* Lenovo ThinkPad T431s */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"),
+                },
+                .driver_data = (int []){1024, 5112, 2024, 4832},
+        },
+        {
                /* Lenovo ThinkPad T440s */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -1523,6 +1590,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
                .driver_data = (int []){1024, 5112, 2024, 4832},
        },
        {
+                /* Lenovo ThinkPad L440 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"),
+                },
+                .driver_data = (int []){1024, 5112, 2024, 4832},
+        },
+        {
                /* Lenovo ThinkPad T540p */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -1530,6 +1605,32 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
                },
                .driver_data = (int []){1024, 5056, 2058, 4832},
        },
+        {
+                /* Lenovo ThinkPad L540 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"),
+                },
+                .driver_data = (int []){1024, 5112, 2024, 4832},
+        },
+        {
+                /* Lenovo Yoga S1 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
+                                        "ThinkPad S1 Yoga"),
+                },
+                .driver_data = (int []){1232, 5710, 1156, 4696},
+        },
+        {
+                /* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION,
+                                        "ThinkPad X1 Carbon 2nd"),
+                },
+                .driver_data = (int []){1024, 5112, 2024, 4832},
+        },
 #endif
        { }
 };
@@ -1593,7 +1694,7 @@ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
                     priv->capabilities, priv->ext_cap, priv->ext_cap_0c,
                     priv->board_id, priv->firmware_id);
-        set_input_params(psmouse->dev, priv);
+        set_input_params(psmouse, priv);
        /*
         * Encode touchpad model so that it can be used to set
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 0ec9abbe31fe..381b20d4c561 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -702,6 +702,17 @@ static int i8042_pnp_aux_irq;
 static char i8042_pnp_kbd_name[32];
 static char i8042_pnp_aux_name[32];
+static void i8042_pnp_id_to_string(struct pnp_id *id, char *dst, int dst_size)
+{
+        strlcpy(dst, "PNP:", dst_size);
+        while (id) {
+                strlcat(dst, " ", dst_size);
+                strlcat(dst, id->id, dst_size);
+                id = id->next;
+        }
+}
 static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *did)
 {
        if (pnp_port_valid(dev, 0) && pnp_port_len(dev, 0) == 1)
@@ -718,6 +729,8 @@ static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *
                strlcat(i8042_pnp_kbd_name, ":", sizeof(i8042_pnp_kbd_name));
                strlcat(i8042_pnp_kbd_name, pnp_dev_name(dev), sizeof(i8042_pnp_kbd_name));
        }
+        i8042_pnp_id_to_string(dev->id, i8042_kbd_firmware_id,
+                               sizeof(i8042_kbd_firmware_id));
        /* Keyboard ports are always supposed to be wakeup-enabled */
        device_set_wakeup_enable(&dev->dev, true);
@@ -742,6 +755,8 @@ static int i8042_pnp_aux_probe(struct pnp_dev *dev, const struct pnp_device_id *
                strlcat(i8042_pnp_aux_name, ":", sizeof(i8042_pnp_aux_name));
                strlcat(i8042_pnp_aux_name, pnp_dev_name(dev), sizeof(i8042_pnp_aux_name));
        }
+        i8042_pnp_id_to_string(dev->id, i8042_aux_firmware_id,
+                               sizeof(i8042_aux_firmware_id));
        i8042_pnp_aux_devices++;
        return 0;
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 020053fa5aaa..3807c3e971cc 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -87,6 +87,8 @@ MODULE_PARM_DESC(debug, "Turn i8042 debugging mode on and off");
 #endif
 static bool i8042_bypass_aux_irq_test;
+static char i8042_kbd_firmware_id[128];
+static char i8042_aux_firmware_id[128];
 #include "i8042.h"
@@ -1218,6 +1220,8 @@ static int __init i8042_create_kbd_port(void)
        serio->dev.parent       = &i8042_platform_device->dev;
        strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
        strlcpy(serio->phys, I8042_KBD_PHYS_DESC, sizeof(serio->phys));
+        strlcpy(serio->firmware_id, i8042_kbd_firmware_id,
+                sizeof(serio->firmware_id));
        port->serio = serio;
        port->irq = I8042_KBD_IRQ;
@@ -1244,6 +1248,8 @@ static int __init i8042_create_aux_port(int idx)
        if (idx < 0) {
                strlcpy(serio->name, "i8042 AUX port", sizeof(serio->name));
                strlcpy(serio->phys, I8042_AUX_PHYS_DESC, sizeof(serio->phys));
+                strlcpy(serio->firmware_id, i8042_aux_firmware_id,
+                        sizeof(serio->firmware_id));
                serio->close = i8042_port_close;
        } else {
                snprintf(serio->name, sizeof(serio->name), "i8042 AUX%d port", idx);
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 8f4c4ab04bc2..b29134de983b 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -451,6 +451,13 @@ static ssize_t serio_set_bind_mode(struct device *dev, struct device_attribute *
        return retval;
 }
+static ssize_t firmware_id_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct serio *serio = to_serio_port(dev);
+        return sprintf(buf, "%s\n", serio->firmware_id);
+}
 static DEVICE_ATTR_RO(type);
 static DEVICE_ATTR_RO(proto);
 static DEVICE_ATTR_RO(id);
@@ -473,12 +480,14 @@ static DEVICE_ATTR_RO(modalias);
 static DEVICE_ATTR_WO(drvctl);
 static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
 static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
+static DEVICE_ATTR_RO(firmware_id);
 static struct attribute *serio_device_attrs[] = {
        &dev_attr_modalias.attr,
        &dev_attr_description.attr,
        &dev_attr_drvctl.attr,
        &dev_attr_bind_mode.attr,
+        &dev_attr_firmware_id.attr,
        NULL
 };
@@ -921,9 +930,14 @@ static int serio_uevent(struct device *dev, struct kobj_uevent_env *env)
        SERIO_ADD_UEVENT_VAR("SERIO_PROTO=%02x", serio->id.proto);
        SERIO_ADD_UEVENT_VAR("SERIO_ID=%02x", serio->id.id);
        SERIO_ADD_UEVENT_VAR("SERIO_EXTRA=%02x", serio->id.extra);
        SERIO_ADD_UEVENT_VAR("MODALIAS=serio:ty%02Xpr%02Xid%02Xex%02X",
                                serio->id.type, serio->id.proto, serio->id.id, serio->id.extra);
+        if (serio->firmware_id[0])
+                SERIO_ADD_UEVENT_VAR("SERIO_FIRMWARE_ID=%s",
+                                     serio->firmware_id);
        return 0;
 }
 #undef SERIO_ADD_UEVENT_VAR
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index b16ebef5b911..611fc3905d00 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -22,23 +22,18 @@
 #define HID_USAGE_PAGE_DIGITIZER        0x0d
 #define HID_USAGE_PAGE_DESKTOP          0x01
 #define HID_USAGE                       0x09
-#define HID_USAGE_X                     0x30
+#define HID_USAGE_X                     ((HID_USAGE_PAGE_DESKTOP << 16) | 0x30)
-#define HID_USAGE_Y                     0x31
+#define HID_USAGE_Y                     ((HID_USAGE_PAGE_DESKTOP << 16) | 0x31)
-#define HID_USAGE_X_TILT                0x3d
+#define HID_USAGE_PRESSURE              ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x30)
-#define HID_USAGE_Y_TILT                0x3e
+#define HID_USAGE_X_TILT                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x3d)
-#define HID_USAGE_FINGER                0x22
+#define HID_USAGE_Y_TILT                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x3e)
-#define HID_USAGE_STYLUS                0x20
+#define HID_USAGE_FINGER                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x22)
-#define HID_USAGE_CONTACTMAX            0x55
+#define HID_USAGE_STYLUS                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x20)
+#define HID_USAGE_CONTACTMAX            ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x55)
 #define HID_COLLECTION                  0xa1
 #define HID_COLLECTION_LOGICAL          0x02
 #define HID_COLLECTION_END              0xc0
-enum {
-        WCM_UNDEFINED = 0,
-        WCM_DESKTOP,
-        WCM_DIGITIZER,
-};
 struct hid_descriptor {
        struct usb_descriptor_header header;
        __le16   bcdHID;
@@ -305,7 +300,7 @@ static int wacom_parse_hid(struct usb_interface *intf,
        char limit = 0;
        /* result has to be defined as int for some devices */
        int result = 0, touch_max = 0;
-        int i = 0, usage = WCM_UNDEFINED, finger = 0, pen = 0;
+        int i = 0, page = 0, finger = 0, pen = 0;
        unsigned char *report;
        report = kzalloc(hid_desc->wDescriptorLength, GFP_KERNEL);
@@ -332,134 +327,121 @@ static int wacom_parse_hid(struct usb_interface *intf,
                switch (report[i]) {
                case HID_USAGE_PAGE:
-                        switch (report[i + 1]) {
+                        page = report[i + 1];
-                        case HID_USAGE_PAGE_DIGITIZER:
+                        i++;
-                                usage = WCM_DIGITIZER;
-                                i++;
-                                break;
-                        case HID_USAGE_PAGE_DESKTOP:
-                                usage = WCM_DESKTOP;
-                                i++;
-                                break;
-                        }
                        break;
                case HID_USAGE:
-                        switch (report[i + 1]) {
+                        switch (page << 16 | report[i + 1]) {
                        case HID_USAGE_X:
-                                if (usage == WCM_DESKTOP) {
+                                if (finger) {
-                                        if (finger) {
+                                        features->device_type = BTN_TOOL_FINGER;
-                                                features->device_type = BTN_TOOL_FINGER;
+                                        /* touch device at least supports one touch point */
-                                                /* touch device at least supports one touch point */
+                                        touch_max = 1;
-                                                touch_max = 1;
+                                        switch (features->type) {
-                                                switch (features->type) {
+                                        case TABLETPC2FG:
-                                                case TABLETPC2FG:
+                                                features->pktlen = WACOM_PKGLEN_TPC2FG;
-                                                        features->pktlen = WACOM_PKGLEN_TPC2FG;
+                                                break;
-                                                        break;
+                                        case MTSCREEN:
-                                                case MTSCREEN:
+                                        case WACOM_24HDT:
-                                                case WACOM_24HDT:
+                                                features->pktlen = WACOM_PKGLEN_MTOUCH;
-                                                        features->pktlen = WACOM_PKGLEN_MTOUCH;
+                                                break;
-                                                        break;
+                                        case MTTPC:
-                                                case MTTPC:
+                                                features->pktlen = WACOM_PKGLEN_MTTPC;
-                                                        features->pktlen = WACOM_PKGLEN_MTTPC;
+                                                break;
-                                                        break;
+                                        case BAMBOO_PT:
-                                                case BAMBOO_PT:
+                                                features->pktlen = WACOM_PKGLEN_BBTOUCH;
-                                                        features->pktlen = WACOM_PKGLEN_BBTOUCH;
+                                                break;
-                                                        break;
+                                        default:
-                                                default:
+                                                features->pktlen = WACOM_PKGLEN_GRAPHIRE;
-                                                        features->pktlen = WACOM_PKGLEN_GRAPHIRE;
+                                                break;
-                                                        break;
+                                        }
-                                                }
+                                        switch (features->type) {
-                                                switch (features->type) {
+                                        case BAMBOO_PT:
-                                                case BAMBOO_PT:
+                                                features->x_phy =
-                                                        features->x_phy =
+                                                        get_unaligned_le16(&report[i + 5]);
-                                                                get_unaligned_le16(&report[i + 5]);
+                                                features->x_max =
-                                                        features->x_max =
+                                                        get_unaligned_le16(&report[i + 8]);
-                                                                get_unaligned_le16(&report[i + 8]);
+                                                i += 15;
-                                                        i += 15;
+                                                break;
-                                                        break;
+                                        case WACOM_24HDT:
-                                                case WACOM_24HDT:
-                                                        features->x_max =
-                                                                get_unaligned_le16(&report[i + 3]);
-                                                        features->x_phy =
-                                                                get_unaligned_le16(&report[i + 8]);
-                                                        features->unit = report[i - 1];
-                                                        features->unitExpo = report[i - 3];
-                                                        i += 12;
-                                                        break;
-                                                default:
-                                                        features->x_max =
-                                                                get_unaligned_le16(&report[i + 3]);
-                                                        features->x_phy =
-                                                                get_unaligned_le16(&report[i + 6]);
-                                                        features->unit = report[i + 9];
-                                                        features->unitExpo = report[i + 11];
-                                                        i += 12;
-                                                        break;
-                                                }
-                                        } else if (pen) {
-                                                /* penabled only accepts exact bytes of data */
-                                                if (features->type >= TABLETPC)
-                                                        features->pktlen = WACOM_PKGLEN_GRAPHIRE;
-                                                features->device_type = BTN_TOOL_PEN;
                                                features->x_max =
                                                        get_unaligned_le16(&report[i + 3]);
-                                                i += 4;
+                                                features->x_phy =
+                                                        get_unaligned_le16(&report[i + 8]);
+                                                features->unit = report[i - 1];
+                                                features->unitExpo = report[i - 3];
+                                                i += 12;
+                                                break;
+                                        default:
+                                                features->x_max =
+                                                        get_unaligned_le16(&report[i + 3]);
+                                                features->x_phy =
+                                                        get_unaligned_le16(&report[i + 6]);
+                                                features->unit = report[i + 9];
+                                                features->unitExpo = report[i + 11];
+                                                i += 12;
+                                                break;
                                        }
+                                } else if (pen) {
+                                        /* penabled only accepts exact bytes of data */
+                                        if (features->type >= TABLETPC)
+                                                features->pktlen = WACOM_PKGLEN_GRAPHIRE;
+                                        features->device_type = BTN_TOOL_PEN;
+                                        features->x_max =
+                                                get_unaligned_le16(&report[i + 3]);
+                                        i += 4;
                                }
                                break;
                        case HID_USAGE_Y:
-                                if (usage == WCM_DESKTOP) {
+                                if (finger) {
-                                        if (finger) {
+                                        switch (features->type) {
-                                                switch (features->type) {
+                                        case TABLETPC2FG:
-                                                case TABLETPC2FG:
+                                        case MTSCREEN:
-                                                case MTSCREEN:
+                                        case MTTPC:
-                                                case MTTPC:
+                                                features->y_max =
-                                                        features->y_max =
+                                                        get_unaligned_le16(&report[i + 3]);
-                                                                get_unaligned_le16(&report[i + 3]);
+                                                features->y_phy =
-                                                        features->y_phy =
+                                                        get_unaligned_le16(&report[i + 6]);
-                                                                get_unaligned_le16(&report[i + 6]);
+                                                i += 7;
-                                                        i += 7;
+                                                break;
-                                                        break;
+                                        case WACOM_24HDT:
-                                                case WACOM_24HDT:
+                                                features->y_max =
-                                                        features->y_max =
+                                                        get_unaligned_le16(&report[i + 3]);
-                                                                get_unaligned_le16(&report[i + 3]);
+                                                features->y_phy =
-                                                        features->y_phy =
+                                                        get_unaligned_le16(&report[i - 2]);
-                                                                get_unaligned_le16(&report[i - 2]);
+                                                i += 7;
-                                                        i += 7;
+                                                break;
-                                                        break;
+                                        case BAMBOO_PT:
-                                                case BAMBOO_PT:
+                                                features->y_phy =
-                                                        features->y_phy =
+                                                        get_unaligned_le16(&report[i + 3]);
-                                                                get_unaligned_le16(&report[i + 3]);
+                                                features->y_max =
-                                                        features->y_max =
+                                                        get_unaligned_le16(&report[i + 6]);
-                                                                get_unaligned_le16(&report[i + 6]);
+                                                i += 12;
-                                                        i += 12;
+                                                break;
-                                                        break;
+                                        default:
-                                                default:
-                                                        features->y_max =
-                                                                features->x_max;
-                                                        features->y_phy =
-                                                                get_unaligned_le16(&report[i + 3]);
-                                                        i += 4;
-                                                        break;
-                                                }
-                                        } else if (pen) {
                                                features->y_max =
+                                                        features->x_max;
+                                                features->y_phy =
                                                        get_unaligned_le16(&report[i + 3]);
                                                i += 4;
+                                                break;
                                        }
+                                } else if (pen) {
+                                        features->y_max =
+                                                get_unaligned_le16(&report[i + 3]);
+                                        i += 4;
                                }
                                break;
@@ -484,12 +466,20 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                        wacom_retrieve_report_data(intf, features);
                                i++;
                                break;
+                        case HID_USAGE_PRESSURE:
+                                if (pen) {
+                                        features->pressure_max =
+                                                get_unaligned_le16(&report[i + 3]);
+                                        i += 4;
+                                }
+                                break;
                        }
                        break;
                case HID_COLLECTION_END:
                        /* reset UsagePage and Finger */
-                        finger = usage = 0;
+                        finger = page = 0;
                        break;
                case HID_COLLECTION:
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 05f371df6c40..4822c57a3756 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -178,10 +178,9 @@ static int wacom_ptu_irq(struct wacom_wac *wacom)
 static int wacom_dtu_irq(struct wacom_wac *wacom)
 {
-        struct wacom_features *features = &wacom->features;
+        unsigned char *data = wacom->data;
-        char *data = wacom->data;
        struct input_dev *input = wacom->input;
-        int prox = data[1] & 0x20, pressure;
+        int prox = data[1] & 0x20;
        dev_dbg(input->dev.parent,
                "%s: received report #%d", __func__, data[0]);
@@ -198,10 +197,7 @@ static int wacom_dtu_irq(struct wacom_wac *wacom)
        input_report_key(input, BTN_STYLUS2, data[1] & 0x10);
        input_report_abs(input, ABS_X, le16_to_cpup((__le16 *)&data[2]));
        input_report_abs(input, ABS_Y, le16_to_cpup((__le16 *)&data[4]));
-        pressure = ((data[7] & 0x01) << 8) | data[6];
+        input_report_abs(input, ABS_PRESSURE, ((data[7] & 0x01) << 8) | data[6]);
-        if (pressure < 0)
-                pressure = features->pressure_max + pressure + 1;
-        input_report_abs(input, ABS_PRESSURE, pressure);
        input_report_key(input, BTN_TOUCH, data[1] & 0x05);
        if (!prox) /* out-prox */
                wacom->id[0] = 0;
@@ -906,7 +902,7 @@ static int int_dist(int x1, int y1, int x2, int y2)
 static int wacom_24hdt_irq(struct wacom_wac *wacom)
 {
        struct input_dev *input = wacom->input;
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        int i;
        int current_num_contacts = data[61];
        int contacts_to_send = 0;
@@ -959,7 +955,7 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
 static int wacom_mt_touch(struct wacom_wac *wacom)
 {
        struct input_dev *input = wacom->input;
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        int i;
        int current_num_contacts = data[2];
        int contacts_to_send = 0;
@@ -1038,7 +1034,7 @@ static int wacom_tpc_mt_touch(struct wacom_wac *wacom)
 static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 {
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        struct input_dev *input = wacom->input;
        bool prox;
        int x = 0, y = 0;
@@ -1074,10 +1070,8 @@ static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 static int wacom_tpc_pen(struct wacom_wac *wacom)
 {
-        struct wacom_features *features = &wacom->features;
+        unsigned char *data = wacom->data;
-        char *data = wacom->data;
        struct input_dev *input = wacom->input;
-        int pressure;
        bool prox = data[1] & 0x20;
        if (!wacom->shared->stylus_in_proximity) /* first in prox */
@@ -1093,10 +1087,7 @@ static int wacom_tpc_pen(struct wacom_wac *wacom)
                input_report_key(input, BTN_STYLUS2, data[1] & 0x10);
                input_report_abs(input, ABS_X, le16_to_cpup((__le16 *)&data[2]));
                input_report_abs(input, ABS_Y, le16_to_cpup((__le16 *)&data[4]));
-                pressure = ((data[7] & 0x01) << 8) | data[6];
+                input_report_abs(input, ABS_PRESSURE, ((data[7] & 0x03) << 8) | data[6]);
-                if (pressure < 0)
-                        pressure = features->pressure_max + pressure + 1;
-                input_report_abs(input, ABS_PRESSURE, pressure);
                input_report_key(input, BTN_TOUCH, data[1] & 0x05);
                input_report_key(input, wacom->tool[0], prox);
                return 1;
@@ -1107,7 +1098,7 @@ static int wacom_tpc_pen(struct wacom_wac *wacom)
 static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
 {
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        dev_dbg(wacom->input->dev.parent,
                "%s: received report #%d\n", __func__, data[0]);
@@ -1838,7 +1829,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
        case DTU:
                if (features->type == DTUS) {
                        input_set_capability(input_dev, EV_MSC, MSC_SERIAL);
-                        for (i = 0; i < 3; i++)
+                        for (i = 0; i < 4; i++)
                                __set_bit(BTN_0 + i, input_dev->keybit);
                }
                __set_bit(BTN_TOOL_PEN, input_dev->keybit);
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 45a06e495ed2..7f8aa981500d 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -425,7 +425,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
 name ## _show(struct device *dev, struct device_attribute *attr, char *buf) \
 { \
        struct ads7846 *ts = dev_get_drvdata(dev); \
-        ssize_t v = ads7846_read12_ser(dev, \
+        ssize_t v = ads7846_read12_ser(&ts->spi->dev, \
                        READ_12BIT_SER(var)); \
        if (v < 0) \
                return v; \
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index c949520bd196..57068e8035b5 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3999,7 +3999,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
        iommu_flush_dte(iommu, devid);
        if (devid != alias) {
                irq_lookup_table[alias] = table;
-                set_dte_irq_entry(devid, table);
+                set_dte_irq_entry(alias, table);
                iommu_flush_dte(iommu, alias);
        }
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index b76c58dbe30c..0e08545d7298 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -788,7 +788,7 @@ static void __init set_device_exclusion_range(u16 devid, struct ivmd_header *m)
                 * per device. But we can enable the exclusion range per
                 * device. This is done here
                 */
-                set_dev_entry_bit(m->devid, DEV_ENTRY_EX);
+                set_dev_entry_bit(devid, DEV_ENTRY_EX);
                iommu->exclusion_start = m->range_start;
                iommu->exclusion_length = m->range_length;
        }
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index 5208828792e6..203b2e6a91cf 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -504,8 +504,10 @@ static void do_fault(struct work_struct *work)
        write = !!(fault->flags & PPR_FAULT_WRITE);
+        down_read(&fault->state->mm->mmap_sem);
        npages = get_user_pages(fault->state->task, fault->state->mm,
                                fault->address, 1, write, 0, &page, NULL);
+        up_read(&fault->state->mm->mmap_sem);
        if (npages == 1) {
                put_page(page);
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 41be897df8d5..3899ba7821c5 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -41,6 +41,7 @@
 #define ARMADA_370_XP_INT_SET_ENABLE_OFFS       (0x30)
 #define ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS     (0x34)
 #define ARMADA_370_XP_INT_SOURCE_CTL(irq)       (0x100 + irq*4)
+#define ARMADA_370_XP_INT_SOURCE_CPU_MASK       0xF
 #define ARMADA_370_XP_CPU_INTACK_OFFS           (0x44)
 #define ARMADA_375_PPI_CAUSE                    (0x10)
@@ -132,8 +133,7 @@ static int armada_370_xp_setup_msi_irq(struct msi_chip *chip,
                                       struct msi_desc *desc)
 {
        struct msi_msg msg;
-        irq_hw_number_t hwirq;
+        int virq, hwirq;
-        int virq;
        hwirq = armada_370_xp_alloc_msi();
        if (hwirq < 0)
@@ -159,8 +159,19 @@ static void armada_370_xp_teardown_msi_irq(struct msi_chip *chip,
                                           unsigned int irq)
 {
        struct irq_data *d = irq_get_irq_data(irq);
+        unsigned long hwirq = d->hwirq;
        irq_dispose_mapping(irq);
-        armada_370_xp_free_msi(d->hwirq);
+        armada_370_xp_free_msi(hwirq);
+}
+static int armada_370_xp_check_msi_device(struct msi_chip *chip, struct pci_dev *dev,
+                                          int nvec, int type)
+{
+        /* We support MSI, but not MSI-X */
+        if (type == PCI_CAP_ID_MSI)
+                return 0;
+        return -EINVAL;
 }
 static struct irq_chip armada_370_xp_msi_irq_chip = {
@@ -201,6 +212,7 @@ static int armada_370_xp_msi_init(struct device_node *node,
        msi_chip->setup_irq = armada_370_xp_setup_msi_irq;
        msi_chip->teardown_irq = armada_370_xp_teardown_msi_irq;
+        msi_chip->check_device = armada_370_xp_check_msi_device;
        msi_chip->of_node = node;
        armada_370_xp_msi_domain =
@@ -244,35 +256,18 @@ static DEFINE_RAW_SPINLOCK(irq_controller_lock);
 static int armada_xp_set_affinity(struct irq_data *d,
                                  const struct cpumask *mask_val, bool force)
 {
-        unsigned long reg;
-        unsigned long new_mask = 0;
-        unsigned long online_mask = 0;
-        unsigned long count = 0;
        irq_hw_number_t hwirq = irqd_to_hwirq(d);
+        unsigned long reg, mask;
        int cpu;
-        for_each_cpu(cpu, mask_val) {
+        /* Select a single core from the affinity mask which is online */
-                new_mask |= 1 << cpu_logical_map(cpu);
+        cpu = cpumask_any_and(mask_val, cpu_online_mask);
-                count++;
+        mask = 1UL << cpu_logical_map(cpu);
-        }
-        /*
-         * Forbid mutlicore interrupt affinity
-         * This is required since the MPIC HW doesn't limit
-         * several CPUs from acknowledging the same interrupt.
-         */
-        if (count > 1)
-                return -EINVAL;
-        for_each_cpu(cpu, cpu_online_mask)
-                online_mask |= 1 << cpu_logical_map(cpu);
        raw_spin_lock(&irq_controller_lock);
        reg = readl(main_int_base + ARMADA_370_XP_INT_SOURCE_CTL(hwirq));
-        reg = (reg & (~online_mask)) | new_mask;
+        reg = (reg & (~ARMADA_370_XP_INT_SOURCE_CPU_MASK)) | mask;
        writel(reg, main_int_base + ARMADA_370_XP_INT_SOURCE_CTL(hwirq));
        raw_spin_unlock(&irq_controller_lock);
        return 0;
@@ -494,15 +489,6 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
 #ifdef CONFIG_SMP
        armada_xp_mpic_smp_cpu_init();
-        /*
-         * Set the default affinity from all CPUs to the boot cpu.
-         * This is required since the MPIC doesn't limit several CPUs
-         * from acknowledging the same interrupt.
-         */
-        cpumask_clear(irq_default_affinity);
-        cpumask_set_cpu(smp_processor_id(), irq_default_affinity);
 #endif
        armada_370_xp_msi_init(node, main_int_res.start);
diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index fc817d28d1fe..3d15d16a7088 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -107,7 +107,7 @@ static int __init crossbar_of_init(struct device_node *node)
        int i, size, max, reserved = 0, entry;
        const __be32 *irqsr;
-        cb = kzalloc(sizeof(struct cb_device *), GFP_KERNEL);
+        cb = kzalloc(sizeof(*cb), GFP_KERNEL);
        if (!cb)
                return -ENOMEM;
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 4300b6606f5e..57d165e026f4 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -246,10 +246,14 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                            bool force)
 {
        void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
-        unsigned int shift = (gic_irq(d) % 4) * 8;
+        unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
        u32 val, mask, bit;
+        if (!force)
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        else
+                cpu = cpumask_first(mask_val);
        if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
                return -EINVAL;
diff --git a/drivers/isdn/hisax/icc.c b/drivers/isdn/hisax/icc.c
index 51dae9167238..96d1df05044f 100644
--- a/drivers/isdn/hisax/icc.c
+++ b/drivers/isdn/hisax/icc.c
@@ -425,7 +425,7 @@ afterXPR:
                                if (cs->debug & L1_DEB_MONITOR)
                                        debugl1(cs, "ICC %02x -> MOX1", cs->dc.icc.mon_tx[cs->dc.icc.mon_txp - 1]);
                        }
-                AfterMOX1:
+                AfterMOX1: ;
 #endif
                }
        }
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1bf4a71919ec..9380be7b1895 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2488,6 +2488,7 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
                } else {
                        inc_hit_counter(cache, bio);
+                        pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
                        if (bio_data_dir(bio) == WRITE && writethrough_mode(&cache->features) &&
                            !is_dirty(cache, lookup_result.cblock))
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 784695d22fde..53b213226c01 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -19,7 +19,6 @@
 #include <linux/crypto.h>
 #include <linux/workqueue.h>
 #include <linux/backing-dev.h>
-#include <linux/percpu.h>
 #include <linux/atomic.h>
 #include <linux/scatterlist.h>
 #include <asm/page.h>
@@ -43,6 +42,7 @@ struct convert_context {
        struct bvec_iter iter_out;
        sector_t cc_sector;
        atomic_t cc_pending;
+        struct ablkcipher_request *req;
 };
 /*
@@ -111,15 +111,7 @@ struct iv_tcw_private {
 enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID };
 /*
- * Duplicated per-CPU state for cipher.
+ * The fields in here must be read only after initialization.
- */
-struct crypt_cpu {
-        struct ablkcipher_request *req;
-};
-/*
- * The fields in here must be read only after initialization,
- * changing state should be in crypt_cpu.
 */
 struct crypt_config {
        struct dm_dev *dev;
@@ -150,12 +142,6 @@ struct crypt_config {
        sector_t iv_offset;
        unsigned int iv_size;
-        /*
-         * Duplicated per cpu state. Access through
-         * per_cpu_ptr() only.
-         */
-        struct crypt_cpu __percpu *cpu;
        /* ESSIV: struct crypto_cipher *essiv_tfm */
        void *iv_private;
        struct crypto_ablkcipher **tfms;
@@ -192,11 +178,6 @@ static void clone_init(struct dm_crypt_io *, struct bio *);
 static void kcryptd_queue_crypt(struct dm_crypt_io *io);
 static u8 *iv_of_dmreq(struct crypt_config *cc, struct dm_crypt_request *dmreq);
-static struct crypt_cpu *this_crypt_config(struct crypt_config *cc)
-{
-        return this_cpu_ptr(cc->cpu);
-}
 /*
 * Use this to access cipher attributes that are the same for each CPU.
 */
@@ -903,16 +884,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
 static void crypt_alloc_req(struct crypt_config *cc,
                            struct convert_context *ctx)
 {
-        struct crypt_cpu *this_cc = this_crypt_config(cc);
        unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1);
-        if (!this_cc->req)
+        if (!ctx->req)
-                this_cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
+                ctx->req = mempool_alloc(cc->req_pool, GFP_NOIO);
-        ablkcipher_request_set_tfm(this_cc->req, cc->tfms[key_index]);
+        ablkcipher_request_set_tfm(ctx->req, cc->tfms[key_index]);
-        ablkcipher_request_set_callback(this_cc->req,
+        ablkcipher_request_set_callback(ctx->req,
            CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
-            kcryptd_async_done, dmreq_of_req(cc, this_cc->req));
+            kcryptd_async_done, dmreq_of_req(cc, ctx->req));
 }
 /*
@@ -921,7 +901,6 @@ static void crypt_alloc_req(struct crypt_config *cc,
 static int crypt_convert(struct crypt_config *cc,
                         struct convert_context *ctx)
 {
-        struct crypt_cpu *this_cc = this_crypt_config(cc);
        int r;
        atomic_set(&ctx->cc_pending, 1);
@@ -932,7 +911,7 @@ static int crypt_convert(struct crypt_config *cc,
                atomic_inc(&ctx->cc_pending);
-                r = crypt_convert_block(cc, ctx, this_cc->req);
+                r = crypt_convert_block(cc, ctx, ctx->req);
                switch (r) {
                /* async */
@@ -941,7 +920,7 @@ static int crypt_convert(struct crypt_config *cc,
                        reinit_completion(&ctx->restart);
                        /* fall through*/
                case -EINPROGRESS:
-                        this_cc->req = NULL;
+                        ctx->req = NULL;
                        ctx->cc_sector++;
                        continue;
@@ -1040,6 +1019,7 @@ static struct dm_crypt_io *crypt_io_alloc(struct crypt_config *cc,
        io->sector = sector;
        io->error = 0;
        io->base_io = NULL;
+        io->ctx.req = NULL;
        atomic_set(&io->io_pending, 0);
        return io;
@@ -1065,6 +1045,8 @@ static void crypt_dec_pending(struct dm_crypt_io *io)
        if (!atomic_dec_and_test(&io->io_pending))
                return;
+        if (io->ctx.req)
+                mempool_free(io->ctx.req, cc->req_pool);
        mempool_free(io, cc->io_pool);
        if (likely(!base_io))
@@ -1492,8 +1474,6 @@ static int crypt_wipe_key(struct crypt_config *cc)
 static void crypt_dtr(struct dm_target *ti)
 {
        struct crypt_config *cc = ti->private;
-        struct crypt_cpu *cpu_cc;
-        int cpu;
        ti->private = NULL;
@@ -1505,13 +1485,6 @@ static void crypt_dtr(struct dm_target *ti)
        if (cc->crypt_queue)
                destroy_workqueue(cc->crypt_queue);
-        if (cc->cpu)
-                for_each_possible_cpu(cpu) {
-                        cpu_cc = per_cpu_ptr(cc->cpu, cpu);
-                        if (cpu_cc->req)
-                                mempool_free(cpu_cc->req, cc->req_pool);
-                }
        crypt_free_tfms(cc);
        if (cc->bs)
@@ -1530,9 +1503,6 @@ static void crypt_dtr(struct dm_target *ti)
        if (cc->dev)
                dm_put_device(ti, cc->dev);
-        if (cc->cpu)
-                free_percpu(cc->cpu);
        kzfree(cc->cipher);
        kzfree(cc->cipher_string);
@@ -1588,13 +1558,6 @@ static int crypt_ctr_cipher(struct dm_target *ti,
        if (tmp)
                DMWARN("Ignoring unexpected additional cipher options");
-        cc->cpu = __alloc_percpu(sizeof(*(cc->cpu)),
-                                 __alignof__(struct crypt_cpu));
-        if (!cc->cpu) {
-                ti->error = "Cannot allocate per cpu state";
-                goto bad_mem;
-        }
        /*
         * For compatibility with the original dm-crypt mapping format, if
         * only the cipher name is supplied, use cbc-plain.
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index aa009e865871..fa0f6cbd6a41 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1566,8 +1566,8 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
                }
                if (m->pg_init_required)
                        __pg_init_all_paths(m);
-                spin_unlock_irqrestore(&m->lock, flags);
                dm_table_run_md_queue_async(m->ti->table);
+                spin_unlock_irqrestore(&m->lock, flags);
        }
        return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 53728be84dee..2e71de8e0048 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -27,6 +27,7 @@
 #define MAPPING_POOL_SIZE 1024
 #define PRISON_CELLS 1024
 #define COMMIT_PERIOD HZ
+#define NO_SPACE_TIMEOUT (HZ * 60)
 DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
                "A percentage of time allocated for copy on write");
@@ -175,6 +176,7 @@ struct pool {
        struct workqueue_struct *wq;
        struct work_struct worker;
        struct delayed_work waker;
+        struct delayed_work no_space_timeout;
        unsigned long last_commit_jiffies;
        unsigned ref_count;
@@ -232,6 +234,13 @@ struct thin_c {
        struct bio_list deferred_bio_list;
        struct bio_list retry_on_resume_list;
        struct rb_root sort_bio_list; /* sorted list of deferred bios */
+        /*
+         * Ensures the thin is not destroyed until the worker has finished
+         * iterating the active_thins list.
+         */
+        atomic_t refcount;
+        struct completion can_destroy;
 };
 /*----------------------------------------------------------------*/
@@ -928,7 +937,7 @@ static int commit(struct pool *pool)
 {
        int r;
-        if (get_pool_mode(pool) != PM_WRITE)
+        if (get_pool_mode(pool) >= PM_READ_ONLY)
                return -EINVAL;
        r = dm_pool_commit_metadata(pool->pmd);
@@ -1486,6 +1495,45 @@ static void process_thin_deferred_bios(struct thin_c *tc)
        blk_finish_plug(&plug);
 }
+static void thin_get(struct thin_c *tc);
+static void thin_put(struct thin_c *tc);
+/*
+ * We can't hold rcu_read_lock() around code that can block.  So we
+ * find a thin with the rcu lock held; bump a refcount; then drop
+ * the lock.
+ */
+static struct thin_c *get_first_thin(struct pool *pool)
+{
+        struct thin_c *tc = NULL;
+        rcu_read_lock();
+        if (!list_empty(&pool->active_thins)) {
+                tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list);
+                thin_get(tc);
+        }
+        rcu_read_unlock();
+        return tc;
+}
+static struct thin_c *get_next_thin(struct pool *pool, struct thin_c *tc)
+{
+        struct thin_c *old_tc = tc;
+        rcu_read_lock();
+        list_for_each_entry_continue_rcu(tc, &pool->active_thins, list) {
+                thin_get(tc);
+                thin_put(old_tc);
+                rcu_read_unlock();
+                return tc;
+        }
+        thin_put(old_tc);
+        rcu_read_unlock();
+        return NULL;
+}
 static void process_deferred_bios(struct pool *pool)
 {
        unsigned long flags;
@@ -1493,10 +1541,11 @@ static void process_deferred_bios(struct pool *pool)
        struct bio_list bios;
        struct thin_c *tc;
-        rcu_read_lock();
+        tc = get_first_thin(pool);
-        list_for_each_entry_rcu(tc, &pool->active_thins, list)
+        while (tc) {
                process_thin_deferred_bios(tc);
-        rcu_read_unlock();
+                tc = get_next_thin(pool, tc);
+        }
        /*
         * If there are any deferred flush bios, we must commit
@@ -1543,6 +1592,20 @@ static void do_waker(struct work_struct *ws)
        queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
 }
+/*
+ * We're holding onto IO to allow userland time to react.  After the
+ * timeout either the pool will have been resized (and thus back in
+ * PM_WRITE mode), or we degrade to PM_READ_ONLY and start erroring IO.
+ */
+static void do_no_space_timeout(struct work_struct *ws)
+{
+        struct pool *pool = container_of(to_delayed_work(ws), struct pool,
+                                         no_space_timeout);
+        if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space)
+                set_pool_mode(pool, PM_READ_ONLY);
+}
 /*----------------------------------------------------------------*/
 struct noflush_work {
@@ -1578,7 +1641,7 @@ static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
 {
        struct noflush_work w;
-        INIT_WORK(&w.worker, fn);
+        INIT_WORK_ONSTACK(&w.worker, fn);
        w.tc = tc;
        atomic_set(&w.complete, 0);
        init_waitqueue_head(&w.wait);
@@ -1668,6 +1731,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                pool->process_discard = process_discard;
                pool->process_prepared_mapping = process_prepared_mapping;
                pool->process_prepared_discard = process_prepared_discard_passdown;
+                if (!pool->pf.error_if_no_space)
+                        queue_delayed_work(pool->wq, &pool->no_space_timeout, NO_SPACE_TIMEOUT);
                break;
        case PM_WRITE:
@@ -2053,6 +2119,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
        INIT_WORK(&pool->worker, do_worker);
        INIT_DELAYED_WORK(&pool->waker, do_waker);
+        INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
        spin_lock_init(&pool->lock);
        bio_list_init(&pool->deferred_flush_bios);
        INIT_LIST_HEAD(&pool->prepared_mappings);
@@ -2615,6 +2682,7 @@ static void pool_postsuspend(struct dm_target *ti)
        struct pool *pool = pt->pool;
        cancel_delayed_work(&pool->waker);
+        cancel_delayed_work(&pool->no_space_timeout);
        flush_workqueue(pool->wq);
        (void) commit(pool);
 }
@@ -3061,11 +3129,25 @@ static struct target_type pool_target = {
 /*----------------------------------------------------------------
 * Thin target methods
 *--------------------------------------------------------------*/
+static void thin_get(struct thin_c *tc)
+{
+        atomic_inc(&tc->refcount);
+}
+static void thin_put(struct thin_c *tc)
+{
+        if (atomic_dec_and_test(&tc->refcount))
+                complete(&tc->can_destroy);
+}
 static void thin_dtr(struct dm_target *ti)
 {
        struct thin_c *tc = ti->private;
        unsigned long flags;
+        thin_put(tc);
+        wait_for_completion(&tc->can_destroy);
        spin_lock_irqsave(&tc->pool->lock, flags);
        list_del_rcu(&tc->list);
        spin_unlock_irqrestore(&tc->pool->lock, flags);
@@ -3101,6 +3183,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        struct thin_c *tc;
        struct dm_dev *pool_dev, *origin_dev;
        struct mapped_device *pool_md;
+        unsigned long flags;
        mutex_lock(&dm_thin_pool_table.mutex);
@@ -3191,9 +3274,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        mutex_unlock(&dm_thin_pool_table.mutex);
-        spin_lock(&tc->pool->lock);
+        atomic_set(&tc->refcount, 1);
+        init_completion(&tc->can_destroy);
+        spin_lock_irqsave(&tc->pool->lock, flags);
        list_add_tail_rcu(&tc->list, &tc->pool->active_thins);
-        spin_unlock(&tc->pool->lock);
+        spin_unlock_irqrestore(&tc->pool->lock, flags);
        /*
         * This synchronize_rcu() call is needed here otherwise we risk a
         * wake_worker() call finding no bios to process (because the newly
diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
index 796007a5e0e1..7a7bab8947ae 100644
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -330,15 +330,17 @@ test_block_hash:
                                return r;
                        }
                }
                todo = 1 << v->data_dev_block_bits;
-                while (io->iter.bi_size) {
+                do {
                        u8 *page;
+                        unsigned len;
                        struct bio_vec bv = bio_iter_iovec(bio, io->iter);
                        page = kmap_atomic(bv.bv_page);
-                        r = crypto_shash_update(desc, page + bv.bv_offset,
+                        len = bv.bv_len;
-                                                bv.bv_len);
+                        if (likely(len >= todo))
+                                len = todo;
+                        r = crypto_shash_update(desc, page + bv.bv_offset, len);
                        kunmap_atomic(page);
                        if (r < 0) {
@@ -346,8 +348,9 @@ test_block_hash:
                                return r;
                        }
-                        bio_advance_iter(bio, &io->iter, bv.bv_len);
+                        bio_advance_iter(bio, &io->iter, len);
-                }
+                        todo -= len;
+                } while (todo);
                if (!v->version) {
                        r = crypto_shash_update(desc, v->salt, v->salt_size);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8fda38d23e38..237b7e0ddc7a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8516,7 +8516,8 @@ static int md_notify_reboot(struct notifier_block *this,
                if (mddev_trylock(mddev)) {
                        if (mddev->pers)
                                __md_stop_writes(mddev);
-                        mddev->safemode = 2;
+                        if (mddev->persistent)
+                                mddev->safemode = 2;
                        mddev_unlock(mddev);
                }
                need_delay = 1;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 33fc408e5eac..cb882aae9e20 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1172,6 +1172,13 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
        int max_sectors;
        int sectors;
+        /*
+         * Register the new request and wait if the reconstruction
+         * thread has put up a bar for new requests.
+         * Continue immediately if no resync is active currently.
+         */
+        wait_barrier(conf);
        sectors = bio_sectors(bio);
        while (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
            bio->bi_iter.bi_sector < conf->reshape_progress &&
@@ -1552,12 +1559,6 @@ static void make_request(struct mddev *mddev, struct bio *bio)
        md_write_start(mddev, bio);
-        /*
-         * Register the new request and wait if the reconstruction
-         * thread has put up a bar for new requests.
-         * Continue immediately if no resync is active currently.
-         */
-        wait_barrier(conf);
        do {
diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
index e8a1ce204036..cdd7c1b7259b 100644
--- a/drivers/media/i2c/ov7670.c
+++ b/drivers/media/i2c/ov7670.c
@@ -1109,7 +1109,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev *sd,
         * windows that fall outside that.
         */
        for (i = 0; i < n_win_sizes; i++) {
-                struct ov7670_win_size *win = &info->devtype->win_sizes[index];
+                struct ov7670_win_size *win = &info->devtype->win_sizes[i];
                if (info->min_width && win->width < info->min_width)
                        continue;
                if (info->min_height && win->height < info->min_height)
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index a4459301b5f8..ee0f57e01b56 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -1616,7 +1616,7 @@ static int s5c73m3_get_platform_data(struct s5c73m3 *state)
        if (ret < 0)
                return -EINVAL;
-        node_ep = v4l2_of_get_next_endpoint(node, NULL);
+        node_ep = of_graph_get_next_endpoint(node, NULL);
        if (!node_ep) {
                dev_warn(dev, "no endpoint defined for node: %s\n",
                                                node->full_name);
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index d5a7a135f75d..703560fa5e73 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev,
        struct media_entity *ent;
        struct media_entity_desc u_ent;
+        memset(&u_ent, 0, sizeof(u_ent));
        if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
                return -EFAULT;
diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
index b4f12d00be05..656708252962 100644
--- a/drivers/media/platform/davinci/vpbe_display.c
+++ b/drivers/media/platform/davinci/vpbe_display.c
@@ -372,18 +372,32 @@ static int vpbe_stop_streaming(struct vb2_queue *vq)
 {
        struct vpbe_fh *fh = vb2_get_drv_priv(vq);
        struct vpbe_layer *layer = fh->layer;
+        struct vpbe_display *disp = fh->disp_dev;
+        unsigned long flags;
        if (!vb2_is_streaming(vq))
                return 0;
        /* release all active buffers */
+        spin_lock_irqsave(&disp->dma_queue_lock, flags);
+        if (layer->cur_frm == layer->next_frm) {
+                vb2_buffer_done(&layer->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (layer->cur_frm != NULL)
+                        vb2_buffer_done(&layer->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (layer->next_frm != NULL)
+                        vb2_buffer_done(&layer->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&layer->dma_queue)) {
                layer->next_frm = list_entry(layer->dma_queue.next,
                                                struct vpbe_disp_buffer, list);
                list_del(&layer->next_frm->list);
                vb2_buffer_done(&layer->next_frm->vb, VB2_BUF_STATE_ERROR);
        }
+        spin_unlock_irqrestore(&disp->dma_queue_lock, flags);
        return 0;
 }
diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
index d762246eabf5..0379cb9f9a9c 100644
--- a/drivers/media/platform/davinci/vpfe_capture.c
+++ b/drivers/media/platform/davinci/vpfe_capture.c
@@ -734,6 +734,8 @@ static int vpfe_release(struct file *file)
                }
                vpfe_dev->io_usrs = 0;
                vpfe_dev->numbuffers = config_params.numbuffers;
+                videobuf_stop(&vpfe_dev->buffer_queue);
+                videobuf_mmap_free(&vpfe_dev->buffer_queue);
        }
        /* Decrement device usrs counter */
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index 756da78bac23..8dea0b84a3ad 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -358,8 +358,31 @@ static int vpif_stop_streaming(struct vb2_queue *vq)
        common = &ch->common[VPIF_VIDEO_INDEX];
+        /* Disable channel as per its device type and channel id */
+        if (VPIF_CHANNEL0_VIDEO == ch->channel_id) {
+                enable_channel0(0);
+                channel0_intr_enable(0);
+        }
+        if ((VPIF_CHANNEL1_VIDEO == ch->channel_id) ||
+                (2 == common->started)) {
+                enable_channel1(0);
+                channel1_intr_enable(0);
+        }
+        common->started = 0;
        /* release all active buffers */
        spin_lock_irqsave(&common->irqlock, flags);
+        if (common->cur_frm == common->next_frm) {
+                vb2_buffer_done(&common->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (common->cur_frm != NULL)
+                        vb2_buffer_done(&common->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (common->next_frm != NULL)
+                        vb2_buffer_done(&common->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&common->dma_queue)) {
                common->next_frm = list_entry(common->dma_queue.next,
                                                struct vpif_cap_buffer, list);
@@ -933,17 +956,6 @@ static int vpif_release(struct file *filep)
        if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                /* Reset io_usrs member of channel object */
                common->io_usrs = 0;
-                /* Disable channel as per its device type and channel id */
-                if (VPIF_CHANNEL0_VIDEO == ch->channel_id) {
-                        enable_channel0(0);
-                        channel0_intr_enable(0);
-                }
-                if ((VPIF_CHANNEL1_VIDEO == ch->channel_id) ||
-                    (2 == common->started)) {
-                        enable_channel1(0);
-                        channel1_intr_enable(0);
-                }
-                common->started = 0;
                /* Free buffers allocated */
                vb2_queue_release(&common->buffer_queue);
                vb2_dma_contig_cleanup_ctx(common->alloc_ctx);
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index 0ac841e35aa4..aed41edd0501 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -320,8 +320,31 @@ static int vpif_stop_streaming(struct vb2_queue *vq)
        common = &ch->common[VPIF_VIDEO_INDEX];
+        /* Disable channel */
+        if (VPIF_CHANNEL2_VIDEO == ch->channel_id) {
+                enable_channel2(0);
+                channel2_intr_enable(0);
+        }
+        if ((VPIF_CHANNEL3_VIDEO == ch->channel_id) ||
+                (2 == common->started)) {
+                enable_channel3(0);
+                channel3_intr_enable(0);
+        }
+        common->started = 0;
        /* release all active buffers */
        spin_lock_irqsave(&common->irqlock, flags);
+        if (common->cur_frm == common->next_frm) {
+                vb2_buffer_done(&common->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (common->cur_frm != NULL)
+                        vb2_buffer_done(&common->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (common->next_frm != NULL)
+                        vb2_buffer_done(&common->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&common->dma_queue)) {
                common->next_frm = list_entry(common->dma_queue.next,
                                                struct vpif_disp_buffer, list);
@@ -773,18 +796,6 @@ static int vpif_release(struct file *filep)
        if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                /* Reset io_usrs member of channel object */
                common->io_usrs = 0;
-                /* Disable channel */
-                if (VPIF_CHANNEL2_VIDEO == ch->channel_id) {
-                        enable_channel2(0);
-                        channel2_intr_enable(0);
-                }
-                if ((VPIF_CHANNEL3_VIDEO == ch->channel_id) ||
-                    (2 == common->started)) {
-                        enable_channel3(0);
-                        channel3_intr_enable(0);
-                }
-                common->started = 0;
                /* Free buffers allocated */
                vb2_queue_release(&common->buffer_queue);
                vb2_dma_contig_cleanup_ctx(common->alloc_ctx);
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index da2fc86cc524..25dbf5b05a96 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -122,7 +122,7 @@ static struct fimc_fmt fimc_formats[] = {
        }, {
                .name           = "YUV 4:2:2 planar, Y/Cb/Cr",
                .fourcc         = V4L2_PIX_FMT_YUV422P,
-                .depth          = { 12 },
+                .depth          = { 16 },
                .color          = FIMC_FMT_YCBYCR422,
                .memplanes      = 1,
                .colplanes      = 3,
diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
index 3aecaf465094..f0c9c42867de 100644
--- a/drivers/media/tuners/fc2580.c
+++ b/drivers/media/tuners/fc2580.c
@@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_frontend *fe)
        f_ref = 2UL * priv->cfg->clock / r_val;
        n_val = div_u64_rem(f_vco, f_ref, &k_val);
-        k_val_reg = 1UL * k_val * (1 << 20) / f_ref;
+        k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref);
        ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff));
        if (ret < 0)
@@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_frontend *fe)
        if (ret < 0)
                goto err;
-        ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \
+        ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock *
-                        fc2580_if_filter_lut[i].mul / 1000000000);
+                        fc2580_if_filter_lut[i].mul, 1000000000));
        if (ret < 0)
                goto err;
diff --git a/drivers/media/tuners/fc2580_priv.h b/drivers/media/tuners/fc2580_priv.h
index be38a9e637e0..646c99452136 100644
--- a/drivers/media/tuners/fc2580_priv.h
+++ b/drivers/media/tuners/fc2580_priv.h
@@ -22,6 +22,7 @@
 #define FC2580_PRIV_H
 #include "fc2580.h"
+#include <linux/math64.h>
 struct fc2580_reg_val {
        u8 reg;
diff --git a/drivers/media/usb/dvb-usb-v2/Makefile b/drivers/media/usb/dvb-usb-v2/Makefile
index 7407b8338ccf..bc38f03394cd 100644
--- a/drivers/media/usb/dvb-usb-v2/Makefile
+++ b/drivers/media/usb/dvb-usb-v2/Makefile
@@ -41,4 +41,3 @@ ccflags-y += -I$(srctree)/drivers/media/dvb-core
 ccflags-y += -I$(srctree)/drivers/media/dvb-frontends
 ccflags-y += -I$(srctree)/drivers/media/tuners
 ccflags-y += -I$(srctree)/drivers/media/common
-ccflags-y += -I$(srctree)/drivers/staging/media/rtl2832u_sdr
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 61d196e8b3ab..dcbd392e6efc 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -24,7 +24,6 @@
 #include "rtl2830.h"
 #include "rtl2832.h"
-#include "rtl2832_sdr.h"
 #include "qt1010.h"
 #include "mt2060.h"
@@ -36,6 +35,45 @@
 #include "tua9001.h"
 #include "r820t.h"
+/*
+ * RTL2832_SDR module is in staging. That logic is added in order to avoid any
+ * hard dependency to drivers/staging/ directory as we want compile mainline
+ * driver even whole staging directory is missing.
+ */
+#include <media/v4l2-subdev.h>
+#if IS_ENABLED(CONFIG_DVB_RTL2832_SDR)
+struct dvb_frontend *rtl2832_sdr_attach(struct dvb_frontend *fe,
+        struct i2c_adapter *i2c, const struct rtl2832_config *cfg,
+        struct v4l2_subdev *sd);
+#else
+static inline struct dvb_frontend *rtl2832_sdr_attach(struct dvb_frontend *fe,
+        struct i2c_adapter *i2c, const struct rtl2832_config *cfg,
+        struct v4l2_subdev *sd)
+{
+        return NULL;
+}
+#endif
+#ifdef CONFIG_MEDIA_ATTACH
+#define dvb_attach_sdr(FUNCTION, ARGS...) ({ \
+        void *__r = NULL; \
+        typeof(&FUNCTION) __a = symbol_request(FUNCTION); \
+        if (__a) { \
+                __r = (void *) __a(ARGS); \
+                if (__r == NULL) \
+                        symbol_put(FUNCTION); \
+        } \
+        __r; \
+})
+#else
+#define dvb_attach_sdr(FUNCTION, ARGS...) ({ \
+        FUNCTION(ARGS); \
+})
+#endif
 static int rtl28xxu_disable_rc;
 module_param_named(disable_rc, rtl28xxu_disable_rc, int, 0644);
 MODULE_PARM_DESC(disable_rc, "disable RTL2832U remote controller");
@@ -908,7 +946,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                adap->fe[0]->ops.tuner_ops.get_rf_strength;
                /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                &rtl28xxu_rtl2832_fc0012_config, NULL);
                break;
        case TUNER_RTL2832_FC0013:
@@ -920,7 +958,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                adap->fe[0]->ops.tuner_ops.get_rf_strength;
                /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                &rtl28xxu_rtl2832_fc0013_config, NULL);
                break;
        case TUNER_RTL2832_E4000: {
@@ -951,7 +989,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                        i2c_set_adapdata(i2c_adap_internal, d);
                        /* attach SDR */
-                        dvb_attach(rtl2832_sdr_attach, adap->fe[0],
+                        dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0],
                                        i2c_adap_internal,
                                        &rtl28xxu_rtl2832_e4000_config, sd);
                }
@@ -982,7 +1020,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                adap->fe[0]->ops.tuner_ops.get_rf_strength;
                /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                &rtl28xxu_rtl2832_r820t_config, NULL);
                break;
        case TUNER_RTL2832_R828D:
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 7277dbd2afcd..ecbcb39feb71 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -1430,10 +1430,8 @@ static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x0c45, 0x600d), SB(PAS106, 101)},
        {USB_DEVICE(0x0c45, 0x6011), SB(OV6650, 101)},
        {USB_DEVICE(0x0c45, 0x6019), SB(OV7630, 101)},
-#if !IS_ENABLED(CONFIG_USB_SN9C102)
        {USB_DEVICE(0x0c45, 0x6024), SB(TAS5130CXX, 102)},
        {USB_DEVICE(0x0c45, 0x6025), SB(TAS5130CXX, 102)},
-#endif
        {USB_DEVICE(0x0c45, 0x6027), SB(OV7630, 101)}, /* Genius Eye 310 */
        {USB_DEVICE(0x0c45, 0x6028), SB(PAS202, 102)},
        {USB_DEVICE(0x0c45, 0x6029), SB(PAS106, 102)},
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 04b2daf567be..7e2411c36419 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
 static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
 {
+        if (get_user(kp->type, &up->type))
+                return -EFAULT;
        switch (kp->type) {
        case V4L2_BUF_TYPE_VIDEO_CAPTURE:
        case V4L2_BUF_TYPE_VIDEO_OUTPUT:
@@ -204,17 +207,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
 static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
+        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
-                        get_user(kp->type, &up->type))
+                return -EFAULT;
-                        return -EFAULT;
        return __get_v4l2_format32(kp, up);
 }
 static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
 {
        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
-            copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt)))
+            copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
-                        return -EFAULT;
+                return -EFAULT;
        return __get_v4l2_format32(&kp->format, &up->format);
 }
diff --git a/drivers/memory/mvebu-devbus.c b/drivers/memory/mvebu-devbus.c
index 110c03627051..b59a17fb7c3e 100644
--- a/drivers/memory/mvebu-devbus.c
+++ b/drivers/memory/mvebu-devbus.c
@@ -108,8 +108,19 @@ static int devbus_set_timing_params(struct devbus *devbus,
                        node->full_name);
                return err;
        }
-        /* Convert bit width to byte width */
-        r.bus_width /= 8;
+        /*
+         * The bus width is encoded into the register as 0 for 8 bits,
+         * and 1 for 16 bits, so we do the necessary conversion here.
+         */
+        if (r.bus_width == 8)
+                r.bus_width = 0;
+        else if (r.bus_width == 16)
+                r.bus_width = 1;
+        else {
+                dev_err(devbus->dev, "invalid bus width %d\n", r.bus_width);
+                return -EINVAL;
+        }
        err = get_timing_param_ps(devbus, node, "devbus,badr-skew-ps",
                                 &r.badr_skew);
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index c9de3d598ea5..1d15735f9ef9 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -338,28 +338,58 @@ int rtsx_pci_transfer_data(struct rtsx_pcr *pcr, struct scatterlist *sglist,
                int num_sg, bool read, int timeout)
 {
        struct completion trans_done;
-        int err = 0, count;
+        u8 dir;
+        int err = 0, i, count;
        long timeleft;
        unsigned long flags;
+        struct scatterlist *sg;
+        enum dma_data_direction dma_dir;
+        u32 val;
+        dma_addr_t addr;
+        unsigned int len;
+        dev_dbg(&(pcr->pci->dev), "--> %s: num_sg = %d\n", __func__, num_sg);
+        /* don't transfer data during abort processing */
+        if (pcr->remove_pci)
+                return -EINVAL;
+        if ((sglist == NULL) || (num_sg <= 0))
+                return -EINVAL;
-        count = rtsx_pci_dma_map_sg(pcr, sglist, num_sg, read);
+        if (read) {
+                dir = DEVICE_TO_HOST;
+                dma_dir = DMA_FROM_DEVICE;
+        } else {
+                dir = HOST_TO_DEVICE;
+                dma_dir = DMA_TO_DEVICE;
+        }
+        count = dma_map_sg(&(pcr->pci->dev), sglist, num_sg, dma_dir);
        if (count < 1) {
                dev_err(&(pcr->pci->dev), "scatterlist map failed\n");
                return -EINVAL;
        }
        dev_dbg(&(pcr->pci->dev), "DMA mapping count: %d\n", count);
+        val = ((u32)(dir & 0x01) << 29) | TRIG_DMA | ADMA_MODE;
+        pcr->sgi = 0;
+        for_each_sg(sglist, sg, count, i) {
+                addr = sg_dma_address(sg);
+                len = sg_dma_len(sg);
+                rtsx_pci_add_sg_tbl(pcr, addr, len, i == count - 1);
+        }
        spin_lock_irqsave(&pcr->lock, flags);
        pcr->done = &trans_done;
        pcr->trans_result = TRANS_NOT_READY;
        init_completion(&trans_done);
+        rtsx_pci_writel(pcr, RTSX_HDBAR, pcr->host_sg_tbl_addr);
+        rtsx_pci_writel(pcr, RTSX_HDBCTLR, val);
        spin_unlock_irqrestore(&pcr->lock, flags);
-        rtsx_pci_dma_transfer(pcr, sglist, count, read);
        timeleft = wait_for_completion_interruptible_timeout(
                        &trans_done, msecs_to_jiffies(timeout));
        if (timeleft <= 0) {
@@ -383,7 +413,7 @@ out:
        pcr->done = NULL;
        spin_unlock_irqrestore(&pcr->lock, flags);
-        rtsx_pci_dma_unmap_sg(pcr, sglist, num_sg, read);
+        dma_unmap_sg(&(pcr->pci->dev), sglist, num_sg, dma_dir);
        if ((err < 0) && (err != -ENODEV))
                rtsx_pci_stop_cmd(pcr);
@@ -395,73 +425,6 @@ out:
 }
 EXPORT_SYMBOL_GPL(rtsx_pci_transfer_data);
-int rtsx_pci_dma_map_sg(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int num_sg, bool read)
-{
-        enum dma_data_direction dir = read ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
-        if (pcr->remove_pci)
-                return -EINVAL;
-        if ((sglist == NULL) || num_sg < 1)
-                return -EINVAL;
-        return dma_map_sg(&(pcr->pci->dev), sglist, num_sg, dir);
-}
-EXPORT_SYMBOL_GPL(rtsx_pci_dma_map_sg);
-int rtsx_pci_dma_unmap_sg(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int num_sg, bool read)
-{
-        enum dma_data_direction dir = read ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
-        if (pcr->remove_pci)
-                return -EINVAL;
-        if (sglist == NULL || num_sg < 1)
-                return -EINVAL;
-        dma_unmap_sg(&(pcr->pci->dev), sglist, num_sg, dir);
-        return num_sg;
-}
-EXPORT_SYMBOL_GPL(rtsx_pci_dma_unmap_sg);
-int rtsx_pci_dma_transfer(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int sg_count, bool read)
-{
-        struct scatterlist *sg;
-        dma_addr_t addr;
-        unsigned int len;
-        int i;
-        u32 val;
-        u8 dir = read ? DEVICE_TO_HOST : HOST_TO_DEVICE;
-        unsigned long flags;
-        if (pcr->remove_pci)
-                return -EINVAL;
-        if ((sglist == NULL) || (sg_count < 1))
-                return -EINVAL;
-        val = ((u32)(dir & 0x01) << 29) | TRIG_DMA | ADMA_MODE;
-        pcr->sgi = 0;
-        for_each_sg(sglist, sg, sg_count, i) {
-                addr = sg_dma_address(sg);
-                len = sg_dma_len(sg);
-                rtsx_pci_add_sg_tbl(pcr, addr, len, i == sg_count - 1);
-        }
-        spin_lock_irqsave(&pcr->lock, flags);
-        rtsx_pci_writel(pcr, RTSX_HDBAR, pcr->host_sg_tbl_addr);
-        rtsx_pci_writel(pcr, RTSX_HDBCTLR, val);
-        spin_unlock_irqrestore(&pcr->lock, flags);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rtsx_pci_dma_transfer);
 int rtsx_pci_read_ppbuf(struct rtsx_pcr *pcr, u8 *buf, int buf_len)
 {
        int err;
@@ -873,8 +836,6 @@ static irqreturn_t rtsx_pci_isr(int irq, void *dev_id)
        int_reg = rtsx_pci_readl(pcr, RTSX_BIPR);
        /* Clear interrupt flag */
        rtsx_pci_writel(pcr, RTSX_BIPR, int_reg);
-        dev_dbg(&pcr->pci->dev, "=========== BIPR 0x%8x ==========\n", int_reg);
        if ((int_reg & pcr->bier) == 0) {
                spin_unlock(&pcr->lock);
                return IRQ_NONE;
@@ -905,28 +866,17 @@ static irqreturn_t rtsx_pci_isr(int irq, void *dev_id)
        }
        if (int_reg & (NEED_COMPLETE_INT | DELINK_INT)) {
-                if (int_reg & (TRANS_FAIL_INT | DELINK_INT))
+                if (int_reg & (TRANS_FAIL_INT | DELINK_INT)) {
                        pcr->trans_result = TRANS_RESULT_FAIL;
-                else if (int_reg & TRANS_OK_INT)
+                        if (pcr->done)
+                                complete(pcr->done);
+                } else if (int_reg & TRANS_OK_INT) {
                        pcr->trans_result = TRANS_RESULT_OK;
+                        if (pcr->done)
-                if (pcr->done)
+                                complete(pcr->done);
-                        complete(pcr->done);
-                if (int_reg & SD_EXIST) {
-                        struct rtsx_slot *slot = &pcr->slots[RTSX_SD_CARD];
-                        if (slot && slot->done_transfer)
-                                slot->done_transfer(slot->p_dev);
-                }
-                if (int_reg & MS_EXIST) {
-                        struct rtsx_slot *slot = &pcr->slots[RTSX_SD_CARD];
-                        if (slot && slot->done_transfer)
-                                slot->done_transfer(slot->p_dev);
                }
        }
        if (pcr->card_inserted || pcr->card_removed)
                schedule_delayed_work(&pcr->carddet_work,
                                msecs_to_jiffies(200));
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index 5fb994f9a653..0b9ded13a3ae 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -31,28 +31,14 @@
 #include <linux/mfd/rtsx_pci.h>
 #include <asm/unaligned.h>
-struct realtek_next {
-        unsigned int    sg_count;
-        s32             cookie;
-};
 struct realtek_pci_sdmmc {
        struct platform_device  *pdev;
        struct rtsx_pcr         *pcr;
        struct mmc_host         *mmc;
        struct mmc_request      *mrq;
-        struct mmc_command      *cmd;
-        struct mmc_data         *data;
+        struct mutex            host_mutex;
-        spinlock_t              lock;
-        struct timer_list       timer;
-        struct tasklet_struct   cmd_tasklet;
-        struct tasklet_struct   data_tasklet;
-        struct tasklet_struct   finish_tasklet;
-        u8                      rsp_type;
-        u8                      rsp_len;
-        int                     sg_count;
        u8                      ssc_depth;
        unsigned int            clock;
        bool                    vpclk;
@@ -62,13 +48,8 @@ struct realtek_pci_sdmmc {
        int                     power_state;
 #define SDMMC_POWER_ON          1
 #define SDMMC_POWER_OFF         0
-        struct realtek_next     next_data;
 };
-static int sd_start_multi_rw(struct realtek_pci_sdmmc *host,
-                struct mmc_request *mrq);
 static inline struct device *sdmmc_dev(struct realtek_pci_sdmmc *host)
 {
        return &(host->pdev->dev);
@@ -105,95 +86,6 @@ static void sd_print_debug_regs(struct realtek_pci_sdmmc *host)
 #define sd_print_debug_regs(host)
 #endif /* DEBUG */
-static void sd_isr_done_transfer(struct platform_device *pdev)
-{
-        struct realtek_pci_sdmmc *host = platform_get_drvdata(pdev);
-        spin_lock(&host->lock);
-        if (host->cmd)
-                tasklet_schedule(&host->cmd_tasklet);
-        if (host->data)
-                tasklet_schedule(&host->data_tasklet);
-        spin_unlock(&host->lock);
-}
-static void sd_request_timeout(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        unsigned long flags;
-        spin_lock_irqsave(&host->lock, flags);
-        if (!host->mrq) {
-                dev_err(sdmmc_dev(host), "error: no request exist\n");
-                goto out;
-        }
-        if (host->cmd)
-                host->cmd->error = -ETIMEDOUT;
-        if (host->data)
-                host->data->error = -ETIMEDOUT;
-        dev_dbg(sdmmc_dev(host), "timeout for request\n");
-out:
-        tasklet_schedule(&host->finish_tasklet);
-        spin_unlock_irqrestore(&host->lock, flags);
-}
-static void sd_finish_request(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_request *mrq;
-        struct mmc_command *cmd;
-        struct mmc_data *data;
-        unsigned long flags;
-        bool any_error;
-        spin_lock_irqsave(&host->lock, flags);
-        del_timer(&host->timer);
-        mrq = host->mrq;
-        if (!mrq) {
-                dev_err(sdmmc_dev(host), "error: no request need finish\n");
-                goto out;
-        }
-        cmd = mrq->cmd;
-        data = mrq->data;
-        any_error = (mrq->sbc && mrq->sbc->error) ||
-                (mrq->stop && mrq->stop->error) ||
-                (cmd && cmd->error) || (data && data->error);
-        if (any_error) {
-                rtsx_pci_stop_cmd(pcr);
-                sd_clear_error(host);
-        }
-        if (data) {
-                if (any_error)
-                        data->bytes_xfered = 0;
-                else
-                        data->bytes_xfered = data->blocks * data->blksz;
-                if (!data->host_cookie)
-                        rtsx_pci_dma_unmap_sg(pcr, data->sg, data->sg_len,
-                                        data->flags & MMC_DATA_READ);
-        }
-        host->mrq = NULL;
-        host->cmd = NULL;
-        host->data = NULL;
-out:
-        spin_unlock_irqrestore(&host->lock, flags);
-        mutex_unlock(&pcr->pcr_mutex);
-        mmc_request_done(host->mmc, mrq);
-}
 static int sd_read_data(struct realtek_pci_sdmmc *host, u8 *cmd, u16 byte_cnt,
                u8 *buf, int buf_len, int timeout)
 {
@@ -311,7 +203,8 @@ static int sd_write_data(struct realtek_pci_sdmmc *host, u8 *cmd, u16 byte_cnt,
        return 0;
 }
-static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
+static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host,
+                struct mmc_command *cmd)
 {
        struct rtsx_pcr *pcr = host->pcr;
        u8 cmd_idx = (u8)cmd->opcode;
@@ -319,14 +212,11 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
        int err = 0;
        int timeout = 100;
        int i;
+        u8 *ptr;
+        int stat_idx = 0;
        u8 rsp_type;
        int rsp_len = 5;
-        unsigned long flags;
+        bool clock_toggled = false;
-        if (host->cmd)
-                dev_err(sdmmc_dev(host), "error: cmd already exist\n");
-        host->cmd = cmd;
        dev_dbg(sdmmc_dev(host), "%s: SD/MMC CMD %d, arg = 0x%08x\n",
                        __func__, cmd_idx, arg);
@@ -361,8 +251,6 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
                err = -EINVAL;
                goto out;
        }
-        host->rsp_type = rsp_type;
-        host->rsp_len = rsp_len;
        if (rsp_type == SD_RSP_TYPE_R1b)
                timeout = 3000;
@@ -372,6 +260,8 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
                                0xFF, SD_CLK_TOGGLE_EN);
                if (err < 0)
                        goto out;
+                clock_toggled = true;
        }
        rtsx_pci_init_cmd(pcr);
@@ -395,60 +285,25 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
                /* Read data from ping-pong buffer */
                for (i = PPBUF_BASE2; i < PPBUF_BASE2 + 16; i++)
                        rtsx_pci_add_cmd(pcr, READ_REG_CMD, (u16)i, 0, 0);
+                stat_idx = 16;
        } else if (rsp_type != SD_RSP_TYPE_R0) {
                /* Read data from SD_CMDx registers */
                for (i = SD_CMD0; i <= SD_CMD4; i++)
                        rtsx_pci_add_cmd(pcr, READ_REG_CMD, (u16)i, 0, 0);
+                stat_idx = 5;
        }
        rtsx_pci_add_cmd(pcr, READ_REG_CMD, SD_STAT1, 0, 0);
-        mod_timer(&host->timer, jiffies + msecs_to_jiffies(timeout));
+        err = rtsx_pci_send_cmd(pcr, timeout);
+        if (err < 0) {
-        spin_lock_irqsave(&pcr->lock, flags);
+                sd_print_debug_regs(host);
-        pcr->trans_result = TRANS_NOT_READY;
+                sd_clear_error(host);
-        rtsx_pci_send_cmd_no_wait(pcr);
+                dev_dbg(sdmmc_dev(host),
-        spin_unlock_irqrestore(&pcr->lock, flags);
+                        "rtsx_pci_send_cmd error (err = %d)\n", err);
-        return;
-out:
-        cmd->error = err;
-        tasklet_schedule(&host->finish_tasklet);
-}
-static void sd_get_rsp(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_command *cmd;
-        int i, err = 0, stat_idx;
-        u8 *ptr, rsp_type;
-        unsigned long flags;
-        spin_lock_irqsave(&host->lock, flags);
-        cmd = host->cmd;
-        host->cmd = NULL;
-        if (!cmd) {
-                dev_err(sdmmc_dev(host), "error: cmd not exist\n");
                goto out;
        }
-        spin_lock(&pcr->lock);
-        if (pcr->trans_result == TRANS_NO_DEVICE)
-                err = -ENODEV;
-        else if (pcr->trans_result != TRANS_RESULT_OK)
-                err = -EINVAL;
-        spin_unlock(&pcr->lock);
-        if (err < 0)
-                goto out;
-        rsp_type = host->rsp_type;
-        stat_idx = host->rsp_len;
        if (rsp_type == SD_RSP_TYPE_R0) {
                err = 0;
                goto out;
@@ -485,106 +340,26 @@ static void sd_get_rsp(unsigned long host_addr)
                                cmd->resp[0]);
        }
-        if (cmd == host->mrq->sbc) {
-                sd_send_cmd(host, host->mrq->cmd);
-                spin_unlock_irqrestore(&host->lock, flags);
-                return;
-        }
-        if (cmd == host->mrq->stop)
-                goto out;
-        if (cmd->data) {
-                sd_start_multi_rw(host, host->mrq);
-                spin_unlock_irqrestore(&host->lock, flags);
-                return;
-        }
 out:
        cmd->error = err;
-        tasklet_schedule(&host->finish_tasklet);
+        if (err && clock_toggled)
-        spin_unlock_irqrestore(&host->lock, flags);
+                rtsx_pci_write_register(pcr, SD_BUS_STAT,
-}
+                                SD_CLK_TOGGLE_EN | SD_CLK_FORCE_STOP, 0);
-static int sd_pre_dma_transfer(struct realtek_pci_sdmmc *host,
-                        struct mmc_data *data, struct realtek_next *next)
-{
-        struct rtsx_pcr *pcr = host->pcr;
-        int read = data->flags & MMC_DATA_READ;
-        int sg_count = 0;
-        if (!next && data->host_cookie &&
-                data->host_cookie != host->next_data.cookie) {
-                dev_err(sdmmc_dev(host),
-                        "error: invalid cookie data[%d] host[%d]\n",
-                        data->host_cookie, host->next_data.cookie);
-                data->host_cookie = 0;
-        }
-        if (next || (!next && data->host_cookie != host->next_data.cookie))
-                sg_count = rtsx_pci_dma_map_sg(pcr,
-                                data->sg, data->sg_len, read);
-        else
-                sg_count = host->next_data.sg_count;
-        if (next) {
-                next->sg_count = sg_count;
-                if (++next->cookie < 0)
-                        next->cookie = 1;
-                data->host_cookie = next->cookie;
-        }
-        return sg_count;
-}
-static void sdmmc_pre_req(struct mmc_host *mmc, struct mmc_request *mrq,
-                bool is_first_req)
-{
-        struct realtek_pci_sdmmc *host = mmc_priv(mmc);
-        struct mmc_data *data = mrq->data;
-        if (data->host_cookie) {
-                dev_err(sdmmc_dev(host),
-                        "error: descard already cookie data[%d]\n",
-                        data->host_cookie);
-                data->host_cookie = 0;
-        }
-        dev_dbg(sdmmc_dev(host), "dma sg prepared: %d\n",
-                sd_pre_dma_transfer(host, data, &host->next_data));
-}
-static void sdmmc_post_req(struct mmc_host *mmc, struct mmc_request *mrq,
-                int err)
-{
-        struct realtek_pci_sdmmc *host = mmc_priv(mmc);
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_data *data = mrq->data;
-        int read = data->flags & MMC_DATA_READ;
-        rtsx_pci_dma_unmap_sg(pcr, data->sg, data->sg_len, read);
-        data->host_cookie = 0;
 }
-static int sd_start_multi_rw(struct realtek_pci_sdmmc *host,
+static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
-                struct mmc_request *mrq)
 {
        struct rtsx_pcr *pcr = host->pcr;
        struct mmc_host *mmc = host->mmc;
        struct mmc_card *card = mmc->card;
        struct mmc_data *data = mrq->data;
        int uhs = mmc_card_uhs(card);
-        int read = data->flags & MMC_DATA_READ;
+        int read = (data->flags & MMC_DATA_READ) ? 1 : 0;
        u8 cfg2, trans_mode;
        int err;
        size_t data_len = data->blksz * data->blocks;
-        if (host->data)
-                dev_err(sdmmc_dev(host), "error: data already exist\n");
-        host->data = data;
        if (read) {
                cfg2 = SD_CALCULATE_CRC7 | SD_CHECK_CRC16 |
                        SD_NO_WAIT_BUSY_END | SD_CHECK_CRC7 | SD_RSP_LEN_0;
@@ -635,54 +410,15 @@ static int sd_start_multi_rw(struct realtek_pci_sdmmc *host,
        rtsx_pci_add_cmd(pcr, CHECK_REG_CMD, SD_TRANSFER,
                        SD_TRANSFER_END, SD_TRANSFER_END);
-        mod_timer(&host->timer, jiffies + 10 * HZ);
        rtsx_pci_send_cmd_no_wait(pcr);
-        err = rtsx_pci_dma_transfer(pcr, data->sg, host->sg_count, read);
+        err = rtsx_pci_transfer_data(pcr, data->sg, data->sg_len, read, 10000);
-        if (err < 0) {
-                data->error = err;
-                tasklet_schedule(&host->finish_tasklet);
-        }
-        return 0;
-}
-static void sd_finish_multi_rw(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_data *data;
-        int err = 0;
-        unsigned long flags;
-        spin_lock_irqsave(&host->lock, flags);
-        if (!host->data) {
-                dev_err(sdmmc_dev(host), "error: no data exist\n");
-                goto out;
-        }
-        data = host->data;
-        host->data = NULL;
-        if (pcr->trans_result == TRANS_NO_DEVICE)
-                err = -ENODEV;
-        else if (pcr->trans_result != TRANS_RESULT_OK)
-                err = -EINVAL;
        if (err < 0) {
-                data->error = err;
+                sd_clear_error(host);
-                goto out;
+                return err;
-        }
-        if (!host->mrq->sbc && data->stop) {
-                sd_send_cmd(host, data->stop);
-                spin_unlock_irqrestore(&host->lock, flags);
-                return;
        }
-out:
+        return 0;
-        tasklet_schedule(&host->finish_tasklet);
-        spin_unlock_irqrestore(&host->lock, flags);
 }
 static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host)
@@ -901,13 +637,6 @@ static int sd_tuning_rx(struct realtek_pci_sdmmc *host, u8 opcode)
        return 0;
 }
-static inline bool sd_use_muti_rw(struct mmc_command *cmd)
-{
-        return mmc_op_multi(cmd->opcode) ||
-                (cmd->opcode == MMC_READ_SINGLE_BLOCK) ||
-                (cmd->opcode == MMC_WRITE_BLOCK);
-}
 static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
 {
        struct realtek_pci_sdmmc *host = mmc_priv(mmc);
@@ -916,14 +645,6 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
        struct mmc_data *data = mrq->data;
        unsigned int data_size = 0;
        int err;
-        unsigned long flags;
-        mutex_lock(&pcr->pcr_mutex);
-        spin_lock_irqsave(&host->lock, flags);
-        if (host->mrq)
-                dev_err(sdmmc_dev(host), "error: request already exist\n");
-        host->mrq = mrq;
        if (host->eject) {
                cmd->error = -ENOMEDIUM;
@@ -936,6 +657,8 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
                goto finish;
        }
+        mutex_lock(&pcr->pcr_mutex);
        rtsx_pci_start_run(pcr);
        rtsx_pci_switch_clock(pcr, host->clock, host->ssc_depth,
@@ -944,28 +667,46 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
        rtsx_pci_write_register(pcr, CARD_SHARE_MODE,
                        CARD_SHARE_MASK, CARD_SHARE_48_SD);
+        mutex_lock(&host->host_mutex);
+        host->mrq = mrq;
+        mutex_unlock(&host->host_mutex);
        if (mrq->data)
                data_size = data->blocks * data->blksz;
-        if (sd_use_muti_rw(cmd))
+        if (!data_size || mmc_op_multi(cmd->opcode) ||
-                host->sg_count = sd_pre_dma_transfer(host, data, NULL);
+                        (cmd->opcode == MMC_READ_SINGLE_BLOCK) ||
+                        (cmd->opcode == MMC_WRITE_BLOCK)) {
+                sd_send_cmd_get_rsp(host, cmd);
-        if (!data_size || sd_use_muti_rw(cmd)) {
+                if (!cmd->error && data_size) {
-                if (mrq->sbc)
+                        sd_rw_multi(host, mrq);
-                        sd_send_cmd(host, mrq->sbc);
-                else
+                        if (mmc_op_multi(cmd->opcode) && mrq->stop)
-                        sd_send_cmd(host, cmd);
+                                sd_send_cmd_get_rsp(host, mrq->stop);
-                spin_unlock_irqrestore(&host->lock, flags);
+                }
        } else {
-                spin_unlock_irqrestore(&host->lock, flags);
                sd_normal_rw(host, mrq);
-                tasklet_schedule(&host->finish_tasklet);
        }
-        return;
+        if (mrq->data) {
+                if (cmd->error || data->error)
+                        data->bytes_xfered = 0;
+                else
+                        data->bytes_xfered = data->blocks * data->blksz;
+        }
+        mutex_unlock(&pcr->pcr_mutex);
 finish:
-        tasklet_schedule(&host->finish_tasklet);
+        if (cmd->error)
-        spin_unlock_irqrestore(&host->lock, flags);
+                dev_dbg(sdmmc_dev(host), "cmd->error = %d\n", cmd->error);
+        mutex_lock(&host->host_mutex);
+        host->mrq = NULL;
+        mutex_unlock(&host->host_mutex);
+        mmc_request_done(mmc, mrq);
 }
 static int sd_set_bus_width(struct realtek_pci_sdmmc *host,
@@ -1400,8 +1141,6 @@ out:
 }
 static const struct mmc_host_ops realtek_pci_sdmmc_ops = {
-        .pre_req = sdmmc_pre_req,
-        .post_req = sdmmc_post_req,
        .request = sdmmc_request,
        .set_ios = sdmmc_set_ios,
        .get_ro = sdmmc_get_ro,
@@ -1465,7 +1204,6 @@ static int rtsx_pci_sdmmc_drv_probe(struct platform_device *pdev)
        struct realtek_pci_sdmmc *host;
        struct rtsx_pcr *pcr;
        struct pcr_handle *handle = pdev->dev.platform_data;
-        unsigned long host_addr;
        if (!handle)
                return -ENXIO;
@@ -1489,15 +1227,8 @@ static int rtsx_pci_sdmmc_drv_probe(struct platform_device *pdev)
        pcr->slots[RTSX_SD_CARD].p_dev = pdev;
        pcr->slots[RTSX_SD_CARD].card_event = rtsx_pci_sdmmc_card_event;
-        host_addr = (unsigned long)host;
+        mutex_init(&host->host_mutex);
-        host->next_data.cookie = 1;
-        setup_timer(&host->timer, sd_request_timeout, host_addr);
-        tasklet_init(&host->cmd_tasklet, sd_get_rsp, host_addr);
-        tasklet_init(&host->data_tasklet, sd_finish_multi_rw, host_addr);
-        tasklet_init(&host->finish_tasklet, sd_finish_request, host_addr);
-        spin_lock_init(&host->lock);
-        pcr->slots[RTSX_SD_CARD].done_transfer = sd_isr_done_transfer;
        realtek_init_host(host);
        mmc_add_host(mmc);
@@ -1510,8 +1241,6 @@ static int rtsx_pci_sdmmc_drv_remove(struct platform_device *pdev)
        struct realtek_pci_sdmmc *host = platform_get_drvdata(pdev);
        struct rtsx_pcr *pcr;
        struct mmc_host *mmc;
-        struct mmc_request *mrq;
-        unsigned long flags;
        if (!host)
                return 0;
@@ -1519,33 +1248,22 @@ static int rtsx_pci_sdmmc_drv_remove(struct platform_device *pdev)
        pcr = host->pcr;
        pcr->slots[RTSX_SD_CARD].p_dev = NULL;
        pcr->slots[RTSX_SD_CARD].card_event = NULL;
-        pcr->slots[RTSX_SD_CARD].done_transfer = NULL;
        mmc = host->mmc;
-        mrq = host->mrq;
-        spin_lock_irqsave(&host->lock, flags);
+        mutex_lock(&host->host_mutex);
        if (host->mrq) {
                dev_dbg(&(pdev->dev),
                        "%s: Controller removed during transfer\n",
                        mmc_hostname(mmc));
-                if (mrq->sbc)
+                rtsx_pci_complete_unfinished_transfer(pcr);
-                        mrq->sbc->error = -ENOMEDIUM;
-                if (mrq->cmd)
-                        mrq->cmd->error = -ENOMEDIUM;
-                if (mrq->stop)
-                        mrq->stop->error = -ENOMEDIUM;
-                if (mrq->data)
-                        mrq->data->error = -ENOMEDIUM;
-                tasklet_schedule(&host->finish_tasklet);
+                host->mrq->cmd->error = -ENOMEDIUM;
+                if (host->mrq->stop)
+                        host->mrq->stop->error = -ENOMEDIUM;
+                mmc_request_done(mmc, host->mrq);
        }
-        spin_unlock_irqrestore(&host->lock, flags);
+        mutex_unlock(&host->host_mutex);
-        del_timer_sync(&host->timer);
-        tasklet_kill(&host->cmd_tasklet);
-        tasklet_kill(&host->data_tasklet);
-        tasklet_kill(&host->finish_tasklet);
        mmc_remove_host(mmc);
        host->eject = true;
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 4615d79fc93f..b922c8efcf40 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -523,6 +523,7 @@ static struct nand_ecclayout hwecc4_2048 = {
 #if defined(CONFIG_OF)
 static const struct of_device_id davinci_nand_of_match[] = {
        {.compatible = "ti,davinci-nand", },
+        {.compatible = "ti,keystone-nand", },
        {},
 };
 MODULE_DEVICE_TABLE(of, davinci_nand_of_match);
@@ -581,6 +582,11 @@ static struct davinci_nand_pdata
                    of_property_read_bool(pdev->dev.of_node,
                        "ti,davinci-nand-use-bbt"))
                        pdata->bbt_options = NAND_BBT_USE_FLASH;
+                if (of_device_is_compatible(pdev->dev.of_node,
+                                            "ti,keystone-nand")) {
+                        pdata->options |= NAND_NO_SUBPAGE_WRITE;
+                }
        }
        return dev_get_platdata(&pdev->dev);
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index 7ff473c871a9..8d659e6a1b4c 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -431,7 +431,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
         * Create one workqueue per volume (per registered block device).
         * Rembember workqueues are cheap, they're not threads.
         */
-        dev->wq = alloc_workqueue(gd->disk_name, 0, 0);
+        dev->wq = alloc_workqueue("%s", 0, 0, gd->disk_name);
        if (!dev->wq)
                goto out_free_queue;
        INIT_WORK(&dev->work, ubiblock_do_work);
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 02317c1c0238..0f3425dac910 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -671,6 +671,8 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)
        e = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF);
        self_check_in_wl_tree(ubi, e, &ubi->free);
+        ubi->free_count--;
+        ubi_assert(ubi->free_count >= 0);
        rb_erase(&e->u.rb, &ubi->free);
        return e;
@@ -684,6 +686,9 @@ int ubi_wl_get_peb(struct ubi_device *ubi)
        peb = __wl_get_peb(ubi);
        spin_unlock(&ubi->wl_lock);
+        if (peb < 0)
+                return peb;
        err = ubi_self_check_all_ff(ubi, peb, ubi->vid_hdr_aloffset,
                                    ubi->peb_size - ubi->vid_hdr_aloffset);
        if (err) {
@@ -1068,6 +1073,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                        /* Give the unused PEB back */
                        wl_tree_add(e2, &ubi->free);
+                        ubi->free_count++;
                        goto out_cancel;
                }
                self_check_in_wl_tree(ubi, e1, &ubi->used);
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 0e8b268da0a0..5f6babcfc26e 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -534,7 +534,7 @@ static ssize_t bonding_show_min_links(struct device *d,
 {
        struct bonding *bond = to_bond(d);
-        return sprintf(buf, "%d\n", bond->params.min_links);
+        return sprintf(buf, "%u\n", bond->params.min_links);
 }
 static ssize_t bonding_store_min_links(struct device *d,
diff --git a/drivers/net/can/c_can/Kconfig b/drivers/net/can/c_can/Kconfig
index 61ffc12d8fd8..8ab7103d4f44 100644
--- a/drivers/net/can/c_can/Kconfig
+++ b/drivers/net/can/c_can/Kconfig
@@ -14,6 +14,13 @@ config CAN_C_CAN_PLATFORM
          SPEAr1310 and SPEAr320 evaluation boards & TI (www.ti.com)
          boards like am335x, dm814x, dm813x and dm811x.
+config CAN_C_CAN_STRICT_FRAME_ORDERING
+        bool "Force a strict RX CAN frame order (may cause frame loss)"
+        ---help---
+          The RX split buffer prevents packet reordering but can cause packet
+          loss. Only enable this option when you accept to lose CAN frames
+          in favour of getting the received CAN frames in the correct order.
 config CAN_C_CAN_PCI
        tristate "Generic PCI Bus based C_CAN/D_CAN driver"
        depends on PCI
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index a5c8dcfa8357..a2ca820b5373 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -60,6 +60,8 @@
 #define CONTROL_IE              BIT(1)
 #define CONTROL_INIT            BIT(0)
+#define CONTROL_IRQMSK          (CONTROL_EIE | CONTROL_IE | CONTROL_SIE)
 /* test register */
 #define TEST_RX                 BIT(7)
 #define TEST_TX1                BIT(6)
@@ -108,11 +110,14 @@
 #define IF_COMM_CONTROL         BIT(4)
 #define IF_COMM_CLR_INT_PND     BIT(3)
 #define IF_COMM_TXRQST          BIT(2)
+#define IF_COMM_CLR_NEWDAT      IF_COMM_TXRQST
 #define IF_COMM_DATAA           BIT(1)
 #define IF_COMM_DATAB           BIT(0)
-#define IF_COMM_ALL             (IF_COMM_MASK | IF_COMM_ARB | \
-                                IF_COMM_CONTROL | IF_COMM_TXRQST | \
+/* TX buffer setup */
-                                IF_COMM_DATAA | IF_COMM_DATAB)
+#define IF_COMM_TX              (IF_COMM_ARB | IF_COMM_CONTROL | \
+                                 IF_COMM_TXRQST |                \
+                                 IF_COMM_DATAA | IF_COMM_DATAB)
 /* For the low buffers we clear the interrupt bit, but keep newdat */
 #define IF_COMM_RCV_LOW         (IF_COMM_MASK | IF_COMM_ARB | \
@@ -120,12 +125,19 @@
                                 IF_COMM_DATAA | IF_COMM_DATAB)
 /* For the high buffers we clear the interrupt bit and newdat */
-#define IF_COMM_RCV_HIGH        (IF_COMM_RCV_LOW | IF_COMM_TXRQST)
+#define IF_COMM_RCV_HIGH        (IF_COMM_RCV_LOW | IF_COMM_CLR_NEWDAT)
+/* Receive setup of message objects */
+#define IF_COMM_RCV_SETUP       (IF_COMM_MASK | IF_COMM_ARB | IF_COMM_CONTROL)
+/* Invalidation of message objects */
+#define IF_COMM_INVAL           (IF_COMM_ARB | IF_COMM_CONTROL)
 /* IFx arbitration */
-#define IF_ARB_MSGVAL           BIT(15)
+#define IF_ARB_MSGVAL           BIT(31)
-#define IF_ARB_MSGXTD           BIT(14)
+#define IF_ARB_MSGXTD           BIT(30)
-#define IF_ARB_TRANSMIT         BIT(13)
+#define IF_ARB_TRANSMIT         BIT(29)
 /* IFx message control */
 #define IF_MCONT_NEWDAT         BIT(15)
@@ -139,19 +151,17 @@
 #define IF_MCONT_EOB            BIT(7)
 #define IF_MCONT_DLC_MASK       0xf
+#define IF_MCONT_RCV            (IF_MCONT_RXIE | IF_MCONT_UMASK)
+#define IF_MCONT_RCV_EOB        (IF_MCONT_RCV | IF_MCONT_EOB)
+#define IF_MCONT_TX             (IF_MCONT_TXIE | IF_MCONT_EOB)
 /*
 * Use IF1 for RX and IF2 for TX
 */
 #define IF_RX                   0
 #define IF_TX                   1
-/* status interrupt */
-#define STATUS_INTERRUPT        0x8000
-/* global interrupt masks */
-#define ENABLE_ALL_INTERRUPTS   1
-#define DISABLE_ALL_INTERRUPTS  0
 /* minimum timeout for checking BUSY status */
 #define MIN_TIMEOUT_VALUE       6
@@ -171,6 +181,7 @@ enum c_can_lec_type {
        LEC_BIT0_ERROR,
        LEC_CRC_ERROR,
        LEC_UNUSED,
+        LEC_MASK = LEC_UNUSED,
 };
 /*
@@ -226,143 +237,115 @@ static inline void c_can_reset_ram(const struct c_can_priv *priv, bool enable)
                priv->raminit(priv, enable);
 }
-static inline int get_tx_next_msg_obj(const struct c_can_priv *priv)
+static void c_can_irq_control(struct c_can_priv *priv, bool enable)
 {
-        return (priv->tx_next & C_CAN_NEXT_MSG_OBJ_MASK) +
+        u32 ctrl = priv->read_reg(priv, C_CAN_CTRL_REG) & ~CONTROL_IRQMSK;
-                        C_CAN_MSG_OBJ_TX_FIRST;
-}
-static inline int get_tx_echo_msg_obj(int txecho)
-{
-        return (txecho & C_CAN_NEXT_MSG_OBJ_MASK) + C_CAN_MSG_OBJ_TX_FIRST;
-}
-static u32 c_can_read_reg32(struct c_can_priv *priv, enum reg index)
-{
-        u32 val = priv->read_reg(priv, index);
-        val |= ((u32) priv->read_reg(priv, index + 1)) << 16;
-        return val;
-}
-static void c_can_enable_all_interrupts(struct c_can_priv *priv,
-                                                int enable)
-{
-        unsigned int cntrl_save = priv->read_reg(priv,
-                                                C_CAN_CTRL_REG);
        if (enable)
-                cntrl_save |= (CONTROL_SIE | CONTROL_EIE | CONTROL_IE);
+                ctrl |= CONTROL_IRQMSK;
-        else
-                cntrl_save &= ~(CONTROL_EIE | CONTROL_IE | CONTROL_SIE);
-        priv->write_reg(priv, C_CAN_CTRL_REG, cntrl_save);
+        priv->write_reg(priv, C_CAN_CTRL_REG, ctrl);
 }
-static inline int c_can_msg_obj_is_busy(struct c_can_priv *priv, int iface)
+static void c_can_obj_update(struct net_device *dev, int iface, u32 cmd, u32 obj)
 {
-        int count = MIN_TIMEOUT_VALUE;
+        struct c_can_priv *priv = netdev_priv(dev);
+        int cnt, reg = C_CAN_IFACE(COMREQ_REG, iface);
+        priv->write_reg(priv, reg + 1, cmd);
+        priv->write_reg(priv, reg, obj);
-        while (count && priv->read_reg(priv,
+        for (cnt = MIN_TIMEOUT_VALUE; cnt; cnt--) {
-                                C_CAN_IFACE(COMREQ_REG, iface)) &
+                if (!(priv->read_reg(priv, reg) & IF_COMR_BUSY))
-                                IF_COMR_BUSY) {
+                        return;
-                count--;
                udelay(1);
        }
+        netdev_err(dev, "Updating object timed out\n");
-        if (!count)
+}
-                return 1;
-        return 0;
+static inline void c_can_object_get(struct net_device *dev, int iface,
+                                    u32 obj, u32 cmd)
+{
+        c_can_obj_update(dev, iface, cmd, obj);
 }
-static inline void c_can_object_get(struct net_device *dev,
+static inline void c_can_object_put(struct net_device *dev, int iface,
-                                        int iface, int objno, int mask)
+                                    u32 obj, u32 cmd)
 {
-        struct c_can_priv *priv = netdev_priv(dev);
+        c_can_obj_update(dev, iface, cmd | IF_COMM_WR, obj);
+}
-        /*
+/*
-         * As per specs, after writting the message object number in the
+ * Note: According to documentation clearing TXIE while MSGVAL is set
-         * IF command request register the transfer b/w interface
+ * is not allowed, but works nicely on C/DCAN. And that lowers the I/O
-         * register and message RAM must be complete in 6 CAN-CLK
+ * load significantly.
-         * period.
+ */
-         */
+static void c_can_inval_tx_object(struct net_device *dev, int iface, int obj)
-        priv->write_reg(priv, C_CAN_IFACE(COMMSK_REG, iface),
+{
-                        IFX_WRITE_LOW_16BIT(mask));
+        struct c_can_priv *priv = netdev_priv(dev);
-        priv->write_reg(priv, C_CAN_IFACE(COMREQ_REG, iface),
-                        IFX_WRITE_LOW_16BIT(objno));
-        if (c_can_msg_obj_is_busy(priv, iface))
+        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), 0);
-                netdev_err(dev, "timed out in object get\n");
+        c_can_object_put(dev, iface, obj, IF_COMM_INVAL);
 }
-static inline void c_can_object_put(struct net_device *dev,
+static void c_can_inval_msg_object(struct net_device *dev, int iface, int obj)
-                                        int iface, int objno, int mask)
 {
        struct c_can_priv *priv = netdev_priv(dev);
-        /*
+        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), 0);
-         * As per specs, after writting the message object number in the
+        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), 0);
-         * IF command request register the transfer b/w interface
+        c_can_inval_tx_object(dev, iface, obj);
-         * register and message RAM must be complete in 6 CAN-CLK
-         * period.
-         */
-        priv->write_reg(priv, C_CAN_IFACE(COMMSK_REG, iface),
-                        (IF_COMM_WR | IFX_WRITE_LOW_16BIT(mask)));
-        priv->write_reg(priv, C_CAN_IFACE(COMREQ_REG, iface),
-                        IFX_WRITE_LOW_16BIT(objno));
-        if (c_can_msg_obj_is_busy(priv, iface))
-                netdev_err(dev, "timed out in object put\n");
 }
-static void c_can_write_msg_object(struct net_device *dev,
+static void c_can_setup_tx_object(struct net_device *dev, int iface,
-                        int iface, struct can_frame *frame, int objno)
+                                  struct can_frame *frame, int idx)
 {
-        int i;
-        u16 flags = 0;
-        unsigned int id;
        struct c_can_priv *priv = netdev_priv(dev);
+        u16 ctrl = IF_MCONT_TX | frame->can_dlc;
-        if (!(frame->can_id & CAN_RTR_FLAG))
+        bool rtr = frame->can_id & CAN_RTR_FLAG;
-                flags |= IF_ARB_TRANSMIT;
+        u32 arb = IF_ARB_MSGVAL;
+        int i;
        if (frame->can_id & CAN_EFF_FLAG) {
-                id = frame->can_id & CAN_EFF_MASK;
+                arb |= frame->can_id & CAN_EFF_MASK;
-                flags |= IF_ARB_MSGXTD;
+                arb |= IF_ARB_MSGXTD;
-        } else
+        } else {
-                id = ((frame->can_id & CAN_SFF_MASK) << 18);
+                arb |= (frame->can_id & CAN_SFF_MASK) << 18;
+        }
+        if (!rtr)
+                arb |= IF_ARB_TRANSMIT;
-        flags |= IF_ARB_MSGVAL;
+        /*
+         * If we change the DIR bit, we need to invalidate the buffer
+         * first, i.e. clear the MSGVAL flag in the arbiter.
+         */
+        if (rtr != (bool)test_bit(idx, &priv->tx_dir)) {
+                u32 obj = idx + C_CAN_MSG_OBJ_TX_FIRST;
+                c_can_inval_msg_object(dev, iface, obj);
+                change_bit(idx, &priv->tx_dir);
+        }
+        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), arb);
+        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), arb >> 16);
-        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
+        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
-                                IFX_WRITE_LOW_16BIT(id));
-        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), flags |
-                                IFX_WRITE_HIGH_16BIT(id));
        for (i = 0; i < frame->can_dlc; i += 2) {
                priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2,
                                frame->data[i] | (frame->data[i + 1] << 8));
        }
-        /* enable interrupt for this message object */
-        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface),
-                        IF_MCONT_TXIE | IF_MCONT_TXRQST | IF_MCONT_EOB |
-                        frame->can_dlc);
-        c_can_object_put(dev, iface, objno, IF_COMM_ALL);
 }
 static inline void c_can_activate_all_lower_rx_msg_obj(struct net_device *dev,
-                                                int iface,
+                                                       int iface)
-                                                int ctrl_mask)
 {
        int i;
-        struct c_can_priv *priv = netdev_priv(dev);
-        for (i = C_CAN_MSG_OBJ_RX_FIRST; i <= C_CAN_MSG_RX_LOW_LAST; i++) {
+        for (i = C_CAN_MSG_OBJ_RX_FIRST; i <= C_CAN_MSG_RX_LOW_LAST; i++)
-                priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface),
+                c_can_object_get(dev, iface, i, IF_COMM_CLR_NEWDAT);
-                                ctrl_mask & ~IF_MCONT_NEWDAT);
-                c_can_object_put(dev, iface, i, IF_COMM_CONTROL);
-        }
 }
 static int c_can_handle_lost_msg_obj(struct net_device *dev,
@@ -377,6 +360,9 @@ static int c_can_handle_lost_msg_obj(struct net_device *dev,
        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
        c_can_object_put(dev, iface, objno, IF_COMM_CONTROL);
+        stats->rx_errors++;
+        stats->rx_over_errors++;
        /* create an error msg */
        skb = alloc_can_err_skb(dev, &frame);
        if (unlikely(!skb))
@@ -384,22 +370,18 @@ static int c_can_handle_lost_msg_obj(struct net_device *dev,
        frame->can_id |= CAN_ERR_CRTL;
        frame->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
-        stats->rx_errors++;
-        stats->rx_over_errors++;
        netif_receive_skb(skb);
        return 1;
 }
-static int c_can_read_msg_object(struct net_device *dev, int iface, int ctrl)
+static int c_can_read_msg_object(struct net_device *dev, int iface, u32 ctrl)
 {
-        u16 flags, data;
-        int i;
-        unsigned int val;
-        struct c_can_priv *priv = netdev_priv(dev);
        struct net_device_stats *stats = &dev->stats;
-        struct sk_buff *skb;
+        struct c_can_priv *priv = netdev_priv(dev);
        struct can_frame *frame;
+        struct sk_buff *skb;
+        u32 arb, data;
        skb = alloc_can_skb(dev, &frame);
        if (!skb) {
@@ -409,115 +391,82 @@ static int c_can_read_msg_object(struct net_device *dev, int iface, int ctrl)
        frame->can_dlc = get_can_dlc(ctrl & 0x0F);
-        flags = priv->read_reg(priv, C_CAN_IFACE(ARB2_REG, iface));
+        arb = priv->read_reg(priv, C_CAN_IFACE(ARB1_REG, iface));
-        val = priv->read_reg(priv, C_CAN_IFACE(ARB1_REG, iface)) |
+        arb |= priv->read_reg(priv, C_CAN_IFACE(ARB2_REG, iface)) << 16;
-                (flags << 16);
-        if (flags & IF_ARB_MSGXTD)
+        if (arb & IF_ARB_MSGXTD)
-                frame->can_id = (val & CAN_EFF_MASK) | CAN_EFF_FLAG;
+                frame->can_id = (arb & CAN_EFF_MASK) | CAN_EFF_FLAG;
        else
-                frame->can_id = (val >> 18) & CAN_SFF_MASK;
+                frame->can_id = (arb >> 18) & CAN_SFF_MASK;
-        if (flags & IF_ARB_TRANSMIT)
+        if (arb & IF_ARB_TRANSMIT) {
                frame->can_id |= CAN_RTR_FLAG;
-        else {
+        } else {
-                for (i = 0; i < frame->can_dlc; i += 2) {
+                int i, dreg = C_CAN_IFACE(DATA1_REG, iface);
-                        data = priv->read_reg(priv,
-                                C_CAN_IFACE(DATA1_REG, iface) + i / 2);
+                for (i = 0; i < frame->can_dlc; i += 2, dreg ++) {
+                        data = priv->read_reg(priv, dreg);
                        frame->data[i] = data;
                        frame->data[i + 1] = data >> 8;
                }
        }
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += frame->can_dlc;
+        netif_receive_skb(skb);
        return 0;
 }
 static void c_can_setup_receive_object(struct net_device *dev, int iface,
-                                        int objno, unsigned int mask,
+                                       u32 obj, u32 mask, u32 id, u32 mcont)
-                                        unsigned int id, unsigned int mcont)
 {
        struct c_can_priv *priv = netdev_priv(dev);
-        priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface),
+        mask |= BIT(29);
-                        IFX_WRITE_LOW_16BIT(mask));
+        priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface), mask);
+        priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface), mask >> 16);
-        /* According to C_CAN documentation, the reserved bit
-         * in IFx_MASK2 register is fixed 1
-         */
-        priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface),
-                        IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
-        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
+        id |= IF_ARB_MSGVAL;
-                        IFX_WRITE_LOW_16BIT(id));
+        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), id);
-        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface),
+        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), id >> 16);
-                        (IF_ARB_MSGVAL | IFX_WRITE_HIGH_16BIT(id)));
        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), mcont);
-        c_can_object_put(dev, iface, objno, IF_COMM_ALL & ~IF_COMM_TXRQST);
+        c_can_object_put(dev, iface, obj, IF_COMM_RCV_SETUP);
-        netdev_dbg(dev, "obj no:%d, msgval:0x%08x\n", objno,
-                        c_can_read_reg32(priv, C_CAN_MSGVAL1_REG));
-}
-static void c_can_inval_msg_object(struct net_device *dev, int iface, int objno)
-{
-        struct c_can_priv *priv = netdev_priv(dev);
-        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), 0);
-        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), 0);
-        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), 0);
-        c_can_object_put(dev, iface, objno, IF_COMM_ARB | IF_COMM_CONTROL);
-        netdev_dbg(dev, "obj no:%d, msgval:0x%08x\n", objno,
-                        c_can_read_reg32(priv, C_CAN_MSGVAL1_REG));
-}
-static inline int c_can_is_next_tx_obj_busy(struct c_can_priv *priv, int objno)
-{
-        int val = c_can_read_reg32(priv, C_CAN_TXRQST1_REG);
-        /*
-         * as transmission request register's bit n-1 corresponds to
-         * message object n, we need to handle the same properly.
-         */
-        if (val & (1 << (objno - 1)))
-                return 1;
-        return 0;
 }
 static netdev_tx_t c_can_start_xmit(struct sk_buff *skb,
-                                        struct net_device *dev)
+                                    struct net_device *dev)
 {
-        u32 msg_obj_no;
-        struct c_can_priv *priv = netdev_priv(dev);
        struct can_frame *frame = (struct can_frame *)skb->data;
+        struct c_can_priv *priv = netdev_priv(dev);
+        u32 idx, obj;
        if (can_dropped_invalid_skb(dev, skb))
                return NETDEV_TX_OK;
-        spin_lock_bh(&priv->xmit_lock);
-        msg_obj_no = get_tx_next_msg_obj(priv);
-        /* prepare message object for transmission */
-        c_can_write_msg_object(dev, IF_TX, frame, msg_obj_no);
-        priv->dlc[msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST] = frame->can_dlc;
-        can_put_echo_skb(skb, dev, msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
        /*
-         * we have to stop the queue in case of a wrap around or
+         * This is not a FIFO. C/D_CAN sends out the buffers
-         * if the next TX message object is still in use
+         * prioritized. The lowest buffer number wins.
         */
-        priv->tx_next++;
+        idx = fls(atomic_read(&priv->tx_active));
-        if (c_can_is_next_tx_obj_busy(priv, get_tx_next_msg_obj(priv)) ||
+        obj = idx + C_CAN_MSG_OBJ_TX_FIRST;
-                        (priv->tx_next & C_CAN_NEXT_MSG_OBJ_MASK) == 0)
+        /* If this is the last buffer, stop the xmit queue */
+        if (idx == C_CAN_MSG_OBJ_TX_NUM - 1)
                netif_stop_queue(dev);
-        spin_unlock_bh(&priv->xmit_lock);
+        /*
+         * Store the message in the interface so we can call
+         * can_put_echo_skb(). We must do this before we enable
+         * transmit as we might race against do_tx().
+         */
+        c_can_setup_tx_object(dev, IF_TX, frame, idx);
+        priv->dlc[idx] = frame->can_dlc;
+        can_put_echo_skb(skb, dev, idx);
+        /* Update the active bits */
+        atomic_add((1 << idx), &priv->tx_active);
+        /* Start transmission */
+        c_can_object_put(dev, IF_TX, obj, IF_COMM_TX);
        return NETDEV_TX_OK;
 }
@@ -594,11 +543,10 @@ static void c_can_configure_msg_objects(struct net_device *dev)
        /* setup receive message objects */
        for (i = C_CAN_MSG_OBJ_RX_FIRST; i < C_CAN_MSG_OBJ_RX_LAST; i++)
-                c_can_setup_receive_object(dev, IF_RX, i, 0, 0,
+                c_can_setup_receive_object(dev, IF_RX, i, 0, 0, IF_MCONT_RCV);
-                        (IF_MCONT_RXIE | IF_MCONT_UMASK) & ~IF_MCONT_EOB);
        c_can_setup_receive_object(dev, IF_RX, C_CAN_MSG_OBJ_RX_LAST, 0, 0,
-                        IF_MCONT_EOB | IF_MCONT_RXIE | IF_MCONT_UMASK);
+                                   IF_MCONT_RCV_EOB);
 }
 /*
@@ -612,30 +560,22 @@ static int c_can_chip_config(struct net_device *dev)
        struct c_can_priv *priv = netdev_priv(dev);
        /* enable automatic retransmission */
-        priv->write_reg(priv, C_CAN_CTRL_REG,
+        priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
-                        CONTROL_ENABLE_AR);
        if ((priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) &&
            (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)) {
                /* loopback + silent mode : useful for hot self-test */
-                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_EIE |
+                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_TEST);
-                                CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
+                priv->write_reg(priv, C_CAN_TEST_REG, TEST_LBACK | TEST_SILENT);
-                priv->write_reg(priv, C_CAN_TEST_REG,
-                                TEST_LBACK | TEST_SILENT);
        } else if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK) {
                /* loopback mode : useful for self-test function */
-                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_EIE |
+                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_TEST);
-                                CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
                priv->write_reg(priv, C_CAN_TEST_REG, TEST_LBACK);
        } else if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
                /* silent mode : bus-monitoring mode */
-                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_EIE |
+                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_TEST);
-                                CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
                priv->write_reg(priv, C_CAN_TEST_REG, TEST_SILENT);
-        } else
+        }
-                /* normal mode*/
-                priv->write_reg(priv, C_CAN_CTRL_REG,
-                                CONTROL_EIE | CONTROL_SIE | CONTROL_IE);
        /* configure message objects */
        c_can_configure_msg_objects(dev);
@@ -643,6 +583,11 @@ static int c_can_chip_config(struct net_device *dev)
        /* set a `lec` value so that we can check for updates later */
        priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
+        /* Clear all internal status */
+        atomic_set(&priv->tx_active, 0);
+        priv->rxmasked = 0;
+        priv->tx_dir = 0;
        /* set bittiming params */
        return c_can_set_bittiming(dev);
 }
@@ -657,13 +602,11 @@ static int c_can_start(struct net_device *dev)
        if (err)
                return err;
-        priv->can.state = CAN_STATE_ERROR_ACTIVE;
+        /* Setup the command for new messages */
+        priv->comm_rcv_high = priv->type != BOSCH_D_CAN ?
-        /* reset tx helper pointers */
+                IF_COMM_RCV_LOW : IF_COMM_RCV_HIGH;
-        priv->tx_next = priv->tx_echo = 0;
-        /* enable status change, error and module interrupts */
+        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-        c_can_enable_all_interrupts(priv, ENABLE_ALL_INTERRUPTS);
        return 0;
 }
@@ -672,15 +615,13 @@ static void c_can_stop(struct net_device *dev)
 {
        struct c_can_priv *priv = netdev_priv(dev);
-        /* disable all interrupts */
+        c_can_irq_control(priv, false);
-        c_can_enable_all_interrupts(priv, DISABLE_ALL_INTERRUPTS);
-        /* set the state as STOPPED */
        priv->can.state = CAN_STATE_STOPPED;
 }
 static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
 {
+        struct c_can_priv *priv = netdev_priv(dev);
        int err;
        switch (mode) {
@@ -689,6 +630,7 @@ static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
                if (err)
                        return err;
                netif_wake_queue(dev);
+                c_can_irq_control(priv, true);
                break;
        default:
                return -EOPNOTSUPP;
@@ -724,42 +666,29 @@ static int c_can_get_berr_counter(const struct net_device *dev,
        return err;
 }
-/*
- * priv->tx_echo holds the number of the oldest can_frame put for
- * transmission into the hardware, but not yet ACKed by the CAN tx
- * complete IRQ.
- *
- * We iterate from priv->tx_echo to priv->tx_next and check if the
- * packet has been transmitted, echo it back to the CAN framework.
- * If we discover a not yet transmitted packet, stop looking for more.
- */
 static void c_can_do_tx(struct net_device *dev)
 {
        struct c_can_priv *priv = netdev_priv(dev);
        struct net_device_stats *stats = &dev->stats;
-        u32 val, obj, pkts = 0, bytes = 0;
+        u32 idx, obj, pkts = 0, bytes = 0, pend, clr;
-        spin_lock_bh(&priv->xmit_lock);
-        for (; (priv->tx_next - priv->tx_echo) > 0; priv->tx_echo++) {
+        clr = pend = priv->read_reg(priv, C_CAN_INTPND2_REG);
-                obj = get_tx_echo_msg_obj(priv->tx_echo);
-                val = c_can_read_reg32(priv, C_CAN_TXRQST1_REG);
-                if (val & (1 << (obj - 1)))
+        while ((idx = ffs(pend))) {
-                        break;
+                idx--;
+                pend &= ~(1 << idx);
-                can_get_echo_skb(dev, obj - C_CAN_MSG_OBJ_TX_FIRST);
+                obj = idx + C_CAN_MSG_OBJ_TX_FIRST;
-                bytes += priv->dlc[obj - C_CAN_MSG_OBJ_TX_FIRST];
+                c_can_inval_tx_object(dev, IF_RX, obj);
+                can_get_echo_skb(dev, idx);
+                bytes += priv->dlc[idx];
                pkts++;
-                c_can_inval_msg_object(dev, IF_TX, obj);
        }
-        /* restart queue if wrap-up or if queue stalled on last pkt */
+        /* Clear the bits in the tx_active mask */
-        if (((priv->tx_next & C_CAN_NEXT_MSG_OBJ_MASK) != 0) ||
+        atomic_sub(clr, &priv->tx_active);
-                        ((priv->tx_echo & C_CAN_NEXT_MSG_OBJ_MASK) == 0))
-                netif_wake_queue(dev);
-        spin_unlock_bh(&priv->xmit_lock);
+        if (clr & (1 << (C_CAN_MSG_OBJ_TX_NUM - 1)))
+                netif_wake_queue(dev);
        if (pkts) {
                stats->tx_bytes += bytes;
@@ -800,18 +729,42 @@ static u32 c_can_adjust_pending(u32 pend)
        return pend & ~((1 << lasts) - 1);
 }
+static inline void c_can_rx_object_get(struct net_device *dev,
+                                       struct c_can_priv *priv, u32 obj)
+{
+#ifdef CONFIG_CAN_C_CAN_STRICT_FRAME_ORDERING
+        if (obj < C_CAN_MSG_RX_LOW_LAST)
+                c_can_object_get(dev, IF_RX, obj, IF_COMM_RCV_LOW);
+        else
+#endif
+                c_can_object_get(dev, IF_RX, obj, priv->comm_rcv_high);
+}
+static inline void c_can_rx_finalize(struct net_device *dev,
+                                     struct c_can_priv *priv, u32 obj)
+{
+#ifdef CONFIG_CAN_C_CAN_STRICT_FRAME_ORDERING
+        if (obj < C_CAN_MSG_RX_LOW_LAST)
+                priv->rxmasked |= BIT(obj - 1);
+        else if (obj == C_CAN_MSG_RX_LOW_LAST) {
+                priv->rxmasked = 0;
+                /* activate all lower message objects */
+                c_can_activate_all_lower_rx_msg_obj(dev, IF_RX);
+        }
+#endif
+        if (priv->type != BOSCH_D_CAN)
+                c_can_object_get(dev, IF_RX, obj, IF_COMM_CLR_NEWDAT);
+}
 static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
                              u32 pend, int quota)
 {
-        u32 pkts = 0, ctrl, obj, mcmd;
+        u32 pkts = 0, ctrl, obj;
        while ((obj = ffs(pend)) && quota > 0) {
                pend &= ~BIT(obj - 1);
-                mcmd = obj < C_CAN_MSG_RX_LOW_LAST ?
+                c_can_rx_object_get(dev, priv, obj);
-                        IF_COMM_RCV_LOW : IF_COMM_RCV_HIGH;
-                c_can_object_get(dev, IF_RX, obj, mcmd);
                ctrl = priv->read_reg(priv, C_CAN_IFACE(MSGCTRL_REG, IF_RX));
                if (ctrl & IF_MCONT_MSGLST) {
@@ -833,9 +786,7 @@ static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
                /* read the data from the message object */
                c_can_read_msg_object(dev, IF_RX, ctrl);
-                if (obj == C_CAN_MSG_RX_LOW_LAST)
+                c_can_rx_finalize(dev, priv, obj);
-                        /* activate all lower message objects */
-                        c_can_activate_all_lower_rx_msg_obj(dev, IF_RX, ctrl);
                pkts++;
                quota--;
@@ -844,6 +795,16 @@ static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
        return pkts;
 }
+static inline u32 c_can_get_pending(struct c_can_priv *priv)
+{
+        u32 pend = priv->read_reg(priv, C_CAN_NEWDAT1_REG);
+#ifdef CONFIG_CAN_C_CAN_STRICT_FRAME_ORDERING
+        pend &= ~priv->rxmasked;
+#endif
+        return pend;
+}
 /*
 * theory of operation:
 *
@@ -853,6 +814,8 @@ static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
 * has arrived. To work-around this issue, we keep two groups of message
 * objects whose partitioning is defined by C_CAN_MSG_OBJ_RX_SPLIT.
 *
+ * If CONFIG_CAN_C_CAN_STRICT_FRAME_ORDERING = y
+ *
 * To ensure in-order frame reception we use the following
 * approach while re-activating a message object to receive further
 * frames:
@@ -865,6 +828,14 @@ static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
 * - if the current message object number is greater than
 *   C_CAN_MSG_RX_LOW_LAST then clear the NEWDAT bit of
 *   only this message object.
+ *
+ * This can cause packet loss!
+ *
+ * If CONFIG_CAN_C_CAN_STRICT_FRAME_ORDERING = n
+ *
+ * We clear the newdat bit right away.
+ *
+ * This can result in packet reordering when the readout is slow.
 */
 static int c_can_do_rx_poll(struct net_device *dev, int quota)
 {
@@ -880,7 +851,7 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
        while (quota > 0) {
                if (!pend) {
-                        pend = priv->read_reg(priv, C_CAN_INTPND1_REG);
+                        pend = c_can_get_pending(priv);
                        if (!pend)
                                break;
                        /*
@@ -905,12 +876,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
        return pkts;
 }
-static inline int c_can_has_and_handle_berr(struct c_can_priv *priv)
-{
-        return (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING) &&
-                (priv->current_status & LEC_UNUSED);
-}
 static int c_can_handle_state_change(struct net_device *dev,
                                enum c_can_bus_error_types error_type)
 {
@@ -922,6 +887,26 @@ static int c_can_handle_state_change(struct net_device *dev,
        struct sk_buff *skb;
        struct can_berr_counter bec;
+        switch (error_type) {
+        case C_CAN_ERROR_WARNING:
+                /* error warning state */
+                priv->can.can_stats.error_warning++;
+                priv->can.state = CAN_STATE_ERROR_WARNING;
+                break;
+        case C_CAN_ERROR_PASSIVE:
+                /* error passive state */
+                priv->can.can_stats.error_passive++;
+                priv->can.state = CAN_STATE_ERROR_PASSIVE;
+                break;
+        case C_CAN_BUS_OFF:
+                /* bus-off state */
+                priv->can.state = CAN_STATE_BUS_OFF;
+                can_bus_off(dev);
+                break;
+        default:
+                break;
+        }
        /* propagate the error condition to the CAN stack */
        skb = alloc_can_err_skb(dev, &cf);
        if (unlikely(!skb))
@@ -935,8 +920,6 @@ static int c_can_handle_state_change(struct net_device *dev,
        switch (error_type) {
        case C_CAN_ERROR_WARNING:
                /* error warning state */
-                priv->can.can_stats.error_warning++;
-                priv->can.state = CAN_STATE_ERROR_WARNING;
                cf->can_id |= CAN_ERR_CRTL;
                cf->data[1] = (bec.txerr > bec.rxerr) ?
                        CAN_ERR_CRTL_TX_WARNING :
@@ -947,8 +930,6 @@ static int c_can_handle_state_change(struct net_device *dev,
                break;
        case C_CAN_ERROR_PASSIVE:
                /* error passive state */
-                priv->can.can_stats.error_passive++;
-                priv->can.state = CAN_STATE_ERROR_PASSIVE;
                cf->can_id |= CAN_ERR_CRTL;
                if (rx_err_passive)
                        cf->data[1] |= CAN_ERR_CRTL_RX_PASSIVE;
@@ -960,22 +941,16 @@ static int c_can_handle_state_change(struct net_device *dev,
                break;
        case C_CAN_BUS_OFF:
                /* bus-off state */
-                priv->can.state = CAN_STATE_BUS_OFF;
                cf->can_id |= CAN_ERR_BUSOFF;
-                /*
-                 * disable all interrupts in bus-off mode to ensure that
-                 * the CPU is not hogged down
-                 */
-                c_can_enable_all_interrupts(priv, DISABLE_ALL_INTERRUPTS);
                can_bus_off(dev);
                break;
        default:
                break;
        }
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        return 1;
 }
@@ -996,6 +971,13 @@ static int c_can_handle_bus_err(struct net_device *dev,
        if (lec_type == LEC_UNUSED || lec_type == LEC_NO_ERROR)
                return 0;
+        if (!(priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING))
+                return 0;
+        /* common for all type of bus errors */
+        priv->can.can_stats.bus_error++;
+        stats->rx_errors++;
        /* propagate the error condition to the CAN stack */
        skb = alloc_can_err_skb(dev, &cf);
        if (unlikely(!skb))
@@ -1005,10 +987,6 @@ static int c_can_handle_bus_err(struct net_device *dev,
         * check for 'last error code' which tells us the
         * type of the last error to occur on the CAN bus
         */
-        /* common for all type of bus errors */
-        priv->can.can_stats.bus_error++;
-        stats->rx_errors++;
        cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
@@ -1043,95 +1021,64 @@ static int c_can_handle_bus_err(struct net_device *dev,
                break;
        }
-        /* set a `lec` value so that we can check for updates later */
-        priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        return 1;
 }
 static int c_can_poll(struct napi_struct *napi, int quota)
 {
-        u16 irqstatus;
-        int lec_type = 0;
-        int work_done = 0;
        struct net_device *dev = napi->dev;
        struct c_can_priv *priv = netdev_priv(dev);
+        u16 curr, last = priv->last_status;
+        int work_done = 0;
-        irqstatus = priv->irqstatus;
+        priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
-        if (!irqstatus)
+        /* Ack status on C_CAN. D_CAN is self clearing */
-                goto end;
+        if (priv->type != BOSCH_D_CAN)
+                priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
-        /* status events have the highest priority */
+        /* handle state changes */
-        if (irqstatus == STATUS_INTERRUPT) {
+        if ((curr & STATUS_EWARN) && (!(last & STATUS_EWARN))) {
-                priv->current_status = priv->read_reg(priv,
+                netdev_dbg(dev, "entered error warning state\n");
-                                        C_CAN_STS_REG);
+                work_done += c_can_handle_state_change(dev, C_CAN_ERROR_WARNING);
+        }
-                /* handle Tx/Rx events */
-                if (priv->current_status & STATUS_TXOK)
-                        priv->write_reg(priv, C_CAN_STS_REG,
-                                        priv->current_status & ~STATUS_TXOK);
-                if (priv->current_status & STATUS_RXOK)
-                        priv->write_reg(priv, C_CAN_STS_REG,
-                                        priv->current_status & ~STATUS_RXOK);
-                /* handle state changes */
-                if ((priv->current_status & STATUS_EWARN) &&
-                                (!(priv->last_status & STATUS_EWARN))) {
-                        netdev_dbg(dev, "entered error warning state\n");
-                        work_done += c_can_handle_state_change(dev,
-                                                C_CAN_ERROR_WARNING);
-                }
-                if ((priv->current_status & STATUS_EPASS) &&
-                                (!(priv->last_status & STATUS_EPASS))) {
-                        netdev_dbg(dev, "entered error passive state\n");
-                        work_done += c_can_handle_state_change(dev,
-                                                C_CAN_ERROR_PASSIVE);
-                }
-                if ((priv->current_status & STATUS_BOFF) &&
-                                (!(priv->last_status & STATUS_BOFF))) {
-                        netdev_dbg(dev, "entered bus off state\n");
-                        work_done += c_can_handle_state_change(dev,
-                                                C_CAN_BUS_OFF);
-                }
-                /* handle bus recovery events */
+        if ((curr & STATUS_EPASS) && (!(last & STATUS_EPASS))) {
-                if ((!(priv->current_status & STATUS_BOFF)) &&
+                netdev_dbg(dev, "entered error passive state\n");
-                                (priv->last_status & STATUS_BOFF)) {
+                work_done += c_can_handle_state_change(dev, C_CAN_ERROR_PASSIVE);
-                        netdev_dbg(dev, "left bus off state\n");
+        }
-                        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-                }
+        if ((curr & STATUS_BOFF) && (!(last & STATUS_BOFF))) {
-                if ((!(priv->current_status & STATUS_EPASS)) &&
+                netdev_dbg(dev, "entered bus off state\n");
-                                (priv->last_status & STATUS_EPASS)) {
+                work_done += c_can_handle_state_change(dev, C_CAN_BUS_OFF);
-                        netdev_dbg(dev, "left error passive state\n");
+                goto end;
-                        priv->can.state = CAN_STATE_ERROR_ACTIVE;
+        }
-                }
-                priv->last_status = priv->current_status;
+        /* handle bus recovery events */
+        if ((!(curr & STATUS_BOFF)) && (last & STATUS_BOFF)) {
-                /* handle lec errors on the bus */
+                netdev_dbg(dev, "left bus off state\n");
-                lec_type = c_can_has_and_handle_berr(priv);
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
-                if (lec_type)
+        }
-                        work_done += c_can_handle_bus_err(dev, lec_type);
+        if ((!(curr & STATUS_EPASS)) && (last & STATUS_EPASS)) {
-        } else if ((irqstatus >= C_CAN_MSG_OBJ_RX_FIRST) &&
+                netdev_dbg(dev, "left error passive state\n");
-                        (irqstatus <= C_CAN_MSG_OBJ_RX_LAST)) {
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
-                /* handle events corresponding to receive message objects */
-                work_done += c_can_do_rx_poll(dev, (quota - work_done));
-        } else if ((irqstatus >= C_CAN_MSG_OBJ_TX_FIRST) &&
-                        (irqstatus <= C_CAN_MSG_OBJ_TX_LAST)) {
-                /* handle events corresponding to transmit message objects */
-                c_can_do_tx(dev);
        }
+        /* handle lec errors on the bus */
+        work_done += c_can_handle_bus_err(dev, curr & LEC_MASK);
+        /* Handle Tx/Rx events. We do this unconditionally */
+        work_done += c_can_do_rx_poll(dev, (quota - work_done));
+        c_can_do_tx(dev);
 end:
        if (work_done < quota) {
                napi_complete(napi);
-                /* enable all IRQs */
+                /* enable all IRQs if we are not in bus off state */
-                c_can_enable_all_interrupts(priv, ENABLE_ALL_INTERRUPTS);
+                if (priv->can.state != CAN_STATE_BUS_OFF)
+                        c_can_irq_control(priv, true);
        }
        return work_done;
@@ -1142,12 +1089,11 @@ static irqreturn_t c_can_isr(int irq, void *dev_id)
        struct net_device *dev = (struct net_device *)dev_id;
        struct c_can_priv *priv = netdev_priv(dev);
-        priv->irqstatus = priv->read_reg(priv, C_CAN_INT_REG);
+        if (!priv->read_reg(priv, C_CAN_INT_REG))
-        if (!priv->irqstatus)
                return IRQ_NONE;
        /* disable all interrupts and schedule the NAPI */
-        c_can_enable_all_interrupts(priv, DISABLE_ALL_INTERRUPTS);
+        c_can_irq_control(priv, false);
        napi_schedule(&priv->napi);
        return IRQ_HANDLED;
@@ -1184,6 +1130,8 @@ static int c_can_open(struct net_device *dev)
        can_led_event(dev, CAN_LED_EVENT_OPEN);
        napi_enable(&priv->napi);
+        /* enable status change, error and module interrupts */
+        c_can_irq_control(priv, true);
        netif_start_queue(dev);
        return 0;
@@ -1226,7 +1174,6 @@ struct net_device *alloc_c_can_dev(void)
                return NULL;
        priv = netdev_priv(dev);
-        spin_lock_init(&priv->xmit_lock);
        netif_napi_add(dev, &priv->napi, c_can_poll, C_CAN_NAPI_WEIGHT);
        priv->dev = dev;
@@ -1281,6 +1228,7 @@ int c_can_power_up(struct net_device *dev)
        u32 val;
        unsigned long time_out;
        struct c_can_priv *priv = netdev_priv(dev);
+        int ret;
        if (!(dev->flags & IFF_UP))
                return 0;
@@ -1307,7 +1255,11 @@ int c_can_power_up(struct net_device *dev)
        if (time_after(jiffies, time_out))
                return -ETIMEDOUT;
-        return c_can_start(dev);
+        ret = c_can_start(dev);
+        if (!ret)
+                c_can_irq_control(priv, true);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(c_can_power_up);
 #endif
diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h
index faa8404162b3..c56f1b1c11ca 100644
--- a/drivers/net/can/c_can/c_can.h
+++ b/drivers/net/can/c_can/c_can.h
@@ -22,14 +22,6 @@
 #ifndef C_CAN_H
 #define C_CAN_H
-/*
- * IFx register masks:
- * allow easy operation on 16-bit registers when the
- * argument is 32-bit instead
- */
-#define IFX_WRITE_LOW_16BIT(x)  ((x) & 0xFFFF)
-#define IFX_WRITE_HIGH_16BIT(x) (((x) & 0xFFFF0000) >> 16)
 /* message object split */
 #define C_CAN_NO_OF_OBJECTS     32
 #define C_CAN_MSG_OBJ_RX_NUM    16
@@ -45,8 +37,6 @@
 #define C_CAN_MSG_OBJ_RX_SPLIT  9
 #define C_CAN_MSG_RX_LOW_LAST   (C_CAN_MSG_OBJ_RX_SPLIT - 1)
-#define C_CAN_NEXT_MSG_OBJ_MASK (C_CAN_MSG_OBJ_TX_NUM - 1)
 #define RECEIVE_OBJECT_BITS     0x0000ffff
 enum reg {
@@ -183,23 +173,20 @@ struct c_can_priv {
        struct napi_struct napi;
        struct net_device *dev;
        struct device *device;
-        spinlock_t xmit_lock;
+        atomic_t tx_active;
-        int tx_object;
+        unsigned long tx_dir;
-        int current_status;
        int last_status;
        u16 (*read_reg) (struct c_can_priv *priv, enum reg index);
        void (*write_reg) (struct c_can_priv *priv, enum reg index, u16 val);
        void __iomem *base;
        const u16 *regs;
-        unsigned long irq_flags; /* for request_irq() */
-        unsigned int tx_next;
-        unsigned int tx_echo;
        void *priv;             /* for board-specific data */
-        u16 irqstatus;
        enum c_can_dev_id type;
        u32 __iomem *raminit_ctrlreg;
-        unsigned int instance;
+        int instance;
        void (*raminit) (const struct c_can_priv *priv, bool enable);
+        u32 comm_rcv_high;
+        u32 rxmasked;
        u32 dlc[C_CAN_MSG_OBJ_TX_NUM];
 };
diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
index bce0be54c2f5..fe5f6303b584 100644
--- a/drivers/net/can/c_can/c_can_pci.c
+++ b/drivers/net/can/c_can/c_can_pci.c
@@ -84,8 +84,11 @@ static int c_can_pci_probe(struct pci_dev *pdev,
                goto out_disable_device;
        }
-        pci_set_master(pdev);
+        ret = pci_enable_msi(pdev);
-        pci_enable_msi(pdev);
+        if (!ret) {
+                dev_info(&pdev->dev, "MSI enabled\n");
+                pci_set_master(pdev);
+        }
        addr = pci_iomap(pdev, 0, pci_resource_len(pdev, 0));
        if (!addr) {
@@ -132,6 +135,8 @@ static int c_can_pci_probe(struct pci_dev *pdev,
                goto out_free_c_can;
        }
+        priv->type = c_can_pci_data->type;
        /* Configure access to registers */
        switch (c_can_pci_data->reg_align) {
        case C_CAN_REG_ALIGN_32:
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 806d92753427..1df0b322d1e4 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -222,7 +222,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
                res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                priv->raminit_ctrlreg = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(priv->raminit_ctrlreg) || (int)priv->instance < 0)
+                if (IS_ERR(priv->raminit_ctrlreg) || priv->instance < 0)
                        dev_info(&pdev->dev, "control memory is not used for raminit\n");
                else
                        priv->raminit = c_can_hw_raminit;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index c7a260478749..e318e87e2bfc 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -256,7 +256,7 @@ static int can_get_bittiming(struct net_device *dev, struct can_bittiming *bt,
        /* Check if the CAN device has bit-timing parameters */
        if (!btc)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
        /*
         * Depending on the given can_bittiming parameter structure the CAN
diff --git a/drivers/net/can/sja1000/sja1000_isa.c b/drivers/net/can/sja1000/sja1000_isa.c
index df136a2516c4..014695d7e6a3 100644
--- a/drivers/net/can/sja1000/sja1000_isa.c
+++ b/drivers/net/can/sja1000/sja1000_isa.c
@@ -46,6 +46,7 @@ static int clk[MAXDEV];
 static unsigned char cdr[MAXDEV] = {[0 ... (MAXDEV - 1)] = 0xff};
 static unsigned char ocr[MAXDEV] = {[0 ... (MAXDEV - 1)] = 0xff};
 static int indirect[MAXDEV] = {[0 ... (MAXDEV - 1)] = -1};
+static spinlock_t indirect_lock[MAXDEV];  /* lock for indirect access mode */
 module_param_array(port, ulong, NULL, S_IRUGO);
 MODULE_PARM_DESC(port, "I/O port number");
@@ -101,19 +102,26 @@ static void sja1000_isa_port_write_reg(const struct sja1000_priv *priv,
 static u8 sja1000_isa_port_read_reg_indirect(const struct sja1000_priv *priv,
                                             int reg)
 {
-        unsigned long base = (unsigned long)priv->reg_base;
+        unsigned long flags, base = (unsigned long)priv->reg_base;
+        u8 readval;
+        spin_lock_irqsave(&indirect_lock[priv->dev->dev_id], flags);
        outb(reg, base);
-        return inb(base + 1);
+        readval = inb(base + 1);
+        spin_unlock_irqrestore(&indirect_lock[priv->dev->dev_id], flags);
+        return readval;
 }
 static void sja1000_isa_port_write_reg_indirect(const struct sja1000_priv *priv,
                                                int reg, u8 val)
 {
-        unsigned long base = (unsigned long)priv->reg_base;
+        unsigned long flags, base = (unsigned long)priv->reg_base;
+        spin_lock_irqsave(&indirect_lock[priv->dev->dev_id], flags);
        outb(reg, base);
        outb(val, base + 1);
+        spin_unlock_irqrestore(&indirect_lock[priv->dev->dev_id], flags);
 }
 static int sja1000_isa_probe(struct platform_device *pdev)
@@ -169,6 +177,7 @@ static int sja1000_isa_probe(struct platform_device *pdev)
                if (iosize == SJA1000_IOSIZE_INDIRECT) {
                        priv->read_reg = sja1000_isa_port_read_reg_indirect;
                        priv->write_reg = sja1000_isa_port_write_reg_indirect;
+                        spin_lock_init(&indirect_lock[idx]);
                } else {
                        priv->read_reg = sja1000_isa_port_read_reg;
                        priv->write_reg = sja1000_isa_port_write_reg;
@@ -198,6 +207,7 @@ static int sja1000_isa_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, dev);
        SET_NETDEV_DEV(dev, &pdev->dev);
+        dev->dev_id = idx;
        err = register_sja1000dev(dev);
        if (err) {
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index f5b16e0e3a12..dcf9196f6316 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -322,13 +322,13 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
                return;
-        spin_lock(&sl->lock);
+        spin_lock_bh(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-                spin_unlock(&sl->lock);
+                spin_unlock_bh(&sl->lock);
                netif_wake_queue(sl->dev);
                return;
        }
@@ -336,7 +336,7 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
-        spin_unlock(&sl->lock);
+        spin_unlock_bh(&sl->lock);
 }
 /* Send a can_frame to a TTY queue. */
diff --git a/drivers/net/ethernet/altera/Kconfig b/drivers/net/ethernet/altera/Kconfig
index 80c1ab74a4b8..fdddba51473e 100644
--- a/drivers/net/ethernet/altera/Kconfig
+++ b/drivers/net/ethernet/altera/Kconfig
@@ -1,5 +1,6 @@
 config ALTERA_TSE
        tristate "Altera Triple-Speed Ethernet MAC support"
+        depends on HAS_DMA
        select PHYLIB
        ---help---
          This driver supports the Altera Triple-Speed (TSE) Ethernet MAC.
diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c
index 3df18669ea30..4d1f2fdd5c32 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.c
+++ b/drivers/net/ethernet/altera/altera_msgdma.c
@@ -18,6 +18,7 @@
 #include "altera_utils.h"
 #include "altera_tse.h"
 #include "altera_msgdmahw.h"
+#include "altera_msgdma.h"
 /* No initialization work to do for MSGDMA */
 int msgdma_initialize(struct altera_tse_private *priv)
@@ -29,6 +30,10 @@ void msgdma_uninitialize(struct altera_tse_private *priv)
 {
 }
+void msgdma_start_rxdma(struct altera_tse_private *priv)
+{
+}
 void msgdma_reset(struct altera_tse_private *priv)
 {
        int counter;
@@ -154,7 +159,7 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
 /* Put buffer to the mSGDMA RX FIFO
 */
-int msgdma_add_rx_desc(struct altera_tse_private *priv,
+void msgdma_add_rx_desc(struct altera_tse_private *priv,
                        struct tse_buffer *rxbuffer)
 {
        struct msgdma_extended_desc *desc = priv->rx_dma_desc;
@@ -175,7 +180,6 @@ int msgdma_add_rx_desc(struct altera_tse_private *priv,
        iowrite32(0, &desc->burst_seq_num);
        iowrite32(0x00010001, &desc->stride);
        iowrite32(control, &desc->control);
-        return 1;
 }
 /* status is returned on upper 16 bits,
diff --git a/drivers/net/ethernet/altera/altera_msgdma.h b/drivers/net/ethernet/altera/altera_msgdma.h
index 7f0f5bf2bba2..42cf61c81057 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.h
+++ b/drivers/net/ethernet/altera/altera_msgdma.h
@@ -25,10 +25,11 @@ void msgdma_disable_txirq(struct altera_tse_private *);
 void msgdma_clear_rxirq(struct altera_tse_private *);
 void msgdma_clear_txirq(struct altera_tse_private *);
 u32 msgdma_tx_completions(struct altera_tse_private *);
-int msgdma_add_rx_desc(struct altera_tse_private *, struct tse_buffer *);
+void msgdma_add_rx_desc(struct altera_tse_private *, struct tse_buffer *);
 int msgdma_tx_buffer(struct altera_tse_private *, struct tse_buffer *);
 u32 msgdma_rx_status(struct altera_tse_private *);
 int msgdma_initialize(struct altera_tse_private *);
 void msgdma_uninitialize(struct altera_tse_private *);
+void msgdma_start_rxdma(struct altera_tse_private *);
 #endif /*  __ALTERA_MSGDMA_H__ */
diff --git a/drivers/net/ethernet/altera/altera_sgdma.c b/drivers/net/ethernet/altera/altera_sgdma.c
index 0ee96639ae44..9ce8630692b6 100644
--- a/drivers/net/ethernet/altera/altera_sgdma.c
+++ b/drivers/net/ethernet/altera/altera_sgdma.c
@@ -20,15 +20,15 @@
 #include "altera_sgdmahw.h"
 #include "altera_sgdma.h"
-static void sgdma_descrip(struct sgdma_descrip *desc,
+static void sgdma_setup_descrip(struct sgdma_descrip *desc,
-                          struct sgdma_descrip *ndesc,
+                                struct sgdma_descrip *ndesc,
-                          dma_addr_t ndesc_phys,
+                                dma_addr_t ndesc_phys,
-                          dma_addr_t raddr,
+                                dma_addr_t raddr,
-                          dma_addr_t waddr,
+                                dma_addr_t waddr,
-                          u16 length,
+                                u16 length,
-                          int generate_eop,
+                                int generate_eop,
-                          int rfixed,
+                                int rfixed,
-                          int wfixed);
+                                int wfixed);
 static int sgdma_async_write(struct altera_tse_private *priv,
                              struct sgdma_descrip *desc);
@@ -64,11 +64,15 @@ queue_rx_peekhead(struct altera_tse_private *priv);
 int sgdma_initialize(struct altera_tse_private *priv)
 {
-        priv->txctrlreg = SGDMA_CTRLREG_ILASTD;
+        priv->txctrlreg = SGDMA_CTRLREG_ILASTD |
+                      SGDMA_CTRLREG_INTEN;
        priv->rxctrlreg = SGDMA_CTRLREG_IDESCRIP |
+                      SGDMA_CTRLREG_INTEN |
                      SGDMA_CTRLREG_ILASTD;
+        priv->sgdmadesclen = sizeof(struct sgdma_descrip);
        INIT_LIST_HEAD(&priv->txlisthd);
        INIT_LIST_HEAD(&priv->rxlisthd);
@@ -93,6 +97,16 @@ int sgdma_initialize(struct altera_tse_private *priv)
                return -EINVAL;
        }
+        /* Initialize descriptor memory to all 0's, sync memory to cache */
+        memset(priv->tx_dma_desc, 0, priv->txdescmem);
+        memset(priv->rx_dma_desc, 0, priv->rxdescmem);
+        dma_sync_single_for_device(priv->device, priv->txdescphys,
+                                   priv->txdescmem, DMA_TO_DEVICE);
+        dma_sync_single_for_device(priv->device, priv->rxdescphys,
+                                   priv->rxdescmem, DMA_TO_DEVICE);
        return 0;
 }
@@ -130,26 +144,23 @@ void sgdma_reset(struct altera_tse_private *priv)
        iowrite32(0, &prxsgdma->control);
 }
+/* For SGDMA, interrupts remain enabled after initially enabling,
+ * so no need to provide implementations for abstract enable
+ * and disable
+ */
 void sgdma_enable_rxirq(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->rx_dma_csr;
-        priv->rxctrlreg |= SGDMA_CTRLREG_INTEN;
-        tse_set_bit(&csr->control, SGDMA_CTRLREG_INTEN);
 }
 void sgdma_enable_txirq(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->tx_dma_csr;
-        priv->txctrlreg |= SGDMA_CTRLREG_INTEN;
-        tse_set_bit(&csr->control, SGDMA_CTRLREG_INTEN);
 }
-/* for SGDMA, RX interrupts remain enabled after enabling */
 void sgdma_disable_rxirq(struct altera_tse_private *priv)
 {
 }
-/* for SGDMA, TX interrupts remain enabled after enabling */
 void sgdma_disable_txirq(struct altera_tse_private *priv)
 {
 }
@@ -184,15 +195,15 @@ int sgdma_tx_buffer(struct altera_tse_private *priv, struct tse_buffer *buffer)
        if (sgdma_txbusy(priv))
                return 0;
-        sgdma_descrip(cdesc,                    /* current descriptor */
+        sgdma_setup_descrip(cdesc,                      /* current descriptor */
-                      ndesc,                    /* next descriptor */
+                            ndesc,                      /* next descriptor */
-                      sgdma_txphysaddr(priv, ndesc),
+                            sgdma_txphysaddr(priv, ndesc),
-                      buffer->dma_addr,         /* address of packet to xmit */
+                            buffer->dma_addr,           /* address of packet to xmit */
-                      0,                        /* write addr 0 for tx dma */
+                            0,                          /* write addr 0 for tx dma */
-                      buffer->len,              /* length of packet */
+                            buffer->len,                /* length of packet */
-                      SGDMA_CONTROL_EOP,        /* Generate EOP */
+                            SGDMA_CONTROL_EOP,          /* Generate EOP */
-                      0,                        /* read fixed */
+                            0,                          /* read fixed */
-                      SGDMA_CONTROL_WR_FIXED);  /* Generate SOP */
+                            SGDMA_CONTROL_WR_FIXED);    /* Generate SOP */
        pktstx = sgdma_async_write(priv, cdesc);
@@ -219,11 +230,15 @@ u32 sgdma_tx_completions(struct altera_tse_private *priv)
        return ready;
 }
-int sgdma_add_rx_desc(struct altera_tse_private *priv,
+void sgdma_start_rxdma(struct altera_tse_private *priv)
-                      struct tse_buffer *rxbuffer)
+{
+        sgdma_async_read(priv);
+}
+void sgdma_add_rx_desc(struct altera_tse_private *priv,
+                       struct tse_buffer *rxbuffer)
 {
        queue_rx(priv, rxbuffer);
-        return sgdma_async_read(priv);
 }
 /* status is returned on upper 16 bits,
@@ -240,28 +255,52 @@ u32 sgdma_rx_status(struct altera_tse_private *priv)
        unsigned int pktstatus = 0;
        struct tse_buffer *rxbuffer = NULL;
-        dma_sync_single_for_cpu(priv->device,
+        u32 sts = ioread32(&csr->status);
-                                priv->rxdescphys,
-                                priv->rxdescmem,
-                                DMA_BIDIRECTIONAL);
        desc = &base[0];
-        if ((ioread32(&csr->status) & SGDMA_STSREG_EOP) ||
+        if (sts & SGDMA_STSREG_EOP) {
-            (desc->status & SGDMA_STATUS_EOP)) {
+                dma_sync_single_for_cpu(priv->device,
+                                        priv->rxdescphys,
+                                        priv->sgdmadesclen,
+                                        DMA_FROM_DEVICE);
                pktlength = desc->bytes_xferred;
                pktstatus = desc->status & 0x3f;
                rxstatus = pktstatus;
                rxstatus = rxstatus << 16;
                rxstatus |= (pktlength & 0xffff);
-                desc->status = 0;
+                if (rxstatus) {
+                        desc->status = 0;
-                rxbuffer = dequeue_rx(priv);
+                        rxbuffer = dequeue_rx(priv);
-                if (rxbuffer == NULL)
+                        if (rxbuffer == NULL)
-                        netdev_err(priv->dev,
+                                netdev_info(priv->dev,
-                                   "sgdma rx and rx queue empty!\n");
+                                            "sgdma rx and rx queue empty!\n");
+                        /* Clear control */
+                        iowrite32(0, &csr->control);
+                        /* clear status */
+                        iowrite32(0xf, &csr->status);
-                /* kick the rx sgdma after reaping this descriptor */
+                        /* kick the rx sgdma after reaping this descriptor */
+                        pktsrx = sgdma_async_read(priv);
+                } else {
+                        /* If the SGDMA indicated an end of packet on recv,
+                         * then it's expected that the rxstatus from the
+                         * descriptor is non-zero - meaning a valid packet
+                         * with a nonzero length, or an error has been
+                         * indicated. if not, then all we can do is signal
+                         * an error and return no packet received. Most likely
+                         * there is a system design error, or an error in the
+                         * underlying kernel (cache or cache management problem)
+                         */
+                        netdev_err(priv->dev,
+                                   "SGDMA RX Error Info: %x, %x, %x\n",
+                                   sts, desc->status, rxstatus);
+                }
+        } else if (sts == 0) {
                pktsrx = sgdma_async_read(priv);
        }
@@ -270,15 +309,15 @@ u32 sgdma_rx_status(struct altera_tse_private *priv)
 /* Private functions */
-static void sgdma_descrip(struct sgdma_descrip *desc,
+static void sgdma_setup_descrip(struct sgdma_descrip *desc,
-                          struct sgdma_descrip *ndesc,
+                                struct sgdma_descrip *ndesc,
-                          dma_addr_t ndesc_phys,
+                                dma_addr_t ndesc_phys,
-                          dma_addr_t raddr,
+                                dma_addr_t raddr,
-                          dma_addr_t waddr,
+                                dma_addr_t waddr,
-                          u16 length,
+                                u16 length,
-                          int generate_eop,
+                                int generate_eop,
-                          int rfixed,
+                                int rfixed,
-                          int wfixed)
+                                int wfixed)
 {
        /* Clear the next descriptor as not owned by hardware */
        u32 ctrl = ndesc->control;
@@ -319,35 +358,29 @@ static int sgdma_async_read(struct altera_tse_private *priv)
        struct sgdma_descrip *cdesc = &descbase[0];
        struct sgdma_descrip *ndesc = &descbase[1];
-        unsigned int sts = ioread32(&csr->status);
        struct tse_buffer *rxbuffer = NULL;
        if (!sgdma_rxbusy(priv)) {
                rxbuffer = queue_rx_peekhead(priv);
-                if (rxbuffer == NULL)
+                if (rxbuffer == NULL) {
+                        netdev_err(priv->dev, "no rx buffers available\n");
                        return 0;
+                }
-                sgdma_descrip(cdesc,            /* current descriptor */
-                              ndesc,            /* next descriptor */
+                sgdma_setup_descrip(cdesc,              /* current descriptor */
-                              sgdma_rxphysaddr(priv, ndesc),
+                                    ndesc,              /* next descriptor */
-                              0,                /* read addr 0 for rx dma */
+                                    sgdma_rxphysaddr(priv, ndesc),
-                              rxbuffer->dma_addr, /* write addr for rx dma */
+                                    0,                  /* read addr 0 for rx dma */
-                              0,                /* read 'til EOP */
+                                    rxbuffer->dma_addr, /* write addr for rx dma */
-                              0,                /* EOP: NA for rx dma */
+                                    0,                  /* read 'til EOP */
-                              0,                /* read fixed: NA for rx dma */
+                                    0,                  /* EOP: NA for rx dma */
-                              0);               /* SOP: NA for rx DMA */
+                                    0,                  /* read fixed: NA for rx dma */
+                                    0);                 /* SOP: NA for rx DMA */
-                /* clear control and status */
-                iowrite32(0, &csr->control);
-                /* If status available, clear those bits */
-                if (sts & 0xf)
-                        iowrite32(0xf, &csr->status);
                dma_sync_single_for_device(priv->device,
                                           priv->rxdescphys,
-                                           priv->rxdescmem,
+                                           priv->sgdmadesclen,
-                                           DMA_BIDIRECTIONAL);
+                                           DMA_TO_DEVICE);
                iowrite32(lower_32_bits(sgdma_rxphysaddr(priv, cdesc)),
                          &csr->next_descrip);
@@ -374,7 +407,7 @@ static int sgdma_async_write(struct altera_tse_private *priv,
        iowrite32(0x1f, &csr->status);
        dma_sync_single_for_device(priv->device, priv->txdescphys,
-                                   priv->txdescmem, DMA_TO_DEVICE);
+                                   priv->sgdmadesclen, DMA_TO_DEVICE);
        iowrite32(lower_32_bits(sgdma_txphysaddr(priv, desc)),
                  &csr->next_descrip);
diff --git a/drivers/net/ethernet/altera/altera_sgdma.h b/drivers/net/ethernet/altera/altera_sgdma.h
index 07d471729dc4..584977e29ef9 100644
--- a/drivers/net/ethernet/altera/altera_sgdma.h
+++ b/drivers/net/ethernet/altera/altera_sgdma.h
@@ -26,10 +26,11 @@ void sgdma_clear_rxirq(struct altera_tse_private *);
 void sgdma_clear_txirq(struct altera_tse_private *);
 int sgdma_tx_buffer(struct altera_tse_private *priv, struct tse_buffer *);
 u32 sgdma_tx_completions(struct altera_tse_private *);
-int sgdma_add_rx_desc(struct altera_tse_private *priv, struct tse_buffer *);
+void sgdma_add_rx_desc(struct altera_tse_private *priv, struct tse_buffer *);
 void sgdma_status(struct altera_tse_private *);
 u32 sgdma_rx_status(struct altera_tse_private *);
 int sgdma_initialize(struct altera_tse_private *);
 void sgdma_uninitialize(struct altera_tse_private *);
+void sgdma_start_rxdma(struct altera_tse_private *);
 #endif /*  __ALTERA_SGDMA_H__ */
diff --git a/drivers/net/ethernet/altera/altera_tse.h b/drivers/net/ethernet/altera/altera_tse.h
index 8feeed05de0e..465c4aabebbd 100644
--- a/drivers/net/ethernet/altera/altera_tse.h
+++ b/drivers/net/ethernet/altera/altera_tse.h
@@ -58,6 +58,8 @@
 /* MAC function configuration default settings */
 #define ALTERA_TSE_TX_IPG_LENGTH        12
+#define ALTERA_TSE_PAUSE_QUANTA         0xffff
 #define GET_BIT_VALUE(v, bit)           (((v) >> (bit)) & 0x1)
 /* MAC Command_Config Register Bit Definitions
@@ -390,10 +392,11 @@ struct altera_dmaops {
        void (*clear_rxirq)(struct altera_tse_private *);
        int (*tx_buffer)(struct altera_tse_private *, struct tse_buffer *);
        u32 (*tx_completions)(struct altera_tse_private *);
-        int (*add_rx_desc)(struct altera_tse_private *, struct tse_buffer *);
+        void (*add_rx_desc)(struct altera_tse_private *, struct tse_buffer *);
        u32 (*get_rx_status)(struct altera_tse_private *);
        int (*init_dma)(struct altera_tse_private *);
        void (*uninit_dma)(struct altera_tse_private *);
+        void (*start_rxdma)(struct altera_tse_private *);
 };
 /* This structure is private to each device.
@@ -453,6 +456,7 @@ struct altera_tse_private {
        u32 rxctrlreg;
        dma_addr_t rxdescphys;
        dma_addr_t txdescphys;
+        size_t sgdmadesclen;
        struct list_head txlisthd;
        struct list_head rxlisthd;
diff --git a/drivers/net/ethernet/altera/altera_tse_ethtool.c b/drivers/net/ethernet/altera/altera_tse_ethtool.c
index 319ca74f5e74..76133caffa78 100644
--- a/drivers/net/ethernet/altera/altera_tse_ethtool.c
+++ b/drivers/net/ethernet/altera/altera_tse_ethtool.c
@@ -77,7 +77,7 @@ static void tse_get_drvinfo(struct net_device *dev,
        struct altera_tse_private *priv = netdev_priv(dev);
        u32 rev = ioread32(&priv->mac_dev->megacore_revision);
-        strcpy(info->driver, "Altera TSE MAC IP Driver");
+        strcpy(info->driver, "altera_tse");
        strcpy(info->version, "v8.0");
        snprintf(info->fw_version, ETHTOOL_FWVERS_LEN, "v%d.%d",
                 rev & 0xFFFF, (rev & 0xFFFF0000) >> 16);
@@ -185,6 +185,12 @@ static void tse_get_regs(struct net_device *dev, struct ethtool_regs *regs,
         * how to do any special formatting of this data.
         * This version number will need to change if and
         * when this register table is changed.
+         *
+         * version[31:0] = 1: Dump the first 128 TSE Registers
+         *      Upper bits are all 0 by default
+         *
+         * Upper 16-bits will indicate feature presence for
+         * Ethtool register decoding in future version.
         */
        regs->version = 1;
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index c70a29e0b9f7..e44a4aeb9701 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -224,6 +224,7 @@ static int tse_init_rx_buffer(struct altera_tse_private *priv,
                dev_kfree_skb_any(rxbuffer->skb);
                return -EINVAL;
        }
+        rxbuffer->dma_addr &= (dma_addr_t)~3;
        rxbuffer->len = len;
        return 0;
 }
@@ -425,9 +426,10 @@ static int tse_rx(struct altera_tse_private *priv, int limit)
                priv->dev->stats.rx_bytes += pktlength;
                entry = next_entry;
+                tse_rx_refill(priv);
        }
-        tse_rx_refill(priv);
        return count;
 }
@@ -520,7 +522,6 @@ static irqreturn_t altera_isr(int irq, void *dev_id)
        struct altera_tse_private *priv;
        unsigned long int flags;
        if (unlikely(!dev)) {
                pr_err("%s: invalid dev pointer\n", __func__);
                return IRQ_NONE;
@@ -868,13 +869,13 @@ static int init_mac(struct altera_tse_private *priv)
        /* Disable RX/TX shift 16 for alignment of all received frames on 16-bit
         * start address
         */
-        tse_clear_bit(&mac->rx_cmd_stat, ALTERA_TSE_RX_CMD_STAT_RX_SHIFT16);
+        tse_set_bit(&mac->rx_cmd_stat, ALTERA_TSE_RX_CMD_STAT_RX_SHIFT16);
        tse_clear_bit(&mac->tx_cmd_stat, ALTERA_TSE_TX_CMD_STAT_TX_SHIFT16 |
                                         ALTERA_TSE_TX_CMD_STAT_OMIT_CRC);
        /* Set the MAC options */
        cmd = ioread32(&mac->command_config);
-        cmd |= MAC_CMDCFG_PAD_EN;       /* Padding Removal on Receive */
+        cmd &= ~MAC_CMDCFG_PAD_EN;      /* No padding Removal on Receive */
        cmd &= ~MAC_CMDCFG_CRC_FWD;     /* CRC Removal */
        cmd |= MAC_CMDCFG_RX_ERR_DISC;  /* Automatically discard frames
                                         * with CRC errors
@@ -882,8 +883,16 @@ static int init_mac(struct altera_tse_private *priv)
        cmd |= MAC_CMDCFG_CNTL_FRM_ENA;
        cmd &= ~MAC_CMDCFG_TX_ENA;
        cmd &= ~MAC_CMDCFG_RX_ENA;
+        /* Default speed and duplex setting, full/100 */
+        cmd &= ~MAC_CMDCFG_HD_ENA;
+        cmd &= ~MAC_CMDCFG_ETH_SPEED;
+        cmd &= ~MAC_CMDCFG_ENA_10;
        iowrite32(cmd, &mac->command_config);
+        iowrite32(ALTERA_TSE_PAUSE_QUANTA, &mac->pause_quanta);
        if (netif_msg_hw(priv))
                dev_dbg(priv->device,
                        "MAC post-initialization: CMD_CONFIG = 0x%08x\n", cmd);
@@ -1085,17 +1094,19 @@ static int tse_open(struct net_device *dev)
        spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
-        /* Start MAC Rx/Tx */
-        spin_lock(&priv->mac_cfg_lock);
-        tse_set_mac(priv, true);
-        spin_unlock(&priv->mac_cfg_lock);
        if (priv->phydev)
                phy_start(priv->phydev);
        napi_enable(&priv->napi);
        netif_start_queue(dev);
+        priv->dmaops->start_rxdma(priv);
+        /* Start MAC Rx/Tx */
+        spin_lock(&priv->mac_cfg_lock);
+        tse_set_mac(priv, true);
+        spin_unlock(&priv->mac_cfg_lock);
        return 0;
 tx_request_irq_error:
@@ -1167,7 +1178,6 @@ static struct net_device_ops altera_tse_netdev_ops = {
        .ndo_validate_addr      = eth_validate_addr,
 };
 static int request_and_map(struct platform_device *pdev, const char *name,
                           struct resource **res, void __iomem **ptr)
 {
@@ -1235,7 +1245,7 @@ static int altera_tse_probe(struct platform_device *pdev)
                /* Get the mapped address to the SGDMA descriptor memory */
                ret = request_and_map(pdev, "s1", &dma_res, &descmap);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                /* Start of that memory is for transmit descriptors */
                priv->tx_dma_desc = descmap;
@@ -1254,24 +1264,24 @@ static int altera_tse_probe(struct platform_device *pdev)
                if (upper_32_bits(priv->rxdescmem_busaddr)) {
                        dev_dbg(priv->device,
                                "SGDMA bus addresses greater than 32-bits\n");
-                        goto out_free;
+                        goto err_free_netdev;
                }
                if (upper_32_bits(priv->txdescmem_busaddr)) {
                        dev_dbg(priv->device,
                                "SGDMA bus addresses greater than 32-bits\n");
-                        goto out_free;
+                        goto err_free_netdev;
                }
        } else if (priv->dmaops &&
                   priv->dmaops->altera_dtype == ALTERA_DTYPE_MSGDMA) {
                ret = request_and_map(pdev, "rx_resp", &dma_res,
                                      &priv->rx_dma_resp);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                ret = request_and_map(pdev, "tx_desc", &dma_res,
                                      &priv->tx_dma_desc);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                priv->txdescmem = resource_size(dma_res);
                priv->txdescmem_busaddr = dma_res->start;
@@ -1279,13 +1289,13 @@ static int altera_tse_probe(struct platform_device *pdev)
                ret = request_and_map(pdev, "rx_desc", &dma_res,
                                      &priv->rx_dma_desc);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                priv->rxdescmem = resource_size(dma_res);
                priv->rxdescmem_busaddr = dma_res->start;
        } else {
-                goto out_free;
+                goto err_free_netdev;
        }
        if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask)))
@@ -1294,26 +1304,26 @@ static int altera_tse_probe(struct platform_device *pdev)
        else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32)))
                dma_set_coherent_mask(priv->device, DMA_BIT_MASK(32));
        else
-                goto out_free;
+                goto err_free_netdev;
        /* MAC address space */
        ret = request_and_map(pdev, "control_port", &control_port,
                              (void __iomem **)&priv->mac_dev);
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* xSGDMA Rx Dispatcher address space */
        ret = request_and_map(pdev, "rx_csr", &dma_res,
                              &priv->rx_dma_csr);
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* xSGDMA Tx Dispatcher address space */
        ret = request_and_map(pdev, "tx_csr", &dma_res,
                              &priv->tx_dma_csr);
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* Rx IRQ */
@@ -1321,7 +1331,7 @@ static int altera_tse_probe(struct platform_device *pdev)
        if (priv->rx_irq == -ENXIO) {
                dev_err(&pdev->dev, "cannot obtain Rx IRQ\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        /* Tx IRQ */
@@ -1329,7 +1339,7 @@ static int altera_tse_probe(struct platform_device *pdev)
        if (priv->tx_irq == -ENXIO) {
                dev_err(&pdev->dev, "cannot obtain Tx IRQ\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        /* get FIFO depths from device tree */
@@ -1337,14 +1347,14 @@ static int altera_tse_probe(struct platform_device *pdev)
                                 &priv->rx_fifo_depth)) {
                dev_err(&pdev->dev, "cannot obtain rx-fifo-depth\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        if (of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth",
                                 &priv->rx_fifo_depth)) {
                dev_err(&pdev->dev, "cannot obtain tx-fifo-depth\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        /* get hash filter settings for this instance */
@@ -1393,7 +1403,7 @@ static int altera_tse_probe(struct platform_device *pdev)
              ((priv->phy_addr >= 0) && (priv->phy_addr < PHY_MAX_ADDR)))) {
                dev_err(&pdev->dev, "invalid phy-addr specified %d\n",
                        priv->phy_addr);
-                goto out_free;
+                goto err_free_netdev;
        }
        /* Create/attach to MDIO bus */
@@ -1401,7 +1411,7 @@ static int altera_tse_probe(struct platform_device *pdev)
                                     atomic_add_return(1, &instance_count));
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* initialize netdev */
        ether_setup(ndev);
@@ -1438,7 +1448,7 @@ static int altera_tse_probe(struct platform_device *pdev)
        ret = register_netdev(ndev);
        if (ret) {
                dev_err(&pdev->dev, "failed to register TSE net device\n");
-                goto out_free_mdio;
+                goto err_register_netdev;
        }
        platform_set_drvdata(pdev, ndev);
@@ -1455,13 +1465,16 @@ static int altera_tse_probe(struct platform_device *pdev)
        ret = init_phy(ndev);
        if (ret != 0) {
                netdev_err(ndev, "Cannot attach to PHY (error: %d)\n", ret);
-                goto out_free_mdio;
+                goto err_init_phy;
        }
        return 0;
-out_free_mdio:
+err_init_phy:
+        unregister_netdev(ndev);
+err_register_netdev:
+        netif_napi_del(&priv->napi);
        altera_tse_mdio_destroy(ndev);
-out_free:
+err_free_netdev:
        free_netdev(ndev);
        return ret;
 }
@@ -1496,6 +1509,7 @@ struct altera_dmaops altera_dtype_sgdma = {
        .get_rx_status = sgdma_rx_status,
        .init_dma = sgdma_initialize,
        .uninit_dma = sgdma_uninitialize,
+        .start_rxdma = sgdma_start_rxdma,
 };
 struct altera_dmaops altera_dtype_msgdma = {
@@ -1514,6 +1528,7 @@ struct altera_dmaops altera_dtype_msgdma = {
        .get_rx_status = msgdma_rx_status,
        .init_dma = msgdma_initialize,
        .uninit_dma = msgdma_uninitialize,
+        .start_rxdma = msgdma_start_rxdma,
 };
 static struct of_device_id altera_tse_ids[] = {
diff --git a/drivers/net/ethernet/arc/emac.h b/drivers/net/ethernet/arc/emac.h
index 928fac6dd10a..53f85bf71526 100644
--- a/drivers/net/ethernet/arc/emac.h
+++ b/drivers/net/ethernet/arc/emac.h
@@ -11,6 +11,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/netdevice.h>
 #include <linux/phy.h>
+#include <linux/clk.h>
 /* STATUS and ENABLE Register bit masks */
 #define TXINT_MASK      (1<<0)  /* Transmit interrupt */
@@ -131,6 +132,7 @@ struct arc_emac_priv {
        struct mii_bus *bus;
        void __iomem *regs;
+        struct clk *clk;
        struct napi_struct napi;
        struct net_device_stats stats;
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index eeecc29cf5b7..d647a7d115ac 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -574,6 +574,18 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        return NETDEV_TX_OK;
 }
+static void arc_emac_set_address_internal(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        unsigned int addr_low, addr_hi;
+        addr_low = le32_to_cpu(*(__le32 *) &ndev->dev_addr[0]);
+        addr_hi = le16_to_cpu(*(__le16 *) &ndev->dev_addr[4]);
+        arc_reg_set(priv, R_ADDRL, addr_low);
+        arc_reg_set(priv, R_ADDRH, addr_hi);
+}
 /**
 * arc_emac_set_address - Set the MAC address for this device.
 * @ndev:       Pointer to net_device structure.
@@ -587,9 +599,7 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
 */
 static int arc_emac_set_address(struct net_device *ndev, void *p)
 {
-        struct arc_emac_priv *priv = netdev_priv(ndev);
        struct sockaddr *addr = p;
-        unsigned int addr_low, addr_hi;
        if (netif_running(ndev))
                return -EBUSY;
@@ -599,11 +609,7 @@ static int arc_emac_set_address(struct net_device *ndev, void *p)
        memcpy(ndev->dev_addr, addr->sa_data, ndev->addr_len);
-        addr_low = le32_to_cpu(*(__le32 *) &ndev->dev_addr[0]);
+        arc_emac_set_address_internal(ndev);
-        addr_hi = le16_to_cpu(*(__le16 *) &ndev->dev_addr[4]);
-        arc_reg_set(priv, R_ADDRL, addr_low);
-        arc_reg_set(priv, R_ADDRH, addr_hi);
        return 0;
 }
@@ -643,13 +649,6 @@ static int arc_emac_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        /* Get CPU clock frequency from device tree */
-        if (of_property_read_u32(pdev->dev.of_node, "clock-frequency",
-                                 &clock_frequency)) {
-                dev_err(&pdev->dev, "failed to retrieve <clock-frequency> from device tree\n");
-                return -EINVAL;
-        }
        /* Get IRQ from device tree */
        irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
        if (!irq) {
@@ -677,17 +676,36 @@ static int arc_emac_probe(struct platform_device *pdev)
        priv->regs = devm_ioremap_resource(&pdev->dev, &res_regs);
        if (IS_ERR(priv->regs)) {
                err = PTR_ERR(priv->regs);
-                goto out;
+                goto out_netdev;
        }
        dev_dbg(&pdev->dev, "Registers base address is 0x%p\n", priv->regs);
+        priv->clk = of_clk_get(pdev->dev.of_node, 0);
+        if (IS_ERR(priv->clk)) {
+                /* Get CPU clock frequency from device tree */
+                if (of_property_read_u32(pdev->dev.of_node, "clock-frequency",
+                                        &clock_frequency)) {
+                        dev_err(&pdev->dev, "failed to retrieve <clock-frequency> from device tree\n");
+                        err = -EINVAL;
+                        goto out_netdev;
+                }
+        } else {
+                err = clk_prepare_enable(priv->clk);
+                if (err) {
+                        dev_err(&pdev->dev, "failed to enable clock\n");
+                        goto out_clkget;
+                }
+                clock_frequency = clk_get_rate(priv->clk);
+        }
        id = arc_reg_get(priv, R_ID);
        /* Check for EMAC revision 5 or 7, magic number */
        if (!(id == 0x0005fd02 || id == 0x0007fd02)) {
                dev_err(&pdev->dev, "ARC EMAC not detected, id=0x%x\n", id);
                err = -ENODEV;
-                goto out;
+                goto out_clken;
        }
        dev_info(&pdev->dev, "ARC EMAC detected with id: 0x%x\n", id);
@@ -702,7 +720,7 @@ static int arc_emac_probe(struct platform_device *pdev)
                               ndev->name, ndev);
        if (err) {
                dev_err(&pdev->dev, "could not allocate IRQ\n");
-                goto out;
+                goto out_clken;
        }
        /* Get MAC address from device tree */
@@ -713,6 +731,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        else
                eth_hw_addr_random(ndev);
+        arc_emac_set_address_internal(ndev);
        dev_info(&pdev->dev, "MAC address is now %pM\n", ndev->dev_addr);
        /* Do 1 allocation instead of 2 separate ones for Rx and Tx BD rings */
@@ -722,7 +741,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        if (!priv->rxbd) {
                dev_err(&pdev->dev, "failed to allocate data buffers\n");
                err = -ENOMEM;
-                goto out;
+                goto out_clken;
        }
        priv->txbd = priv->rxbd + RX_BD_NUM;
@@ -734,7 +753,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        err = arc_mdio_probe(pdev, priv);
        if (err) {
                dev_err(&pdev->dev, "failed to probe MII bus\n");
-                goto out;
+                goto out_clken;
        }
        priv->phy_dev = of_phy_connect(ndev, phy_node, arc_emac_adjust_link, 0,
@@ -742,7 +761,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        if (!priv->phy_dev) {
                dev_err(&pdev->dev, "of_phy_connect() failed\n");
                err = -ENODEV;
-                goto out;
+                goto out_mdio;
        }
        dev_info(&pdev->dev, "connected to %s phy with id 0x%x\n",
@@ -752,14 +771,25 @@ static int arc_emac_probe(struct platform_device *pdev)
        err = register_netdev(ndev);
        if (err) {
-                netif_napi_del(&priv->napi);
                dev_err(&pdev->dev, "failed to register network device\n");
-                goto out;
+                goto out_netif_api;
        }
        return 0;
-out:
+out_netif_api:
+        netif_napi_del(&priv->napi);
+        phy_disconnect(priv->phy_dev);
+        priv->phy_dev = NULL;
+out_mdio:
+        arc_mdio_remove(priv);
+out_clken:
+        if (!IS_ERR(priv->clk))
+                clk_disable_unprepare(priv->clk);
+out_clkget:
+        if (!IS_ERR(priv->clk))
+                clk_put(priv->clk);
+out_netdev:
        free_netdev(ndev);
        return err;
 }
@@ -774,6 +804,12 @@ static int arc_emac_remove(struct platform_device *pdev)
        arc_mdio_remove(priv);
        unregister_netdev(ndev);
        netif_napi_del(&priv->napi);
+        if (!IS_ERR(priv->clk)) {
+                clk_disable_unprepare(priv->clk);
+                clk_put(priv->clk);
+        }
        free_netdev(ndev);
        return 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index a78edaccceee..b260913db236 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13233,6 +13233,8 @@ static void __bnx2x_remove(struct pci_dev *pdev,
                                iounmap(bp->doorbells);
                        bnx2x_release_firmware(bp);
+                } else {
+                        bnx2x_vf_pci_dealloc(bp);
                }
                bnx2x_free_mem_bp(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 5c523b32db70..81cc2d9831c2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -427,7 +427,9 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp,
        if (filter->add && filter->type == BNX2X_VF_FILTER_VLAN &&
            (atomic_read(&bnx2x_vfq(vf, qid, vlan_count)) >=
             vf_vlan_rules_cnt(vf))) {
-                BNX2X_ERR("No credits for vlan\n");
+                BNX2X_ERR("No credits for vlan [%d >= %d]\n",
+                          atomic_read(&bnx2x_vfq(vf, qid, vlan_count)),
+                          vf_vlan_rules_cnt(vf));
                return -ENOMEM;
        }
@@ -610,6 +612,7 @@ int bnx2x_vf_mcast(struct bnx2x *bp, struct bnx2x_virtf *vf,
                }
                /* add new mcasts */
+                mcast.mcast_list_len = mc_num;
                rc = bnx2x_config_mcast(bp, &mcast, BNX2X_MCAST_CMD_ADD);
                if (rc)
                        BNX2X_ERR("Faled to add multicasts\n");
@@ -837,6 +840,29 @@ int bnx2x_vf_flr_clnup_epilog(struct bnx2x *bp, u8 abs_vfid)
        return 0;
 }
+static void bnx2x_iov_re_set_vlan_filters(struct bnx2x *bp,
+                                          struct bnx2x_virtf *vf,
+                                          int new)
+{
+        int num = vf_vlan_rules_cnt(vf);
+        int diff = new - num;
+        bool rc = true;
+        DP(BNX2X_MSG_IOV, "vf[%d] - %d vlan filter credits [previously %d]\n",
+           vf->abs_vfid, new, num);
+        if (diff > 0)
+                rc = bp->vlans_pool.get(&bp->vlans_pool, diff);
+        else if (diff < 0)
+                rc = bp->vlans_pool.put(&bp->vlans_pool, -diff);
+        if (rc)
+                vf_vlan_rules_cnt(vf) = new;
+        else
+                DP(BNX2X_MSG_IOV, "vf[%d] - Failed to configure vlan filter credits change\n",
+                   vf->abs_vfid);
+}
 /* must be called after the number of PF queues and the number of VFs are
 * both known
 */
@@ -854,9 +880,11 @@ bnx2x_iov_static_resc(struct bnx2x *bp, struct bnx2x_virtf *vf)
        resc->num_mac_filters = 1;
        /* divvy up vlan rules */
+        bnx2x_iov_re_set_vlan_filters(bp, vf, 0);
        vlan_count = bp->vlans_pool.check(&bp->vlans_pool);
        vlan_count = 1 << ilog2(vlan_count);
-        resc->num_vlan_filters = vlan_count / BNX2X_NR_VIRTFN(bp);
+        bnx2x_iov_re_set_vlan_filters(bp, vf,
+                                      vlan_count / BNX2X_NR_VIRTFN(bp));
        /* no real limitation */
        resc->num_mc_filters = 0;
@@ -1478,10 +1506,6 @@ int bnx2x_iov_nic_init(struct bnx2x *bp)
                bnx2x_iov_static_resc(bp, vf);
                /* queues are initialized during VF-ACQUIRE */
-                /* reserve the vf vlan credit */
-                bp->vlans_pool.get(&bp->vlans_pool, vf_vlan_rules_cnt(vf));
                vf->filter_state = 0;
                vf->sp_cl_id = bnx2x_fp(bp, 0, cl_id);
@@ -1912,11 +1936,12 @@ int bnx2x_vf_chk_avail_resc(struct bnx2x *bp, struct bnx2x_virtf *vf,
        u8 rxq_cnt = vf_rxq_count(vf) ? : bnx2x_vf_max_queue_cnt(bp, vf);
        u8 txq_cnt = vf_txq_count(vf) ? : bnx2x_vf_max_queue_cnt(bp, vf);
+        /* Save a vlan filter for the Hypervisor */
        return ((req_resc->num_rxqs <= rxq_cnt) &&
                (req_resc->num_txqs <= txq_cnt) &&
                (req_resc->num_sbs <= vf_sb_count(vf))   &&
                (req_resc->num_mac_filters <= vf_mac_rules_cnt(vf)) &&
-                (req_resc->num_vlan_filters <= vf_vlan_rules_cnt(vf)));
+                (req_resc->num_vlan_filters <= vf_vlan_rules_visible_cnt(vf)));
 }
 /* CORE VF API */
@@ -1972,14 +1997,14 @@ int bnx2x_vf_acquire(struct bnx2x *bp, struct bnx2x_virtf *vf,
        vf_txq_count(vf) = resc->num_txqs ? : bnx2x_vf_max_queue_cnt(bp, vf);
        if (resc->num_mac_filters)
                vf_mac_rules_cnt(vf) = resc->num_mac_filters;
-        if (resc->num_vlan_filters)
+        /* Add an additional vlan filter credit for the hypervisor */
-                vf_vlan_rules_cnt(vf) = resc->num_vlan_filters;
+        bnx2x_iov_re_set_vlan_filters(bp, vf, resc->num_vlan_filters + 1);
        DP(BNX2X_MSG_IOV,
           "Fulfilling vf request: sb count %d, tx_count %d, rx_count %d, mac_rules_count %d, vlan_rules_count %d\n",
           vf_sb_count(vf), vf_rxq_count(vf),
           vf_txq_count(vf), vf_mac_rules_cnt(vf),
-           vf_vlan_rules_cnt(vf));
+           vf_vlan_rules_visible_cnt(vf));
        /* Initialize the queues */
        if (!vf->vfqs) {
@@ -2896,6 +2921,14 @@ void __iomem *bnx2x_vf_doorbells(struct bnx2x *bp)
        return bp->regview + PXP_VF_ADDR_DB_START;
 }
+void bnx2x_vf_pci_dealloc(struct bnx2x *bp)
+{
+        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
+                       sizeof(struct bnx2x_vf_mbx_msg));
+        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
+                       sizeof(union pf_vf_bulletin));
+}
 int bnx2x_vf_pci_alloc(struct bnx2x *bp)
 {
        mutex_init(&bp->vf2pf_mutex);
@@ -2915,10 +2948,7 @@ int bnx2x_vf_pci_alloc(struct bnx2x *bp)
        return 0;
 alloc_mem_err:
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
+        bnx2x_vf_pci_dealloc(bp);
-                       sizeof(struct bnx2x_vf_mbx_msg));
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
-                       sizeof(union pf_vf_bulletin));
        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 8bf764570eef..6929adba52f9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -159,6 +159,8 @@ struct bnx2x_virtf {
 #define vf_mac_rules_cnt(vf)            ((vf)->alloc_resc.num_mac_filters)
 #define vf_vlan_rules_cnt(vf)           ((vf)->alloc_resc.num_vlan_filters)
 #define vf_mc_rules_cnt(vf)             ((vf)->alloc_resc.num_mc_filters)
+        /* Hide a single vlan filter credit for the hypervisor */
+#define vf_vlan_rules_visible_cnt(vf)   (vf_vlan_rules_cnt(vf) - 1)
        u8 sb_count;    /* actual number of SBs */
        u8 igu_base_id; /* base igu status block id */
@@ -502,6 +504,7 @@ static inline int bnx2x_vf_ustorm_prods_offset(struct bnx2x *bp,
 enum sample_bulletin_result bnx2x_sample_bulletin(struct bnx2x *bp);
 void bnx2x_timer_sriov(struct bnx2x *bp);
 void __iomem *bnx2x_vf_doorbells(struct bnx2x *bp);
+void bnx2x_vf_pci_dealloc(struct bnx2x *bp);
 int bnx2x_vf_pci_alloc(struct bnx2x *bp);
 int bnx2x_enable_sriov(struct bnx2x *bp);
 void bnx2x_disable_sriov(struct bnx2x *bp);
@@ -568,6 +571,7 @@ static inline void __iomem *bnx2x_vf_doorbells(struct bnx2x *bp)
        return NULL;
 }
+static inline void bnx2x_vf_pci_dealloc(struct bnx2 *bp) {return 0; }
 static inline int bnx2x_vf_pci_alloc(struct bnx2x *bp) {return 0; }
 static inline void bnx2x_pf_set_vfs_vlan(struct bnx2x *bp) {}
 static inline int bnx2x_sriov_configure(struct pci_dev *dev, int num_vfs) {return 0; }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 0622884596b2..0c067e8564dd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -1163,7 +1163,7 @@ static void bnx2x_vf_mbx_acquire_resp(struct bnx2x *bp, struct bnx2x_virtf *vf,
                        bnx2x_vf_max_queue_cnt(bp, vf);
                resc->num_sbs = vf_sb_count(vf);
                resc->num_mac_filters = vf_mac_rules_cnt(vf);
-                resc->num_vlan_filters = vf_vlan_rules_cnt(vf);
+                resc->num_vlan_filters = vf_vlan_rules_visible_cnt(vf);
                resc->num_mc_filters = 0;
                if (status == PFVF_STATUS_SUCCESS) {
diff --git a/drivers/net/ethernet/cadence/Kconfig b/drivers/net/ethernet/cadence/Kconfig
index 7e49c43b7af3..9e089d24466e 100644
--- a/drivers/net/ethernet/cadence/Kconfig
+++ b/drivers/net/ethernet/cadence/Kconfig
@@ -4,7 +4,7 @@
 config NET_CADENCE
        bool "Cadence devices"
-        depends on HAS_IOMEM && (ARM || AVR32 || COMPILE_TEST)
+        depends on HAS_IOMEM && (ARM || AVR32 || MICROBLAZE || COMPILE_TEST)
        default y
        ---help---
          If you have a network (Ethernet) card belonging to this class, say Y.
@@ -30,7 +30,7 @@ config ARM_AT91_ETHER
 config MACB
        tristate "Cadence MACB/GEM support"
-        depends on HAS_DMA && (PLATFORM_AT32AP || ARCH_AT91 || ARCH_PICOXCELL || ARCH_ZYNQ || COMPILE_TEST)
+        depends on HAS_DMA && (PLATFORM_AT32AP || ARCH_AT91 || ARCH_PICOXCELL || ARCH_ZYNQ || MICROBLAZE || COMPILE_TEST)
        select PHYLIB
        ---help---
          The Cadence MACB ethernet interface is found on many Atmel AT32 and
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index ca97005e24b4..e9daa072ebb4 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -599,25 +599,16 @@ static void gem_rx_refill(struct macb *bp)
 {
        unsigned int            entry;
        struct sk_buff          *skb;
-        struct macb_dma_desc    *desc;
        dma_addr_t              paddr;
        while (CIRC_SPACE(bp->rx_prepared_head, bp->rx_tail, RX_RING_SIZE) > 0) {
-                u32 addr, ctrl;
                entry = macb_rx_ring_wrap(bp->rx_prepared_head);
-                desc = &bp->rx_ring[entry];
                /* Make hw descriptor updates visible to CPU */
                rmb();
-                addr = desc->addr;
-                ctrl = desc->ctrl;
                bp->rx_prepared_head++;
-                if ((addr & MACB_BIT(RX_USED)))
-                        continue;
                if (bp->rx_skbuff[entry] == NULL) {
                        /* allocate sk_buff for this free entry in ring */
                        skb = netdev_alloc_skb(bp->dev, bp->rx_buffer_size);
@@ -698,7 +689,6 @@ static int gem_rx(struct macb *bp, int budget)
                if (!(addr & MACB_BIT(RX_USED)))
                        break;
-                desc->addr &= ~MACB_BIT(RX_USED);
                bp->rx_tail++;
                count++;
@@ -891,16 +881,15 @@ static int macb_poll(struct napi_struct *napi, int budget)
        if (work_done < budget) {
                napi_complete(napi);
-                /*
-                 * We've done what we can to clean the buffers. Make sure we
-                 * get notified when new packets arrive.
-                 */
-                macb_writel(bp, IER, MACB_RX_INT_FLAGS);
                /* Packets received while interrupts were disabled */
                status = macb_readl(bp, RSR);
-                if (unlikely(status))
+                if (status) {
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_BIT(RCOMP));
                        napi_reschedule(napi);
+                } else {
+                        macb_writel(bp, IER, MACB_RX_INT_FLAGS);
+                }
        }
        /* TODO: Handle errors */
@@ -951,6 +940,10 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                if (unlikely(status & (MACB_TX_ERR_FLAGS))) {
                        macb_writel(bp, IDR, MACB_TX_INT_FLAGS);
                        schedule_work(&bp->tx_error_task);
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_TX_ERR_FLAGS);
                        break;
                }
@@ -968,6 +961,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                                bp->hw_stats.gem.rx_overruns++;
                        else
                                bp->hw_stats.macb.rx_overruns++;
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_BIT(ISR_ROVR));
                }
                if (status & MACB_BIT(HRESP)) {
@@ -977,6 +973,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                         * (work queue?)
                         */
                        netdev_err(dev, "DMA bus error: HRESP not OK\n");
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_BIT(HRESP));
                }
                status = macb_readl(bp, ISR);
@@ -1113,7 +1112,7 @@ static void gem_free_rx_buffers(struct macb *bp)
                desc = &bp->rx_ring[i];
                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
-                dma_unmap_single(&bp->pdev->dev, addr, skb->len,
+                dma_unmap_single(&bp->pdev->dev, addr, bp->rx_buffer_size,
                                 DMA_FROM_DEVICE);
                dev_kfree_skb_any(skb);
                skb = NULL;
diff --git a/drivers/net/ethernet/chelsio/Kconfig b/drivers/net/ethernet/chelsio/Kconfig
index d40c994a4f6a..570222c33410 100644
--- a/drivers/net/ethernet/chelsio/Kconfig
+++ b/drivers/net/ethernet/chelsio/Kconfig
@@ -67,13 +67,13 @@ config CHELSIO_T3
          will be called cxgb3.
 config CHELSIO_T4
-        tristate "Chelsio Communications T4 Ethernet support"
+        tristate "Chelsio Communications T4/T5 Ethernet support"
        depends on PCI
        select FW_LOADER
        select MDIO
        ---help---
-          This driver supports Chelsio T4-based gigabit and 10Gb Ethernet
+          This driver supports Chelsio T4 and T5 based gigabit, 10Gb Ethernet
-          adapters.
+          adapter and T5 based 40Gb Ethernet adapter.
          For general information about Chelsio and our products, visit
          our website at <http://www.chelsio.com>.
@@ -87,11 +87,12 @@ config CHELSIO_T4
          will be called cxgb4.
 config CHELSIO_T4VF
-        tristate "Chelsio Communications T4 Virtual Function Ethernet support"
+        tristate "Chelsio Communications T4/T5 Virtual Function Ethernet support"
        depends on PCI
        ---help---
-          This driver supports Chelsio T4-based gigabit and 10Gb Ethernet
+          This driver supports Chelsio T4 and T5 based gigabit, 10Gb Ethernet
-          adapters with PCI-E SR-IOV Virtual Functions.
+          adapters and T5 based 40Gb Ethernet adapters with PCI-E SR-IOV Virtual
+          Functions.
          For general information about Chelsio and our products, visit
          our website at <http://www.chelsio.com>.
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 6fe58913403a..24e16e3301e0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5870,6 +5870,8 @@ static void print_port_info(const struct net_device *dev)
                spd = " 2.5 GT/s";
        else if (adap->params.pci.speed == PCI_EXP_LNKSTA_CLS_5_0GB)
                spd = " 5 GT/s";
+        else if (adap->params.pci.speed == PCI_EXP_LNKSTA_CLS_8_0GB)
+                spd = " 8 GT/s";
        if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_100M)
                bufp += sprintf(bufp, "100/");
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 9125d9abf099..e2d42475b006 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -121,6 +121,7 @@ static irqreturn_t gfar_error(int irq, void *dev_id);
 static irqreturn_t gfar_transmit(int irq, void *dev_id);
 static irqreturn_t gfar_interrupt(int irq, void *dev_id);
 static void adjust_link(struct net_device *dev);
+static noinline void gfar_update_link_state(struct gfar_private *priv);
 static int init_phy(struct net_device *dev);
 static int gfar_probe(struct platform_device *ofdev);
 static int gfar_remove(struct platform_device *ofdev);
@@ -3076,41 +3077,6 @@ static irqreturn_t gfar_interrupt(int irq, void *grp_id)
        return IRQ_HANDLED;
 }
-static u32 gfar_get_flowctrl_cfg(struct gfar_private *priv)
-{
-        struct phy_device *phydev = priv->phydev;
-        u32 val = 0;
-        if (!phydev->duplex)
-                return val;
-        if (!priv->pause_aneg_en) {
-                if (priv->tx_pause_en)
-                        val |= MACCFG1_TX_FLOW;
-                if (priv->rx_pause_en)
-                        val |= MACCFG1_RX_FLOW;
-        } else {
-                u16 lcl_adv, rmt_adv;
-                u8 flowctrl;
-                /* get link partner capabilities */
-                rmt_adv = 0;
-                if (phydev->pause)
-                        rmt_adv = LPA_PAUSE_CAP;
-                if (phydev->asym_pause)
-                        rmt_adv |= LPA_PAUSE_ASYM;
-                lcl_adv = mii_advertise_flowctrl(phydev->advertising);
-                flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
-                if (flowctrl & FLOW_CTRL_TX)
-                        val |= MACCFG1_TX_FLOW;
-                if (flowctrl & FLOW_CTRL_RX)
-                        val |= MACCFG1_RX_FLOW;
-        }
-        return val;
-}
 /* Called every time the controller might need to be made
 * aware of new link state.  The PHY code conveys this
 * information through variables in the phydev structure, and this
@@ -3120,83 +3086,12 @@ static u32 gfar_get_flowctrl_cfg(struct gfar_private *priv)
 static void adjust_link(struct net_device *dev)
 {
        struct gfar_private *priv = netdev_priv(dev);
-        struct gfar __iomem *regs = priv->gfargrp[0].regs;
        struct phy_device *phydev = priv->phydev;
-        int new_state = 0;
-        if (test_bit(GFAR_RESETTING, &priv->state))
+        if (unlikely(phydev->link != priv->oldlink ||
-                return;
+                     phydev->duplex != priv->oldduplex ||
+                     phydev->speed != priv->oldspeed))
-        if (phydev->link) {
+                gfar_update_link_state(priv);
-                u32 tempval1 = gfar_read(&regs->maccfg1);
-                u32 tempval = gfar_read(&regs->maccfg2);
-                u32 ecntrl = gfar_read(&regs->ecntrl);
-                /* Now we make sure that we can be in full duplex mode.
-                 * If not, we operate in half-duplex mode.
-                 */
-                if (phydev->duplex != priv->oldduplex) {
-                        new_state = 1;
-                        if (!(phydev->duplex))
-                                tempval &= ~(MACCFG2_FULL_DUPLEX);
-                        else
-                                tempval |= MACCFG2_FULL_DUPLEX;
-                        priv->oldduplex = phydev->duplex;
-                }
-                if (phydev->speed != priv->oldspeed) {
-                        new_state = 1;
-                        switch (phydev->speed) {
-                        case 1000:
-                                tempval =
-                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_GMII);
-                                ecntrl &= ~(ECNTRL_R100);
-                                break;
-                        case 100:
-                        case 10:
-                                tempval =
-                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_MII);
-                                /* Reduced mode distinguishes
-                                 * between 10 and 100
-                                 */
-                                if (phydev->speed == SPEED_100)
-                                        ecntrl |= ECNTRL_R100;
-                                else
-                                        ecntrl &= ~(ECNTRL_R100);
-                                break;
-                        default:
-                                netif_warn(priv, link, dev,
-                                           "Ack!  Speed (%d) is not 10/100/1000!\n",
-                                           phydev->speed);
-                                break;
-                        }
-                        priv->oldspeed = phydev->speed;
-                }
-                tempval1 &= ~(MACCFG1_TX_FLOW | MACCFG1_RX_FLOW);
-                tempval1 |= gfar_get_flowctrl_cfg(priv);
-                gfar_write(&regs->maccfg1, tempval1);
-                gfar_write(&regs->maccfg2, tempval);
-                gfar_write(&regs->ecntrl, ecntrl);
-                if (!priv->oldlink) {
-                        new_state = 1;
-                        priv->oldlink = 1;
-                }
-        } else if (priv->oldlink) {
-                new_state = 1;
-                priv->oldlink = 0;
-                priv->oldspeed = 0;
-                priv->oldduplex = -1;
-        }
-        if (new_state && netif_msg_link(priv))
-                phy_print_status(phydev);
 }
 /* Update the hash table based on the current list of multicast
@@ -3442,6 +3337,114 @@ static irqreturn_t gfar_error(int irq, void *grp_id)
        return IRQ_HANDLED;
 }
+static u32 gfar_get_flowctrl_cfg(struct gfar_private *priv)
+{
+        struct phy_device *phydev = priv->phydev;
+        u32 val = 0;
+        if (!phydev->duplex)
+                return val;
+        if (!priv->pause_aneg_en) {
+                if (priv->tx_pause_en)
+                        val |= MACCFG1_TX_FLOW;
+                if (priv->rx_pause_en)
+                        val |= MACCFG1_RX_FLOW;
+        } else {
+                u16 lcl_adv, rmt_adv;
+                u8 flowctrl;
+                /* get link partner capabilities */
+                rmt_adv = 0;
+                if (phydev->pause)
+                        rmt_adv = LPA_PAUSE_CAP;
+                if (phydev->asym_pause)
+                        rmt_adv |= LPA_PAUSE_ASYM;
+                lcl_adv = mii_advertise_flowctrl(phydev->advertising);
+                flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
+                if (flowctrl & FLOW_CTRL_TX)
+                        val |= MACCFG1_TX_FLOW;
+                if (flowctrl & FLOW_CTRL_RX)
+                        val |= MACCFG1_RX_FLOW;
+        }
+        return val;
+}
+static noinline void gfar_update_link_state(struct gfar_private *priv)
+{
+        struct gfar __iomem *regs = priv->gfargrp[0].regs;
+        struct phy_device *phydev = priv->phydev;
+        if (unlikely(test_bit(GFAR_RESETTING, &priv->state)))
+                return;
+        if (phydev->link) {
+                u32 tempval1 = gfar_read(&regs->maccfg1);
+                u32 tempval = gfar_read(&regs->maccfg2);
+                u32 ecntrl = gfar_read(&regs->ecntrl);
+                if (phydev->duplex != priv->oldduplex) {
+                        if (!(phydev->duplex))
+                                tempval &= ~(MACCFG2_FULL_DUPLEX);
+                        else
+                                tempval |= MACCFG2_FULL_DUPLEX;
+                        priv->oldduplex = phydev->duplex;
+                }
+                if (phydev->speed != priv->oldspeed) {
+                        switch (phydev->speed) {
+                        case 1000:
+                                tempval =
+                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_GMII);
+                                ecntrl &= ~(ECNTRL_R100);
+                                break;
+                        case 100:
+                        case 10:
+                                tempval =
+                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_MII);
+                                /* Reduced mode distinguishes
+                                 * between 10 and 100
+                                 */
+                                if (phydev->speed == SPEED_100)
+                                        ecntrl |= ECNTRL_R100;
+                                else
+                                        ecntrl &= ~(ECNTRL_R100);
+                                break;
+                        default:
+                                netif_warn(priv, link, priv->ndev,
+                                           "Ack!  Speed (%d) is not 10/100/1000!\n",
+                                           phydev->speed);
+                                break;
+                        }
+                        priv->oldspeed = phydev->speed;
+                }
+                tempval1 &= ~(MACCFG1_TX_FLOW | MACCFG1_RX_FLOW);
+                tempval1 |= gfar_get_flowctrl_cfg(priv);
+                gfar_write(&regs->maccfg1, tempval1);
+                gfar_write(&regs->maccfg2, tempval);
+                gfar_write(&regs->ecntrl, ecntrl);
+                if (!priv->oldlink)
+                        priv->oldlink = 1;
+        } else if (priv->oldlink) {
+                priv->oldlink = 0;
+                priv->oldspeed = 0;
+                priv->oldduplex = -1;
+        }
+        if (netif_msg_link(priv))
+                phy_print_status(phydev);
+}
 static struct of_device_id gfar_match[] =
 {
        {
diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
index 891dbee6e6c1..76d70708f864 100644
--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -533,6 +533,9 @@ static int gfar_spauseparam(struct net_device *dev,
        struct gfar __iomem *regs = priv->gfargrp[0].regs;
        u32 oldadv, newadv;
+        if (!phydev)
+                return -ENODEV;
        if (!(phydev->supported & SUPPORTED_Pause) ||
            (!(phydev->supported & SUPPORTED_Asym_Pause) &&
             (epause->rx_pause != epause->tx_pause)))
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 9866f264f55e..f0bbd4246d71 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -186,7 +186,7 @@ static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
 {
        u16 phy_reg = 0;
        u32 phy_id = 0;
-        s32 ret_val;
+        s32 ret_val = 0;
        u16 retry_count;
        u32 mac_reg = 0;
@@ -217,11 +217,13 @@ static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
        /* In case the PHY needs to be in mdio slow mode,
         * set slow mode and try to get the PHY id again.
         */
-        hw->phy.ops.release(hw);
+        if (hw->mac.type < e1000_pch_lpt) {
-        ret_val = e1000_set_mdio_slow_mode_hv(hw);
+                hw->phy.ops.release(hw);
-        if (!ret_val)
+                ret_val = e1000_set_mdio_slow_mode_hv(hw);
-                ret_val = e1000e_get_phy_id(hw);
+                if (!ret_val)
-        hw->phy.ops.acquire(hw);
+                        ret_val = e1000e_get_phy_id(hw);
+                hw->phy.ops.acquire(hw);
+        }
        if (ret_val)
                return false;
@@ -842,6 +844,17 @@ s32 e1000_set_eee_pchlan(struct e1000_hw *hw)
                }
        }
+        if (hw->phy.type == e1000_phy_82579) {
+                ret_val = e1000_read_emi_reg_locked(hw, I82579_LPI_PLL_SHUT,
+                                                    &data);
+                if (ret_val)
+                        goto release;
+                data &= ~I82579_LPI_100_PLL_SHUT;
+                ret_val = e1000_write_emi_reg_locked(hw, I82579_LPI_PLL_SHUT,
+                                                     data);
+        }
        /* R/Clr IEEE MMD 3.1 bits 11:10 - Tx/Rx LPI Received */
        ret_val = e1000_read_emi_reg_locked(hw, pcs_status, &data);
        if (ret_val)
@@ -1314,14 +1327,17 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                        return ret_val;
        }
-        /* When connected at 10Mbps half-duplex, 82579 parts are excessively
+        /* When connected at 10Mbps half-duplex, some parts are excessively
         * aggressive resulting in many collisions. To avoid this, increase
         * the IPG and reduce Rx latency in the PHY.
         */
-        if ((hw->mac.type == e1000_pch2lan) && link) {
+        if (((hw->mac.type == e1000_pch2lan) ||
+             (hw->mac.type == e1000_pch_lpt)) && link) {
                u32 reg;
                reg = er32(STATUS);
                if (!(reg & (E1000_STATUS_FD | E1000_STATUS_SPEED_MASK))) {
+                        u16 emi_addr;
                        reg = er32(TIPG);
                        reg &= ~E1000_TIPG_IPGT_MASK;
                        reg |= 0xFF;
@@ -1332,8 +1348,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                        if (ret_val)
                                return ret_val;
-                        ret_val =
+                        if (hw->mac.type == e1000_pch2lan)
-                            e1000_write_emi_reg_locked(hw, I82579_RX_CONFIG, 0);
+                                emi_addr = I82579_RX_CONFIG;
+                        else
+                                emi_addr = I217_RX_CONFIG;
+                        ret_val = e1000_write_emi_reg_locked(hw, emi_addr, 0);
                        hw->phy.ops.release(hw);
@@ -2493,51 +2513,44 @@ release:
 *  e1000_k1_gig_workaround_lv - K1 Si workaround
 *  @hw:   pointer to the HW structure
 *
- *  Workaround to set the K1 beacon duration for 82579 parts
+ *  Workaround to set the K1 beacon duration for 82579 parts in 10Mbps
+ *  Disable K1 in 1000Mbps and 100Mbps
 **/
 static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
 {
        s32 ret_val = 0;
        u16 status_reg = 0;
-        u32 mac_reg;
-        u16 phy_reg;
        if (hw->mac.type != e1000_pch2lan)
                return 0;
-        /* Set K1 beacon duration based on 1Gbps speed or otherwise */
+        /* Set K1 beacon duration based on 10Mbs speed */
        ret_val = e1e_rphy(hw, HV_M_STATUS, &status_reg);
        if (ret_val)
                return ret_val;
        if ((status_reg & (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE))
            == (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE)) {
-                mac_reg = er32(FEXTNVM4);
+                if (status_reg &
-                mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
+                    (HV_M_STATUS_SPEED_1000 | HV_M_STATUS_SPEED_100)) {
-                ret_val = e1e_rphy(hw, I82579_LPI_CTRL, &phy_reg);
-                if (ret_val)
-                        return ret_val;
-                if (status_reg & HV_M_STATUS_SPEED_1000) {
                        u16 pm_phy_reg;
-                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
+                        /* LV 1G/100 Packet drop issue wa  */
-                        phy_reg &= ~I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
-                        /* LV 1G Packet drop issue wa  */
                        ret_val = e1e_rphy(hw, HV_PM_CTRL, &pm_phy_reg);
                        if (ret_val)
                                return ret_val;
-                        pm_phy_reg &= ~HV_PM_CTRL_PLL_STOP_IN_K1_GIGA;
+                        pm_phy_reg &= ~HV_PM_CTRL_K1_ENABLE;
                        ret_val = e1e_wphy(hw, HV_PM_CTRL, pm_phy_reg);
                        if (ret_val)
                                return ret_val;
                } else {
+                        u32 mac_reg;
+                        mac_reg = er32(FEXTNVM4);
+                        mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
-                        phy_reg |= I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                        ew32(FEXTNVM4, mac_reg);
                }
-                ew32(FEXTNVM4, mac_reg);
-                ret_val = e1e_wphy(hw, I82579_LPI_CTRL, phy_reg);
        }
        return ret_val;
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index bead50f9187b..5515126c81c1 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -232,16 +232,19 @@
 #define I82577_MSE_THRESHOLD    0x0887  /* 82577 Mean Square Error Threshold */
 #define I82579_MSE_LINK_DOWN    0x2411  /* MSE count before dropping link */
 #define I82579_RX_CONFIG                0x3412  /* Receive configuration */
+#define I82579_LPI_PLL_SHUT             0x4412  /* LPI PLL Shut Enable */
 #define I82579_EEE_PCS_STATUS           0x182E  /* IEEE MMD Register 3.1 >> 8 */
 #define I82579_EEE_CAPABILITY           0x0410  /* IEEE MMD Register 3.20 */
 #define I82579_EEE_ADVERTISEMENT        0x040E  /* IEEE MMD Register 7.60 */
 #define I82579_EEE_LP_ABILITY           0x040F  /* IEEE MMD Register 7.61 */
 #define I82579_EEE_100_SUPPORTED        (1 << 1)        /* 100BaseTx EEE */
 #define I82579_EEE_1000_SUPPORTED       (1 << 2)        /* 1000BaseTx EEE */
+#define I82579_LPI_100_PLL_SHUT (1 << 2)        /* 100M LPI PLL Shut Enabled */
 #define I217_EEE_PCS_STATUS     0x9401  /* IEEE MMD Register 3.1 */
 #define I217_EEE_CAPABILITY     0x8000  /* IEEE MMD Register 3.20 */
 #define I217_EEE_ADVERTISEMENT  0x8001  /* IEEE MMD Register 7.60 */
 #define I217_EEE_LP_ABILITY     0x8002  /* IEEE MMD Register 7.61 */
+#define I217_RX_CONFIG          0xB20C  /* Receive configuration */
 #define E1000_EEE_RX_LPI_RCVD   0x0400  /* Tx LP idle received */
 #define E1000_EEE_TX_LPI_RCVD   0x0800  /* Rx LP idle received */
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index d50c91e50528..3e69386add04 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1165,7 +1165,7 @@ static void e1000e_tx_hwtstamp_work(struct work_struct *work)
                dev_kfree_skb_any(adapter->tx_hwtstamp_skb);
                adapter->tx_hwtstamp_skb = NULL;
                adapter->tx_hwtstamp_timeouts++;
-                e_warn("clearing Tx timestamp hang");
+                e_warn("clearing Tx timestamp hang\n");
        } else {
                /* reschedule to check later */
                schedule_work(&adapter->tx_hwtstamp_work);
@@ -5687,7 +5687,7 @@ struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev,
 static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
 {
        struct e1000_adapter *adapter = netdev_priv(netdev);
-        int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+        int max_frame = new_mtu + VLAN_HLEN + ETH_HLEN + ETH_FCS_LEN;
        /* Jumbo frame support */
        if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
@@ -6235,6 +6235,7 @@ static int __e1000_resume(struct pci_dev *pdev)
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
 static int e1000e_pm_thaw(struct device *dev)
 {
        struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev));
@@ -6255,7 +6256,6 @@ static int e1000e_pm_thaw(struct device *dev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
 static int e1000e_pm_suspend(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
diff --git a/drivers/net/ethernet/intel/e1000e/phy.h b/drivers/net/ethernet/intel/e1000e/phy.h
index 3841bccf058c..537d2780b408 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.h
+++ b/drivers/net/ethernet/intel/e1000e/phy.h
@@ -164,6 +164,7 @@ s32 e1000_get_cable_length_82577(struct e1000_hw *hw);
 #define HV_M_STATUS_AUTONEG_COMPLETE    0x1000
 #define HV_M_STATUS_SPEED_MASK          0x0300
 #define HV_M_STATUS_SPEED_1000          0x0200
+#define HV_M_STATUS_SPEED_100           0x0100
 #define HV_M_STATUS_LINK_UP             0x0040
 #define IGP01E1000_PHY_PCS_INIT_REG     0x00B4
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 861b722c2672..cf0761f08911 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -2897,12 +2897,9 @@ static irqreturn_t i40e_intr(int irq, void *data)
                u32 prttsyn_stat = rd32(hw, I40E_PRTTSYN_STAT_0);
                if (prttsyn_stat & I40E_PRTTSYN_STAT_0_TXTIME_MASK) {
-                        ena_mask &= ~I40E_PFINT_ICR0_ENA_TIMESYNC_MASK;
+                        icr0 &= ~I40E_PFINT_ICR0_ENA_TIMESYNC_MASK;
                        i40e_ptp_tx_hwtstamp(pf);
-                        prttsyn_stat &= ~I40E_PRTTSYN_STAT_0_TXTIME_MASK;
                }
-                wr32(hw, I40E_PRTTSYN_STAT_0, prttsyn_stat);
        }
        /* If a critical error is pending we have no choice but to reset the
@@ -4271,6 +4268,14 @@ static int i40e_open(struct net_device *netdev)
        if (err)
                return err;
+        /* configure global TSO hardware offload settings */
+        wr32(&pf->hw, I40E_GLLAN_TSOMSK_F, be32_to_cpu(TCP_FLAG_PSH |
+                                                       TCP_FLAG_FIN) >> 16);
+        wr32(&pf->hw, I40E_GLLAN_TSOMSK_M, be32_to_cpu(TCP_FLAG_PSH |
+                                                       TCP_FLAG_FIN |
+                                                       TCP_FLAG_CWR) >> 16);
+        wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16);
 #ifdef CONFIG_I40E_VXLAN
        vxlan_get_rx_port(netdev);
 #endif
@@ -6712,6 +6717,7 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
                           NETIF_F_HW_VLAN_CTAG_FILTER |
                           NETIF_F_IPV6_CSUM           |
                           NETIF_F_TSO                 |
+                           NETIF_F_TSO_ECN             |
                           NETIF_F_TSO6                |
                           NETIF_F_RXCSUM              |
                           NETIF_F_NTUPLE              |
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index 262bdf11d221..81299189a47d 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -160,7 +160,7 @@ static i40e_status i40e_poll_sr_srctl_done_bit(struct i40e_hw *hw)
                udelay(5);
        }
        if (ret_code == I40E_ERR_TIMEOUT)
-                hw_dbg(hw, "Done bit in GLNVM_SRCTL not set");
+                hw_dbg(hw, "Done bit in GLNVM_SRCTL not set\n");
        return ret_code;
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
index e33ec6c842b7..e61e63720800 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -239,7 +239,7 @@ static void i40e_ptp_tx_work(struct work_struct *work)
                dev_kfree_skb_any(pf->ptp_tx_skb);
                pf->ptp_tx_skb = NULL;
                pf->tx_hwtstamp_timeouts++;
-                dev_warn(&pf->pdev->dev, "clearing Tx timestamp hang");
+                dev_warn(&pf->pdev->dev, "clearing Tx timestamp hang\n");
                return;
        }
@@ -321,7 +321,7 @@ void i40e_ptp_rx_hang(struct i40e_vsi *vsi)
                pf->last_rx_ptp_check = jiffies;
                pf->rx_hwtstamp_cleared++;
                dev_warn(&vsi->back->pdev->dev,
-                         "%s: clearing Rx timestamp hang",
+                         "%s: clearing Rx timestamp hang\n",
                         __func__);
        }
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 0f5d96ad281d..9478ddc66caf 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -418,7 +418,7 @@ int i40e_add_del_fdir(struct i40e_vsi *vsi,
                }
                break;
        default:
-                dev_info(&pf->pdev->dev, "Could not specify spec type %d",
+                dev_info(&pf->pdev->dev, "Could not specify spec type %d\n",
                         input->flow_type);
                ret = -EINVAL;
        }
@@ -478,7 +478,7 @@ static void i40e_fd_handle_status(struct i40e_ring *rx_ring,
                                pf->flags |= I40E_FLAG_FDIR_REQUIRES_REINIT;
                        }
                } else {
-                        dev_info(&pdev->dev, "FD filter programming error");
+                        dev_info(&pdev->dev, "FD filter programming error\n");
                }
        } else if (error ==
                          (0x1 << I40E_RX_PROG_STATUS_DESC_NO_FD_ENTRY_SHIFT)) {
@@ -1713,9 +1713,11 @@ static int i40e_tx_prepare_vlan_flags(struct sk_buff *skb,
                                I40E_TX_FLAGS_VLAN_PRIO_SHIFT;
                if (tx_flags & I40E_TX_FLAGS_SW_VLAN) {
                        struct vlan_ethhdr *vhdr;
-                        if (skb_header_cloned(skb) &&
+                        int rc;
-                            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
-                                return -ENOMEM;
+                        rc = skb_cow_head(skb, 0);
+                        if (rc < 0)
+                                return rc;
                        vhdr = (struct vlan_ethhdr *)skb->data;
                        vhdr->h_vlan_TCI = htons(tx_flags >>
                                                 I40E_TX_FLAGS_VLAN_SHIFT);
@@ -1743,20 +1745,18 @@ static int i40e_tso(struct i40e_ring *tx_ring, struct sk_buff *skb,
                    u64 *cd_type_cmd_tso_mss, u32 *cd_tunneling)
 {
        u32 cd_cmd, cd_tso_len, cd_mss;
+        struct ipv6hdr *ipv6h;
        struct tcphdr *tcph;
        struct iphdr *iph;
        u32 l4len;
        int err;
-        struct ipv6hdr *ipv6h;
        if (!skb_is_gso(skb))
                return 0;
-        if (skb_header_cloned(skb)) {
+        err = skb_cow_head(skb, 0);
-                err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+        if (err < 0)
-                if (err)
+                return err;
-                        return err;
-        }
        if (protocol == htons(ETH_P_IP)) {
                iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
index db963397cc27..f67f8a170b90 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
@@ -365,7 +365,7 @@ static s32 igb_read_invm_word_i210(struct e1000_hw *hw, u8 address, u16 *data)
                        word_address = INVM_DWORD_TO_WORD_ADDRESS(invm_dword);
                        if (word_address == address) {
                                *data = INVM_DWORD_TO_WORD_DATA(invm_dword);
-                                hw_dbg("Read INVM Word 0x%02x = %x",
+                                hw_dbg("Read INVM Word 0x%02x = %x\n",
                                          address, *data);
                                status = E1000_SUCCESS;
                                break;
diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c
index 5910a932ea7c..1e0c404db81a 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.c
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.c
@@ -929,11 +929,10 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                         */
                        if (hw->fc.requested_mode == e1000_fc_full) {
                                hw->fc.current_mode = e1000_fc_full;
-                                hw_dbg("Flow Control = FULL.\r\n");
+                                hw_dbg("Flow Control = FULL.\n");
                        } else {
                                hw->fc.current_mode = e1000_fc_rx_pause;
-                                hw_dbg("Flow Control = "
+                                hw_dbg("Flow Control = RX PAUSE frames only.\n");
-                                       "RX PAUSE frames only.\r\n");
                        }
                }
                /* For receiving PAUSE frames ONLY.
@@ -948,7 +947,7 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                          (mii_nway_lp_ability_reg & NWAY_LPAR_PAUSE) &&
                          (mii_nway_lp_ability_reg & NWAY_LPAR_ASM_DIR)) {
                        hw->fc.current_mode = e1000_fc_tx_pause;
-                        hw_dbg("Flow Control = TX PAUSE frames only.\r\n");
+                        hw_dbg("Flow Control = TX PAUSE frames only.\n");
                }
                /* For transmitting PAUSE frames ONLY.
                 *
@@ -962,7 +961,7 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                         !(mii_nway_lp_ability_reg & NWAY_LPAR_PAUSE) &&
                         (mii_nway_lp_ability_reg & NWAY_LPAR_ASM_DIR)) {
                        hw->fc.current_mode = e1000_fc_rx_pause;
-                        hw_dbg("Flow Control = RX PAUSE frames only.\r\n");
+                        hw_dbg("Flow Control = RX PAUSE frames only.\n");
                }
                /* Per the IEEE spec, at this point flow control should be
                 * disabled.  However, we want to consider that we could
@@ -988,10 +987,10 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                         (hw->fc.requested_mode == e1000_fc_tx_pause) ||
                         (hw->fc.strict_ieee)) {
                        hw->fc.current_mode = e1000_fc_none;
-                        hw_dbg("Flow Control = NONE.\r\n");
+                        hw_dbg("Flow Control = NONE.\n");
                } else {
                        hw->fc.current_mode = e1000_fc_rx_pause;
-                        hw_dbg("Flow Control = RX PAUSE frames only.\r\n");
+                        hw_dbg("Flow Control = RX PAUSE frames only.\n");
                }
                /* Now we need to do one last check...  If we auto-
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index fb98d4602f9d..16430a8440fa 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5193,8 +5193,10 @@ void igb_update_stats(struct igb_adapter *adapter,
        rcu_read_lock();
        for (i = 0; i < adapter->num_rx_queues; i++) {
-                u32 rqdpc = rd32(E1000_RQDPC(i));
                struct igb_ring *ring = adapter->rx_ring[i];
+                u32 rqdpc = rd32(E1000_RQDPC(i));
+                if (hw->mac.type >= e1000_i210)
+                        wr32(E1000_RQDPC(i), 0);
                if (rqdpc) {
                        ring->rx_stats.drops += rqdpc;
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index 9209d652e1c9..ab25e49365f7 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -389,7 +389,7 @@ static void igb_ptp_tx_work(struct work_struct *work)
                adapter->ptp_tx_skb = NULL;
                clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state);
                adapter->tx_hwtstamp_timeouts++;
-                dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang");
+                dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n");
                return;
        }
@@ -451,7 +451,7 @@ void igb_ptp_rx_hang(struct igb_adapter *adapter)
                rd32(E1000_RXSTMPH);
                adapter->last_rx_ptp_check = jiffies;
                adapter->rx_hwtstamp_cleared++;
-                dev_warn(&adapter->pdev->dev, "clearing Rx timestamp hang");
+                dev_warn(&adapter->pdev->dev, "clearing Rx timestamp hang\n");
        }
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 1a12c1dd7a27..c6c4ca7d68e6 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -256,7 +256,6 @@ struct ixgbe_ring {
                struct ixgbe_tx_buffer *tx_buffer_info;
                struct ixgbe_rx_buffer *rx_buffer_info;
        };
-        unsigned long last_rx_timestamp;
        unsigned long state;
        u8 __iomem *tail;
        dma_addr_t dma;                 /* phys. address of descriptor ring */
@@ -770,6 +769,7 @@ struct ixgbe_adapter {
        unsigned long ptp_tx_start;
        unsigned long last_overflow_check;
        unsigned long last_rx_ptp_check;
+        unsigned long last_rx_timestamp;
        spinlock_t tmreg_lock;
        struct cyclecounter cc;
        struct timecounter tc;
@@ -944,24 +944,7 @@ void ixgbe_ptp_init(struct ixgbe_adapter *adapter);
 void ixgbe_ptp_stop(struct ixgbe_adapter *adapter);
 void ixgbe_ptp_overflow_check(struct ixgbe_adapter *adapter);
 void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter);
-void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
+void ixgbe_ptp_rx_hwtstamp(struct ixgbe_adapter *adapter, struct sk_buff *skb);
-                             struct sk_buff *skb);
-static inline void ixgbe_ptp_rx_hwtstamp(struct ixgbe_ring *rx_ring,
-                                         union ixgbe_adv_rx_desc *rx_desc,
-                                         struct sk_buff *skb)
-{
-        if (unlikely(!ixgbe_test_staterr(rx_desc, IXGBE_RXDADV_STAT_TS)))
-                return;
-        __ixgbe_ptp_rx_hwtstamp(rx_ring->q_vector, skb);
-        /*
-         * Update the last_rx_timestamp timer in order to enable watchdog check
-         * for error case of latched timestamp on a dropped packet.
-         */
-        rx_ring->last_rx_timestamp = jiffies;
-}
 int ixgbe_ptp_set_ts_config(struct ixgbe_adapter *adapter, struct ifreq *ifr);
 int ixgbe_ptp_get_ts_config(struct ixgbe_adapter *adapter, struct ifreq *ifr);
 void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 24fba39e194e..981b8a7b100d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1195,7 +1195,7 @@ static s32 ixgbe_detect_eeprom_page_size_generic(struct ixgbe_hw *hw,
         */
        hw->eeprom.word_page_size = IXGBE_EEPROM_PAGE_SIZE_MAX - data[0];
-        hw_dbg(hw, "Detected EEPROM page size = %d words.",
+        hw_dbg(hw, "Detected EEPROM page size = %d words.\n",
               hw->eeprom.word_page_size);
 out:
        return status;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index c4c526b7f99f..d62e7a25cf97 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1664,7 +1664,8 @@ static void ixgbe_process_skb_fields(struct ixgbe_ring *rx_ring,
        ixgbe_rx_checksum(rx_ring, rx_desc, skb);
-        ixgbe_ptp_rx_hwtstamp(rx_ring, rx_desc, skb);
+        if (unlikely(ixgbe_test_staterr(rx_desc, IXGBE_RXDADV_STAT_TS)))
+                ixgbe_ptp_rx_hwtstamp(rx_ring->q_vector->adapter, skb);
        if ((dev->features & NETIF_F_HW_VLAN_CTAG_RX) &&
            ixgbe_test_staterr(rx_desc, IXGBE_RXD_STAT_VP)) {
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index 23f765263f12..a76af8e28a04 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -536,7 +536,7 @@ s32 ixgbe_setup_phy_link_generic(struct ixgbe_hw *hw)
        if (time_out == max_time_out) {
                status = IXGBE_ERR_LINK_SETUP;
-                hw_dbg(hw, "ixgbe_setup_phy_link_generic: time out");
+                hw_dbg(hw, "ixgbe_setup_phy_link_generic: time out\n");
        }
        return status;
@@ -745,7 +745,7 @@ s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
        if (time_out == max_time_out) {
                status = IXGBE_ERR_LINK_SETUP;
-                hw_dbg(hw, "ixgbe_setup_phy_link_tnx: time out");
+                hw_dbg(hw, "ixgbe_setup_phy_link_tnx: time out\n");
        }
        return status;
@@ -1175,7 +1175,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw)
                                status = 0;
                        } else {
                                if (hw->allow_unsupported_sfp) {
-                                        e_warn(drv, "WARNING: Intel (R) Network Connections are quality tested using Intel (R) Ethernet Optics.  Using untested modules is not supported and may cause unstable operation or damage to the module or the adapter.  Intel Corporation is not responsible for any harm caused by using untested modules.");
+                                        e_warn(drv, "WARNING: Intel (R) Network Connections are quality tested using Intel (R) Ethernet Optics.  Using untested modules is not supported and may cause unstable operation or damage to the module or the adapter.  Intel Corporation is not responsible for any harm caused by using untested modules.\n");
                                        status = 0;
                                } else {
                                        hw_dbg(hw,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index 63515a6f67fa..8902ae683457 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -435,10 +435,8 @@ void ixgbe_ptp_overflow_check(struct ixgbe_adapter *adapter)
 void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter)
 {
        struct ixgbe_hw *hw = &adapter->hw;
-        struct ixgbe_ring *rx_ring;
        u32 tsyncrxctl = IXGBE_READ_REG(hw, IXGBE_TSYNCRXCTL);
        unsigned long rx_event;
-        int n;
        /* if we don't have a valid timestamp in the registers, just update the
         * timeout counter and exit
@@ -450,18 +448,15 @@ void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter)
        /* determine the most recent watchdog or rx_timestamp event */
        rx_event = adapter->last_rx_ptp_check;
-        for (n = 0; n < adapter->num_rx_queues; n++) {
+        if (time_after(adapter->last_rx_timestamp, rx_event))
-                rx_ring = adapter->rx_ring[n];
+                rx_event = adapter->last_rx_timestamp;
-                if (time_after(rx_ring->last_rx_timestamp, rx_event))
-                        rx_event = rx_ring->last_rx_timestamp;
-        }
        /* only need to read the high RXSTMP register to clear the lock */
        if (time_is_before_jiffies(rx_event + 5*HZ)) {
                IXGBE_READ_REG(hw, IXGBE_RXSTMPH);
                adapter->last_rx_ptp_check = jiffies;
-                e_warn(drv, "clearing RX Timestamp hang");
+                e_warn(drv, "clearing RX Timestamp hang\n");
        }
 }
@@ -517,7 +512,7 @@ static void ixgbe_ptp_tx_hwtstamp_work(struct work_struct *work)
                dev_kfree_skb_any(adapter->ptp_tx_skb);
                adapter->ptp_tx_skb = NULL;
                clear_bit_unlock(__IXGBE_PTP_TX_IN_PROGRESS, &adapter->state);
-                e_warn(drv, "clearing Tx Timestamp hang");
+                e_warn(drv, "clearing Tx Timestamp hang\n");
                return;
        }
@@ -530,35 +525,22 @@ static void ixgbe_ptp_tx_hwtstamp_work(struct work_struct *work)
 }
 /**
- * __ixgbe_ptp_rx_hwtstamp - utility function which checks for RX time stamp
+ * ixgbe_ptp_rx_hwtstamp - utility function which checks for RX time stamp
- * @q_vector: structure containing interrupt and ring information
+ * @adapter: pointer to adapter struct
 * @skb: particular skb to send timestamp with
 *
 * if the timestamp is valid, we convert it into the timecounter ns
 * value, then store that result into the shhwtstamps structure which
 * is passed up the network stack
 */
-void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
+void ixgbe_ptp_rx_hwtstamp(struct ixgbe_adapter *adapter, struct sk_buff *skb)
-                             struct sk_buff *skb)
 {
-        struct ixgbe_adapter *adapter;
+        struct ixgbe_hw *hw = &adapter->hw;
-        struct ixgbe_hw *hw;
        struct skb_shared_hwtstamps *shhwtstamps;
        u64 regval = 0, ns;
        u32 tsyncrxctl;
        unsigned long flags;
-        /* we cannot process timestamps on a ring without a q_vector */
-        if (!q_vector || !q_vector->adapter)
-                return;
-        adapter = q_vector->adapter;
-        hw = &adapter->hw;
-        /*
-         * Read the tsyncrxctl register afterwards in order to prevent taking an
-         * I/O hit on every packet.
-         */
        tsyncrxctl = IXGBE_READ_REG(hw, IXGBE_TSYNCRXCTL);
        if (!(tsyncrxctl & IXGBE_TSYNCRXCTL_VALID))
                return;
@@ -566,13 +548,17 @@ void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
        regval |= (u64)IXGBE_READ_REG(hw, IXGBE_RXSTMPL);
        regval |= (u64)IXGBE_READ_REG(hw, IXGBE_RXSTMPH) << 32;
        spin_lock_irqsave(&adapter->tmreg_lock, flags);
        ns = timecounter_cyc2time(&adapter->tc, regval);
        spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
        shhwtstamps = skb_hwtstamps(skb);
        shhwtstamps->hwtstamp = ns_to_ktime(ns);
+        /* Update the last_rx_timestamp timer in order to enable watchdog check
+         * for error case of latched timestamp on a dropped packet.
+         */
+        adapter->last_rx_timestamp = jiffies;
 }
 int ixgbe_ptp_get_ts_config(struct ixgbe_adapter *adapter, struct ifreq *ifr)
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index b161a525fc5b..9d5ced263a5e 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -232,7 +232,7 @@ static int orion_mdio_probe(struct platform_device *pdev)
                clk_prepare_enable(dev->clk);
        dev->err_interrupt = platform_get_irq(pdev, 0);
-        if (dev->err_interrupt != -ENXIO) {
+        if (dev->err_interrupt > 0) {
                ret = devm_request_irq(&pdev->dev, dev->err_interrupt,
                                        orion_mdio_err_irq,
                                        IRQF_SHARED, pdev->name, dev);
@@ -241,6 +241,9 @@ static int orion_mdio_probe(struct platform_device *pdev)
                writel(MVMDIO_ERR_INT_SMI_DONE,
                        dev->regs + MVMDIO_ERR_INT_MASK);
+        } else if (dev->err_interrupt == -EPROBE_DEFER) {
+                return -EPROBE_DEFER;
        }
        mutex_init(&dev->lock);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index cef267e24f9c..7cf9dadcb471 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -754,10 +754,10 @@ static void mlx4_request_modules(struct mlx4_dev *dev)
                        has_eth_port = true;
        }
-        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
-                request_module_nowait(IB_DRV_NAME);
        if (has_eth_port)
                request_module_nowait(EN_DRV_NAME);
+        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
+                request_module_nowait(IB_DRV_NAME);
 }
 /*
@@ -2440,7 +2440,8 @@ slave_start:
         * No return code for this call, just warn the user in case of PCI
         * express device capabilities are under-satisfied by the bus.
         */
-        mlx4_check_pcie_caps(dev);
+        if (!mlx4_is_slave(dev))
+                mlx4_check_pcie_caps(dev);
        /* In master functions, the communication channel must be initialized
         * after obtaining its address from fw */
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index cfcad26ed40f..b5b3549b0c8d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -1106,6 +1106,9 @@ int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,
        }
        if (found_ix >= 0) {
+                /* Calculate a slave_gid which is the slave number in the gid
+                 * table and not a globally unique slave number.
+                 */
                if (found_ix < MLX4_ROCE_PF_GIDS)
                        slave_gid = 0;
                else if (found_ix < MLX4_ROCE_PF_GIDS + (vf_gids % num_vfs) *
@@ -1118,41 +1121,43 @@ int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,
                          ((vf_gids % num_vfs) * ((vf_gids / num_vfs + 1)))) /
                         (vf_gids / num_vfs)) + vf_gids % num_vfs + 1;
+                /* Calculate the globally unique slave id */
                if (slave_gid) {
                        struct mlx4_active_ports exclusive_ports;
                        struct mlx4_active_ports actv_ports;
                        struct mlx4_slaves_pport slaves_pport_actv;
                        unsigned max_port_p_one;
-                        int num_slaves_before = 1;
+                        int num_vfs_before = 0;
+                        int candidate_slave_gid;
+                        /* Calculate how many VFs are on the previous port, if exists */
                        for (i = 1; i < port; i++) {
                                bitmap_zero(exclusive_ports.ports, dev->caps.num_ports);
-                                set_bit(i, exclusive_ports.ports);
+                                set_bit(i - 1, exclusive_ports.ports);
                                slaves_pport_actv =
                                        mlx4_phys_to_slaves_pport_actv(
                                                        dev, &exclusive_ports);
-                                num_slaves_before += bitmap_weight(
+                                num_vfs_before += bitmap_weight(
                                                slaves_pport_actv.slaves,
                                                dev->num_vfs + 1);
                        }
-                        if (slave_gid < num_slaves_before) {
+                        /* candidate_slave_gid isn't necessarily the correct slave, but
-                                bitmap_zero(exclusive_ports.ports, dev->caps.num_ports);
+                         * it has the same number of ports and is assigned to the same
-                                set_bit(port - 1, exclusive_ports.ports);
+                         * ports as the real slave we're looking for. On dual port VF,
-                                slaves_pport_actv =
+                         * slave_gid = [single port VFs on port <port>] +
-                                        mlx4_phys_to_slaves_pport_actv(
+                         * [offset of the current slave from the first dual port VF] +
-                                                        dev, &exclusive_ports);
+                         * 1 (for the PF).
-                                slave_gid += bitmap_weight(
+                         */
-                                                slaves_pport_actv.slaves,
+                        candidate_slave_gid = slave_gid + num_vfs_before;
-                                                dev->num_vfs + 1) -
-                                                num_slaves_before;
+                        actv_ports = mlx4_get_active_ports(dev, candidate_slave_gid);
-                        }
-                        actv_ports = mlx4_get_active_ports(dev, slave_gid);
                        max_port_p_one = find_first_bit(
                                actv_ports.ports, dev->caps.num_ports) +
                                bitmap_weight(actv_ports.ports,
                                              dev->caps.num_ports) + 1;
+                        /* Calculate the real slave number */
                        for (i = 1; i < max_port_p_one; i++) {
                                if (i == port)
                                        continue;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 3b5f53ef29b2..1c3fdd4a1f7d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -3733,6 +3733,25 @@ static int qp_detach(struct mlx4_dev *dev, struct mlx4_qp *qp,
        }
 }
+static int mlx4_adjust_port(struct mlx4_dev *dev, int slave,
+                            u8 *gid, enum mlx4_protocol prot)
+{
+        int real_port;
+        if (prot != MLX4_PROT_ETH)
+                return 0;
+        if (dev->caps.steering_mode == MLX4_STEERING_MODE_B0 ||
+            dev->caps.steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) {
+                real_port = mlx4_slave_convert_port(dev, slave, gid[5]);
+                if (real_port < 0)
+                        return -EINVAL;
+                gid[5] = real_port;
+        }
+        return 0;
+}
 int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                               struct mlx4_vhcr *vhcr,
                               struct mlx4_cmd_mailbox *inbox,
@@ -3768,6 +3787,10 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                if (err)
                        goto ex_detach;
        } else {
+                err = mlx4_adjust_port(dev, slave, gid, prot);
+                if (err)
+                        goto ex_put;
                err = rem_mcg_res(dev, slave, rqp, gid, prot, type, &reg_id);
                if (err)
                        goto ex_put;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index dbf75393f758..0bc914859e38 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2374,6 +2374,14 @@ void qlcnic_set_drv_version(struct qlcnic_adapter *adapter)
                qlcnic_fw_cmd_set_drv_version(adapter, fw_cmd);
 }
+/* Reset firmware API lock */
+static void qlcnic_reset_api_lock(struct qlcnic_adapter *adapter)
+{
+        qlcnic_api_lock(adapter);
+        qlcnic_api_unlock(adapter);
+}
 static int
 qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -2476,6 +2484,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (qlcnic_82xx_check(adapter)) {
                qlcnic_check_vf(adapter, ent);
                adapter->portnum = adapter->ahw->pci_func;
+                qlcnic_reset_api_lock(adapter);
                err = qlcnic_start_firmware(adapter);
                if (err) {
                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n"
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 0638c1810d54..6afe9c1f5ab9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -1370,7 +1370,7 @@ static int qlcnic_sriov_issue_cmd(struct qlcnic_adapter *adapter,
        rsp = qlcnic_sriov_alloc_bc_trans(&trans);
        if (rsp)
-                return rsp;
+                goto free_cmd;
        rsp = qlcnic_sriov_prepare_bc_hdr(trans, cmd, seq, QLC_BC_COMMAND);
        if (rsp)
@@ -1425,6 +1425,13 @@ err_out:
 cleanup_transaction:
        qlcnic_sriov_cleanup_transaction(trans);
+free_cmd:
+        if (cmd->type == QLC_83XX_MBX_CMD_NO_WAIT) {
+                qlcnic_free_mbx_args(cmd);
+                kfree(cmd);
+        }
        return rsp;
 }
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h b/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h
index 6203c7d8550f..45019649bbbd 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h
@@ -358,6 +358,8 @@ struct sxgbe_core_ops {
        /* Enable disable checksum offload operations */
        void (*enable_rx_csum)(void __iomem *ioaddr);
        void (*disable_rx_csum)(void __iomem *ioaddr);
+        void (*enable_rxqueue)(void __iomem *ioaddr, int queue_num);
+        void (*disable_rxqueue)(void __iomem *ioaddr, int queue_num);
 };
 const struct sxgbe_core_ops *sxgbe_get_core_ops(void);
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c
index c4da7a2b002a..58c35692560e 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c
@@ -165,6 +165,26 @@ static void sxgbe_core_set_speed(void __iomem *ioaddr, unsigned char speed)
        writel(tx_cfg, ioaddr + SXGBE_CORE_TX_CONFIG_REG);
 }
+static void sxgbe_core_enable_rxqueue(void __iomem *ioaddr, int queue_num)
+{
+        u32 reg_val;
+        reg_val = readl(ioaddr + SXGBE_CORE_RX_CTL0_REG);
+        reg_val &= ~(SXGBE_CORE_RXQ_ENABLE_MASK << queue_num);
+        reg_val |= SXGBE_CORE_RXQ_ENABLE;
+        writel(reg_val, ioaddr + SXGBE_CORE_RX_CTL0_REG);
+}
+static void sxgbe_core_disable_rxqueue(void __iomem *ioaddr, int queue_num)
+{
+        u32 reg_val;
+        reg_val = readl(ioaddr + SXGBE_CORE_RX_CTL0_REG);
+        reg_val &= ~(SXGBE_CORE_RXQ_ENABLE_MASK << queue_num);
+        reg_val |= SXGBE_CORE_RXQ_DISABLE;
+        writel(reg_val, ioaddr + SXGBE_CORE_RX_CTL0_REG);
+}
 static void  sxgbe_set_eee_mode(void __iomem *ioaddr)
 {
        u32 ctrl;
@@ -254,6 +274,8 @@ static const struct sxgbe_core_ops core_ops = {
        .set_eee_pls            = sxgbe_set_eee_pls,
        .enable_rx_csum         = sxgbe_enable_rx_csum,
        .disable_rx_csum        = sxgbe_disable_rx_csum,
+        .enable_rxqueue         = sxgbe_core_enable_rxqueue,
+        .disable_rxqueue        = sxgbe_core_disable_rxqueue,
 };
 const struct sxgbe_core_ops *sxgbe_get_core_ops(void)
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c
index e896dbbd2e15..2686bb5b6765 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c
@@ -45,10 +45,10 @@ static void sxgbe_prepare_tx_desc(struct sxgbe_tx_norm_desc *p, u8 is_fd,
        p->tdes23.tx_rd_des23.first_desc = is_fd;
        p->tdes23.tx_rd_des23.buf1_size = buf1_len;
-        p->tdes23.tx_rd_des23.tx_pkt_len.cksum_pktlen.total_pkt_len = pkt_len;
+        p->tdes23.tx_rd_des23.tx_pkt_len.pkt_len.total_pkt_len = pkt_len;
        if (cksum)
-                p->tdes23.tx_rd_des23.tx_pkt_len.cksum_pktlen.cksum_ctl = cic_full;
+                p->tdes23.tx_rd_des23.cksum_ctl = cic_full;
 }
 /* Set VLAN control information */
@@ -233,6 +233,12 @@ static void sxgbe_set_rx_owner(struct sxgbe_rx_norm_desc *p)
        p->rdes23.rx_rd_des23.own_bit = 1;
 }
+/* Set Interrupt on completion bit */
+static void sxgbe_set_rx_int_on_com(struct sxgbe_rx_norm_desc *p)
+{
+        p->rdes23.rx_rd_des23.int_on_com = 1;
+}
 /* Get the receive frame size */
 static int sxgbe_get_rx_frame_len(struct sxgbe_rx_norm_desc *p)
 {
@@ -498,6 +504,7 @@ static const struct sxgbe_desc_ops desc_ops = {
        .init_rx_desc                   = sxgbe_init_rx_desc,
        .get_rx_owner                   = sxgbe_get_rx_owner,
        .set_rx_owner                   = sxgbe_set_rx_owner,
+        .set_rx_int_on_com              = sxgbe_set_rx_int_on_com,
        .get_rx_frame_len               = sxgbe_get_rx_frame_len,
        .get_rx_fd_status               = sxgbe_get_rx_fd_status,
        .get_rx_ld_status               = sxgbe_get_rx_ld_status,
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h
index 838cb9fb0ea9..18609324db72 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h
@@ -39,22 +39,22 @@ struct sxgbe_tx_norm_desc {
                        u32 int_on_com:1;
                        /* TDES3 */
                        union {
-                                u32 tcp_payload_len:18;
+                                u16 tcp_payload_len;
                                struct {
                                        u32 total_pkt_len:15;
                                        u32 reserved1:1;
-                                        u32 cksum_ctl:2;
+                                } pkt_len;
-                                } cksum_pktlen;
                        } tx_pkt_len;
-                        u32 tse_bit:1;
+                        u16 cksum_ctl:2;
-                        u32 tcp_hdr_len:4;
+                        u16 tse_bit:1;
-                        u32 sa_insert_ctl:3;
+                        u16 tcp_hdr_len:4;
-                        u32 crc_pad_ctl:2;
+                        u16 sa_insert_ctl:3;
-                        u32 last_desc:1;
+                        u16 crc_pad_ctl:2;
-                        u32 first_desc:1;
+                        u16 last_desc:1;
-                        u32 ctxt_bit:1;
+                        u16 first_desc:1;
-                        u32 own_bit:1;
+                        u16 ctxt_bit:1;
+                        u16 own_bit:1;
                } tx_rd_des23;
                /* tx write back Desc 2,3 */
@@ -70,25 +70,20 @@ struct sxgbe_tx_norm_desc {
 struct sxgbe_rx_norm_desc {
        union {
-                u32 rdes0; /* buf1 address */
+                u64 rdes01; /* buf1 address */
-                struct {
+                union {
                        u32 out_vlan_tag:16;
                        u32 in_vlan_tag:16;
-                } wb_rx_des0;
+                        u32 rss_hash;
-        } rd_wb_des0;
+                } rx_wb_des01;
+        } rdes01;
-        union {
-                u32 rdes1;      /* buf2 address or buf1[63:32] */
-                u32 rss_hash;   /* Write-back RX */
-        } rd_wb_des1;
        union {
                /* RX Read format Desc 2,3 */
                struct{
                        /* RDES2 */
-                        u32 buf2_addr;
+                        u64 buf2_addr:62;
                        /* RDES3 */
-                        u32 buf2_hi_addr:30;
                        u32 int_on_com:1;
                        u32 own_bit:1;
                } rx_rd_des23;
@@ -263,6 +258,9 @@ struct sxgbe_desc_ops {
        /* Set own bit */
        void (*set_rx_owner)(struct sxgbe_rx_norm_desc *p);
+        /* Set Interrupt on completion bit */
+        void (*set_rx_int_on_com)(struct sxgbe_rx_norm_desc *p);
        /* Get the receive frame size */
        int (*get_rx_frame_len)(struct sxgbe_rx_norm_desc *p);
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
index 4d989ff6c978..bb9b5b8afc5f 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
@@ -23,21 +23,8 @@
 /* DMA core initialization */
 static int sxgbe_dma_init(void __iomem *ioaddr, int fix_burst, int burst_map)
 {
-        int retry_count = 10;
        u32 reg_val;
-        /* reset the DMA */
-        writel(SXGBE_DMA_SOFT_RESET, ioaddr + SXGBE_DMA_MODE_REG);
-        while (retry_count--) {
-                if (!(readl(ioaddr + SXGBE_DMA_MODE_REG) &
-                      SXGBE_DMA_SOFT_RESET))
-                        break;
-                mdelay(10);
-        }
-        if (retry_count < 0)
-                return -EBUSY;
        reg_val = readl(ioaddr + SXGBE_DMA_SYSBUS_MODE_REG);
        /* if fix_burst = 0, Set UNDEF = 1 of DMA_Sys_Mode Register.
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 27e8c824b204..82a9a983869f 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -1076,6 +1076,9 @@ static int sxgbe_open(struct net_device *dev)
        /* Initialize the MAC Core */
        priv->hw->mac->core_init(priv->ioaddr);
+        SXGBE_FOR_EACH_QUEUE(SXGBE_RX_QUEUES, queue_num) {
+                priv->hw->mac->enable_rxqueue(priv->ioaddr, queue_num);
+        }
        /* Request the IRQ lines */
        ret = devm_request_irq(priv->device, priv->irq, sxgbe_common_interrupt,
@@ -1453,6 +1456,7 @@ static void sxgbe_rx_refill(struct sxgbe_priv_data *priv)
                /* Added memory barrier for RX descriptor modification */
                wmb();
                priv->hw->desc->set_rx_owner(p);
+                priv->hw->desc->set_rx_int_on_com(p);
                /* Added memory barrier for RX descriptor modification */
                wmb();
        }
@@ -2070,6 +2074,24 @@ static int sxgbe_hw_init(struct sxgbe_priv_data * const priv)
        return 0;
 }
+static int sxgbe_sw_reset(void __iomem *addr)
+{
+        int retry_count = 10;
+        writel(SXGBE_DMA_SOFT_RESET, addr + SXGBE_DMA_MODE_REG);
+        while (retry_count--) {
+                if (!(readl(addr + SXGBE_DMA_MODE_REG) &
+                      SXGBE_DMA_SOFT_RESET))
+                        break;
+                mdelay(10);
+        }
+        if (retry_count < 0)
+                return -EBUSY;
+        return 0;
+}
 /**
 * sxgbe_drv_probe
 * @device: device pointer
@@ -2102,6 +2124,10 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device,
        priv->plat = plat_dat;
        priv->ioaddr = addr;
+        ret = sxgbe_sw_reset(priv->ioaddr);
+        if (ret)
+                goto error_free_netdev;
        /* Verify driver arguments */
        sxgbe_verify_args();
@@ -2218,9 +2244,14 @@ error_free_netdev:
 int sxgbe_drv_remove(struct net_device *ndev)
 {
        struct sxgbe_priv_data *priv = netdev_priv(ndev);
+        u8 queue_num;
        netdev_info(ndev, "%s: removing driver\n", __func__);
+        SXGBE_FOR_EACH_QUEUE(SXGBE_RX_QUEUES, queue_num) {
+                priv->hw->mac->disable_rxqueue(priv->ioaddr, queue_num);
+        }
        priv->hw->dma->stop_rx(priv->ioaddr, SXGBE_RX_QUEUES);
        priv->hw->dma->stop_tx(priv->ioaddr, SXGBE_TX_QUEUES);
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c
index 01af2cbb479d..43ccb4a6de15 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c
@@ -27,7 +27,7 @@
 #define SXGBE_SMA_PREAD_CMD     0x02 /* post read  increament address */
 #define SXGBE_SMA_READ_CMD      0x03 /* read command */
 #define SXGBE_SMA_SKIP_ADDRFRM  0x00040000 /* skip the address frame */
-#define SXGBE_MII_BUSY          0x00800000 /* mii busy */
+#define SXGBE_MII_BUSY          0x00400000 /* mii busy */
 static int sxgbe_mdio_busy_wait(void __iomem *ioaddr, unsigned int mii_data)
 {
@@ -147,6 +147,7 @@ int sxgbe_mdio_register(struct net_device *ndev)
        struct sxgbe_mdio_bus_data *mdio_data = priv->plat->mdio_bus_data;
        int err, phy_addr;
        int *irqlist;
+        bool phy_found = false;
        bool act;
        /* allocate the new mdio bus */
@@ -162,7 +163,7 @@ int sxgbe_mdio_register(struct net_device *ndev)
                irqlist = priv->mii_irq;
        /* assign mii bus fields */
-        mdio_bus->name = "samsxgbe";
+        mdio_bus->name = "sxgbe";
        mdio_bus->read = &sxgbe_mdio_read;
        mdio_bus->write = &sxgbe_mdio_write;
        snprintf(mdio_bus->id, MII_BUS_ID_SIZE, "%s-%x",
@@ -216,13 +217,22 @@ int sxgbe_mdio_register(struct net_device *ndev)
                        netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
                                    phy->phy_id, phy_addr, irq_str,
                                    dev_name(&phy->dev), act ? " active" : "");
+                        phy_found = true;
                }
        }
+        if (!phy_found) {
+                netdev_err(ndev, "PHY not found\n");
+                goto phyfound_err;
+        }
        priv->mii = mdio_bus;
        return 0;
+phyfound_err:
+        err = -ENODEV;
+        mdiobus_unregister(mdio_bus);
 mdiobus_err:
        mdiobus_free(mdio_bus);
        return err;
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h b/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h
index 5a89acb4c505..56f8bf5a3f1b 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h
@@ -52,6 +52,10 @@
 #define SXGBE_CORE_RX_CTL2_REG          0x00A8
 #define SXGBE_CORE_RX_CTL3_REG          0x00AC
+#define SXGBE_CORE_RXQ_ENABLE_MASK      0x0003
+#define SXGBE_CORE_RXQ_ENABLE           0x0002
+#define SXGBE_CORE_RXQ_DISABLE          0x0000
 /* Interrupt Registers */
 #define SXGBE_CORE_INT_STATUS_REG       0x00B0
 #define SXGBE_CORE_INT_ENABLE_REG       0x00B4
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index d1b4dca53a9d..bcaa41af1e62 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -147,18 +147,19 @@ MODULE_ALIAS("platform:smc91x");
 */
 #define MII_DELAY               1
-#if SMC_DEBUG > 0
+#define DBG(n, dev, fmt, ...)                                   \
-#define DBG(n, dev, args...)                            \
+        do {                                                    \
-        do {                                            \
+                if (SMC_DEBUG >= (n))                           \
-                if (SMC_DEBUG >= (n))                   \
+                        netdev_dbg(dev, fmt, ##__VA_ARGS__);    \
-                        netdev_dbg(dev, args);          \
        } while (0)
-#define PRINTK(dev, args...)   netdev_info(dev, args)
+#define PRINTK(dev, fmt, ...)                                   \
-#else
+        do {                                                    \
-#define DBG(n, dev, args...)   do { } while (0)
+                if (SMC_DEBUG > 0)                              \
-#define PRINTK(dev, args...)   netdev_dbg(dev, args)
+                        netdev_info(dev, fmt, ##__VA_ARGS__);   \
-#endif
+                else                                            \
+                        netdev_dbg(dev, fmt, ##__VA_ARGS__);    \
+        } while (0)
 #if SMC_DEBUG > 3
 static void PRINT_PKT(u_char *buf, int length)
@@ -191,7 +192,7 @@ static void PRINT_PKT(u_char *buf, int length)
        pr_cont("\n");
 }
 #else
-#define PRINT_PKT(x...)  do { } while (0)
+static inline void PRINT_PKT(u_char *buf, int length) { }
 #endif
@@ -1781,7 +1782,7 @@ static int smc_findirq(struct smc_local *lp)
        int timeout = 20;
        unsigned long cookie;
-        DBG(2, dev, "%s: %s\n", CARDNAME, __func__);
+        DBG(2, lp->dev, "%s: %s\n", CARDNAME, __func__);
        cookie = probe_irq_on();
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 31e55fba7cad..7918d5132c1f 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -382,6 +382,10 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
        if (skb_is_gso(skb))
                goto do_lso;
+        if ((skb->ip_summed == CHECKSUM_NONE) ||
+            (skb->ip_summed == CHECKSUM_UNNECESSARY))
+                goto do_send;
        rndis_msg_size += NDIS_CSUM_PPI_SIZE;
        ppi = init_ppi_data(rndis_msg, NDIS_CSUM_PPI_SIZE,
                            TCPIP_CHKSUM_PKTINFO);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 753a8c23d15d..b0e2865a6810 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -263,11 +263,9 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
        const struct macvlan_dev *vlan = netdev_priv(dev);
        const struct macvlan_port *port = vlan->port;
        const struct macvlan_dev *dest;
-        __u8 ip_summed = skb->ip_summed;
        if (vlan->mode == MACVLAN_MODE_BRIDGE) {
                const struct ethhdr *eth = (void *)skb->data;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
                /* send to other bridge ports directly */
                if (is_multicast_ether_addr(eth->h_dest)) {
@@ -285,7 +283,6 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
        }
 xmit_world:
-        skb->ip_summed = ip_summed;
        skb->dev = vlan->lowerdev;
        return dev_queue_xmit(skb);
 }
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index ff111a89e17f..3381c4f91a8c 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -322,6 +322,15 @@ static rx_handler_result_t macvtap_handle_frame(struct sk_buff **pskb)
                        segs = nskb;
                }
        } else {
+                /* If we receive a partial checksum and the tap side
+                 * doesn't support checksum offload, compute the checksum.
+                 * Note: it doesn't matter which checksum feature to
+                 *        check, we either support them all or none.
+                 */
+                if (skb->ip_summed == CHECKSUM_PARTIAL &&
+                    !(features & NETIF_F_ALL_CSUM) &&
+                    skb_checksum_help(skb))
+                        goto drop;
                skb_queue_tail(&q->sk.sk_receive_queue, skb);
        }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 5ad971a55c5d..d849684231c1 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -246,13 +246,13 @@ static int ksz9021_load_values_from_of(struct phy_device *phydev,
        if (val1 != -1)
                newval = ((newval & 0xfff0) | ((val1 / PS_TO_REG) & 0xf) << 0);
-        if (val2 != -1)
+        if (val2 != -2)
                newval = ((newval & 0xff0f) | ((val2 / PS_TO_REG) & 0xf) << 4);
-        if (val3 != -1)
+        if (val3 != -3)
                newval = ((newval & 0xf0ff) | ((val3 / PS_TO_REG) & 0xf) << 8);
-        if (val4 != -1)
+        if (val4 != -4)
                newval = ((newval & 0x0fff) | ((val4 / PS_TO_REG) & 0xf) << 12);
        return kszphy_extended_write(phydev, reg, newval);
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1b6d09aef427..a972056b2249 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -765,6 +765,17 @@ void phy_state_machine(struct work_struct *work)
                        break;
                if (phydev->link) {
+                        if (AUTONEG_ENABLE == phydev->autoneg) {
+                                err = phy_aneg_done(phydev);
+                                if (err < 0)
+                                        break;
+                                if (!err) {
+                                        phydev->state = PHY_AN;
+                                        phydev->link_timeout = PHY_AN_TIMEOUT;
+                                        break;
+                                }
+                        }
                        phydev->state = PHY_RUNNING;
                        netif_carrier_on(phydev->attached_dev);
                        phydev->adjust_link(phydev->attached_dev);
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index cc70ecfc7062..ad4a94e9ff57 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -429,13 +429,13 @@ static void slip_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
                return;
-        spin_lock(&sl->lock);
+        spin_lock_bh(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-                spin_unlock(&sl->lock);
+                spin_unlock_bh(&sl->lock);
                sl_unlock(sl);
                return;
        }
@@ -443,7 +443,7 @@ static void slip_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
-        spin_unlock(&sl->lock);
+        spin_unlock_bh(&sl->lock);
 }
 static void sl_tx_timeout(struct net_device *dev)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 33008c1d1d67..767fe61b5ac9 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2834,8 +2834,10 @@ static int team_device_event(struct notifier_block *unused,
        case NETDEV_UP:
                if (netif_carrier_ok(dev))
                        team_port_change_check(port, true);
+                break;
        case NETDEV_DOWN:
                team_port_change_check(port, false);
+                break;
        case NETDEV_CHANGE:
                if (netif_running(port->dev))
                        team_port_change_check(port,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 549dbac710ed..9a2bd11943eb 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -785,7 +785,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
            skb_out->len > CDC_NCM_MIN_TX_PKT)
                memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0,
                       ctx->tx_max - skb_out->len);
-        else if ((skb_out->len % dev->maxpacket) == 0)
+        else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0)
                *skb_put(skb_out, 1) = 0;       /* force short packet */
        /* set final frame length */
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index e3458e3c44f1..83208d4fdc59 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -669,6 +669,22 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
+        {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
+        {QMI_FIXED_INTF(0x16d8, 0x6007, 0)},    /* CMOTech CHE-628S */
+        {QMI_FIXED_INTF(0x16d8, 0x6008, 0)},    /* CMOTech CMU-301 */
+        {QMI_FIXED_INTF(0x16d8, 0x6280, 0)},    /* CMOTech CHU-628 */
+        {QMI_FIXED_INTF(0x16d8, 0x7001, 0)},    /* CMOTech CHU-720S */
+        {QMI_FIXED_INTF(0x16d8, 0x7002, 0)},    /* CMOTech 7002 */
+        {QMI_FIXED_INTF(0x16d8, 0x7003, 4)},    /* CMOTech CHU-629K */
+        {QMI_FIXED_INTF(0x16d8, 0x7004, 3)},    /* CMOTech 7004 */
+        {QMI_FIXED_INTF(0x16d8, 0x7006, 5)},    /* CMOTech CGU-629 */
+        {QMI_FIXED_INTF(0x16d8, 0x700a, 4)},    /* CMOTech CHU-629S */
+        {QMI_FIXED_INTF(0x16d8, 0x7211, 0)},    /* CMOTech CHU-720I */
+        {QMI_FIXED_INTF(0x16d8, 0x7212, 0)},    /* CMOTech 7212 */
+        {QMI_FIXED_INTF(0x16d8, 0x7213, 0)},    /* CMOTech 7213 */
+        {QMI_FIXED_INTF(0x16d8, 0x7251, 1)},    /* CMOTech 7251 */
+        {QMI_FIXED_INTF(0x16d8, 0x7252, 1)},    /* CMOTech 7252 */
+        {QMI_FIXED_INTF(0x16d8, 0x7253, 1)},    /* CMOTech 7253 */
        {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
        {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
        {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
@@ -730,16 +746,28 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
        {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
        {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
+        {QMI_FIXED_INTF(0x1199, 0x68c0, 8)},    /* Sierra Wireless MC73xx */
+        {QMI_FIXED_INTF(0x1199, 0x68c0, 10)},   /* Sierra Wireless MC73xx */
+        {QMI_FIXED_INTF(0x1199, 0x68c0, 11)},   /* Sierra Wireless MC73xx */
        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
+        {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
+        {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
        {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
        {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
+        {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},    /* Olivetti Olicard 500 */
        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
        {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},    /* Cinterion PHxx,PXxx */
+        {QMI_FIXED_INTF(0x413c, 0x81a2, 8)},    /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a3, 8)},    /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7b687469199b..8a852b5f215f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1285,7 +1285,7 @@ static int virtnet_set_channels(struct net_device *dev,
        if (channels->rx_count || channels->tx_count || channels->other_count)
                return -EINVAL;
-        if (queue_pairs > vi->max_queue_pairs)
+        if (queue_pairs > vi->max_queue_pairs || queue_pairs == 0)
                return -EINVAL;
        get_online_cpus();
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 82355d5d155a..4dbb2ed85b97 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -389,8 +389,8 @@ static inline size_t vxlan_nlmsg_size(void)
                + nla_total_size(sizeof(struct nda_cacheinfo));
 }
-static void vxlan_fdb_notify(struct vxlan_dev *vxlan,
+static void vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
-                             struct vxlan_fdb *fdb, int type)
+                             struct vxlan_rdst *rd, int type)
 {
        struct net *net = dev_net(vxlan->dev);
        struct sk_buff *skb;
@@ -400,8 +400,7 @@ static void vxlan_fdb_notify(struct vxlan_dev *vxlan,
        if (skb == NULL)
                goto errout;
-        err = vxlan_fdb_info(skb, vxlan, fdb, 0, 0, type, 0,
+        err = vxlan_fdb_info(skb, vxlan, fdb, 0, 0, type, 0, rd);
-                             first_remote_rtnl(fdb));
        if (err < 0) {
                /* -EMSGSIZE implies BUG in vxlan_nlmsg_size() */
                WARN_ON(err == -EMSGSIZE);
@@ -427,10 +426,7 @@ static void vxlan_ip_miss(struct net_device *dev, union vxlan_addr *ipa)
                .remote_vni = VXLAN_N_VID,
        };
-        INIT_LIST_HEAD(&f.remotes);
+        vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH);
-        list_add_rcu(&remote.list, &f.remotes);
-        vxlan_fdb_notify(vxlan, &f, RTM_GETNEIGH);
 }
 static void vxlan_fdb_miss(struct vxlan_dev *vxlan, const u8 eth_addr[ETH_ALEN])
@@ -438,11 +434,11 @@ static void vxlan_fdb_miss(struct vxlan_dev *vxlan, const u8 eth_addr[ETH_ALEN])
        struct vxlan_fdb f = {
                .state = NUD_STALE,
        };
+        struct vxlan_rdst remote = { };
-        INIT_LIST_HEAD(&f.remotes);
        memcpy(f.eth_addr, eth_addr, ETH_ALEN);
-        vxlan_fdb_notify(vxlan, &f, RTM_GETNEIGH);
+        vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH);
 }
 /* Hash Ethernet address */
@@ -533,7 +529,8 @@ static int vxlan_fdb_replace(struct vxlan_fdb *f,
 /* Add/update destinations for multicast */
 static int vxlan_fdb_append(struct vxlan_fdb *f,
-                            union vxlan_addr *ip, __be16 port, __u32 vni, __u32 ifindex)
+                            union vxlan_addr *ip, __be16 port, __u32 vni,
+                            __u32 ifindex, struct vxlan_rdst **rdp)
 {
        struct vxlan_rdst *rd;
@@ -551,6 +548,7 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
        list_add_tail_rcu(&rd->list, &f->remotes);
+        *rdp = rd;
        return 1;
 }
@@ -690,6 +688,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                            __be16 port, __u32 vni, __u32 ifindex,
                            __u8 ndm_flags)
 {
+        struct vxlan_rdst *rd = NULL;
        struct vxlan_fdb *f;
        int notify = 0;
@@ -726,7 +725,8 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                if ((flags & NLM_F_APPEND) &&
                    (is_multicast_ether_addr(f->eth_addr) ||
                     is_zero_ether_addr(f->eth_addr))) {
-                        int rc = vxlan_fdb_append(f, ip, port, vni, ifindex);
+                        int rc = vxlan_fdb_append(f, ip, port, vni, ifindex,
+                                                  &rd);
                        if (rc < 0)
                                return rc;
@@ -756,15 +756,18 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                INIT_LIST_HEAD(&f->remotes);
                memcpy(f->eth_addr, mac, ETH_ALEN);
-                vxlan_fdb_append(f, ip, port, vni, ifindex);
+                vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
                ++vxlan->addrcnt;
                hlist_add_head_rcu(&f->hlist,
                                   vxlan_fdb_head(vxlan, mac));
        }
-        if (notify)
+        if (notify) {
-                vxlan_fdb_notify(vxlan, f, RTM_NEWNEIGH);
+                if (rd == NULL)
+                        rd = first_remote_rtnl(f);
+                vxlan_fdb_notify(vxlan, f, rd, RTM_NEWNEIGH);
+        }
        return 0;
 }
@@ -785,7 +788,7 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
                    "delete %pM\n", f->eth_addr);
        --vxlan->addrcnt;
-        vxlan_fdb_notify(vxlan, f, RTM_DELNEIGH);
+        vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH);
        hlist_del_rcu(&f->hlist);
        call_rcu(&f->rcu, vxlan_fdb_free);
@@ -919,6 +922,7 @@ static int vxlan_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
         */
        if (rd && !list_is_singular(&f->remotes)) {
                list_del_rcu(&rd->list);
+                vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
                kfree_rcu(rd, rcu);
                goto out;
        }
@@ -993,7 +997,7 @@ static bool vxlan_snoop(struct net_device *dev,
                rdst->remote_ip = *src_ip;
                f->updated = jiffies;
-                vxlan_fdb_notify(vxlan, f, RTM_NEWNEIGH);
+                vxlan_fdb_notify(vxlan, f, rdst, RTM_NEWNEIGH);
        } else {
                /* learned new entry */
                spin_lock(&vxlan->hash_lock);
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index a0398fe3eb28..be3eb2a8d602 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -86,7 +86,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
        int irq;
        int ret = 0;
        struct ath_hw *ah;
-        struct ath_common *common;
        char hw_name[64];
        if (!dev_get_platdata(&pdev->dev)) {
@@ -146,9 +145,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
        wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                   hw_name, (unsigned long)mem, irq);
-        common = ath9k_hw_common(sc->sc_ah);
-        /* Will be cleared in ath9k_start() */
-        set_bit(ATH_OP_INVALID, &common->op_flags);
        return 0;
 err_irq:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 6d47783f2e5b..ba502a2d199b 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -155,6 +155,9 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
                ATH9K_ANI_RSSI_THR_LOW,
                ATH9K_ANI_RSSI_THR_HIGH);
+        if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_OFDM_DEF_LEVEL)
+                immunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;
        if (!scan)
                aniState->ofdmNoiseImmunityLevel = immunityLevel;
@@ -235,6 +238,9 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
                BEACON_RSSI(ah), ATH9K_ANI_RSSI_THR_LOW,
                ATH9K_ANI_RSSI_THR_HIGH);
+        if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_CCK_DEF_LEVEL)
+                immunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
        if (ah->opmode == NL80211_IFTYPE_STATION &&
            BEACON_RSSI(ah) <= ATH9K_ANI_RSSI_THR_LOW &&
            immunityLevel > ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI)
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 44d74495c4de..3ba03dde4215 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -251,7 +251,6 @@ struct ath_atx_tid {
        s8 bar_index;
        bool sched;
-        bool paused;
        bool active;
 };
diff --git a/drivers/net/wireless/ath/ath9k/debug_sta.c b/drivers/net/wireless/ath/ath9k/debug_sta.c
index d76e6e0120d2..ffca918ff16a 100644
--- a/drivers/net/wireless/ath/ath9k/debug_sta.c
+++ b/drivers/net/wireless/ath/ath9k/debug_sta.c
@@ -72,7 +72,7 @@ static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
                ath_txq_lock(sc, txq);
                if (tid->active) {
                        len += scnprintf(buf + len, size - len,
-                                         "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                         "%3d%11d%10d%10d%10d%10d%9d%6d\n",
                                         tid->tidno,
                                         tid->seq_start,
                                         tid->seq_next,
@@ -80,8 +80,7 @@ static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
                                         tid->baw_head,
                                         tid->baw_tail,
                                         tid->bar_index,
-                                         tid->sched,
+                                         tid->sched);
-                                         tid->paused);
                }
                ath_txq_unlock(sc, txq);
        }
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index cbbb02a6b13b..36ae6490e554 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -783,6 +783,9 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
        common = ath9k_hw_common(ah);
        ath9k_set_hw_capab(sc, hw);
+        /* Will be cleared in ath9k_start() */
+        set_bit(ATH_OP_INVALID, &common->op_flags);
        /* Initialize regulatory */
        error = ath_regd_init(&common->regulatory, sc->hw->wiphy,
                              ath9k_reg_notifier);
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 25304adece57..914dbc6b1720 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -784,7 +784,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
        struct ath_softc *sc;
        struct ieee80211_hw *hw;
-        struct ath_common *common;
        u8 csz;
        u32 val;
        int ret = 0;
@@ -877,10 +876,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                   hw_name, (unsigned long)sc->mem, pdev->irq);
-        /* Will be cleared in ath9k_start() */
-        common = ath9k_hw_common(sc->sc_ah);
-        set_bit(ATH_OP_INVALID, &common->op_flags);
        return 0;
 err_init:
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 6c9accdb52e4..19df969ec909 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -975,6 +975,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
        u64 tsf = 0;
        unsigned long flags;
        dma_addr_t new_buf_addr;
+        unsigned int budget = 512;
        if (edma)
                dma_type = DMA_BIDIRECTIONAL;
@@ -1113,15 +1114,17 @@ requeue_drop_frag:
                }
 requeue:
                list_add_tail(&bf->list, &sc->rx.rxbuf);
-                if (flush)
-                        continue;
                if (edma) {
                        ath_rx_edma_buf_link(sc, qtype);
                } else {
                        ath_rx_buf_relink(sc, bf);
-                        ath9k_hw_rxena(ah);
+                        if (!flush)
+                                ath9k_hw_rxena(ah);
                }
+                if (!budget--)
+                        break;
        } while (1);
        if (!(ah->imask & ATH9K_INT_RXEOL)) {
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 87cbec47fb48..66acb2cbd9df 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -107,9 +107,6 @@ static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
 {
        struct ath_atx_ac *ac = tid->ac;
-        if (tid->paused)
-                return;
        if (tid->sched)
                return;
@@ -1407,7 +1404,6 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
        ath_tx_tid_change_state(sc, txtid);
        txtid->active = true;
-        txtid->paused = true;
        *ssn = txtid->seq_start = txtid->seq_next;
        txtid->bar_index = -1;
@@ -1427,7 +1423,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
        ath_txq_lock(sc, txq);
        txtid->active = false;
-        txtid->paused = false;
        ath_tx_flush_tid(sc, txtid);
        ath_tx_tid_change_state(sc, txtid);
        ath_txq_unlock_complete(sc, txq);
@@ -1487,7 +1482,7 @@ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
                ath_txq_lock(sc, txq);
                ac->clear_ps_filter = true;
-                if (!tid->paused && ath_tid_has_buffered(tid)) {
+                if (ath_tid_has_buffered(tid)) {
                        ath_tx_queue_tid(txq, tid);
                        ath_txq_schedule(sc, txq);
                }
@@ -1510,7 +1505,6 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
        ath_txq_lock(sc, txq);
        tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-        tid->paused = false;
        if (ath_tid_has_buffered(tid)) {
                ath_tx_queue_tid(txq, tid);
@@ -1544,8 +1538,6 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                        continue;
                tid = ATH_AN_2_TID(an, i);
-                if (tid->paused)
-                        continue;
                ath_txq_lock(sc, tid->ac->txq);
                while (nframes > 0) {
@@ -1844,9 +1836,6 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
                        list_del(&tid->list);
                        tid->sched = false;
-                        if (tid->paused)
-                                continue;
                        if (ath_tx_sched_aggr(sc, txq, tid, &stop))
                                sent = true;
@@ -2698,7 +2687,6 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
                tid->baw_size  = WME_MAX_BA;
                tid->baw_head  = tid->baw_tail = 0;
                tid->sched     = false;
-                tid->paused    = false;
                tid->active        = false;
                __skb_queue_head_init(&tid->buf_q);
                __skb_queue_head_init(&tid->retry_q);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index df130ef53d1c..c7c9f15c0fe0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -303,10 +303,10 @@ static void brcmf_chip_ai_coredisable(struct brcmf_core_priv *core,
        ci = core->chip;
-        /* if core is already in reset, just return */
+        /* if core is already in reset, skip reset */
        regdata = ci->ops->read32(ci->ctx, core->wrapbase + BCMA_RESET_CTL);
        if ((regdata & BCMA_RESET_CTL_RESET) != 0)
-                return;
+                goto in_reset_configure;
        /* configure reset */
        ci->ops->write32(ci->ctx, core->wrapbase + BCMA_IOCTL,
@@ -322,6 +322,7 @@ static void brcmf_chip_ai_coredisable(struct brcmf_core_priv *core,
        SPINWAIT(ci->ops->read32(ci->ctx, core->wrapbase + BCMA_RESET_CTL) !=
                 BCMA_RESET_CTL_RESET, 300);
+in_reset_configure:
        /* in-reset configure */
        ci->ops->write32(ci->ctx, core->wrapbase + BCMA_IOCTL,
                         reset | BCMA_IOCTL_FGC | BCMA_IOCTL_CLK);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ddeb5a709aa3..a87ee9b6585a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -621,20 +621,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                      bss_conf->bssid);
        /*
-         * Update the beacon. This is only required on USB devices. PCI
-         * devices fetch beacons periodically.
-         */
-        if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
-                rt2x00queue_update_beacon(rt2x00dev, vif);
-        /*
         * Start/stop beaconing.
         */
        if (changes & BSS_CHANGED_BEACON_ENABLED) {
                if (!bss_conf->enable_beacon && intf->enable_beacon) {
-                        rt2x00queue_clear_beacon(rt2x00dev, vif);
                        rt2x00dev->intf_beaconing--;
                        intf->enable_beacon = false;
+                        /*
+                         * Clear beacon in the H/W for this vif. This is needed
+                         * to disable beaconing on this particular interface
+                         * and keep it running on other interfaces.
+                         */
+                        rt2x00queue_clear_beacon(rt2x00dev, vif);
                        if (rt2x00dev->intf_beaconing == 0) {
                                /*
@@ -645,11 +643,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                rt2x00queue_stop_queue(rt2x00dev->bcn);
                                mutex_unlock(&intf->beacon_skb_mutex);
                        }
                } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
                        rt2x00dev->intf_beaconing++;
                        intf->enable_beacon = true;
+                        /*
+                         * Upload beacon to the H/W. This is only required on
+                         * USB devices. PCI devices fetch beacons periodically.
+                         */
+                        if (rt2x00_is_usb(rt2x00dev))
+                                rt2x00queue_update_beacon(rt2x00dev, vif);
                        if (rt2x00dev->intf_beaconing == 1) {
                                /*
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index 06ef47cd6203..5b4c225396f2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -293,7 +293,7 @@ static void _rtl88ee_translate_rx_signal_stuff(struct ieee80211_hw *hw,
        u8 *psaddr;
        __le16 fc;
        u16 type, ufc;
-        bool match_bssid, packet_toself, packet_beacon, addr;
+        bool match_bssid, packet_toself, packet_beacon = false, addr;
        tmp_buf = skb->data + pstatus->rx_drvinfo_size + pstatus->rx_bufshift;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 68b5c7e92cfb..07cb06da6729 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
        err = _rtl92cu_init_mac(hw);
        if (err) {
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n");
-                return err;
+                goto exit;
        }
        err = rtl92c_download_fw(hw);
        if (err) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 36b48be8329c..2b3c78baa9f8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -49,6 +49,12 @@ static u8 _rtl92se_map_hwqueue_to_fwqueue(struct sk_buff *skb,	u8 skb_queue)
        if (ieee80211_is_nullfunc(fc))
                return QSLT_HIGH;
+        /* Kernel commit 1bf4bbb4024dcdab changed EAPOL packets to use
+         * queue V0 at priority 7; however, the RTL8192SE appears to have
+         * that queue at priority 6
+         */
+        if (skb->priority == 7)
+                return QSLT_VO;
        return skb->priority;
 }
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 6d4ee22708c9..32e969d95319 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1831,6 +1831,10 @@ int of_update_property(struct device_node *np, struct property *newprop)
        if (!found)
                return -ENODEV;
+        /* At early boot, bail out and defer setup to of_init() */
+        if (!of_kset)
+                return found ? 0 : -ENODEV;
        /* Update the sysfs attribute */
        sysfs_remove_bin_file(&np->kobj, &oldprop->attr);
        __of_add_property_sysfs(np, newprop);
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 9bcf2cf19357..5aeb89411350 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -364,7 +364,7 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
                memset(r, 0, sizeof(*r));
                /*
-                 * Get optional "interrupts-names" property to add a name
+                 * Get optional "interrupt-names" property to add a name
                 * to the resource.
                 */
                of_property_read_string_index(dev, "interrupt-names", index,
@@ -380,6 +380,32 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
 EXPORT_SYMBOL_GPL(of_irq_to_resource);
 /**
+ * of_irq_get - Decode a node's IRQ and return it as a Linux irq number
+ * @dev: pointer to device tree node
+ * @index: zero-based index of the irq
+ *
+ * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
+ * is not yet created.
+ *
+ */
+int of_irq_get(struct device_node *dev, int index)
+{
+        int rc;
+        struct of_phandle_args oirq;
+        struct irq_domain *domain;
+        rc = of_irq_parse_one(dev, index, &oirq);
+        if (rc)
+                return rc;
+        domain = irq_find_host(oirq.np);
+        if (!domain)
+                return -EPROBE_DEFER;
+        return irq_create_of_mapping(&oirq);
+}
+/**
 * of_irq_count - Count the number of IRQs a node uses
 * @dev: pointer to device tree node
 */
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 404d1daebefa..bd47fbc53dc9 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -168,7 +168,9 @@ struct platform_device *of_device_alloc(struct device_node *np,
                        rc = of_address_to_resource(np, i, res);
                        WARN_ON(rc);
                }
-                WARN_ON(of_irq_to_resource_table(np, res, num_irq) != num_irq);
+                if (of_irq_to_resource_table(np, res, num_irq) != num_irq)
+                        pr_debug("not all legacy IRQ resources mapped for %s\n",
+                                 np->name);
        }
        dev->dev.of_node = of_node_get(np);
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index ae4450070503..fe70b86bcffb 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
+#include <linux/of_platform.h>
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
@@ -427,6 +428,36 @@ static void __init of_selftest_match_node(void)
        }
 }
+static void __init of_selftest_platform_populate(void)
+{
+        int irq;
+        struct device_node *np;
+        struct platform_device *pdev;
+        np = of_find_node_by_path("/testcase-data");
+        of_platform_populate(np, of_default_bus_match_table, NULL, NULL);
+        /* Test that a missing irq domain returns -EPROBE_DEFER */
+        np = of_find_node_by_path("/testcase-data/testcase-device1");
+        pdev = of_find_device_by_node(np);
+        if (!pdev)
+                selftest(0, "device 1 creation failed\n");
+        irq = platform_get_irq(pdev, 0);
+        if (irq != -EPROBE_DEFER)
+                selftest(0, "device deferred probe failed - %d\n", irq);
+        /* Test that a parsing failure does not return -EPROBE_DEFER */
+        np = of_find_node_by_path("/testcase-data/testcase-device2");
+        pdev = of_find_device_by_node(np);
+        if (!pdev)
+                selftest(0, "device 2 creation failed\n");
+        irq = platform_get_irq(pdev, 0);
+        if (irq >= 0 || irq == -EPROBE_DEFER)
+                selftest(0, "device parsing error failed - %d\n", irq);
+        selftest(1, "passed");
+}
 static int __init of_selftest(void)
 {
        struct device_node *np;
@@ -445,6 +476,7 @@ static int __init of_selftest(void)
        of_selftest_parse_interrupts();
        of_selftest_parse_interrupts_extended();
        of_selftest_match_node();
+        of_selftest_platform_populate();
        pr_info("end of selftest - %i passed, %i failed\n",
                selftest_results.passed, selftest_results.failed);
        return 0;
diff --git a/drivers/of/testcase-data/tests-interrupts.dtsi b/drivers/of/testcase-data/tests-interrupts.dtsi
index c843720bd3e5..da4695f60351 100644
--- a/drivers/of/testcase-data/tests-interrupts.dtsi
+++ b/drivers/of/testcase-data/tests-interrupts.dtsi
@@ -54,5 +54,18 @@
                                                      <&test_intmap1 1 2>;
                        };
                };
+                testcase-device1 {
+                        compatible = "testcase-device";
+                        interrupt-parent = <&test_intc0>;
+                        interrupts = <1>;
+                };
+                testcase-device2 {
+                        compatible = "testcase-device";
+                        interrupt-parent = <&test_intc2>;
+                        interrupts = <1>; /* invalid specifier - too short */
+                };
        };
 };
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index d3d1cfd51e09..e384e2534594 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -293,6 +293,58 @@ static int mvebu_pcie_hw_wr_conf(struct mvebu_pcie_port *port,
        return PCIBIOS_SUCCESSFUL;
 }
+/*
+ * Remove windows, starting from the largest ones to the smallest
+ * ones.
+ */
+static void mvebu_pcie_del_windows(struct mvebu_pcie_port *port,
+                                   phys_addr_t base, size_t size)
+{
+        while (size) {
+                size_t sz = 1 << (fls(size) - 1);
+                mvebu_mbus_del_window(base, sz);
+                base += sz;
+                size -= sz;
+        }
+}
+/*
+ * MBus windows can only have a power of two size, but PCI BARs do not
+ * have this constraint. Therefore, we have to split the PCI BAR into
+ * areas each having a power of two size. We start from the largest
+ * one (i.e highest order bit set in the size).
+ */
+static void mvebu_pcie_add_windows(struct mvebu_pcie_port *port,
+                                   unsigned int target, unsigned int attribute,
+                                   phys_addr_t base, size_t size,
+                                   phys_addr_t remap)
+{
+        size_t size_mapped = 0;
+        while (size) {
+                size_t sz = 1 << (fls(size) - 1);
+                int ret;
+                ret = mvebu_mbus_add_window_remap_by_id(target, attribute, base,
+                                                        sz, remap);
+                if (ret) {
+                        dev_err(&port->pcie->pdev->dev,
+                                "Could not create MBus window at 0x%x, size 0x%x: %d\n",
+                                base, sz, ret);
+                        mvebu_pcie_del_windows(port, base - size_mapped,
+                                               size_mapped);
+                        return;
+                }
+                size -= sz;
+                size_mapped += sz;
+                base += sz;
+                if (remap != MVEBU_MBUS_NO_REMAP)
+                        remap += sz;
+        }
+}
 static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
 {
        phys_addr_t iobase;
@@ -304,8 +356,8 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
                /* If a window was configured, remove it */
                if (port->iowin_base) {
-                        mvebu_mbus_del_window(port->iowin_base,
+                        mvebu_pcie_del_windows(port, port->iowin_base,
-                                              port->iowin_size);
+                                               port->iowin_size);
                        port->iowin_base = 0;
                        port->iowin_size = 0;
                }
@@ -331,11 +383,11 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
        port->iowin_base = port->pcie->io.start + iobase;
        port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
                            (port->bridge.iolimitupper << 16)) -
-                            iobase);
+                            iobase) + 1;
-        mvebu_mbus_add_window_remap_by_id(port->io_target, port->io_attr,
+        mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
-                                          port->iowin_base, port->iowin_size,
+                               port->iowin_base, port->iowin_size,
-                                          iobase);
+                               iobase);
 }
 static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
@@ -346,8 +398,8 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
                /* If a window was configured, remove it */
                if (port->memwin_base) {
-                        mvebu_mbus_del_window(port->memwin_base,
+                        mvebu_pcie_del_windows(port, port->memwin_base,
-                                              port->memwin_size);
+                                               port->memwin_size);
                        port->memwin_base = 0;
                        port->memwin_size = 0;
                }
@@ -364,10 +416,11 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
        port->memwin_base  = ((port->bridge.membase & 0xFFF0) << 16);
        port->memwin_size  =
                (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
-                port->memwin_base;
+                port->memwin_base + 1;
-        mvebu_mbus_add_window_by_id(port->mem_target, port->mem_attr,
+        mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr,
-                                    port->memwin_base, port->memwin_size);
+                               port->memwin_base, port->memwin_size,
+                               MVEBU_MBUS_NO_REMAP);
 }
 /*
@@ -743,14 +796,21 @@ static resource_size_t mvebu_pcie_align_resource(struct pci_dev *dev,
        /*
         * On the PCI-to-PCI bridge side, the I/O windows must have at
-         * least a 64 KB size and be aligned on their size, and the
+         * least a 64 KB size and the memory windows must have at
-         * memory windows must have at least a 1 MB size and be
+         * least a 1 MB size. Moreover, MBus windows need to have a
-         * aligned on their size
+         * base address aligned on their size, and their size must be
+         * a power of two. This means that if the BAR doesn't have a
+         * power of two size, several MBus windows will actually be
+         * created. We need to ensure that the biggest MBus window
+         * (which will be the first one) is aligned on its size, which
+         * explains the rounddown_pow_of_two() being done here.
         */
        if (res->flags & IORESOURCE_IO)
-                return round_up(start, max_t(resource_size_t, SZ_64K, size));
+                return round_up(start, max_t(resource_size_t, SZ_64K,
+                                             rounddown_pow_of_two(size)));
        else if (res->flags & IORESOURCE_MEM)
-                return round_up(start, max_t(resource_size_t, SZ_1M, size));
+                return round_up(start, max_t(resource_size_t, SZ_1M,
+                                             rounddown_pow_of_two(size)));
        else
                return start;
 }
diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
index 58499277903a..6efc2ec5e4db 100644
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -282,8 +282,8 @@ static int board_added(struct slot *p_slot)
                return WRONG_BUS_FREQUENCY;
        }
-        bsp = ctrl->pci_dev->bus->cur_bus_speed;
+        bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
-        msp = ctrl->pci_dev->bus->max_bus_speed;
+        msp = ctrl->pci_dev->subordinate->max_bus_speed;
        /* Check if there are other slots or devices on the same bus */
        if (!list_empty(&ctrl->pci_dev->subordinate->devices))
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 7325d43bf030..759475ef6ff3 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3067,7 +3067,8 @@ int pci_wait_for_pending_transaction(struct pci_dev *dev)
        if (!pci_is_pcie(dev))
                return 1;
-        return pci_wait_for_pending(dev, PCI_EXP_DEVSTA, PCI_EXP_DEVSTA_TRPND);
+        return pci_wait_for_pending(dev, pci_pcie_cap(dev) + PCI_EXP_DEVSTA,
+                                    PCI_EXP_DEVSTA_TRPND);
 }
 EXPORT_SYMBOL(pci_wait_for_pending_transaction);
@@ -3109,7 +3110,7 @@ static int pci_af_flr(struct pci_dev *dev, int probe)
                return 0;
        /* Wait for Transaction Pending bit clean */
-        if (pci_wait_for_pending(dev, PCI_AF_STATUS, PCI_AF_STATUS_TP))
+        if (pci_wait_for_pending(dev, pos + PCI_AF_STATUS, PCI_AF_STATUS_TP))
                goto clear;
        dev_err(&dev->dev, "transaction is not cleared; "
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index 3bb05f17b9b4..4906c27fa3bd 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -33,6 +33,7 @@ config PHY_MVEBU_SATA
 config OMAP_CONTROL_PHY
        tristate "OMAP CONTROL PHY Driver"
+        depends on ARCH_OMAP2PLUS || COMPILE_TEST
        help
          Enable this to add support for the PHY part present in the control
          module. This driver has API to power on the USB2 PHY and to write to
diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
index 2faf78edc864..7728518572a4 100644
--- a/drivers/phy/Makefile
+++ b/drivers/phy/Makefile
@@ -13,8 +13,9 @@ obj-$(CONFIG_TI_PIPE3)			+= phy-ti-pipe3.o
 obj-$(CONFIG_TWL4030_USB)               += phy-twl4030-usb.o
 obj-$(CONFIG_PHY_EXYNOS5250_SATA)       += phy-exynos5250-sata.o
 obj-$(CONFIG_PHY_SUN4I_USB)             += phy-sun4i-usb.o
-obj-$(CONFIG_PHY_SAMSUNG_USB2)          += phy-samsung-usb2.o
+obj-$(CONFIG_PHY_SAMSUNG_USB2)          += phy-exynos-usb2.o
-obj-$(CONFIG_PHY_EXYNOS4210_USB2)       += phy-exynos4210-usb2.o
+phy-exynos-usb2-y                       += phy-samsung-usb2.o
-obj-$(CONFIG_PHY_EXYNOS4X12_USB2)       += phy-exynos4x12-usb2.o
+phy-exynos-usb2-$(CONFIG_PHY_EXYNOS4210_USB2)   += phy-exynos4210-usb2.o
-obj-$(CONFIG_PHY_EXYNOS5250_USB2)       += phy-exynos5250-usb2.o
+phy-exynos-usb2-$(CONFIG_PHY_EXYNOS4X12_USB2)   += phy-exynos4x12-usb2.o
+phy-exynos-usb2-$(CONFIG_PHY_EXYNOS5250_USB2)   += phy-exynos5250-usb2.o
 obj-$(CONFIG_PHY_XGENE)                 += phy-xgene.o
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 623b71c54b3e..c64a2f3b2d62 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -64,6 +64,9 @@ static struct phy *phy_lookup(struct device *device, const char *port)
        class_dev_iter_init(&iter, phy_class, NULL, NULL);
        while ((dev = class_dev_iter_next(&iter))) {
                phy = to_phy(dev);
+                if (!phy->init_data)
+                        continue;
                count = phy->init_data->num_consumers;
                consumers = phy->init_data->consumers;
                while (count--) {
diff --git a/drivers/pinctrl/pinctrl-as3722.c b/drivers/pinctrl/pinctrl-as3722.c
index 92ed4b2e3c07..c862f9c0e9ce 100644
--- a/drivers/pinctrl/pinctrl-as3722.c
+++ b/drivers/pinctrl/pinctrl-as3722.c
@@ -64,7 +64,6 @@ struct as3722_pin_function {
 };
 struct as3722_gpio_pin_control {
-        bool enable_gpio_invert;
        unsigned mode_prop;
        int io_function;
 };
@@ -320,10 +319,8 @@ static int as3722_pinctrl_gpio_set_direction(struct pinctrl_dev *pctldev,
                return mode;
        }
-        if (as_pci->gpio_control[offset].enable_gpio_invert)
+        return as3722_update_bits(as3722, AS3722_GPIOn_CONTROL_REG(offset),
-                mode |= AS3722_GPIO_INV;
+                                AS3722_GPIO_MODE_MASK, mode);
-        return as3722_write(as3722, AS3722_GPIOn_CONTROL_REG(offset), mode);
 }
 static const struct pinmux_ops as3722_pinmux_ops = {
@@ -496,10 +493,18 @@ static void as3722_gpio_set(struct gpio_chip *chip, unsigned offset,
 {
        struct as3722_pctrl_info *as_pci = to_as_pci(chip);
        struct as3722 *as3722 = as_pci->as3722;
-        int en_invert = as_pci->gpio_control[offset].enable_gpio_invert;
+        int en_invert;
        u32 val;
        int ret;
+        ret = as3722_read(as3722, AS3722_GPIOn_CONTROL_REG(offset), &val);
+        if (ret < 0) {
+                dev_err(as_pci->dev,
+                        "GPIO_CONTROL%d_REG read failed: %d\n", offset, ret);
+                return;
+        }
+        en_invert = !!(val & AS3722_GPIO_INV);
        if (value)
                val = (en_invert) ? 0 : AS3722_GPIOn_SIGNAL(offset);
        else
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 81075f2a1d3f..2960557bfed9 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -810,6 +810,7 @@ static const struct pinconf_ops pcs_pinconf_ops = {
 static int pcs_add_pin(struct pcs_device *pcs, unsigned offset,
                unsigned pin_pos)
 {
+        struct pcs_soc_data *pcs_soc = &pcs->socdata;
        struct pinctrl_pin_desc *pin;
        struct pcs_name *pn;
        int i;
@@ -821,6 +822,18 @@ static int pcs_add_pin(struct pcs_device *pcs, unsigned offset,
                return -ENOMEM;
        }
+        if (pcs_soc->irq_enable_mask) {
+                unsigned val;
+                val = pcs->read(pcs->base + offset);
+                if (val & pcs_soc->irq_enable_mask) {
+                        dev_dbg(pcs->dev, "irq enabled at boot for pin at %lx (%x), clearing\n",
+                                (unsigned long)pcs->res->start + offset, val);
+                        val &= ~pcs_soc->irq_enable_mask;
+                        pcs->write(val, pcs->base + offset);
+                }
+        }
        pin = &pcs->pins.pa[i];
        pn = &pcs->names[i];
        sprintf(pn->name, "%lx.%d",
diff --git a/drivers/pinctrl/pinctrl-tb10x.c b/drivers/pinctrl/pinctrl-tb10x.c
index c5e0f6973a3b..26ca6855f478 100644
--- a/drivers/pinctrl/pinctrl-tb10x.c
+++ b/drivers/pinctrl/pinctrl-tb10x.c
@@ -629,9 +629,8 @@ static int tb10x_gpio_request_enable(struct pinctrl_dev *pctl,
         */
        for (i = 0; i < state->pinfuncgrpcnt; i++) {
                const struct tb10x_pinfuncgrp *pfg = &state->pingroups[i];
-                unsigned int port = pfg->port;
                unsigned int mode = pfg->mode;
-                int j;
+                int j, port = pfg->port;
                /*
                 * Skip pin groups which are always mapped and don't need
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7790.c b/drivers/pinctrl/sh-pfc/pfc-r8a7790.c
index 48093719167a..f5cd3f961808 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7790.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7790.c
@@ -4794,8 +4794,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                FN_MSIOF0_SCK_B, 0,
                /* IP5_23_21 [3] */
                FN_WE1_N, FN_IERX, FN_CAN1_RX, FN_VI1_G4,
-                FN_VI1_G4_B, FN_VI2_R6, FN_SCIFA0_CTS_N_B,
+                FN_VI1_G4_B, FN_VI2_R6, FN_SCIFA0_CTS_N_B, FN_IERX_C,
-                FN_IERX_C, 0,
                /* IP5_20_18 [3] */
                FN_WE0_N, FN_IECLK, FN_CAN_CLK,
                FN_VI2_VSYNC_N, FN_SCIFA0_TXD_B, FN_VI2_VSYNC_N_B, 0, 0,
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 5186d70c49d4..7868bf3a0f91 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -5288,7 +5288,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                /* SEL_SCIF3 [2] */
                FN_SEL_SCIF3_0, FN_SEL_SCIF3_1, FN_SEL_SCIF3_2, FN_SEL_SCIF3_3,
                /* SEL_IEB [2] */
-                FN_SEL_IEB_0, FN_SEL_IEB_1, FN_SEL_IEB_2,
+                FN_SEL_IEB_0, FN_SEL_IEB_1, FN_SEL_IEB_2, 0,
                /* SEL_MMC [1] */
                FN_SEL_MMC_0, FN_SEL_MMC_1,
                /* SEL_SCIF5 [1] */
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index 9f611cbbc294..c31aa07b3ba5 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -83,8 +83,7 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
 {
        struct acpi_device *acpi_dev;
        acpi_handle handle;
-        struct acpi_buffer buffer;
+        int ret = 0;
-        int ret;
        pnp_dbg(&dev->dev, "set resources\n");
@@ -97,19 +96,26 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
        if (WARN_ON_ONCE(acpi_dev != dev->data))
                dev->data = acpi_dev;
-        ret = pnpacpi_build_resource_template(dev, &buffer);
+        if (acpi_has_method(handle, METHOD_NAME__SRS)) {
-        if (ret)
+                struct acpi_buffer buffer;
-                return ret;
-        ret = pnpacpi_encode_resources(dev, &buffer);
+                ret = pnpacpi_build_resource_template(dev, &buffer);
-        if (ret) {
+                if (ret)
+                        return ret;
+                ret = pnpacpi_encode_resources(dev, &buffer);
+                if (!ret) {
+                        acpi_status status;
+                        status = acpi_set_current_resources(handle, &buffer);
+                        if (ACPI_FAILURE(status))
+                                ret = -EIO;
+                }
                kfree(buffer.pointer);
-                return ret;
        }
-        if (ACPI_FAILURE(acpi_set_current_resources(handle, &buffer)))
+        if (!ret && acpi_bus_power_manageable(handle))
-                ret = -EINVAL;
-        else if (acpi_bus_power_manageable(handle))
                ret = acpi_bus_set_power(handle, ACPI_STATE_D0);
-        kfree(buffer.pointer);
        return ret;
 }
@@ -117,7 +123,7 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
 {
        struct acpi_device *acpi_dev;
        acpi_handle handle;
-        int ret;
+        acpi_status status;
        dev_dbg(&dev->dev, "disable resources\n");
@@ -128,13 +134,15 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
        }
        /* acpi_unregister_gsi(pnp_irq(dev, 0)); */
-        ret = 0;
        if (acpi_bus_power_manageable(handle))
                acpi_bus_set_power(handle, ACPI_STATE_D3_COLD);
-                /* continue even if acpi_bus_set_power() fails */
-        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL)))
+        /* continue even if acpi_bus_set_power() fails */
-                ret = -ENODEV;
+        status = acpi_evaluate_object(handle, "_DIS", NULL, NULL);
-        return ret;
+        if (ACPI_FAILURE(status) && status != AE_NOT_FOUND)
+                return -ENODEV;
+        return 0;
 }
 #ifdef CONFIG_ACPI_SLEEP
diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
index deb7f4bcdb7b..438d4c72c7b3 100644
--- a/drivers/pnp/pnpbios/bioscalls.c
+++ b/drivers/pnp/pnpbios/bioscalls.c
@@ -37,7 +37,7 @@ __visible struct {
 * kernel begins at offset 3GB...
 */
-asmlinkage void pnp_bios_callfunc(void);
+asmlinkage __visible void pnp_bios_callfunc(void);
 __asm__(".text                  \n"
        __ALIGN_STR "\n"
diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
index 258fef272ea7..ebf0d6710b5a 100644
--- a/drivers/pnp/quirks.c
+++ b/drivers/pnp/quirks.c
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/pci.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/pnp.h>
@@ -334,6 +335,81 @@ static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
 }
 #endif
+#ifdef CONFIG_PCI
+/* Device IDs of parts that have 32KB MCH space */
+static const unsigned int mch_quirk_devices[] = {
+        0x0154, /* Ivy Bridge */
+        0x0c00, /* Haswell */
+};
+static struct pci_dev *get_intel_host(void)
+{
+        int i;
+        struct pci_dev *host;
+        for (i = 0; i < ARRAY_SIZE(mch_quirk_devices); i++) {
+                host = pci_get_device(PCI_VENDOR_ID_INTEL, mch_quirk_devices[i],
+                                      NULL);
+                if (host)
+                        return host;
+        }
+        return NULL;
+}
+static void quirk_intel_mch(struct pnp_dev *dev)
+{
+        struct pci_dev *host;
+        u32 addr_lo, addr_hi;
+        struct pci_bus_region region;
+        struct resource mch;
+        struct pnp_resource *pnp_res;
+        struct resource *res;
+        host = get_intel_host();
+        if (!host)
+                return;
+        /*
+         * MCHBAR is not an architected PCI BAR, so MCH space is usually
+         * reported as a PNP0C02 resource.  The MCH space was originally
+         * 16KB, but is 32KB in newer parts.  Some BIOSes still report a
+         * PNP0C02 resource that is only 16KB, which means the rest of the
+         * MCH space is consumed but unreported.
+         */
+        /*
+         * Read MCHBAR for Host Member Mapped Register Range Base
+         * https://www-ssl.intel.com/content/www/us/en/processors/core/4th-gen-core-family-desktop-vol-2-datasheet
+         * Sec 3.1.12.
+         */
+        pci_read_config_dword(host, 0x48, &addr_lo);
+        region.start = addr_lo & ~0x7fff;
+        pci_read_config_dword(host, 0x4c, &addr_hi);
+        region.start |= (u64) addr_hi << 32;
+        region.end = region.start + 32*1024 - 1;
+        memset(&mch, 0, sizeof(mch));
+        mch.flags = IORESOURCE_MEM;
+        pcibios_bus_to_resource(host->bus, &mch, &region);
+        list_for_each_entry(pnp_res, &dev->resources, list) {
+                res = &pnp_res->res;
+                if (res->end < mch.start || res->start > mch.end)
+                        continue;       /* no overlap */
+                if (res->start == mch.start && res->end == mch.end)
+                        continue;       /* exact match */
+                dev_info(&dev->dev, FW_BUG "PNP resource %pR covers only part of %s Intel MCH; extending to %pR\n",
+                         res, pci_name(host), &mch);
+                res->start = mch.start;
+                res->end = mch.end;
+                break;
+        }
+        pci_dev_put(host);
+}
+#endif
 /*
 *  PnP Quirks
 *  Cards or devices that need some tweaking due to incomplete resource info
@@ -364,6 +440,9 @@ static struct pnp_fixup pnp_fixups[] = {
 #ifdef CONFIG_AMD_NB
        {"PNP0c01", quirk_amd_mmconfig_area},
 #endif
+#ifdef CONFIG_PCI
+        {"PNP0c02", quirk_intel_mch},
+#endif
        {""}
 };
diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c
index 476aa495c110..b95cf71ed695 100644
--- a/drivers/power/reset/vexpress-poweroff.c
+++ b/drivers/power/reset/vexpress-poweroff.c
@@ -11,7 +11,7 @@
 * Copyright (C) 2012 ARM Limited
 */
-#include <linux/jiffies.h>
+#include <linux/delay.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
@@ -23,17 +23,12 @@
 static void vexpress_reset_do(struct device *dev, const char *what)
 {
        int err = -ENOENT;
-        struct vexpress_config_func *func =
+        struct vexpress_config_func *func = dev_get_drvdata(dev);
-                        vexpress_config_func_get_by_dev(dev);
        if (func) {
-                unsigned long timeout;
                err = vexpress_config_write(func, 0, 0);
+                if (!err)
-                timeout = jiffies + HZ;
+                        mdelay(1000);
-                while (time_before(jiffies, timeout))
-                        cpu_relax();
        }
        dev_emerg(dev, "Unable to %s (%d)\n", what, err);
@@ -96,12 +91,18 @@ static int vexpress_reset_probe(struct platform_device *pdev)
        enum vexpress_reset_func func;
        const struct of_device_id *match =
                        of_match_device(vexpress_reset_of_match, &pdev->dev);
+        struct vexpress_config_func *config_func;
        if (match)
                func = (enum vexpress_reset_func)match->data;
        else
                func = pdev->id_entry->driver_data;
+        config_func = vexpress_config_func_get_by_dev(&pdev->dev);
+        if (!config_func)
+                return -EINVAL;
+        dev_set_drvdata(&pdev->dev, config_func);
        switch (func) {
        case FUNC_SHUTDOWN:
                vexpress_power_off_device = &pdev->dev;
diff --git a/drivers/regulator/pbias-regulator.c b/drivers/regulator/pbias-regulator.c
index ded3b3574209..6d38be3d970c 100644
--- a/drivers/regulator/pbias-regulator.c
+++ b/drivers/regulator/pbias-regulator.c
@@ -38,66 +38,24 @@ struct pbias_reg_info {
 struct pbias_regulator_data {
        struct regulator_desc desc;
        void __iomem *pbias_addr;
-        unsigned int pbias_reg;
        struct regulator_dev *dev;
        struct regmap *syscon;
        const struct pbias_reg_info *info;
        int voltage;
 };
-static int pbias_regulator_set_voltage(struct regulator_dev *dev,
+static const unsigned int pbias_volt_table[] = {
-                        int min_uV, int max_uV, unsigned *selector)
+        1800000,
-{
+        3000000
-        struct pbias_regulator_data *data = rdev_get_drvdata(dev);
+};
-        const struct pbias_reg_info *info = data->info;
-        int ret, vmode;
-        if (min_uV <= 1800000)
-                vmode = 0;
-        else if (min_uV > 1800000)
-                vmode = info->vmode;
-        ret = regmap_update_bits(data->syscon, data->pbias_reg,
-                                                info->vmode, vmode);
-        return ret;
-}
-static int pbias_regulator_get_voltage(struct regulator_dev *rdev)
-{
-        struct pbias_regulator_data *data = rdev_get_drvdata(rdev);
-        const struct pbias_reg_info *info = data->info;
-        int value, voltage;
-        regmap_read(data->syscon, data->pbias_reg, &value);
-        value &= info->vmode;
-        voltage = value ? 3000000 : 1800000;
-        return voltage;
-}
 static int pbias_regulator_enable(struct regulator_dev *rdev)
 {
        struct pbias_regulator_data *data = rdev_get_drvdata(rdev);
        const struct pbias_reg_info *info = data->info;
-        int ret;
-        ret = regmap_update_bits(data->syscon, data->pbias_reg,
-                                        info->enable_mask, info->enable);
-        return ret;
-}
-static int pbias_regulator_disable(struct regulator_dev *rdev)
-{
-        struct pbias_regulator_data *data = rdev_get_drvdata(rdev);
-        const struct pbias_reg_info *info = data->info;
-        int ret;
-        ret = regmap_update_bits(data->syscon, data->pbias_reg,
+        return regmap_update_bits(data->syscon, rdev->desc->enable_reg,
-                                                info->enable_mask, 0);
+                                  info->enable_mask, info->enable);
-        return ret;
 }
 static int pbias_regulator_is_enable(struct regulator_dev *rdev)
@@ -106,17 +64,18 @@ static int pbias_regulator_is_enable(struct regulator_dev *rdev)
        const struct pbias_reg_info *info = data->info;
        int value;
-        regmap_read(data->syscon, data->pbias_reg, &value);
+        regmap_read(data->syscon, rdev->desc->enable_reg, &value);
-        return (value & info->enable_mask) == info->enable_mask;
+        return (value & info->enable_mask) == info->enable;
 }
 static struct regulator_ops pbias_regulator_voltage_ops = {
-        .set_voltage    = pbias_regulator_set_voltage,
+        .list_voltage = regulator_list_voltage_table,
-        .get_voltage    = pbias_regulator_get_voltage,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
-        .enable         = pbias_regulator_enable,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
-        .disable        = pbias_regulator_disable,
+        .enable = pbias_regulator_enable,
-        .is_enabled     = pbias_regulator_is_enable,
+        .disable = regulator_disable_regmap,
+        .is_enabled = pbias_regulator_is_enable,
 };
 static const struct pbias_reg_info pbias_mmc_omap2430 = {
@@ -192,6 +151,7 @@ static int pbias_regulator_probe(struct platform_device *pdev)
        if (IS_ERR(syscon))
                return PTR_ERR(syscon);
+        cfg.regmap = syscon;
        cfg.dev = &pdev->dev;
        for (idx = 0; idx < PBIAS_NUM_REGS && data_idx < count; idx++) {
@@ -207,15 +167,19 @@ static int pbias_regulator_probe(struct platform_device *pdev)
                if (!res)
                        return -EINVAL;
-                drvdata[data_idx].pbias_reg = res->start;
                drvdata[data_idx].syscon = syscon;
                drvdata[data_idx].info = info;
                drvdata[data_idx].desc.name = info->name;
                drvdata[data_idx].desc.owner = THIS_MODULE;
                drvdata[data_idx].desc.type = REGULATOR_VOLTAGE;
                drvdata[data_idx].desc.ops = &pbias_regulator_voltage_ops;
+                drvdata[data_idx].desc.volt_table = pbias_volt_table;
                drvdata[data_idx].desc.n_voltages = 2;
                drvdata[data_idx].desc.enable_time = info->enable_time;
+                drvdata[data_idx].desc.vsel_reg = res->start;
+                drvdata[data_idx].desc.vsel_mask = info->vmode;
+                drvdata[data_idx].desc.enable_reg = res->start;
+                drvdata[data_idx].desc.enable_mask = info->enable_mask;
                cfg.init_data = pbias_matches[idx].init_data;
                cfg.driver_data = &drvdata[data_idx];
diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c
index bd628a6f981d..e5f13c4310fe 100644
--- a/drivers/rtc/rtc-hym8563.c
+++ b/drivers/rtc/rtc-hym8563.c
@@ -569,6 +569,9 @@ static int hym8563_probe(struct i2c_client *client,
        if (IS_ERR(hym8563->rtc))
                return PTR_ERR(hym8563->rtc);
+        /* the hym8563 alarm only supports a minute accuracy */
+        hym8563->rtc->uie_unsupported = 1;
 #ifdef CONFIG_COMMON_CLK
        hym8563_clkout_register_clk(hym8563);
 #endif
diff --git a/drivers/rtc/rtc-pcf8523.c b/drivers/rtc/rtc-pcf8523.c
index 5c8f8226c848..4cdb64be061b 100644
--- a/drivers/rtc/rtc-pcf8523.c
+++ b/drivers/rtc/rtc-pcf8523.c
@@ -206,7 +206,7 @@ static int pcf8523_rtc_read_time(struct device *dev, struct rtc_time *tm)
        tm->tm_hour = bcd2bin(regs[2] & 0x3f);
        tm->tm_mday = bcd2bin(regs[3] & 0x3f);
        tm->tm_wday = regs[4] & 0x7;
-        tm->tm_mon = bcd2bin(regs[5] & 0x1f);
+        tm->tm_mon = bcd2bin(regs[5] & 0x1f) - 1;
        tm->tm_year = bcd2bin(regs[6]) + 100;
        return rtc_valid_tm(tm);
@@ -229,7 +229,7 @@ static int pcf8523_rtc_set_time(struct device *dev, struct rtc_time *tm)
        regs[3] = bin2bcd(tm->tm_hour);
        regs[4] = bin2bcd(tm->tm_mday);
        regs[5] = tm->tm_wday;
-        regs[6] = bin2bcd(tm->tm_mon);
+        regs[6] = bin2bcd(tm->tm_mon + 1);
        regs[7] = bin2bcd(tm->tm_year - 100);
        msg.addr = client->addr;
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 9f0ea6cb6922..e3bf885f4a6c 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -541,18 +541,27 @@ static void chsc_process_sei_nt0(struct chsc_sei_nt0_area *sei_area)
 static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm)
 {
-        do {
+        static int ntsm_unsupported;
+        while (true) {
                memset(sei, 0, sizeof(*sei));
                sei->request.length = 0x0010;
                sei->request.code = 0x000e;
-                sei->ntsm = ntsm;
+                if (!ntsm_unsupported)
+                        sei->ntsm = ntsm;
                if (chsc(sei))
                        break;
                if (sei->response.code != 0x0001) {
-                        CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n",
+                        CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x, ntsm=%llx)\n",
-                                      sei->response.code);
+                                      sei->response.code, sei->ntsm);
+                        if (sei->response.code == 3 && sei->ntsm) {
+                                /* Fallback for old firmware. */
+                                ntsm_unsupported = 1;
+                                continue;
+                        }
                        break;
                }
@@ -568,7 +577,10 @@ static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm)
                        CIO_CRW_EVENT(2, "chsc: unhandled nt: %d\n", sei->nt);
                        break;
                }
-        } while (sei->u.nt0_area.flags & 0x80);
+                if (!(sei->u.nt0_area.flags & 0x80))
+                        break;
+        }
 }
 /*
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 8cf4a0c69baf..9a6e4a2cd072 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -7463,6 +7463,10 @@ static void hpsa_put_ctlr_into_performant_mode(struct ctlr_info *h)
        if (hpsa_simple_mode)
                return;
+        trans_support = readl(&(h->cfgtable->TransportSupport));
+        if (!(trans_support & PERFORMANT_MODE))
+                return;
        /* Check for I/O accelerator mode support */
        if (trans_support & CFGTBL_Trans_io_accel1) {
                transMethod |= CFGTBL_Trans_io_accel1 |
@@ -7479,10 +7483,6 @@ static void hpsa_put_ctlr_into_performant_mode(struct ctlr_info *h)
        }
        /* TODO, check that this next line h->nreply_queues is correct */
-        trans_support = readl(&(h->cfgtable->TransportSupport));
-        if (!(trans_support & PERFORMANT_MODE))
-                return;
        h->nreply_queues = h->msix_vector > 0 ? h->msix_vector : 1;
        hpsa_get_max_perf_mode_cmds(h);
        /* Performant mode ring buffer and supporting data structures */
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 7f0af4fcc001..6fd7d40b2c4d 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -8293,7 +8293,6 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state)
        mpt2sas_base_free_resources(ioc);
        pci_save_state(pdev);
-        pci_disable_device(pdev);
        pci_set_power_state(pdev, device_state);
        return 0;
 }
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 771c16bfdbac..f17aa7aa7879 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -189,6 +189,7 @@ scsi_abort_command(struct scsi_cmnd *scmd)
                /*
                 * Retry after abort failed, escalate to next level.
                 */
+                scmd->eh_eflags &= ~SCSI_EH_ABORT_SCHEDULED;
                SCSI_LOG_ERROR_RECOVERY(3,
                        scmd_printk(KERN_INFO, scmd,
                                    "scmd %p previous abort failed\n", scmd));
@@ -920,10 +921,12 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
        ses->prot_op = scmd->prot_op;
        scmd->prot_op = SCSI_PROT_NORMAL;
+        scmd->eh_eflags = 0;
        scmd->cmnd = ses->eh_cmnd;
        memset(scmd->cmnd, 0, BLK_MAX_CDB);
        memset(&scmd->sdb, 0, sizeof(scmd->sdb));
        scmd->request->next_rq = NULL;
+        scmd->result = 0;
        if (sense_bytes) {
                scmd->sdb.length = min_t(unsigned, SCSI_SENSE_BUFFERSIZE,
@@ -1157,6 +1160,15 @@ int scsi_eh_get_sense(struct list_head *work_q,
                                             __func__));
                        break;
                }
+                if (status_byte(scmd->result) != CHECK_CONDITION)
+                        /*
+                         * don't request sense if there's no check condition
+                         * status because the error we're processing isn't one
+                         * that has a sense code (and some devices get
+                         * confused by sense requests out of the blue)
+                         */
+                        continue;
                SCSI_LOG_ERROR_RECOVERY(2, scmd_printk(KERN_INFO, scmd,
                                                  "%s: requesting sense\n",
                                                  current->comm));
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 65a123d9c676..9db097a28a74 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -137,6 +137,7 @@ static void __scsi_queue_insert(struct scsi_cmnd *cmd, int reason, int unbusy)
         * lock such that the kblockd_schedule_work() call happens
         * before blk_cleanup_queue() finishes.
         */
+        cmd->result = 0;
        spin_lock_irqsave(q->queue_lock, flags);
        blk_requeue_request(q, cmd->request);
        kblockd_schedule_work(q, &device->requeue_work);
@@ -1044,6 +1045,7 @@ static int scsi_init_sgtable(struct request *req, struct scsi_data_buffer *sdb,
 */
 int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask)
 {
+        struct scsi_device *sdev = cmd->device;
        struct request *rq = cmd->request;
        int error = scsi_init_sgtable(rq, &cmd->sdb, gfp_mask);
@@ -1091,7 +1093,7 @@ err_exit:
        scsi_release_buffers(cmd);
        cmd->request->special = NULL;
        scsi_put_command(cmd);
-        put_device(&cmd->device->sdev_gendev);
+        put_device(&sdev->sdev_gendev);
        return error;
 }
 EXPORT_SYMBOL(scsi_init_io);
@@ -1273,7 +1275,7 @@ int scsi_prep_return(struct request_queue *q, struct request *req, int ret)
                        struct scsi_cmnd *cmd = req->special;
                        scsi_release_buffers(cmd);
                        scsi_put_command(cmd);
-                        put_device(&cmd->device->sdev_gendev);
+                        put_device(&sdev->sdev_gendev);
                        req->special = NULL;
                }
                break;
diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c
index fe30ea94ffe6..109802f776ed 100644
--- a/drivers/scsi/scsi_netlink.c
+++ b/drivers/scsi/scsi_netlink.c
@@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
                        goto next_msg;
                }
-                if (!capable(CAP_SYS_ADMIN)) {
+                if (!netlink_capable(skb, CAP_SYS_ADMIN)) {
                        err = -EPERM;
                        goto next_msg;
                }
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 16bfd50cd3fe..db3b494e5926 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -750,8 +750,12 @@ static void __virtscsi_set_affinity(struct virtio_scsi *vscsi, bool affinity)
                vscsi->affinity_hint_set = true;
        } else {
-                for (i = 0; i < vscsi->num_queues; i++)
+                for (i = 0; i < vscsi->num_queues; i++) {
+                        if (!vscsi->req_vqs[i].vq)
+                                continue;
                        virtqueue_set_affinity(vscsi->req_vqs[i].vq, -1);
+                }
                vscsi->affinity_hint_set = false;
        }
diff --git a/drivers/sh/Makefile b/drivers/sh/Makefile
index fc67f564f02c..788ed9b59b4e 100644
--- a/drivers/sh/Makefile
+++ b/drivers/sh/Makefile
@@ -1,10 +1,12 @@
 #
 # Makefile for the SuperH specific drivers.
 #
-obj-y   := intc/
+obj-$(CONFIG_SUPERH)                    += intc/
+obj-$(CONFIG_ARCH_SHMOBILE_LEGACY)      += intc/
+ifneq ($(CONFIG_COMMON_CLK),y)
+obj-$(CONFIG_HAVE_CLK)                  += clk/
+endif
+obj-$(CONFIG_MAPLE)                     += maple/
+obj-$(CONFIG_SUPERHYWAY)                += superhyway/
-obj-$(CONFIG_HAVE_CLK)          += clk/
+obj-y                                   += pm_runtime.o
-obj-$(CONFIG_MAPLE)             += maple/
-obj-$(CONFIG_SUPERHYWAY)        += superhyway/
-obj-y                           += pm_runtime.o
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index 8afa5a4589f2..10c65eb51f85 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -50,8 +50,25 @@ static struct pm_clk_notifier_block platform_bus_notifier = {
        .con_ids = { NULL, },
 };
+static bool default_pm_on;
 static int __init sh_pm_runtime_init(void)
 {
+        if (IS_ENABLED(CONFIG_ARCH_SHMOBILE_MULTI)) {
+                if (!of_machine_is_compatible("renesas,emev2") &&
+                    !of_machine_is_compatible("renesas,r7s72100") &&
+                    !of_machine_is_compatible("renesas,r8a73a4") &&
+                    !of_machine_is_compatible("renesas,r8a7740") &&
+                    !of_machine_is_compatible("renesas,r8a7778") &&
+                    !of_machine_is_compatible("renesas,r8a7779") &&
+                    !of_machine_is_compatible("renesas,r8a7790") &&
+                    !of_machine_is_compatible("renesas,r8a7791") &&
+                    !of_machine_is_compatible("renesas,sh7372") &&
+                    !of_machine_is_compatible("renesas,sh73a0"))
+                        return 0;
+        }
+        default_pm_on = true;
        pm_clk_add_notifier(&platform_bus_type, &platform_bus_notifier);
        return 0;
 }
@@ -59,7 +76,8 @@ core_initcall(sh_pm_runtime_init);
 static int __init sh_pm_runtime_late_init(void)
 {
-        pm_genpd_poweroff_unused();
+        if (default_pm_on)
+                pm_genpd_poweroff_unused();
        return 0;
 }
 late_initcall(sh_pm_runtime_late_init);
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 8005f9869481..079e6b1b0cdb 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1115,8 +1115,11 @@ static int atmel_spi_one_transfer(struct spi_master *master,
                        atmel_spi_next_xfer_pio(master, xfer);
                }
+                /* interrupts are disabled, so free the lock for schedule */
+                atmel_spi_unlock(as);
                ret = wait_for_completion_timeout(&as->xfer_completion,
                                                        SPI_DMA_TIMEOUT);
+                atmel_spi_lock(as);
                if (WARN_ON(ret == 0)) {
                        dev_err(&spi->dev,
                                "spi trasfer timeout, err %d\n", ret);
diff --git a/drivers/spi/spi-bfin5xx.c b/drivers/spi/spi-bfin5xx.c
index 55e57c3eb9bd..ebf720b88a2a 100644
--- a/drivers/spi/spi-bfin5xx.c
+++ b/drivers/spi/spi-bfin5xx.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <linux/gpio.h>
 #include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
diff --git a/drivers/spi/spi-pxa2xx-dma.c b/drivers/spi/spi-pxa2xx-dma.c
index 713af4806f26..f6759dc0153b 100644
--- a/drivers/spi/spi-pxa2xx-dma.c
+++ b/drivers/spi/spi-pxa2xx-dma.c
@@ -29,18 +29,6 @@ static int pxa2xx_spi_map_dma_buffer(struct driver_data *drv_data,
        struct sg_table *sgt;
        void *buf, *pbuf;
-        /*
-         * Some DMA controllers have problems transferring buffers that are
-         * not multiple of 4 bytes. So we truncate the transfer so that it
-         * is suitable for such controllers, and handle the trailing bytes
-         * manually after the DMA completes.
-         *
-         * REVISIT: It would be better if this information could be
-         * retrieved directly from the DMA device in a similar way than
-         * ->copy_align etc. is done.
-         */
-        len = ALIGN(drv_data->len, 4);
        if (dir == DMA_TO_DEVICE) {
                dmadev = drv_data->tx_chan->device->dev;
                sgt = &drv_data->tx_sgt;
@@ -144,12 +132,8 @@ static void pxa2xx_spi_dma_transfer_complete(struct driver_data *drv_data,
                if (!error) {
                        pxa2xx_spi_unmap_dma_buffers(drv_data);
-                        /* Handle the last bytes of unaligned transfer */
                        drv_data->tx += drv_data->tx_map_len;
-                        drv_data->write(drv_data);
                        drv_data->rx += drv_data->rx_map_len;
-                        drv_data->read(drv_data);
                        msg->actual_length += drv_data->len;
                        msg->state = pxa2xx_spi_next_transfer(drv_data);
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index b032e8885e24..78c66e3c53ed 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -734,7 +734,7 @@ static int spi_qup_remove(struct platform_device *pdev)
        int ret;
        ret = pm_runtime_get_sync(&pdev->dev);
-        if (ret)
+        if (ret < 0)
                return ret;
        ret = spi_qup_set_state(controller, QUP_STATE_RESET);
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index 9009456bdf4d..c8e795ef2e13 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -244,9 +244,9 @@ static int hspi_probe(struct platform_device *pdev)
                return -ENOMEM;
        }
-        clk = clk_get(NULL, "shyway_clk");
+        clk = clk_get(&pdev->dev, NULL);
        if (IS_ERR(clk)) {
-                dev_err(&pdev->dev, "shyway_clk is required\n");
+                dev_err(&pdev->dev, "couldn't get clock\n");
                ret = -EINVAL;
                goto error0;
        }
diff --git a/drivers/spi/spi-sirf.c b/drivers/spi/spi-sirf.c
index 1a77ad52812f..67d8909dcf39 100644
--- a/drivers/spi/spi-sirf.c
+++ b/drivers/spi/spi-sirf.c
@@ -287,8 +287,8 @@ static irqreturn_t spi_sirfsoc_irq(int irq, void *dev_id)
                                sspi->left_rx_word)
                        sspi->rx_word(sspi);
-        if (spi_stat & (SIRFSOC_SPI_FIFO_EMPTY
+        if (spi_stat & (SIRFSOC_SPI_TXFIFO_EMPTY |
-                        | SIRFSOC_SPI_TXFIFO_THD_REACH))
+                        SIRFSOC_SPI_TXFIFO_THD_REACH))
                while (!((readl(sspi->base + SIRFSOC_SPI_TXFIFO_STATUS)
                                & SIRFSOC_SPI_FIFO_FULL)) &&
                                sspi->left_tx_word)
@@ -470,7 +470,16 @@ static void spi_sirfsoc_chipselect(struct spi_device *spi, int value)
                writel(regval, sspi->base + SIRFSOC_SPI_CTRL);
        } else {
                int gpio = sspi->chipselect[spi->chip_select];
-                gpio_direction_output(gpio, spi->mode & SPI_CS_HIGH ? 0 : 1);
+                switch (value) {
+                case BITBANG_CS_ACTIVE:
+                        gpio_direction_output(gpio,
+                                        spi->mode & SPI_CS_HIGH ? 1 : 0);
+                        break;
+                case BITBANG_CS_INACTIVE:
+                        gpio_direction_output(gpio,
+                                        spi->mode & SPI_CS_HIGH ? 0 : 1);
+                        break;
+                }
        }
 }
@@ -559,6 +568,11 @@ spi_sirfsoc_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
                regval &= ~SIRFSOC_SPI_CMD_MODE;
                sspi->tx_by_cmd = false;
        }
+        /*
+         * set spi controller in RISC chipselect mode, we are controlling CS by
+         * software BITBANG_CS_ACTIVE and BITBANG_CS_INACTIVE.
+         */
+        regval |= SIRFSOC_SPI_CS_IO_MODE;
        writel(regval, sspi->base + SIRFSOC_SPI_CTRL);
        if (IS_DMA_VALID(t)) {
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 4eb9bf02996c..939edf473235 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -580,6 +580,7 @@ static void spi_set_cs(struct spi_device *spi, bool enable)
                spi->master->set_cs(spi, !enable);
 }
+#ifdef CONFIG_HAS_DMA
 static int spi_map_buf(struct spi_master *master, struct device *dev,
                       struct sg_table *sgt, void *buf, size_t len,
                       enum dma_data_direction dir)
@@ -637,55 +638,12 @@ static void spi_unmap_buf(struct spi_master *master, struct device *dev,
        }
 }
-static int spi_map_msg(struct spi_master *master, struct spi_message *msg)
+static int __spi_map_msg(struct spi_master *master, struct spi_message *msg)
 {
        struct device *tx_dev, *rx_dev;
        struct spi_transfer *xfer;
-        void *tmp;
-        unsigned int max_tx, max_rx;
        int ret;
-        if (master->flags & (SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX)) {
-                max_tx = 0;
-                max_rx = 0;
-                list_for_each_entry(xfer, &msg->transfers, transfer_list) {
-                        if ((master->flags & SPI_MASTER_MUST_TX) &&
-                            !xfer->tx_buf)
-                                max_tx = max(xfer->len, max_tx);
-                        if ((master->flags & SPI_MASTER_MUST_RX) &&
-                            !xfer->rx_buf)
-                                max_rx = max(xfer->len, max_rx);
-                }
-                if (max_tx) {
-                        tmp = krealloc(master->dummy_tx, max_tx,
-                                       GFP_KERNEL | GFP_DMA);
-                        if (!tmp)
-                                return -ENOMEM;
-                        master->dummy_tx = tmp;
-                        memset(tmp, 0, max_tx);
-                }
-                if (max_rx) {
-                        tmp = krealloc(master->dummy_rx, max_rx,
-                                       GFP_KERNEL | GFP_DMA);
-                        if (!tmp)
-                                return -ENOMEM;
-                        master->dummy_rx = tmp;
-                }
-                if (max_tx || max_rx) {
-                        list_for_each_entry(xfer, &msg->transfers,
-                                            transfer_list) {
-                                if (!xfer->tx_buf)
-                                        xfer->tx_buf = master->dummy_tx;
-                                if (!xfer->rx_buf)
-                                        xfer->rx_buf = master->dummy_rx;
-                        }
-                }
-        }
        if (!master->can_dma)
                return 0;
@@ -742,6 +700,69 @@ static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
        return 0;
 }
+#else /* !CONFIG_HAS_DMA */
+static inline int __spi_map_msg(struct spi_master *master,
+                                struct spi_message *msg)
+{
+        return 0;
+}
+static inline int spi_unmap_msg(struct spi_master *master,
+                                struct spi_message *msg)
+{
+        return 0;
+}
+#endif /* !CONFIG_HAS_DMA */
+static int spi_map_msg(struct spi_master *master, struct spi_message *msg)
+{
+        struct spi_transfer *xfer;
+        void *tmp;
+        unsigned int max_tx, max_rx;
+        if (master->flags & (SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX)) {
+                max_tx = 0;
+                max_rx = 0;
+                list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+                        if ((master->flags & SPI_MASTER_MUST_TX) &&
+                            !xfer->tx_buf)
+                                max_tx = max(xfer->len, max_tx);
+                        if ((master->flags & SPI_MASTER_MUST_RX) &&
+                            !xfer->rx_buf)
+                                max_rx = max(xfer->len, max_rx);
+                }
+                if (max_tx) {
+                        tmp = krealloc(master->dummy_tx, max_tx,
+                                       GFP_KERNEL | GFP_DMA);
+                        if (!tmp)
+                                return -ENOMEM;
+                        master->dummy_tx = tmp;
+                        memset(tmp, 0, max_tx);
+                }
+                if (max_rx) {
+                        tmp = krealloc(master->dummy_rx, max_rx,
+                                       GFP_KERNEL | GFP_DMA);
+                        if (!tmp)
+                                return -ENOMEM;
+                        master->dummy_rx = tmp;
+                }
+                if (max_tx || max_rx) {
+                        list_for_each_entry(xfer, &msg->transfers,
+                                            transfer_list) {
+                                if (!xfer->tx_buf)
+                                        xfer->tx_buf = master->dummy_tx;
+                                if (!xfer->rx_buf)
+                                        xfer->rx_buf = master->dummy_rx;
+                        }
+                }
+        }
+        return __spi_map_msg(master, msg);
+}
 /*
 * spi_transfer_one_message - Default implementation of transfer_one_message()
@@ -1151,7 +1172,6 @@ static int spi_master_initialize_queue(struct spi_master *master)
 {
        int ret;
-        master->queued = true;
        master->transfer = spi_queued_transfer;
        if (!master->transfer_one_message)
                master->transfer_one_message = spi_transfer_one_message;
@@ -1162,6 +1182,7 @@ static int spi_master_initialize_queue(struct spi_master *master)
                dev_err(&master->dev, "problem initializing queue\n");
                goto err_init_queue;
        }
+        master->queued = true;
        ret = spi_start_queue(master);
        if (ret) {
                dev_err(&master->dev, "problem starting queue\n");
@@ -1171,8 +1192,8 @@ static int spi_master_initialize_queue(struct spi_master *master)
        return 0;
 err_start_queue:
-err_init_queue:
        spi_destroy_queue(master);
+err_init_queue:
        return ret;
 }
@@ -1756,7 +1777,7 @@ EXPORT_SYMBOL_GPL(spi_busnum_to_master);
 */
 int spi_setup(struct spi_device *spi)
 {
-        unsigned        bad_bits;
+        unsigned        bad_bits, ugly_bits;
        int             status = 0;
        /* check mode to prevent that DUAL and QUAD set at the same time
@@ -1776,6 +1797,15 @@ int spi_setup(struct spi_device *spi)
         * that aren't supported with their current master
         */
        bad_bits = spi->mode & ~spi->master->mode_bits;
+        ugly_bits = bad_bits &
+                    (SPI_TX_DUAL | SPI_TX_QUAD | SPI_RX_DUAL | SPI_RX_QUAD);
+        if (ugly_bits) {
+                dev_warn(&spi->dev,
+                         "setup: ignoring unsupported mode bits %x\n",
+                         ugly_bits);
+                spi->mode &= ~ugly_bits;
+                bad_bits &= ~ugly_bits;
+        }
        if (bad_bits) {
                dev_err(&spi->dev, "setup: unsupported mode bits %x\n",
                        bad_bits);
diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index 71db683098d6..b59af0303581 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -493,7 +493,7 @@ static void usbduxsub_ao_isoc_irq(struct urb *urb)
                        /* pointer to the DA */
                        *datap++ = val & 0xff;
                        *datap++ = (val >> 8) & 0xff;
-                        *datap++ = chan;
+                        *datap++ = chan << 6;
                        devpriv->ao_readback[chan] = val;
                        s->async->events |= COMEDI_CB_BLOCK;
@@ -1040,11 +1040,8 @@ static int usbdux_ao_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
        /* set current channel of the running acquisition to zero */
        s->async->cur_chan = 0;
-        for (i = 0; i < cmd->chanlist_len; ++i) {
+        for (i = 0; i < cmd->chanlist_len; ++i)
-                unsigned int chan = CR_CHAN(cmd->chanlist[i]);
+                devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]);
-                devpriv->ao_chanlist[i] = chan << 6;
-        }
        /* we count in steps of 1ms (125us) */
        /* 125us mode not used yet */
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 11fb95201545..dae8d1a9038e 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -1526,7 +1526,7 @@ static int mxs_lradc_probe(struct platform_device *pdev)
        struct resource *iores;
        int ret = 0, touch_ret;
        int i, s;
-        unsigned int scale_uv;
+        uint64_t scale_uv;
        /* Allocate the IIO device. */
        iio = devm_iio_device_alloc(dev, sizeof(*lradc));
diff --git a/drivers/staging/iio/resolver/ad2s1200.c b/drivers/staging/iio/resolver/ad2s1200.c
index 36eedd8a0ea9..017d2f8379b7 100644
--- a/drivers/staging/iio/resolver/ad2s1200.c
+++ b/drivers/staging/iio/resolver/ad2s1200.c
@@ -70,6 +70,7 @@ static int ad2s1200_read_raw(struct iio_dev *indio_dev,
                vel = (((s16)(st->rx[0])) << 4) | ((st->rx[1] & 0xF0) >> 4);
                vel = (vel << 4) >> 4;
                *val = vel;
+                break;
        default:
                mutex_unlock(&st->lock);
                return -EINVAL;
@@ -106,7 +107,7 @@ static int ad2s1200_probe(struct spi_device *spi)
        int pn, ret = 0;
        unsigned short *pins = spi->dev.platform_data;
-        for (pn = 0; pn < AD2S1200_PN; pn++)
+        for (pn = 0; pn < AD2S1200_PN; pn++) {
                ret = devm_gpio_request_one(&spi->dev, pins[pn], GPIOF_DIR_OUT,
                                            DRV_NAME);
                if (ret) {
@@ -114,6 +115,7 @@ static int ad2s1200_probe(struct spi_device *spi)
                                                        pins[pn]);
                        return ret;
                }
+        }
        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
        if (!indio_dev)
                return -ENOMEM;
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 4144a75e5f71..c270c9ae6d27 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -517,7 +517,7 @@ int imx_drm_encoder_get_mux_id(struct device_node *node,
                of_node_put(port);
                if (port == imx_crtc->port) {
                        ret = of_graph_parse_endpoint(ep, &endpoint);
-                        return ret ? ret : endpoint.id;
+                        return ret ? ret : endpoint.port;
                }
        } while (ep);
@@ -675,6 +675,11 @@ static int imx_drm_platform_probe(struct platform_device *pdev)
                        if (!remote || !of_device_is_available(remote)) {
                                of_node_put(remote);
                                continue;
+                        } else if (!of_device_is_available(remote->parent)) {
+                                dev_warn(&pdev->dev, "parent device of %s is not available\n",
+                                         remote->full_name);
+                                of_node_put(remote);
+                                continue;
                        }
                        ret = imx_drm_add_component(&pdev->dev, remote);
diff --git a/drivers/staging/imx-drm/imx-tve.c b/drivers/staging/imx-drm/imx-tve.c
index 575533f4fd64..a23f4f773146 100644
--- a/drivers/staging/imx-drm/imx-tve.c
+++ b/drivers/staging/imx-drm/imx-tve.c
@@ -582,7 +582,7 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
        tve->dev = dev;
        spin_lock_init(&tve->lock);
-        ddc_node = of_parse_phandle(np, "i2c-ddc-bus", 0);
+        ddc_node = of_parse_phandle(np, "ddc-i2c-bus", 0);
        if (ddc_node) {
                tve->ddc = of_find_i2c_adapter_by_node(ddc_node);
                of_node_put(ddc_node);
diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c
index 8c101cbbee97..acc8184c46cd 100644
--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
+++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
@@ -1247,9 +1247,18 @@ static int vpfe_stop_streaming(struct vb2_queue *vq)
        struct vpfe_fh *fh = vb2_get_drv_priv(vq);
        struct vpfe_video_device *video = fh->video;
-        if (!vb2_is_streaming(vq))
-                return 0;
        /* release all active buffers */
+        if (video->cur_frm == video->next_frm) {
+                vb2_buffer_done(&video->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (video->cur_frm != NULL)
+                        vb2_buffer_done(&video->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (video->next_frm != NULL)
+                        vb2_buffer_done(&video->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&video->dma_queue)) {
                video->next_frm = list_entry(video->dma_queue.next,
                                                struct vpfe_cap_buffer, list);
diff --git a/drivers/staging/media/sn9c102/sn9c102_devtable.h b/drivers/staging/media/sn9c102/sn9c102_devtable.h
index b3d2cc729657..4ba569258498 100644
--- a/drivers/staging/media/sn9c102/sn9c102_devtable.h
+++ b/drivers/staging/media/sn9c102/sn9c102_devtable.h
@@ -48,10 +48,8 @@ static const struct usb_device_id sn9c102_id_table[] = {
        { SN9C102_USB_DEVICE(0x0c45, 0x600d, BRIDGE_SN9C102), },
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x6011, BRIDGE_SN9C102), }, OV6650 */
        { SN9C102_USB_DEVICE(0x0c45, 0x6019, BRIDGE_SN9C102), },
-#endif
        { SN9C102_USB_DEVICE(0x0c45, 0x6024, BRIDGE_SN9C102), },
        { SN9C102_USB_DEVICE(0x0c45, 0x6025, BRIDGE_SN9C102), },
-#if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
        { SN9C102_USB_DEVICE(0x0c45, 0x6028, BRIDGE_SN9C102), },
        { SN9C102_USB_DEVICE(0x0c45, 0x6029, BRIDGE_SN9C102), },
        { SN9C102_USB_DEVICE(0x0c45, 0x602a, BRIDGE_SN9C102), },
diff --git a/drivers/staging/rtl8723au/os_dep/os_intfs.c b/drivers/staging/rtl8723au/os_dep/os_intfs.c
index 57eca7a45672..4fe751f7c2bf 100644
--- a/drivers/staging/rtl8723au/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723au/os_dep/os_intfs.c
@@ -953,8 +953,6 @@ static int netdev_close(struct net_device *pnetdev)
 #endif /* CONFIG_8723AU_P2P */
        rtw_scan_abort23a(padapter);
-         /* set this at the end */
-        padapter->rtw_wdev->iftype = NL80211_IFTYPE_MONITOR;
        RT_TRACE(_module_os_intfs_c_, _drv_info_, ("-871x_drv - drv_close\n"));
        DBG_8723A("-871x_drv - drv_close, bup =%d\n", padapter->bup);
diff --git a/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c b/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c
index c49160e477d8..07e542e5d156 100644
--- a/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c
+++ b/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c
@@ -26,7 +26,7 @@ unsigned int ffaddr2pipehdl23a(struct dvobj_priv *pdvobj, u32 addr)
        if (addr == RECV_BULK_IN_ADDR) {
                pipe = usb_rcvbulkpipe(pusbd, pdvobj->RtInPipe[0]);
        } else if (addr == RECV_INT_IN_ADDR) {
-                pipe = usb_rcvbulkpipe(pusbd, pdvobj->RtInPipe[1]);
+                pipe = usb_rcvintpipe(pusbd, pdvobj->RtInPipe[1]);
        } else if (addr < HW_QUEUE_ENTRY) {
                ep_num = pdvobj->Queue2Pipe[addr];
                pipe = usb_sndbulkpipe(pusbd, ep_num);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 78cab13bbb1b..46588c85d39b 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1593,7 +1593,9 @@ int iscsit_process_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         * Initiator is expecting a NopIN ping reply..
         */
        if (hdr->itt != RESERVED_ITT) {
-                BUG_ON(!cmd);
+                if (!cmd)
+                        return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
+                                                (unsigned char *)hdr);
                spin_lock_bh(&conn->cmd_lock);
                list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 6960f22909ae..302eb3b78715 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -775,6 +775,7 @@ struct iscsi_np {
        int                     np_ip_proto;
        int                     np_sock_type;
        enum np_thread_state_table np_thread_state;
+        bool                    enabled;
        enum iscsi_timer_flags_table np_login_timer_flags;
        u32                     np_exports;
        enum np_flags_table     np_flags;
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 8739b98f6f93..ca31fa1b8a4b 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -436,7 +436,7 @@ static int iscsi_login_zero_tsih_s2(
                }
                off = mrdsl % PAGE_SIZE;
                if (!off)
-                        return 0;
+                        goto check_prot;
                if (mrdsl < PAGE_SIZE)
                        mrdsl = PAGE_SIZE;
@@ -452,6 +452,31 @@ static int iscsi_login_zero_tsih_s2(
                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
                        return -1;
                }
+                /*
+                 * ISER currently requires that ImmediateData + Unsolicited
+                 * Data be disabled when protection / signature MRs are enabled.
+                 */
+check_prot:
+                if (sess->se_sess->sup_prot_ops &
+                   (TARGET_PROT_DOUT_STRIP | TARGET_PROT_DOUT_PASS |
+                    TARGET_PROT_DOUT_INSERT)) {
+                        sprintf(buf, "ImmediateData=No");
+                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                                return -1;
+                        }
+                        sprintf(buf, "InitialR2T=Yes");
+                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                                return -1;
+                        }
+                        pr_debug("Forcing ImmediateData=No + InitialR2T=Yes for"
+                                 " T10-PI enabled ISER session\n");
+                }
        }
        return 0;
@@ -984,6 +1009,7 @@ int iscsi_target_setup_login_socket(
        }
        np->np_transport = t;
+        np->enabled = true;
        return 0;
 }
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index eb96b20dc09e..ca1811858afd 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -184,6 +184,7 @@ static void iscsit_clear_tpg_np_login_thread(
                return;
        }
+        tpg_np->tpg_np->enabled = false;
        iscsit_reset_np_thread(tpg_np->tpg_np, tpg_np, tpg, shutdown);
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 65001e133670..26416c15d65c 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -798,10 +798,10 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
                pr_err("emulate_write_cache not supported for pSCSI\n");
                return -EINVAL;
        }
-        if (dev->transport->get_write_cache) {
+        if (flag &&
-                pr_warn("emulate_write_cache cannot be changed when underlying"
+            dev->transport->get_write_cache) {
-                        " HW reports WriteCacheEnabled, ignoring request\n");
+                pr_err("emulate_write_cache not supported for this device\n");
-                return 0;
+                return -EINVAL;
        }
        dev->dev_attrib.emulate_write_cache = flag;
@@ -936,6 +936,10 @@ int se_dev_set_pi_prot_type(struct se_device *dev, int flag)
                return 0;
        }
        if (!dev->transport->init_prot || !dev->transport->free_prot) {
+                /* 0 is only allowed value for non-supporting backends */
+                if (flag == 0)
+                        return 0;
                pr_err("DIF protection not supported by backend: %s\n",
                       dev->transport->name);
                return -ENOSYS;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index d4b98690a736..789aa9eb0a1e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1113,6 +1113,7 @@ void transport_init_se_cmd(
        init_completion(&cmd->cmd_wait_comp);
        init_completion(&cmd->task_stop_comp);
        spin_lock_init(&cmd->t_state_lock);
+        kref_init(&cmd->cmd_kref);
        cmd->transport_state = CMD_T_DEV_ACTIVE;
        cmd->se_tfo = tfo;
@@ -2357,7 +2358,6 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
        unsigned long flags;
        int ret = 0;
-        kref_init(&se_cmd->cmd_kref);
        /*
         * Add a second kref if the fabric caller is expecting to handle
         * fabric acknowledgement that requires two target_put_sess_cmd()
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 01cf37f212c3..f5fd515b2bee 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -90,18 +90,18 @@ static void ft_free_cmd(struct ft_cmd *cmd)
 {
        struct fc_frame *fp;
        struct fc_lport *lport;
-        struct se_session *se_sess;
+        struct ft_sess *sess;
        if (!cmd)
                return;
-        se_sess = cmd->sess->se_sess;
+        sess = cmd->sess;
        fp = cmd->req_frame;
        lport = fr_dev(fp);
        if (fr_seq(fp))
                lport->tt.seq_release(fr_seq(fp));
        fc_frame_free(fp);
-        percpu_ida_free(&se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
+        percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
-        ft_sess_put(cmd->sess); /* undo get from lookup at recv */
+        ft_sess_put(sess);      /* undo get from lookup at recv */
 }
 void ft_release_cmd(struct se_cmd *se_cmd)
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 94f9e3a38412..0ff7fda0742f 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -190,7 +190,7 @@ static struct tty_driver *hvc_console_device(struct console *c, int *index)
        return hvc_driver;
 }
-static int __init hvc_console_setup(struct console *co, char *options)
+static int hvc_console_setup(struct console *co, char *options)
 {       
        if (co->index < 0 || co->index >= MAX_NR_HVC_CONSOLES)
                return -ENODEV;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 41fe8a047d37..fe9d129c8735 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
                        if (tty->ops->flush_chars)
                                tty->ops->flush_chars(tty);
                } else {
+                        struct n_tty_data *ldata = tty->disc_data;
                        while (nr > 0) {
+                                mutex_lock(&ldata->output_lock);
                                c = tty->ops->write(tty, b, nr);
+                                mutex_unlock(&ldata->output_lock);
                                if (c < 0) {
                                        retval = c;
                                        goto break_out;
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 81f909c2101f..2d4bd3929e50 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -555,7 +555,7 @@ static void serial8250_set_sleep(struct uart_8250_port *p, int sleep)
         */
        if ((p->port.type == PORT_XR17V35X) ||
           (p->port.type == PORT_XR17D15X)) {
-                serial_out(p, UART_EXAR_SLEEP, 0xff);
+                serial_out(p, UART_EXAR_SLEEP, sleep ? 0xff : 0);
                return;
        }
@@ -1520,7 +1520,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
                        status = serial8250_rx_chars(up, status);
        }
        serial8250_modem_status(up);
-        if (status & UART_LSR_THRE)
+        if (!up->dma && (status & UART_LSR_THRE))
                serial8250_tx_chars(up);
        spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c
index 7046769608d4..ab9096dc3849 100644
--- a/drivers/tty/serial/8250/8250_dma.c
+++ b/drivers/tty/serial/8250/8250_dma.c
@@ -20,12 +20,15 @@ static void __dma_tx_complete(void *param)
        struct uart_8250_port   *p = param;
        struct uart_8250_dma    *dma = p->dma;
        struct circ_buf         *xmit = &p->port.state->xmit;
+        unsigned long   flags;
-        dma->tx_running = 0;
        dma_sync_single_for_cpu(dma->txchan->device->dev, dma->tx_addr,
                                UART_XMIT_SIZE, DMA_TO_DEVICE);
+        spin_lock_irqsave(&p->port.lock, flags);
+        dma->tx_running = 0;
        xmit->tail += dma->tx_size;
        xmit->tail &= UART_XMIT_SIZE - 1;
        p->port.icount.tx += dma->tx_size;
@@ -35,6 +38,8 @@ static void __dma_tx_complete(void *param)
        if (!uart_circ_empty(xmit) && !uart_tx_stopped(&p->port))
                serial8250_tx_dma(p);
+        spin_unlock_irqrestore(&p->port.lock, flags);
 }
 static void __dma_rx_complete(void *param)
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 23f459600738..1f5505e7f90d 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1446,8 +1446,8 @@ static int s3c24xx_serial_get_poll_char(struct uart_port *port)
 static void s3c24xx_serial_put_poll_char(struct uart_port *port,
                unsigned char c)
 {
-        unsigned int ufcon = rd_regl(cons_uart, S3C2410_UFCON);
+        unsigned int ufcon = rd_regl(port, S3C2410_UFCON);
-        unsigned int ucon = rd_regl(cons_uart, S3C2410_UCON);
+        unsigned int ucon = rd_regl(port, S3C2410_UCON);
        /* not possible to xmit on unconfigured port */
        if (!s3c24xx_port_configured(ucon))
@@ -1455,7 +1455,7 @@ static void s3c24xx_serial_put_poll_char(struct uart_port *port,
        while (!s3c24xx_serial_console_txrdy(port, ufcon))
                cpu_relax();
-        wr_regb(cons_uart, S3C2410_UTXH, c);
+        wr_regb(port, S3C2410_UTXH, c);
 }
 #endif /* CONFIG_CONSOLE_POLL */
@@ -1463,22 +1463,23 @@ static void s3c24xx_serial_put_poll_char(struct uart_port *port,
 static void
 s3c24xx_serial_console_putchar(struct uart_port *port, int ch)
 {
-        unsigned int ufcon = rd_regl(cons_uart, S3C2410_UFCON);
+        unsigned int ufcon = rd_regl(port, S3C2410_UFCON);
-        unsigned int ucon = rd_regl(cons_uart, S3C2410_UCON);
-        /* not possible to xmit on unconfigured port */
-        if (!s3c24xx_port_configured(ucon))
-                return;
        while (!s3c24xx_serial_console_txrdy(port, ufcon))
-                barrier();
+                cpu_relax();
-        wr_regb(cons_uart, S3C2410_UTXH, ch);
+        wr_regb(port, S3C2410_UTXH, ch);
 }
 static void
 s3c24xx_serial_console_write(struct console *co, const char *s,
                             unsigned int count)
 {
+        unsigned int ucon = rd_regl(cons_uart, S3C2410_UCON);
+        /* not possible to xmit on unconfigured port */
+        if (!s3c24xx_port_configured(ucon))
+                return;
        uart_console_write(cons_uart, s, count, s3c24xx_serial_console_putchar);
 }
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index f26834d262b3..b68550d95a40 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -137,6 +137,11 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
                return 1;
        /*
+         * Make sure the device is in D0 state.
+         */
+        uart_change_pm(state, UART_PM_STATE_ON);
+        /*
         * Initialise and allocate the transmit and temporary
         * buffer.
         */
@@ -825,25 +830,29 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
                 * If we fail to request resources for the
                 * new port, try to restore the old settings.
                 */
-                if (retval && old_type != PORT_UNKNOWN) {
+                if (retval) {
                        uport->iobase = old_iobase;
                        uport->type = old_type;
                        uport->hub6 = old_hub6;
                        uport->iotype = old_iotype;
                        uport->regshift = old_shift;
                        uport->mapbase = old_mapbase;
-                        retval = uport->ops->request_port(uport);
-                        /*
-                         * If we failed to restore the old settings,
-                         * we fail like this.
-                         */
-                        if (retval)
-                                uport->type = PORT_UNKNOWN;
-                        /*
+                        if (old_type != PORT_UNKNOWN) {
-                         * We failed anyway.
+                                retval = uport->ops->request_port(uport);
-                         */
+                                /*
-                        retval = -EBUSY;
+                                 * If we failed to restore the old settings,
+                                 * we fail like this.
+                                 */
+                                if (retval)
+                                        uport->type = PORT_UNKNOWN;
+                                /*
+                                 * We failed anyway.
+                                 */
+                                retval = -EBUSY;
+                        }
                        /* Added to return the correct error -Ram Gupta */
                        goto exit;
                }
@@ -1571,12 +1580,6 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
        }
        /*
-         * Make sure the device is in D0 state.
-         */
-        if (port->count == 1)
-                uart_change_pm(state, UART_PM_STATE_ON);
-        /*
         * Start up the serial port.
         */
        retval = uart_startup(tty, state, 0);
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 8ebd9f88a6f6..cf78d1985cd8 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -258,7 +258,11 @@ static int __tty_buffer_request_room(struct tty_port *port, size_t size,
                        n->flags = flags;
                        buf->tail = n;
                        b->commit = b->used;
-                        smp_mb();
+                        /* paired w/ barrier in flush_to_ldisc(); ensures the
+                         * latest commit value can be read before the head is
+                         * advanced to the next buffer
+                         */
+                        smp_wmb();
                        b->next = n;
                } else if (change)
                        size = 0;
@@ -444,17 +448,24 @@ static void flush_to_ldisc(struct work_struct *work)
        while (1) {
                struct tty_buffer *head = buf->head;
+                struct tty_buffer *next;
                int count;
                /* Ldisc or user is trying to gain exclusive access */
                if (atomic_read(&buf->priority))
                        break;
+                next = head->next;
+                /* paired w/ barrier in __tty_buffer_request_room();
+                 * ensures commit value read is not stale if the head
+                 * is advancing to the next buffer
+                 */
+                smp_rmb();
                count = head->commit - head->read;
                if (!count) {
-                        if (head->next == NULL)
+                        if (next == NULL)
                                break;
-                        buf->head = head->next;
+                        buf->head = next;
                        tty_buffer_free(port, head);
                        continue;
                }
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index ca6831c5b763..1cd5d0ba587c 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -277,6 +277,39 @@ static void hw_phymode_configure(struct ci_hdrc *ci)
 }
 /**
+ * ci_usb_phy_init: initialize phy according to different phy type
+ * @ci: the controller
+  *
+ * This function returns an error code if usb_phy_init has failed
+ */
+static int ci_usb_phy_init(struct ci_hdrc *ci)
+{
+        int ret;
+        switch (ci->platdata->phy_mode) {
+        case USBPHY_INTERFACE_MODE_UTMI:
+        case USBPHY_INTERFACE_MODE_UTMIW:
+        case USBPHY_INTERFACE_MODE_HSIC:
+                ret = usb_phy_init(ci->transceiver);
+                if (ret)
+                        return ret;
+                hw_phymode_configure(ci);
+                break;
+        case USBPHY_INTERFACE_MODE_ULPI:
+        case USBPHY_INTERFACE_MODE_SERIAL:
+                hw_phymode_configure(ci);
+                ret = usb_phy_init(ci->transceiver);
+                if (ret)
+                        return ret;
+                break;
+        default:
+                ret = usb_phy_init(ci->transceiver);
+        }
+        return ret;
+}
+/**
 * hw_device_reset: resets chip (execute without interruption)
 * @ci: the controller
  *
@@ -543,8 +576,6 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        hw_phymode_configure(ci);
        if (ci->platdata->phy)
                ci->transceiver = ci->platdata->phy;
        else
@@ -564,7 +595,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                return -EPROBE_DEFER;
        }
-        ret = usb_phy_init(ci->transceiver);
+        ret = ci_usb_phy_init(ci);
        if (ret) {
                dev_err(dev, "unable to init phy: %d\n", ret);
                return ret;
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index d001417e8e37..10aaaae9af25 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -821,6 +821,7 @@ static void dwc3_complete(struct device *dev)
        spin_lock_irqsave(&dwc->lock, flags);
+        dwc3_event_buffers_setup(dwc);
        switch (dwc->dr_mode) {
        case USB_DR_MODE_PERIPHERAL:
        case USB_DR_MODE_OTG:
@@ -828,7 +829,6 @@ static void dwc3_complete(struct device *dev)
                /* FALLTHROUGH */
        case USB_DR_MODE_HOST:
        default:
-                dwc3_event_buffers_setup(dwc);
                break;
        }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index a740eac74d56..70715eeededd 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -187,15 +187,12 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
         * improve this algorithm so that we better use the internal
         * FIFO space
         */
-        for (num = 0; num < DWC3_ENDPOINTS_NUM; num++) {
+        for (num = 0; num < dwc->num_in_eps; num++) {
-                struct dwc3_ep  *dep = dwc->eps[num];
+                /* bit0 indicates direction; 1 means IN ep */
-                int             fifo_number = dep->number >> 1;
+                struct dwc3_ep  *dep = dwc->eps[(num << 1) | 1];
                int             mult = 1;
                int             tmp;
-                if (!(dep->number & 1))
-                        continue;
                if (!(dep->flags & DWC3_EP_ENABLED))
                        continue;
@@ -224,8 +221,7 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
                dev_vdbg(dwc->dev, "%s: Fifo Addr %04x Size %d\n",
                                dep->name, last_fifo_depth, fifo_size & 0xffff);
-                dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(fifo_number),
+                dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(num), fifo_size);
-                                fifo_size);
                last_fifo_depth += (fifo_size & 0xffff);
        }
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index f605ad8c1902..cfd18bcca723 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1709,16 +1709,6 @@ static int at91udc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        if (pdev->num_resources != 2) {
-                DBG("invalid num_resources\n");
-                return -ENODEV;
-        }
-        if ((pdev->resource[0].flags != IORESOURCE_MEM)
-                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
-                DBG("invalid resource type\n");
-                return -ENODEV;
-        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res)
                return -ENXIO;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 2e164dca08e8..1e12b3ee56fd 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -745,6 +745,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 */
                struct usb_gadget *gadget = epfile->ffs->gadget;
+                spin_lock_irq(&epfile->ffs->eps_lock);
+                /* In the meantime, endpoint got disabled or changed. */
+                if (epfile->ep != ep) {
+                        spin_unlock_irq(&epfile->ffs->eps_lock);
+                        return -ESHUTDOWN;
+                }
                /*
                 * Controller may require buffer size to be aligned to
                 * maxpacketsize of an out endpoint.
@@ -752,6 +758,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                data_len = io_data->read ?
                           usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
                           io_data->len;
+                spin_unlock_irq(&epfile->ffs->eps_lock);
                data = kmalloc(data_len, GFP_KERNEL);
                if (unlikely(!data))
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index c11761ce5113..9a4f49dc6ac4 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -377,7 +377,7 @@ static struct sk_buff *rndis_add_header(struct gether *port,
        if (skb2)
                rndis_add_hdr(skb2);
-        dev_kfree_skb_any(skb);
+        dev_kfree_skb(skb);
        return skb2;
 }
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index 15960af0f67e..a2f26cdb56fe 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -1219,6 +1219,10 @@ static int fsl_pullup(struct usb_gadget *gadget, int is_on)
        struct fsl_udc *udc;
        udc = container_of(gadget, struct fsl_udc, gadget);
+        if (!udc->vbus_active)
+                return -EOPNOTSUPP;
        udc->softconnect = (is_on != 0);
        if (can_pullup(udc))
                fsl_writel((fsl_readl(&dr_regs->usbcmd) | USB_CMD_RUN_STOP),
@@ -2532,8 +2536,8 @@ static int __exit fsl_udc_remove(struct platform_device *pdev)
        if (!udc_controller)
                return -ENODEV;
-        usb_del_gadget_udc(&udc_controller->gadget);
        udc_controller->done = &done;
+        usb_del_gadget_udc(&udc_controller->gadget);
        fsl_udc_clk_release();
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index b5be6f0308c2..a925d0cbcd41 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -2043,6 +2043,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                return -ESRCH;
        /* fake probe to determine $CHIP */
+        CHIP = NULL;
        usb_gadget_probe_driver(&probe_driver);
        if (!CHIP)
                return -ENODEV;
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index d822d822efb3..7ed452d90f4d 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -35,6 +35,7 @@
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
+#include "u_rndis.h"
 #undef  VERBOSE_DEBUG
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 50d09c289137..b7d4f82872b7 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -48,8 +48,6 @@
 #define UETH__VERSION   "29-May-2008"
-#define GETHER_NAPI_WEIGHT      32
 struct eth_dev {
        /* lock is held while accessing port_usb
         */
@@ -74,7 +72,6 @@ struct eth_dev {
                                                struct sk_buff_head *list);
        struct work_struct      work;
-        struct napi_struct      rx_napi;
        unsigned long           todo;
 #define WORK_RX_MEMORY          0
@@ -256,16 +253,18 @@ enomem:
                DBG(dev, "rx submit --> %d\n", retval);
                if (skb)
                        dev_kfree_skb_any(skb);
+                spin_lock_irqsave(&dev->req_lock, flags);
+                list_add(&req->list, &dev->rx_reqs);
+                spin_unlock_irqrestore(&dev->req_lock, flags);
        }
        return retval;
 }
 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
 {
-        struct sk_buff  *skb = req->context;
+        struct sk_buff  *skb = req->context, *skb2;
        struct eth_dev  *dev = ep->driver_data;
        int             status = req->status;
-        bool            rx_queue = 0;
        switch (status) {
@@ -289,8 +288,30 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req)
                } else {
                        skb_queue_tail(&dev->rx_frames, skb);
                }
-                if (!status)
+                skb = NULL;
-                        rx_queue = 1;
+                skb2 = skb_dequeue(&dev->rx_frames);
+                while (skb2) {
+                        if (status < 0
+                                        || ETH_HLEN > skb2->len
+                                        || skb2->len > VLAN_ETH_FRAME_LEN) {
+                                dev->net->stats.rx_errors++;
+                                dev->net->stats.rx_length_errors++;
+                                DBG(dev, "rx length %d\n", skb2->len);
+                                dev_kfree_skb_any(skb2);
+                                goto next_frame;
+                        }
+                        skb2->protocol = eth_type_trans(skb2, dev->net);
+                        dev->net->stats.rx_packets++;
+                        dev->net->stats.rx_bytes += skb2->len;
+                        /* no buffer copies needed, unless hardware can't
+                         * use skb buffers.
+                         */
+                        status = netif_rx(skb2);
+next_frame:
+                        skb2 = skb_dequeue(&dev->rx_frames);
+                }
                break;
        /* software-driven interface shutdown */
@@ -313,20 +334,22 @@ quiesce:
                /* FALLTHROUGH */
        default:
-                rx_queue = 1;
-                dev_kfree_skb_any(skb);
                dev->net->stats.rx_errors++;
                DBG(dev, "rx status %d\n", status);
                break;
        }
+        if (skb)
+                dev_kfree_skb_any(skb);
+        if (!netif_running(dev->net)) {
 clean:
                spin_lock(&dev->req_lock);
                list_add(&req->list, &dev->rx_reqs);
                spin_unlock(&dev->req_lock);
+                req = NULL;
-        if (rx_queue && likely(napi_schedule_prep(&dev->rx_napi)))
+        }
-                __napi_schedule(&dev->rx_napi);
+        if (req)
+                rx_submit(dev, req, GFP_ATOMIC);
 }
 static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
@@ -391,24 +414,16 @@ static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
 {
        struct usb_request      *req;
        unsigned long           flags;
-        int                     rx_counts = 0;
        /* fill unused rxq slots with some skb */
        spin_lock_irqsave(&dev->req_lock, flags);
        while (!list_empty(&dev->rx_reqs)) {
-                if (++rx_counts > qlen(dev->gadget, dev->qmult))
-                        break;
                req = container_of(dev->rx_reqs.next,
                                struct usb_request, list);
                list_del_init(&req->list);
                spin_unlock_irqrestore(&dev->req_lock, flags);
                if (rx_submit(dev, req, gfp_flags) < 0) {
-                        spin_lock_irqsave(&dev->req_lock, flags);
-                        list_add(&req->list, &dev->rx_reqs);
-                        spin_unlock_irqrestore(&dev->req_lock, flags);
                        defer_kevent(dev, WORK_RX_MEMORY);
                        return;
                }
@@ -418,41 +433,6 @@ static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
        spin_unlock_irqrestore(&dev->req_lock, flags);
 }
-static int gether_poll(struct napi_struct *napi, int budget)
-{
-        struct eth_dev  *dev = container_of(napi, struct eth_dev, rx_napi);
-        struct sk_buff  *skb;
-        unsigned int    work_done = 0;
-        int             status = 0;
-        while ((skb = skb_dequeue(&dev->rx_frames))) {
-                if (status < 0
-                                || ETH_HLEN > skb->len
-                                || skb->len > VLAN_ETH_FRAME_LEN) {
-                        dev->net->stats.rx_errors++;
-                        dev->net->stats.rx_length_errors++;
-                        DBG(dev, "rx length %d\n", skb->len);
-                        dev_kfree_skb_any(skb);
-                        continue;
-                }
-                skb->protocol = eth_type_trans(skb, dev->net);
-                dev->net->stats.rx_packets++;
-                dev->net->stats.rx_bytes += skb->len;
-                status = netif_rx_ni(skb);
-        }
-        if (netif_running(dev->net)) {
-                rx_fill(dev, GFP_KERNEL);
-                work_done++;
-        }
-        if (work_done < budget)
-                napi_complete(&dev->rx_napi);
-        return work_done;
-}
 static void eth_work(struct work_struct *work)
 {
        struct eth_dev  *dev = container_of(work, struct eth_dev, work);
@@ -645,7 +625,6 @@ static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
        /* and open the tx floodgates */
        atomic_set(&dev->tx_qlen, 0);
        netif_wake_queue(dev->net);
-        napi_enable(&dev->rx_napi);
 }
 static int eth_open(struct net_device *net)
@@ -672,7 +651,6 @@ static int eth_stop(struct net_device *net)
        unsigned long   flags;
        VDBG(dev, "%s\n", __func__);
-        napi_disable(&dev->rx_napi);
        netif_stop_queue(net);
        DBG(dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
@@ -790,7 +768,6 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
                return ERR_PTR(-ENOMEM);
        dev = netdev_priv(net);
-        netif_napi_add(net, &dev->rx_napi, gether_poll, GETHER_NAPI_WEIGHT);
        spin_lock_init(&dev->lock);
        spin_lock_init(&dev->req_lock);
        INIT_WORK(&dev->work, eth_work);
@@ -853,7 +830,6 @@ struct net_device *gether_setup_name_default(const char *netname)
                return ERR_PTR(-ENOMEM);
        dev = netdev_priv(net);
-        netif_napi_add(net, &dev->rx_napi, gether_poll, GETHER_NAPI_WEIGHT);
        spin_lock_init(&dev->lock);
        spin_lock_init(&dev->req_lock);
        INIT_WORK(&dev->work, eth_work);
@@ -1137,7 +1113,6 @@ void gether_disconnect(struct gether *link)
 {
        struct eth_dev          *dev = link->ioport;
        struct usb_request      *req;
-        struct sk_buff          *skb;
        WARN_ON(!dev);
        if (!dev)
@@ -1164,12 +1139,6 @@ void gether_disconnect(struct gether *link)
                spin_lock(&dev->req_lock);
        }
        spin_unlock(&dev->req_lock);
-        spin_lock(&dev->rx_frames.lock);
-        while ((skb = __skb_dequeue(&dev->rx_frames)))
-                dev_kfree_skb_any(skb);
-        spin_unlock(&dev->rx_frames.lock);
        link->in_ep->driver_data = NULL;
        link->in_ep->desc = NULL;
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 9f170c53e3d9..134f354ede62 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -300,7 +300,7 @@ static int __init zero_bind(struct usb_composite_dev *cdev)
        ss_opts->isoc_interval = gzero_options.isoc_interval;
        ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket;
        ss_opts->isoc_mult = gzero_options.isoc_mult;
-        ss_opts->isoc_maxburst = gzero_options.isoc_maxpacket;
+        ss_opts->isoc_maxburst = gzero_options.isoc_maxburst;
        ss_opts->bulk_buflen = gzero_options.bulk_buflen;
        func_ss = usb_get_function(func_inst_ss);
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 6f2c8d3899d2..cf2734b532a7 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -248,7 +248,8 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
                break;
        }
-        if (pdata->have_sysif_regs && pdata->controller_ver &&
+        if (pdata->have_sysif_regs &&
+            pdata->controller_ver > FSL_USB_VER_1_6 &&
            (phy_mode == FSL_USB2_PHY_ULPI)) {
                /* check PHY_CLK_VALID to get phy clk valid */
                if (!(spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index c81c8721cc5a..cd871b895013 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -90,6 +90,24 @@ __acquires(ohci->lock)
        dl_done_list (ohci);
        finish_unlinks (ohci, ohci_frame_no(ohci));
+        /*
+         * Some controllers don't handle "global" suspend properly if
+         * there are unsuspended ports.  For these controllers, put all
+         * the enabled ports into suspend before suspending the root hub.
+         */
+        if (ohci->flags & OHCI_QUIRK_GLOBAL_SUSPEND) {
+                __hc32 __iomem  *portstat = ohci->regs->roothub.portstatus;
+                int             i;
+                unsigned        temp;
+                for (i = 0; i < ohci->num_ports; (++i, ++portstat)) {
+                        temp = ohci_readl(ohci, portstat);
+                        if ((temp & (RH_PS_PES | RH_PS_PSS)) ==
+                                        RH_PS_PES)
+                                ohci_writel(ohci, RH_PS_PSS, portstat);
+                }
+        }
        /* maybe resume can wake root hub */
        if (ohci_to_hcd(ohci)->self.root_hub->do_remote_wakeup || autostop) {
                ohci->hc_control |= OHCI_CTRL_RWE;
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 90879e9ccbec..bb1509675727 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -160,6 +160,7 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd)
                ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
        }
+        ohci->flags |= OHCI_QUIRK_GLOBAL_SUSPEND;
        return 0;
 }
diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
index 9250cada13f0..4550ce05af7f 100644
--- a/drivers/usb/host/ohci.h
+++ b/drivers/usb/host/ohci.h
@@ -405,6 +405,8 @@ struct ohci_hcd {
 #define OHCI_QUIRK_HUB_POWER    0x100                   /* distrust firmware power/oc setup */
 #define OHCI_QUIRK_AMD_PLL      0x200                   /* AMD PLL quirk*/
 #define OHCI_QUIRK_AMD_PREFETCH 0x400                   /* pre-fetch for ISO transfer */
+#define OHCI_QUIRK_GLOBAL_SUSPEND       0x800           /* must suspend ports */
        // there are also chip quirks/bugs in init logic
        struct work_struct      nec_work;       /* Worker for NEC quirk */
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 47390e369cd4..35d447780707 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -134,6 +134,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 */
                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
        }
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
@@ -143,9 +145,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
        }
        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
-                        pdev->device == 0x0015 &&
+                        pdev->device == 0x0015)
-                        pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
-                        pdev->subsystem_device == 0xc0cd)
                xhci->quirks |= XHCI_RESET_ON_RESUME;
        if (pdev->vendor == PCI_VENDOR_ID_VIA)
                xhci->quirks |= XHCI_RESET_ON_RESUME;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5f926bea5ab1..7a0e3c720c00 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -550,6 +550,7 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
        struct xhci_ring *ep_ring;
        struct xhci_generic_trb *trb;
        dma_addr_t addr;
+        u64 hw_dequeue;
        ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
                        ep_index, stream_id);
@@ -559,16 +560,6 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                                stream_id);
                return;
        }
-        state->new_cycle_state = 0;
-        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
-                        "Finding segment containing stopped TRB.");
-        state->new_deq_seg = find_trb_seg(cur_td->start_seg,
-                        dev->eps[ep_index].stopped_trb,
-                        &state->new_cycle_state);
-        if (!state->new_deq_seg) {
-                WARN_ON(1);
-                return;
-        }
        /* Dig out the cycle state saved by the xHC during the stop ep cmd */
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
@@ -577,46 +568,57 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
        if (ep->ep_state & EP_HAS_STREAMS) {
                struct xhci_stream_ctx *ctx =
                        &ep->stream_info->stream_ctx_array[stream_id];
-                state->new_cycle_state = 0x1 & le64_to_cpu(ctx->stream_ring);
+                hw_dequeue = le64_to_cpu(ctx->stream_ring);
        } else {
                struct xhci_ep_ctx *ep_ctx
                        = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
-                state->new_cycle_state = 0x1 & le64_to_cpu(ep_ctx->deq);
+                hw_dequeue = le64_to_cpu(ep_ctx->deq);
        }
+        /* Find virtual address and segment of hardware dequeue pointer */
+        state->new_deq_seg = ep_ring->deq_seg;
+        state->new_deq_ptr = ep_ring->dequeue;
+        while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
+                        != (dma_addr_t)(hw_dequeue & ~0xf)) {
+                next_trb(xhci, ep_ring, &state->new_deq_seg,
+                                        &state->new_deq_ptr);
+                if (state->new_deq_ptr == ep_ring->dequeue) {
+                        WARN_ON(1);
+                        return;
+                }
+        }
+        /*
+         * Find cycle state for last_trb, starting at old cycle state of
+         * hw_dequeue. If there is only one segment ring, find_trb_seg() will
+         * return immediately and cannot toggle the cycle state if this search
+         * wraps around, so add one more toggle manually in that case.
+         */
+        state->new_cycle_state = hw_dequeue & 0x1;
+        if (ep_ring->first_seg == ep_ring->first_seg->next &&
+                        cur_td->last_trb < state->new_deq_ptr)
+                state->new_cycle_state ^= 0x1;
        state->new_deq_ptr = cur_td->last_trb;
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                        "Finding segment containing last TRB in TD.");
        state->new_deq_seg = find_trb_seg(state->new_deq_seg,
-                        state->new_deq_ptr,
+                        state->new_deq_ptr, &state->new_cycle_state);
-                        &state->new_cycle_state);
        if (!state->new_deq_seg) {
                WARN_ON(1);
                return;
        }
+        /* Increment to find next TRB after last_trb. Cycle if appropriate. */
        trb = &state->new_deq_ptr->generic;
        if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
            (trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
                state->new_cycle_state ^= 0x1;
        next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
-        /*
+        /* Don't update the ring cycle state for the producer (us). */
-         * If there is only one segment in a ring, find_trb_seg()'s while loop
-         * will not run, and it will return before it has a chance to see if it
-         * needs to toggle the cycle bit.  It can't tell if the stalled transfer
-         * ended just before the link TRB on a one-segment ring, or if the TD
-         * wrapped around the top of the ring, because it doesn't have the TD in
-         * question.  Look for the one-segment case where stalled TRB's address
-         * is greater than the new dequeue pointer address.
-         */
-        if (ep_ring->first_seg == ep_ring->first_seg->next &&
-                        state->new_deq_ptr < dev->eps[ep_index].stopped_trb)
-                state->new_cycle_state ^= 0x1;
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                        "Cycle state = 0x%x", state->new_cycle_state);
-        /* Don't update the ring cycle state for the producer (us). */
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                        "New dequeue segment = %p (virtual)",
                        state->new_deq_seg);
@@ -799,7 +801,6 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
        if (list_empty(&ep->cancelled_td_list)) {
                xhci_stop_watchdog_timer_in_irq(xhci, ep);
                ep->stopped_td = NULL;
-                ep->stopped_trb = NULL;
                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
                return;
        }
@@ -867,11 +868,9 @@ remove_finished_td:
                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
        }
-        /* Clear stopped_td and stopped_trb if endpoint is not halted */
+        /* Clear stopped_td if endpoint is not halted */
-        if (!(ep->ep_state & EP_HALTED)) {
+        if (!(ep->ep_state & EP_HALTED))
                ep->stopped_td = NULL;
-                ep->stopped_trb = NULL;
-        }
        /*
         * Drop the lock and complete the URBs in the cancelled TD list.
@@ -1941,14 +1940,12 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
        struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
        ep->ep_state |= EP_HALTED;
        ep->stopped_td = td;
-        ep->stopped_trb = event_trb;
        ep->stopped_stream = stream_id;
        xhci_queue_reset_ep(xhci, slot_id, ep_index);
        xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
        ep->stopped_td = NULL;
-        ep->stopped_trb = NULL;
        ep->stopped_stream = 0;
        xhci_ring_cmd_db(xhci);
@@ -2030,7 +2027,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 * the ring dequeue pointer or take this TD off any lists yet.
                 */
                ep->stopped_td = td;
-                ep->stopped_trb = event_trb;
                return 0;
        } else {
                if (trb_comp_code == COMP_STALL) {
@@ -2042,7 +2038,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
                         * USB class driver clear the stall later.
                         */
                        ep->stopped_td = td;
-                        ep->stopped_trb = event_trb;
                        ep->stopped_stream = ep_ring->stream_id;
                } else if (xhci_requires_manual_halt_cleanup(xhci,
                                        ep_ctx, trb_comp_code)) {
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 8fe4e124ddd4..300836972faa 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -408,16 +408,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
 #else
-static int xhci_try_enable_msi(struct usb_hcd *hcd)
+static inline int xhci_try_enable_msi(struct usb_hcd *hcd)
 {
        return 0;
 }
-static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+static inline void xhci_cleanup_msix(struct xhci_hcd *xhci)
 {
 }
-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
 {
 }
@@ -2954,7 +2954,6 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
                xhci_ring_cmd_db(xhci);
        }
        virt_ep->stopped_td = NULL;
-        virt_ep->stopped_trb = NULL;
        virt_ep->stopped_stream = 0;
        spin_unlock_irqrestore(&xhci->lock, flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index d280e9213d08..4746816aed3e 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -865,8 +865,6 @@ struct xhci_virt_ep {
 #define EP_GETTING_NO_STREAMS   (1 << 5)
        /* ----  Related to URB cancellation ---- */
        struct list_head        cancelled_td_list;
-        /* The TRB that was last reported in a stopped endpoint ring */
-        union xhci_trb          *stopped_trb;
        struct xhci_td          *stopped_td;
        unsigned int            stopped_stream;
        /* Watchdog timer for stop endpoint command to cancel URBs */
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 3372ded5def7..e2fd263585de 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -470,8 +470,9 @@ static int dsps_musb_exit(struct musb *musb)
        struct dsps_glue *glue = dev_get_drvdata(dev->parent);
        del_timer_sync(&glue->timer);
        usb_phy_shutdown(musb->xceiv);
+        debugfs_remove_recursive(glue->dbgfs_root);
        return 0;
 }
@@ -708,8 +709,6 @@ static int dsps_remove(struct platform_device *pdev)
        pm_runtime_put(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
-        debugfs_remove_recursive(glue->dbgfs_root);
        return 0;
 }
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index d341c149a2f9..d369bf1f3936 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -316,7 +316,13 @@ static void omap_musb_mailbox_work(struct work_struct *mailbox_work)
 {
        struct omap2430_glue *glue = container_of(mailbox_work,
                                struct omap2430_glue, omap_musb_mailbox_work);
+        struct musb *musb = glue_to_musb(glue);
+        struct device *dev = musb->controller;
+        pm_runtime_get_sync(dev);
        omap_musb_set_mailbox(glue);
+        pm_runtime_mark_last_busy(dev);
+        pm_runtime_put_autosuspend(dev);
 }
 static irqreturn_t omap2430_musb_interrupt(int irq, void *__hci)
@@ -416,6 +422,7 @@ static int omap2430_musb_init(struct musb *musb)
                omap_musb_set_mailbox(glue);
        phy_init(musb->phy);
+        phy_power_on(musb->phy);
        pm_runtime_put_noidle(musb->controller);
        return 0;
@@ -478,6 +485,7 @@ static int omap2430_musb_exit(struct musb *musb)
        del_timer_sync(&musb_idle_timer);
        omap2430_low_level_exit(musb);
+        phy_power_off(musb->phy);
        phy_exit(musb->phy);
        return 0;
diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
index d75196ad5f2f..35b6083b7999 100644
--- a/drivers/usb/phy/phy-am335x-control.c
+++ b/drivers/usb/phy/phy-am335x-control.c
@@ -3,6 +3,7 @@
 #include <linux/err.h>
 #include <linux/of.h>
 #include <linux/io.h>
+#include <linux/delay.h>
 #include "am35x-phy-control.h"
 struct am335x_control_usb {
@@ -86,6 +87,14 @@ static void am335x_phy_power(struct phy_control *phy_ctrl, u32 id, bool on)
        }
        writel(val, usb_ctrl->phy_reg + reg);
+        /*
+         * Give the PHY ~1ms to complete the power up operation.
+         * Tests have shown unstable behaviour if other USB PHY related
+         * registers are written too shortly after such a transition.
+         */
+        if (on)
+                mdelay(1);
 }
 static const struct phy_control ctrl_am335x = {
diff --git a/drivers/usb/phy/phy-fsm-usb.c b/drivers/usb/phy/phy-fsm-usb.c
index c47e5a6edde2..d03fadd2629f 100644
--- a/drivers/usb/phy/phy-fsm-usb.c
+++ b/drivers/usb/phy/phy-fsm-usb.c
@@ -303,17 +303,18 @@ int otg_statemachine(struct otg_fsm *fsm)
                        otg_set_state(fsm, OTG_STATE_A_WAIT_VRISE);
                break;
        case OTG_STATE_A_WAIT_VRISE:
-                if (fsm->id || fsm->a_bus_drop || fsm->a_vbus_vld ||
+                if (fsm->a_vbus_vld)
-                                fsm->a_wait_vrise_tmout) {
                        otg_set_state(fsm, OTG_STATE_A_WAIT_BCON);
-                }
+                else if (fsm->id || fsm->a_bus_drop ||
+                                fsm->a_wait_vrise_tmout)
+                        otg_set_state(fsm, OTG_STATE_A_WAIT_VFALL);
                break;
        case OTG_STATE_A_WAIT_BCON:
                if (!fsm->a_vbus_vld)
                        otg_set_state(fsm, OTG_STATE_A_VBUS_ERR);
                else if (fsm->b_conn)
                        otg_set_state(fsm, OTG_STATE_A_HOST);
-                else if (fsm->id | fsm->a_bus_drop | fsm->a_wait_bcon_tmout)
+                else if (fsm->id || fsm->a_bus_drop || fsm->a_wait_bcon_tmout)
                        otg_set_state(fsm, OTG_STATE_A_WAIT_VFALL);
                break;
        case OTG_STATE_A_HOST:
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index 8afa813d690b..36b6bce33b20 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -132,6 +132,9 @@ struct usb_phy *usb_get_phy(enum usb_phy_type type)
        if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
                pr_debug("PHY: unable to find transceiver of type %s\n",
                        usb_phy_type_string(type));
+                if (!IS_ERR(phy))
+                        phy = ERR_PTR(-ENODEV);
                goto err0;
        }
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index a2db5be9c305..df90dae53eb9 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -28,6 +28,7 @@
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 #include <linux/serial.h>
+#include <linux/swab.h>
 #include <linux/kfifo.h>
 #include <linux/ioctl.h>
 #include <linux/firmware.h>
@@ -280,7 +281,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
 {
        int status = 0;
        __u8 read_length;
-        __be16 be_start_address;
+        u16 be_start_address;
        dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, length);
@@ -296,10 +297,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
                if (read_length > 1) {
                        dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, read_length);
                }
-                be_start_address = cpu_to_be16(start_address);
+                /*
+                 * NOTE: Must use swab as wIndex is sent in little-endian
+                 *       byte order regardless of host byte order.
+                 */
+                be_start_address = swab16((u16)start_address);
                status = ti_vread_sync(dev, UMPC_MEMORY_READ,
                                        (__u16)address_type,
-                                        (__force __u16)be_start_address,
+                                        be_start_address,
                                        buffer, read_length);
                if (status) {
@@ -394,7 +399,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
        struct device *dev = &serial->serial->dev->dev;
        int status = 0;
        int write_length;
-        __be16 be_start_address;
+        u16 be_start_address;
        /* We can only send a maximum of 1 aligned byte page at a time */
@@ -409,11 +414,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
                __func__, start_address, write_length);
        usb_serial_debug_data(dev, __func__, write_length, buffer);
-        /* Write first page */
+        /*
-        be_start_address = cpu_to_be16(start_address);
+         * Write first page.
+         *
+         * NOTE: Must use swab as wIndex is sent in little-endian byte order
+         *       regardless of host byte order.
+         */
+        be_start_address = swab16((u16)start_address);
        status = ti_vsend_sync(serial->serial->dev,
                                UMPC_MEMORY_WRITE, (__u16)address_type,
-                                (__force __u16)be_start_address,
+                                be_start_address,
                                buffer, write_length);
        if (status) {
                dev_dbg(dev, "%s - ERROR %d\n", __func__, status);
@@ -436,11 +446,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
                        __func__, start_address, write_length);
                usb_serial_debug_data(dev, __func__, write_length, buffer);
-                /* Write next page */
+                /*
-                be_start_address = cpu_to_be16(start_address);
+                 * Write next page.
+                 *
+                 * NOTE: Must use swab as wIndex is sent in little-endian byte
+                 *       order regardless of host byte order.
+                 */
+                be_start_address = swab16((u16)start_address);
                status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
                                (__u16)address_type,
-                                (__force __u16)be_start_address,
+                                be_start_address,
                                buffer, write_length);
                if (status) {
                        dev_err(dev, "%s - ERROR %d\n", __func__, status);
@@ -585,8 +600,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
                if (rom_desc->Type == desc_type)
                        return start_address;
-                start_address = start_address + sizeof(struct ti_i2c_desc)
+                start_address = start_address + sizeof(struct ti_i2c_desc) +
-                                                        + rom_desc->Size;
+                                                le16_to_cpu(rom_desc->Size);
        } while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
@@ -599,7 +614,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
        __u16 i;
        __u8 cs = 0;
-        for (i = 0; i < rom_desc->Size; i++)
+        for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
                cs = (__u8)(cs + buffer[i]);
        if (cs != rom_desc->CheckSum) {
@@ -650,7 +665,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
                        break;
                if ((start_address + sizeof(struct ti_i2c_desc) +
-                                        rom_desc->Size) > TI_MAX_I2C_SIZE) {
+                        le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
                        status = -ENODEV;
                        dev_dbg(dev, "%s - structure too big, erroring out.\n", __func__);
                        break;
@@ -665,7 +680,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
                        /* Read the descriptor data */
                        status = read_rom(serial, start_address +
                                                sizeof(struct ti_i2c_desc),
-                                                rom_desc->Size, buffer);
+                                                le16_to_cpu(rom_desc->Size),
+                                                buffer);
                        if (status)
                                break;
@@ -674,7 +690,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
                                break;
                }
                start_address = start_address + sizeof(struct ti_i2c_desc) +
-                                                                rom_desc->Size;
+                                                le16_to_cpu(rom_desc->Size);
        } while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
                                (start_address < TI_MAX_I2C_SIZE));
@@ -712,7 +728,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
        /* Read the descriptor data */
        status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
-                                                rom_desc->Size, buffer);
+                                        le16_to_cpu(rom_desc->Size), buffer);
        if (status)
                goto exit;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 367c7f08b27c..f213ee978516 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb);
 #define QUALCOMM_VENDOR_ID                      0x05C6
 #define CMOTECH_VENDOR_ID                       0x16d8
-#define CMOTECH_PRODUCT_6008                    0x6008
+#define CMOTECH_PRODUCT_6001                    0x6001
-#define CMOTECH_PRODUCT_6280                    0x6280
+#define CMOTECH_PRODUCT_CMU_300                 0x6002
+#define CMOTECH_PRODUCT_6003                    0x6003
+#define CMOTECH_PRODUCT_6004                    0x6004
+#define CMOTECH_PRODUCT_6005                    0x6005
+#define CMOTECH_PRODUCT_CGU_628A                0x6006
+#define CMOTECH_PRODUCT_CHE_628S                0x6007
+#define CMOTECH_PRODUCT_CMU_301                 0x6008
+#define CMOTECH_PRODUCT_CHU_628                 0x6280
+#define CMOTECH_PRODUCT_CHU_628S                0x6281
+#define CMOTECH_PRODUCT_CDU_680                 0x6803
+#define CMOTECH_PRODUCT_CDU_685A                0x6804
+#define CMOTECH_PRODUCT_CHU_720S                0x7001
+#define CMOTECH_PRODUCT_7002                    0x7002
+#define CMOTECH_PRODUCT_CHU_629K                0x7003
+#define CMOTECH_PRODUCT_7004                    0x7004
+#define CMOTECH_PRODUCT_7005                    0x7005
+#define CMOTECH_PRODUCT_CGU_629                 0x7006
+#define CMOTECH_PRODUCT_CHU_629S                0x700a
+#define CMOTECH_PRODUCT_CHU_720I                0x7211
+#define CMOTECH_PRODUCT_7212                    0x7212
+#define CMOTECH_PRODUCT_7213                    0x7213
+#define CMOTECH_PRODUCT_7251                    0x7251
+#define CMOTECH_PRODUCT_7252                    0x7252
+#define CMOTECH_PRODUCT_7253                    0x7253
 #define TELIT_VENDOR_ID                         0x1bc7
 #define TELIT_PRODUCT_UC864E                    0x1003
@@ -287,6 +310,7 @@ static void option_instat_callback(struct urb *urb);
 #define ALCATEL_PRODUCT_X060S_X200              0x0000
 #define ALCATEL_PRODUCT_X220_X500D              0x0017
 #define ALCATEL_PRODUCT_L100V                   0x011e
+#define ALCATEL_PRODUCT_L800MA                  0x0203
 #define PIRELLI_VENDOR_ID                       0x1266
 #define PIRELLI_PRODUCT_C100_1                  0x1002
@@ -349,6 +373,7 @@ static void option_instat_callback(struct urb *urb);
 #define OLIVETTI_PRODUCT_OLICARD100             0xc000
 #define OLIVETTI_PRODUCT_OLICARD145             0xc003
 #define OLIVETTI_PRODUCT_OLICARD200             0xc005
+#define OLIVETTI_PRODUCT_OLICARD500             0xc00b
 /* Celot products */
 #define CELOT_VENDOR_ID                         0x211f
@@ -502,6 +527,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = {
        .reserved = BIT(1) | BIT(2),
 };
+static const struct option_blacklist_info net_intf0_blacklist = {
+        .reserved = BIT(0),
+};
 static const struct option_blacklist_info net_intf1_blacklist = {
        .reserved = BIT(1),
 };
@@ -1035,8 +1064,47 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
-        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
-        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
+          .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
+          .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
+          .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
+          .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
+          .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
@@ -1500,6 +1568,8 @@ static const struct usb_device_id option_ids[] = {
          .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
+          .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
        { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
        { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
        { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
@@ -1545,6 +1615,9 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
                .driver_info = (kernel_ulong_t)&net_intf6_blacklist
        },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist
+        },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 968a40201e5f..6c0a542e8ec1 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -136,12 +136,36 @@ static const struct usb_device_id id_table[] = {
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 0)},       /* Sierra Wireless MC7710 Device Management */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 2)},       /* Sierra Wireless MC7710 NMEA */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 3)},       /* Sierra Wireless MC7710 Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 0)},       /* Sierra Wireless MC73xx Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 2)},       /* Sierra Wireless MC73xx NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 3)},       /* Sierra Wireless MC73xx Modem */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)},       /* Sierra Wireless EM7700 Device Management */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)},       /* Sierra Wireless EM7700 NMEA */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)},       /* Sierra Wireless EM7700 Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 0)},       /* Sierra Wireless EM7355 Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 2)},       /* Sierra Wireless EM7355 NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 3)},       /* Sierra Wireless EM7355 Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 0)},       /* Sierra Wireless MC7305/MC7355 Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 2)},       /* Sierra Wireless MC7305/MC7355 NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 3)},       /* Sierra Wireless MC7305/MC7355 Modem */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)},       /* Netgear AirCard 340U Device Management */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)},       /* Netgear AirCard 340U NMEA */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)},       /* Netgear AirCard 340U Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 0)},       /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 2)},       /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 3)},       /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 0)},       /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 2)},       /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 3)},       /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 0)},       /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 2)},       /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 3)},       /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 0)},       /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 2)},       /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 3)},       /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 0)},       /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 2)},       /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 3)},       /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Modem */
        { }                             /* Terminating entry */
 };
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 81fc0dfcfdcf..6d40d56378d7 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1347,10 +1347,12 @@ static int usb_serial_register(struct usb_serial_driver *driver)
 static void usb_serial_deregister(struct usb_serial_driver *device)
 {
        pr_info("USB Serial deregistering driver %s\n", device->description);
        mutex_lock(&table_lock);
        list_del(&device->driver_list);
-        usb_serial_bus_deregister(device);
        mutex_unlock(&table_lock);
+        usb_serial_bus_deregister(device);
 }
 /**
diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index 4ef2a80728f7..008d805c3d21 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -1851,7 +1851,7 @@ static int usbat_probe(struct usb_interface *intf,
        us->transport_name = "Shuttle USBAT";
        us->transport = usbat_flash_transport;
        us->transport_reset = usb_stor_CB_reset;
-        us->max_lun = 1;
+        us->max_lun = 0;
        result = usb_stor_probe2(us);
        return result;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index f4a82291894a..174a447868cd 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -234,6 +234,20 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_MAX_SECTORS_64 ),
+/* Reported by Daniele Forsi <dforsi@gmail.com> */
+UNUSUAL_DEV(  0x0421, 0x04b9, 0x0350, 0x0350,
+                "Nokia",
+                "5300",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64 ),
+/* Patch submitted by Victor A. Santos <victoraur.santos@gmail.com> */
+UNUSUAL_DEV(  0x0421, 0x05af, 0x0742, 0x0742,
+                "Nokia",
+                "305",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64),
 /* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
 UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
                "Nokia",
diff --git a/drivers/usb/wusbcore/mmc.c b/drivers/usb/wusbcore/mmc.c
index 44741267c917..3f485df96226 100644
--- a/drivers/usb/wusbcore/mmc.c
+++ b/drivers/usb/wusbcore/mmc.c
@@ -301,7 +301,7 @@ int wusbhc_chid_set(struct wusbhc *wusbhc, const struct wusb_ckhdid *chid)
        if (chid)
                result = uwb_radio_start(&wusbhc->pal);
-        else
+        else if (wusbhc->uwb_rc)
                uwb_radio_stop(&wusbhc->pal);
        return result;
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index c8e2a47d62a7..3e2e4ed20157 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -2390,10 +2390,10 @@ error_complete:
                done) {
                dev_info(dev, "Control EP stall.  Queue delayed work.\n");
-                spin_lock_irq(&wa->xfer_list_lock);
+                spin_lock(&wa->xfer_list_lock);
                /* move xfer from xfer_list to xfer_errored_list. */
                list_move_tail(&xfer->list_node, &wa->xfer_errored_list);
-                spin_unlock_irq(&wa->xfer_list_lock);
+                spin_unlock(&wa->xfer_list_lock);
                spin_unlock_irqrestore(&xfer->lock, flags);
                queue_work(wusbd, &wa->xfer_error_work);
        } else {
diff --git a/drivers/uwb/drp.c b/drivers/uwb/drp.c
index 1a2fd9795367..468c89fb6a16 100644
--- a/drivers/uwb/drp.c
+++ b/drivers/uwb/drp.c
@@ -59,6 +59,7 @@ static void uwb_rc_set_drp_cmd_done(struct uwb_rc *rc, void *arg,
                                    struct uwb_rceb *reply, ssize_t reply_size)
 {
        struct uwb_rc_evt_set_drp_ie *r = (struct uwb_rc_evt_set_drp_ie *)reply;
+        unsigned long flags;
        if (r != NULL) {
                if (r->bResultCode != UWB_RC_RES_SUCCESS)
@@ -67,14 +68,14 @@ static void uwb_rc_set_drp_cmd_done(struct uwb_rc *rc, void *arg,
        } else
                dev_err(&rc->uwb_dev.dev, "SET-DRP-IE: timeout\n");
-        spin_lock_irq(&rc->rsvs_lock);
+        spin_lock_irqsave(&rc->rsvs_lock, flags);
        if (rc->set_drp_ie_pending > 1) {
                rc->set_drp_ie_pending = 0;
-                uwb_rsv_queue_update(rc);       
+                uwb_rsv_queue_update(rc);
        } else {
-                rc->set_drp_ie_pending = 0;     
+                rc->set_drp_ie_pending = 0;
        }
-        spin_unlock_irq(&rc->rsvs_lock);
+        spin_unlock_irqrestore(&rc->rsvs_lock, flags);
 }
 /**
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index 96109a9972b6..84b4bfb84344 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -66,7 +66,22 @@ static DEFINE_PER_CPU(struct evtchn_fifo_queue, cpu_queue);
 static event_word_t *event_array[MAX_EVENT_ARRAY_PAGES] __read_mostly;
 static unsigned event_array_pages __read_mostly;
+/*
+ * sync_set_bit() and friends must be unsigned long aligned on non-x86
+ * platforms.
+ */
+#if !defined(CONFIG_X86) && BITS_PER_LONG > 32
+#define BM(w) (unsigned long *)((unsigned long)w & ~0x7UL)
+#define EVTCHN_FIFO_BIT(b, w) \
+    (((unsigned long)w & 0x4UL) ? (EVTCHN_FIFO_ ##b + 32) : EVTCHN_FIFO_ ##b)
+#else
 #define BM(w) ((unsigned long *)(w))
+#define EVTCHN_FIFO_BIT(b, w) EVTCHN_FIFO_ ##b
+#endif
 static inline event_word_t *event_word_from_port(unsigned port)
 {
@@ -161,33 +176,38 @@ static void evtchn_fifo_bind_to_cpu(struct irq_info *info, unsigned cpu)
 static void evtchn_fifo_clear_pending(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        sync_clear_bit(EVTCHN_FIFO_PENDING, BM(word));
+        sync_clear_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 static void evtchn_fifo_set_pending(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        sync_set_bit(EVTCHN_FIFO_PENDING, BM(word));
+        sync_set_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 static bool evtchn_fifo_is_pending(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        return sync_test_bit(EVTCHN_FIFO_PENDING, BM(word));
+        return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 static bool evtchn_fifo_test_and_set_mask(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        return sync_test_and_set_bit(EVTCHN_FIFO_MASKED, BM(word));
+        return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
 }
 static void evtchn_fifo_mask(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        sync_set_bit(EVTCHN_FIFO_MASKED, BM(word));
+        sync_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
 }
+static bool evtchn_fifo_is_masked(unsigned port)
+{
+        event_word_t *word = event_word_from_port(port);
+        return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
+}
 /*
 * Clear MASKED, spinning if BUSY is set.
 */
@@ -211,7 +231,7 @@ static void evtchn_fifo_unmask(unsigned port)
        BUG_ON(!irqs_disabled());
        clear_masked(word);
-        if (sync_test_bit(EVTCHN_FIFO_PENDING, BM(word))) {
+        if (evtchn_fifo_is_pending(port)) {
                struct evtchn_unmask unmask = { .port = port };
                (void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
        }
@@ -243,7 +263,7 @@ static void handle_irq_for_port(unsigned port)
 static void consume_one_event(unsigned cpu,
                              struct evtchn_fifo_control_block *control_block,
-                              unsigned priority, uint32_t *ready)
+                              unsigned priority, unsigned long *ready)
 {
        struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
        uint32_t head;
@@ -273,10 +293,9 @@ static void consume_one_event(unsigned cpu,
         * copy of the ready word.
         */
        if (head == 0)
-                clear_bit(priority, BM(ready));
+                clear_bit(priority, ready);
-        if (sync_test_bit(EVTCHN_FIFO_PENDING, BM(word))
+        if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port))
-            && !sync_test_bit(EVTCHN_FIFO_MASKED, BM(word)))
                handle_irq_for_port(port);
        q->head[priority] = head;
@@ -285,7 +304,7 @@ static void consume_one_event(unsigned cpu,
 static void evtchn_fifo_handle_events(unsigned cpu)
 {
        struct evtchn_fifo_control_block *control_block;
-        uint32_t ready;
+        unsigned long ready;
        unsigned q;
        control_block = per_cpu(cpu_control_block, cpu);
diff --git a/fs/affs/super.c b/fs/affs/super.c
index 6d589f28bf9b..895ac7dc9dbf 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -340,8 +340,6 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent)
                                &blocksize,&sbi->s_prefix,
                                sbi->s_volume, &mount_flags)) {
                printk(KERN_ERR "AFFS: Error parsing options\n");
-                kfree(sbi->s_prefix);
-                kfree(sbi);
                return -EINVAL;
        }
        /* N.B. after this point s_prefix must be released */
diff --git a/fs/aio.c b/fs/aio.c
index 12a3de0ee6da..a0ed6c7d2cd2 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -112,6 +112,11 @@ struct kioctx {
        struct work_struct      free_work;
+        /*
+         * signals when all in-flight requests are done
+         */
+        struct completion *requests_done;
        struct {
                /*
                 * This counts the number of available slots in the ringbuffer,
@@ -508,6 +513,10 @@ static void free_ioctx_reqs(struct percpu_ref *ref)
 {
        struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
+        /* At this point we know that there are no any in-flight requests */
+        if (ctx->requests_done)
+                complete(ctx->requests_done);
        INIT_WORK(&ctx->free_work, free_ioctx);
        schedule_work(&ctx->free_work);
 }
@@ -718,7 +727,8 @@ err:
 *      when the processes owning a context have all exited to encourage
 *      the rapid destruction of the kioctx.
 */
-static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx)
+static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
+                struct completion *requests_done)
 {
        if (!atomic_xchg(&ctx->dead, 1)) {
                struct kioctx_table *table;
@@ -747,7 +757,11 @@ static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx)
                if (ctx->mmap_size)
                        vm_munmap(ctx->mmap_base, ctx->mmap_size);
+                ctx->requests_done = requests_done;
                percpu_ref_kill(&ctx->users);
+        } else {
+                if (requests_done)
+                        complete(requests_done);
        }
 }
@@ -809,7 +823,7 @@ void exit_aio(struct mm_struct *mm)
                 */
                ctx->mmap_size = 0;
-                kill_ioctx(mm, ctx);
+                kill_ioctx(mm, ctx, NULL);
        }
 }
@@ -1185,7 +1199,7 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
        if (!IS_ERR(ioctx)) {
                ret = put_user(ioctx->user_id, ctxp);
                if (ret)
-                        kill_ioctx(current->mm, ioctx);
+                        kill_ioctx(current->mm, ioctx, NULL);
                percpu_ref_put(&ioctx->users);
        }
@@ -1203,8 +1217,22 @@ SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
 {
        struct kioctx *ioctx = lookup_ioctx(ctx);
        if (likely(NULL != ioctx)) {
-                kill_ioctx(current->mm, ioctx);
+                struct completion requests_done =
+                        COMPLETION_INITIALIZER_ONSTACK(requests_done);
+                /* Pass requests_done to kill_ioctx() where it can be set
+                 * in a thread-safe way. If we try to set it here then we have
+                 * a race condition if two io_destroy() called simultaneously.
+                 */
+                kill_ioctx(current->mm, ioctx, &requests_done);
                percpu_ref_put(&ioctx->users);
+                /* Wait until all IO for the context are done. Otherwise kernel
+                 * keep using user-space buffers even if user thinks the context
+                 * is destroyed.
+                 */
+                wait_for_completion(&requests_done);
                return 0;
        }
        pr_debug("EINVAL: io_destroy: invalid context id\n");
@@ -1299,10 +1327,8 @@ rw_common:
                                                &iovec, compat)
                        : aio_setup_single_vector(req, rw, buf, &nr_segs,
                                                  iovec);
-                if (ret)
+                if (!ret)
-                        return ret;
+                        ret = rw_verify_area(rw, file, &req->ki_pos, req->ki_nbytes);
-                ret = rw_verify_area(rw, file, &req->ki_pos, req->ki_nbytes);
                if (ret < 0) {
                        if (iovec != &inline_vec)
                                kfree(iovec);
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 2caf36ac3e93..cc87c1abac97 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -179,7 +179,7 @@ static struct dentry *autofs4_lookup_active(struct dentry *dentry)
                spin_lock(&active->d_lock);
                /* Already gone? */
-                if (!d_count(active))
+                if ((int) d_count(active) <= 0)
                        goto next;
                qstr = &active->d_name;
@@ -230,7 +230,7 @@ static struct dentry *autofs4_lookup_expiring(struct dentry *dentry)
                spin_lock(&expiring->d_lock);
-                /* Bad luck, we've already been dentry_iput */
+                /* We've already been dentry_iput or unlinked */
                if (!expiring->d_inode)
                        goto next;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 4c48df572bd6..ba6b88528dc7 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2058,6 +2058,20 @@ struct btrfs_ioctl_defrag_range_args {
 #define btrfs_raw_test_opt(o, opt)      ((o) & BTRFS_MOUNT_##opt)
 #define btrfs_test_opt(root, opt)       ((root)->fs_info->mount_opt & \
                                         BTRFS_MOUNT_##opt)
+#define btrfs_set_and_info(root, opt, fmt, args...)                     \
+{                                                                       \
+        if (!btrfs_test_opt(root, opt))                                 \
+                btrfs_info(root->fs_info, fmt, ##args);                 \
+        btrfs_set_opt(root->fs_info->mount_opt, opt);                   \
+}
+#define btrfs_clear_and_info(root, opt, fmt, args...)                   \
+{                                                                       \
+        if (btrfs_test_opt(root, opt))                                  \
+                btrfs_info(root->fs_info, fmt, ##args);                 \
+        btrfs_clear_opt(root->fs_info->mount_opt, opt);                 \
+}
 /*
 * Inode flags
 */
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 029d46c2e170..983314932af3 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2861,7 +2861,7 @@ retry_root_backup:
                        printk(KERN_ERR "BTRFS: failed to read log tree\n");
                        free_extent_buffer(log_tree_root->node);
                        kfree(log_tree_root);
-                        goto fail_trans_kthread;
+                        goto fail_qgroup;
                }
                /* returns with log_tree_root freed on success */
                ret = btrfs_recover_log_trees(log_tree_root);
@@ -2870,24 +2870,24 @@ retry_root_backup:
                                    "Failed to recover log tree");
                        free_extent_buffer(log_tree_root->node);
                        kfree(log_tree_root);
-                        goto fail_trans_kthread;
+                        goto fail_qgroup;
                }
                if (sb->s_flags & MS_RDONLY) {
                        ret = btrfs_commit_super(tree_root);
                        if (ret)
-                                goto fail_trans_kthread;
+                                goto fail_qgroup;
                }
        }
        ret = btrfs_find_orphan_roots(tree_root);
        if (ret)
-                goto fail_trans_kthread;
+                goto fail_qgroup;
        if (!(sb->s_flags & MS_RDONLY)) {
                ret = btrfs_cleanup_fs_roots(fs_info);
                if (ret)
-                        goto fail_trans_kthread;
+                        goto fail_qgroup;
                ret = btrfs_recover_relocation(tree_root);
                if (ret < 0) {
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 1306487c82cf..5590af92094b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1542,6 +1542,7 @@ again:
                                ret = 0;
                }
                if (ret) {
+                        key.objectid = bytenr;
                        key.type = BTRFS_EXTENT_ITEM_KEY;
                        key.offset = num_bytes;
                        btrfs_release_path(path);
@@ -3542,11 +3543,13 @@ static u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags)
        return extended_to_chunk(flags | tmp);
 }
-static u64 get_alloc_profile(struct btrfs_root *root, u64 flags)
+static u64 get_alloc_profile(struct btrfs_root *root, u64 orig_flags)
 {
        unsigned seq;
+        u64 flags;
        do {
+                flags = orig_flags;
                seq = read_seqbegin(&root->fs_info->profiles_lock);
                if (flags & BTRFS_BLOCK_GROUP_DATA)
@@ -5719,6 +5722,7 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans,
                        if (ret > 0 && skinny_metadata) {
                                skinny_metadata = false;
+                                key.objectid = bytenr;
                                key.type = BTRFS_EXTENT_ITEM_KEY;
                                key.offset = num_bytes;
                                btrfs_release_path(path);
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index eb742c07e7a4..ae6af072b635 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -800,7 +800,7 @@ next_slot:
                if (start > key.offset && end < extent_end) {
                        BUG_ON(del_nr > 0);
                        if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
-                                ret = -EINVAL;
+                                ret = -EOPNOTSUPP;
                                break;
                        }
@@ -846,7 +846,7 @@ next_slot:
                 */
                if (start <= key.offset && end < extent_end) {
                        if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
-                                ret = -EINVAL;
+                                ret = -EOPNOTSUPP;
                                break;
                        }
@@ -872,7 +872,7 @@ next_slot:
                if (start > key.offset && end >= extent_end) {
                        BUG_ON(del_nr > 0);
                        if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
-                                ret = -EINVAL;
+                                ret = -EOPNOTSUPP;
                                break;
                        }
@@ -1777,7 +1777,7 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
        start_pos = round_down(pos, root->sectorsize);
        if (start_pos > i_size_read(inode)) {
                /* Expand hole size to cover write data, preventing empty gap */
-                end_pos = round_up(pos + iov->iov_len, root->sectorsize);
+                end_pos = round_up(pos + count, root->sectorsize);
                err = btrfs_cont_expand(inode, i_size_read(inode), end_pos);
                if (err) {
                        mutex_unlock(&inode->i_mutex);
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index cc8ca193d830..86935f5ae291 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -176,7 +176,11 @@ static void start_caching(struct btrfs_root *root)
        tsk = kthread_run(caching_kthread, root, "btrfs-ino-cache-%llu\n",
                          root->root_key.objectid);
-        BUG_ON(IS_ERR(tsk)); /* -ENOMEM */
+        if (IS_ERR(tsk)) {
+                btrfs_warn(root->fs_info, "failed to start inode caching task");
+                btrfs_clear_and_info(root, CHANGE_INODE_CACHE,
+                                "disabling inode map caching");
+        }
 }
 int btrfs_find_free_ino(struct btrfs_root *root, u64 *objectid)
@@ -205,24 +209,14 @@ again:
 void btrfs_return_ino(struct btrfs_root *root, u64 objectid)
 {
-        struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
        struct btrfs_free_space_ctl *pinned = root->free_ino_pinned;
        if (!btrfs_test_opt(root, INODE_MAP_CACHE))
                return;
 again:
        if (root->cached == BTRFS_CACHE_FINISHED) {
-                __btrfs_add_free_space(ctl, objectid, 1);
+                __btrfs_add_free_space(pinned, objectid, 1);
        } else {
-                /*
-                 * If we are in the process of caching free ino chunks,
-                 * to avoid adding the same inode number to the free_ino
-                 * tree twice due to cross transaction, we'll leave it
-                 * in the pinned tree until a transaction is committed
-                 * or the caching work is done.
-                 */
                down_write(&root->fs_info->commit_root_sem);
                spin_lock(&root->cache_lock);
                if (root->cached == BTRFS_CACHE_FINISHED) {
@@ -234,11 +228,7 @@ again:
                start_caching(root);
-                if (objectid <= root->cache_progress ||
+                __btrfs_add_free_space(pinned, objectid, 1);
-                    objectid >= root->highest_objectid)
-                        __btrfs_add_free_space(ctl, objectid, 1);
-                else
-                        __btrfs_add_free_space(pinned, objectid, 1);
                up_write(&root->fs_info->commit_root_sem);
        }
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index e79ff6b90cb7..2f6d7b13b5bd 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3066,7 +3066,7 @@ process_slot:
                                                         new_key.offset + datal,
                                                         1);
                                if (ret) {
-                                        if (ret != -EINVAL)
+                                        if (ret != -EOPNOTSUPP)
                                                btrfs_abort_transaction(trans,
                                                                root, ret);
                                        btrfs_end_transaction(trans, root);
@@ -3120,6 +3120,8 @@ process_slot:
                        } else if (type == BTRFS_FILE_EXTENT_INLINE) {
                                u64 skip = 0;
                                u64 trim = 0;
+                                u64 aligned_end = 0;
                                if (off > key.offset) {
                                        skip = off - key.offset;
                                        new_key.offset += skip;
@@ -3136,12 +3138,14 @@ process_slot:
                                size -= skip + trim;
                                datal -= skip + trim;
+                                aligned_end = ALIGN(new_key.offset + datal,
+                                                    root->sectorsize);
                                ret = btrfs_drop_extents(trans, root, inode,
                                                         new_key.offset,
-                                                         new_key.offset + datal,
+                                                         aligned_end,
                                                         1);
                                if (ret) {
-                                        if (ret != -EINVAL)
+                                        if (ret != -EOPNOTSUPP)
                                                btrfs_abort_transaction(trans,
                                                        root, ret);
                                        btrfs_end_transaction(trans, root);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 1ac3ca98c429..fd38b5053479 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -349,6 +349,11 @@ static int fs_path_ensure_buf(struct fs_path *p, int len)
        if (p->buf_len >= len)
                return 0;
+        if (len > PATH_MAX) {
+                WARN_ON(1);
+                return -ENOMEM;
+        }
        path_len = p->end - p->start;
        old_buf_len = p->buf_len;
@@ -1663,7 +1668,7 @@ static int get_first_ref(struct btrfs_root *root, u64 ino,
                goto out;
        }
-        if (key.type == BTRFS_INODE_REF_KEY) {
+        if (found_key.type == BTRFS_INODE_REF_KEY) {
                struct btrfs_inode_ref *iref;
                iref = btrfs_item_ptr(path->nodes[0], path->slots[0],
                                      struct btrfs_inode_ref);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 5011aadacab8..9601d25a4607 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -385,20 +385,6 @@ static match_table_t tokens = {
        {Opt_err, NULL},
 };
-#define btrfs_set_and_info(root, opt, fmt, args...)                     \
-{                                                                       \
-        if (!btrfs_test_opt(root, opt))                                 \
-                btrfs_info(root->fs_info, fmt, ##args);                 \
-        btrfs_set_opt(root->fs_info->mount_opt, opt);                   \
-}
-#define btrfs_clear_and_info(root, opt, fmt, args...)                   \
-{                                                                       \
-        if (btrfs_test_opt(root, opt))                                  \
-                btrfs_info(root->fs_info, fmt, ##args);                 \
-        btrfs_clear_opt(root->fs_info->mount_opt, opt);                 \
-}
 /*
 * Regular mount options parser.  Everything that is needed only when
 * reading in a new superblock is parsed here.
@@ -1186,7 +1172,6 @@ static struct dentry *mount_subvol(const char *subvol_name, int flags,
                return ERR_PTR(-ENOMEM);
        mnt = vfs_kern_mount(&btrfs_fs_type, flags, device_name,
                             newargs);
-        kfree(newargs);
        if (PTR_RET(mnt) == -EBUSY) {
                if (flags & MS_RDONLY) {
@@ -1196,17 +1181,22 @@ static struct dentry *mount_subvol(const char *subvol_name, int flags,
                        int r;
                        mnt = vfs_kern_mount(&btrfs_fs_type, flags | MS_RDONLY, device_name,
                                             newargs);
-                        if (IS_ERR(mnt))
+                        if (IS_ERR(mnt)) {
+                                kfree(newargs);
                                return ERR_CAST(mnt);
+                        }
                        r = btrfs_remount(mnt->mnt_sb, &flags, NULL);
                        if (r < 0) {
                                /* FIXME: release vfsmount mnt ??*/
+                                kfree(newargs);
                                return ERR_PTR(r);
                        }
                }
        }
+        kfree(newargs);
        if (IS_ERR(mnt))
                return ERR_CAST(mnt);
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 2e5e648eb5c3..c561b628ebce 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -3261,7 +3261,7 @@ int ceph_encode_inode_release(void **p, struct inode *inode,
                        rel->seq = cpu_to_le32(cap->seq);
                        rel->issue_seq = cpu_to_le32(cap->issue_seq),
                        rel->mseq = cpu_to_le32(cap->mseq);
-                        rel->caps = cpu_to_le32(cap->issued);
+                        rel->caps = cpu_to_le32(cap->implemented);
                        rel->wanted = cpu_to_le32(cap->mds_wanted);
                        rel->dname_len = 0;
                        rel->dname_seq = 0;
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 766410a12c2c..c29d6ae68874 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -141,7 +141,7 @@ static int __dcache_readdir(struct file *file,  struct dir_context *ctx,
        /* start at beginning? */
        if (ctx->pos == 2 || last == NULL ||
-            ctx->pos < ceph_dentry(last)->offset) {
+            fpos_cmp(ctx->pos, ceph_dentry(last)->offset) < 0) {
                if (list_empty(&parent->d_subdirs))
                        goto out_unlock;
                p = parent->d_subdirs.prev;
@@ -182,9 +182,16 @@ more:
        spin_unlock(&dentry->d_lock);
        spin_unlock(&parent->d_lock);
+        /* make sure a dentry wasn't dropped while we didn't have parent lock */
+        if (!ceph_dir_is_complete(dir)) {
+                dout(" lost dir complete on %p; falling back to mds\n", dir);
+                dput(dentry);
+                err = -EAGAIN;
+                goto out;
+        }
        dout(" %llu (%llu) dentry %p %.*s %p\n", di->offset, ctx->pos,
             dentry, dentry->d_name.len, dentry->d_name.name, dentry->d_inode);
-        ctx->pos = di->offset;
        if (!dir_emit(ctx, dentry->d_name.name,
                      dentry->d_name.len,
                      ceph_translate_ino(dentry->d_sb, dentry->d_inode->i_ino),
@@ -198,19 +205,12 @@ more:
                return 0;
        }
+        ctx->pos = di->offset + 1;
        if (last)
                dput(last);
        last = dentry;
-        ctx->pos++;
-        /* make sure a dentry wasn't dropped while we didn't have parent lock */
-        if (!ceph_dir_is_complete(dir)) {
-                dout(" lost dir complete on %p; falling back to mds\n", dir);
-                err = -EAGAIN;
-                goto out;
-        }
        spin_lock(&parent->d_lock);
        p = p->prev;    /* advance to next dentry */
        goto more;
@@ -296,6 +296,8 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
                err = __dcache_readdir(file, ctx, shared_gen);
                if (err != -EAGAIN)
                        return err;
+                frag = fpos_frag(ctx->pos);
+                off = fpos_off(ctx->pos);
        } else {
                spin_unlock(&ci->i_ceph_lock);
        }
@@ -446,7 +448,6 @@ more:
        if (atomic_read(&ci->i_release_count) == fi->dir_release_count) {
                dout(" marking %p complete\n", inode);
                __ceph_dir_set_complete(ci, fi->dir_release_count);
-                ci->i_max_offset = ctx->pos;
        }
        spin_unlock(&ci->i_ceph_lock);
@@ -935,14 +936,16 @@ static int ceph_rename(struct inode *old_dir, struct dentry *old_dentry,
                 * to do it here.
                 */
-                /* d_move screws up d_subdirs order */
-                ceph_dir_clear_complete(new_dir);
                d_move(old_dentry, new_dentry);
                /* ensure target dentry is invalidated, despite
                   rehashing bug in vfs_rename_dir */
                ceph_invalidate_dentry_lease(new_dentry);
+                /* d_move screws up sibling dentries' offsets */
+                ceph_dir_clear_complete(old_dir);
+                ceph_dir_clear_complete(new_dir);
        }
        ceph_mdsc_put_request(req);
        return err;
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 0b0728e5be2d..233c6f96910a 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -744,7 +744,6 @@ static int fill_inode(struct inode *inode,
            !__ceph_dir_is_complete(ci)) {
                dout(" marking %p complete (empty)\n", inode);
                __ceph_dir_set_complete(ci, atomic_read(&ci->i_release_count));
-                ci->i_max_offset = 2;
        }
 no_change:
        /* only update max_size on auth cap */
@@ -890,41 +889,6 @@ out_unlock:
 }
 /*
- * Set dentry's directory position based on the current dir's max, and
- * order it in d_subdirs, so that dcache_readdir behaves.
- *
- * Always called under directory's i_mutex.
- */
-static void ceph_set_dentry_offset(struct dentry *dn)
-{
-        struct dentry *dir = dn->d_parent;
-        struct inode *inode = dir->d_inode;
-        struct ceph_inode_info *ci;
-        struct ceph_dentry_info *di;
-        BUG_ON(!inode);
-        ci = ceph_inode(inode);
-        di = ceph_dentry(dn);
-        spin_lock(&ci->i_ceph_lock);
-        if (!__ceph_dir_is_complete(ci)) {
-                spin_unlock(&ci->i_ceph_lock);
-                return;
-        }
-        di->offset = ceph_inode(inode)->i_max_offset++;
-        spin_unlock(&ci->i_ceph_lock);
-        spin_lock(&dir->d_lock);
-        spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
-        list_move(&dn->d_u.d_child, &dir->d_subdirs);
-        dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
-             dn->d_u.d_child.prev, dn->d_u.d_child.next);
-        spin_unlock(&dn->d_lock);
-        spin_unlock(&dir->d_lock);
-}
-/*
 * splice a dentry to an inode.
 * caller must hold directory i_mutex for this to be safe.
 *
@@ -933,7 +897,7 @@ static void ceph_set_dentry_offset(struct dentry *dn)
 * the caller) if we fail.
 */
 static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
-                                    bool *prehash, bool set_offset)
+                                    bool *prehash)
 {
        struct dentry *realdn;
@@ -965,8 +929,6 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
        }
        if ((!prehash || *prehash) && d_unhashed(dn))
                d_rehash(dn);
-        if (set_offset)
-                ceph_set_dentry_offset(dn);
 out:
        return dn;
 }
@@ -987,7 +949,6 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
 {
        struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info;
        struct inode *in = NULL;
-        struct ceph_mds_reply_inode *ininfo;
        struct ceph_vino vino;
        struct ceph_fs_client *fsc = ceph_sb_to_client(sb);
        int err = 0;
@@ -1161,6 +1122,9 @@ retry_lookup:
                /* rename? */
                if (req->r_old_dentry && req->r_op == CEPH_MDS_OP_RENAME) {
+                        struct inode *olddir = req->r_old_dentry_dir;
+                        BUG_ON(!olddir);
                        dout(" src %p '%.*s' dst %p '%.*s'\n",
                             req->r_old_dentry,
                             req->r_old_dentry->d_name.len,
@@ -1180,13 +1144,10 @@ retry_lookup:
                           rehashing bug in vfs_rename_dir */
                        ceph_invalidate_dentry_lease(dn);
-                        /*
+                        /* d_move screws up sibling dentries' offsets */
-                         * d_move() puts the renamed dentry at the end of
+                        ceph_dir_clear_complete(dir);
-                         * d_subdirs.  We need to assign it an appropriate
+                        ceph_dir_clear_complete(olddir);
-                         * directory offset so we can behave when dir is
-                         * complete.
-                         */
-                        ceph_set_dentry_offset(req->r_old_dentry);
                        dout("dn %p gets new offset %lld\n", req->r_old_dentry,
                             ceph_dentry(req->r_old_dentry)->offset);
@@ -1213,8 +1174,9 @@ retry_lookup:
                /* attach proper inode */
                if (!dn->d_inode) {
+                        ceph_dir_clear_complete(dir);
                        ihold(in);
-                        dn = splice_dentry(dn, in, &have_lease, true);
+                        dn = splice_dentry(dn, in, &have_lease);
                        if (IS_ERR(dn)) {
                                err = PTR_ERR(dn);
                                goto done;
@@ -1235,17 +1197,16 @@ retry_lookup:
                   (req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
                    req->r_op == CEPH_MDS_OP_MKSNAP)) {
                struct dentry *dn = req->r_dentry;
+                struct inode *dir = req->r_locked_dir;
                /* fill out a snapdir LOOKUPSNAP dentry */
                BUG_ON(!dn);
-                BUG_ON(!req->r_locked_dir);
+                BUG_ON(!dir);
-                BUG_ON(ceph_snap(req->r_locked_dir) != CEPH_SNAPDIR);
+                BUG_ON(ceph_snap(dir) != CEPH_SNAPDIR);
-                ininfo = rinfo->targeti.in;
-                vino.ino = le64_to_cpu(ininfo->ino);
-                vino.snap = le64_to_cpu(ininfo->snapid);
                dout(" linking snapped dir %p to dn %p\n", in, dn);
+                ceph_dir_clear_complete(dir);
                ihold(in);
-                dn = splice_dentry(dn, in, NULL, true);
+                dn = splice_dentry(dn, in, NULL);
                if (IS_ERR(dn)) {
                        err = PTR_ERR(dn);
                        goto done;
@@ -1407,7 +1368,7 @@ retry_lookup:
                }
                if (!dn->d_inode) {
-                        dn = splice_dentry(dn, in, NULL, false);
+                        dn = splice_dentry(dn, in, NULL);
                        if (IS_ERR(dn)) {
                                err = PTR_ERR(dn);
                                dn = NULL;
diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
index fdf941b44ff1..a822a6e58290 100644
--- a/fs/ceph/ioctl.c
+++ b/fs/ceph/ioctl.c
@@ -109,6 +109,8 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg)
                return PTR_ERR(req);
        req->r_inode = inode;
        ihold(inode);
+        req->r_num_caps = 1;
        req->r_inode_drop = CEPH_CAP_FILE_SHARED | CEPH_CAP_FILE_EXCL;
        req->r_args.setlayout.layout.fl_stripe_unit =
@@ -153,6 +155,7 @@ static long ceph_ioctl_set_layout_policy (struct file *file, void __user *arg)
                return PTR_ERR(req);
        req->r_inode = inode;
        ihold(inode);
+        req->r_num_caps = 1;
        req->r_args.setlayout.layout.fl_stripe_unit =
                        cpu_to_le32(l.stripe_unit);
diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index d94ba0df9f4d..191398852a2e 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -45,6 +45,7 @@ static int ceph_lock_message(u8 lock_type, u16 operation, struct file *file,
                return PTR_ERR(req);
        req->r_inode = inode;
        ihold(inode);
+        req->r_num_caps = 1;
        /* mds requires start and length rather than start and end */
        if (LLONG_MAX == fl->fl_end)
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 7866cd05a6bb..ead05cc1f447 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -266,7 +266,6 @@ struct ceph_inode_info {
        struct timespec i_rctime;
        u64 i_rbytes, i_rfiles, i_rsubdirs;
        u64 i_files, i_subdirs;
-        u64 i_max_offset;  /* largest readdir offset, set with complete dir */
        struct rb_root i_fragtree;
        struct mutex i_fragtree_mutex;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index aadc2b68678b..a22d667f1069 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1737,6 +1737,9 @@ cifs_inode_needs_reval(struct inode *inode)
        if (cifs_i->time == 0)
                return true;
+        if (!cifs_sb->actimeo)
+                return true;
        if (!time_in_range(jiffies, cifs_i->time,
                                cifs_i->time + cifs_sb->actimeo))
                return true;
diff --git a/fs/compat.c b/fs/compat.c
index ca926ad0430c..66d3d3c6b4b2 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -457,9 +457,9 @@ COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
        case F_GETLK64:
        case F_SETLK64:
        case F_SETLKW64:
-        case F_GETLKP:
+        case F_OFD_GETLK:
-        case F_SETLKP:
+        case F_OFD_SETLK:
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
                ret = get_compat_flock64(&f, compat_ptr(arg));
                if (ret != 0)
                        break;
@@ -468,7 +468,7 @@ COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
                conv_cmd = convert_fcntl_cmd(cmd);
                ret = sys_fcntl(fd, conv_cmd, (unsigned long)&f);
                set_fs(old_fs);
-                if ((conv_cmd == F_GETLK || conv_cmd == F_GETLKP) && ret == 0) {
+                if ((conv_cmd == F_GETLK || conv_cmd == F_OFD_GETLK) && ret == 0) {
                        /* need to return lock information - see above for commentary */
                        if (f.l_start > COMPAT_LOFF_T_MAX)
                                ret = -EOVERFLOW;
@@ -493,9 +493,9 @@ COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
        case F_GETLK64:
        case F_SETLK64:
        case F_SETLKW64:
-        case F_GETLKP:
+        case F_OFD_GETLK:
-        case F_SETLKP:
+        case F_OFD_SETLK:
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
                return -EINVAL;
        }
        return compat_sys_fcntl64(fd, cmd, arg);
diff --git a/fs/dcache.c b/fs/dcache.c
index 40707d88a945..42ae01eefc07 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -246,16 +246,8 @@ static void __d_free(struct rcu_head *head)
        kmem_cache_free(dentry_cache, dentry); 
 }
-/*
+static void dentry_free(struct dentry *dentry)
- * no locks, please.
- */
-static void d_free(struct dentry *dentry)
 {
-        BUG_ON((int)dentry->d_lockref.count > 0);
-        this_cpu_dec(nr_dentry);
-        if (dentry->d_op && dentry->d_op->d_release)
-                dentry->d_op->d_release(dentry);
        /* if dentry was never visible to RCU, immediate free is OK */
        if (!(dentry->d_flags & DCACHE_RCUACCESS))
                __d_free(&dentry->d_u.d_rcu);
@@ -403,56 +395,6 @@ static void dentry_lru_add(struct dentry *dentry)
                d_lru_add(dentry);
 }
-/*
- * Remove a dentry with references from the LRU.
- *
- * If we are on the shrink list, then we can get to try_prune_one_dentry() and
- * lose our last reference through the parent walk. In this case, we need to
- * remove ourselves from the shrink list, not the LRU.
- */
-static void dentry_lru_del(struct dentry *dentry)
-{
-        if (dentry->d_flags & DCACHE_LRU_LIST) {
-                if (dentry->d_flags & DCACHE_SHRINK_LIST)
-                        return d_shrink_del(dentry);
-                d_lru_del(dentry);
-        }
-}
-/**
- * d_kill - kill dentry and return parent
- * @dentry: dentry to kill
- * @parent: parent dentry
- *
- * The dentry must already be unhashed and removed from the LRU.
- *
- * If this is the root of the dentry tree, return NULL.
- *
- * dentry->d_lock and parent->d_lock must be held by caller, and are dropped by
- * d_kill.
- */
-static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
-        __releases(dentry->d_lock)
-        __releases(parent->d_lock)
-        __releases(dentry->d_inode->i_lock)
-{
-        list_del(&dentry->d_u.d_child);
-        /*
-         * Inform d_walk() that we are no longer attached to the
-         * dentry tree
-         */
-        dentry->d_flags |= DCACHE_DENTRY_KILLED;
-        if (parent)
-                spin_unlock(&parent->d_lock);
-        dentry_iput(dentry);
-        /*
-         * dentry_iput drops the locks, at which point nobody (except
-         * transient RCU lookups) can reach this dentry.
-         */
-        d_free(dentry);
-        return parent;
-}
 /**
 * d_drop - drop a dentry
 * @dentry: dentry to drop
@@ -510,7 +452,14 @@ dentry_kill(struct dentry *dentry, int unlock_on_failure)
        __releases(dentry->d_lock)
 {
        struct inode *inode;
-        struct dentry *parent;
+        struct dentry *parent = NULL;
+        bool can_free = true;
+        if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) {
+                can_free = dentry->d_flags & DCACHE_MAY_FREE;
+                spin_unlock(&dentry->d_lock);
+                goto out;
+        }
        inode = dentry->d_inode;
        if (inode && !spin_trylock(&inode->i_lock)) {
@@ -521,9 +470,7 @@ relock:
                }
                return dentry; /* try again with same dentry */
        }
-        if (IS_ROOT(dentry))
+        if (!IS_ROOT(dentry))
-                parent = NULL;
-        else
                parent = dentry->d_parent;
        if (parent && !spin_trylock(&parent->d_lock)) {
                if (inode)
@@ -543,10 +490,40 @@ relock:
        if ((dentry->d_flags & DCACHE_OP_PRUNE) && !d_unhashed(dentry))
                dentry->d_op->d_prune(dentry);
-        dentry_lru_del(dentry);
+        if (dentry->d_flags & DCACHE_LRU_LIST) {
+                if (!(dentry->d_flags & DCACHE_SHRINK_LIST))
+                        d_lru_del(dentry);
+        }
        /* if it was on the hash then remove it */
        __d_drop(dentry);
-        return d_kill(dentry, parent);
+        list_del(&dentry->d_u.d_child);
+        /*
+         * Inform d_walk() that we are no longer attached to the
+         * dentry tree
+         */
+        dentry->d_flags |= DCACHE_DENTRY_KILLED;
+        if (parent)
+                spin_unlock(&parent->d_lock);
+        dentry_iput(dentry);
+        /*
+         * dentry_iput drops the locks, at which point nobody (except
+         * transient RCU lookups) can reach this dentry.
+         */
+        BUG_ON((int)dentry->d_lockref.count > 0);
+        this_cpu_dec(nr_dentry);
+        if (dentry->d_op && dentry->d_op->d_release)
+                dentry->d_op->d_release(dentry);
+        spin_lock(&dentry->d_lock);
+        if (dentry->d_flags & DCACHE_SHRINK_LIST) {
+                dentry->d_flags |= DCACHE_MAY_FREE;
+                can_free = false;
+        }
+        spin_unlock(&dentry->d_lock);
+out:
+        if (likely(can_free))
+                dentry_free(dentry);
+        return parent;
 }
 /* 
@@ -815,65 +792,13 @@ restart:
 }
 EXPORT_SYMBOL(d_prune_aliases);
-/*
- * Try to throw away a dentry - free the inode, dput the parent.
- * Requires dentry->d_lock is held, and dentry->d_count == 0.
- * Releases dentry->d_lock.
- *
- * This may fail if locks cannot be acquired no problem, just try again.
- */
-static struct dentry * try_prune_one_dentry(struct dentry *dentry)
-        __releases(dentry->d_lock)
-{
-        struct dentry *parent;
-        parent = dentry_kill(dentry, 0);
-        /*
-         * If dentry_kill returns NULL, we have nothing more to do.
-         * if it returns the same dentry, trylocks failed. In either
-         * case, just loop again.
-         *
-         * Otherwise, we need to prune ancestors too. This is necessary
-         * to prevent quadratic behavior of shrink_dcache_parent(), but
-         * is also expected to be beneficial in reducing dentry cache
-         * fragmentation.
-         */
-        if (!parent)
-                return NULL;
-        if (parent == dentry)
-                return dentry;
-        /* Prune ancestors. */
-        dentry = parent;
-        while (dentry) {
-                if (lockref_put_or_lock(&dentry->d_lockref))
-                        return NULL;
-                dentry = dentry_kill(dentry, 1);
-        }
-        return NULL;
-}
 static void shrink_dentry_list(struct list_head *list)
 {
-        struct dentry *dentry;
+        struct dentry *dentry, *parent;
-        rcu_read_lock();
+        while (!list_empty(list)) {
-        for (;;) {
+                dentry = list_entry(list->prev, struct dentry, d_lru);
-                dentry = list_entry_rcu(list->prev, struct dentry, d_lru);
-                if (&dentry->d_lru == list)
-                        break; /* empty */
-                /*
-                 * Get the dentry lock, and re-verify that the dentry is
-                 * this on the shrinking list. If it is, we know that
-                 * DCACHE_SHRINK_LIST and DCACHE_LRU_LIST are set.
-                 */
                spin_lock(&dentry->d_lock);
-                if (dentry != list_entry(list->prev, struct dentry, d_lru)) {
-                        spin_unlock(&dentry->d_lock);
-                        continue;
-                }
                /*
                 * The dispose list is isolated and dentries are not accounted
                 * to the LRU here, so we can simply remove it from the list
@@ -885,30 +810,38 @@ static void shrink_dentry_list(struct list_head *list)
                 * We found an inuse dentry which was not removed from
                 * the LRU because of laziness during lookup. Do not free it.
                 */
-                if (dentry->d_lockref.count) {
+                if ((int)dentry->d_lockref.count > 0) {
                        spin_unlock(&dentry->d_lock);
                        continue;
                }
-                rcu_read_unlock();
+                parent = dentry_kill(dentry, 0);
                /*
-                 * If 'try_to_prune()' returns a dentry, it will
+                 * If dentry_kill returns NULL, we have nothing more to do.
-                 * be the same one we passed in, and d_lock will
-                 * have been held the whole time, so it will not
-                 * have been added to any other lists. We failed
-                 * to get the inode lock.
-                 *
-                 * We just add it back to the shrink list.
                 */
-                dentry = try_prune_one_dentry(dentry);
+                if (!parent)
+                        continue;
-                rcu_read_lock();
+                if (unlikely(parent == dentry)) {
-                if (dentry) {
+                        /*
+                         * trylocks have failed and d_lock has been held the
+                         * whole time, so it could not have been added to any
+                         * other lists. Just add it back to the shrink list.
+                         */
                        d_shrink_add(dentry, list);
                        spin_unlock(&dentry->d_lock);
+                        continue;
                }
+                /*
+                 * We need to prune ancestors too. This is necessary to prevent
+                 * quadratic behavior of shrink_dcache_parent(), but is also
+                 * expected to be beneficial in reducing dentry cache
+                 * fragmentation.
+                 */
+                dentry = parent;
+                while (dentry && !lockref_put_or_lock(&dentry->d_lockref))
+                        dentry = dentry_kill(dentry, 1);
        }
-        rcu_read_unlock();
 }
 static enum lru_status
@@ -1261,34 +1194,23 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
        if (data->start == dentry)
                goto out;
-        /*
+        if (dentry->d_flags & DCACHE_SHRINK_LIST) {
-         * move only zero ref count dentries to the dispose list.
-         *
-         * Those which are presently on the shrink list, being processed
-         * by shrink_dentry_list(), shouldn't be moved.  Otherwise the
-         * loop in shrink_dcache_parent() might not make any progress
-         * and loop forever.
-         */
-        if (dentry->d_lockref.count) {
-                dentry_lru_del(dentry);
-        } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
-                /*
-                 * We can't use d_lru_shrink_move() because we
-                 * need to get the global LRU lock and do the
-                 * LRU accounting.
-                 */
-                d_lru_del(dentry);
-                d_shrink_add(dentry, &data->dispose);
                data->found++;
-                ret = D_WALK_NORETRY;
+        } else {
+                if (dentry->d_flags & DCACHE_LRU_LIST)
+                        d_lru_del(dentry);
+                if (!dentry->d_lockref.count) {
+                        d_shrink_add(dentry, &data->dispose);
+                        data->found++;
+                }
        }
        /*
         * We can return to the caller if we have found some (this
         * ensures forward progress). We'll be coming back to find
         * the rest.
         */
-        if (data->found && need_resched())
+        if (!list_empty(&data->dispose))
-                ret = D_WALK_QUIT;
+                ret = need_resched() ? D_WALK_QUIT : D_WALK_NORETRY;
 out:
        return ret;
 }
@@ -1318,45 +1240,35 @@ void shrink_dcache_parent(struct dentry *parent)
 }
 EXPORT_SYMBOL(shrink_dcache_parent);
-static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
 {
-        struct select_data *data = _data;
+        /* it has busy descendents; complain about those instead */
-        enum d_walk_ret ret = D_WALK_CONTINUE;
+        if (!list_empty(&dentry->d_subdirs))
+                return D_WALK_CONTINUE;
-        if (dentry->d_lockref.count) {
+        /* root with refcount 1 is fine */
-                dentry_lru_del(dentry);
+        if (dentry == _data && dentry->d_lockref.count == 1)
-                if (likely(!list_empty(&dentry->d_subdirs)))
+                return D_WALK_CONTINUE;
-                        goto out;
-                if (dentry == data->start && dentry->d_lockref.count == 1)
+        printk(KERN_ERR "BUG: Dentry %p{i=%lx,n=%pd} "
-                        goto out;
+                        " still in use (%d) [unmount of %s %s]\n",
-                printk(KERN_ERR
-                       "BUG: Dentry %p{i=%lx,n=%s}"
-                       " still in use (%d)"
-                       " [unmount of %s %s]\n",
                       dentry,
                       dentry->d_inode ?
                       dentry->d_inode->i_ino : 0UL,
-                       dentry->d_name.name,
+                       dentry,
                       dentry->d_lockref.count,
                       dentry->d_sb->s_type->name,
                       dentry->d_sb->s_id);
-                BUG();
+        WARN_ON(1);
-        } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
+        return D_WALK_CONTINUE;
-                /*
+}
-                 * We can't use d_lru_shrink_move() because we
-                 * need to get the global LRU lock and do the
+static void do_one_tree(struct dentry *dentry)
-                 * LRU accounting.
+{
-                 */
+        shrink_dcache_parent(dentry);
-                if (dentry->d_flags & DCACHE_LRU_LIST)
+        d_walk(dentry, dentry, umount_check, NULL);
-                        d_lru_del(dentry);
+        d_drop(dentry);
-                d_shrink_add(dentry, &data->dispose);
+        dput(dentry);
-                data->found++;
-                ret = D_WALK_NORETRY;
-        }
-out:
-        if (data->found && need_resched())
-                ret = D_WALK_QUIT;
-        return ret;
 }
 /*
@@ -1366,40 +1278,15 @@ void shrink_dcache_for_umount(struct super_block *sb)
 {
        struct dentry *dentry;
-        if (down_read_trylock(&sb->s_umount))
+        WARN(down_read_trylock(&sb->s_umount), "s_umount should've been locked");
-                BUG();
        dentry = sb->s_root;
        sb->s_root = NULL;
-        for (;;) {
+        do_one_tree(dentry);
-                struct select_data data;
-                INIT_LIST_HEAD(&data.dispose);
-                data.start = dentry;
-                data.found = 0;
-                d_walk(dentry, &data, umount_collect, NULL);
-                if (!data.found)
-                        break;
-                shrink_dentry_list(&data.dispose);
-                cond_resched();
-        }
-        d_drop(dentry);
-        dput(dentry);
        while (!hlist_bl_empty(&sb->s_anon)) {
-                struct select_data data;
+                dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash));
-                dentry = hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash);
+                do_one_tree(dentry);
-                INIT_LIST_HEAD(&data.dispose);
-                data.start = NULL;
-                data.found = 0;
-                d_walk(dentry, &data, umount_collect, NULL);
-                if (data.found)
-                        shrink_dentry_list(&data.dispose);
-                cond_resched();
        }
 }
@@ -1647,8 +1534,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
        unsigned add_flags = d_flags_for_inode(inode);
        spin_lock(&dentry->d_lock);
-        dentry->d_flags &= ~DCACHE_ENTRY_TYPE;
+        __d_set_type(dentry, add_flags);
-        dentry->d_flags |= add_flags;
        if (inode)
                hlist_add_head(&dentry->d_alias, &inode->i_dentry);
        dentry->d_inode = inode;
diff --git a/fs/exec.c b/fs/exec.c
index 476f3ebf437e..238b7aa26f68 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -657,10 +657,10 @@ int setup_arg_pages(struct linux_binprm *bprm,
        unsigned long rlim_stack;
 #ifdef CONFIG_STACK_GROWSUP
-        /* Limit stack size to 1GB */
+        /* Limit stack size */
        stack_base = rlimit_max(RLIMIT_STACK);
-        if (stack_base > (1 << 30))
+        if (stack_base > STACK_SIZE_MAX)
-                stack_base = 1 << 30;
+                stack_base = STACK_SIZE_MAX;
        /* Make sure we didn't let the argument array grow too large. */
        if (vma->vm_end - vma->vm_start > stack_base)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 9ead1596399a..72c82f69b01b 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -274,15 +274,15 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                break;
 #if BITS_PER_LONG != 32
        /* 32-bit arches must use fcntl64() */
-        case F_GETLKP:
+        case F_OFD_GETLK:
 #endif
        case F_GETLK:
                err = fcntl_getlk(filp, cmd, (struct flock __user *) arg);
                break;
 #if BITS_PER_LONG != 32
        /* 32-bit arches must use fcntl64() */
-        case F_SETLKP:
+        case F_OFD_SETLK:
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
 #endif
                /* Fallthrough */
        case F_SETLK:
@@ -399,13 +399,13 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
        
        switch (cmd) {
        case F_GETLK64:
-        case F_GETLKP:
+        case F_OFD_GETLK:
                err = fcntl_getlk64(f.file, cmd, (struct flock64 __user *) arg);
                break;
        case F_SETLK64:
        case F_SETLKW64:
-        case F_SETLKP:
+        case F_OFD_SETLK:
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
                err = fcntl_setlk64(fd, f.file, cmd,
                                (struct flock64 __user *) arg);
                break;
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index a0b0855d00a9..205e0d5d5307 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -348,7 +348,7 @@ int __init fuse_ctl_init(void)
        return register_filesystem(&fuse_ctl_fs_type);
 }
-void fuse_ctl_cleanup(void)
+void __exit fuse_ctl_cleanup(void)
 {
        unregister_filesystem(&fuse_ctl_fs_type);
 }
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 5b4e035b364c..42198359fa1b 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -679,6 +679,14 @@ static int fuse_symlink(struct inode *dir, struct dentry *entry,
        return create_new_entry(fc, req, dir, entry, S_IFLNK);
 }
+static inline void fuse_update_ctime(struct inode *inode)
+{
+        if (!IS_NOCMTIME(inode)) {
+                inode->i_ctime = current_fs_time(inode->i_sb);
+                mark_inode_dirty_sync(inode);
+        }
+}
 static int fuse_unlink(struct inode *dir, struct dentry *entry)
 {
        int err;
@@ -713,6 +721,7 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry)
                fuse_invalidate_attr(inode);
                fuse_invalidate_attr(dir);
                fuse_invalidate_entry_cache(entry);
+                fuse_update_ctime(inode);
        } else if (err == -EINTR)
                fuse_invalidate_entry(entry);
        return err;
@@ -743,23 +752,26 @@ static int fuse_rmdir(struct inode *dir, struct dentry *entry)
        return err;
 }
-static int fuse_rename(struct inode *olddir, struct dentry *oldent,
+static int fuse_rename_common(struct inode *olddir, struct dentry *oldent,
-                       struct inode *newdir, struct dentry *newent)
+                              struct inode *newdir, struct dentry *newent,
+                              unsigned int flags, int opcode, size_t argsize)
 {
        int err;
-        struct fuse_rename_in inarg;
+        struct fuse_rename2_in inarg;
        struct fuse_conn *fc = get_fuse_conn(olddir);
-        struct fuse_req *req = fuse_get_req_nopages(fc);
+        struct fuse_req *req;
+        req = fuse_get_req_nopages(fc);
        if (IS_ERR(req))
                return PTR_ERR(req);
-        memset(&inarg, 0, sizeof(inarg));
+        memset(&inarg, 0, argsize);
        inarg.newdir = get_node_id(newdir);
-        req->in.h.opcode = FUSE_RENAME;
+        inarg.flags = flags;
+        req->in.h.opcode = opcode;
        req->in.h.nodeid = get_node_id(olddir);
        req->in.numargs = 3;
-        req->in.args[0].size = sizeof(inarg);
+        req->in.args[0].size = argsize;
        req->in.args[0].value = &inarg;
        req->in.args[1].size = oldent->d_name.len + 1;
        req->in.args[1].value = oldent->d_name.name;
@@ -771,15 +783,22 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
        if (!err) {
                /* ctime changes */
                fuse_invalidate_attr(oldent->d_inode);
+                fuse_update_ctime(oldent->d_inode);
+                if (flags & RENAME_EXCHANGE) {
+                        fuse_invalidate_attr(newent->d_inode);
+                        fuse_update_ctime(newent->d_inode);
+                }
                fuse_invalidate_attr(olddir);
                if (olddir != newdir)
                        fuse_invalidate_attr(newdir);
                /* newent will end up negative */
-                if (newent->d_inode) {
+                if (!(flags & RENAME_EXCHANGE) && newent->d_inode) {
                        fuse_invalidate_attr(newent->d_inode);
                        fuse_invalidate_entry_cache(newent);
+                        fuse_update_ctime(newent->d_inode);
                }
        } else if (err == -EINTR) {
                /* If request was interrupted, DEITY only knows if the
@@ -795,6 +814,36 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
        return err;
 }
+static int fuse_rename(struct inode *olddir, struct dentry *oldent,
+                       struct inode *newdir, struct dentry *newent)
+{
+        return fuse_rename_common(olddir, oldent, newdir, newent, 0,
+                                  FUSE_RENAME, sizeof(struct fuse_rename_in));
+}
+static int fuse_rename2(struct inode *olddir, struct dentry *oldent,
+                        struct inode *newdir, struct dentry *newent,
+                        unsigned int flags)
+{
+        struct fuse_conn *fc = get_fuse_conn(olddir);
+        int err;
+        if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))
+                return -EINVAL;
+        if (fc->no_rename2 || fc->minor < 23)
+                return -EINVAL;
+        err = fuse_rename_common(olddir, oldent, newdir, newent, flags,
+                                 FUSE_RENAME2, sizeof(struct fuse_rename2_in));
+        if (err == -ENOSYS) {
+                fc->no_rename2 = 1;
+                err = -EINVAL;
+        }
+        return err;
+}
 static int fuse_link(struct dentry *entry, struct inode *newdir,
                     struct dentry *newent)
 {
@@ -829,6 +878,7 @@ static int fuse_link(struct dentry *entry, struct inode *newdir,
                inc_nlink(inode);
                spin_unlock(&fc->lock);
                fuse_invalidate_attr(inode);
+                fuse_update_ctime(inode);
        } else if (err == -EINTR) {
                fuse_invalidate_attr(inode);
        }
@@ -846,6 +896,8 @@ static void fuse_fillattr(struct inode *inode, struct fuse_attr *attr,
                attr->size = i_size_read(inode);
                attr->mtime = inode->i_mtime.tv_sec;
                attr->mtimensec = inode->i_mtime.tv_nsec;
+                attr->ctime = inode->i_ctime.tv_sec;
+                attr->ctimensec = inode->i_ctime.tv_nsec;
        }
        stat->dev = inode->i_sb->s_dev;
@@ -1504,7 +1556,7 @@ static bool update_mtime(unsigned ivalid, bool trust_local_mtime)
 }
 static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg,
-                           bool trust_local_mtime)
+                           bool trust_local_cmtime)
 {
        unsigned ivalid = iattr->ia_valid;
@@ -1523,13 +1575,18 @@ static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg,
                if (!(ivalid & ATTR_ATIME_SET))
                        arg->valid |= FATTR_ATIME_NOW;
        }
-        if ((ivalid & ATTR_MTIME) && update_mtime(ivalid, trust_local_mtime)) {
+        if ((ivalid & ATTR_MTIME) && update_mtime(ivalid, trust_local_cmtime)) {
                arg->valid |= FATTR_MTIME;
                arg->mtime = iattr->ia_mtime.tv_sec;
                arg->mtimensec = iattr->ia_mtime.tv_nsec;
-                if (!(ivalid & ATTR_MTIME_SET) && !trust_local_mtime)
+                if (!(ivalid & ATTR_MTIME_SET) && !trust_local_cmtime)
                        arg->valid |= FATTR_MTIME_NOW;
        }
+        if ((ivalid & ATTR_CTIME) && trust_local_cmtime) {
+                arg->valid |= FATTR_CTIME;
+                arg->ctime = iattr->ia_ctime.tv_sec;
+                arg->ctimensec = iattr->ia_ctime.tv_nsec;
+        }
 }
 /*
@@ -1597,39 +1654,38 @@ static void fuse_setattr_fill(struct fuse_conn *fc, struct fuse_req *req,
 /*
 * Flush inode->i_mtime to the server
 */
-int fuse_flush_mtime(struct file *file, bool nofail)
+int fuse_flush_times(struct inode *inode, struct fuse_file *ff)
 {
-        struct inode *inode = file->f_mapping->host;
-        struct fuse_inode *fi = get_fuse_inode(inode);
        struct fuse_conn *fc = get_fuse_conn(inode);
-        struct fuse_req *req = NULL;
+        struct fuse_req *req;
        struct fuse_setattr_in inarg;
        struct fuse_attr_out outarg;
        int err;
-        if (nofail) {
+        req = fuse_get_req_nopages(fc);
-                req = fuse_get_req_nofail_nopages(fc, file);
+        if (IS_ERR(req))
-        } else {
+                return PTR_ERR(req);
-                req = fuse_get_req_nopages(fc);
-                if (IS_ERR(req))
-                        return PTR_ERR(req);
-        }
        memset(&inarg, 0, sizeof(inarg));
        memset(&outarg, 0, sizeof(outarg));
-        inarg.valid |= FATTR_MTIME;
+        inarg.valid = FATTR_MTIME;
        inarg.mtime = inode->i_mtime.tv_sec;
        inarg.mtimensec = inode->i_mtime.tv_nsec;
+        if (fc->minor >= 23) {
+                inarg.valid |= FATTR_CTIME;
+                inarg.ctime = inode->i_ctime.tv_sec;
+                inarg.ctimensec = inode->i_ctime.tv_nsec;
+        }
+        if (ff) {
+                inarg.valid |= FATTR_FH;
+                inarg.fh = ff->fh;
+        }
        fuse_setattr_fill(fc, req, inode, &inarg, &outarg);
        fuse_request_send(fc, req);
        err = req->out.h.error;
        fuse_put_request(fc, req);
-        if (!err)
-                clear_bit(FUSE_I_MTIME_DIRTY, &fi->state);
        return err;
 }
@@ -1653,7 +1709,7 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
        bool is_wb = fc->writeback_cache;
        loff_t oldsize;
        int err;
-        bool trust_local_mtime = is_wb && S_ISREG(inode->i_mode);
+        bool trust_local_cmtime = is_wb && S_ISREG(inode->i_mode);
        if (!(fc->flags & FUSE_DEFAULT_PERMISSIONS))
                attr->ia_valid |= ATTR_FORCE;
@@ -1678,11 +1734,13 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
        if (is_truncate) {
                fuse_set_nowrite(inode);
                set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+                if (trust_local_cmtime && attr->ia_size != inode->i_size)
+                        attr->ia_valid |= ATTR_MTIME | ATTR_CTIME;
        }
        memset(&inarg, 0, sizeof(inarg));
        memset(&outarg, 0, sizeof(outarg));
-        iattr_to_fattr(attr, &inarg, trust_local_mtime);
+        iattr_to_fattr(attr, &inarg, trust_local_cmtime);
        if (file) {
                struct fuse_file *ff = file->private_data;
                inarg.valid |= FATTR_FH;
@@ -1711,9 +1769,12 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
        spin_lock(&fc->lock);
        /* the kernel maintains i_mtime locally */
-        if (trust_local_mtime && (attr->ia_valid & ATTR_MTIME)) {
+        if (trust_local_cmtime) {
-                inode->i_mtime = attr->ia_mtime;
+                if (attr->ia_valid & ATTR_MTIME)
-                clear_bit(FUSE_I_MTIME_DIRTY, &fi->state);
+                        inode->i_mtime = attr->ia_mtime;
+                if (attr->ia_valid & ATTR_CTIME)
+                        inode->i_ctime = attr->ia_ctime;
+                /* FIXME: clear I_DIRTY_SYNC? */
        }
        fuse_change_attributes_common(inode, &outarg.attr,
@@ -1810,8 +1871,10 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
                fc->no_setxattr = 1;
                err = -EOPNOTSUPP;
        }
-        if (!err)
+        if (!err) {
                fuse_invalidate_attr(inode);
+                fuse_update_ctime(inode);
+        }
        return err;
 }
@@ -1941,20 +2004,11 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
                fc->no_removexattr = 1;
                err = -EOPNOTSUPP;
        }
-        if (!err)
+        if (!err) {
                fuse_invalidate_attr(inode);
-        return err;
+                fuse_update_ctime(inode);
-}
-static int fuse_update_time(struct inode *inode, struct timespec *now,
-                            int flags)
-{
-        if (flags & S_MTIME) {
-                inode->i_mtime = *now;
-                set_bit(FUSE_I_MTIME_DIRTY, &get_fuse_inode(inode)->state);
-                BUG_ON(!S_ISREG(inode->i_mode));
        }
-        return 0;
+        return err;
 }
 static const struct inode_operations fuse_dir_inode_operations = {
@@ -1964,6 +2018,7 @@ static const struct inode_operations fuse_dir_inode_operations = {
        .unlink         = fuse_unlink,
        .rmdir          = fuse_rmdir,
        .rename         = fuse_rename,
+        .rename2        = fuse_rename2,
        .link           = fuse_link,
        .setattr        = fuse_setattr,
        .create         = fuse_create,
@@ -1996,7 +2051,6 @@ static const struct inode_operations fuse_common_inode_operations = {
        .getxattr       = fuse_getxattr,
        .listxattr      = fuse_listxattr,
        .removexattr    = fuse_removexattr,
-        .update_time    = fuse_update_time,
 };
 static const struct inode_operations fuse_symlink_inode_operations = {
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 13f8bdec5110..96d513e01a5d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -223,6 +223,8 @@ void fuse_finish_open(struct inode *inode, struct file *file)
                i_size_write(inode, 0);
                spin_unlock(&fc->lock);
                fuse_invalidate_attr(inode);
+                if (fc->writeback_cache)
+                        file_update_time(file);
        }
        if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache)
                fuse_link_write_file(file);
@@ -232,18 +234,26 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
 {
        struct fuse_conn *fc = get_fuse_conn(inode);
        int err;
+        bool lock_inode = (file->f_flags & O_TRUNC) &&
+                          fc->atomic_o_trunc &&
+                          fc->writeback_cache;
        err = generic_file_open(inode, file);
        if (err)
                return err;
+        if (lock_inode)
+                mutex_lock(&inode->i_mutex);
        err = fuse_do_open(fc, get_node_id(inode), file, isdir);
-        if (err)
-                return err;
-        fuse_finish_open(inode, file);
+        if (!err)
+                fuse_finish_open(inode, file);
-        return 0;
+        if (lock_inode)
+                mutex_unlock(&inode->i_mutex);
+        return err;
 }
 static void fuse_prepare_release(struct fuse_file *ff, int flags, int opcode)
@@ -314,10 +324,7 @@ static int fuse_release(struct inode *inode, struct file *file)
        /* see fuse_vma_close() for !writeback_cache case */
        if (fc->writeback_cache)
-                filemap_write_and_wait(file->f_mapping);
+                write_inode_now(inode, 1);
-        if (test_bit(FUSE_I_MTIME_DIRTY, &get_fuse_inode(inode)->state))
-                fuse_flush_mtime(file, true);
        fuse_release_common(file, FUSE_RELEASE);
@@ -439,7 +446,7 @@ static int fuse_flush(struct file *file, fl_owner_t id)
        if (fc->no_flush)
                return 0;
-        err = filemap_write_and_wait(file->f_mapping);
+        err = write_inode_now(inode, 1);
        if (err)
                return err;
@@ -480,13 +487,6 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
        if (is_bad_inode(inode))
                return -EIO;
-        err = filemap_write_and_wait_range(inode->i_mapping, start, end);
-        if (err)
-                return err;
-        if ((!isdir && fc->no_fsync) || (isdir && fc->no_fsyncdir))
-                return 0;
        mutex_lock(&inode->i_mutex);
        /*
@@ -494,17 +494,17 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
         * wait for all outstanding writes, before sending the FSYNC
         * request.
         */
-        err = write_inode_now(inode, 0);
+        err = filemap_write_and_wait_range(inode->i_mapping, start, end);
        if (err)
                goto out;
        fuse_sync_writes(inode);
+        err = sync_inode_metadata(inode, 1);
+        if (err)
+                goto out;
-        if (test_bit(FUSE_I_MTIME_DIRTY, &get_fuse_inode(inode)->state)) {
+        if ((!isdir && fc->no_fsync) || (isdir && fc->no_fsyncdir))
-                int err = fuse_flush_mtime(file, false);
+                goto out;
-                if (err)
-                        goto out;
-        }
        req = fuse_get_req_nopages(fc);
        if (IS_ERR(req)) {
@@ -1659,13 +1659,13 @@ static void fuse_writepage_end(struct fuse_conn *fc, struct fuse_req *req)
        fuse_writepage_free(fc, req);
 }
-static struct fuse_file *fuse_write_file_get(struct fuse_conn *fc,
+static struct fuse_file *__fuse_write_file_get(struct fuse_conn *fc,
-                                             struct fuse_inode *fi)
+                                               struct fuse_inode *fi)
 {
        struct fuse_file *ff = NULL;
        spin_lock(&fc->lock);
-        if (!WARN_ON(list_empty(&fi->write_files))) {
+        if (!list_empty(&fi->write_files)) {
                ff = list_entry(fi->write_files.next, struct fuse_file,
                                write_entry);
                fuse_file_get(ff);
@@ -1675,6 +1675,29 @@ static struct fuse_file *fuse_write_file_get(struct fuse_conn *fc,
        return ff;
 }
+static struct fuse_file *fuse_write_file_get(struct fuse_conn *fc,
+                                             struct fuse_inode *fi)
+{
+        struct fuse_file *ff = __fuse_write_file_get(fc, fi);
+        WARN_ON(!ff);
+        return ff;
+}
+int fuse_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        struct fuse_inode *fi = get_fuse_inode(inode);
+        struct fuse_file *ff;
+        int err;
+        ff = __fuse_write_file_get(fc, fi);
+        err = fuse_flush_times(inode, ff);
+        if (ff)
+                fuse_file_put(ff, 0);
+        return err;
+}
 static int fuse_writepage_locked(struct page *page)
 {
        struct address_space *mapping = page->mapping;
@@ -2972,6 +2995,9 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
        bool lock_inode = !(mode & FALLOC_FL_KEEP_SIZE) ||
                           (mode & FALLOC_FL_PUNCH_HOLE);
+        if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+                return -EOPNOTSUPP;
        if (fc->no_fallocate)
                return -EOPNOTSUPP;
@@ -3017,12 +3043,8 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
        if (!(mode & FALLOC_FL_KEEP_SIZE)) {
                bool changed = fuse_write_update_size(inode, offset + length);
-                if (changed && fc->writeback_cache) {
+                if (changed && fc->writeback_cache)
-                        struct fuse_inode *fi = get_fuse_inode(inode);
+                        file_update_time(file);
-                        inode->i_mtime = current_fs_time(inode->i_sb);
-                        set_bit(FUSE_I_MTIME_DIRTY, &fi->state);
-                }
        }
        if (mode & FALLOC_FL_PUNCH_HOLE)
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index a257ed8ebee6..7aa5c75e0de1 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -119,8 +119,6 @@ enum {
        FUSE_I_INIT_RDPLUS,
        /** An operation changing file size is in progress  */
        FUSE_I_SIZE_UNSTABLE,
-        /** i_mtime has been updated locally; a flush to userspace needed */
-        FUSE_I_MTIME_DIRTY,
 };
 struct fuse_conn;
@@ -544,6 +542,9 @@ struct fuse_conn {
        /** Is fallocate not implemented by fs? */
        unsigned no_fallocate:1;
+        /** Is rename with flags implemented by fs? */
+        unsigned no_rename2:1;
        /** Use enhanced/automatic page cache invalidation. */
        unsigned auto_inval_data:1;
@@ -725,7 +726,7 @@ int fuse_dev_init(void);
 void fuse_dev_cleanup(void);
 int fuse_ctl_init(void);
-void fuse_ctl_cleanup(void);
+void __exit fuse_ctl_cleanup(void);
 /**
 * Allocate a request
@@ -891,7 +892,8 @@ int fuse_dev_release(struct inode *inode, struct file *file);
 bool fuse_write_update_size(struct inode *inode, loff_t pos);
-int fuse_flush_mtime(struct file *file, bool nofail);
+int fuse_flush_times(struct inode *inode, struct fuse_file *ff);
+int fuse_write_inode(struct inode *inode, struct writeback_control *wbc);
 int fuse_do_setattr(struct inode *inode, struct iattr *attr,
                    struct file *file);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 8d611696fcad..754dcf23de8a 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -175,9 +175,9 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
        if (!fc->writeback_cache || !S_ISREG(inode->i_mode)) {
                inode->i_mtime.tv_sec   = attr->mtime;
                inode->i_mtime.tv_nsec  = attr->mtimensec;
+                inode->i_ctime.tv_sec   = attr->ctime;
+                inode->i_ctime.tv_nsec  = attr->ctimensec;
        }
-        inode->i_ctime.tv_sec   = attr->ctime;
-        inode->i_ctime.tv_nsec  = attr->ctimensec;
        if (attr->blksize != 0)
                inode->i_blkbits = ilog2(attr->blksize);
@@ -256,6 +256,8 @@ static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
        inode->i_size = attr->size;
        inode->i_mtime.tv_sec  = attr->mtime;
        inode->i_mtime.tv_nsec = attr->mtimensec;
+        inode->i_ctime.tv_sec  = attr->ctime;
+        inode->i_ctime.tv_nsec = attr->ctimensec;
        if (S_ISREG(inode->i_mode)) {
                fuse_init_common(inode);
                fuse_init_file_inode(inode);
@@ -303,7 +305,7 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid,
        if ((inode->i_state & I_NEW)) {
                inode->i_flags |= S_NOATIME;
-                if (!fc->writeback_cache || !S_ISREG(inode->i_mode))
+                if (!fc->writeback_cache || !S_ISREG(attr->mode))
                        inode->i_flags |= S_NOCMTIME;
                inode->i_generation = generation;
                inode->i_data.backing_dev_info = &fc->bdi;
@@ -788,6 +790,7 @@ static const struct super_operations fuse_super_operations = {
        .alloc_inode    = fuse_alloc_inode,
        .destroy_inode  = fuse_destroy_inode,
        .evict_inode    = fuse_evict_inode,
+        .write_inode    = fuse_write_inode,
        .drop_inode     = generic_delete_inode,
        .remount_fs     = fuse_remount_fs,
        .put_super      = fuse_put_super,
@@ -890,6 +893,11 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                                fc->async_dio = 1;
                        if (arg->flags & FUSE_WRITEBACK_CACHE)
                                fc->writeback_cache = 1;
+                        if (arg->time_gran && arg->time_gran <= 1000000000)
+                                fc->sb->s_time_gran = arg->time_gran;
+                        else
+                                fc->sb->s_time_gran = 1000000000;
                } else {
                        ra_pages = fc->max_read / PAGE_CACHE_SIZE;
                        fc->no_lock = 1;
@@ -996,7 +1004,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
        if (sb->s_flags & MS_MANDLOCK)
                goto err;
-        sb->s_flags &= ~MS_NOSEC;
+        sb->s_flags &= ~(MS_NOSEC | MS_I_VERSION);
        if (!parse_fuse_opt((char *) data, &d, is_bdev))
                goto err;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 204027520937..e19d4c0cacae 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -1030,6 +1030,11 @@ static int __init init_hugetlbfs_fs(void)
        int error;
        int i;
+        if (!hugepages_supported()) {
+                pr_info("hugetlbfs: disabling because there are no supported hugepage sizes\n");
+                return -ENOTSUPP;
+        }
        error = bdi_init(&hugetlbfs_backing_dev_info);
        if (error)
                return error;
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index 78f3403300af..ac127cd008bf 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -232,9 +232,6 @@ static int kernfs_link_sibling(struct kernfs_node *kn)
        struct rb_node **node = &kn->parent->dir.children.rb_node;
        struct rb_node *parent = NULL;
-        if (kernfs_type(kn) == KERNFS_DIR)
-                kn->parent->dir.subdirs++;
        while (*node) {
                struct kernfs_node *pos;
                int result;
@@ -249,9 +246,15 @@ static int kernfs_link_sibling(struct kernfs_node *kn)
                else
                        return -EEXIST;
        }
        /* add new node and rebalance the tree */
        rb_link_node(&kn->rb, parent, node);
        rb_insert_color(&kn->rb, &kn->parent->dir.children);
+        /* successfully added, account subdir number */
+        if (kernfs_type(kn) == KERNFS_DIR)
+                kn->parent->dir.subdirs++;
        return 0;
 }
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 8034706a7af8..5e9a80cfc3d8 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -484,6 +484,8 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma)
        ops = kernfs_ops(of->kn);
        rc = ops->mmap(of, vma);
+        if (rc)
+                goto out_put;
        /*
         * PowerPC's pci_mmap of legacy_mem uses shmem_zero_setup()
@@ -608,6 +610,7 @@ static void kernfs_put_open_node(struct kernfs_node *kn,
 static int kernfs_fop_open(struct inode *inode, struct file *file)
 {
        struct kernfs_node *kn = file->f_path.dentry->d_fsdata;
+        struct kernfs_root *root = kernfs_root(kn);
        const struct kernfs_ops *ops;
        struct kernfs_open_file *of;
        bool has_read, has_write, has_mmap;
@@ -622,14 +625,16 @@ static int kernfs_fop_open(struct inode *inode, struct file *file)
        has_write = ops->write || ops->mmap;
        has_mmap = ops->mmap;
-        /* check perms and supported operations */
+        /* see the flag definition for details */
-        if ((file->f_mode & FMODE_WRITE) &&
+        if (root->flags & KERNFS_ROOT_EXTRA_OPEN_PERM_CHECK) {
-            (!(inode->i_mode & S_IWUGO) || !has_write))
+                if ((file->f_mode & FMODE_WRITE) &&
-                goto err_out;
+                    (!(inode->i_mode & S_IWUGO) || !has_write))
+                        goto err_out;
-        if ((file->f_mode & FMODE_READ) &&
+                if ((file->f_mode & FMODE_READ) &&
-            (!(inode->i_mode & S_IRUGO) || !has_read))
+                    (!(inode->i_mode & S_IRUGO) || !has_read))
-                goto err_out;
+                        goto err_out;
+        }
        /* allocate a kernfs_open_file for the file */
        error = -ENOMEM;
diff --git a/fs/locks.c b/fs/locks.c
index 13fc7a6d380a..e390bd9ae068 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -135,7 +135,7 @@
 #define IS_POSIX(fl)    (fl->fl_flags & FL_POSIX)
 #define IS_FLOCK(fl)    (fl->fl_flags & FL_FLOCK)
 #define IS_LEASE(fl)    (fl->fl_flags & (FL_LEASE|FL_DELEG))
-#define IS_FILE_PVT(fl) (fl->fl_flags & FL_FILE_PVT)
+#define IS_OFDLCK(fl)   (fl->fl_flags & FL_OFDLCK)
 static bool lease_breaking(struct file_lock *fl)
 {
@@ -389,18 +389,6 @@ static int flock64_to_posix_lock(struct file *filp, struct file_lock *fl,
        fl->fl_ops = NULL;
        fl->fl_lmops = NULL;
-        /* Ensure that fl->fl_filp has compatible f_mode */
-        switch (l->l_type) {
-        case F_RDLCK:
-                if (!(filp->f_mode & FMODE_READ))
-                        return -EBADF;
-                break;
-        case F_WRLCK:
-                if (!(filp->f_mode & FMODE_WRITE))
-                        return -EBADF;
-                break;
-        }
        return assign_type(fl, l->l_type);
 }
@@ -564,7 +552,7 @@ static void __locks_insert_block(struct file_lock *blocker,
        BUG_ON(!list_empty(&waiter->fl_block));
        waiter->fl_next = blocker;
        list_add_tail(&waiter->fl_block, &blocker->fl_block);
-        if (IS_POSIX(blocker) && !IS_FILE_PVT(blocker))
+        if (IS_POSIX(blocker) && !IS_OFDLCK(blocker))
                locks_insert_global_blocked(waiter);
 }
@@ -759,12 +747,12 @@ EXPORT_SYMBOL(posix_test_lock);
 * of tasks (such as posix threads) sharing the same open file table.
 * To handle those cases, we just bail out after a few iterations.
 *
- * For FL_FILE_PVT locks, the owner is the filp, not the files_struct.
+ * For FL_OFDLCK locks, the owner is the filp, not the files_struct.
 * Because the owner is not even nominally tied to a thread of
 * execution, the deadlock detection below can't reasonably work well. Just
 * skip it for those.
 *
- * In principle, we could do a more limited deadlock detection on FL_FILE_PVT
+ * In principle, we could do a more limited deadlock detection on FL_OFDLCK
 * locks that just checks for the case where two tasks are attempting to
 * upgrade from read to write locks on the same inode.
 */
@@ -791,9 +779,9 @@ static int posix_locks_deadlock(struct file_lock *caller_fl,
        /*
         * This deadlock detector can't reasonably detect deadlocks with
-         * FL_FILE_PVT locks, since they aren't owned by a process, per-se.
+         * FL_OFDLCK locks, since they aren't owned by a process, per-se.
         */
-        if (IS_FILE_PVT(caller_fl))
+        if (IS_OFDLCK(caller_fl))
                return 0;
        while ((block_fl = what_owner_is_waiting_for(block_fl))) {
@@ -1391,11 +1379,10 @@ int __break_lease(struct inode *inode, unsigned int mode, unsigned int type)
 restart:
        break_time = flock->fl_break_time;
-        if (break_time != 0) {
+        if (break_time != 0)
                break_time -= jiffies;
-                if (break_time == 0)
+        if (break_time == 0)
-                        break_time++;
+                break_time++;
-        }
        locks_insert_block(flock, new_fl);
        spin_unlock(&inode->i_lock);
        error = wait_event_interruptible_timeout(new_fl->fl_wait,
@@ -1891,7 +1878,7 @@ EXPORT_SYMBOL_GPL(vfs_test_lock);
 static int posix_lock_to_flock(struct flock *flock, struct file_lock *fl)
 {
-        flock->l_pid = IS_FILE_PVT(fl) ? -1 : fl->fl_pid;
+        flock->l_pid = IS_OFDLCK(fl) ? -1 : fl->fl_pid;
 #if BITS_PER_LONG == 32
        /*
         * Make sure we can represent the posix lock via
@@ -1913,7 +1900,7 @@ static int posix_lock_to_flock(struct flock *flock, struct file_lock *fl)
 #if BITS_PER_LONG == 32
 static void posix_lock_to_flock64(struct flock64 *flock, struct file_lock *fl)
 {
-        flock->l_pid = IS_FILE_PVT(fl) ? -1 : fl->fl_pid;
+        flock->l_pid = IS_OFDLCK(fl) ? -1 : fl->fl_pid;
        flock->l_start = fl->fl_start;
        flock->l_len = fl->fl_end == OFFSET_MAX ? 0 :
                fl->fl_end - fl->fl_start + 1;
@@ -1942,13 +1929,13 @@ int fcntl_getlk(struct file *filp, unsigned int cmd, struct flock __user *l)
        if (error)
                goto out;
-        if (cmd == F_GETLKP) {
+        if (cmd == F_OFD_GETLK) {
                error = -EINVAL;
                if (flock.l_pid != 0)
                        goto out;
                cmd = F_GETLK;
-                file_lock.fl_flags |= FL_FILE_PVT;
+                file_lock.fl_flags |= FL_OFDLCK;
                file_lock.fl_owner = (fl_owner_t)filp;
        }
@@ -2035,6 +2022,22 @@ static int do_lock_file_wait(struct file *filp, unsigned int cmd,
        return error;
 }
+/* Ensure that fl->fl_filp has compatible f_mode for F_SETLK calls */
+static int
+check_fmode_for_setlk(struct file_lock *fl)
+{
+        switch (fl->fl_type) {
+        case F_RDLCK:
+                if (!(fl->fl_file->f_mode & FMODE_READ))
+                        return -EBADF;
+                break;
+        case F_WRLCK:
+                if (!(fl->fl_file->f_mode & FMODE_WRITE))
+                        return -EBADF;
+        }
+        return 0;
+}
 /* Apply the lock described by l to an open file descriptor.
 * This implements both the F_SETLK and F_SETLKW commands of fcntl().
 */
@@ -2072,27 +2075,31 @@ again:
        if (error)
                goto out;
+        error = check_fmode_for_setlk(file_lock);
+        if (error)
+                goto out;
        /*
         * If the cmd is requesting file-private locks, then set the
-         * FL_FILE_PVT flag and override the owner.
+         * FL_OFDLCK flag and override the owner.
         */
        switch (cmd) {
-        case F_SETLKP:
+        case F_OFD_SETLK:
                error = -EINVAL;
                if (flock.l_pid != 0)
                        goto out;
                cmd = F_SETLK;
-                file_lock->fl_flags |= FL_FILE_PVT;
+                file_lock->fl_flags |= FL_OFDLCK;
                file_lock->fl_owner = (fl_owner_t)filp;
                break;
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
                error = -EINVAL;
                if (flock.l_pid != 0)
                        goto out;
                cmd = F_SETLKW;
-                file_lock->fl_flags |= FL_FILE_PVT;
+                file_lock->fl_flags |= FL_OFDLCK;
                file_lock->fl_owner = (fl_owner_t)filp;
                /* Fallthrough */
        case F_SETLKW:
@@ -2144,13 +2151,13 @@ int fcntl_getlk64(struct file *filp, unsigned int cmd, struct flock64 __user *l)
        if (error)
                goto out;
-        if (cmd == F_GETLKP) {
+        if (cmd == F_OFD_GETLK) {
                error = -EINVAL;
                if (flock.l_pid != 0)
                        goto out;
                cmd = F_GETLK64;
-                file_lock.fl_flags |= FL_FILE_PVT;
+                file_lock.fl_flags |= FL_OFDLCK;
                file_lock.fl_owner = (fl_owner_t)filp;
        }
@@ -2207,27 +2214,31 @@ again:
        if (error)
                goto out;
+        error = check_fmode_for_setlk(file_lock);
+        if (error)
+                goto out;
        /*
         * If the cmd is requesting file-private locks, then set the
-         * FL_FILE_PVT flag and override the owner.
+         * FL_OFDLCK flag and override the owner.
         */
        switch (cmd) {
-        case F_SETLKP:
+        case F_OFD_SETLK:
                error = -EINVAL;
                if (flock.l_pid != 0)
                        goto out;
                cmd = F_SETLK64;
-                file_lock->fl_flags |= FL_FILE_PVT;
+                file_lock->fl_flags |= FL_OFDLCK;
                file_lock->fl_owner = (fl_owner_t)filp;
                break;
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
                error = -EINVAL;
                if (flock.l_pid != 0)
                        goto out;
                cmd = F_SETLKW64;
-                file_lock->fl_flags |= FL_FILE_PVT;
+                file_lock->fl_flags |= FL_OFDLCK;
                file_lock->fl_owner = (fl_owner_t)filp;
                /* Fallthrough */
        case F_SETLKW64:
@@ -2413,8 +2424,8 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl,
        if (IS_POSIX(fl)) {
                if (fl->fl_flags & FL_ACCESS)
                        seq_printf(f, "ACCESS");
-                else if (IS_FILE_PVT(fl))
+                else if (IS_OFDLCK(fl))
-                        seq_printf(f, "FLPVT ");
+                        seq_printf(f, "OFDLCK");
                else
                        seq_printf(f, "POSIX ");
diff --git a/fs/namei.c b/fs/namei.c
index c6157c894fce..80168273396b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1542,7 +1542,7 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
                inode = path->dentry->d_inode;
        }
        err = -ENOENT;
-        if (!inode)
+        if (!inode || d_is_negative(path->dentry))
                goto out_path_put;
        if (should_follow_link(path->dentry, follow)) {
@@ -2249,7 +2249,7 @@ mountpoint_last(struct nameidata *nd, struct path *path)
        mutex_unlock(&dir->d_inode->i_mutex);
 done:
-        if (!dentry->d_inode) {
+        if (!dentry->d_inode || d_is_negative(dentry)) {
                error = -ENOENT;
                dput(dentry);
                goto out;
@@ -2994,7 +2994,7 @@ retry_lookup:
 finish_lookup:
        /* we _can_ be in RCU mode here */
        error = -ENOENT;
-        if (d_is_negative(path->dentry)) {
+        if (!inode || d_is_negative(path->dentry)) {
                path_to_nameidata(path, nd);
                goto out;
        }
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 6f3f392d48af..b6f46013dddf 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -402,8 +402,10 @@ sort_pacl(struct posix_acl *pacl)
         * by uid/gid. */
        int i, j;
-        if (pacl->a_count <= 4)
+        /* no users or groups */
-                return; /* no users or groups */
+        if (!pacl || pacl->a_count <= 4)
+                return;
        i = 1;
        while (pacl->a_entries[i].e_tag == ACL_USER)
                i++;
@@ -530,13 +532,12 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
        /*
         * ACLs with no ACEs are treated differently in the inheritable
-         * and effective cases: when there are no inheritable ACEs, we
+         * and effective cases: when there are no inheritable ACEs,
-         * set a zero-length default posix acl:
+         * calls ->set_acl with a NULL ACL structure.
         */
-        if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) {
+        if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
-                pacl = posix_acl_alloc(0, GFP_KERNEL);
+                return NULL;
-                return pacl ? pacl : ERR_PTR(-ENOMEM);
-        }
        /*
         * When there are no effective ACEs, the following will end
         * up setting a 3-element effective posix ACL with all
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 39c8ef875f91..2c73cae9899d 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -654,9 +654,11 @@ static struct rpc_clnt *create_backchannel_client(struct rpc_create_args *args)
 static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
 {
+        int maxtime = max_cb_time(clp->net);
        struct rpc_timeout      timeparms = {
-                .to_initval     = max_cb_time(clp->net),
+                .to_initval     = maxtime,
                .to_retries     = 0,
+                .to_maxval      = maxtime,
        };
        struct rpc_create_args args = {
                .net            = clp->net,
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 3ba65979a3cd..32b699bebb9c 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1078,6 +1078,18 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
                return NULL;
        }
        clp->cl_name.len = name.len;
+        INIT_LIST_HEAD(&clp->cl_sessions);
+        idr_init(&clp->cl_stateids);
+        atomic_set(&clp->cl_refcount, 0);
+        clp->cl_cb_state = NFSD4_CB_UNKNOWN;
+        INIT_LIST_HEAD(&clp->cl_idhash);
+        INIT_LIST_HEAD(&clp->cl_openowners);
+        INIT_LIST_HEAD(&clp->cl_delegations);
+        INIT_LIST_HEAD(&clp->cl_lru);
+        INIT_LIST_HEAD(&clp->cl_callbacks);
+        INIT_LIST_HEAD(&clp->cl_revoked);
+        spin_lock_init(&clp->cl_lock);
+        rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
        return clp;
 }
@@ -1095,6 +1107,7 @@ free_client(struct nfs4_client *clp)
                WARN_ON_ONCE(atomic_read(&ses->se_ref));
                free_session(ses);
        }
+        rpc_destroy_wait_queue(&clp->cl_cb_waitq);
        free_svc_cred(&clp->cl_cred);
        kfree(clp->cl_name.data);
        idr_destroy(&clp->cl_stateids);
@@ -1347,7 +1360,6 @@ static struct nfs4_client *create_client(struct xdr_netobj name,
        if (clp == NULL)
                return NULL;
-        INIT_LIST_HEAD(&clp->cl_sessions);
        ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
        if (ret) {
                spin_lock(&nn->client_lock);
@@ -1355,20 +1367,9 @@ static struct nfs4_client *create_client(struct xdr_netobj name,
                spin_unlock(&nn->client_lock);
                return NULL;
        }
-        idr_init(&clp->cl_stateids);
-        atomic_set(&clp->cl_refcount, 0);
-        clp->cl_cb_state = NFSD4_CB_UNKNOWN;
-        INIT_LIST_HEAD(&clp->cl_idhash);
-        INIT_LIST_HEAD(&clp->cl_openowners);
-        INIT_LIST_HEAD(&clp->cl_delegations);
-        INIT_LIST_HEAD(&clp->cl_lru);
-        INIT_LIST_HEAD(&clp->cl_callbacks);
-        INIT_LIST_HEAD(&clp->cl_revoked);
-        spin_lock_init(&clp->cl_lock);
        nfsd4_init_callback(&clp->cl_cb_null);
        clp->cl_time = get_seconds();
        clear_bit(0, &clp->cl_cb_slot_busy);
-        rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
        copy_verf(clp, verf);
        rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
        gen_confirm(clp);
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 2723c1badd01..18881f34737a 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3627,14 +3627,6 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
        /* nfsd4_check_resp_size guarantees enough room for error status */
        if (!op->status)
                op->status = nfsd4_check_resp_size(resp, 0);
-        if (op->status == nfserr_resource && nfsd4_has_session(&resp->cstate)) {
-                struct nfsd4_slot *slot = resp->cstate.slot;
-                if (slot->sl_flags & NFSD4_SLOT_CACHETHIS)
-                        op->status = nfserr_rep_too_big_to_cache;
-                else
-                        op->status = nfserr_rep_too_big;
-        }
        if (so) {
                so->so_replay.rp_status = op->status;
                so->so_replay.rp_buflen = (char *)resp->p - (char *)(statp+1);
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 4e565c814309..732648b270dc 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -698,6 +698,8 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
        }
        group->overflow_event = &oevent->fse;
+        if (force_o_largefile())
+                event_f_flags |= O_LARGEFILE;
        group->fanotify_data.f_flags = event_f_flags;
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
        spin_lock_init(&group->fanotify_data.access_lock);
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 9e363e41dacc..0855f772cd41 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -246,6 +246,12 @@ posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p)
        umode_t mode = 0;
        int not_equiv = 0;
+        /*
+         * A null ACL can always be presented as mode bits.
+         */
+        if (!acl)
+                return 0;
        FOREACH_ACL_ENTRY(pa, acl, pe) {
                switch (pa->e_tag) {
                        case ACL_USER_OBJ:
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 28cc1acd5439..e9ef59b3abb1 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -47,12 +47,13 @@ static int sysfs_kf_seq_show(struct seq_file *sf, void *v)
        ssize_t count;
        char *buf;
-        /* acquire buffer and ensure that it's >= PAGE_SIZE */
+        /* acquire buffer and ensure that it's >= PAGE_SIZE and clear */
        count = seq_get_buf(sf, &buf);
        if (count < PAGE_SIZE) {
                seq_commit(sf, -1);
                return 0;
        }
+        memset(buf, 0, PAGE_SIZE);
        /*
         * Invoke show().  Control may reach here via seq file lseek even
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index a66ad6196f59..8794423f7efb 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -63,7 +63,8 @@ int __init sysfs_init(void)
 {
        int err;
-        sysfs_root = kernfs_create_root(NULL, 0, NULL);
+        sysfs_root = kernfs_create_root(NULL, KERNFS_ROOT_EXTRA_OPEN_PERM_CHECK,
+                                        NULL);
        if (IS_ERR(sysfs_root))
                return PTR_ERR(sysfs_root);
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index a1266089eca1..a81c7b556896 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1556,7 +1556,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
        if (c->space_fixup) {
                err = ubifs_fixup_free_space(c);
                if (err)
-                        return err;
+                        goto out;
        }
        err = check_free_space(c);
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index 01b6a0102fbd..abda1124a70f 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -213,7 +213,7 @@ xfs_attr_calc_size(
                 * Out of line attribute, cannot double split, but
                 * make room for the attribute value itself.
                 */
-                uint    dblocks = XFS_B_TO_FSB(mp, valuelen);
+                uint    dblocks = xfs_attr3_rmt_blocks(mp, valuelen);
                nblks += dblocks;
                nblks += XFS_NEXTENTADD_SPACE_RES(mp, dblocks, XFS_ATTR_FORK);
        }
@@ -698,11 +698,22 @@ xfs_attr_leaf_addname(xfs_da_args_t *args)
                trace_xfs_attr_leaf_replace(args);
+                /* save the attribute state for later removal*/
                args->op_flags |= XFS_DA_OP_RENAME;     /* an atomic rename */
                args->blkno2 = args->blkno;             /* set 2nd entry info*/
                args->index2 = args->index;
                args->rmtblkno2 = args->rmtblkno;
                args->rmtblkcnt2 = args->rmtblkcnt;
+                args->rmtvaluelen2 = args->rmtvaluelen;
+                /*
+                 * clear the remote attr state now that it is saved so that the
+                 * values reflect the state of the attribute we are about to
+                 * add, not the attribute we just found and will remove later.
+                 */
+                args->rmtblkno = 0;
+                args->rmtblkcnt = 0;
+                args->rmtvaluelen = 0;
        }
        /*
@@ -794,6 +805,7 @@ xfs_attr_leaf_addname(xfs_da_args_t *args)
                args->blkno = args->blkno2;
                args->rmtblkno = args->rmtblkno2;
                args->rmtblkcnt = args->rmtblkcnt2;
+                args->rmtvaluelen = args->rmtvaluelen2;
                if (args->rmtblkno) {
                        error = xfs_attr_rmtval_remove(args);
                        if (error)
@@ -999,13 +1011,22 @@ restart:
                trace_xfs_attr_node_replace(args);
+                /* save the attribute state for later removal*/
                args->op_flags |= XFS_DA_OP_RENAME;     /* atomic rename op */
                args->blkno2 = args->blkno;             /* set 2nd entry info*/
                args->index2 = args->index;
                args->rmtblkno2 = args->rmtblkno;
                args->rmtblkcnt2 = args->rmtblkcnt;
+                args->rmtvaluelen2 = args->rmtvaluelen;
+                /*
+                 * clear the remote attr state now that it is saved so that the
+                 * values reflect the state of the attribute we are about to
+                 * add, not the attribute we just found and will remove later.
+                 */
                args->rmtblkno = 0;
                args->rmtblkcnt = 0;
+                args->rmtvaluelen = 0;
        }
        retval = xfs_attr3_leaf_add(blk->bp, state->args);
@@ -1133,6 +1154,7 @@ restart:
                args->blkno = args->blkno2;
                args->rmtblkno = args->rmtblkno2;
                args->rmtblkcnt = args->rmtblkcnt2;
+                args->rmtvaluelen = args->rmtvaluelen2;
                if (args->rmtblkno) {
                        error = xfs_attr_rmtval_remove(args);
                        if (error)
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index fe9587fab17a..511c283459b1 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -1229,6 +1229,7 @@ xfs_attr3_leaf_add_work(
                name_rmt->valueblk = 0;
                args->rmtblkno = 1;
                args->rmtblkcnt = xfs_attr3_rmt_blocks(mp, args->valuelen);
+                args->rmtvaluelen = args->valuelen;
        }
        xfs_trans_log_buf(args->trans, bp,
             XFS_DA_LOGRANGE(leaf, xfs_attr3_leaf_name(leaf, args->index),
@@ -2167,11 +2168,11 @@ xfs_attr3_leaf_lookup_int(
                        if (!xfs_attr_namesp_match(args->flags, entry->flags))
                                continue;
                        args->index = probe;
-                        args->valuelen = be32_to_cpu(name_rmt->valuelen);
+                        args->rmtvaluelen = be32_to_cpu(name_rmt->valuelen);
                        args->rmtblkno = be32_to_cpu(name_rmt->valueblk);
                        args->rmtblkcnt = xfs_attr3_rmt_blocks(
                                                        args->dp->i_mount,
-                                                        args->valuelen);
+                                                        args->rmtvaluelen);
                        return XFS_ERROR(EEXIST);
                }
        }
@@ -2220,19 +2221,19 @@ xfs_attr3_leaf_getvalue(
                name_rmt = xfs_attr3_leaf_name_remote(leaf, args->index);
                ASSERT(name_rmt->namelen == args->namelen);
                ASSERT(memcmp(args->name, name_rmt->name, args->namelen) == 0);
-                valuelen = be32_to_cpu(name_rmt->valuelen);
+                args->rmtvaluelen = be32_to_cpu(name_rmt->valuelen);
                args->rmtblkno = be32_to_cpu(name_rmt->valueblk);
                args->rmtblkcnt = xfs_attr3_rmt_blocks(args->dp->i_mount,
-                                                       valuelen);
+                                                       args->rmtvaluelen);
                if (args->flags & ATTR_KERNOVAL) {
-                        args->valuelen = valuelen;
+                        args->valuelen = args->rmtvaluelen;
                        return 0;
                }
-                if (args->valuelen < valuelen) {
+                if (args->valuelen < args->rmtvaluelen) {
-                        args->valuelen = valuelen;
+                        args->valuelen = args->rmtvaluelen;
                        return XFS_ERROR(ERANGE);
                }
-                args->valuelen = valuelen;
+                args->valuelen = args->rmtvaluelen;
        }
        return 0;
 }
@@ -2519,7 +2520,7 @@ xfs_attr3_leaf_clearflag(
                ASSERT((entry->flags & XFS_ATTR_LOCAL) == 0);
                name_rmt = xfs_attr3_leaf_name_remote(leaf, args->index);
                name_rmt->valueblk = cpu_to_be32(args->rmtblkno);
-                name_rmt->valuelen = cpu_to_be32(args->valuelen);
+                name_rmt->valuelen = cpu_to_be32(args->rmtvaluelen);
                xfs_trans_log_buf(args->trans, bp,
                         XFS_DA_LOGRANGE(leaf, name_rmt, sizeof(*name_rmt)));
        }
@@ -2677,7 +2678,7 @@ xfs_attr3_leaf_flipflags(
                ASSERT((entry1->flags & XFS_ATTR_LOCAL) == 0);
                name_rmt = xfs_attr3_leaf_name_remote(leaf1, args->index);
                name_rmt->valueblk = cpu_to_be32(args->rmtblkno);
-                name_rmt->valuelen = cpu_to_be32(args->valuelen);
+                name_rmt->valuelen = cpu_to_be32(args->rmtvaluelen);
                xfs_trans_log_buf(args->trans, bp1,
                         XFS_DA_LOGRANGE(leaf1, name_rmt, sizeof(*name_rmt)));
        }
diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
index 01db96f60cf0..833fe5d98d80 100644
--- a/fs/xfs/xfs_attr_list.c
+++ b/fs/xfs/xfs_attr_list.c
@@ -447,6 +447,7 @@ xfs_attr3_leaf_list_int(
                                args.dp = context->dp;
                                args.whichfork = XFS_ATTR_FORK;
                                args.valuelen = valuelen;
+                                args.rmtvaluelen = valuelen;
                                args.value = kmem_alloc(valuelen, KM_SLEEP | KM_NOFS);
                                args.rmtblkno = be32_to_cpu(name_rmt->valueblk);
                                args.rmtblkcnt = xfs_attr3_rmt_blocks(
diff --git a/fs/xfs/xfs_attr_remote.c b/fs/xfs/xfs_attr_remote.c
index 6e37823e2932..d2e6e948cec7 100644
--- a/fs/xfs/xfs_attr_remote.c
+++ b/fs/xfs/xfs_attr_remote.c
@@ -337,7 +337,7 @@ xfs_attr_rmtval_get(
        struct xfs_buf          *bp;
        xfs_dablk_t             lblkno = args->rmtblkno;
        __uint8_t               *dst = args->value;
-        int                     valuelen = args->valuelen;
+        int                     valuelen;
        int                     nmap;
        int                     error;
        int                     blkcnt = args->rmtblkcnt;
@@ -347,7 +347,9 @@ xfs_attr_rmtval_get(
        trace_xfs_attr_rmtval_get(args);
        ASSERT(!(args->flags & ATTR_KERNOVAL));
+        ASSERT(args->rmtvaluelen == args->valuelen);
+        valuelen = args->rmtvaluelen;
        while (valuelen > 0) {
                nmap = ATTR_RMTVALUE_MAPSIZE;
                error = xfs_bmapi_read(args->dp, (xfs_fileoff_t)lblkno,
@@ -415,7 +417,7 @@ xfs_attr_rmtval_set(
         * attributes have headers, we can't just do a straight byte to FSB
         * conversion and have to take the header space into account.
         */
-        blkcnt = xfs_attr3_rmt_blocks(mp, args->valuelen);
+        blkcnt = xfs_attr3_rmt_blocks(mp, args->rmtvaluelen);
        error = xfs_bmap_first_unused(args->trans, args->dp, blkcnt, &lfileoff,
                                                   XFS_ATTR_FORK);
        if (error)
@@ -480,7 +482,7 @@ xfs_attr_rmtval_set(
         */
        lblkno = args->rmtblkno;
        blkcnt = args->rmtblkcnt;
-        valuelen = args->valuelen;
+        valuelen = args->rmtvaluelen;
        while (valuelen > 0) {
                struct xfs_buf  *bp;
                xfs_daddr_t     dblkno;
diff --git a/fs/xfs/xfs_da_btree.h b/fs/xfs/xfs_da_btree.h
index 6e95ea79f5d7..201c6091d26a 100644
--- a/fs/xfs/xfs_da_btree.h
+++ b/fs/xfs/xfs_da_btree.h
@@ -60,10 +60,12 @@ typedef struct xfs_da_args {
        int             index;          /* index of attr of interest in blk */
        xfs_dablk_t     rmtblkno;       /* remote attr value starting blkno */
        int             rmtblkcnt;      /* remote attr value block count */
+        int             rmtvaluelen;    /* remote attr value length in bytes */
        xfs_dablk_t     blkno2;         /* blkno of 2nd attr leaf of interest */
        int             index2;         /* index of 2nd attr in blk */
        xfs_dablk_t     rmtblkno2;      /* remote attr value starting blkno */
        int             rmtblkcnt2;     /* remote attr value block count */
+        int             rmtvaluelen2;   /* remote attr value length in bytes */
        int             op_flags;       /* operation flags */
        enum xfs_dacmp  cmpresult;      /* name compare result for lookups */
 } xfs_da_args_t;
diff --git a/fs/xfs/xfs_export.c b/fs/xfs/xfs_export.c
index 1399e187d425..753e467aa1a5 100644
--- a/fs/xfs/xfs_export.c
+++ b/fs/xfs/xfs_export.c
@@ -237,7 +237,7 @@ xfs_fs_nfs_commit_metadata(
        if (!lsn)
                return 0;
-        return _xfs_log_force_lsn(mp, lsn, XFS_LOG_SYNC, NULL);
+        return -_xfs_log_force_lsn(mp, lsn, XFS_LOG_SYNC, NULL);
 }
 const struct export_operations xfs_export_operations = {
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 951a2321ee01..830c1c937b88 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -155,7 +155,7 @@ xfs_dir_fsync(
        if (!lsn)
                return 0;
-        return _xfs_log_force_lsn(mp, lsn, XFS_LOG_SYNC, NULL);
+        return -_xfs_log_force_lsn(mp, lsn, XFS_LOG_SYNC, NULL);
 }
 STATIC int
@@ -295,7 +295,7 @@ xfs_file_aio_read(
                xfs_rw_ilock(ip, XFS_IOLOCK_EXCL);
                if (inode->i_mapping->nrpages) {
-                        ret = -filemap_write_and_wait_range(
+                        ret = filemap_write_and_wait_range(
                                                        VFS_I(ip)->i_mapping,
                                                        pos, -1);
                        if (ret) {
@@ -837,7 +837,7 @@ xfs_file_fallocate(
                unsigned blksize_mask = (1 << inode->i_blkbits) - 1;
                if (offset & blksize_mask || len & blksize_mask) {
-                        error = -EINVAL;
+                        error = EINVAL;
                        goto out_unlock;
                }
@@ -846,7 +846,7 @@ xfs_file_fallocate(
                 * in which case it is effectively a truncate operation
                 */
                if (offset + len >= i_size_read(inode)) {
-                        error = -EINVAL;
+                        error = EINVAL;
                        goto out_unlock;
                }
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index ef1ca010f417..36d630319a27 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -72,8 +72,8 @@ xfs_initxattrs(
        int                     error = 0;
        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
-                error = xfs_attr_set(ip, xattr->name, xattr->value,
+                error = -xfs_attr_set(ip, xattr->name, xattr->value,
-                                     xattr->value_len, ATTR_SECURE);
+                                      xattr->value_len, ATTR_SECURE);
                if (error < 0)
                        break;
        }
@@ -93,8 +93,8 @@ xfs_init_security(
        struct inode    *dir,
        const struct qstr *qstr)
 {
-        return security_inode_init_security(inode, dir, qstr,
+        return -security_inode_init_security(inode, dir, qstr,
-                                            &xfs_initxattrs, NULL);
+                                             &xfs_initxattrs, NULL);
 }
 static void
@@ -124,15 +124,15 @@ xfs_cleanup_inode(
        xfs_dentry_to_name(&teardown, dentry, 0);
        xfs_remove(XFS_I(dir), &teardown, XFS_I(inode));
-        iput(inode);
 }
 STATIC int
-xfs_vn_mknod(
+xfs_generic_create(
        struct inode    *dir,
        struct dentry   *dentry,
        umode_t         mode,
-        dev_t           rdev)
+        dev_t           rdev,
+        bool            tmpfile)        /* unnamed file */
 {
        struct inode    *inode;
        struct xfs_inode *ip = NULL;
@@ -156,8 +156,12 @@ xfs_vn_mknod(
        if (error)
                return error;
-        xfs_dentry_to_name(&name, dentry, mode);
+        if (!tmpfile) {
-        error = xfs_create(XFS_I(dir), &name, mode, rdev, &ip);
+                xfs_dentry_to_name(&name, dentry, mode);
+                error = xfs_create(XFS_I(dir), &name, mode, rdev, &ip);
+        } else {
+                error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip);
+        }
        if (unlikely(error))
                goto out_free_acl;
@@ -169,18 +173,22 @@ xfs_vn_mknod(
 #ifdef CONFIG_XFS_POSIX_ACL
        if (default_acl) {
-                error = xfs_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
+                error = -xfs_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
                if (error)
                        goto out_cleanup_inode;
        }
        if (acl) {
-                error = xfs_set_acl(inode, acl, ACL_TYPE_ACCESS);
+                error = -xfs_set_acl(inode, acl, ACL_TYPE_ACCESS);
                if (error)
                        goto out_cleanup_inode;
        }
 #endif
-        d_instantiate(dentry, inode);
+        if (tmpfile)
+                d_tmpfile(dentry, inode);
+        else
+                d_instantiate(dentry, inode);
 out_free_acl:
        if (default_acl)
                posix_acl_release(default_acl);
@@ -189,11 +197,23 @@ xfs_vn_mknod(
        return -error;
 out_cleanup_inode:
-        xfs_cleanup_inode(dir, inode, dentry);
+        if (!tmpfile)
+                xfs_cleanup_inode(dir, inode, dentry);
+        iput(inode);
        goto out_free_acl;
 }
 STATIC int
+xfs_vn_mknod(
+        struct inode    *dir,
+        struct dentry   *dentry,
+        umode_t         mode,
+        dev_t           rdev)
+{
+        return xfs_generic_create(dir, dentry, mode, rdev, false);
+}
+STATIC int
 xfs_vn_create(
        struct inode    *dir,
        struct dentry   *dentry,
@@ -353,6 +373,7 @@ xfs_vn_symlink(
 out_cleanup_inode:
        xfs_cleanup_inode(dir, inode, dentry);
+        iput(inode);
 out:
        return -error;
 }
@@ -1053,25 +1074,7 @@ xfs_vn_tmpfile(
        struct dentry   *dentry,
        umode_t         mode)
 {
-        int                     error;
+        return xfs_generic_create(dir, dentry, mode, 0, true);
-        struct xfs_inode        *ip;
-        struct inode            *inode;
-        error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip);
-        if (unlikely(error))
-                return -error;
-        inode = VFS_I(ip);
-        error = xfs_init_security(inode, dir, &dentry->d_name);
-        if (unlikely(error)) {
-                iput(inode);
-                return -error;
-        }
-        d_tmpfile(dentry, inode);
-        return 0;
 }
 static const struct inode_operations xfs_inode_operations = {
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 08624dc67317..a5f8bd9899d3 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -616,11 +616,13 @@ xfs_log_mount(
        int             error = 0;
        int             min_logfsbs;
-        if (!(mp->m_flags & XFS_MOUNT_NORECOVERY))
+        if (!(mp->m_flags & XFS_MOUNT_NORECOVERY)) {
-                xfs_notice(mp, "Mounting Filesystem");
+                xfs_notice(mp, "Mounting V%d Filesystem",
-        else {
+                           XFS_SB_VERSION_NUM(&mp->m_sb));
+        } else {
                xfs_notice(mp,
-"Mounting filesystem in no-recovery mode.  Filesystem will be inconsistent.");
+"Mounting V%d filesystem in no-recovery mode. Filesystem will be inconsistent.",
+                           XFS_SB_VERSION_NUM(&mp->m_sb));
                ASSERT(mp->m_flags & XFS_MOUNT_RDONLY);
        }
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 993cb19e7d39..944f3d9456a8 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -743,8 +743,6 @@ xfs_mountfs(
                new_size *= mp->m_sb.sb_inodesize / XFS_DINODE_MIN_SIZE;
                if (mp->m_sb.sb_inoalignmt >= XFS_B_TO_FSBT(mp, new_size))
                        mp->m_inode_cluster_size = new_size;
-                xfs_info(mp, "Using inode cluster size of %d bytes",
-                         mp->m_inode_cluster_size);
        }
        /*
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 348e4d2ed6e6..dc977b6e6a36 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -843,22 +843,17 @@ xfs_qm_init_quotainfo(
        qinf = mp->m_quotainfo = kmem_zalloc(sizeof(xfs_quotainfo_t), KM_SLEEP);
-        if ((error = list_lru_init(&qinf->qi_lru))) {
+        error = -list_lru_init(&qinf->qi_lru);
-                kmem_free(qinf);
+        if (error)
-                mp->m_quotainfo = NULL;
+                goto out_free_qinf;
-                return error;
-        }
        /*
         * See if quotainodes are setup, and if not, allocate them,
         * and change the superblock accordingly.
         */
-        if ((error = xfs_qm_init_quotainos(mp))) {
+        error = xfs_qm_init_quotainos(mp);
-                list_lru_destroy(&qinf->qi_lru);
+        if (error)
-                kmem_free(qinf);
+                goto out_free_lru;
-                mp->m_quotainfo = NULL;
-                return error;
-        }
        INIT_RADIX_TREE(&qinf->qi_uquota_tree, GFP_NOFS);
        INIT_RADIX_TREE(&qinf->qi_gquota_tree, GFP_NOFS);
@@ -918,7 +913,7 @@ xfs_qm_init_quotainfo(
                qinf->qi_isoftlimit = be64_to_cpu(ddqp->d_ino_softlimit);
                qinf->qi_rtbhardlimit = be64_to_cpu(ddqp->d_rtb_hardlimit);
                qinf->qi_rtbsoftlimit = be64_to_cpu(ddqp->d_rtb_softlimit);
- 
                xfs_qm_dqdestroy(dqp);
        } else {
                qinf->qi_btimelimit = XFS_QM_BTIMELIMIT;
@@ -935,6 +930,13 @@ xfs_qm_init_quotainfo(
        qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE;
        register_shrinker(&qinf->qi_shrinker);
        return 0;
+out_free_lru:
+        list_lru_destroy(&qinf->qi_lru);
+out_free_qinf:
+        kmem_free(qinf);
+        mp->m_quotainfo = NULL;
+        return error;
 }
diff --git a/fs/xfs/xfs_sb.c b/fs/xfs/xfs_sb.c
index 0c0e41bbe4e3..8baf61afae1d 100644
--- a/fs/xfs/xfs_sb.c
+++ b/fs/xfs/xfs_sb.c
@@ -201,10 +201,6 @@ xfs_mount_validate_sb(
         * write validation, we don't need to check feature masks.
         */
        if (check_version && XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) {
-                xfs_alert(mp,
-"Version 5 superblock detected. This kernel has EXPERIMENTAL support enabled!\n"
-"Use of these features in this kernel is at your own risk!");
                if (xfs_sb_has_compat_feature(sbp,
                                        XFS_SB_FEAT_COMPAT_UNKNOWN)) {
                        xfs_warn(mp,
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 205376776377..3494eff8e4eb 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1433,11 +1433,11 @@ xfs_fs_fill_super(
        if (error)
                goto out_free_fsname;
-        error = xfs_init_mount_workqueues(mp);
+        error = -xfs_init_mount_workqueues(mp);
        if (error)
                goto out_close_devices;
-        error = xfs_icsb_init_counters(mp);
+        error = -xfs_icsb_init_counters(mp);
        if (error)
                goto out_destroy_workqueues;
diff --git a/include/asm-generic/fixmap.h b/include/asm-generic/fixmap.h
index 5a64ca4621f3..f23174fb9ec4 100644
--- a/include/asm-generic/fixmap.h
+++ b/include/asm-generic/fixmap.h
@@ -93,5 +93,8 @@ static inline unsigned long virt_to_fix(const unsigned long vaddr)
 #define set_fixmap_io(idx, phys) \
        __set_fixmap(idx, phys, FIXMAP_PAGE_IO)
+#define set_fixmap_offset_io(idx, phys) \
+        __set_fixmap_offset(idx, phys, FIXMAP_PAGE_IO)
 #endif /* __ASSEMBLY__ */
 #endif /* __ASM_GENERIC_FIXMAP_H */
diff --git a/include/asm-generic/resource.h b/include/asm-generic/resource.h
index b4ea8f50fc65..5e752b959054 100644
--- a/include/asm-generic/resource.h
+++ b/include/asm-generic/resource.h
@@ -12,7 +12,7 @@
        [RLIMIT_CPU]            = {  RLIM_INFINITY,  RLIM_INFINITY },   \
        [RLIMIT_FSIZE]          = {  RLIM_INFINITY,  RLIM_INFINITY },   \
        [RLIMIT_DATA]           = {  RLIM_INFINITY,  RLIM_INFINITY },   \
-        [RLIMIT_STACK]          = {       _STK_LIM,   _STK_LIM_MAX },   \
+        [RLIMIT_STACK]          = {       _STK_LIM,  RLIM_INFINITY },   \
        [RLIMIT_CORE]           = {              0,  RLIM_INFINITY },   \
        [RLIMIT_RSS]            = {  RLIM_INFINITY,  RLIM_INFINITY },   \
        [RLIMIT_NPROC]          = {              0,              0 },   \
diff --git a/include/asm-generic/word-at-a-time.h b/include/asm-generic/word-at-a-time.h
index d3909effd725..94f9ea8abcae 100644
--- a/include/asm-generic/word-at-a-time.h
+++ b/include/asm-generic/word-at-a-time.h
@@ -50,11 +50,7 @@ static inline bool has_zero(unsigned long val, unsigned long *data, const struct
 }
 #ifndef zero_bytemask
-#ifdef CONFIG_64BIT
+#define zero_bytemask(mask) (~1ul << __fls(mask))
-#define zero_bytemask(mask)     (~0ul << fls64(mask))
+#endif
-#else
-#define zero_bytemask(mask)     (~0ul << fls(mask))
-#endif /* CONFIG_64BIT */
-#endif /* zero_bytemask */
 #endif /* _ASM_WORD_AT_A_TIME_H */
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 49376aec2fbb..6dfd64b3a604 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -637,6 +637,22 @@
        {0x1002, 0x983d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x983e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x983f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KABINI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9851, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9852, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9853, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9854, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9855, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9856, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9857, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9858, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9859, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x985A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x985B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x985C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x985D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x985E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x985F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9900, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9901, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9903, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index 940ece4934ba..012d58fa8ff0 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -191,8 +191,8 @@
        INTEL_VGA_DEVICE(0x0A06, info), /* ULT GT1 mobile */ \
        INTEL_VGA_DEVICE(0x0A16, info), /* ULT GT2 mobile */ \
        INTEL_VGA_DEVICE(0x0A26, info), /* ULT GT3 mobile */ \
-        INTEL_VGA_DEVICE(0x0A0E, info), /* ULT GT1 reserved */ \
+        INTEL_VGA_DEVICE(0x0A0E, info), /* ULX GT1 mobile */ \
-        INTEL_VGA_DEVICE(0x0A1E, info), /* ULT GT2 reserved */ \
+        INTEL_VGA_DEVICE(0x0A1E, info), /* ULX GT2 mobile */ \
        INTEL_VGA_DEVICE(0x0A2E, info), /* ULT GT3 reserved */ \
        INTEL_VGA_DEVICE(0x0D06, info), /* CRW GT1 mobile */ \
        INTEL_VGA_DEVICE(0x0D16, info), /* CRW GT2 mobile */ \
diff --git a/include/dt-bindings/clk/at91.h b/include/dt-bindings/clock/at91.h
index 0b4cb999a3f7..0b4cb999a3f7 100644
--- a/include/dt-bindings/clk/at91.h
+++ b/include/dt-bindings/clock/at91.h
diff --git a/include/dt-bindings/clock/tegra124-car.h b/include/dt-bindings/clock/tegra124-car.h
index 8c1603b10665..433528ab5161 100644
--- a/include/dt-bindings/clock/tegra124-car.h
+++ b/include/dt-bindings/clock/tegra124-car.h
@@ -29,7 +29,7 @@
 /* 10 (register bit affects spdif_in and spdif_out) */
 #define TEGRA124_CLK_I2S1 11
 #define TEGRA124_CLK_I2C1 12
-#define TEGRA124_CLK_NDFLASH 13
+/* 13 */
 #define TEGRA124_CLK_SDMMC1 14
 #define TEGRA124_CLK_SDMMC4 15
 /* 16 */
@@ -83,7 +83,7 @@
 /* 64 */
 #define TEGRA124_CLK_UARTD 65
-#define TEGRA124_CLK_UARTE 66
+/* 66 */
 #define TEGRA124_CLK_I2C3 67
 #define TEGRA124_CLK_SBC4 68
 #define TEGRA124_CLK_SDMMC3 69
@@ -97,7 +97,7 @@
 #define TEGRA124_CLK_TRACE 77
 #define TEGRA124_CLK_SOC_THERM 78
 #define TEGRA124_CLK_DTV 79
-#define TEGRA124_CLK_NDSPEED 80
+/* 80 */
 #define TEGRA124_CLK_I2CSLOW 81
 #define TEGRA124_CLK_DSIB 82
 #define TEGRA124_CLK_TSEC 83
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index c2515851c1aa..d60904b9e505 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -473,6 +473,7 @@ struct cftype {
 };
 extern struct cgroup_root cgrp_dfl_root;
+extern struct css_set init_css_set;
 static inline bool cgroup_on_dfl(const struct cgroup *cgrp)
 {
@@ -700,6 +701,20 @@ static inline struct cgroup_subsys_state *task_css(struct task_struct *task,
        return task_css_check(task, subsys_id, false);
 }
+/**
+ * task_css_is_root - test whether a task belongs to the root css
+ * @task: the target task
+ * @subsys_id: the target subsystem ID
+ *
+ * Test whether @task belongs to the root css on the specified subsystem.
+ * May be invoked in any context.
+ */
+static inline bool task_css_is_root(struct task_struct *task, int subsys_id)
+{
+        return task_css_check(task, subsys_id, true) ==
+                init_css_set.subsys[subsys_id];
+}
 static inline struct cgroup *task_cgroup(struct task_struct *task,
                                         int subsys_id)
 {
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 3b9bfdb83ba6..3c7ec327ebd2 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -221,6 +221,8 @@ struct dentry_operations {
 #define DCACHE_SYMLINK_TYPE             0x00300000 /* Symlink */
 #define DCACHE_FILE_TYPE                0x00400000 /* Other file type */
+#define DCACHE_MAY_FREE                 0x00800000
 extern seqlock_t rename_lock;
 static inline int dname_external(const struct dentry *dentry)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 7a9c5bca2b76..878031227c57 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -815,7 +815,7 @@ static inline struct file *get_file(struct file *f)
 #define FL_SLEEP        128     /* A blocking lock */
 #define FL_DOWNGRADE_PENDING    256 /* Lease is being downgraded */
 #define FL_UNLOCK_PENDING       512 /* Lease is being broken */
-#define FL_FILE_PVT     1024    /* lock is private to the file */
+#define FL_OFDLCK       1024    /* lock is "owned" by struct file */
 /*
 * Special return value from posix_lock_file() and vfs_lock_file() for
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 9212b017bc72..ae9504b4b67d 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -535,6 +535,7 @@ static inline int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_a
 extern int ftrace_arch_read_dyn_info(char *buf, int size);
 extern int skip_trace(unsigned long ip);
+extern void ftrace_module_init(struct module *mod);
 extern void ftrace_disable_daemon(void);
 extern void ftrace_enable_daemon(void);
@@ -544,6 +545,7 @@ static inline int ftrace_force_update(void) { return 0; }
 static inline void ftrace_disable_daemon(void) { }
 static inline void ftrace_enable_daemon(void) { }
 static inline void ftrace_release_mod(struct module *mod) {}
+static inline void ftrace_module_init(struct module *mod) {}
 static inline __init int register_ftrace_command(struct ftrace_func_command *cmd)
 {
        return -EINVAL;
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 5b337cf8fb86..b65166de1d9d 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -412,6 +412,16 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
        return &mm->page_table_lock;
 }
+static inline bool hugepages_supported(void)
+{
+        /*
+         * Some platform decide whether they support huge pages at boot
+         * time. On these, such as powerpc, HPAGE_SHIFT is set to 0 when
+         * there is no such support
+         */
+        return HPAGE_SHIFT != 0;
+}
 #else   /* CONFIG_HUGETLB_PAGE */
 struct hstate {};
 #define alloc_huge_page_node(h, nid) NULL
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index c7bfac1c4a7b..051c85032f48 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -203,7 +203,40 @@ static inline int check_wakeup_irqs(void) { return 0; }
 extern cpumask_var_t irq_default_affinity;
-extern int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask);
+/* Internal implementation. Use the helpers below */
+extern int __irq_set_affinity(unsigned int irq, const struct cpumask *cpumask,
+                              bool force);
+/**
+ * irq_set_affinity - Set the irq affinity of a given irq
+ * @irq:        Interrupt to set affinity
+ * @cpumask:    cpumask
+ *
+ * Fails if cpumask does not contain an online CPU
+ */
+static inline int
+irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
+{
+        return __irq_set_affinity(irq, cpumask, false);
+}
+/**
+ * irq_force_affinity - Force the irq affinity of a given irq
+ * @irq:        Interrupt to set affinity
+ * @cpumask:    cpumask
+ *
+ * Same as irq_set_affinity, but without checking the mask against
+ * online cpus.
+ *
+ * Solely for low level cpu hotplug code, where we need to make per
+ * cpu interrupts affine before the cpu becomes online.
+ */
+static inline int
+irq_force_affinity(unsigned int irq, const struct cpumask *cpumask)
+{
+        return __irq_set_affinity(irq, cpumask, true);
+}
 extern int irq_can_set_affinity(unsigned int irq);
 extern int irq_select_affinity(unsigned int irq);
@@ -239,6 +272,11 @@ static inline int irq_set_affinity(unsigned int irq, const struct cpumask *m)
        return -EINVAL;
 }
+static inline int irq_force_affinity(unsigned int irq, const struct cpumask *cpumask)
+{
+        return 0;
+}
 static inline int irq_can_set_affinity(unsigned int irq)
 {
        return 0;
diff --git a/include/linux/irq.h b/include/linux/irq.h
index d278838908cb..5c57efb863d0 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -394,7 +394,8 @@ extern void remove_percpu_irq(unsigned int irq, struct irqaction *act);
 extern void irq_cpu_online(void);
 extern void irq_cpu_offline(void);
-extern int __irq_set_affinity_locked(struct irq_data *data,  const struct cpumask *cpumask);
+extern int irq_set_affinity_locked(struct irq_data *data,
+                                   const struct cpumask *cpumask, bool force);
 #if defined(CONFIG_SMP) && defined(CONFIG_GENERIC_PENDING_IRQ)
 void irq_move_irq(struct irq_data *data);
@@ -602,6 +603,8 @@ static inline u32 irq_get_trigger_type(unsigned int irq)
        return d ? irqd_get_trigger_type(d) : 0;
 }
+unsigned int arch_dynirq_lower_bound(unsigned int from);
 int __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
                struct module *owner);
diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h
index b0122dc6f96a..ca1be5c9136c 100644
--- a/include/linux/kernfs.h
+++ b/include/linux/kernfs.h
@@ -50,7 +50,24 @@ enum kernfs_node_flag {
 /* @flags for kernfs_create_root() */
 enum kernfs_root_flag {
-        KERNFS_ROOT_CREATE_DEACTIVATED = 0x0001,
+        /*
+         * kernfs_nodes are created in the deactivated state and invisible.
+         * They require explicit kernfs_activate() to become visible.  This
+         * can be used to make related nodes become visible atomically
+         * after all nodes are created successfully.
+         */
+        KERNFS_ROOT_CREATE_DEACTIVATED          = 0x0001,
+        /*
+         * For regular flies, if the opener has CAP_DAC_OVERRIDE, open(2)
+         * succeeds regardless of the RW permissions.  sysfs had an extra
+         * layer of enforcement where open(2) fails with -EACCES regardless
+         * of CAP_DAC_OVERRIDE if the permission doesn't have the
+         * respective read or write access at all (none of S_IRUGO or
+         * S_IWUGO) or the respective operation isn't implemented.  The
+         * following flag enables that behavior.
+         */
+        KERNFS_ROOT_EXTRA_OPEN_PERM_CHECK       = 0x0002,
 };
 /* type-specific structures for kernfs_node union members */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 1de36be64df4..5ab4e3a76721 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -822,6 +822,7 @@ struct ata_port {
        unsigned long           qc_allocated;
        unsigned int            qc_active;
        int                     nr_active_links; /* #links with active qcs */
+        unsigned int            last_tag;       /* track next tag hw expects */
        struct ata_link         link;           /* host default link */
        struct ata_link         *slave_link;    /* see ata_slave_link_init() */
diff --git a/include/linux/linkage.h b/include/linux/linkage.h
index 34a513a2727b..a6a42dd02466 100644
--- a/include/linux/linkage.h
+++ b/include/linux/linkage.h
@@ -12,9 +12,9 @@
 #endif
 #ifdef __cplusplus
-#define CPP_ASMLINKAGE extern "C" __visible
+#define CPP_ASMLINKAGE extern "C"
 #else
-#define CPP_ASMLINKAGE __visible
+#define CPP_ASMLINKAGE
 #endif
 #ifndef asmlinkage
diff --git a/include/linux/mfd/rtsx_common.h b/include/linux/mfd/rtsx_common.h
index 7c36cc55d2c7..443176ee1ab0 100644
--- a/include/linux/mfd/rtsx_common.h
+++ b/include/linux/mfd/rtsx_common.h
@@ -45,7 +45,6 @@ struct platform_device;
 struct rtsx_slot {
        struct platform_device  *p_dev;
        void                    (*card_event)(struct platform_device *p_dev);
-        void                    (*done_transfer)(struct platform_device *p_dev);
 };
 #endif
diff --git a/include/linux/mfd/rtsx_pci.h b/include/linux/mfd/rtsx_pci.h
index 8d6bbd609ad9..a3835976f7c6 100644
--- a/include/linux/mfd/rtsx_pci.h
+++ b/include/linux/mfd/rtsx_pci.h
@@ -943,12 +943,6 @@ void rtsx_pci_send_cmd_no_wait(struct rtsx_pcr *pcr);
 int rtsx_pci_send_cmd(struct rtsx_pcr *pcr, int timeout);
 int rtsx_pci_transfer_data(struct rtsx_pcr *pcr, struct scatterlist *sglist,
                int num_sg, bool read, int timeout);
-int rtsx_pci_dma_map_sg(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int num_sg, bool read);
-int rtsx_pci_dma_unmap_sg(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int num_sg, bool read);
-int rtsx_pci_dma_transfer(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int sg_count, bool read);
 int rtsx_pci_read_ppbuf(struct rtsx_pcr *pcr, u8 *buf, int buf_len);
 int rtsx_pci_write_ppbuf(struct rtsx_pcr *pcr, u8 *buf, int buf_len);
 int rtsx_pci_card_pull_ctl_enable(struct rtsx_pcr *pcr, int card);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index bf9811e1321a..d6777060449f 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -370,6 +370,8 @@ static inline int is_vmalloc_or_module_addr(const void *x)
 }
 #endif
+extern void kvfree(const void *addr);
 static inline void compound_lock(struct page *page)
 {
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index aad8eeaf416d..f64b01787ddc 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -169,4 +169,11 @@ struct netlink_tap {
 extern int netlink_add_tap(struct netlink_tap *nt);
 extern int netlink_remove_tap(struct netlink_tap *nt);
+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
+                          struct user_namespace *ns, int cap);
+bool netlink_ns_capable(const struct sk_buff *skb,
+                        struct user_namespace *ns, int cap);
+bool netlink_capable(const struct sk_buff *skb, int cap);
+bool netlink_net_capable(const struct sk_buff *skb, int cap);
 #endif  /* __LINUX_NETLINK_H */
diff --git a/include/linux/of.h b/include/linux/of.h
index 3bad8d106e0e..e6f0988c1c68 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -349,7 +349,7 @@ int of_device_is_stdout_path(struct device_node *dn);
 #else /* CONFIG_OF */
-static inline const char* of_node_full_name(struct device_node *np)
+static inline const char* of_node_full_name(const struct device_node *np)
 {
        return "<no-node>";
 }
diff --git a/include/linux/of_irq.h b/include/linux/of_irq.h
index 3f23b4472c31..6404253d810d 100644
--- a/include/linux/of_irq.h
+++ b/include/linux/of_irq.h
@@ -44,11 +44,16 @@ extern void of_irq_init(const struct of_device_id *matches);
 #ifdef CONFIG_OF_IRQ
 extern int of_irq_count(struct device_node *dev);
+extern int of_irq_get(struct device_node *dev, int index);
 #else
 static inline int of_irq_count(struct device_node *dev)
 {
        return 0;
 }
+static inline int of_irq_get(struct device_node *dev, int index)
+{
+        return 0;
+}
 #endif
 #if defined(CONFIG_OF)
diff --git a/include/linux/phy/phy.h b/include/linux/phy/phy.h
index e2f5ca96cddc..2760744cb2a7 100644
--- a/include/linux/phy/phy.h
+++ b/include/linux/phy/phy.h
@@ -174,21 +174,29 @@ void devm_of_phy_provider_unregister(struct device *dev,
 #else
 static inline int phy_pm_runtime_get(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
 static inline int phy_pm_runtime_get_sync(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
 static inline int phy_pm_runtime_put(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
 static inline int phy_pm_runtime_put_sync(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
@@ -204,21 +212,29 @@ static inline void phy_pm_runtime_forbid(struct phy *phy)
 static inline int phy_init(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
 static inline int phy_exit(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
 static inline int phy_power_on(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
 static inline int phy_power_off(struct phy *phy)
 {
+        if (!phy)
+                return 0;
        return -ENOSYS;
 }
diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
index e530681bea70..1a4a8c157b31 100644
--- a/include/linux/regulator/consumer.h
+++ b/include/linux/regulator/consumer.h
@@ -258,14 +258,14 @@ regulator_get_exclusive(struct device *dev, const char *id)
 static inline struct regulator *__must_check
 regulator_get_optional(struct device *dev, const char *id)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 static inline struct regulator *__must_check
 devm_regulator_get_optional(struct device *dev, const char *id)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 static inline void regulator_put(struct regulator *regulator)
diff --git a/include/linux/serio.h b/include/linux/serio.h
index 36aac733840a..9f779c7a2da4 100644
--- a/include/linux/serio.h
+++ b/include/linux/serio.h
@@ -23,6 +23,7 @@ struct serio {
        char name[32];
        char phys[32];
+        char firmware_id[128];
        bool manual_bind;
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index f2f7398848cf..d82abd40a3c0 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -101,4 +101,13 @@ struct kmem_cache {
        struct kmem_cache_node *node[MAX_NUMNODES];
 };
+#ifdef CONFIG_SYSFS
+#define SLAB_SUPPORTS_SYSFS
+void sysfs_slab_remove(struct kmem_cache *);
+#else
+static inline void sysfs_slab_remove(struct kmem_cache *s)
+{
+}
+#endif
 #endif /* _LINUX_SLUB_DEF_H */
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index 54f91d35e5fd..46cca4c06848 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie);
 void sock_diag_save_cookie(void *sk, __u32 *cookie);
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
+int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,
                             struct sk_buff *skb, int attrtype);
 #endif
diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index 7d64d3609ec9..428277869400 100644
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -155,7 +155,11 @@ struct vsock_transport {
 /**** CORE ****/
-int vsock_core_init(const struct vsock_transport *t);
+int __vsock_core_init(const struct vsock_transport *t, struct module *owner);
+static inline int vsock_core_init(const struct vsock_transport *t)
+{
+        return __vsock_core_init(t, THIS_MODULE);
+}
 void vsock_core_exit(void);
 /**** UTILS ****/
diff --git a/include/net/sock.h b/include/net/sock.h
index 8338a14e4805..21569cf456ed 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2255,6 +2255,11 @@ int sock_get_timestampns(struct sock *, struct timespec __user *);
 int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level,
                       int type);
+bool sk_ns_capable(const struct sock *sk,
+                   struct user_namespace *user_ns, int cap);
+bool sk_capable(const struct sock *sk, int cap);
+bool sk_net_capable(const struct sock *sk, int cap);
 /*
 *      Enable debug/info messages
 */
diff --git a/include/trace/events/module.h b/include/trace/events/module.h
index 11fd51b413de..7c5cbfe3fc49 100644
--- a/include/trace/events/module.h
+++ b/include/trace/events/module.h
@@ -25,7 +25,7 @@ struct module;
        { (1UL << TAINT_OOT_MODULE),            "O" },          \
        { (1UL << TAINT_FORCED_MODULE),         "F" },          \
        { (1UL << TAINT_CRAP),                  "C" },          \
-        { (1UL << TAINT_UNSIGNED_MODULE),       "X" })
+        { (1UL << TAINT_UNSIGNED_MODULE),       "E" })
 TRACE_EVENT(module_load,
@@ -80,7 +80,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
        TP_fast_assign(
                __entry->ip     = ip;
-                __entry->refcnt = __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs);
+                __entry->refcnt = __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs);
                __assign_str(name, mod->name);
        ),
diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h
index a9b13f8b3595..7543b3e51331 100644
--- a/include/uapi/asm-generic/fcntl.h
+++ b/include/uapi/asm-generic/fcntl.h
@@ -133,20 +133,20 @@
 #endif
 /*
- * fd "private" POSIX locks.
+ * Open File Description Locks
 *
- * Usually POSIX locks held by a process are released on *any* close and are
+ * Usually record locks held by a process are released on *any* close and are
 * not inherited across a fork().
 *
- * These cmd values will set locks that conflict with normal POSIX locks, but
+ * These cmd values will set locks that conflict with process-associated
- * are "owned" by the opened file, not the process. This means that they are
+ * record  locks, but are "owned" by the open file description, not the
- * inherited across fork() like BSD (flock) locks, and they are only released
+ * process. This means that they are inherited across fork() like BSD (flock)
- * automatically when the last reference to the the open file against which
+ * locks, and they are only released automatically when the last reference to
- * they were acquired is put.
+ * the the open file against which they were acquired is put.
 */
-#define F_GETLKP        36
+#define F_OFD_GETLK     36
-#define F_SETLKP        37
+#define F_OFD_SETLK     37
-#define F_SETLKPW       38
+#define F_OFD_SETLKW    38
 #define F_OWNER_TID     0
 #define F_OWNER_PID     1
diff --git a/include/uapi/asm-generic/resource.h b/include/uapi/asm-generic/resource.h
index f863428796d5..c6d10af50123 100644
--- a/include/uapi/asm-generic/resource.h
+++ b/include/uapi/asm-generic/resource.h
@@ -57,12 +57,5 @@
 # define RLIM_INFINITY          (~0UL)
 #endif
-/*
- * RLIMIT_STACK default maximum - some architectures override it:
- */
-#ifndef _STK_LIM_MAX
-# define _STK_LIM_MAX           RLIM_INFINITY
-#endif
 #endif /* _UAPI_ASM_GENERIC_RESOURCE_H */
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 6db66783d268..333640608087 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -697,9 +697,11 @@ __SYSCALL(__NR_finit_module, sys_finit_module)
 __SYSCALL(__NR_sched_setattr, sys_sched_setattr)
 #define __NR_sched_getattr 275
 __SYSCALL(__NR_sched_getattr, sys_sched_getattr)
+#define __NR_renameat2 276
+__SYSCALL(__NR_renameat2, sys_renameat2)
 #undef __NR_syscalls
-#define __NR_syscalls 276
+#define __NR_syscalls 277
 /*
 * All syscalls below here should go away really,
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 11917f747cb4..1b1efddb91cd 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -331,9 +331,17 @@ enum {
 #define AUDIT_FAIL_PRINTK       1
 #define AUDIT_FAIL_PANIC        2
+/*
+ * These bits disambiguate different calling conventions that share an
+ * ELF machine type, bitness, and endianness
+ */
+#define __AUDIT_ARCH_CONVENTION_MASK 0x30000000
+#define __AUDIT_ARCH_CONVENTION_MIPS64_N32 0x20000000
 /* distinguish syscall tables */
 #define __AUDIT_ARCH_64BIT 0x80000000
 #define __AUDIT_ARCH_LE    0x40000000
 #define AUDIT_ARCH_ALPHA        (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_ARM          (EM_ARM|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_ARMEB        (EM_ARM)
@@ -346,7 +354,11 @@ enum {
 #define AUDIT_ARCH_MIPS         (EM_MIPS)
 #define AUDIT_ARCH_MIPSEL       (EM_MIPS|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_MIPS64       (EM_MIPS|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_MIPS64N32    (EM_MIPS|__AUDIT_ARCH_64BIT|\
+                                 __AUDIT_ARCH_CONVENTION_MIPS64_N32)
 #define AUDIT_ARCH_MIPSEL64     (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_MIPSEL64N32  (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE\
+                                 __AUDIT_ARCH_CONVENTION_MIPS64_N32)
 #define AUDIT_ARCH_OPENRISC     (EM_OPENRISC)
 #define AUDIT_ARCH_PARISC       (EM_PARISC)
 #define AUDIT_ARCH_PARISC64     (EM_PARISC|__AUDIT_ARCH_64BIT)
diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h
index cf4750e1bb49..40b5ca8a1b1f 100644
--- a/include/uapi/linux/fuse.h
+++ b/include/uapi/linux/fuse.h
@@ -96,6 +96,11 @@
 *
 * 7.23
 *  - add FUSE_WRITEBACK_CACHE
+ *  - add time_gran to fuse_init_out
+ *  - add reserved space to fuse_init_out
+ *  - add FATTR_CTIME
+ *  - add ctime and ctimensec to fuse_setattr_in
+ *  - add FUSE_RENAME2 request
 */
 #ifndef _LINUX_FUSE_H
@@ -191,6 +196,7 @@ struct fuse_file_lock {
 #define FATTR_ATIME_NOW (1 << 7)
 #define FATTR_MTIME_NOW (1 << 8)
 #define FATTR_LOCKOWNER (1 << 9)
+#define FATTR_CTIME     (1 << 10)
 /**
 * Flags returned by the OPEN request
@@ -348,6 +354,7 @@ enum fuse_opcode {
        FUSE_BATCH_FORGET  = 42,
        FUSE_FALLOCATE     = 43,
        FUSE_READDIRPLUS   = 44,
+        FUSE_RENAME2       = 45,
        /* CUSE specific operations */
        CUSE_INIT          = 4096,
@@ -426,6 +433,12 @@ struct fuse_rename_in {
        uint64_t        newdir;
 };
+struct fuse_rename2_in {
+        uint64_t        newdir;
+        uint32_t        flags;
+        uint32_t        padding;
+};
 struct fuse_link_in {
        uint64_t        oldnodeid;
 };
@@ -438,10 +451,10 @@ struct fuse_setattr_in {
        uint64_t        lock_owner;
        uint64_t        atime;
        uint64_t        mtime;
-        uint64_t        unused2;
+        uint64_t        ctime;
        uint32_t        atimensec;
        uint32_t        mtimensec;
-        uint32_t        unused3;
+        uint32_t        ctimensec;
        uint32_t        mode;
        uint32_t        unused4;
        uint32_t        uid;
@@ -559,6 +572,9 @@ struct fuse_init_in {
        uint32_t        flags;
 };
+#define FUSE_COMPAT_INIT_OUT_SIZE 8
+#define FUSE_COMPAT_22_INIT_OUT_SIZE 24
 struct fuse_init_out {
        uint32_t        major;
        uint32_t        minor;
@@ -567,6 +583,8 @@ struct fuse_init_out {
        uint16_t        max_background;
        uint16_t        congestion_threshold;
        uint32_t        max_write;
+        uint32_t        time_gran;
+        uint32_t        unused[9];
 };
 #define CUSE_INIT_INFO_MAX 4096
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index bd24470d24a2..f4849525519c 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -164,6 +164,7 @@ struct input_keymap_entry {
 #define INPUT_PROP_DIRECT               0x01    /* direct input devices */
 #define INPUT_PROP_BUTTONPAD            0x02    /* has button(s) under pad */
 #define INPUT_PROP_SEMI_MT              0x03    /* touch rectangle only */
+#define INPUT_PROP_TOPBUTTONPAD         0x04    /* softbuttons at top of pad */
 #define INPUT_PROP_MAX                  0x1f
 #define INPUT_PROP_CNT                  (INPUT_PROP_MAX + 1)
diff --git a/init/main.c b/init/main.c
index 9c7fd4c9249f..48655ceb66f4 100644
--- a/init/main.c
+++ b/init/main.c
@@ -476,7 +476,7 @@ static void __init mm_init(void)
        vmalloc_init();
 }
-asmlinkage void __init start_kernel(void)
+asmlinkage __visible void __init start_kernel(void)
 {
        char * command_line;
        extern const struct kernel_param __start___param[], __stop___param[];
diff --git a/kernel/audit.c b/kernel/audit.c
index 7c2893602d06..47845c57eb19 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -643,13 +643,13 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
                if ((task_active_pid_ns(current) != &init_pid_ns))
                        return -EPERM;
-                if (!capable(CAP_AUDIT_CONTROL))
+                if (!netlink_capable(skb, CAP_AUDIT_CONTROL))
                        err = -EPERM;
                break;
        case AUDIT_USER:
        case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
        case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
-                if (!capable(CAP_AUDIT_WRITE))
+                if (!netlink_capable(skb, CAP_AUDIT_WRITE))
                        err = -EPERM;
                break;
        default:  /* bad msg */
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 9fcdaa705b6c..3f1ca934a237 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -348,7 +348,7 @@ struct cgrp_cset_link {
 * reference-counted, to improve performance when child cgroups
 * haven't been created.
 */
-static struct css_set init_css_set = {
+struct css_set init_css_set = {
        .refcount               = ATOMIC_INIT(1),
        .cgrp_links             = LIST_HEAD_INIT(init_css_set.cgrp_links),
        .tasks                  = LIST_HEAD_INIT(init_css_set.tasks),
@@ -1495,7 +1495,7 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
         */
        if (!use_task_css_set_links)
                cgroup_enable_task_cg_lists();
-retry:
        mutex_lock(&cgroup_tree_mutex);
        mutex_lock(&cgroup_mutex);
@@ -1503,7 +1503,7 @@ retry:
        ret = parse_cgroupfs_options(data, &opts);
        if (ret)
                goto out_unlock;
+retry:
        /* look for a matching existing root */
        if (!opts.subsys_mask && !opts.none && !opts.name) {
                cgrp_dfl_root_visible = true;
@@ -1562,9 +1562,9 @@ retry:
                if (!atomic_inc_not_zero(&root->cgrp.refcnt)) {
                        mutex_unlock(&cgroup_mutex);
                        mutex_unlock(&cgroup_tree_mutex);
-                        kfree(opts.release_agent);
-                        kfree(opts.name);
                        msleep(10);
+                        mutex_lock(&cgroup_tree_mutex);
+                        mutex_lock(&cgroup_mutex);
                        goto retry;
                }
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index 2bc4a2256444..345628c78b5b 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -21,6 +21,7 @@
 #include <linux/uaccess.h>
 #include <linux/freezer.h>
 #include <linux/seq_file.h>
+#include <linux/mutex.h>
 /*
 * A cgroup is freezing if any FREEZING flags are set.  FREEZING_SELF is
@@ -42,9 +43,10 @@ enum freezer_state_flags {
 struct freezer {
        struct cgroup_subsys_state      css;
        unsigned int                    state;
-        spinlock_t                      lock;
 };
+static DEFINE_MUTEX(freezer_mutex);
 static inline struct freezer *css_freezer(struct cgroup_subsys_state *css)
 {
        return css ? container_of(css, struct freezer, css) : NULL;
@@ -93,7 +95,6 @@ freezer_css_alloc(struct cgroup_subsys_state *parent_css)
        if (!freezer)
                return ERR_PTR(-ENOMEM);
-        spin_lock_init(&freezer->lock);
        return &freezer->css;
 }
@@ -110,14 +111,7 @@ static int freezer_css_online(struct cgroup_subsys_state *css)
        struct freezer *freezer = css_freezer(css);
        struct freezer *parent = parent_freezer(freezer);
-        /*
+        mutex_lock(&freezer_mutex);
-         * The following double locking and freezing state inheritance
-         * guarantee that @cgroup can never escape ancestors' freezing
-         * states.  See css_for_each_descendant_pre() for details.
-         */
-        if (parent)
-                spin_lock_irq(&parent->lock);
-        spin_lock_nested(&freezer->lock, SINGLE_DEPTH_NESTING);
        freezer->state |= CGROUP_FREEZER_ONLINE;
@@ -126,10 +120,7 @@ static int freezer_css_online(struct cgroup_subsys_state *css)
                atomic_inc(&system_freezing_cnt);
        }
-        spin_unlock(&freezer->lock);
+        mutex_unlock(&freezer_mutex);
-        if (parent)
-                spin_unlock_irq(&parent->lock);
        return 0;
 }
@@ -144,14 +135,14 @@ static void freezer_css_offline(struct cgroup_subsys_state *css)
 {
        struct freezer *freezer = css_freezer(css);
-        spin_lock_irq(&freezer->lock);
+        mutex_lock(&freezer_mutex);
        if (freezer->state & CGROUP_FREEZING)
                atomic_dec(&system_freezing_cnt);
        freezer->state = 0;
-        spin_unlock_irq(&freezer->lock);
+        mutex_unlock(&freezer_mutex);
 }
 static void freezer_css_free(struct cgroup_subsys_state *css)
@@ -175,7 +166,7 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
        struct task_struct *task;
        bool clear_frozen = false;
-        spin_lock_irq(&freezer->lock);
+        mutex_lock(&freezer_mutex);
        /*
         * Make the new tasks conform to the current state of @new_css.
@@ -197,21 +188,13 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
                }
        }
-        spin_unlock_irq(&freezer->lock);
+        /* propagate FROZEN clearing upwards */
-        /*
-         * Propagate FROZEN clearing upwards.  We may race with
-         * update_if_frozen(), but as long as both work bottom-up, either
-         * update_if_frozen() sees child's FROZEN cleared or we clear the
-         * parent's FROZEN later.  No parent w/ !FROZEN children can be
-         * left FROZEN.
-         */
        while (clear_frozen && (freezer = parent_freezer(freezer))) {
-                spin_lock_irq(&freezer->lock);
                freezer->state &= ~CGROUP_FROZEN;
                clear_frozen = freezer->state & CGROUP_FREEZING;
-                spin_unlock_irq(&freezer->lock);
        }
+        mutex_unlock(&freezer_mutex);
 }
 /**
@@ -228,9 +211,6 @@ static void freezer_fork(struct task_struct *task)
 {
        struct freezer *freezer;
-        rcu_read_lock();
-        freezer = task_freezer(task);
        /*
         * The root cgroup is non-freezable, so we can skip locking the
         * freezer.  This is safe regardless of race with task migration.
@@ -238,24 +218,18 @@ static void freezer_fork(struct task_struct *task)
         * to do.  If we lost and root is the new cgroup, noop is still the
         * right thing to do.
         */
-        if (!parent_freezer(freezer))
+        if (task_css_is_root(task, freezer_cgrp_id))
-                goto out;
+                return;
-        /*
+        mutex_lock(&freezer_mutex);
-         * Grab @freezer->lock and freeze @task after verifying @task still
+        rcu_read_lock();
-         * belongs to @freezer and it's freezing.  The former is for the
-         * case where we have raced against task migration and lost and
+        freezer = task_freezer(task);
-         * @task is already in a different cgroup which may not be frozen.
+        if (freezer->state & CGROUP_FREEZING)
-         * This isn't strictly necessary as freeze_task() is allowed to be
-         * called spuriously but let's do it anyway for, if nothing else,
-         * documentation.
-         */
-        spin_lock_irq(&freezer->lock);
-        if (freezer == task_freezer(task) && (freezer->state & CGROUP_FREEZING))
                freeze_task(task);
-        spin_unlock_irq(&freezer->lock);
-out:
        rcu_read_unlock();
+        mutex_unlock(&freezer_mutex);
 }
 /**
@@ -281,22 +255,24 @@ static void update_if_frozen(struct cgroup_subsys_state *css)
        struct css_task_iter it;
        struct task_struct *task;
-        WARN_ON_ONCE(!rcu_read_lock_held());
+        lockdep_assert_held(&freezer_mutex);
-        spin_lock_irq(&freezer->lock);
        if (!(freezer->state & CGROUP_FREEZING) ||
            (freezer->state & CGROUP_FROZEN))
-                goto out_unlock;
+                return;
        /* are all (live) children frozen? */
+        rcu_read_lock();
        css_for_each_child(pos, css) {
                struct freezer *child = css_freezer(pos);
                if ((child->state & CGROUP_FREEZER_ONLINE) &&
-                    !(child->state & CGROUP_FROZEN))
+                    !(child->state & CGROUP_FROZEN)) {
-                        goto out_unlock;
+                        rcu_read_unlock();
+                        return;
+                }
        }
+        rcu_read_unlock();
        /* are all tasks frozen? */
        css_task_iter_start(css, &it);
@@ -317,21 +293,29 @@ static void update_if_frozen(struct cgroup_subsys_state *css)
        freezer->state |= CGROUP_FROZEN;
 out_iter_end:
        css_task_iter_end(&it);
-out_unlock:
-        spin_unlock_irq(&freezer->lock);
 }
 static int freezer_read(struct seq_file *m, void *v)
 {
        struct cgroup_subsys_state *css = seq_css(m), *pos;
+        mutex_lock(&freezer_mutex);
        rcu_read_lock();
        /* update states bottom-up */
-        css_for_each_descendant_post(pos, css)
+        css_for_each_descendant_post(pos, css) {
+                if (!css_tryget(pos))
+                        continue;
+                rcu_read_unlock();
                update_if_frozen(pos);
+                rcu_read_lock();
+                css_put(pos);
+        }
        rcu_read_unlock();
+        mutex_unlock(&freezer_mutex);
        seq_puts(m, freezer_state_strs(css_freezer(css)->state));
        seq_putc(m, '\n');
@@ -373,7 +357,7 @@ static void freezer_apply_state(struct freezer *freezer, bool freeze,
                                unsigned int state)
 {
        /* also synchronizes against task migration, see freezer_attach() */
-        lockdep_assert_held(&freezer->lock);
+        lockdep_assert_held(&freezer_mutex);
        if (!(freezer->state & CGROUP_FREEZER_ONLINE))
                return;
@@ -414,31 +398,29 @@ static void freezer_change_state(struct freezer *freezer, bool freeze)
         * descendant will try to inherit its parent's FREEZING state as
         * CGROUP_FREEZING_PARENT.
         */
+        mutex_lock(&freezer_mutex);
        rcu_read_lock();
        css_for_each_descendant_pre(pos, &freezer->css) {
                struct freezer *pos_f = css_freezer(pos);
                struct freezer *parent = parent_freezer(pos_f);
-                spin_lock_irq(&pos_f->lock);
+                if (!css_tryget(pos))
+                        continue;
+                rcu_read_unlock();
-                if (pos_f == freezer) {
+                if (pos_f == freezer)
                        freezer_apply_state(pos_f, freeze,
                                            CGROUP_FREEZING_SELF);
-                } else {
+                else
-                        /*
-                         * Our update to @parent->state is already visible
-                         * which is all we need.  No need to lock @parent.
-                         * For more info on synchronization, see
-                         * freezer_post_create().
-                         */
                        freezer_apply_state(pos_f,
                                            parent->state & CGROUP_FREEZING,
                                            CGROUP_FREEZING_PARENT);
-                }
-                spin_unlock_irq(&pos_f->lock);
+                rcu_read_lock();
+                css_put(pos);
        }
        rcu_read_unlock();
+        mutex_unlock(&freezer_mutex);
 }
 static int freezer_write(struct cgroup_subsys_state *css, struct cftype *cft,
diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c
index 6cb20d2e7ee0..019d45008448 100644
--- a/kernel/context_tracking.c
+++ b/kernel/context_tracking.c
@@ -120,7 +120,7 @@ void context_tracking_user_enter(void)
 * instead of preempt_schedule() to exit user context if needed before
 * calling the scheduler.
 */
-asmlinkage void __sched notrace preempt_schedule_context(void)
+asmlinkage __visible void __sched notrace preempt_schedule_context(void)
 {
        enum ctx_state prev_ctx;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index d55092ceee29..e0501fe7140d 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -234,6 +234,11 @@ again:
                        goto again;
                }
                timer->base = new_base;
+        } else {
+                if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
+                        cpu = this_cpu;
+                        goto again;
+                }
        }
        return new_base;
 }
@@ -569,6 +574,23 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
        cpu_base->expires_next.tv64 = expires_next.tv64;
+        /*
+         * If a hang was detected in the last timer interrupt then we
+         * leave the hang delay active in the hardware. We want the
+         * system to make progress. That also prevents the following
+         * scenario:
+         * T1 expires 50ms from now
+         * T2 expires 5s from now
+         *
+         * T1 is removed, so this code is called and would reprogram
+         * the hardware to 5s from now. Any hrtimer_start after that
+         * will not reprogram the hardware due to hang_detected being
+         * set. So we'd effectivly block all timers until the T2 event
+         * fires.
+         */
+        if (cpu_base->hang_detected)
+                return;
        if (cpu_base->expires_next.tv64 != KTIME_MAX)
                tick_program_event(cpu_base->expires_next, 1);
 }
@@ -968,11 +990,8 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
        /* Remove an active timer from the queue: */
        ret = remove_hrtimer(timer, base);
-        /* Switch the timer base, if necessary: */
-        new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
        if (mode & HRTIMER_MODE_REL) {
-                tim = ktime_add_safe(tim, new_base->get_time());
+                tim = ktime_add_safe(tim, base->get_time());
                /*
                 * CONFIG_TIME_LOW_RES is a temporary way for architectures
                 * to signal that they simply return xtime in
@@ -987,6 +1006,9 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
        hrtimer_set_expires_range_ns(timer, tim, delta_ns);
+        /* Switch the timer base, if necessary: */
+        new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
        timer_stats_hrtimer_set_start_info(timer);
        leftmost = enqueue_hrtimer(timer, new_base);
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index a7174617616b..bb07f2928f4b 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -363,6 +363,13 @@ __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
                if (from > irq)
                        return -EINVAL;
                from = irq;
+        } else {
+                /*
+                 * For interrupts which are freely allocated the
+                 * architecture can force a lower bound to the @from
+                 * argument. x86 uses this to exclude the GSI space.
+                 */
+                from = arch_dynirq_lower_bound(from);
        }
        mutex_lock(&sparse_irq_lock);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 2486a4c1a710..d34131ca372b 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -180,7 +180,7 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
        struct irq_chip *chip = irq_data_get_irq_chip(data);
        int ret;
-        ret = chip->irq_set_affinity(data, mask, false);
+        ret = chip->irq_set_affinity(data, mask, force);
        switch (ret) {
        case IRQ_SET_MASK_OK:
                cpumask_copy(data->affinity, mask);
@@ -192,7 +192,8 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
        return ret;
 }
-int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
+int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+                            bool force)
 {
        struct irq_chip *chip = irq_data_get_irq_chip(data);
        struct irq_desc *desc = irq_data_to_desc(data);
@@ -202,7 +203,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
                return -EINVAL;
        if (irq_can_move_pcntxt(data)) {
-                ret = irq_do_set_affinity(data, mask, false);
+                ret = irq_do_set_affinity(data, mask, force);
        } else {
                irqd_set_move_pending(data);
                irq_copy_pending(desc, mask);
@@ -217,13 +218,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
        return ret;
 }
-/**
+int __irq_set_affinity(unsigned int irq, const struct cpumask *mask, bool force)
- *      irq_set_affinity - Set the irq affinity of a given irq
- *      @irq:           Interrupt to set affinity
- *      @mask:          cpumask
- *
- */
-int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
 {
        struct irq_desc *desc = irq_to_desc(irq);
        unsigned long flags;
@@ -233,7 +228,7 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
                return -EINVAL;
        raw_spin_lock_irqsave(&desc->lock, flags);
-        ret =  __irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask);
+        ret = irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask, force);
        raw_spin_unlock_irqrestore(&desc->lock, flags);
        return ret;
 }
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index b0e9467922e1..d24e4339b46d 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -4188,7 +4188,7 @@ void debug_show_held_locks(struct task_struct *task)
 }
 EXPORT_SYMBOL_GPL(debug_show_held_locks);
-asmlinkage void lockdep_sys_exit(void)
+asmlinkage __visible void lockdep_sys_exit(void)
 {
        struct task_struct *curr = current;
diff --git a/kernel/module.c b/kernel/module.c
index 11869408f79b..079c4615607d 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -815,9 +815,6 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
                return -EFAULT;
        name[MODULE_NAME_LEN-1] = '\0';
-        if (!(flags & O_NONBLOCK))
-                pr_warn("waiting module removal not supported: please upgrade\n");
        if (mutex_lock_interruptible(&module_mutex) != 0)
                return -EINTR;
@@ -3271,6 +3268,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
        dynamic_debug_setup(info->debug, info->num_debug);
+        /* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
+        ftrace_module_init(mod);
        /* Finally it's fully formed, ready to start executing. */
        err = complete_formation(mod, info);
        if (err)
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 18fb7a2fb14b..1ea328aafdc9 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1586,7 +1586,7 @@ swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
        return -ENOMEM;
 }
-asmlinkage int swsusp_save(void)
+asmlinkage __visible int swsusp_save(void)
 {
        unsigned int nr_pages, nr_highmem;
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index c3ad9cafe930..8233cd4047d7 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/cpu.h>
+#include <linux/cpuidle.h>
 #include <linux/syscalls.h>
 #include <linux/gfp.h>
 #include <linux/io.h>
@@ -53,7 +54,9 @@ static void freeze_begin(void)
 static void freeze_enter(void)
 {
+        cpuidle_resume();
        wait_event(suspend_freeze_wait_head, suspend_freeze_wake);
+        cpuidle_pause();
 }
 void freeze_wake(void)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index a45b50962295..7228258b85ec 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1674,7 +1674,7 @@ EXPORT_SYMBOL(printk_emit);
 *
 * See the vsnprintf() documentation for format string extensions over C99.
 */
-asmlinkage int printk(const char *fmt, ...)
+asmlinkage __visible int printk(const char *fmt, ...)
 {
        va_list args;
        int r;
@@ -1737,7 +1737,7 @@ void early_vprintk(const char *fmt, va_list ap)
        }
 }
-asmlinkage void early_printk(const char *fmt, ...)
+asmlinkage __visible void early_printk(const char *fmt, ...)
 {
        va_list ap;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 4b82622b6252..092e511605ec 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2223,7 +2223,7 @@ static inline void post_schedule(struct rq *rq)
 * schedule_tail - first thing a freshly forked thread must call.
 * @prev: the thread we just switched away from.
 */
-asmlinkage void schedule_tail(struct task_struct *prev)
+asmlinkage __visible void schedule_tail(struct task_struct *prev)
        __releases(rq->lock)
 {
        struct rq *rq = this_rq();
@@ -2778,7 +2778,7 @@ static inline void sched_submit_work(struct task_struct *tsk)
                blk_schedule_flush_plug(tsk);
 }
-asmlinkage void __sched schedule(void)
+asmlinkage __visible void __sched schedule(void)
 {
        struct task_struct *tsk = current;
@@ -2788,7 +2788,7 @@ asmlinkage void __sched schedule(void)
 EXPORT_SYMBOL(schedule);
 #ifdef CONFIG_CONTEXT_TRACKING
-asmlinkage void __sched schedule_user(void)
+asmlinkage __visible void __sched schedule_user(void)
 {
        /*
         * If we come here after a random call to set_need_resched(),
@@ -2820,7 +2820,7 @@ void __sched schedule_preempt_disabled(void)
 * off of preempt_enable. Kernel preemptions off return from interrupt
 * occur there and call schedule directly.
 */
-asmlinkage void __sched notrace preempt_schedule(void)
+asmlinkage __visible void __sched notrace preempt_schedule(void)
 {
        /*
         * If there is a non-zero preempt_count or interrupts are disabled,
@@ -2850,7 +2850,7 @@ EXPORT_SYMBOL(preempt_schedule);
 * Note, that this is called and return with irqs disabled. This will
 * protect us against recursive calling from irq.
 */
-asmlinkage void __sched preempt_schedule_irq(void)
+asmlinkage __visible void __sched preempt_schedule_irq(void)
 {
        enum ctx_state prev_state;
diff --git a/kernel/softirq.c b/kernel/softirq.c
index b50990a5bea0..92f24f5e8d52 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -223,7 +223,7 @@ static inline bool lockdep_softirq_start(void) { return false; }
 static inline void lockdep_softirq_end(bool in_hardirq) { }
 #endif
-asmlinkage void __do_softirq(void)
+asmlinkage __visible void __do_softirq(void)
 {
        unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
        unsigned long old_flags = current->flags;
@@ -299,7 +299,7 @@ restart:
        tsk_restore_flags(current, old_flags, PF_MEMALLOC);
 }
-asmlinkage void do_softirq(void)
+asmlinkage __visible void do_softirq(void)
 {
        __u32 pending;
        unsigned long flags;
@@ -779,3 +779,8 @@ int __init __weak arch_early_irq_init(void)
 {
        return 0;
 }
+unsigned int __weak arch_dynirq_lower_bound(unsigned int from)
+{
+        return from;
+}
diff --git a/kernel/timer.c b/kernel/timer.c
index 87bd529879c2..3bb01a323b2a 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -838,7 +838,7 @@ unsigned long apply_slack(struct timer_list *timer, unsigned long expires)
        bit = find_last_bit(&mask, BITS_PER_LONG);
-        mask = (1 << bit) - 1;
+        mask = (1UL << bit) - 1;
        expires_limit = expires_limit & ~(mask);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 1fd4b9479210..4a54a25afa2f 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4330,16 +4330,11 @@ static void ftrace_init_module(struct module *mod,
        ftrace_process_locs(mod, start, end);
 }
-static int ftrace_module_notify_enter(struct notifier_block *self,
+void ftrace_module_init(struct module *mod)
-                                      unsigned long val, void *data)
 {
-        struct module *mod = data;
+        ftrace_init_module(mod, mod->ftrace_callsites,
+                           mod->ftrace_callsites +
-        if (val == MODULE_STATE_COMING)
+                           mod->num_ftrace_callsites);
-                ftrace_init_module(mod, mod->ftrace_callsites,
-                                   mod->ftrace_callsites +
-                                   mod->num_ftrace_callsites);
-        return 0;
 }
 static int ftrace_module_notify_exit(struct notifier_block *self,
@@ -4353,11 +4348,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
        return 0;
 }
 #else
-static int ftrace_module_notify_enter(struct notifier_block *self,
-                                      unsigned long val, void *data)
-{
-        return 0;
-}
 static int ftrace_module_notify_exit(struct notifier_block *self,
                                     unsigned long val, void *data)
 {
@@ -4365,11 +4355,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
 }
 #endif /* CONFIG_MODULES */
-struct notifier_block ftrace_module_enter_nb = {
-        .notifier_call = ftrace_module_notify_enter,
-        .priority = INT_MAX,    /* Run before anything that can use kprobes */
-};
 struct notifier_block ftrace_module_exit_nb = {
        .notifier_call = ftrace_module_notify_exit,
        .priority = INT_MIN,    /* Run after anything that can remove kprobes */
@@ -4403,10 +4388,6 @@ void __init ftrace_init(void)
                                  __start_mcount_loc,
                                  __stop_mcount_loc);
-        ret = register_module_notifier(&ftrace_module_enter_nb);
-        if (ret)
-                pr_warning("Failed to register trace ftrace module enter notifier\n");
        ret = register_module_notifier(&ftrace_module_exit_nb);
        if (ret)
                pr_warning("Failed to register trace ftrace module exit notifier\n");
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 925f537f07d1..4747b476a030 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -77,7 +77,7 @@ event_triggers_call(struct ftrace_event_file *file, void *rec)
                        data->ops->func(data);
                        continue;
                }
-                filter = rcu_dereference(data->filter);
+                filter = rcu_dereference_sched(data->filter);
                if (filter && !filter_match_preds(filter, rec))
                        continue;
                if (data->cmd_ops->post_trigger) {
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index ac5b23cf7212..6620e5837ce2 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -188,7 +188,6 @@ static int tracepoint_add_func(struct tracepoint *tp,
                WARN_ON_ONCE(1);
                return PTR_ERR(old);
        }
-        release_probes(old);
        /*
         * rcu_assign_pointer has a smp_wmb() which makes sure that the new
@@ -200,6 +199,7 @@ static int tracepoint_add_func(struct tracepoint *tp,
        rcu_assign_pointer(tp->funcs, tp_funcs);
        if (!static_key_enabled(&tp->key))
                static_key_slow_inc(&tp->key);
+        release_probes(old);
        return 0;
 }
@@ -221,7 +221,6 @@ static int tracepoint_remove_func(struct tracepoint *tp,
                WARN_ON_ONCE(1);
                return PTR_ERR(old);
        }
-        release_probes(old);
        if (!tp_funcs) {
                /* Removed last function */
@@ -232,6 +231,7 @@ static int tracepoint_remove_func(struct tracepoint *tp,
                        static_key_slow_dec(&tp->key);
        }
        rcu_assign_pointer(tp->funcs, tp_funcs);
+        release_probes(old);
        return 0;
 }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index c30c01b32ece..a4bab46cd38e 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1916,6 +1916,12 @@ static void send_mayday(struct work_struct *work)
        /* mayday mayday mayday */
        if (list_empty(&pwq->mayday_node)) {
+                /*
+                 * If @pwq is for an unbound wq, its base ref may be put at
+                 * any time due to an attribute change.  Pin @pwq until the
+                 * rescuer is done with it.
+                 */
+                get_pwq(pwq);
                list_add_tail(&pwq->mayday_node, &wq->maydays);
                wake_up_process(wq->rescuer->task);
        }
@@ -2398,6 +2404,7 @@ static int rescuer_thread(void *__rescuer)
        struct worker *rescuer = __rescuer;
        struct workqueue_struct *wq = rescuer->rescue_wq;
        struct list_head *scheduled = &rescuer->scheduled;
+        bool should_stop;
        set_user_nice(current, RESCUER_NICE_LEVEL);
@@ -2409,11 +2416,15 @@ static int rescuer_thread(void *__rescuer)
 repeat:
        set_current_state(TASK_INTERRUPTIBLE);
-        if (kthread_should_stop()) {
+        /*
-                __set_current_state(TASK_RUNNING);
+         * By the time the rescuer is requested to stop, the workqueue
-                rescuer->task->flags &= ~PF_WQ_WORKER;
+         * shouldn't have any work pending, but @wq->maydays may still have
-                return 0;
+         * pwq(s) queued.  This can happen by non-rescuer workers consuming
-        }
+         * all the work items before the rescuer got to them.  Go through
+         * @wq->maydays processing before acting on should_stop so that the
+         * list is always empty on exit.
+         */
+        should_stop = kthread_should_stop();
        /* see whether any pwq is asking for help */
        spin_lock_irq(&wq_mayday_lock);
@@ -2445,6 +2456,12 @@ repeat:
                process_scheduled_works(rescuer);
                /*
+                 * Put the reference grabbed by send_mayday().  @pool won't
+                 * go away while we're holding its lock.
+                 */
+                put_pwq(pwq);
+                /*
                 * Leave this pool.  If keep_working() is %true, notify a
                 * regular worker; otherwise, we end up with 0 concurrency
                 * and stalling the execution.
@@ -2459,6 +2476,12 @@ repeat:
        spin_unlock_irq(&wq_mayday_lock);
+        if (should_stop) {
+                __set_current_state(TASK_RUNNING);
+                rescuer->task->flags &= ~PF_WQ_WORKER;
+                return 0;
+        }
        /* rescuers should never participate in concurrency management */
        WARN_ON_ONCE(!(rescuer->flags & WORKER_NOT_RUNNING));
        schedule();
@@ -4100,7 +4123,8 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
        if (!pwq) {
                pr_warning("workqueue: allocation failed while updating NUMA affinity of \"%s\"\n",
                           wq->name);
-                goto out_unlock;
+                mutex_lock(&wq->mutex);
+                goto use_dfl_pwq;
        }
        /*
diff --git a/lib/dump_stack.c b/lib/dump_stack.c
index f23b63f0a1c3..6745c6230db3 100644
--- a/lib/dump_stack.c
+++ b/lib/dump_stack.c
@@ -23,7 +23,7 @@ static void __dump_stack(void)
 #ifdef CONFIG_SMP
 static atomic_t dump_lock = ATOMIC_INIT(-1);
-asmlinkage void dump_stack(void)
+asmlinkage __visible void dump_stack(void)
 {
        int was_locked;
        int old;
@@ -55,7 +55,7 @@ retry:
        preempt_enable();
 }
 #else
-asmlinkage void dump_stack(void)
+asmlinkage __visible void dump_stack(void)
 {
        __dump_stack();
 }
diff --git a/mm/Kconfig b/mm/Kconfig
index ebe5880c29d6..1b5a95f0fa01 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -581,3 +581,18 @@ config PGTABLE_MAPPING
 config GENERIC_EARLY_IOREMAP
        bool
+config MAX_STACK_SIZE_MB
+        int "Maximum user stack size for 32-bit processes (MB)"
+        default 80
+        range 8 256 if METAG
+        range 8 2048
+        depends on STACK_GROWSUP && (!64BIT || COMPAT)
+        help
+          This is the maximum stack size in Megabytes in the VM layout of 32-bit
+          user processes when the stack grows upwards (currently only on parisc
+          and metag arch). The stack will be located at the highest memory
+          address minus the given value, unless the RLIMIT_STACK hard limit is
+          changed to a smaller value in which case that is used.
+          A sane initial value is 80 MB.
diff --git a/mm/compaction.c b/mm/compaction.c
index 37f976287068..627dc2e4320f 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -671,16 +671,20 @@ static void isolate_freepages(struct zone *zone,
                                struct compact_control *cc)
 {
        struct page *page;
-        unsigned long high_pfn, low_pfn, pfn, z_end_pfn, end_pfn;
+        unsigned long high_pfn, low_pfn, pfn, z_end_pfn;
        int nr_freepages = cc->nr_freepages;
        struct list_head *freelist = &cc->freepages;
        /*
         * Initialise the free scanner. The starting point is where we last
-         * scanned from (or the end of the zone if starting). The low point
+         * successfully isolated from, zone-cached value, or the end of the
-         * is the end of the pageblock the migration scanner is using.
+         * zone when isolating for the first time. We need this aligned to
+         * the pageblock boundary, because we do pfn -= pageblock_nr_pages
+         * in the for loop.
+         * The low boundary is the end of the pageblock the migration scanner
+         * is using.
         */
-        pfn = cc->free_pfn;
+        pfn = cc->free_pfn & ~(pageblock_nr_pages-1);
        low_pfn = ALIGN(cc->migrate_pfn + 1, pageblock_nr_pages);
        /*
@@ -700,6 +704,7 @@ static void isolate_freepages(struct zone *zone,
        for (; pfn >= low_pfn && cc->nr_migratepages > nr_freepages;
                                        pfn -= pageblock_nr_pages) {
                unsigned long isolated;
+                unsigned long end_pfn;
                /*
                 * This can iterate a massively long zone without finding any
@@ -734,13 +739,10 @@ static void isolate_freepages(struct zone *zone,
                isolated = 0;
                /*
-                 * As pfn may not start aligned, pfn+pageblock_nr_page
+                 * Take care when isolating in last pageblock of a zone which
-                 * may cross a MAX_ORDER_NR_PAGES boundary and miss
+                 * ends in the middle of a pageblock.
-                 * a pfn_valid check. Ensure isolate_freepages_block()
-                 * only scans within a pageblock
                 */
-                end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
+                end_pfn = min(pfn + pageblock_nr_pages, z_end_pfn);
-                end_pfn = min(end_pfn, z_end_pfn);
                isolated = isolate_freepages_block(cc, pfn, end_pfn,
                                                   freelist, false);
                nr_freepages += isolated;
diff --git a/mm/filemap.c b/mm/filemap.c
index 5020b280a771..000a220e2a41 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -906,8 +906,8 @@ EXPORT_SYMBOL(page_cache_prev_hole);
 * Looks up the page cache slot at @mapping & @offset.  If there is a
 * page cache page, it is returned with an increased refcount.
 *
- * If the slot holds a shadow entry of a previously evicted page, it
+ * If the slot holds a shadow entry of a previously evicted page, or a
- * is returned.
+ * swap entry from shmem/tmpfs, it is returned.
 *
 * Otherwise, %NULL is returned.
 */
@@ -928,9 +928,9 @@ repeat:
                        if (radix_tree_deref_retry(page))
                                goto repeat;
                        /*
-                         * Otherwise, shmem/tmpfs must be storing a swap entry
+                         * A shadow entry of a recently evicted page,
-                         * here as an exceptional entry: so return it without
+                         * or a swap entry from shmem/tmpfs.  Return
-                         * attempting to raise page count.
+                         * it without attempting to raise page count.
                         */
                        goto out;
                }
@@ -983,8 +983,8 @@ EXPORT_SYMBOL(find_get_page);
 * page cache page, it is returned locked and with an increased
 * refcount.
 *
- * If the slot holds a shadow entry of a previously evicted page, it
+ * If the slot holds a shadow entry of a previously evicted page, or a
- * is returned.
+ * swap entry from shmem/tmpfs, it is returned.
 *
 * Otherwise, %NULL is returned.
 *
@@ -1099,8 +1099,8 @@ EXPORT_SYMBOL(find_or_create_page);
 * with ascending indexes.  There may be holes in the indices due to
 * not-present pages.
 *
- * Any shadow entries of evicted pages are included in the returned
+ * Any shadow entries of evicted pages, or swap entries from
- * array.
+ * shmem/tmpfs, are included in the returned array.
 *
 * find_get_entries() returns the number of pages and shadow entries
 * which were found.
@@ -1128,9 +1128,9 @@ repeat:
                        if (radix_tree_deref_retry(page))
                                goto restart;
                        /*
-                         * Otherwise, we must be storing a swap entry
+                         * A shadow entry of a recently evicted page,
-                         * here as an exceptional entry: so return it
+                         * or a swap entry from shmem/tmpfs.  Return
-                         * without attempting to raise page count.
+                         * it without attempting to raise page count.
                         */
                        goto export;
                }
@@ -1198,9 +1198,9 @@ repeat:
                                goto restart;
                        }
                        /*
-                         * Otherwise, shmem/tmpfs must be storing a swap entry
+                         * A shadow entry of a recently evicted page,
-                         * here as an exceptional entry: so skip over it -
+                         * or a swap entry from shmem/tmpfs.  Skip
-                         * we only reach this from invalidate_mapping_pages().
+                         * over it.
                         */
                        continue;
                }
@@ -1265,9 +1265,9 @@ repeat:
                                goto restart;
                        }
                        /*
-                         * Otherwise, shmem/tmpfs must be storing a swap entry
+                         * A shadow entry of a recently evicted page,
-                         * here as an exceptional entry: so stop looking for
+                         * or a swap entry from shmem/tmpfs.  Stop
-                         * contiguous pages.
+                         * looking for contiguous pages.
                         */
                        break;
                }
@@ -1341,10 +1341,17 @@ repeat:
                                goto restart;
                        }
                        /*
-                         * This function is never used on a shmem/tmpfs
+                         * A shadow entry of a recently evicted page.
-                         * mapping, so a swap entry won't be found here.
+                         *
+                         * Those entries should never be tagged, but
+                         * this tree walk is lockless and the tags are
+                         * looked up in bulk, one radix tree node at a
+                         * time, so there is a sizable window for page
+                         * reclaim to evict a page we saw tagged.
+                         *
+                         * Skip over it.
                         */
-                        BUG();
+                        continue;
                }
                if (!page_cache_get_speculative(page))
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 246192929a2d..c82290b9c1fc 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1981,11 +1981,7 @@ static int __init hugetlb_init(void)
 {
        int i;
-        /* Some platform decide whether they support huge pages at boot
+        if (!hugepages_supported())
-         * time. On these, such as powerpc, HPAGE_SHIFT is set to 0 when
-         * there is no such support
-         */
-        if (HPAGE_SHIFT == 0)
                return 0;
        if (!size_to_hstate(default_hstate_size)) {
@@ -2112,6 +2108,9 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
        unsigned long tmp;
        int ret;
+        if (!hugepages_supported())
+                return -ENOTSUPP;
        tmp = h->max_huge_pages;
        if (write && h->order >= MAX_ORDER)
@@ -2165,6 +2164,9 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
        unsigned long tmp;
        int ret;
+        if (!hugepages_supported())
+                return -ENOTSUPP;
        tmp = h->nr_overcommit_huge_pages;
        if (write && h->order >= MAX_ORDER)
@@ -2190,6 +2192,8 @@ out:
 void hugetlb_report_meminfo(struct seq_file *m)
 {
        struct hstate *h = &default_hstate;
+        if (!hugepages_supported())
+                return;
        seq_printf(m,
                        "HugePages_Total:   %5lu\n"
                        "HugePages_Free:    %5lu\n"
@@ -2206,6 +2210,8 @@ void hugetlb_report_meminfo(struct seq_file *m)
 int hugetlb_report_node_meminfo(int nid, char *buf)
 {
        struct hstate *h = &default_hstate;
+        if (!hugepages_supported())
+                return 0;
        return sprintf(buf,
                "Node %d HugePages_Total: %5u\n"
                "Node %d HugePages_Free:  %5u\n"
@@ -2220,6 +2226,9 @@ void hugetlb_show_meminfo(void)
        struct hstate *h;
        int nid;
+        if (!hugepages_supported())
+                return;
        for_each_node_state(nid, N_MEMORY)
                for_each_hstate(h)
                        pr_info("Node %d hugepages_total=%u hugepages_free=%u hugepages_surp=%u hugepages_size=%lukB\n",
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 91d67eaee050..8d2fcdfeff7f 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1775,10 +1775,9 @@ void __init kmemleak_init(void)
        int i;
        unsigned long flags;
-        kmemleak_early_log = 0;
 #ifdef CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF
        if (!kmemleak_skip_disable) {
+                kmemleak_early_log = 0;
                kmemleak_disable();
                return;
        }
@@ -1796,6 +1795,7 @@ void __init kmemleak_init(void)
        /* the kernel is still in UP mode, so disabling the IRQs is enough */
        local_irq_save(flags);
+        kmemleak_early_log = 0;
        if (kmemleak_error) {
                local_irq_restore(flags);
                return;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 29501f040568..c47dffdcb246 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6686,16 +6686,20 @@ static struct page *mc_handle_file_pte(struct vm_area_struct *vma,
                pgoff = pte_to_pgoff(ptent);
        /* page is moved even if it's not RSS of this task(page-faulted). */
-        page = find_get_page(mapping, pgoff);
 #ifdef CONFIG_SWAP
        /* shmem/tmpfs may report page out on swap: account for that too. */
-        if (radix_tree_exceptional_entry(page)) {
+        if (shmem_mapping(mapping)) {
-                swp_entry_t swap = radix_to_swp_entry(page);
+                page = find_get_entry(mapping, pgoff);
-                if (do_swap_account)
+                if (radix_tree_exceptional_entry(page)) {
-                        *entry = swap;
+                        swp_entry_t swp = radix_to_swp_entry(page);
-                page = find_get_page(swap_address_space(swap), swap.val);
+                        if (do_swap_account)
-        }
+                                *entry = swp;
+                        page = find_get_page(swap_address_space(swp), swp.val);
+                }
+        } else
+                page = find_get_page(mapping, pgoff);
+#else
+        page = find_get_page(mapping, pgoff);
 #endif
        return page;
 }
diff --git a/mm/memory.c b/mm/memory.c
index 9c2dc659f6f6..e302ae1dcce0 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -232,17 +232,18 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long
 #endif
 }
-void tlb_flush_mmu(struct mmu_gather *tlb)
+static void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
 {
-        struct mmu_gather_batch *batch;
-        if (!tlb->need_flush)
-                return;
        tlb->need_flush = 0;
        tlb_flush(tlb);
 #ifdef CONFIG_HAVE_RCU_TABLE_FREE
        tlb_table_flush(tlb);
 #endif
+}
+static void tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
+        struct mmu_gather_batch *batch;
        for (batch = &tlb->local; batch; batch = batch->next) {
                free_pages_and_swap_cache(batch->pages, batch->nr);
@@ -251,6 +252,14 @@ void tlb_flush_mmu(struct mmu_gather *tlb)
        tlb->active = &tlb->local;
 }
+void tlb_flush_mmu(struct mmu_gather *tlb)
+{
+        if (!tlb->need_flush)
+                return;
+        tlb_flush_mmu_tlbonly(tlb);
+        tlb_flush_mmu_free(tlb);
+}
 /* tlb_finish_mmu
 *      Called at the end of the shootdown operation to free up any resources
 *      that were required.
@@ -1127,8 +1136,10 @@ again:
                        if (PageAnon(page))
                                rss[MM_ANONPAGES]--;
                        else {
-                                if (pte_dirty(ptent))
+                                if (pte_dirty(ptent)) {
+                                        force_flush = 1;
                                        set_page_dirty(page);
+                                }
                                if (pte_young(ptent) &&
                                    likely(!(vma->vm_flags & VM_SEQ_READ)))
                                        mark_page_accessed(page);
@@ -1137,9 +1148,10 @@ again:
                        page_remove_rmap(page);
                        if (unlikely(page_mapcount(page) < 0))
                                print_bad_pte(vma, addr, ptent, page);
-                        force_flush = !__tlb_remove_page(tlb, page);
+                        if (unlikely(!__tlb_remove_page(tlb, page))) {
-                        if (force_flush)
+                                force_flush = 1;
                                break;
+                        }
                        continue;
                }
                /*
@@ -1174,18 +1186,11 @@ again:
        add_mm_rss_vec(mm, rss);
        arch_leave_lazy_mmu_mode();
-        pte_unmap_unlock(start_pte, ptl);
-        /*
+        /* Do the actual TLB flush before dropping ptl */
-         * mmu_gather ran out of room to batch pages, we break out of
-         * the PTE lock to avoid doing the potential expensive TLB invalidate
-         * and page-free while holding it.
-         */
        if (force_flush) {
                unsigned long old_end;
-                force_flush = 0;
                /*
                 * Flush the TLB just for the previous segment,
                 * then update the range to be the remaining
@@ -1193,11 +1198,21 @@ again:
                 */
                old_end = tlb->end;
                tlb->end = addr;
+                tlb_flush_mmu_tlbonly(tlb);
-                tlb_flush_mmu(tlb);
                tlb->start = addr;
                tlb->end = old_end;
+        }
+        pte_unmap_unlock(start_pte, ptl);
+        /*
+         * If we forced a TLB flush (either due to running out of
+         * batch buffers or because we needed to flush dirty TLB
+         * entries before releasing the ptl), free the batched
+         * memory too. Restart if we didn't do everything.
+         */
+        if (force_flush) {
+                force_flush = 0;
+                tlb_flush_mmu_free(tlb);
                if (addr != end)
                        goto again;
@@ -1955,12 +1970,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
                     unsigned long address, unsigned int fault_flags)
 {
        struct vm_area_struct *vma;
+        vm_flags_t vm_flags;
        int ret;
        vma = find_extend_vma(mm, address);
        if (!vma || address < vma->vm_start)
                return -EFAULT;
+        vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
+        if (!(vm_flags & vma->vm_flags))
+                return -EFAULT;
        ret = handle_mm_fault(mm, vma, address, fault_flags);
        if (ret & VM_FAULT_ERROR) {
                if (ret & VM_FAULT_OOM)
diff --git a/mm/mremap.c b/mm/mremap.c
index 0843feb66f3d..05f1180e9f21 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -194,10 +194,17 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
                        break;
                if (pmd_trans_huge(*old_pmd)) {
                        int err = 0;
-                        if (extent == HPAGE_PMD_SIZE)
+                        if (extent == HPAGE_PMD_SIZE) {
+                                VM_BUG_ON(vma->vm_file || !vma->anon_vma);
+                                /* See comment in move_ptes() */
+                                if (need_rmap_locks)
+                                        anon_vma_lock_write(vma->anon_vma);
                                err = move_huge_pmd(vma, new_vma, old_addr,
                                                    new_addr, old_end,
                                                    old_pmd, new_pmd);
+                                if (need_rmap_locks)
+                                        anon_vma_unlock_write(vma->anon_vma);
+                        }
                        if (err > 0) {
                                need_flush = true;
                                continue;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index ef413492a149..a4317da60532 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -593,14 +593,14 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
 * (5) the closer to setpoint, the smaller |df/dx| (and the reverse)
 *     => fast response on large errors; small oscillation near setpoint
 */
-static inline long long pos_ratio_polynom(unsigned long setpoint,
+static long long pos_ratio_polynom(unsigned long setpoint,
                                          unsigned long dirty,
                                          unsigned long limit)
 {
        long long pos_ratio;
        long x;
-        x = div_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+        x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
                    limit - setpoint + 1);
        pos_ratio = x;
        pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
@@ -842,7 +842,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
        x_intercept = bdi_setpoint + span;
        if (bdi_dirty < x_intercept - span / 4) {
-                pos_ratio = div_u64(pos_ratio * (x_intercept - bdi_dirty),
+                pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
                                    x_intercept - bdi_setpoint + 1);
        } else
                pos_ratio /= 4;
diff --git a/mm/percpu.c b/mm/percpu.c
index 63e24fb4387b..2ddf9a990dbd 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -610,7 +610,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
        chunk->map = pcpu_mem_zalloc(PCPU_DFL_MAP_ALLOC *
                                                sizeof(chunk->map[0]));
        if (!chunk->map) {
-                kfree(chunk);
+                pcpu_mem_free(chunk, pcpu_chunk_struct_size);
                return NULL;
        }
diff --git a/mm/slab.c b/mm/slab.c
index 388cb1ae6fbc..19d92181ce24 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -166,7 +166,7 @@ typedef unsigned char freelist_idx_t;
 typedef unsigned short freelist_idx_t;
 #endif
-#define SLAB_OBJ_MAX_NUM (1 << sizeof(freelist_idx_t) * BITS_PER_BYTE)
+#define SLAB_OBJ_MAX_NUM ((1 << sizeof(freelist_idx_t) * BITS_PER_BYTE) - 1)
 /*
 * true if a page was allocated from pfmemalloc reserves for network-based
@@ -2572,13 +2572,13 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
        return freelist;
 }
-static inline freelist_idx_t get_free_obj(struct page *page, unsigned char idx)
+static inline freelist_idx_t get_free_obj(struct page *page, unsigned int idx)
 {
        return ((freelist_idx_t *)page->freelist)[idx];
 }
 static inline void set_free_obj(struct page *page,
-                                        unsigned char idx, freelist_idx_t val)
+                                        unsigned int idx, freelist_idx_t val)
 {
        ((freelist_idx_t *)(page->freelist))[idx] = val;
 }
diff --git a/mm/slab.h b/mm/slab.h
index 3045316b7c9d..6bd4c353704f 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -91,6 +91,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
 #define CACHE_CREATE_MASK (SLAB_CORE_FLAGS | SLAB_DEBUG_FLAGS | SLAB_CACHE_FLAGS)
 int __kmem_cache_shutdown(struct kmem_cache *);
+void slab_kmem_cache_release(struct kmem_cache *);
 struct seq_file;
 struct file;
diff --git a/mm/slab_common.c b/mm/slab_common.c
index f3cfccf76dda..102cc6fca3d3 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -323,6 +323,12 @@ static int kmem_cache_destroy_memcg_children(struct kmem_cache *s)
 }
 #endif /* CONFIG_MEMCG_KMEM */
+void slab_kmem_cache_release(struct kmem_cache *s)
+{
+        kfree(s->name);
+        kmem_cache_free(kmem_cache, s);
+}
 void kmem_cache_destroy(struct kmem_cache *s)
 {
        get_online_cpus();
@@ -352,8 +358,11 @@ void kmem_cache_destroy(struct kmem_cache *s)
                rcu_barrier();
        memcg_free_cache_params(s);
-        kfree(s->name);
+#ifdef SLAB_SUPPORTS_SYSFS
-        kmem_cache_free(kmem_cache, s);
+        sysfs_slab_remove(s);
+#else
+        slab_kmem_cache_release(s);
+#endif
        goto out_put_cpus;
 out_unlock:
diff --git a/mm/slub.c b/mm/slub.c
index 5e234f1f8853..2b1ce697fc4b 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -210,14 +210,11 @@ enum track_item { TRACK_ALLOC, TRACK_FREE };
 #ifdef CONFIG_SYSFS
 static int sysfs_slab_add(struct kmem_cache *);
 static int sysfs_slab_alias(struct kmem_cache *, const char *);
-static void sysfs_slab_remove(struct kmem_cache *);
 static void memcg_propagate_slab_attrs(struct kmem_cache *s);
 #else
 static inline int sysfs_slab_add(struct kmem_cache *s) { return 0; }
 static inline int sysfs_slab_alias(struct kmem_cache *s, const char *p)
                                                        { return 0; }
-static inline void sysfs_slab_remove(struct kmem_cache *s) { }
 static inline void memcg_propagate_slab_attrs(struct kmem_cache *s) { }
 #endif
@@ -3238,24 +3235,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
 int __kmem_cache_shutdown(struct kmem_cache *s)
 {
-        int rc = kmem_cache_close(s);
+        return kmem_cache_close(s);
-        if (!rc) {
-                /*
-                 * Since slab_attr_store may take the slab_mutex, we should
-                 * release the lock while removing the sysfs entry in order to
-                 * avoid a deadlock. Because this is pretty much the last
-                 * operation we do and the lock will be released shortly after
-                 * that in slab_common.c, we could just move sysfs_slab_remove
-                 * to a later point in common code. We should do that when we
-                 * have a common sysfs framework for all allocators.
-                 */
-                mutex_unlock(&slab_mutex);
-                sysfs_slab_remove(s);
-                mutex_lock(&slab_mutex);
-        }
-        return rc;
 }
 /********************************************************************
@@ -5071,15 +5051,18 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
 #ifdef CONFIG_MEMCG_KMEM
        int i;
        char *buffer = NULL;
+        struct kmem_cache *root_cache;
-        if (!is_root_cache(s))
+        if (is_root_cache(s))
                return;
+        root_cache = s->memcg_params->root_cache;
        /*
         * This mean this cache had no attribute written. Therefore, no point
         * in copying default values around
         */
-        if (!s->max_attr_size)
+        if (!root_cache->max_attr_size)
                return;
        for (i = 0; i < ARRAY_SIZE(slab_attrs); i++) {
@@ -5101,7 +5084,7 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
                 */
                if (buffer)
                        buf = buffer;
-                else if (s->max_attr_size < ARRAY_SIZE(mbuf))
+                else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf))
                        buf = mbuf;
                else {
                        buffer = (char *) get_zeroed_page(GFP_KERNEL);
@@ -5110,7 +5093,7 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
                        buf = buffer;
                }
-                attr->show(s->memcg_params->root_cache, buf);
+                attr->show(root_cache, buf);
                attr->store(s, buf, strlen(buf));
        }
@@ -5119,6 +5102,11 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
 #endif
 }
+static void kmem_cache_release(struct kobject *k)
+{
+        slab_kmem_cache_release(to_slab(k));
+}
 static const struct sysfs_ops slab_sysfs_ops = {
        .show = slab_attr_show,
        .store = slab_attr_store,
@@ -5126,6 +5114,7 @@ static const struct sysfs_ops slab_sysfs_ops = {
 static struct kobj_type slab_ktype = {
        .sysfs_ops = &slab_sysfs_ops,
+        .release = kmem_cache_release,
 };
 static int uevent_filter(struct kset *kset, struct kobject *kobj)
@@ -5252,7 +5241,7 @@ out_put_kobj:
        goto out;
 }
-static void sysfs_slab_remove(struct kmem_cache *s)
+void sysfs_slab_remove(struct kmem_cache *s)
 {
        if (slab_state < FULL)
                /*
diff --git a/mm/truncate.c b/mm/truncate.c
index e5cc39ab0751..6a78c814bebf 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -484,14 +484,6 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
        unsigned long count = 0;
        int i;
-        /*
-         * Note: this function may get called on a shmem/tmpfs mapping:
-         * pagevec_lookup() might then return 0 prematurely (because it
-         * got a gangful of swap entries); but it's hardly worth worrying
-         * about - it can rarely have anything to free from such a mapping
-         * (most pages are dirty), and already skips over any difficulties.
-         */
        pagevec_init(&pvec, 0);
        while (index <= end && pagevec_lookup_entries(&pvec, mapping, index,
                        min(end - index, (pgoff_t)PAGEVEC_SIZE - 1) + 1,
diff --git a/mm/util.c b/mm/util.c
index f380af7ea779..d5ea733c5082 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -10,6 +10,7 @@
 #include <linux/swapops.h>
 #include <linux/mman.h>
 #include <linux/hugetlb.h>
+#include <linux/vmalloc.h>
 #include <asm/uaccess.h>
@@ -387,6 +388,15 @@ unsigned long vm_mmap(struct file *file, unsigned long addr,
 }
 EXPORT_SYMBOL(vm_mmap);
+void kvfree(const void *addr)
+{
+        if (is_vmalloc_addr(addr))
+                vfree(addr);
+        else
+                kfree(addr);
+}
+EXPORT_SYMBOL(kvfree);
 struct address_space *page_mapping(struct page *page)
 {
        struct address_space *mapping = page->mapping;
diff --git a/mm/vmacache.c b/mm/vmacache.c
index d4224b397c0e..1037a3bab505 100644
--- a/mm/vmacache.c
+++ b/mm/vmacache.c
@@ -81,10 +81,12 @@ struct vm_area_struct *vmacache_find(struct mm_struct *mm, unsigned long addr)
        for (i = 0; i < VMACACHE_SIZE; i++) {
                struct vm_area_struct *vma = current->vmacache[i];
-                if (vma && vma->vm_start <= addr && vma->vm_end > addr) {
+                if (!vma)
-                        BUG_ON(vma->vm_mm != mm);
+                        continue;
+                if (WARN_ON_ONCE(vma->vm_mm != mm))
+                        break;
+                if (vma->vm_start <= addr && vma->vm_end > addr)
                        return vma;
-                }
        }
        return NULL;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 3f56c8deb3c0..32c661d66a45 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1916,6 +1916,24 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc,
                get_lru_size(lruvec, LRU_INACTIVE_FILE);
        /*
+         * Prevent the reclaimer from falling into the cache trap: as
+         * cache pages start out inactive, every cache fault will tip
+         * the scan balance towards the file LRU.  And as the file LRU
+         * shrinks, so does the window for rotation from references.
+         * This means we have a runaway feedback loop where a tiny
+         * thrashing file LRU becomes infinitely more attractive than
+         * anon pages.  Try to detect this based on file LRU size.
+         */
+        if (global_reclaim(sc)) {
+                unsigned long free = zone_page_state(zone, NR_FREE_PAGES);
+                if (unlikely(file + free <= high_wmark_pages(zone))) {
+                        scan_balance = SCAN_ANON;
+                        goto out;
+                }
+        }
+        /*
         * There is enough inactive page cache, do not reclaim
         * anything from the anonymous working set right now.
         */
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d958e2dca52f..521fd4f3985e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -819,14 +819,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                struct hci_cp_auth_requested cp;
-                /* encrypt must be pending if auth is also pending */
-                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
                cp.handle = cpu_to_le16(conn->handle);
                hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                             sizeof(cp), &cp);
+                /* If we're already encrypted set the REAUTH_PEND flag,
+                 * otherwise set the ENCRYPT_PEND.
+                 */
                if (conn->key_type != 0xff)
                        set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
+                else
+                        set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
        }
        return 0;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 49774912cb01..15010a230b6d 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3330,6 +3330,12 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
        if (!conn)
                goto unlock;
+        /* For BR/EDR the necessary steps are taken through the
+         * auth_complete event.
+         */
+        if (conn->type != LE_LINK)
+                goto unlock;
        if (!ev->status)
                conn->sec_level = conn->pending_sec_level;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index e74b6d530cb6..e8844d975b32 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -445,6 +445,20 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
        return 0;
 }
+static int br_dev_newlink(struct net *src_net, struct net_device *dev,
+                          struct nlattr *tb[], struct nlattr *data[])
+{
+        struct net_bridge *br = netdev_priv(dev);
+        if (tb[IFLA_ADDRESS]) {
+                spin_lock_bh(&br->lock);
+                br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
+                spin_unlock_bh(&br->lock);
+        }
+        return register_netdevice(dev);
+}
 static size_t br_get_link_af_size(const struct net_device *dev)
 {
        struct net_port_vlans *pv;
@@ -473,6 +487,7 @@ struct rtnl_link_ops br_link_ops __read_mostly = {
        .priv_size      = sizeof(struct net_bridge),
        .setup          = br_dev_setup,
        .validate       = br_validate,
+        .newlink        = br_dev_newlink,
        .dellink        = br_dev_delete,
 };
diff --git a/net/can/gw.c b/net/can/gw.c
index ac31891967da..050a2110d43f 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -804,7 +804,7 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
        u8 limhops = 0;
        int err = 0;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if (nlmsg_len(nlh) < sizeof(*r))
@@ -893,7 +893,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh)
        u8 limhops = 0;
        int err = 0;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if (nlmsg_len(nlh) < sizeof(*r))
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index dac7f9b98687..1948d592aa54 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -557,7 +557,7 @@ static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
        return r;
 }
-static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+static int __ceph_tcp_sendpage(struct socket *sock, struct page *page,
                     int offset, size_t size, bool more)
 {
        int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR);
@@ -570,6 +570,24 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
        return ret;
 }
+static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+                     int offset, size_t size, bool more)
+{
+        int ret;
+        struct kvec iov;
+        /* sendpage cannot properly handle pages with page_count == 0,
+         * we need to fallback to sendmsg if that's the case */
+        if (page_count(page) >= 1)
+                return __ceph_tcp_sendpage(sock, page, offset, size, more);
+        iov.iov_base = kmap(page) + offset;
+        iov.iov_len = size;
+        ret = ceph_tcp_sendmsg(sock, &iov, 1, size, more);
+        kunmap(page);
+        return ret;
+}
 /*
 * Shutdown/close the socket for the given connection.
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index e632b5a52f5b..c547e46084d3 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -329,6 +329,11 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
        dout("crush decode tunable chooseleaf_descend_once = %d",
             c->chooseleaf_descend_once);
+        ceph_decode_need(p, end, sizeof(u8), done);
+        c->chooseleaf_vary_r = ceph_decode_8(p);
+        dout("crush decode tunable chooseleaf_vary_r = %d",
+             c->chooseleaf_vary_r);
 done:
        dout("crush_decode success\n");
        return c;
@@ -1548,8 +1553,10 @@ static void apply_primary_affinity(struct ceph_osdmap *osdmap, u32 pps,
                return;
        for (i = 0; i < len; i++) {
-                if (osds[i] != CRUSH_ITEM_NONE &&
+                int osd = osds[i];
-                    osdmap->osd_primary_affinity[i] !=
+                if (osd != CRUSH_ITEM_NONE &&
+                    osdmap->osd_primary_affinity[osd] !=
                                        CEPH_OSD_DEFAULT_PRIMARY_AFFINITY) {
                        break;
                }
@@ -1563,10 +1570,9 @@ static void apply_primary_affinity(struct ceph_osdmap *osdmap, u32 pps,
         * osd's pgs get rejected as primary.
         */
        for (i = 0; i < len; i++) {
-                int osd;
+                int osd = osds[i];
                u32 aff;
-                osd = osds[i];
                if (osd == CRUSH_ITEM_NONE)
                        continue;
diff --git a/net/core/filter.c b/net/core/filter.c
index cd58614660cf..9d79ca0a6e8e 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -122,6 +122,13 @@ noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
        return 0;
 }
+/* Register mappings for user programs. */
+#define A_REG           0
+#define X_REG           7
+#define TMP_REG         8
+#define ARG2_REG        2
+#define ARG3_REG        3
 /**
 *      __sk_run_filter - run a filter on a given context
 *      @ctx: buffer to run the filter on
@@ -242,6 +249,8 @@ unsigned int __sk_run_filter(void *ctx, const struct sock_filter_int *insn)
        regs[FP_REG]  = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)];
        regs[ARG1_REG] = (u64) (unsigned long) ctx;
+        regs[A_REG] = 0;
+        regs[X_REG] = 0;
 select_insn:
        goto *jumptable[insn->code];
@@ -643,13 +652,6 @@ static u64 __get_raw_cpu_id(u64 ctx, u64 A, u64 X, u64 r4, u64 r5)
        return raw_smp_processor_id();
 }
-/* Register mappings for user programs. */
-#define A_REG           0
-#define X_REG           7
-#define TMP_REG         8
-#define ARG2_REG        2
-#define ARG3_REG        3
 static bool convert_bpf_extensions(struct sock_filter *fp,
                                   struct sock_filter_int **insnp)
 {
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d4ff41739b0f..9837bebf93ce 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -774,7 +774,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
                return 0;
 }
-static size_t rtnl_port_size(const struct net_device *dev)
+static size_t rtnl_port_size(const struct net_device *dev,
+                             u32 ext_filter_mask)
 {
        size_t port_size = nla_total_size(4)            /* PORT_VF */
                + nla_total_size(PORT_PROFILE_MAX)      /* PORT_PROFILE */
@@ -790,7 +791,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
        size_t port_self_size = nla_total_size(sizeof(struct nlattr))
                + port_size;
-        if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+        if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+            !(ext_filter_mask & RTEXT_FILTER_VF))
                return 0;
        if (dev_num_vf(dev->dev.parent))
                return port_self_size + vf_ports_size +
@@ -826,7 +828,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
               + nla_total_size(ext_filter_mask
                                & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
               + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
-               + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+               + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
               + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
               + rtnl_link_get_af_size(dev) /* IFLA_AF_SPEC */
               + nla_total_size(MAX_PHYS_PORT_ID_LEN); /* IFLA_PHYS_PORT_ID */
@@ -888,11 +890,13 @@ static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev)
        return 0;
 }
-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
+static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
+                          u32 ext_filter_mask)
 {
        int err;
-        if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+        if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+            !(ext_filter_mask & RTEXT_FILTER_VF))
                return 0;
        err = rtnl_port_self_fill(skb, dev);
@@ -1079,7 +1083,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                nla_nest_end(skb, vfinfo);
        }
-        if (rtnl_port_fill(skb, dev))
+        if (rtnl_port_fill(skb, dev, ext_filter_mask))
                goto nla_put_failure;
        if (dev->rtnl_link_ops || rtnl_have_link_slave_info(dev)) {
@@ -1198,6 +1202,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
        struct hlist_head *head;
        struct nlattr *tb[IFLA_MAX+1];
        u32 ext_filter_mask = 0;
+        int err;
        s_h = cb->args[0];
        s_idx = cb->args[1];
@@ -1218,11 +1223,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                        if (idx < s_idx)
                                goto cont;
-                        if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+                        err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
-                                             NETLINK_CB(cb->skb).portid,
+                                               NETLINK_CB(cb->skb).portid,
-                                             cb->nlh->nlmsg_seq, 0,
+                                               cb->nlh->nlmsg_seq, 0,
-                                             NLM_F_MULTI,
+                                               NLM_F_MULTI,
-                                             ext_filter_mask) <= 0)
+                                               ext_filter_mask);
+                        /* If we ran out of room on the first message,
+                         * we're in trouble
+                         */
+                        WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
+                        if (err <= 0)
                                goto out;
                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@ -1395,7 +1406,8 @@ static int do_set_master(struct net_device *dev, int ifindex)
        return 0;
 }
-static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
+static int do_setlink(const struct sk_buff *skb,
+                      struct net_device *dev, struct ifinfomsg *ifm,
                      struct nlattr **tb, char *ifname, int modified)
 {
        const struct net_device_ops *ops = dev->netdev_ops;
@@ -1407,7 +1419,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                        err = PTR_ERR(net);
                        goto errout;
                }
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
+                if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
                        err = -EPERM;
                        goto errout;
                }
@@ -1661,7 +1673,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
        if (err < 0)
                goto errout;
-        err = do_setlink(dev, ifm, tb, ifname, 0);
+        err = do_setlink(skb, dev, ifm, tb, ifname, 0);
 errout:
        return err;
 }
@@ -1778,7 +1790,8 @@ err:
 }
 EXPORT_SYMBOL(rtnl_create_link);
-static int rtnl_group_changelink(struct net *net, int group,
+static int rtnl_group_changelink(const struct sk_buff *skb,
+                struct net *net, int group,
                struct ifinfomsg *ifm,
                struct nlattr **tb)
 {
@@ -1787,7 +1800,7 @@ static int rtnl_group_changelink(struct net *net, int group,
        for_each_netdev(net, dev) {
                if (dev->group == group) {
-                        err = do_setlink(dev, ifm, tb, NULL, 0);
+                        err = do_setlink(skb, dev, ifm, tb, NULL, 0);
                        if (err < 0)
                                return err;
                }
@@ -1929,12 +1942,12 @@ replay:
                                modified = 1;
                        }
-                        return do_setlink(dev, ifm, tb, ifname, modified);
+                        return do_setlink(skb, dev, ifm, tb, ifname, modified);
                }
                if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
                        if (ifm->ifi_index == 0 && tb[IFLA_GROUP])
-                                return rtnl_group_changelink(net,
+                                return rtnl_group_changelink(skb, net,
                                                nla_get_u32(tb[IFLA_GROUP]),
                                                ifm, tb);
                        return -ENODEV;
@@ -2321,7 +2334,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh)
        int err = -EINVAL;
        __u8 *addr;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
@@ -2773,7 +2786,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        sz_idx = type>>2;
        kind = type&3;
-        if (kind != 2 && !ns_capable(net->user_ns, CAP_NET_ADMIN))
+        if (kind != 2 && !netlink_net_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) {
diff --git a/net/core/sock.c b/net/core/sock.c
index b4fff008136f..664ee4295b6f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -145,6 +145,55 @@
 static DEFINE_MUTEX(proto_list_mutex);
 static LIST_HEAD(proto_list);
+/**
+ * sk_ns_capable - General socket capability test
+ * @sk: Socket to use a capability on or through
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket had when the socket was
+ * created and the current process has the capability @cap in the user
+ * namespace @user_ns.
+ */
+bool sk_ns_capable(const struct sock *sk,
+                   struct user_namespace *user_ns, int cap)
+{
+        return file_ns_capable(sk->sk_socket->file, user_ns, cap) &&
+                ns_capable(user_ns, cap);
+}
+EXPORT_SYMBOL(sk_ns_capable);
+/**
+ * sk_capable - Socket global capability test
+ * @sk: Socket to use a capability on or through
+ * @cap: The global capbility to use
+ *
+ * Test to see if the opener of the socket had when the socket was
+ * created and the current process has the capability @cap in all user
+ * namespaces.
+ */
+bool sk_capable(const struct sock *sk, int cap)
+{
+        return sk_ns_capable(sk, &init_user_ns, cap);
+}
+EXPORT_SYMBOL(sk_capable);
+/**
+ * sk_net_capable - Network namespace socket capability test
+ * @sk: Socket to use a capability on or through
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket had when the socke was created
+ * and the current process has the capability @cap over the network namespace
+ * the socket is a member of.
+ */
+bool sk_net_capable(const struct sock *sk, int cap)
+{
+        return sk_ns_capable(sk, sock_net(sk)->user_ns, cap);
+}
+EXPORT_SYMBOL(sk_net_capable);
 #ifdef CONFIG_MEMCG_KMEM
 int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index d7af18859322..a4216a4c9572 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype)
 }
 EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);
-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
+int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,
                             struct sk_buff *skb, int attrtype)
 {
        struct sock_fprog_kern *fprog;
@@ -58,7 +58,7 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
        unsigned int flen;
        int err = 0;
-        if (!ns_capable(user_ns, CAP_NET_ADMIN)) {
+        if (!may_report_filterinfo) {
                nla_reserve(skb, attrtype, 0);
                return 0;
        }
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 553644402670..f8b98d89c285 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1669,7 +1669,7 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct nlmsghdr *reply_nlh = NULL;
        const struct reply_func *fn;
-        if ((nlh->nlmsg_type == RTM_SETDCB) && !capable(CAP_NET_ADMIN))
+        if ((nlh->nlmsg_type == RTM_SETDCB) && !netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        ret = nlmsg_parse(nlh, sizeof(*dcb), tb, DCB_ATTR_MAX,
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index a603823a3e27..3b726f31c64c 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -574,7 +574,7 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct dn_ifaddr __rcu **ifap;
        int err = -EINVAL;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if (!net_eq(net, &init_net))
@@ -618,7 +618,7 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct dn_ifaddr *ifa;
        int err;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if (!net_eq(net, &init_net))
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 57dc159245ec..d332aefb0846 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -505,7 +505,7 @@ static int dn_fib_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct nlattr *attrs[RTA_MAX+1];
        int err;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if (!net_eq(net, &init_net))
@@ -530,7 +530,7 @@ static int dn_fib_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct nlattr *attrs[RTA_MAX+1];
        int err;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if (!net_eq(net, &init_net))
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index e83015cecfa7..e4d9560a910b 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
        if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
                return;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                RCV_SKB_FAIL(-EPERM);
        /* Eventually we might send routing messages too */
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index fa5b7519765f..b3f859731c60 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -442,6 +442,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
                tunnel->i_seqno = ntohl(tpi->seq) + 1;
        }
+        skb_reset_network_header(skb);
        err = IP_ECN_decapsulate(iph, skb);
        if (unlikely(err)) {
                if (log_ecn_error)
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 8bf224516ba2..b4f1b29b08bd 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -409,7 +409,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
                ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
                ratio += cnt;
-                ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT);
+                ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
        }
        /* Some calls are for duplicates without timetamps */
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 025e25093984..12d6016bdd9a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2441,8 +2441,14 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
        }
-        if (likely(!err))
+        if (likely(!err)) {
                TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
+                /* Update global TCP statistics. */
+                TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
+                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
+                tp->total_retrans++;
+        }
        return err;
 }
@@ -2452,12 +2458,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
        int err = __tcp_retransmit_skb(sk, skb);
        if (err == 0) {
-                /* Update global TCP statistics. */
-                TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
-                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
-                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
-                tp->total_retrans++;
 #if FASTRETRANS_DEBUG > 0
                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) {
                        net_dbg_ratelimited("retrans_out leaked\n");
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 34e0ded5c14b..87891f5f57b5 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1459,7 +1459,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                                if (w->skip) {
                                        w->skip--;
-                                        continue;
+                                        goto skip;
                                }
                                err = w->func(w);
@@ -1469,6 +1469,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                                w->count++;
                                continue;
                        }
+skip:
                        w->state = FWS_U;
                case FWS_U:
                        if (fn == w->root)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 8659067da28e..8250474ab7dc 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1633,7 +1633,7 @@ struct sock *mroute6_socket(struct net *net, struct sk_buff *skb)
 {
        struct mr6_table *mrt;
        struct flowi6 fl6 = {
-                .flowi6_iif     = skb->skb_iif,
+                .flowi6_iif     = skb->skb_iif ? : LOOPBACK_IFINDEX,
                .flowi6_oif     = skb->dev->ifindex,
                .flowi6_mark    = skb->mark,
        };
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index e0983f3648a6..790e0c6b19e1 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -33,6 +33,7 @@ static bool rpfilter_lookup_reverse6(const struct sk_buff *skb,
        struct ipv6hdr *iph = ipv6_hdr(skb);
        bool ret = false;
        struct flowi6 fl6 = {
+                .flowi6_iif = LOOPBACK_IFINDEX,
                .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK,
                .flowi6_proto = iph->nexthdr,
                .daddr = iph->saddr,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4011617cca68..004fffb6c221 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1273,6 +1273,7 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
        struct flowi6 fl6;
        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_iif = LOOPBACK_IFINDEX;
        fl6.flowi6_oif = oif;
        fl6.flowi6_mark = mark;
        fl6.daddr = iph->daddr;
@@ -1294,6 +1295,7 @@ void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
        struct flowi6 fl6;
        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_iif = LOOPBACK_IFINDEX;
        fl6.flowi6_oif = oif;
        fl6.flowi6_mark = mark;
        fl6.daddr = msg->dest;
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index e8138da4c14f..e009087620e3 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -368,14 +368,13 @@ done:
 static void nfnetlink_rcv(struct sk_buff *skb)
 {
        struct nlmsghdr *nlh = nlmsg_hdr(skb);
-        struct net *net = sock_net(skb->sk);
        int msglen;
        if (nlh->nlmsg_len < NLMSG_HDRLEN ||
            skb->len < nlh->nlmsg_len)
                return;
-        if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
+        if (!netlink_net_capable(skb, CAP_NET_ADMIN)) {
                netlink_ack(skb, nlh, -EPERM);
                return;
        }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 894cda0206bb..81dca96d2be6 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1360,7 +1360,72 @@ retry:
        return err;
 }
-static inline int netlink_capable(const struct socket *sock, unsigned int flag)
+/**
+ * __netlink_ns_capable - General netlink message capability test
+ * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in the user namespace @user_ns.
+ */
+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
+                        struct user_namespace *user_ns, int cap)
+{
+        return sk_ns_capable(nsp->sk, user_ns, cap);
+}
+EXPORT_SYMBOL(__netlink_ns_capable);
+/**
+ * netlink_ns_capable - General netlink message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in the user namespace @user_ns.
+ */
+bool netlink_ns_capable(const struct sk_buff *skb,
+                        struct user_namespace *user_ns, int cap)
+{
+        return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_ns_capable);
+/**
+ * netlink_capable - Netlink global message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in all user namespaces.
+ */
+bool netlink_capable(const struct sk_buff *skb, int cap)
+{
+        return netlink_ns_capable(skb, &init_user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_capable);
+/**
+ * netlink_net_capable - Netlink network namespace message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap over the network namespace of
+ * the socket we received the message from.
+ */
+bool netlink_net_capable(const struct sk_buff *skb, int cap)
+{
+        return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_net_capable);
+static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
 {
        return (nl_table[sock->sk->sk_protocol].flags & flag) ||
                ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
@@ -1428,7 +1493,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
        /* Only superuser is allowed to listen multicasts */
        if (nladdr->nl_groups) {
-                if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV))
+                if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
                        return -EPERM;
                err = netlink_realloc_groups(sk);
                if (err)
@@ -1490,7 +1555,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
                return -EINVAL;
        if ((nladdr->nl_groups || nladdr->nl_pid) &&
-            !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
+            !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                return -EPERM;
        if (!nlk->portid)
@@ -2096,7 +2161,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                break;
        case NETLINK_ADD_MEMBERSHIP:
        case NETLINK_DROP_MEMBERSHIP: {
-                if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV))
+                if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
                        return -EPERM;
                err = netlink_realloc_groups(sk);
                if (err)
@@ -2247,7 +2312,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
                dst_group = ffs(addr->nl_groups);
                err =  -EPERM;
                if ((dst_group || dst_portid) &&
-                    !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
+                    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                        goto out;
        } else {
                dst_portid = nlk->dst_portid;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index b1dcdb932a86..a3ba3ca0ff92 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -561,7 +561,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
                return -EOPNOTSUPP;
        if ((ops->flags & GENL_ADMIN_PERM) &&
-            !capable(CAP_NET_ADMIN))
+            !netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
diff --git a/net/packet/diag.c b/net/packet/diag.c
index 533ce4ff108a..92f2c7107eec 100644
--- a/net/packet/diag.c
+++ b/net/packet/diag.c
@@ -128,6 +128,7 @@ static int pdiag_put_fanout(struct packet_sock *po, struct sk_buff *nlskb)
 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
                        struct packet_diag_req *req,
+                        bool may_report_filterinfo,
                        struct user_namespace *user_ns,
                        u32 portid, u32 seq, u32 flags, int sk_ino)
 {
@@ -172,7 +173,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
                goto out_nlmsg_trim;
        if ((req->pdiag_show & PACKET_SHOW_FILTER) &&
-            sock_diag_put_filterinfo(user_ns, sk, skb, PACKET_DIAG_FILTER))
+            sock_diag_put_filterinfo(may_report_filterinfo, sk, skb,
+                                     PACKET_DIAG_FILTER))
                goto out_nlmsg_trim;
        return nlmsg_end(skb, nlh);
@@ -188,9 +190,11 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
        struct packet_diag_req *req;
        struct net *net;
        struct sock *sk;
+        bool may_report_filterinfo;
        net = sock_net(skb->sk);
        req = nlmsg_data(cb->nlh);
+        may_report_filterinfo = netlink_net_capable(cb->skb, CAP_NET_ADMIN);
        mutex_lock(&net->packet.sklist_lock);
        sk_for_each(sk, &net->packet.sklist) {
@@ -200,6 +204,7 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                        goto next;
                if (sk_diag_fill(sk, skb, req,
+                                 may_report_filterinfo,
                                 sk_user_ns(NETLINK_CB(cb->skb).sk),
                                 NETLINK_CB(cb->skb).portid,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index dc15f4300808..b64151ade6b3 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -70,10 +70,10 @@ static int addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh)
        int err;
        u8 pnaddr;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
-        if (!capable(CAP_SYS_ADMIN))
+        if (!netlink_capable(skb, CAP_SYS_ADMIN))
                return -EPERM;
        ASSERT_RTNL();
@@ -233,10 +233,10 @@ static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh)
        int err;
        u8 dst;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
-        if (!capable(CAP_SYS_ADMIN))
+        if (!netlink_capable(skb, CAP_SYS_ADMIN))
                return -EPERM;
        ASSERT_RTNL();
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 8a5ba5add4bc..648778aef1a2 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -948,7 +948,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n)
        u32 portid = skb ? NETLINK_CB(skb).portid : 0;
        int ret = 0, ovr = 0;
-        if ((n->nlmsg_type != RTM_GETACTION) && !capable(CAP_NET_ADMIN))
+        if ((n->nlmsg_type != RTM_GETACTION) && !netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        ret = nlmsg_parse(n, sizeof(struct tcamsg), tca, TCA_ACT_MAX, NULL);
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 29a30a14c315..bdbdb1a7920a 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -134,7 +134,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
        int err;
        int tp_created = 0;
-        if ((n->nlmsg_type != RTM_GETTFILTER) && !capable(CAP_NET_ADMIN))
+        if ((n->nlmsg_type != RTM_GETTFILTER) && !netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
 replay:
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index a0b84e0e22de..400769014bbd 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1084,7 +1084,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n)
        struct Qdisc *p = NULL;
        int err;
-        if ((n->nlmsg_type != RTM_GETQDISC) && !capable(CAP_NET_ADMIN))
+        if ((n->nlmsg_type != RTM_GETQDISC) && !netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL);
@@ -1151,7 +1151,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n)
        struct Qdisc *q, *p;
        int err;
-        if (!capable(CAP_NET_ADMIN))
+        if (!netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
 replay:
@@ -1490,7 +1490,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n)
        u32 qid;
        int err;
-        if ((n->nlmsg_type != RTM_GETTCLASS) && !capable(CAP_NET_ADMIN))
+        if ((n->nlmsg_type != RTM_GETTCLASS) && !netlink_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL);
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index edee03d922e2..6e957c3b9854 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -553,11 +553,6 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt)
        if (err < 0)
                return err;
-        sch_tree_lock(sch);
-        if (tb[TCA_HHF_BACKLOG_LIMIT])
-                sch->limit = nla_get_u32(tb[TCA_HHF_BACKLOG_LIMIT]);
        if (tb[TCA_HHF_QUANTUM])
                new_quantum = nla_get_u32(tb[TCA_HHF_QUANTUM]);
@@ -567,6 +562,12 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt)
        non_hh_quantum = (u64)new_quantum * new_hhf_non_hh_weight;
        if (non_hh_quantum > INT_MAX)
                return -EINVAL;
+        sch_tree_lock(sch);
+        if (tb[TCA_HHF_BACKLOG_LIMIT])
+                sch->limit = nla_get_u32(tb[TCA_HHF_BACKLOG_LIMIT]);
        q->quantum = new_quantum;
        q->hhf_non_hh_weight = new_hhf_non_hh_weight;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index c09757fbf803..44cbb54c8574 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -491,8 +491,13 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                        continue;
                if ((laddr->state == SCTP_ADDR_SRC) &&
                    (AF_INET == laddr->a.sa.sa_family)) {
-                        fl4->saddr = laddr->a.v4.sin_addr.s_addr;
                        fl4->fl4_sport = laddr->a.v4.sin_port;
+                        flowi4_update_output(fl4,
+                                             asoc->base.sk->sk_bound_dev_if,
+                                             RT_CONN_FLAGS(asoc->base.sk),
+                                             daddr->v4.sin_addr.s_addr,
+                                             laddr->a.v4.sin_addr.s_addr);
                        rt = ip_route_output_key(sock_net(sk), fl4);
                        if (!IS_ERR(rt)) {
                                dst = &rt->dst;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 5d6883ff00c3..fef2acdf4a2e 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -496,11 +496,10 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands,
        /* If the transport error count is greater than the pf_retrans
         * threshold, and less than pathmaxrtx, and if the current state
-         * is not SCTP_UNCONFIRMED, then mark this transport as Partially
+         * is SCTP_ACTIVE, then mark this transport as Partially Failed,
-         * Failed, see SCTP Quick Failover Draft, section 5.1
+         * see SCTP Quick Failover Draft, section 5.1
         */
-        if ((transport->state != SCTP_PF) &&
+        if ((transport->state == SCTP_ACTIVE) &&
-           (transport->state != SCTP_UNCONFIRMED) &&
           (asoc->pf_retrans < transport->pathmaxrxt) &&
           (transport->error_count > asoc->pf_retrans)) {
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 3aaf73de9e2d..ad844d365340 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -47,7 +47,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
        int hdr_space = nlmsg_total_size(GENL_HDRLEN + TIPC_GENL_HDRLEN);
        u16 cmd;
-        if ((req_userhdr->cmd & 0xC000) && (!capable(CAP_NET_ADMIN)))
+        if ((req_userhdr->cmd & 0xC000) && (!netlink_capable(skb, CAP_NET_ADMIN)))
                cmd = TIPC_CMD_NOT_NET_ADMIN;
        else
                cmd = req_userhdr->cmd;
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 5adfd94c5b85..85d232bed87d 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1925,9 +1925,23 @@ static struct miscdevice vsock_device = {
        .fops           = &vsock_device_ops,
 };
-static int __vsock_core_init(void)
+int __vsock_core_init(const struct vsock_transport *t, struct module *owner)
 {
-        int err;
+        int err = mutex_lock_interruptible(&vsock_register_mutex);
+        if (err)
+                return err;
+        if (transport) {
+                err = -EBUSY;
+                goto err_busy;
+        }
+        /* Transport must be the owner of the protocol so that it can't
+         * unload while there are open sockets.
+         */
+        vsock_proto.owner = owner;
+        transport = t;
        vsock_init_tables();
@@ -1951,36 +1965,19 @@ static int __vsock_core_init(void)
                goto err_unregister_proto;
        }
+        mutex_unlock(&vsock_register_mutex);
        return 0;
 err_unregister_proto:
        proto_unregister(&vsock_proto);
 err_misc_deregister:
        misc_deregister(&vsock_device);
-        return err;
+        transport = NULL;
-}
+err_busy:
-int vsock_core_init(const struct vsock_transport *t)
-{
-        int retval = mutex_lock_interruptible(&vsock_register_mutex);
-        if (retval)
-                return retval;
-        if (transport) {
-                retval = -EBUSY;
-                goto out;
-        }
-        transport = t;
-        retval = __vsock_core_init();
-        if (retval)
-                transport = NULL;
-out:
        mutex_unlock(&vsock_register_mutex);
-        return retval;
+        return err;
 }
-EXPORT_SYMBOL_GPL(vsock_core_init);
+EXPORT_SYMBOL_GPL(__vsock_core_init);
 void vsock_core_exit(void)
 {
@@ -2000,5 +1997,5 @@ EXPORT_SYMBOL_GPL(vsock_core_exit);
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Socket Family");
-MODULE_VERSION("1.0.0.0-k");
+MODULE_VERSION("1.0.1.0-k");
 MODULE_LICENSE("GPL v2");
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 8f131c10a6f3..51398ae6cda8 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2377,7 +2377,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        link = &xfrm_dispatch[type];
        /* All operations require privileges, even GET */
-        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+        if (!netlink_net_capable(skb, CAP_NET_ADMIN))
                return -EPERM;
        if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
diff --git a/scripts/checksyscalls.sh b/scripts/checksyscalls.sh
index fd8fa9aa7c4e..5b3add31f9f1 100755
--- a/scripts/checksyscalls.sh
+++ b/scripts/checksyscalls.sh
@@ -25,7 +25,7 @@ cat << EOF
 #define __IGNORE_rmdir          /* unlinkat */
 #define __IGNORE_lchown         /* fchownat */
 #define __IGNORE_access         /* faccessat */
-#define __IGNORE_rename         /* renameat */
+#define __IGNORE_rename         /* renameat2 */
 #define __IGNORE_readlink       /* readlinkat */
 #define __IGNORE_symlink        /* symlinkat */
 #define __IGNORE_utimes         /* futimesat */
@@ -37,6 +37,9 @@ cat << EOF
 #define __IGNORE_lstat64        /* fstatat64 */
 #endif
+/* Missing flags argument */
+#define __IGNORE_renameat       /* renameat2 */
 /* CLOEXEC flag */
 #define __IGNORE_pipe           /* pipe2 */
 #define __IGNORE_dup2           /* dup3 */
diff --git a/scripts/sortextable.c b/scripts/sortextable.c
index cc49062acdee..1052d4834a44 100644
--- a/scripts/sortextable.c
+++ b/scripts/sortextable.c
@@ -35,6 +35,10 @@
 #define EM_ARCOMPACT    93
 #endif
+#ifndef EM_XTENSA
+#define EM_XTENSA       94
+#endif
 #ifndef EM_AARCH64
 #define EM_AARCH64      183
 #endif
@@ -281,6 +285,7 @@ do_file(char const *const fname)
        case EM_AARCH64:
        case EM_MICROBLAZE:
        case EM_MIPS:
+        case EM_XTENSA:
                break;
        }  /* end switch */
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
index 8fb1488a3cd4..97130f88838b 100644
--- a/security/apparmor/include/apparmor.h
+++ b/security/apparmor/include/apparmor.h
@@ -66,7 +66,6 @@ extern int apparmor_initialized __initdata;
 char *aa_split_fqname(char *args, char **ns_name);
 void aa_info_message(const char *str);
 void *__aa_kvmalloc(size_t size, gfp_t flags);
-void kvfree(void *buffer);
 static inline void *kvmalloc(size_t size)
 {
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 69689922c491..c1827e068454 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -104,17 +104,3 @@ void *__aa_kvmalloc(size_t size, gfp_t flags)
        }
        return buffer;
 }
-/**
- * kvfree - free an allocation do by kvmalloc
- * @buffer: buffer to free (MAYBE_NULL)
- *
- * Free a buffer allocated by kvmalloc
- */
-void kvfree(void *buffer)
-{
-        if (is_vmalloc_addr(buffer))
-                vfree(buffer);
-        else
-                kfree(buffer);
-}
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 8365909f5f8c..9134dbf70d3e 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -306,57 +306,138 @@ static int devcgroup_seq_show(struct seq_file *m, void *v)
 }
 /**
- * may_access - verifies if a new exception is part of what is allowed
+ * match_exception      - iterates the exception list trying to find a complete match
- *              by a dev cgroup based on the default policy +
+ * @exceptions: list of exceptions
- *              exceptions. This is used to make sure a child cgroup
+ * @type: device type (DEV_BLOCK or DEV_CHAR)
- *              won't have more privileges than its parent or to
+ * @major: device file major number, ~0 to match all
- *              verify if a certain access is allowed.
+ * @minor: device file minor number, ~0 to match all
- * @dev_cgroup: dev cgroup to be tested against
+ * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
- * @refex: new exception
+ *
- * @behavior: behavior of the exception
+ * It is considered a complete match if an exception is found that will
+ * contain the entire range of provided parameters.
+ *
+ * Return: true in case it matches an exception completely
 */
-static bool may_access(struct dev_cgroup *dev_cgroup,
+static bool match_exception(struct list_head *exceptions, short type,
-                       struct dev_exception_item *refex,
+                            u32 major, u32 minor, short access)
-                       enum devcg_behavior behavior)
 {
        struct dev_exception_item *ex;
-        bool match = false;
-        rcu_lockdep_assert(rcu_read_lock_held() ||
+        list_for_each_entry_rcu(ex, exceptions, list) {
-                           lockdep_is_held(&devcgroup_mutex),
+                if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
-                           "device_cgroup::may_access() called without proper synchronization");
+                        continue;
+                if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
+                        continue;
+                if (ex->major != ~0 && ex->major != major)
+                        continue;
+                if (ex->minor != ~0 && ex->minor != minor)
+                        continue;
+                /* provided access cannot have more than the exception rule */
+                if (access & (~ex->access))
+                        continue;
+                return true;
+        }
+        return false;
+}
+/**
+ * match_exception_partial - iterates the exception list trying to find a partial match
+ * @exceptions: list of exceptions
+ * @type: device type (DEV_BLOCK or DEV_CHAR)
+ * @major: device file major number, ~0 to match all
+ * @minor: device file minor number, ~0 to match all
+ * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
+ *
+ * It is considered a partial match if an exception's range is found to
+ * contain *any* of the devices specified by provided parameters. This is
+ * used to make sure no extra access is being granted that is forbidden by
+ * any of the exception list.
+ *
+ * Return: true in case the provided range mat matches an exception completely
+ */
+static bool match_exception_partial(struct list_head *exceptions, short type,
+                                    u32 major, u32 minor, short access)
+{
+        struct dev_exception_item *ex;
-        list_for_each_entry_rcu(ex, &dev_cgroup->exceptions, list) {
+        list_for_each_entry_rcu(ex, exceptions, list) {
-                if ((refex->type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
+                if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
                        continue;
-                if ((refex->type & DEV_CHAR) && !(ex->type & DEV_CHAR))
+                if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
                        continue;
-                if (ex->major != ~0 && ex->major != refex->major)
+                /*
+                 * We must be sure that both the exception and the provided
+                 * range aren't masking all devices
+                 */
+                if (ex->major != ~0 && major != ~0 && ex->major != major)
                        continue;
-                if (ex->minor != ~0 && ex->minor != refex->minor)
+                if (ex->minor != ~0 && minor != ~0 && ex->minor != minor)
                        continue;
-                if (refex->access & (~ex->access))
+                /*
+                 * In order to make sure the provided range isn't matching
+                 * an exception, all its access bits shouldn't match the
+                 * exception's access bits
+                 */
+                if (!(access & ex->access))
                        continue;
-                match = true;
+                return true;
-                break;
        }
+        return false;
+}
+/**
+ * verify_new_ex - verifies if a new exception is allowed by parent cgroup's permissions
+ * @dev_cgroup: dev cgroup to be tested against
+ * @refex: new exception
+ * @behavior: behavior of the exception's dev_cgroup
+ *
+ * This is used to make sure a child cgroup won't have more privileges
+ * than its parent
+ */
+static bool verify_new_ex(struct dev_cgroup *dev_cgroup,
+                          struct dev_exception_item *refex,
+                          enum devcg_behavior behavior)
+{
+        bool match = false;
+        rcu_lockdep_assert(rcu_read_lock_held() ||
+                           lockdep_is_held(&devcgroup_mutex),
+                           "device_cgroup:verify_new_ex called without proper synchronization");
        if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW) {
                if (behavior == DEVCG_DEFAULT_ALLOW) {
-                        /* the exception will deny access to certain devices */
+                        /*
+                         * new exception in the child doesn't matter, only
+                         * adding extra restrictions
+                         */ 
                        return true;
                } else {
-                        /* the exception will allow access to certain devices */
+                        /*
+                         * new exception in the child will add more devices
+                         * that can be acessed, so it can't match any of
+                         * parent's exceptions, even slightly
+                         */ 
+                        match = match_exception_partial(&dev_cgroup->exceptions,
+                                                        refex->type,
+                                                        refex->major,
+                                                        refex->minor,
+                                                        refex->access);
                        if (match)
-                                /*
-                                 * a new exception allowing access shouldn't
-                                 * match an parent's exception
-                                 */
                                return false;
                        return true;
                }
        } else {
-                /* only behavior == DEVCG_DEFAULT_DENY allowed here */
+                /*
+                 * Only behavior == DEVCG_DEFAULT_DENY allowed here, therefore
+                 * the new exception will add access to more devices and must
+                 * be contained completely in an parent's exception to be
+                 * allowed
+                 */
+                match = match_exception(&dev_cgroup->exceptions, refex->type,
+                                        refex->major, refex->minor,
+                                        refex->access);
                if (match)
                        /* parent has an exception that matches the proposed */
                        return true;
@@ -378,7 +459,38 @@ static int parent_has_perm(struct dev_cgroup *childcg,
        if (!parent)
                return 1;
-        return may_access(parent, ex, childcg->behavior);
+        return verify_new_ex(parent, ex, childcg->behavior);
+}
+/**
+ * parent_allows_removal - verify if it's ok to remove an exception
+ * @childcg: child cgroup from where the exception will be removed
+ * @ex: exception being removed
+ *
+ * When removing an exception in cgroups with default ALLOW policy, it must
+ * be checked if removing it will give the child cgroup more access than the
+ * parent.
+ *
+ * Return: true if it's ok to remove exception, false otherwise
+ */
+static bool parent_allows_removal(struct dev_cgroup *childcg,
+                                  struct dev_exception_item *ex)
+{
+        struct dev_cgroup *parent = css_to_devcgroup(css_parent(&childcg->css));
+        if (!parent)
+                return true;
+        /* It's always allowed to remove access to devices */
+        if (childcg->behavior == DEVCG_DEFAULT_DENY)
+                return true;
+        /*
+         * Make sure you're not removing part or a whole exception existing in
+         * the parent cgroup
+         */
+        return !match_exception_partial(&parent->exceptions, ex->type,
+                                        ex->major, ex->minor, ex->access);
 }
 /**
@@ -616,17 +728,21 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
        switch (filetype) {
        case DEVCG_ALLOW:
-                if (!parent_has_perm(devcgroup, &ex))
-                        return -EPERM;
                /*
                 * If the default policy is to allow by default, try to remove
                 * an matching exception instead. And be silent about it: we
                 * don't want to break compatibility
                 */
                if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
+                        /* Check if the parent allows removing it first */
+                        if (!parent_allows_removal(devcgroup, &ex))
+                                return -EPERM;
                        dev_exception_rm(devcgroup, &ex);
-                        return 0;
+                        break;
                }
+                if (!parent_has_perm(devcgroup, &ex))
+                        return -EPERM;
                rc = dev_exception_add(devcgroup, &ex);
                break;
        case DEVCG_DENY:
@@ -704,18 +820,18 @@ static int __devcgroup_check_permission(short type, u32 major, u32 minor,
                                        short access)
 {
        struct dev_cgroup *dev_cgroup;
-        struct dev_exception_item ex;
+        bool rc;
-        int rc;
-        memset(&ex, 0, sizeof(ex));
-        ex.type = type;
-        ex.major = major;
-        ex.minor = minor;
-        ex.access = access;
        rcu_read_lock();
        dev_cgroup = task_devcgroup(current);
-        rc = may_access(dev_cgroup, &ex, dev_cgroup->behavior);
+        if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW)
+                /* Can't match any of the exceptions, even partially */
+                rc = !match_exception_partial(&dev_cgroup->exceptions,
+                                              type, major, minor, access);
+        else
+                /* Need to match completely one exception to be allowed */
+                rc = match_exception(&dev_cgroup->exceptions, type, major,
+                                     minor, access);
        rcu_read_unlock();
        if (!rc)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b4beb77967b1..2c7341dbc5d6 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3317,9 +3317,9 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
        case F_GETLK:
        case F_SETLK:
        case F_SETLKW:
-        case F_GETLKP:
+        case F_OFD_GETLK:
-        case F_SETLKP:
+        case F_OFD_SETLK:
-        case F_SETLKPW:
+        case F_OFD_SETLKW:
 #if BITS_PER_LONG == 32
        case F_GETLK64:
        case F_SETLK64:
diff --git a/sound/isa/sb/sb_mixer.c b/sound/isa/sb/sb_mixer.c
index 6496822c1808..1ff78ec9f0ac 100644
--- a/sound/isa/sb/sb_mixer.c
+++ b/sound/isa/sb/sb_mixer.c
@@ -818,12 +818,14 @@ int snd_sbmixer_new(struct snd_sb *chip)
                        return err;
                break;
        case SB_HW_DT019X:
-                if ((err = snd_sbmixer_init(chip,
+                err = snd_sbmixer_init(chip,
-                                            snd_dt019x_controls,
+                                       snd_dt019x_controls,
-                                            ARRAY_SIZE(snd_dt019x_controls),
+                                       ARRAY_SIZE(snd_dt019x_controls),
-                                            snd_dt019x_init_values,
+                                       snd_dt019x_init_values,
-                                            ARRAY_SIZE(snd_dt019x_init_values),
+                                       ARRAY_SIZE(snd_dt019x_init_values),
-                                            "DT019X")) < 0)
+                                       "DT019X");
+                if (err < 0)
+                        return err;
                break;
        default:
                strcpy(card->mixername, "???");
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index 248b90abb882..480bbddbd801 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -1059,24 +1059,26 @@ static void azx_init_cmd_io(struct azx *chip)
        /* reset the corb hw read pointer */
        azx_writew(chip, CORBRP, ICH6_CORBRP_RST);
-        for (timeout = 1000; timeout > 0; timeout--) {
+        if (!(chip->driver_caps & AZX_DCAPS_CORBRP_SELF_CLEAR)) {
-                if ((azx_readw(chip, CORBRP) & ICH6_CORBRP_RST) == ICH6_CORBRP_RST)
+                for (timeout = 1000; timeout > 0; timeout--) {
-                        break;
+                        if ((azx_readw(chip, CORBRP) & ICH6_CORBRP_RST) == ICH6_CORBRP_RST)
-                udelay(1);
+                                break;
-        }
+                        udelay(1);
-        if (timeout <= 0)
+                }
-                dev_err(chip->card->dev, "CORB reset timeout#1, CORBRP = %d\n",
+                if (timeout <= 0)
-                        azx_readw(chip, CORBRP));
+                        dev_err(chip->card->dev, "CORB reset timeout#1, CORBRP = %d\n",
+                                azx_readw(chip, CORBRP));
-        azx_writew(chip, CORBRP, 0);
+                azx_writew(chip, CORBRP, 0);
-        for (timeout = 1000; timeout > 0; timeout--) {
+                for (timeout = 1000; timeout > 0; timeout--) {
-                if (azx_readw(chip, CORBRP) == 0)
+                        if (azx_readw(chip, CORBRP) == 0)
-                        break;
+                                break;
-                udelay(1);
+                        udelay(1);
+                }
+                if (timeout <= 0)
+                        dev_err(chip->card->dev, "CORB reset timeout#2, CORBRP = %d\n",
+                                azx_readw(chip, CORBRP));
        }
-        if (timeout <= 0)
-                dev_err(chip->card->dev, "CORB reset timeout#2, CORBRP = %d\n",
-                        azx_readw(chip, CORBRP));
        /* enable corb dma */
        azx_writeb(chip, CORBCTL, ICH6_CORBCTL_RUN);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index d6bca62ef387..2c54629d62d1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -249,7 +249,8 @@ enum {
 /* quirks for Nvidia */
 #define AZX_DCAPS_PRESET_NVIDIA \
        (AZX_DCAPS_NVIDIA_SNOOP | AZX_DCAPS_RIRB_DELAY | AZX_DCAPS_NO_MSI |\
-         AZX_DCAPS_ALIGN_BUFSIZE | AZX_DCAPS_NO_64BIT)
+         AZX_DCAPS_ALIGN_BUFSIZE | AZX_DCAPS_NO_64BIT |\
+         AZX_DCAPS_CORBRP_SELF_CLEAR)
 #define AZX_DCAPS_PRESET_CTHDA \
        (AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_4K_BDLE_BOUNDARY)
@@ -1366,6 +1367,12 @@ static int azx_first_init(struct azx *chip)
        /* initialize streams */
        azx_init_stream(chip);
+        /* workaround for Broadwell HDMI: the first stream is broken,
+         * so mask it by keeping it as if opened
+         */
+        if (pci->vendor == 0x8086 && pci->device == 0x160c)
+                chip->azx_dev[0].opened = 1;
        /* initialize chip */
        azx_init_pci(chip);
        azx_init_chip(chip, (probe_only[dev] & 2) == 0);
diff --git a/sound/pci/hda/hda_priv.h b/sound/pci/hda/hda_priv.h
index ba38b819f984..4a7cb01fa912 100644
--- a/sound/pci/hda/hda_priv.h
+++ b/sound/pci/hda/hda_priv.h
@@ -189,6 +189,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 #define AZX_DCAPS_COUNT_LPIB_DELAY  (1 << 25)   /* Take LPIB as delay */
 #define AZX_DCAPS_PM_RUNTIME    (1 << 26)       /* runtime PM support */
 #define AZX_DCAPS_I915_POWERWELL (1 << 27)      /* HSW i915 powerwell support */
+#define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)   /* CORBRP clears itself after reset */
 /* position fix mode */
 enum {
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 0cb5b89cd0c8..b4218a19df22 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1127,8 +1127,10 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
                                            AMP_OUT_UNMUTE);
        eld = &per_pin->sink_eld;
-        if (!eld->monitor_present)
+        if (!eld->monitor_present) {
+                hdmi_set_channel_count(codec, per_pin->cvt_nid, channels);
                return;
+        }
        if (!non_pcm && per_pin->chmap_set)
                ca = hdmi_manual_channel_allocation(channels, per_pin->chmap);
@@ -3330,6 +3332,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x10de0051, .name = "GPU 51 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0060, .name = "GPU 60 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0067, .name = "MCP67 HDMI",       .patch = patch_nvhdmi_2ch },
+{ .id = 0x10de0071, .name = "GPU 71 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",       .patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
 { .id = 0x11069f81, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
@@ -3385,6 +3388,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0044");
 MODULE_ALIAS("snd-hda-codec-id:10de0051");
 MODULE_ALIAS("snd-hda-codec-id:10de0060");
 MODULE_ALIAS("snd-hda-codec-id:10de0067");
+MODULE_ALIAS("snd-hda-codec-id:10de0071");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
 MODULE_ALIAS("snd-hda-codec-id:11069f80");
 MODULE_ALIAS("snd-hda-codec-id:11069f81");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c643dfc0a826..49e884fb3e5d 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4616,12 +4616,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x0653, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0657, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0658, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x065c, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x065f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0662, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0667, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0668, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0669, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0674, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x067e, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x067f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0680, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0684, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
diff --git a/sound/soc/codecs/alc5623.c b/sound/soc/codecs/alc5623.c
index f500905e9373..2acf82f4a08a 100644
--- a/sound/soc/codecs/alc5623.c
+++ b/sound/soc/codecs/alc5623.c
@@ -1018,13 +1018,13 @@ static int alc5623_i2c_probe(struct i2c_client *client,
                dev_err(&client->dev, "failed to read vendor ID1: %d\n", ret);
                return ret;
        }
-        vid1 = ((vid1 & 0xff) << 8) | (vid1 >> 8);
        ret = regmap_read(alc5623->regmap, ALC5623_VENDOR_ID2, &vid2);
        if (ret < 0) {
                dev_err(&client->dev, "failed to read vendor ID2: %d\n", ret);
                return ret;
        }
+        vid2 >>= 8;
        if ((vid1 != 0x10ec) || (vid2 != id->driver_data)) {
                dev_err(&client->dev, "unknown or wrong codec\n");
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index 460d35547a68..2213a037c893 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -1229,8 +1229,10 @@ static int cs42l52_i2c_probe(struct i2c_client *i2c_client,
        }
        if (cs42l52->pdata.reset_gpio) {
-                ret = gpio_request_one(cs42l52->pdata.reset_gpio,
+                ret = devm_gpio_request_one(&i2c_client->dev,
-                                       GPIOF_OUT_INIT_HIGH, "CS42L52 /RST");
+                                            cs42l52->pdata.reset_gpio,
+                                            GPIOF_OUT_INIT_HIGH,
+                                            "CS42L52 /RST");
                if (ret < 0) {
                        dev_err(&i2c_client->dev, "Failed to request /RST %d: %d\n",
                                cs42l52->pdata.reset_gpio, ret);
diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c
index 0ee60a19a263..ae3717992d56 100644
--- a/sound/soc/codecs/cs42l73.c
+++ b/sound/soc/codecs/cs42l73.c
@@ -1443,8 +1443,10 @@ static int cs42l73_i2c_probe(struct i2c_client *i2c_client,
        i2c_set_clientdata(i2c_client, cs42l73);
        if (cs42l73->pdata.reset_gpio) {
-                ret = gpio_request_one(cs42l73->pdata.reset_gpio,
+                ret = devm_gpio_request_one(&i2c_client->dev,
-                                       GPIOF_OUT_INIT_HIGH, "CS42L73 /RST");
+                                            cs42l73->pdata.reset_gpio,
+                                            GPIOF_OUT_INIT_HIGH,
+                                            "CS42L73 /RST");
                if (ret < 0) {
                        dev_err(&i2c_client->dev, "Failed to request /RST %d: %d\n",
                                cs42l73->pdata.reset_gpio, ret);
diff --git a/sound/soc/codecs/tlv320aic31xx.c b/sound/soc/codecs/tlv320aic31xx.c
index fa158cfe9b32..d1929de641e2 100644
--- a/sound/soc/codecs/tlv320aic31xx.c
+++ b/sound/soc/codecs/tlv320aic31xx.c
@@ -376,7 +376,7 @@ static int aic31xx_dapm_power_event(struct snd_soc_dapm_widget *w,
                reg = AIC31XX_ADCFLAG;
                break;
        default:
-                dev_err(w->codec->dev, "Unknown widget '%s' calling %s/n",
+                dev_err(w->codec->dev, "Unknown widget '%s' calling %s\n",
                        w->name, __func__);
                return -EINVAL;
        }
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index b1835103e9b4..d7349bc89ad3 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1399,7 +1399,6 @@ static int aic3x_probe(struct snd_soc_codec *codec)
        }
        aic3x_add_widgets(codec);
-        list_add(&aic3x->list, &reset_list);
        return 0;
@@ -1569,7 +1568,13 @@ static int aic3x_i2c_probe(struct i2c_client *i2c,
        ret = snd_soc_register_codec(&i2c->dev,
                        &soc_codec_dev_aic3x, &aic3x_dai, 1);
-        return ret;
+        if (ret != 0)
+                goto err_gpio;
+        list_add(&aic3x->list, &reset_list);
+        return 0;
 err_gpio:
        if (gpio_is_valid(aic3x->gpio_reset) &&
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 5522d2566c67..ecd26dd2e442 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -154,6 +154,7 @@ static struct reg_default wm8962_reg[] = {
        { 40, 0x0000 },   /* R40    - SPKOUTL volume */
        { 41, 0x0000 },   /* R41    - SPKOUTR volume */
+        { 49, 0x0010 },   /* R49    - Class D Control 1 */
        { 51, 0x0003 },   /* R51    - Class D Control 2 */
        { 56, 0x0506 },   /* R56    - Clocking 4 */
@@ -795,7 +796,6 @@ static bool wm8962_volatile_register(struct device *dev, unsigned int reg)
        case WM8962_ALC2:
        case WM8962_THERMAL_SHUTDOWN_STATUS:
        case WM8962_ADDITIONAL_CONTROL_4:
-        case WM8962_CLASS_D_CONTROL_1:
        case WM8962_DC_SERVO_6:
        case WM8962_INTERRUPT_STATUS_1:
        case WM8962_INTERRUPT_STATUS_2:
@@ -2929,13 +2929,22 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
 static int wm8962_mute(struct snd_soc_dai *dai, int mute)
 {
        struct snd_soc_codec *codec = dai->codec;
-        int val;
+        int val, ret;
        if (mute)
-                val = WM8962_DAC_MUTE;
+                val = WM8962_DAC_MUTE | WM8962_DAC_MUTE_ALT;
        else
                val = 0;
+        /**
+         * The DAC mute bit is mirrored in two registers, update both to keep
+         * the register cache consistent.
+         */
+        ret = snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_1,
+                                  WM8962_DAC_MUTE_ALT, val);
+        if (ret < 0)
+                return ret;
        return snd_soc_update_bits(codec, WM8962_ADC_DAC_CONTROL_1,
                                   WM8962_DAC_MUTE, val);
 }
diff --git a/sound/soc/codecs/wm8962.h b/sound/soc/codecs/wm8962.h
index a1a5d5294c19..910aafd09d21 100644
--- a/sound/soc/codecs/wm8962.h
+++ b/sound/soc/codecs/wm8962.h
@@ -1954,6 +1954,10 @@
 #define WM8962_SPKOUTL_ENA_MASK                 0x0040  /* SPKOUTL_ENA */
 #define WM8962_SPKOUTL_ENA_SHIFT                     6  /* SPKOUTL_ENA */
 #define WM8962_SPKOUTL_ENA_WIDTH                     1  /* SPKOUTL_ENA */
+#define WM8962_DAC_MUTE_ALT                     0x0010  /* DAC_MUTE */
+#define WM8962_DAC_MUTE_ALT_MASK                0x0010  /* DAC_MUTE */
+#define WM8962_DAC_MUTE_ALT_SHIFT                    4  /* DAC_MUTE */
+#define WM8962_DAC_MUTE_ALT_WIDTH                    1  /* DAC_MUTE */
 #define WM8962_SPKOUTL_PGA_MUTE                 0x0002  /* SPKOUTL_PGA_MUTE */
 #define WM8962_SPKOUTL_PGA_MUTE_MASK            0x0002  /* SPKOUTL_PGA_MUTE */
 #define WM8962_SPKOUTL_PGA_MUTE_SHIFT                1  /* SPKOUTL_PGA_MUTE */
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index c8e5db1414d7..496ce2eb2f1f 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -258,10 +258,16 @@ static int fsl_esai_set_dai_sysclk(struct snd_soc_dai *dai, int clk_id,
                return -EINVAL;
        }
-        if (ratio == 1) {
+        /* Only EXTAL source can be output directly without using PSR and PM */
+        if (ratio == 1 && clksrc == esai_priv->extalclk) {
                /* Bypass all the dividers if not being needed */
                ecr |= tx ? ESAI_ECR_ETO : ESAI_ECR_ERO;
                goto out;
+        } else if (ratio < 2) {
+                /* The ratio should be no less than 2 if using other sources */
+                dev_err(dai->dev, "failed to derive required HCK%c rate\n",
+                                tx ? 'T' : 'R');
+                return -EINVAL;
        }
        ret = fsl_esai_divisor_cal(dai, tx, ratio, false, 0);
@@ -307,7 +313,8 @@ static int fsl_esai_set_bclk(struct snd_soc_dai *dai, bool tx, u32 freq)
                return -EINVAL;
        }
-        if (esai_priv->sck_div[tx] && (ratio > 16 || ratio == 0)) {
+        /* The ratio should be contented by FP alone if bypassing PM and PSR */
+        if (!esai_priv->sck_div[tx] && (ratio > 16 || ratio == 0)) {
                dev_err(dai->dev, "the ratio is out of range (1 ~ 16)\n");
                return -EINVAL;
        }
@@ -454,12 +461,6 @@ static int fsl_esai_startup(struct snd_pcm_substream *substream,
        }
        if (!dai->active) {
-                /* Reset Port C */
-                regmap_update_bits(esai_priv->regmap, REG_ESAI_PRRC,
-                                   ESAI_PRRC_PDC_MASK, ESAI_PRRC_PDC(ESAI_GPIO));
-                regmap_update_bits(esai_priv->regmap, REG_ESAI_PCRC,
-                                   ESAI_PCRC_PC_MASK, ESAI_PCRC_PC(ESAI_GPIO));
                /* Set synchronous mode */
                regmap_update_bits(esai_priv->regmap, REG_ESAI_SAICR,
                                   ESAI_SAICR_SYNC, esai_priv->synchronous ?
@@ -519,6 +520,11 @@ static int fsl_esai_hw_params(struct snd_pcm_substream *substream,
        regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx), mask, val);
+        /* Remove ESAI personal reset by configuring ESAI_PCRC and ESAI_PRRC */
+        regmap_update_bits(esai_priv->regmap, REG_ESAI_PRRC,
+                           ESAI_PRRC_PDC_MASK, ESAI_PRRC_PDC(ESAI_GPIO));
+        regmap_update_bits(esai_priv->regmap, REG_ESAI_PCRC,
+                           ESAI_PCRC_PC_MASK, ESAI_PCRC_PC(ESAI_GPIO));
        return 0;
 }
diff --git a/sound/soc/fsl/fsl_spdif.h b/sound/soc/fsl/fsl_spdif.h
index b1266790d117..605a10b2112b 100644
--- a/sound/soc/fsl/fsl_spdif.h
+++ b/sound/soc/fsl/fsl_spdif.h
@@ -144,8 +144,8 @@ enum spdif_gainsel {
 /* SPDIF Clock register */
 #define STC_SYSCLK_DIV_OFFSET           11
-#define STC_SYSCLK_DIV_MASK             (0x1ff << STC_TXCLK_SRC_OFFSET)
+#define STC_SYSCLK_DIV_MASK             (0x1ff << STC_SYSCLK_DIV_OFFSET)
-#define STC_SYSCLK_DIV(x)               ((((x) - 1) << STC_TXCLK_DIV_OFFSET) & STC_SYSCLK_DIV_MASK)
+#define STC_SYSCLK_DIV(x)               ((((x) - 1) << STC_SYSCLK_DIV_OFFSET) & STC_SYSCLK_DIV_MASK)
 #define STC_TXCLK_SRC_OFFSET            8
 #define STC_TXCLK_SRC_MASK              (0x7 << STC_TXCLK_SRC_OFFSET)
 #define STC_TXCLK_SRC_SET(x)            ((x << STC_TXCLK_SRC_OFFSET) & STC_TXCLK_SRC_MASK)
diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
index ac869931d7f1..267717aa96c1 100644
--- a/sound/soc/fsl/imx-audmux.c
+++ b/sound/soc/fsl/imx-audmux.c
@@ -145,7 +145,7 @@ static const struct file_operations audmux_debugfs_fops = {
        .llseek = default_llseek,
 };
-static void __init audmux_debugfs_init(void)
+static void audmux_debugfs_init(void)
 {
        int i;
        char buf[20];
diff --git a/sound/soc/intel/sst-acpi.c b/sound/soc/intel/sst-acpi.c
index 5d06eecb6198..18aee77f8d4a 100644
--- a/sound/soc/intel/sst-acpi.c
+++ b/sound/soc/intel/sst-acpi.c
@@ -138,6 +138,7 @@ static int sst_acpi_probe(struct platform_device *pdev)
        sst_pdata = &sst_acpi->sst_pdata;
        sst_pdata->id = desc->sst_id;
+        sst_pdata->dma_dev = dev;
        sst_acpi->desc = desc;
        sst_acpi->mach = mach;
diff --git a/sound/soc/intel/sst-baytrail-dsp.c b/sound/soc/intel/sst-baytrail-dsp.c
index a50bf7fc0e3a..adf0aca5aca6 100644
--- a/sound/soc/intel/sst-baytrail-dsp.c
+++ b/sound/soc/intel/sst-baytrail-dsp.c
@@ -324,7 +324,7 @@ static int sst_byt_init(struct sst_dsp *sst, struct sst_pdata *pdata)
        memcpy_toio(sst->addr.lpe + SST_BYT_MAILBOX_OFFSET,
               &pdata->fw_base, sizeof(u32));
-        ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+        ret = dma_coerce_mask_and_coherent(sst->dma_dev, DMA_BIT_MASK(32));
        if (ret)
                return ret;
diff --git a/sound/soc/intel/sst-baytrail-ipc.c b/sound/soc/intel/sst-baytrail-ipc.c
index d0eaeee21be4..0d31dbbf4806 100644
--- a/sound/soc/intel/sst-baytrail-ipc.c
+++ b/sound/soc/intel/sst-baytrail-ipc.c
@@ -542,16 +542,20 @@ struct sst_byt_stream *sst_byt_stream_new(struct sst_byt *byt, int id,
        void *data)
 {
        struct sst_byt_stream *stream;
+        struct sst_dsp *sst = byt->dsp;
+        unsigned long flags;
        stream = kzalloc(sizeof(*stream), GFP_KERNEL);
        if (stream == NULL)
                return NULL;
+        spin_lock_irqsave(&sst->spinlock, flags);
        list_add(&stream->node, &byt->stream_list);
        stream->notify_position = notify_position;
        stream->pdata = data;
        stream->byt = byt;
        stream->str_id = id;
+        spin_unlock_irqrestore(&sst->spinlock, flags);
        return stream;
 }
@@ -630,6 +634,8 @@ int sst_byt_stream_free(struct sst_byt *byt, struct sst_byt_stream *stream)
 {
        u64 header;
        int ret = 0;
+        struct sst_dsp *sst = byt->dsp;
+        unsigned long flags;
        if (!stream->commited)
                goto out;
@@ -644,8 +650,10 @@ int sst_byt_stream_free(struct sst_byt *byt, struct sst_byt_stream *stream)
        stream->commited = false;
 out:
+        spin_lock_irqsave(&sst->spinlock, flags);
        list_del(&stream->node);
        kfree(stream);
+        spin_unlock_irqrestore(&sst->spinlock, flags);
        return ret;
 }
diff --git a/sound/soc/intel/sst-dsp-priv.h b/sound/soc/intel/sst-dsp-priv.h
index fe8e81aad646..401213455497 100644
--- a/sound/soc/intel/sst-dsp-priv.h
+++ b/sound/soc/intel/sst-dsp-priv.h
@@ -136,7 +136,7 @@ struct sst_module_data {
        enum sst_data_type data_type;   /* type of module data */
        u32 size;               /* size in bytes */
-        u32 offset;             /* offset in FW file */
+        int32_t offset;         /* offset in FW file */
        u32 data_offset;        /* offset in ADSP memory space */
        void *data;             /* module data */
 };
@@ -228,6 +228,7 @@ struct sst_dsp {
        spinlock_t spinlock;    /* IPC locking */
        struct mutex mutex;     /* DSP FW lock */
        struct device *dev;
+        struct device *dma_dev;
        void *thread_context;
        int irq;
        u32 id;
diff --git a/sound/soc/intel/sst-dsp.c b/sound/soc/intel/sst-dsp.c
index 0c129fd85ecf..0b715b20a2d7 100644
--- a/sound/soc/intel/sst-dsp.c
+++ b/sound/soc/intel/sst-dsp.c
@@ -337,6 +337,7 @@ struct sst_dsp *sst_dsp_new(struct device *dev,
        spin_lock_init(&sst->spinlock);
        mutex_init(&sst->mutex);
        sst->dev = dev;
+        sst->dma_dev = pdata->dma_dev;
        sst->thread_context = sst_dev->thread_context;
        sst->sst_dev = sst_dev;
        sst->id = pdata->id;
diff --git a/sound/soc/intel/sst-dsp.h b/sound/soc/intel/sst-dsp.h
index 74052b59485c..e44423be66c4 100644
--- a/sound/soc/intel/sst-dsp.h
+++ b/sound/soc/intel/sst-dsp.h
@@ -169,6 +169,7 @@ struct sst_pdata {
        u32 dma_base;
        u32 dma_size;
        int dma_engine;
+        struct device *dma_dev;
        /* DSP */
        u32 id;
diff --git a/sound/soc/intel/sst-firmware.c b/sound/soc/intel/sst-firmware.c
index f7687107cf7f..928f228c38e7 100644
--- a/sound/soc/intel/sst-firmware.c
+++ b/sound/soc/intel/sst-firmware.c
@@ -57,14 +57,8 @@ struct sst_fw *sst_fw_new(struct sst_dsp *dsp,
        sst_fw->private = private;
        sst_fw->size = fw->size;
-        err = dma_coerce_mask_and_coherent(dsp->dev, DMA_BIT_MASK(32));
-        if (err < 0) {
-                kfree(sst_fw);
-                return NULL;
-        }
        /* allocate DMA buffer to store FW data */
-        sst_fw->dma_buf = dma_alloc_coherent(dsp->dev, sst_fw->size,
+        sst_fw->dma_buf = dma_alloc_coherent(dsp->dma_dev, sst_fw->size,
                                &sst_fw->dmable_fw_paddr, GFP_DMA | GFP_KERNEL);
        if (!sst_fw->dma_buf) {
                dev_err(dsp->dev, "error: DMA alloc failed\n");
@@ -106,7 +100,7 @@ void sst_fw_free(struct sst_fw *sst_fw)
        list_del(&sst_fw->list);
        mutex_unlock(&dsp->mutex);
-        dma_free_coherent(dsp->dev, sst_fw->size, sst_fw->dma_buf,
+        dma_free_coherent(dsp->dma_dev, sst_fw->size, sst_fw->dma_buf,
                        sst_fw->dmable_fw_paddr);
        kfree(sst_fw);
 }
@@ -202,6 +196,9 @@ static int block_alloc_contiguous(struct sst_module *module,
                size -= block->size;
        }
+        list_for_each_entry(block, &tmp, list)
+                list_add(&block->module_list, &module->block_list);
        list_splice(&tmp, &dsp->used_block_list);
        return 0;
 }
@@ -247,8 +244,7 @@ static int block_alloc(struct sst_module *module,
                /* do we span > 1 blocks */
                if (data->size > block->size) {
                        ret = block_alloc_contiguous(module, data,
-                                block->offset + block->size,
+                                block->offset, data->size);
-                                data->size - block->size);
                        if (ret == 0)
                                return ret;
                }
@@ -344,7 +340,7 @@ static int block_alloc_fixed(struct sst_module *module,
                        err = block_alloc_contiguous(module, data,
                                block->offset + block->size,
-                                data->size - block->size + data->offset - block->offset);
+                                data->size - block->size);
                        if (err < 0)
                                return -ENOMEM;
@@ -371,15 +367,10 @@ static int block_alloc_fixed(struct sst_module *module,
                if (data->offset >= block->offset && data->offset < block_end) {
                        err = block_alloc_contiguous(module, data,
-                                block->offset + block->size,
+                                block->offset, data->size);
-                                data->size - block->size);
                        if (err < 0)
                                return -ENOMEM;
-                        /* add block */
-                        block->data_type = data->data_type;
-                        list_move(&block->list, &dsp->used_block_list);
-                        list_add(&block->module_list, &module->block_list);
                        return 0;
                }
diff --git a/sound/soc/intel/sst-haswell-dsp.c b/sound/soc/intel/sst-haswell-dsp.c
index f5ebf36af889..535f517629fd 100644
--- a/sound/soc/intel/sst-haswell-dsp.c
+++ b/sound/soc/intel/sst-haswell-dsp.c
@@ -433,7 +433,7 @@ static int hsw_init(struct sst_dsp *sst, struct sst_pdata *pdata)
        int ret = -ENODEV, i, j, region_count;
        u32 offset, size;
-        dev = sst->dev;
+        dev = sst->dma_dev;
        switch (sst->id) {
        case SST_DEV_ID_LYNX_POINT:
@@ -466,7 +466,7 @@ static int hsw_init(struct sst_dsp *sst, struct sst_pdata *pdata)
                return ret;
        }
-        ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+        ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(31));
        if (ret)
                return ret;
diff --git a/sound/soc/intel/sst-haswell-ipc.c b/sound/soc/intel/sst-haswell-ipc.c
index f46bb4ddde6f..e7996b39a484 100644
--- a/sound/soc/intel/sst-haswell-ipc.c
+++ b/sound/soc/intel/sst-haswell-ipc.c
@@ -617,7 +617,7 @@ static void hsw_notification_work(struct work_struct *work)
        case IPC_POSITION_CHANGED:
                trace_ipc_notification("DSP stream position changed for",
                        stream->reply.stream_hw_id);
-                sst_dsp_inbox_read(hsw->dsp, pos, sizeof(pos));
+                sst_dsp_inbox_read(hsw->dsp, pos, sizeof(*pos));
                if (stream->notify_position)
                        stream->notify_position(stream, stream->pdata);
@@ -991,7 +991,8 @@ int sst_hsw_stream_get_volume(struct sst_hsw *hsw, struct sst_hsw_stream *stream
                return -EINVAL;
        sst_dsp_read(hsw->dsp, volume,
-                stream->reply.volume_register_address[channel], sizeof(volume));
+                stream->reply.volume_register_address[channel],
+                sizeof(*volume));
        return 0;
 }
@@ -1158,11 +1159,14 @@ struct sst_hsw_stream *sst_hsw_stream_new(struct sst_hsw *hsw, int id,
        void *data)
 {
        struct sst_hsw_stream *stream;
+        struct sst_dsp *sst = hsw->dsp;
+        unsigned long flags;
        stream = kzalloc(sizeof(*stream), GFP_KERNEL);
        if (stream == NULL)
                return NULL;
+        spin_lock_irqsave(&sst->spinlock, flags);
        list_add(&stream->node, &hsw->stream_list);
        stream->notify_position = notify_position;
        stream->pdata = data;
@@ -1171,6 +1175,7 @@ struct sst_hsw_stream *sst_hsw_stream_new(struct sst_hsw *hsw, int id,
        /* work to process notification messages */
        INIT_WORK(&stream->notify_work, hsw_notification_work);
+        spin_unlock_irqrestore(&sst->spinlock, flags);
        return stream;
 }
@@ -1179,6 +1184,8 @@ int sst_hsw_stream_free(struct sst_hsw *hsw, struct sst_hsw_stream *stream)
 {
        u32 header;
        int ret = 0;
+        struct sst_dsp *sst = hsw->dsp;
+        unsigned long flags;
        /* dont free DSP streams that are not commited */
        if (!stream->commited)
@@ -1200,8 +1207,11 @@ int sst_hsw_stream_free(struct sst_hsw *hsw, struct sst_hsw_stream *stream)
        trace_hsw_stream_free_req(stream, &stream->free_req);
 out:
+        cancel_work_sync(&stream->notify_work);
+        spin_lock_irqsave(&sst->spinlock, flags);
        list_del(&stream->node);
        kfree(stream);
+        spin_unlock_irqrestore(&sst->spinlock, flags);
        return ret;
 }
@@ -1537,10 +1547,28 @@ int sst_hsw_stream_reset(struct sst_hsw *hsw, struct sst_hsw_stream *stream)
 }
 /* Stream pointer positions */
-int sst_hsw_get_dsp_position(struct sst_hsw *hsw,
+u32 sst_hsw_get_dsp_position(struct sst_hsw *hsw,
        struct sst_hsw_stream *stream)
 {
-        return stream->rpos.position;
+        u32 rpos;
+        sst_dsp_read(hsw->dsp, &rpos,
+                stream->reply.read_position_register_address, sizeof(rpos));
+        return rpos;
+}
+/* Stream presentation (monotonic) positions */
+u64 sst_hsw_get_dsp_presentation_position(struct sst_hsw *hsw,
+        struct sst_hsw_stream *stream)
+{
+        u64 ppos;
+        sst_dsp_read(hsw->dsp, &ppos,
+                stream->reply.presentation_position_register_address,
+                sizeof(ppos));
+        return ppos;
 }
 int sst_hsw_stream_set_write_position(struct sst_hsw *hsw,
@@ -1609,7 +1637,7 @@ int sst_hsw_dx_set_state(struct sst_hsw *hsw,
        trace_ipc_request("PM enter Dx state", state);
        ret = ipc_tx_message_wait(hsw, header, &state_, sizeof(state_),
-                dx, sizeof(dx));
+                dx, sizeof(*dx));
        if (ret < 0) {
                dev_err(hsw->dev, "ipc: error set dx state %d failed\n", state);
                return ret;
diff --git a/sound/soc/intel/sst-haswell-ipc.h b/sound/soc/intel/sst-haswell-ipc.h
index d517929ccc38..2ac194a6d04b 100644
--- a/sound/soc/intel/sst-haswell-ipc.h
+++ b/sound/soc/intel/sst-haswell-ipc.h
@@ -464,7 +464,9 @@ int sst_hsw_stream_get_write_pos(struct sst_hsw *hsw,
        struct sst_hsw_stream *stream, u32 *position);
 int sst_hsw_stream_set_write_position(struct sst_hsw *hsw,
        struct sst_hsw_stream *stream, u32 stage_id, u32 position);
-int sst_hsw_get_dsp_position(struct sst_hsw *hsw,
+u32 sst_hsw_get_dsp_position(struct sst_hsw *hsw,
+        struct sst_hsw_stream *stream);
+u64 sst_hsw_get_dsp_presentation_position(struct sst_hsw *hsw,
        struct sst_hsw_stream *stream);
 /* HW port config */
diff --git a/sound/soc/intel/sst-haswell-pcm.c b/sound/soc/intel/sst-haswell-pcm.c
index 0a32dd13a23d..9d5f64a583a3 100644
--- a/sound/soc/intel/sst-haswell-pcm.c
+++ b/sound/soc/intel/sst-haswell-pcm.c
@@ -99,6 +99,7 @@ struct hsw_pcm_data {
        struct snd_compr_stream *cstream;
        unsigned int wpos;
        struct mutex mutex;
+        bool allocated;
 };
 /* private data for the driver */
@@ -107,12 +108,14 @@ struct hsw_priv_data {
        struct sst_hsw *hsw;
        /* page tables */
-        unsigned char *pcm_pg[HSW_PCM_COUNT][2];
+        struct snd_dma_buffer dmab[HSW_PCM_COUNT][2];
        /* DAI data */
        struct hsw_pcm_data pcm[HSW_PCM_COUNT];
 };
+static u32 hsw_notify_pointer(struct sst_hsw_stream *stream, void *data);
 static inline u32 hsw_mixer_to_ipc(unsigned int value)
 {
        if (value >= ARRAY_SIZE(volume_map))
@@ -273,28 +276,26 @@ static const struct snd_kcontrol_new hsw_volume_controls[] = {
 };
 /* Create DMA buffer page table for DSP */
-static int create_adsp_page_table(struct hsw_priv_data *pdata,
+static int create_adsp_page_table(struct snd_pcm_substream *substream,
-        struct snd_soc_pcm_runtime *rtd,
+        struct hsw_priv_data *pdata, struct snd_soc_pcm_runtime *rtd,
-        unsigned char *dma_area, size_t size, int pcm, int stream)
+        unsigned char *dma_area, size_t size, int pcm)
 {
-        int i, pages;
+        struct snd_dma_buffer *dmab = snd_pcm_get_dma_buf(substream);
+        int i, pages, stream = substream->stream;
-        if (size % PAGE_SIZE)
+        pages = snd_sgbuf_aligned_pages(size);
-                pages = (size / PAGE_SIZE) + 1;
-        else
-                pages = size / PAGE_SIZE;
        dev_dbg(rtd->dev, "generating page table for %p size 0x%zu pages %d\n",
                dma_area, size, pages);
        for (i = 0; i < pages; i++) {
                u32 idx = (((i << 2) + i)) >> 1;
-                u32 pfn = (virt_to_phys(dma_area + i * PAGE_SIZE)) >> PAGE_SHIFT;
+                u32 pfn = snd_sgbuf_get_addr(dmab, i * PAGE_SIZE) >> PAGE_SHIFT;
                u32 *pg_table;
                dev_dbg(rtd->dev, "pfn i %i idx %d pfn %x\n", i, idx, pfn);
-                pg_table = (u32*)(pdata->pcm_pg[pcm][stream] + idx);
+                pg_table = (u32 *)(pdata->dmab[pcm][stream].area + idx);
                if (i & 1)
                        *pg_table |= (pfn << 4);
@@ -317,12 +318,36 @@ static int hsw_pcm_hw_params(struct snd_pcm_substream *substream,
        struct sst_hsw *hsw = pdata->hsw;
        struct sst_module *module_data;
        struct sst_dsp *dsp;
+        struct snd_dma_buffer *dmab;
        enum sst_hsw_stream_type stream_type;
        enum sst_hsw_stream_path_id path_id;
        u32 rate, bits, map, pages, module_id;
        u8 channels;
        int ret;
+        /* check if we are being called a subsequent time */
+        if (pcm_data->allocated) {
+                ret = sst_hsw_stream_reset(hsw, pcm_data->stream);
+                if (ret < 0)
+                        dev_dbg(rtd->dev, "error: reset stream failed %d\n",
+                                ret);
+                ret = sst_hsw_stream_free(hsw, pcm_data->stream);
+                if (ret < 0) {
+                        dev_dbg(rtd->dev, "error: free stream failed %d\n",
+                                ret);
+                        return ret;
+                }
+                pcm_data->allocated = false;
+                pcm_data->stream = sst_hsw_stream_new(hsw, rtd->cpu_dai->id,
+                        hsw_notify_pointer, pcm_data);
+                if (pcm_data->stream == NULL) {
+                        dev_err(rtd->dev, "error: failed to create stream\n");
+                        return -EINVAL;
+                }
+        }
        /* stream direction */
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                path_id = SST_HSW_STREAM_PATH_SSP0_OUT;
@@ -416,8 +441,10 @@ static int hsw_pcm_hw_params(struct snd_pcm_substream *substream,
                return ret;
        }
-        ret = create_adsp_page_table(pdata, rtd, runtime->dma_area,
+        dmab = snd_pcm_get_dma_buf(substream);
-                runtime->dma_bytes, rtd->cpu_dai->id, substream->stream);
+        ret = create_adsp_page_table(substream, pdata, rtd, runtime->dma_area,
+                runtime->dma_bytes, rtd->cpu_dai->id);
        if (ret < 0)
                return ret;
@@ -430,9 +457,9 @@ static int hsw_pcm_hw_params(struct snd_pcm_substream *substream,
                pages = runtime->dma_bytes / PAGE_SIZE;
        ret = sst_hsw_stream_buffer(hsw, pcm_data->stream,
-                virt_to_phys(pdata->pcm_pg[rtd->cpu_dai->id][substream->stream]),
+                pdata->dmab[rtd->cpu_dai->id][substream->stream].addr,
                pages, runtime->dma_bytes, 0,
-                (u32)(virt_to_phys(runtime->dma_area) >> PAGE_SHIFT));
+                snd_sgbuf_get_addr(dmab, 0) >> PAGE_SHIFT);
        if (ret < 0) {
                dev_err(rtd->dev, "error: failed to set DMA buffer %d\n", ret);
                return ret;
@@ -474,6 +501,7 @@ static int hsw_pcm_hw_params(struct snd_pcm_substream *substream,
                dev_err(rtd->dev, "error: failed to commit stream %d\n", ret);
                return ret;
        }
+        pcm_data->allocated = true;
        ret = sst_hsw_stream_pause(hsw, pcm_data->stream, 1);
        if (ret < 0)
@@ -541,12 +569,14 @@ static snd_pcm_uframes_t hsw_pcm_pointer(struct snd_pcm_substream *substream)
        struct hsw_pcm_data *pcm_data = snd_soc_pcm_get_drvdata(rtd);
        struct sst_hsw *hsw = pdata->hsw;
        snd_pcm_uframes_t offset;
+        uint64_t ppos;
+        u32 position = sst_hsw_get_dsp_position(hsw, pcm_data->stream);
-        offset = bytes_to_frames(runtime,
+        offset = bytes_to_frames(runtime, position);
-                sst_hsw_get_dsp_position(hsw, pcm_data->stream));
+        ppos = sst_hsw_get_dsp_presentation_position(hsw, pcm_data->stream);
-        dev_dbg(rtd->dev, "PCM: DMA pointer %zu bytes\n",
+        dev_dbg(rtd->dev, "PCM: DMA pointer %du bytes, pos %llu\n",
-                frames_to_bytes(runtime, (u32)offset));
+                position, ppos);
        return offset;
 }
@@ -606,6 +636,7 @@ static int hsw_pcm_close(struct snd_pcm_substream *substream)
                dev_dbg(rtd->dev, "error: free stream failed %d\n", ret);
                goto out;
        }
+        pcm_data->allocated = 0;
        pcm_data->stream = NULL;
 out:
@@ -621,7 +652,7 @@ static struct snd_pcm_ops hsw_pcm_ops = {
        .hw_free        = hsw_pcm_hw_free,
        .trigger        = hsw_pcm_trigger,
        .pointer        = hsw_pcm_pointer,
-        .mmap           = snd_pcm_lib_default_mmap,
+        .page           = snd_pcm_sgbuf_ops_page,
 };
 static void hsw_pcm_free(struct snd_pcm *pcm)
@@ -632,17 +663,16 @@ static void hsw_pcm_free(struct snd_pcm *pcm)
 static int hsw_pcm_new(struct snd_soc_pcm_runtime *rtd)
 {
        struct snd_pcm *pcm = rtd->pcm;
+        struct snd_soc_platform *platform = rtd->platform;
+        struct sst_pdata *pdata = dev_get_platdata(platform->dev);
+        struct device *dev = pdata->dma_dev;
        int ret = 0;
-        ret = dma_coerce_mask_and_coherent(rtd->card->dev, DMA_BIT_MASK(32));
-        if (ret)
-                return ret;
        if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream ||
                        pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) {
                ret = snd_pcm_lib_preallocate_pages_for_all(pcm,
-                        SNDRV_DMA_TYPE_DEV,
+                        SNDRV_DMA_TYPE_DEV_SG,
-                        rtd->card->dev,
+                        dev,
                        hsw_pcm_hardware.buffer_bytes_max,
                        hsw_pcm_hardware.buffer_bytes_max);
                if (ret) {
@@ -742,11 +772,14 @@ static int hsw_pcm_probe(struct snd_soc_platform *platform)
 {
        struct sst_pdata *pdata = dev_get_platdata(platform->dev);
        struct hsw_priv_data *priv_data;
-        int i;
+        struct device *dma_dev;
+        int i, ret = 0;
        if (!pdata)
                return -ENODEV;
+        dma_dev = pdata->dma_dev;
        priv_data = devm_kzalloc(platform->dev, sizeof(*priv_data), GFP_KERNEL);
        priv_data->hsw = pdata->dsp;
        snd_soc_platform_set_drvdata(platform, priv_data);
@@ -758,15 +791,17 @@ static int hsw_pcm_probe(struct snd_soc_platform *platform)
                /* playback */
                if (hsw_dais[i].playback.channels_min) {
-                        priv_data->pcm_pg[i][0] = kzalloc(PAGE_SIZE, GFP_DMA);
+                        ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, dma_dev,
-                        if (priv_data->pcm_pg[i][0] == NULL)
+                                PAGE_SIZE, &priv_data->dmab[i][0]);
+                        if (ret < 0)
                                goto err;
                }
                /* capture */
                if (hsw_dais[i].capture.channels_min) {
-                        priv_data->pcm_pg[i][1] = kzalloc(PAGE_SIZE, GFP_DMA);
+                        ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, dma_dev,
-                        if (priv_data->pcm_pg[i][1] == NULL)
+                                PAGE_SIZE, &priv_data->dmab[i][1]);
+                        if (ret < 0)
                                goto err;
                }
        }
@@ -776,11 +811,11 @@ static int hsw_pcm_probe(struct snd_soc_platform *platform)
 err:
        for (;i >= 0; i--) {
                if (hsw_dais[i].playback.channels_min)
-                        kfree(priv_data->pcm_pg[i][0]);
+                        snd_dma_free_pages(&priv_data->dmab[i][0]);
                if (hsw_dais[i].capture.channels_min)
-                        kfree(priv_data->pcm_pg[i][1]);
+                        snd_dma_free_pages(&priv_data->dmab[i][1]);
        }
-        return -ENOMEM;
+        return ret;
 }
 static int hsw_pcm_remove(struct snd_soc_platform *platform)
@@ -791,9 +826,9 @@ static int hsw_pcm_remove(struct snd_soc_platform *platform)
        for (i = 0; i < ARRAY_SIZE(hsw_dais); i++) {
                if (hsw_dais[i].playback.channels_min)
-                        kfree(priv_data->pcm_pg[i][0]);
+                        snd_dma_free_pages(&priv_data->dmab[i][0]);
                if (hsw_dais[i].capture.channels_min)
-                        kfree(priv_data->pcm_pg[i][1]);
+                        snd_dma_free_pages(&priv_data->dmab[i][1]);
        }
        return 0;
diff --git a/sound/soc/jz4740/Makefile b/sound/soc/jz4740/Makefile
index be873c1b0c20..d32c540555c4 100644
--- a/sound/soc/jz4740/Makefile
+++ b/sound/soc/jz4740/Makefile
@@ -1,10 +1,8 @@
 #
 # Jz4740 Platform Support
 #
-snd-soc-jz4740-objs := jz4740-pcm.o
 snd-soc-jz4740-i2s-objs := jz4740-i2s.o
-obj-$(CONFIG_SND_JZ4740_SOC) += snd-soc-jz4740.o
 obj-$(CONFIG_SND_JZ4740_SOC_I2S) += snd-soc-jz4740-i2s.o
 # Jz4740 Machine Support
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 215b668166be..89424470a1f3 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -197,13 +197,12 @@ static void rsnd_dma_complete(void *data)
         * rsnd_dai_pointer_update() will be called twice,
         * ant it will breaks io->byte_pos
         */
-        rsnd_dai_pointer_update(io, io->byte_per_period);
        if (dma->submit_loop)
                rsnd_dma_continue(dma);
        rsnd_unlock(priv, flags);
+        rsnd_dai_pointer_update(io, io->byte_per_period);
 }
 static void __rsnd_dma_start(struct rsnd_dma *dma)
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index 6232b7d307aa..4d0720ed5a90 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -258,7 +258,7 @@ static int rsnd_src_init(struct rsnd_mod *mod,
 {
        struct rsnd_src *src = rsnd_mod_to_src(mod);
-        clk_enable(src->clk);
+        clk_prepare_enable(src->clk);
        return 0;
 }
@@ -269,7 +269,7 @@ static int rsnd_src_quit(struct rsnd_mod *mod,
 {
        struct rsnd_src *src = rsnd_mod_to_src(mod);
-        clk_disable(src->clk);
+        clk_disable_unprepare(src->clk);
        return 0;
 }
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 4b7e20603dd7..1d8387c25bd8 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -171,7 +171,7 @@ static void rsnd_ssi_hw_start(struct rsnd_ssi *ssi,
        u32 cr;
        if (0 == ssi->usrcnt) {
-                clk_enable(ssi->clk);
+                clk_prepare_enable(ssi->clk);
                if (rsnd_dai_is_clk_master(rdai)) {
                        if (rsnd_ssi_clk_from_parent(ssi))
@@ -230,7 +230,7 @@ static void rsnd_ssi_hw_stop(struct rsnd_ssi *ssi,
                                rsnd_ssi_master_clk_stop(ssi);
                }
-                clk_disable(ssi->clk);
+                clk_disable_unprepare(ssi->clk);
        }
        dev_dbg(dev, "ssi%d hw stopped\n", rsnd_mod_id(&ssi->mod));
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index c8a780d0d057..6d6ceee447d5 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -254,7 +254,6 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
 static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
 {
        struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
-        kfree(data->widget);
        kfree(data->wlist);
        kfree(data);
 }
@@ -1613,8 +1612,11 @@ static void dapm_pre_sequence_async(void *data, async_cookie_t cookie)
                                "ASoC: Failed to turn on bias: %d\n", ret);
        }
-        /* Prepare for a STADDBY->ON or ON->STANDBY transition */
+        /* Prepare for a transition to ON or away from ON */
-        if (d->bias_level != d->target_bias_level) {
+        if ((d->target_bias_level == SND_SOC_BIAS_ON &&
+             d->bias_level != SND_SOC_BIAS_ON) ||
+            (d->target_bias_level != SND_SOC_BIAS_ON &&
+             d->bias_level == SND_SOC_BIAS_ON)) {
                ret = snd_soc_dapm_set_bias_level(d, SND_SOC_BIAS_PREPARE);
                if (ret != 0)
                        dev_err(d->dev,
@@ -3476,8 +3478,11 @@ void snd_soc_dapm_connect_dai_link_widgets(struct snd_soc_card *card)
                cpu_dai = rtd->cpu_dai;
                codec_dai = rtd->codec_dai;
-                /* dynamic FE links have no fixed DAI mapping */
+                /*
-                if (rtd->dai_link->dynamic)
+                 * dynamic FE links have no fixed DAI mapping.
+                 * CODEC<->CODEC links have no direct connection.
+                 */
+                if (rtd->dai_link->dynamic || rtd->dai_link->params)
                        continue;
                /* there is no point in connecting BE DAI links with dummies */
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 2cedf09f6d96..a391de058037 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1675,7 +1675,7 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
                        be->dpcm[stream].state = SND_SOC_DPCM_STATE_STOP;
                        break;
                case SNDRV_PCM_TRIGGER_SUSPEND:
-                        if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP)
+                        if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START)
                                continue;
                        if (!snd_soc_dpcm_can_be_free_stop(fe, be, stream))
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 893d5a1afc3c..c3b5b7dca1c3 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -651,7 +651,7 @@ int snd_usb_autoresume(struct snd_usb_audio *chip)
        int err = -ENODEV;
        down_read(&chip->shutdown_rwsem);
-        if (chip->probing)
+        if (chip->probing && chip->in_pm)
                err = 0;
        else if (!chip->shutdown)
                err = usb_autopm_get_interface(chip->pm_intf);
@@ -663,7 +663,7 @@ int snd_usb_autoresume(struct snd_usb_audio *chip)
 void snd_usb_autosuspend(struct snd_usb_audio *chip)
 {
        down_read(&chip->shutdown_rwsem);
-        if (!chip->shutdown && !chip->probing)
+        if (!chip->shutdown && !chip->probing && !chip->in_pm)
                usb_autopm_put_interface(chip->pm_intf);
        up_read(&chip->shutdown_rwsem);
 }
@@ -695,8 +695,9 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
                        chip->autosuspended = 1;
        }
-        list_for_each_entry(mixer, &chip->mixer_list, list)
+        if (chip->num_suspended_intf == 1)
-                snd_usb_mixer_suspend(mixer);
+                list_for_each_entry(mixer, &chip->mixer_list, list)
+                        snd_usb_mixer_suspend(mixer);
        return 0;
 }
@@ -711,6 +712,8 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
                return 0;
        if (--chip->num_suspended_intf)
                return 0;
+        chip->in_pm = 1;
        /*
         * ALSA leaves material resumption to user space
         * we just notify and restart the mixers
@@ -726,6 +729,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
        chip->autosuspended = 0;
 err_out:
+        chip->in_pm = 0;
        return err;
 }
diff --git a/sound/usb/card.h b/sound/usb/card.h
index 9867ab866857..97acb906acc2 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -92,6 +92,7 @@ struct snd_usb_endpoint {
        unsigned int curframesize;      /* current packet size in frames (for capture) */
        unsigned int syncmaxsize;       /* sync endpoint packet size */
        unsigned int fill_max:1;        /* fill max packet size always */
+        unsigned int udh01_fb_quirk:1;  /* corrupted feedback data */
        unsigned int datainterval;      /* log_2 of data packet interval */
        unsigned int syncinterval;      /* P for adaptive mode, 0 otherwise */
        unsigned char silence_value;
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index e70a87e0d9fe..289f582c9130 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -471,6 +471,10 @@ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
                        ep->syncinterval = 3;
                ep->syncmaxsize = le16_to_cpu(get_endpoint(alts, 1)->wMaxPacketSize);
+                if (chip->usb_id == USB_ID(0x0644, 0x8038) /* TEAC UD-H01 */ &&
+                    ep->syncmaxsize == 4)
+                        ep->udh01_fb_quirk = 1;
        }
        list_add_tail(&ep->list, &chip->ep_list);
@@ -1105,7 +1109,16 @@ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
        if (f == 0)
                return;
-        if (unlikely(ep->freqshift == INT_MIN)) {
+        if (unlikely(sender->udh01_fb_quirk)) {
+                /*
+                 * The TEAC UD-H01 firmware sometimes changes the feedback value
+                 * by +/- 0x1.0000.
+                 */
+                if (f < ep->freqn - 0x8000)
+                        f += 0x10000;
+                else if (f > ep->freqn + 0x8000)
+                        f -= 0x10000;
+        } else if (unlikely(ep->freqshift == INT_MIN)) {
                /*
                 * The first time we see a feedback value, determine its format
                 * by shifting it left or right until it matches the nominal
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 131336d40492..c62a1659106d 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1501,9 +1501,8 @@ static void retire_playback_urb(struct snd_usb_substream *subs,
         * The error should be lower than 2ms since the estimate relies
         * on two reads of a counter updated every ms.
         */
-        if (printk_ratelimit() &&
+        if (abs(est_delay - subs->last_delay) * 1000 > runtime->rate * 2)
-            abs(est_delay - subs->last_delay) * 1000 > runtime->rate * 2)
+                dev_dbg_ratelimited(&subs->dev->dev,
-                dev_dbg(&subs->dev->dev,
                        "delay: estimated %d, actual %d\n",
                        est_delay, subs->last_delay);
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
index 25c4c7e217de..91d0380431b4 100644
--- a/sound/usb/usbaudio.h
+++ b/sound/usb/usbaudio.h
@@ -40,6 +40,7 @@ struct snd_usb_audio {
        struct rw_semaphore shutdown_rwsem;
        unsigned int shutdown:1;
        unsigned int probing:1;
+        unsigned int in_pm:1;
        unsigned int autosuspended:1;   
        unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */
        
diff --git a/tools/lib/api/fs/debugfs.c b/tools/lib/api/fs/debugfs.c
index 7c4347962353..a74fba6d7743 100644
--- a/tools/lib/api/fs/debugfs.c
+++ b/tools/lib/api/fs/debugfs.c
@@ -12,8 +12,8 @@
 char debugfs_mountpoint[PATH_MAX + 1] = "/sys/kernel/debug";
 static const char * const debugfs_known_mountpoints[] = {
-        "/sys/kernel/debug/",
+        "/sys/kernel/debug",
-        "/debug/",
+        "/debug",
        0,
 };
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index baec7d887da4..b83184f2d484 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -4344,6 +4344,7 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
                                              format, len_arg, arg);
                                trace_seq_terminate(&p);
                                trace_seq_puts(s, p.buffer);
+                                trace_seq_destroy(&p);
                                arg = arg->next;
                                break;
                        default:
diff --git a/tools/lib/traceevent/event-parse.h b/tools/lib/traceevent/event-parse.h
index 791c539374c7..feab94281634 100644
--- a/tools/lib/traceevent/event-parse.h
+++ b/tools/lib/traceevent/event-parse.h
@@ -876,8 +876,8 @@ struct event_filter {
 struct event_filter *pevent_filter_alloc(struct pevent *pevent);
 /* for backward compatibility */
-#define FILTER_NONE             PEVENT_ERRNO__FILTER_NOT_FOUND
+#define FILTER_NONE             PEVENT_ERRNO__NO_FILTER
-#define FILTER_NOEXIST          PEVENT_ERRNO__NO_FILTER
+#define FILTER_NOEXIST          PEVENT_ERRNO__FILTER_NOT_FOUND
 #define FILTER_MISS             PEVENT_ERRNO__FILTER_MISS
 #define FILTER_MATCH            PEVENT_ERRNO__FILTER_MATCH
diff --git a/tools/net/bpf_dbg.c b/tools/net/bpf_dbg.c
index bb31813e43dd..9a287bec695a 100644
--- a/tools/net/bpf_dbg.c
+++ b/tools/net/bpf_dbg.c
@@ -820,7 +820,7 @@ do_div:
                r->A &= r->X;
                break;
        case BPF_ALU_AND | BPF_K:
-                r->A &= r->X;
+                r->A &= K;
                break;
        case BPF_ALU_OR | BPF_X:
                r->A |= r->X;
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index e96923310d57..895edd32930c 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -589,7 +589,7 @@ $(GTK_OBJS): $(OUTPUT)%.o: %.c $(LIB_H)
        $(QUIET_CC)$(CC) -o $@ -c -fPIC $(CFLAGS) $(GTK_CFLAGS) $<
 $(OUTPUT)libperf-gtk.so: $(GTK_OBJS) $(PERFLIBS)
-        $(QUIET_LINK)$(CC) -o $@ -shared $(ALL_LDFLAGS) $(filter %.o,$^) $(GTK_LIBS)
+        $(QUIET_LINK)$(CC) -o $@ -shared $(LDFLAGS) $(filter %.o,$^) $(GTK_LIBS)
 $(OUTPUT)builtin-help.o: builtin-help.c $(OUTPUT)common-cmds.h $(OUTPUT)PERF-CFLAGS
        $(QUIET_CC)$(CC) -o $@ -c $(CFLAGS) \
diff --git a/tools/perf/arch/x86/tests/dwarf-unwind.c b/tools/perf/arch/x86/tests/dwarf-unwind.c
index b602ad93ce63..83bc2385e6d3 100644
--- a/tools/perf/arch/x86/tests/dwarf-unwind.c
+++ b/tools/perf/arch/x86/tests/dwarf-unwind.c
@@ -23,9 +23,10 @@ static int sample_ustack(struct perf_sample *sample,
        sp = (unsigned long) regs[PERF_REG_X86_SP];
-        map = map_groups__find(&thread->mg, MAP__FUNCTION, (u64) sp);
+        map = map_groups__find(&thread->mg, MAP__VARIABLE, (u64) sp);
        if (!map) {
                pr_debug("failed to get stack map\n");
+                free(buf);
                return -1;
        }
diff --git a/tools/perf/arch/x86/tests/regs_load.S b/tools/perf/arch/x86/tests/regs_load.S
index 99167bf644ea..60875d5c556c 100644
--- a/tools/perf/arch/x86/tests/regs_load.S
+++ b/tools/perf/arch/x86/tests/regs_load.S
@@ -1,4 +1,3 @@
 #include <linux/linkage.h>
 #define AX       0
@@ -90,3 +89,10 @@ ENTRY(perf_regs_load)
        ret
 ENDPROC(perf_regs_load)
 #endif
+/*
+ * We need to provide note.GNU-stack section, saying that we want
+ * NOT executable stack. Otherwise the final linking will assume that
+ * the ELF stack should not be restricted at all and set it RWX.
+ */
+.section .note.GNU-stack,"",@progbits
diff --git a/tools/perf/config/Makefile b/tools/perf/config/Makefile
index ee21fa95ebcf..802cf544202b 100644
--- a/tools/perf/config/Makefile
+++ b/tools/perf/config/Makefile
@@ -34,6 +34,14 @@ ifeq ($(ARCH),arm)
  LIBUNWIND_LIBS = -lunwind -lunwind-arm
 endif
+# So far there's only x86 libdw unwind support merged in perf.
+# Disable it on all other architectures in case libdw unwind
+# support is detected in system. Add supported architectures
+# to the check.
+ifneq ($(ARCH),x86)
+  NO_LIBDW_DWARF_UNWIND := 1
+endif
 ifeq ($(LIBUNWIND_LIBS),)
  NO_LIBUNWIND := 1
 else
@@ -109,6 +117,10 @@ CFLAGS += -Wall
 CFLAGS += -Wextra
 CFLAGS += -std=gnu99
+# Enforce a non-executable stack, as we may regress (again) in the future by
+# adding assembler files missing the .GNU-stack linker note.
+LDFLAGS += -Wl,-z,noexecstack
 EXTLIBS = -lelf -lpthread -lrt -lm -ldl
 ifneq ($(OUTPUT),)
@@ -186,7 +198,10 @@ VF_FEATURE_TESTS =			\
        stackprotector-all              \
        timerfd                         \
        libunwind-debug-frame           \
-        bionic
+        bionic                          \
+        liberty                         \
+        liberty-z                       \
+        cplus-demangle
 # Set FEATURE_CHECK_(C|LD)FLAGS-all for all CORE_FEATURE_TESTS features.
 # If in the future we need per-feature checks/flags for features not
@@ -504,7 +519,21 @@ else
 endif
 ifeq ($(feature-libbfd), 1)
-  EXTLIBS += -lbfd -lz -liberty
+  EXTLIBS += -lbfd
+  # call all detections now so we get correct
+  # status in VF output
+  $(call feature_check,liberty)
+  $(call feature_check,liberty-z)
+  $(call feature_check,cplus-demangle)
+  ifeq ($(feature-liberty), 1)
+    EXTLIBS += -liberty
+  else
+    ifeq ($(feature-liberty-z), 1)
+      EXTLIBS += -liberty -lz
+    endif
+  endif
 endif
 ifdef NO_DEMANGLE
@@ -515,15 +544,10 @@ else
    CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
  else
    ifneq ($(feature-libbfd), 1)
-      $(call feature_check,liberty)
+      ifneq ($(feature-liberty), 1)
-      ifeq ($(feature-liberty), 1)
+        ifneq ($(feature-liberty-z), 1)
-        EXTLIBS += -lbfd -liberty
+          # we dont have neither HAVE_CPLUS_DEMANGLE_SUPPORT
-      else
+          # or any of 'bfd iberty z' trinity
-        $(call feature_check,liberty-z)
-        ifeq ($(feature-liberty-z), 1)
-          EXTLIBS += -lbfd -liberty -lz
-        else
-          $(call feature_check,cplus-demangle)
          ifeq ($(feature-cplus-demangle), 1)
            EXTLIBS += -liberty
            CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
diff --git a/tools/perf/tests/make b/tools/perf/tests/make
index 5daeae1cb4c0..2f92d6e7ee00 100644
--- a/tools/perf/tests/make
+++ b/tools/perf/tests/make
@@ -46,6 +46,7 @@ make_install_man    := install-man
 make_install_html   := install-html
 make_install_info   := install-info
 make_install_pdf    := install-pdf
+make_static         := LDFLAGS=-static
 # all the NO_* variable combined
 make_minimal        := NO_LIBPERL=1 NO_LIBPYTHON=1 NO_NEWT=1 NO_GTK2=1
@@ -87,6 +88,7 @@ run += make_install_bin
 # run += make_install_info
 # run += make_install_pdf
 run += make_minimal
+run += make_static
 ifneq ($(call has,ctags),)
 run += make_tags
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index a53cd0b8c151..27c2a5efe450 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -717,7 +717,7 @@ static char *get_kernel_version(const char *root_dir)
 }
 static int map_groups__set_modules_path_dir(struct map_groups *mg,
-                                const char *dir_name)
+                                const char *dir_name, int depth)
 {
        struct dirent *dent;
        DIR *dir = opendir(dir_name);
@@ -742,7 +742,15 @@ static int map_groups__set_modules_path_dir(struct map_groups *mg,
                            !strcmp(dent->d_name, ".."))
                                continue;
-                        ret = map_groups__set_modules_path_dir(mg, path);
+                        /* Do not follow top-level source and build symlinks */
+                        if (depth == 0) {
+                                if (!strcmp(dent->d_name, "source") ||
+                                    !strcmp(dent->d_name, "build"))
+                                        continue;
+                        }
+                        ret = map_groups__set_modules_path_dir(mg, path,
+                                                               depth + 1);
                        if (ret < 0)
                                goto out;
                } else {
@@ -786,11 +794,11 @@ static int machine__set_modules_path(struct machine *machine)
        if (!version)
                return -1;
-        snprintf(modules_path, sizeof(modules_path), "%s/lib/modules/%s/kernel",
+        snprintf(modules_path, sizeof(modules_path), "%s/lib/modules/%s",
                 machine->root_dir, version);
        free(version);
-        return map_groups__set_modules_path_dir(&machine->kmaps, modules_path);
+        return map_groups__set_modules_path_dir(&machine->kmaps, modules_path, 0);
 }
 static int machine__create_module(void *arg, const char *name, u64 start)
diff --git a/tools/power/acpi/Makefile b/tools/power/acpi/Makefile
index d9186a2fdf06..c2c0f20067a5 100644
--- a/tools/power/acpi/Makefile
+++ b/tools/power/acpi/Makefile
@@ -89,15 +89,6 @@ else
        STRIPCMD = $(STRIP) -s --remove-section=.note --remove-section=.comment
 endif
-# if DEBUG is enabled, then we do not strip or optimize
-ifeq ($(strip $(DEBUG)),true)
-        CFLAGS += -O1 -g -DDEBUG
-        STRIPCMD = /bin/true -Since_we_are_debugging
-else
-        CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
-        STRIPCMD = $(STRIP) -s --remove-section=.note --remove-section=.comment
-endif
 # --- ACPIDUMP BEGIN ---
 vpath %.c \
@@ -128,7 +119,7 @@ clean:
        -rm -f $(OUTPUT)acpidump
 install-tools:
-        $(INSTALL) -d $(DESTDIR)${bindir}
+        $(INSTALL) -d $(DESTDIR)${sbindir}
        $(INSTALL_PROGRAM) $(OUTPUT)acpidump $(DESTDIR)${sbindir}
 install-man:
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 47b29834a6b6..56ff9bebb577 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -548,11 +548,10 @@ static bool handle_mmio_cfg_reg(struct kvm_vcpu *vcpu,
        u32 val;
        u32 *reg;
-        offset >>= 1;
        reg = vgic_bitmap_get_reg(&vcpu->kvm->arch.vgic.irq_cfg,
-                                  vcpu->vcpu_id, offset);
+                                  vcpu->vcpu_id, offset >> 1);
-        if (offset & 2)
+        if (offset & 4)
                val = *reg >> 16;
        else
                val = *reg & 0xffff;
@@ -561,13 +560,13 @@ static bool handle_mmio_cfg_reg(struct kvm_vcpu *vcpu,
        vgic_reg_access(mmio, &val, offset,
                        ACCESS_READ_VALUE | ACCESS_WRITE_VALUE);
        if (mmio->is_write) {
-                if (offset < 4) {
+                if (offset < 8) {
                        *reg = ~0U; /* Force PPIs/SGIs to 1 */
                        return false;
                }
                val = vgic_cfg_compress(val);
-                if (offset & 2) {
+                if (offset & 4) {
                        *reg &= 0xffff;
                        *reg |= val << 16;
                } else {
@@ -916,6 +915,7 @@ static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg)
        case 0:
                if (!target_cpus)
                        return;
+                break;
        case 1:
                target_cpus = ((1 << nrcpus) - 1) & ~(1 << vcpu_id) & 0xff;
@@ -1667,10 +1667,11 @@ static int vgic_ioaddr_assign(struct kvm *kvm, phys_addr_t *ioaddr,
        if (addr + size < addr)
                return -EINVAL;
+        *ioaddr = addr;
        ret = vgic_ioaddr_overlap(kvm);
        if (ret)
-                return ret;
+                *ioaddr = VGIC_ADDR_UNDEF;
-        *ioaddr = addr;
        return ret;
 }
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index 8db43701016f..bf06577fea51 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -395,7 +395,8 @@ static int assigned_device_enable_host_msix(struct kvm *kvm,
        if (dev->entries_nr == 0)
                return r;
-        r = pci_enable_msix(dev->dev, dev->host_msix_entries, dev->entries_nr);
+        r = pci_enable_msix_exact(dev->dev,
+                                  dev->host_msix_entries, dev->entries_nr);
        if (r)
                return r;
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 10df100c4514..06e6401d6ef4 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -101,7 +101,7 @@ static void async_pf_execute(struct work_struct *work)
        if (waitqueue_active(&vcpu->wq))
                wake_up_interruptible(&vcpu->wq);
-        mmdrop(mm);
+        mmput(mm);
        kvm_put_kvm(vcpu->kvm);
 }
@@ -118,7 +118,7 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
                flush_work(&work->work);
 #else
                if (cancel_work_sync(&work->work)) {
-                        mmdrop(work->mm);
+                        mmput(work->mm);
                        kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
                        kmem_cache_free(async_pf_cache, work);
                }
@@ -183,7 +183,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
        work->addr = hva;
        work->arch = *arch;
        work->mm = current->mm;
-        atomic_inc(&work->mm->mm_count);
+        atomic_inc(&work->mm->mm_users);
        kvm_get_kvm(work->vcpu->kvm);
        /* this can't really happen otherwise gfn_to_pfn_async
@@ -201,7 +201,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
        return 1;
 retry_sync:
        kvm_put_kvm(work->vcpu->kvm);
-        mmdrop(work->mm);
+        mmput(work->mm);
        kmem_cache_free(async_pf_cache, work);
        return 0;
 }
author	Ingo Molnar <mingo@kernel.org>	2014-05-22 04:28:56 -0400
committer	Ingo Molnar <mingo@kernel.org>	2014-05-22 04:28:56 -0400
commit	65c2ce70046c779974af8b5dfc25a0df489089b5 (patch)
tree	b16f152eb62b71cf5a1edc51da865b357c989922
parent	842514849a616e9b61acad65771c7afe01e651f9 (diff)
parent	4b660a7f5c8099d88d1a43d8ae138965112592c7 (diff)