Merge tag 'asoc-fix-v3.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v3.19

A few last minute fixes for v3.19, all driver specific.  None of them
stand out particularly - it's all the standard people who are affected
will care stuff.

The Samsung fix is a DT only fix for the audio controller, it's being
merged via the ASoC tree due to process messups (the submitter sent it
at the end of a tangentally related series rather than separately to the
ARM folks) in order to make sure that it gets to people sooner.

226 files changed, 2384 insertions, 1312 deletions

diff --git a/Documentation/devicetree/bindings/i2c/i2c-st.txt b/Documentation/devicetree/bindings/i2c/i2c-st.txt
index 437e0db3823c..4c26fda3844a 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-st.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-st.txt
@@ -31,7 +31,7 @@ i2c0: i2c@fed40000 {
         compatible      = "st,comms-ssc4-i2c";
         reg             = <0xfed40000 0x110>;
         interrupts      =  <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
-        clocks          = <&CLK_S_ICN_REG_0>;
+        clocks          = <&clk_s_a0_ls CLK_ICN_REG>;
         clock-names     = "ssc";
         clock-frequency = <400000>;
         pinctrl-names   = "default";
diff --git a/Documentation/devicetree/bindings/i2c/trivial-devices.txt b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
index 9f4e3824e71e..9f41d05be3be 100644
--- a/Documentation/devicetree/bindings/i2c/trivial-devices.txt
+++ b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
@@ -47,6 +47,7 @@ dallas,ds3232		Extremely Accurate I²C RTC with Integrated Crystal and SRAM
 dallas,ds4510           CPU Supervisor with Nonvolatile Memory and Programmable I/O
 dallas,ds75             Digital Thermometer and Thermostat
 dlg,da9053              DA9053: flexible system level PMIC with multicore support
+dlg,da9063              DA9063: system PMIC for quad-core application processors
 epson,rx8025            High-Stability. I2C-Bus INTERFACE REAL TIME CLOCK MODULE
 epson,rx8581            I2C-BUS INTERFACE REAL TIME CLOCK MODULE
 fsl,mag3110             MAG3110: Xtrinsic High Accuracy, 3D Magnetometer
diff --git a/MAINTAINERS b/MAINTAINERS
index 2ebb056cbe0a..4871639b939f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -708,6 +708,16 @@ X:	drivers/iio/*/adjd*
 F:      drivers/staging/iio/*/ad*
 F:      staging/iio/trigger/iio-trig-bfin-timer.c
 
+ANDROID DRIVERS
+M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Arve Hjønnevåg <arve@android.com>
+M:      Riley Andrews <riandrews@android.com>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/gregkh/staging.git
+L:      devel@driverdev.osuosl.org
+S:      Supported
+F:      drivers/android/
+F:      drivers/staging/android/
+
 AOA (Apple Onboard Audio) ALSA DRIVER
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linuxppc-dev@lists.ozlabs.org
@@ -4943,6 +4953,16 @@ F:	Documentation/input/multi-touch-protocol.txt
 F:      drivers/input/input-mt.c
 K:      \b(ABS|SYN)_MT_
 
+INTEL ASoC BDW/HSW DRIVERS
+M:      Jie Yang <yang.jie@linux.intel.com>
+L:      alsa-devel@alsa-project.org
+S:      Supported
+F:      sound/soc/intel/sst-haswell*
+F:      sound/soc/intel/sst-dsp*
+F:      sound/soc/intel/sst-firmware.c
+F:      sound/soc/intel/broadwell.c
+F:      sound/soc/intel/haswell.c
+
 INTEL C600 SERIES SAS CONTROLLER DRIVER
 M:      Intel SCU Linux support <intel-linux-scu@intel.com>
 M:      Artur Paszkiewicz <artur.paszkiewicz@intel.com>
@@ -10166,6 +10186,7 @@ USERSPACE I/O (UIO)
 M:      "Hans J. Koch" <hjk@hansjkoch.de>
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 F:      Documentation/DocBook/uio-howto.tmpl
 F:      drivers/uio/
 F:      include/linux/uio*.h
diff --git a/Makefile b/Makefile
index 95a0e827ecd3..c8e17c05f916 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 19
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Diseased Newt
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index 98838a05ba6d..9d0ac091a52a 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -156,6 +156,8 @@ retry:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index 6f7e3a68803a..563cb27e37f5 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -161,6 +161,8 @@ good_area:
 
         if (fault & VM_FAULT_OOM)
                 goto out_of_memory;
+        else if (fault & VM_FAULT_SIGSEGV)
+                goto bad_area;
         else if (fault & VM_FAULT_SIGBUS)
                 goto do_sigbus;
 
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index b8168f1f8139..24ff27049ce0 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -368,7 +368,7 @@
         };
 
         i2s1: i2s@13960000 {
-                compatible = "samsung,s5pv210-i2s";
+                compatible = "samsung,s3c6410-i2s";
                 reg = <0x13960000 0x100>;
                 clocks = <&clock CLK_I2S1>;
                 clock-names = "iis";
@@ -378,7 +378,7 @@
         };
 
         i2s2: i2s@13970000 {
-                compatible = "samsung,s5pv210-i2s";
+                compatible = "samsung,s3c6410-i2s";
                 reg = <0x13970000 0x100>;
                 clocks = <&clock CLK_I2S2>;
                 clock-names = "iis";
diff --git a/arch/arm/boot/dts/imx6sx-sdb.dts b/arch/arm/boot/dts/imx6sx-sdb.dts
index 8c1febd7e3f2..c108bb451337 100644
--- a/arch/arm/boot/dts/imx6sx-sdb.dts
+++ b/arch/arm/boot/dts/imx6sx-sdb.dts
@@ -166,12 +166,12 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                ethphy1: ethernet-phy@0 {
-                        reg = <0>;
+                ethphy1: ethernet-phy@1 {
+                        reg = <1>;
                 };
 
-                ethphy2: ethernet-phy@1 {
-                        reg = <1>;
+                ethphy2: ethernet-phy@2 {
+                        reg = <2>;
                 };
         };
 };
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 7b4099fcf817..d5c4669224b1 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -17,14 +17,6 @@
 
         aliases {
                 ethernet0 = &emac;
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
-                serial6 = &uart6;
-                serial7 = &uart7;
         };
 
         chosen {
@@ -39,6 +31,14 @@
                                  <&ahb_gates 44>;
                         status = "disabled";
                 };
+
+                framebuffer@1 {
+                        compatible = "allwinner,simple-framebuffer", "simple-framebuffer";
+                        allwinner,pipeline = "de_fe0-de_be0-lcd0-hdmi";
+                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 43>,
+                                 <&ahb_gates 44>, <&ahb_gates 46>;
+                        status = "disabled";
+                };
         };
 
         cpus {
@@ -438,8 +438,8 @@
                         reg-names = "phy_ctrl", "pmu1", "pmu2";
                         clocks = <&usb_clk 8>;
                         clock-names = "usb_phy";
-                        resets = <&usb_clk 1>, <&usb_clk 2>;
-                        reset-names = "usb1_reset", "usb2_reset";
+                        resets = <&usb_clk 0>, <&usb_clk 1>, <&usb_clk 2>;
+                        reset-names = "usb0_reset", "usb1_reset", "usb2_reset";
                         status = "disabled";
                 };
 
diff --git a/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts b/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts
index fe3c559ca6a8..bfa742817690 100644
--- a/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts
+++ b/arch/arm/boot/dts/sun5i-a10s-olinuxino-micro.dts
@@ -55,6 +55,12 @@
         model = "Olimex A10s-Olinuxino Micro";
         compatible = "olimex,a10s-olinuxino-micro", "allwinner,sun5i-a10s";
 
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart2;
+                serial2 = &uart3;
+        };
+
         soc@01c00000 {
                 emac: ethernet@01c0b000 {
                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index 1b76667f3182..2e7d8263799d 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -18,10 +18,6 @@
 
         aliases {
                 ethernet0 = &emac;
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
         };
 
         chosen {
@@ -390,8 +386,8 @@
                         reg-names = "phy_ctrl", "pmu1";
                         clocks = <&usb_clk 8>;
                         clock-names = "usb_phy";
-                        resets = <&usb_clk 1>;
-                        reset-names = "usb1_reset";
+                        resets = <&usb_clk 0>, <&usb_clk 1>;
+                        reset-names = "usb0_reset", "usb1_reset";
                         status = "disabled";
                 };
 
diff --git a/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts b/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts
index eeed1f236ee8..c7be3abd9fcc 100644
--- a/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts
+++ b/arch/arm/boot/dts/sun5i-a13-hsg-h702.dts
@@ -53,6 +53,10 @@
         model = "HSG H702";
         compatible = "hsg,h702", "allwinner,sun5i-a13";
 
+        aliases {
+                serial0 = &uart1;
+        };
+
         soc@01c00000 {
                 mmc0: mmc@01c0f000 {
                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts b/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts
index 916ee8bb826f..3decefb3c37a 100644
--- a/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts
+++ b/arch/arm/boot/dts/sun5i-a13-olinuxino-micro.dts
@@ -54,6 +54,10 @@
         model = "Olimex A13-Olinuxino Micro";
         compatible = "olimex,a13-olinuxino-micro", "allwinner,sun5i-a13";
 
+        aliases {
+                serial0 = &uart1;
+        };
+
         soc@01c00000 {
                 mmc0: mmc@01c0f000 {
                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a13-olinuxino.dts b/arch/arm/boot/dts/sun5i-a13-olinuxino.dts
index e31d291d14cb..b421f7fa197b 100644
--- a/arch/arm/boot/dts/sun5i-a13-olinuxino.dts
+++ b/arch/arm/boot/dts/sun5i-a13-olinuxino.dts
@@ -55,6 +55,10 @@
         model = "Olimex A13-Olinuxino";
         compatible = "olimex,a13-olinuxino", "allwinner,sun5i-a13";
 
+        aliases {
+                serial0 = &uart1;
+        };
+
         soc@01c00000 {
                 mmc0: mmc@01c0f000 {
                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index c35217ea1f64..c556688f8b8b 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -16,11 +16,6 @@
 / {
         interrupt-parent = <&intc>;
 
-        aliases {
-                serial0 = &uart1;
-                serial1 = &uart3;
-        };
-
         cpus {
                 #address-cells = <1>;
                 #size-cells = <0>;
@@ -349,8 +344,8 @@
                         reg-names = "phy_ctrl", "pmu1";
                         clocks = <&usb_clk 8>;
                         clock-names = "usb_phy";
-                        resets = <&usb_clk 1>;
-                        reset-names = "usb1_reset";
+                        resets = <&usb_clk 0>, <&usb_clk 1>;
+                        reset-names = "usb0_reset", "usb1_reset";
                         status = "disabled";
                 };
 
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index f47156b6572b..1e7e7bcf8307 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -53,12 +53,6 @@
         interrupt-parent = <&gic>;
 
         aliases {
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
                 ethernet0 = &gmac;
         };
 
diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi.dts b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
index 1cf1214cc068..bd7b15add697 100644
--- a/arch/arm/boot/dts/sun7i-a20-bananapi.dts
+++ b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
@@ -55,6 +55,12 @@
         model = "LeMaker Banana Pi";
         compatible = "lemaker,bananapi", "allwinner,sun7i-a20";
 
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart3;
+                serial2 = &uart7;
+        };
+
         soc@01c00000 {
                 spi0: spi@01c05000 {
                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun7i-a20-hummingbird.dts b/arch/arm/boot/dts/sun7i-a20-hummingbird.dts
index 0e4bfa3b2b85..0bcefcbbb756 100644
--- a/arch/arm/boot/dts/sun7i-a20-hummingbird.dts
+++ b/arch/arm/boot/dts/sun7i-a20-hummingbird.dts
@@ -19,6 +19,14 @@
         model = "Merrii A20 Hummingbird";
         compatible = "merrii,a20-hummingbird", "allwinner,sun7i-a20";
 
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart2;
+                serial2 = &uart3;
+                serial3 = &uart4;
+                serial4 = &uart5;
+        };
+
         soc@01c00000 {
                 mmc0: mmc@01c0f000 {
                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts
index 9d669cdf031d..66cc77707198 100644
--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-micro.dts
@@ -20,6 +20,9 @@
         compatible = "olimex,a20-olinuxino-micro", "allwinner,sun7i-a20";
 
         aliases {
+                serial0 = &uart0;
+                serial1 = &uart6;
+                serial2 = &uart7;
                 spi0 = &spi1;
                 spi1 = &spi2;
         };
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index e21ce5992d56..89749ce34a84 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -54,14 +54,6 @@
 
         aliases {
                 ethernet0 = &gmac;
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
-                serial6 = &uart6;
-                serial7 = &uart7;
         };
 
         chosen {
diff --git a/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts b/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts
index 7f2117ce6985..32ad80804dbb 100644
--- a/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts
+++ b/arch/arm/boot/dts/sun8i-a23-ippo-q8h-v5.dts
@@ -55,6 +55,10 @@
         model = "Ippo Q8H Dual Core Tablet (v5)";
         compatible = "ippo,q8h-v5", "allwinner,sun8i-a23";
 
+        aliases {
+                serial0 = &r_uart;
+        };
+
         chosen {
                 bootargs = "earlyprintk console=ttyS0,115200";
         };
diff --git a/arch/arm/boot/dts/sun8i-a23.dtsi b/arch/arm/boot/dts/sun8i-a23.dtsi
index 0746cd1024d7..86584fcf5e32 100644
--- a/arch/arm/boot/dts/sun8i-a23.dtsi
+++ b/arch/arm/boot/dts/sun8i-a23.dtsi
@@ -52,15 +52,6 @@
 / {
         interrupt-parent = <&gic>;
 
-        aliases {
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &r_uart;
-        };
-
         cpus {
                 #address-cells = <1>;
                 #size-cells = <0>;
diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
index 506948f582ee..11ec71072e81 100644
--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
+++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
@@ -54,6 +54,11 @@
         model = "Merrii A80 Optimus Board";
         compatible = "merrii,a80-optimus", "allwinner,sun9i-a80";
 
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart4;
+        };
+
         chosen {
                 bootargs = "earlyprintk console=ttyS0,115200";
         };
diff --git a/arch/arm/boot/dts/sun9i-a80.dtsi b/arch/arm/boot/dts/sun9i-a80.dtsi
index 494714f67b57..9ef4438206a9 100644
--- a/arch/arm/boot/dts/sun9i-a80.dtsi
+++ b/arch/arm/boot/dts/sun9i-a80.dtsi
@@ -52,16 +52,6 @@
 / {
         interrupt-parent = <&gic>;
 
-        aliases {
-                serial0 = &uart0;
-                serial1 = &uart1;
-                serial2 = &uart2;
-                serial3 = &uart3;
-                serial4 = &uart4;
-                serial5 = &uart5;
-                serial6 = &r_uart;
-        };
-
         cpus {
                 #address-cells = <1>;
                 #size-cells = <0>;
diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h
index 66ce17655bb9..7b0152321b20 100644
--- a/arch/arm/include/asm/kvm_emulate.h
+++ b/arch/arm/include/asm/kvm_emulate.h
@@ -38,6 +38,16 @@ static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
         vcpu->arch.hcr = HCR_GUEST_MASK;
 }
 
+static inline unsigned long vcpu_get_hcr(struct kvm_vcpu *vcpu)
+{
+        return vcpu->arch.hcr;
+}
+
+static inline void vcpu_set_hcr(struct kvm_vcpu *vcpu, unsigned long hcr)
+{
+        vcpu->arch.hcr = hcr;
+}
+
 static inline bool vcpu_mode_is_32bit(struct kvm_vcpu *vcpu)
 {
         return 1;
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 254e0650e48b..04b4ea0b550a 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -125,9 +125,6 @@ struct kvm_vcpu_arch {
          * Anything that is not used directly from assembly code goes
          * here.
          */
-        /* dcache set/way operation pending */
-        int last_pcpu;
-        cpumask_t require_dcache_flush;
 
         /* Don't run the guest on this vcpu */
         bool pause;
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index 63e0ecc04901..1bca8f8af442 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -44,6 +44,7 @@
 
 #ifndef __ASSEMBLY__
 
+#include <linux/highmem.h>
 #include <asm/cacheflush.h>
 #include <asm/pgalloc.h>
 
@@ -161,13 +162,10 @@ static inline bool vcpu_has_cache_enabled(struct kvm_vcpu *vcpu)
         return (vcpu->arch.cp15[c1_SCTLR] & 0b101) == 0b101;
 }
 
-static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
-                                             unsigned long size,
-                                             bool ipa_uncached)
+static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
+                                               unsigned long size,
+                                               bool ipa_uncached)
 {
-        if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached)
-                kvm_flush_dcache_to_poc((void *)hva, size);
-        
         /*
          * If we are going to insert an instruction page and the icache is
          * either VIPT or PIPT, there is a potential problem where the host
@@ -179,18 +177,77 @@ static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
          *
          * VIVT caches are tagged using both the ASID and the VMID and doesn't
          * need any kind of flushing (DDI 0406C.b - Page B3-1392).
+         *
+         * We need to do this through a kernel mapping (using the
+         * user-space mapping has proved to be the wrong
+         * solution). For that, we need to kmap one page at a time,
+         * and iterate over the range.
          */
-        if (icache_is_pipt()) {
-                __cpuc_coherent_user_range(hva, hva + size);
-        } else if (!icache_is_vivt_asid_tagged()) {
+
+        bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached;
+
+        VM_BUG_ON(size & PAGE_MASK);
+
+        if (!need_flush && !icache_is_pipt())
+                goto vipt_cache;
+
+        while (size) {
+                void *va = kmap_atomic_pfn(pfn);
+
+                if (need_flush)
+                        kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+
+                if (icache_is_pipt())
+                        __cpuc_coherent_user_range((unsigned long)va,
+                                                   (unsigned long)va + PAGE_SIZE);
+
+                size -= PAGE_SIZE;
+                pfn++;
+
+                kunmap_atomic(va);
+        }
+
+vipt_cache:
+        if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) {
                 /* any kind of VIPT cache */
                 __flush_icache_all();
         }
 }
 
+static inline void __kvm_flush_dcache_pte(pte_t pte)
+{
+        void *va = kmap_atomic(pte_page(pte));
+
+        kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+
+        kunmap_atomic(va);
+}
+
+static inline void __kvm_flush_dcache_pmd(pmd_t pmd)
+{
+        unsigned long size = PMD_SIZE;
+        pfn_t pfn = pmd_pfn(pmd);
+
+        while (size) {
+                void *va = kmap_atomic_pfn(pfn);
+
+                kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+
+                pfn++;
+                size -= PAGE_SIZE;
+
+                kunmap_atomic(va);
+        }
+}
+
+static inline void __kvm_flush_dcache_pud(pud_t pud)
+{
+}
+
 #define kvm_virt_to_phys(x)             virt_to_idmap((unsigned long)(x))
 
-void stage2_flush_vm(struct kvm *kvm);
+void kvm_set_way_flush(struct kvm_vcpu *vcpu);
+void kvm_toggle_cache(struct kvm_vcpu *vcpu, bool was_enabled);
 
 #endif  /* !__ASSEMBLY__ */
 
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 2d6d91001062..0b0d58a905c4 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -281,15 +281,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
         vcpu->cpu = cpu;
         vcpu->arch.host_cpu_context = this_cpu_ptr(kvm_host_cpu_state);
 
-        /*
-         * Check whether this vcpu requires the cache to be flushed on
-         * this physical CPU. This is a consequence of doing dcache
-         * operations by set/way on this vcpu. We do it here to be in
-         * a non-preemptible section.
-         */
-        if (cpumask_test_and_clear_cpu(cpu, &vcpu->arch.require_dcache_flush))
-                flush_cache_all(); /* We'd really want v7_flush_dcache_all() */
-
         kvm_arm_set_running_vcpu(vcpu);
 }
 
@@ -541,7 +532,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                 ret = kvm_call_hyp(__kvm_vcpu_run, vcpu);
 
                 vcpu->mode = OUTSIDE_GUEST_MODE;
-                vcpu->arch.last_pcpu = smp_processor_id();
                 kvm_guest_exit();
                 trace_kvm_exit(*vcpu_pc(vcpu));
                 /*
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 7928dbdf2102..f3d88dc388bc 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -189,82 +189,40 @@ static bool access_l2ectlr(struct kvm_vcpu *vcpu,
         return true;
 }
 
-/* See note at ARM ARM B1.14.4 */
+/*
+ * See note at ARMv7 ARM B1.14.4 (TL;DR: S/W ops are not easily virtualized).
+ */
 static bool access_dcsw(struct kvm_vcpu *vcpu,
                         const struct coproc_params *p,
                         const struct coproc_reg *r)
 {
-        unsigned long val;
-        int cpu;
-
         if (!p->is_write)
                 return read_from_write_only(vcpu, p);
 
-        cpu = get_cpu();
-
-        cpumask_setall(&vcpu->arch.require_dcache_flush);
-        cpumask_clear_cpu(cpu, &vcpu->arch.require_dcache_flush);
-
-        /* If we were already preempted, take the long way around */
-        if (cpu != vcpu->arch.last_pcpu) {
-                flush_cache_all();
-                goto done;
-        }
-
-        val = *vcpu_reg(vcpu, p->Rt1);
-
-        switch (p->CRm) {
-        case 6:                 /* Upgrade DCISW to DCCISW, as per HCR.SWIO */
-        case 14:                /* DCCISW */
-                asm volatile("mcr p15, 0, %0, c7, c14, 2" : : "r" (val));
-                break;
-
-        case 10:                /* DCCSW */
-                asm volatile("mcr p15, 0, %0, c7, c10, 2" : : "r" (val));
-                break;
-        }
-
-done:
-        put_cpu();
-
+        kvm_set_way_flush(vcpu);
         return true;
 }
 
 /*
  * Generic accessor for VM registers. Only called as long as HCR_TVM
- * is set.
+ * is set.  If the guest enables the MMU, we stop trapping the VM
+ * sys_regs and leave it in complete control of the caches.
+ *
+ * Used by the cpu-specific code.
  */
-static bool access_vm_reg(struct kvm_vcpu *vcpu,
-                          const struct coproc_params *p,
-                          const struct coproc_reg *r)
+bool access_vm_reg(struct kvm_vcpu *vcpu,
+                   const struct coproc_params *p,
+                   const struct coproc_reg *r)
 {
+        bool was_enabled = vcpu_has_cache_enabled(vcpu);
+
         BUG_ON(!p->is_write);
 
         vcpu->arch.cp15[r->reg] = *vcpu_reg(vcpu, p->Rt1);
         if (p->is_64bit)
                 vcpu->arch.cp15[r->reg + 1] = *vcpu_reg(vcpu, p->Rt2);
 
-        return true;
-}
-
-/*
- * SCTLR accessor. Only called as long as HCR_TVM is set.  If the
- * guest enables the MMU, we stop trapping the VM sys_regs and leave
- * it in complete control of the caches.
- *
- * Used by the cpu-specific code.
- */
-bool access_sctlr(struct kvm_vcpu *vcpu,
-                  const struct coproc_params *p,
-                  const struct coproc_reg *r)
-{
-        access_vm_reg(vcpu, p, r);
-
-        if (vcpu_has_cache_enabled(vcpu)) {     /* MMU+Caches enabled? */
-                vcpu->arch.hcr &= ~HCR_TVM;
-                stage2_flush_vm(vcpu->kvm);
-        }
-
+        kvm_toggle_cache(vcpu, was_enabled);
         return true;
 }
 
diff --git a/arch/arm/kvm/coproc.h b/arch/arm/kvm/coproc.h
index 1a44bbe39643..88d24a3a9778 100644
--- a/arch/arm/kvm/coproc.h
+++ b/arch/arm/kvm/coproc.h
@@ -153,8 +153,8 @@ static inline int cmp_reg(const struct coproc_reg *i1,
 #define is64            .is_64 = true
 #define is32            .is_64 = false
 
-bool access_sctlr(struct kvm_vcpu *vcpu,
-                  const struct coproc_params *p,
-                  const struct coproc_reg *r);
+bool access_vm_reg(struct kvm_vcpu *vcpu,
+                   const struct coproc_params *p,
+                   const struct coproc_reg *r);
 
 #endif /* __ARM_KVM_COPROC_LOCAL_H__ */
diff --git a/arch/arm/kvm/coproc_a15.c b/arch/arm/kvm/coproc_a15.c
index e6f4ae48bda9..a7136757d373 100644
--- a/arch/arm/kvm/coproc_a15.c
+++ b/arch/arm/kvm/coproc_a15.c
@@ -34,7 +34,7 @@
 static const struct coproc_reg a15_regs[] = {
         /* SCTLR: swapped by interrupt.S. */
         { CRn( 1), CRm( 0), Op1( 0), Op2( 0), is32,
-                        access_sctlr, reset_val, c1_SCTLR, 0x00C50078 },
+                        access_vm_reg, reset_val, c1_SCTLR, 0x00C50078 },
 };
 
 static struct kvm_coproc_target_table a15_target_table = {
diff --git a/arch/arm/kvm/coproc_a7.c b/arch/arm/kvm/coproc_a7.c
index 17fc7cd479d3..b19e46d1b2c0 100644
--- a/arch/arm/kvm/coproc_a7.c
+++ b/arch/arm/kvm/coproc_a7.c
@@ -37,7 +37,7 @@
 static const struct coproc_reg a7_regs[] = {
         /* SCTLR: swapped by interrupt.S. */
         { CRn( 1), CRm( 0), Op1( 0), Op2( 0), is32,
-                        access_sctlr, reset_val, c1_SCTLR, 0x00C50878 },
+                        access_vm_reg, reset_val, c1_SCTLR, 0x00C50878 },
 };
 
 static struct kvm_coproc_target_table a7_target_table = {
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 1dc9778a00af..136662547ca6 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -58,6 +58,26 @@ static void kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
                 kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, kvm, ipa);
 }
 
+/*
+ * D-Cache management functions. They take the page table entries by
+ * value, as they are flushing the cache using the kernel mapping (or
+ * kmap on 32bit).
+ */
+static void kvm_flush_dcache_pte(pte_t pte)
+{
+        __kvm_flush_dcache_pte(pte);
+}
+
+static void kvm_flush_dcache_pmd(pmd_t pmd)
+{
+        __kvm_flush_dcache_pmd(pmd);
+}
+
+static void kvm_flush_dcache_pud(pud_t pud)
+{
+        __kvm_flush_dcache_pud(pud);
+}
+
 static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
                                   int min, int max)
 {
@@ -119,6 +139,26 @@ static void clear_pmd_entry(struct kvm *kvm, pmd_t *pmd, phys_addr_t addr)
         put_page(virt_to_page(pmd));
 }
 
+/*
+ * Unmapping vs dcache management:
+ *
+ * If a guest maps certain memory pages as uncached, all writes will
+ * bypass the data cache and go directly to RAM.  However, the CPUs
+ * can still speculate reads (not writes) and fill cache lines with
+ * data.
+ *
+ * Those cache lines will be *clean* cache lines though, so a
+ * clean+invalidate operation is equivalent to an invalidate
+ * operation, because no cache lines are marked dirty.
+ *
+ * Those clean cache lines could be filled prior to an uncached write
+ * by the guest, and the cache coherent IO subsystem would therefore
+ * end up writing old data to disk.
+ *
+ * This is why right after unmapping a page/section and invalidating
+ * the corresponding TLBs, we call kvm_flush_dcache_p*() to make sure
+ * the IO subsystem will never hit in the cache.
+ */
 static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
                        phys_addr_t addr, phys_addr_t end)
 {
@@ -128,9 +168,16 @@ static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
         start_pte = pte = pte_offset_kernel(pmd, addr);
         do {
                 if (!pte_none(*pte)) {
+                        pte_t old_pte = *pte;
+
                         kvm_set_pte(pte, __pte(0));
-                        put_page(virt_to_page(pte));
                         kvm_tlb_flush_vmid_ipa(kvm, addr);
+
+                        /* No need to invalidate the cache for device mappings */
+                        if ((pte_val(old_pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
+                                kvm_flush_dcache_pte(old_pte);
+
+                        put_page(virt_to_page(pte));
                 }
         } while (pte++, addr += PAGE_SIZE, addr != end);
 
@@ -149,8 +196,13 @@ static void unmap_pmds(struct kvm *kvm, pud_t *pud,
                 next = kvm_pmd_addr_end(addr, end);
                 if (!pmd_none(*pmd)) {
                         if (kvm_pmd_huge(*pmd)) {
+                                pmd_t old_pmd = *pmd;
+
                                 pmd_clear(pmd);
                                 kvm_tlb_flush_vmid_ipa(kvm, addr);
+
+                                kvm_flush_dcache_pmd(old_pmd);
+
                                 put_page(virt_to_page(pmd));
                         } else {
                                 unmap_ptes(kvm, pmd, addr, next);
@@ -173,8 +225,13 @@ static void unmap_puds(struct kvm *kvm, pgd_t *pgd,
                 next = kvm_pud_addr_end(addr, end);
                 if (!pud_none(*pud)) {
                         if (pud_huge(*pud)) {
+                                pud_t old_pud = *pud;
+
                                 pud_clear(pud);
                                 kvm_tlb_flush_vmid_ipa(kvm, addr);
+
+                                kvm_flush_dcache_pud(old_pud);
+
                                 put_page(virt_to_page(pud));
                         } else {
                                 unmap_pmds(kvm, pud, addr, next);
@@ -209,10 +266,9 @@ static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd,
 
         pte = pte_offset_kernel(pmd, addr);
         do {
-                if (!pte_none(*pte)) {
-                        hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
-                        kvm_flush_dcache_to_poc((void*)hva, PAGE_SIZE);
-                }
+                if (!pte_none(*pte) &&
+                    (pte_val(*pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
+                        kvm_flush_dcache_pte(*pte);
         } while (pte++, addr += PAGE_SIZE, addr != end);
 }
 
@@ -226,12 +282,10 @@ static void stage2_flush_pmds(struct kvm *kvm, pud_t *pud,
         do {
                 next = kvm_pmd_addr_end(addr, end);
                 if (!pmd_none(*pmd)) {
-                        if (kvm_pmd_huge(*pmd)) {
-                                hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
-                                kvm_flush_dcache_to_poc((void*)hva, PMD_SIZE);
-                        } else {
+                        if (kvm_pmd_huge(*pmd))
+                                kvm_flush_dcache_pmd(*pmd);
+                        else
                                 stage2_flush_ptes(kvm, pmd, addr, next);
-                        }
                 }
         } while (pmd++, addr = next, addr != end);
 }
@@ -246,12 +300,10 @@ static void stage2_flush_puds(struct kvm *kvm, pgd_t *pgd,
         do {
                 next = kvm_pud_addr_end(addr, end);
                 if (!pud_none(*pud)) {
-                        if (pud_huge(*pud)) {
-                                hva_t hva = gfn_to_hva(kvm, addr >> PAGE_SHIFT);
-                                kvm_flush_dcache_to_poc((void*)hva, PUD_SIZE);
-                        } else {
+                        if (pud_huge(*pud))
+                                kvm_flush_dcache_pud(*pud);
+                        else
                                 stage2_flush_pmds(kvm, pud, addr, next);
-                        }
                 }
         } while (pud++, addr = next, addr != end);
 }
@@ -278,7 +330,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
  * Go through the stage 2 page tables and invalidate any cache lines
  * backing memory already mapped to the VM.
  */
-void stage2_flush_vm(struct kvm *kvm)
+static void stage2_flush_vm(struct kvm *kvm)
 {
         struct kvm_memslots *slots;
         struct kvm_memory_slot *memslot;
@@ -905,6 +957,12 @@ static bool kvm_is_device_pfn(unsigned long pfn)
         return !pfn_valid(pfn);
 }
 
+static void coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
+                                      unsigned long size, bool uncached)
+{
+        __coherent_cache_guest_page(vcpu, pfn, size, uncached);
+}
+
 static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                           struct kvm_memory_slot *memslot, unsigned long hva,
                           unsigned long fault_status)
@@ -994,8 +1052,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                         kvm_set_s2pmd_writable(&new_pmd);
                         kvm_set_pfn_dirty(pfn);
                 }
-                coherent_cache_guest_page(vcpu, hva & PMD_MASK, PMD_SIZE,
-                                          fault_ipa_uncached);
+                coherent_cache_guest_page(vcpu, pfn, PMD_SIZE, fault_ipa_uncached);
                 ret = stage2_set_pmd_huge(kvm, memcache, fault_ipa, &new_pmd);
         } else {
                 pte_t new_pte = pfn_pte(pfn, mem_type);
@@ -1003,8 +1060,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                         kvm_set_s2pte_writable(&new_pte);
                         kvm_set_pfn_dirty(pfn);
                 }
-                coherent_cache_guest_page(vcpu, hva, PAGE_SIZE,
-                                          fault_ipa_uncached);
+                coherent_cache_guest_page(vcpu, pfn, PAGE_SIZE, fault_ipa_uncached);
                 ret = stage2_set_pte(kvm, memcache, fault_ipa, &new_pte,
                         pgprot_val(mem_type) == pgprot_val(PAGE_S2_DEVICE));
         }
@@ -1411,3 +1467,71 @@ void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
         unmap_stage2_range(kvm, gpa, size);
         spin_unlock(&kvm->mmu_lock);
 }
+
+/*
+ * See note at ARMv7 ARM B1.14.4 (TL;DR: S/W ops are not easily virtualized).
+ *
+ * Main problems:
+ * - S/W ops are local to a CPU (not broadcast)
+ * - We have line migration behind our back (speculation)
+ * - System caches don't support S/W at all (damn!)
+ *
+ * In the face of the above, the best we can do is to try and convert
+ * S/W ops to VA ops. Because the guest is not allowed to infer the
+ * S/W to PA mapping, it can only use S/W to nuke the whole cache,
+ * which is a rather good thing for us.
+ *
+ * Also, it is only used when turning caches on/off ("The expected
+ * usage of the cache maintenance instructions that operate by set/way
+ * is associated with the cache maintenance instructions associated
+ * with the powerdown and powerup of caches, if this is required by
+ * the implementation.").
+ *
+ * We use the following policy:
+ *
+ * - If we trap a S/W operation, we enable VM trapping to detect
+ *   caches being turned on/off, and do a full clean.
+ *
+ * - We flush the caches on both caches being turned on and off.
+ *
+ * - Once the caches are enabled, we stop trapping VM ops.
+ */
+void kvm_set_way_flush(struct kvm_vcpu *vcpu)
+{
+        unsigned long hcr = vcpu_get_hcr(vcpu);
+
+        /*
+         * If this is the first time we do a S/W operation
+         * (i.e. HCR_TVM not set) flush the whole memory, and set the
+         * VM trapping.
+         *
+         * Otherwise, rely on the VM trapping to wait for the MMU +
+         * Caches to be turned off. At that point, we'll be able to
+         * clean the caches again.
+         */
+        if (!(hcr & HCR_TVM)) {
+                trace_kvm_set_way_flush(*vcpu_pc(vcpu),
+                                        vcpu_has_cache_enabled(vcpu));
+                stage2_flush_vm(vcpu->kvm);
+                vcpu_set_hcr(vcpu, hcr | HCR_TVM);
+        }
+}
+
+void kvm_toggle_cache(struct kvm_vcpu *vcpu, bool was_enabled)
+{
+        bool now_enabled = vcpu_has_cache_enabled(vcpu);
+
+        /*
+         * If switching the MMU+caches on, need to invalidate the caches.
+         * If switching it off, need to clean the caches.
+         * Clean + invalidate does the trick always.
+         */
+        if (now_enabled != was_enabled)
+                stage2_flush_vm(vcpu->kvm);
+
+        /* Caches are now on, stop trapping VM ops (until a S/W op) */
+        if (now_enabled)
+                vcpu_set_hcr(vcpu, vcpu_get_hcr(vcpu) & ~HCR_TVM);
+
+        trace_kvm_toggle_cache(*vcpu_pc(vcpu), was_enabled, now_enabled);
+}
diff --git a/arch/arm/kvm/trace.h b/arch/arm/kvm/trace.h
index b1d640f78623..b6a6e7102201 100644
--- a/arch/arm/kvm/trace.h
+++ b/arch/arm/kvm/trace.h
@@ -223,6 +223,45 @@ TRACE_EVENT(kvm_hvc,
                   __entry->vcpu_pc, __entry->r0, __entry->imm)
 );
 
+TRACE_EVENT(kvm_set_way_flush,
+            TP_PROTO(unsigned long vcpu_pc, bool cache),
+            TP_ARGS(vcpu_pc, cache),
+
+            TP_STRUCT__entry(
+                    __field(    unsigned long,  vcpu_pc         )
+                    __field(    bool,           cache           )
+            ),
+
+            TP_fast_assign(
+                    __entry->vcpu_pc            = vcpu_pc;
+                    __entry->cache              = cache;
+            ),
+
+            TP_printk("S/W flush at 0x%016lx (cache %s)",
+                      __entry->vcpu_pc, __entry->cache ? "on" : "off")
+);
+
+TRACE_EVENT(kvm_toggle_cache,
+            TP_PROTO(unsigned long vcpu_pc, bool was, bool now),
+            TP_ARGS(vcpu_pc, was, now),
+
+            TP_STRUCT__entry(
+                    __field(    unsigned long,  vcpu_pc         )
+                    __field(    bool,           was             )
+                    __field(    bool,           now             )
+            ),
+
+            TP_fast_assign(
+                    __entry->vcpu_pc            = vcpu_pc;
+                    __entry->was                = was;
+                    __entry->now                = now;
+            ),
+
+            TP_printk("VM op at 0x%016lx (cache was %s, now %s)",
+                      __entry->vcpu_pc, __entry->was ? "on" : "off",
+                      __entry->now ? "on" : "off")
+);
+
 #endif /* _TRACE_KVM_H */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index caa21e9b8cd9..ccef8806bb58 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -190,6 +190,13 @@ static void __init armada_375_380_coherency_init(struct device_node *np)
         arch_ioremap_caller = armada_pcie_wa_ioremap_caller;
 
         /*
+         * We should switch the PL310 to I/O coherency mode only if
+         * I/O coherency is actually enabled.
+         */
+        if (!coherency_available())
+                return;
+
+        /*
          * Add the PL310 property "arm,io-coherent". This makes sure the
          * outer sync operation is not used, which allows to
          * workaround the system erratum that causes deadlocks when
diff --git a/arch/arm/mach-shmobile/board-ape6evm.c b/arch/arm/mach-shmobile/board-ape6evm.c
index 66f67816a844..444f22d370f0 100644
--- a/arch/arm/mach-shmobile/board-ape6evm.c
+++ b/arch/arm/mach-shmobile/board-ape6evm.c
@@ -18,6 +18,8 @@
 #include <linux/gpio_keys.h>
 #include <linux/input.h>
 #include <linux/interrupt.h>
+#include <linux/irqchip.h>
+#include <linux/irqchip/arm-gic.h>
 #include <linux/kernel.h>
 #include <linux/mfd/tmio.h>
 #include <linux/mmc/host.h>
@@ -273,6 +275,22 @@ static void __init ape6evm_add_standard_devices(void)
                                       sizeof(ape6evm_leds_pdata));
 }
 
+static void __init ape6evm_legacy_init_time(void)
+{
+        /* Do not invoke DT-based timers via clocksource_of_init() */
+}
+
+static void __init ape6evm_legacy_init_irq(void)
+{
+        void __iomem *gic_dist_base = ioremap_nocache(0xf1001000, 0x1000);
+        void __iomem *gic_cpu_base = ioremap_nocache(0xf1002000, 0x1000);
+
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+
+        /* Do not invoke DT-based interrupt code via irqchip_init() */
+}
+
+
 static const char *ape6evm_boards_compat_dt[] __initdata = {
         "renesas,ape6evm",
         NULL,
@@ -280,7 +298,9 @@ static const char *ape6evm_boards_compat_dt[] __initdata = {
 
 DT_MACHINE_START(APE6EVM_DT, "ape6evm")
         .init_early     = shmobile_init_delay,
+        .init_irq       = ape6evm_legacy_init_irq,
         .init_machine   = ape6evm_add_standard_devices,
         .init_late      = shmobile_init_late,
         .dt_compat      = ape6evm_boards_compat_dt,
+        .init_time      = ape6evm_legacy_init_time,
 MACHINE_END
diff --git a/arch/arm/mach-shmobile/board-lager.c b/arch/arm/mach-shmobile/board-lager.c
index f8197eb6e566..65b128dd4072 100644
--- a/arch/arm/mach-shmobile/board-lager.c
+++ b/arch/arm/mach-shmobile/board-lager.c
@@ -21,6 +21,8 @@
 #include <linux/input.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/irqchip.h>
+#include <linux/irqchip/arm-gic.h>
 #include <linux/kernel.h>
 #include <linux/leds.h>
 #include <linux/mfd/tmio.h>
@@ -811,6 +813,16 @@ static void __init lager_init(void)
                                           lager_ksz8041_fixup);
 }
 
+static void __init lager_legacy_init_irq(void)
+{
+        void __iomem *gic_dist_base = ioremap_nocache(0xf1001000, 0x1000);
+        void __iomem *gic_cpu_base = ioremap_nocache(0xf1002000, 0x1000);
+
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+
+        /* Do not invoke DT-based interrupt code via irqchip_init() */
+}
+
 static const char * const lager_boards_compat_dt[] __initconst = {
         "renesas,lager",
         NULL,
@@ -819,6 +831,7 @@ static const char * const lager_boards_compat_dt[] __initconst = {
 DT_MACHINE_START(LAGER_DT, "lager")
         .smp            = smp_ops(r8a7790_smp_ops),
         .init_early     = shmobile_init_delay,
+        .init_irq       = lager_legacy_init_irq,
         .init_time      = rcar_gen2_timer_init,
         .init_machine   = lager_init,
         .init_late      = shmobile_init_late,
diff --git a/arch/arm/mach-shmobile/setup-rcar-gen2.c b/arch/arm/mach-shmobile/setup-rcar-gen2.c
index 3dd6edd9bd1d..cc9470dfb1ce 100644
--- a/arch/arm/mach-shmobile/setup-rcar-gen2.c
+++ b/arch/arm/mach-shmobile/setup-rcar-gen2.c
@@ -133,7 +133,9 @@ void __init rcar_gen2_timer_init(void)
 #ifdef CONFIG_COMMON_CLK
         rcar_gen2_clocks_init(mode);
 #endif
+#ifdef CONFIG_ARCH_SHMOBILE_MULTI
         clocksource_of_init();
+#endif
 }
 
 struct memory_reserve_config {
diff --git a/arch/arm/mach-shmobile/timer.c b/arch/arm/mach-shmobile/timer.c
index f1d027aa7a81..0edf2a6d2bbe 100644
--- a/arch/arm/mach-shmobile/timer.c
+++ b/arch/arm/mach-shmobile/timer.c
@@ -70,6 +70,18 @@ void __init shmobile_init_delay(void)
         if (!max_freq)
                 return;
 
+#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
+        /* Non-multiplatform r8a73a4 SoC cannot use arch timer due
+         * to GIC being initialized from C and arch timer via DT */
+        if (of_machine_is_compatible("renesas,r8a73a4"))
+                has_arch_timer = false;
+
+        /* Non-multiplatform r8a7790 SoC cannot use arch timer due
+         * to GIC being initialized from C and arch timer via DT */
+        if (of_machine_is_compatible("renesas,r8a7790"))
+                has_arch_timer = false;
+#endif
+
         if (!has_arch_timer || !IS_ENABLED(CONFIG_ARM_ARCH_TIMER)) {
                 if (is_a7_a8_a9)
                         shmobile_setup_delay_hz(max_freq, 1, 3);
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 7864797609b3..a673c7f7e208 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1940,13 +1940,32 @@ void arm_iommu_release_mapping(struct dma_iommu_mapping *mapping)
 }
 EXPORT_SYMBOL_GPL(arm_iommu_release_mapping);
 
+static int __arm_iommu_attach_device(struct device *dev,
+                                     struct dma_iommu_mapping *mapping)
+{
+        int err;
+
+        err = iommu_attach_device(mapping->domain, dev);
+        if (err)
+                return err;
+
+        kref_get(&mapping->kref);
+        dev->archdata.mapping = mapping;
+
+        pr_debug("Attached IOMMU controller to %s device.\n", dev_name(dev));
+        return 0;
+}
+
 /**
  * arm_iommu_attach_device
  * @dev: valid struct device pointer
  * @mapping: io address space mapping structure (returned from
  *      arm_iommu_create_mapping)
  *
- * Attaches specified io address space mapping to the provided device,
+ * Attaches specified io address space mapping to the provided device.
+ * This replaces the dma operations (dma_map_ops pointer) with the
+ * IOMMU aware version.
+ *
  * More than one client might be attached to the same io address space
  * mapping.
  */
@@ -1955,25 +1974,16 @@ int arm_iommu_attach_device(struct device *dev,
 {
         int err;
 
-        err = iommu_attach_device(mapping->domain, dev);
+        err = __arm_iommu_attach_device(dev, mapping);
         if (err)
                 return err;
 
-        kref_get(&mapping->kref);
-        dev->archdata.mapping = mapping;
-
-        pr_debug("Attached IOMMU controller to %s device.\n", dev_name(dev));
+        set_dma_ops(dev, &iommu_ops);
         return 0;
 }
 EXPORT_SYMBOL_GPL(arm_iommu_attach_device);
 
-/**
- * arm_iommu_detach_device
- * @dev: valid struct device pointer
- *
- * Detaches the provided device from a previously attached map.
- */
-void arm_iommu_detach_device(struct device *dev)
+static void __arm_iommu_detach_device(struct device *dev)
 {
         struct dma_iommu_mapping *mapping;
 
@@ -1989,6 +1999,19 @@ void arm_iommu_detach_device(struct device *dev)
 
         pr_debug("Detached IOMMU controller from %s device.\n", dev_name(dev));
 }
+
+/**
+ * arm_iommu_detach_device
+ * @dev: valid struct device pointer
+ *
+ * Detaches the provided device from a previously attached map.
+ * This voids the dma operations (dma_map_ops pointer)
+ */
+void arm_iommu_detach_device(struct device *dev)
+{
+        __arm_iommu_detach_device(dev);
+        set_dma_ops(dev, NULL);
+}
 EXPORT_SYMBOL_GPL(arm_iommu_detach_device);
 
 static struct dma_map_ops *arm_get_iommu_dma_map_ops(bool coherent)
@@ -2011,7 +2034,7 @@ static bool arm_setup_iommu_dma_ops(struct device *dev, u64 dma_base, u64 size,
                 return false;
         }
 
-        if (arm_iommu_attach_device(dev, mapping)) {
+        if (__arm_iommu_attach_device(dev, mapping)) {
                 pr_warn("Failed to attached device %s to IOMMU_mapping\n",
                                 dev_name(dev));
                 arm_iommu_release_mapping(mapping);
@@ -2025,7 +2048,7 @@ static void arm_teardown_iommu_dma_ops(struct device *dev)
 {
         struct dma_iommu_mapping *mapping = dev->archdata.mapping;
 
-        arm_iommu_detach_device(dev);
+        __arm_iommu_detach_device(dev);
         arm_iommu_release_mapping(mapping);
 }
 
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 865a7e28ea2d..3cb4c856b10d 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -45,6 +45,16 @@ static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
                 vcpu->arch.hcr_el2 &= ~HCR_RW;
 }
 
+static inline unsigned long vcpu_get_hcr(struct kvm_vcpu *vcpu)
+{
+        return vcpu->arch.hcr_el2;
+}
+
+static inline void vcpu_set_hcr(struct kvm_vcpu *vcpu, unsigned long hcr)
+{
+        vcpu->arch.hcr_el2 = hcr;
+}
+
 static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu)
 {
         return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.pc;
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 0b7dfdb931df..acd101a9014d 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -116,9 +116,6 @@ struct kvm_vcpu_arch {
          * Anything that is not used directly from assembly code goes
          * here.
          */
-        /* dcache set/way operation pending */
-        int last_pcpu;
-        cpumask_t require_dcache_flush;
 
         /* Don't run the guest */
         bool pause;
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 14a74f136272..adcf49547301 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -243,24 +243,46 @@ static inline bool vcpu_has_cache_enabled(struct kvm_vcpu *vcpu)
         return (vcpu_sys_reg(vcpu, SCTLR_EL1) & 0b101) == 0b101;
 }
 
-static inline void coherent_cache_guest_page(struct kvm_vcpu *vcpu, hva_t hva,
-                                             unsigned long size,
-                                             bool ipa_uncached)
+static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
+                                               unsigned long size,
+                                               bool ipa_uncached)
 {
+        void *va = page_address(pfn_to_page(pfn));
+
         if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached)
-                kvm_flush_dcache_to_poc((void *)hva, size);
+                kvm_flush_dcache_to_poc(va, size);
 
         if (!icache_is_aliasing()) {            /* PIPT */
-                flush_icache_range(hva, hva + size);
+                flush_icache_range((unsigned long)va,
+                                   (unsigned long)va + size);
         } else if (!icache_is_aivivt()) {       /* non ASID-tagged VIVT */
                 /* any kind of VIPT cache */
                 __flush_icache_all();
         }
 }
 
+static inline void __kvm_flush_dcache_pte(pte_t pte)
+{
+        struct page *page = pte_page(pte);
+        kvm_flush_dcache_to_poc(page_address(page), PAGE_SIZE);
+}
+
+static inline void __kvm_flush_dcache_pmd(pmd_t pmd)
+{
+        struct page *page = pmd_page(pmd);
+        kvm_flush_dcache_to_poc(page_address(page), PMD_SIZE);
+}
+
+static inline void __kvm_flush_dcache_pud(pud_t pud)
+{
+        struct page *page = pud_page(pud);
+        kvm_flush_dcache_to_poc(page_address(page), PUD_SIZE);
+}
+
 #define kvm_virt_to_phys(x)             __virt_to_phys((unsigned long)(x))
 
-void stage2_flush_vm(struct kvm *kvm);
+void kvm_set_way_flush(struct kvm_vcpu *vcpu);
+void kvm_toggle_cache(struct kvm_vcpu *vcpu, bool was_enabled);
 
 #endif /* __ASSEMBLY__ */
 #endif /* __ARM64_KVM_MMU_H__ */
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 3d7c2df89946..f31e8bb2bc5b 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -69,68 +69,31 @@ static u32 get_ccsidr(u32 csselr)
         return ccsidr;
 }
 
-static void do_dc_cisw(u32 val)
-{
-        asm volatile("dc cisw, %x0" : : "r" (val));
-        dsb(ish);
-}
-
-static void do_dc_csw(u32 val)
-{
-        asm volatile("dc csw, %x0" : : "r" (val));
-        dsb(ish);
-}
-
-/* See note at ARM ARM B1.14.4 */
+/*
+ * See note at ARMv7 ARM B1.14.4 (TL;DR: S/W ops are not easily virtualized).
+ */
 static bool access_dcsw(struct kvm_vcpu *vcpu,
                         const struct sys_reg_params *p,
                         const struct sys_reg_desc *r)
 {
-        unsigned long val;
-        int cpu;
-
         if (!p->is_write)
                 return read_from_write_only(vcpu, p);
 
-        cpu = get_cpu();
-
-        cpumask_setall(&vcpu->arch.require_dcache_flush);
-        cpumask_clear_cpu(cpu, &vcpu->arch.require_dcache_flush);
-
-        /* If we were already preempted, take the long way around */
-        if (cpu != vcpu->arch.last_pcpu) {
-                flush_cache_all();
-                goto done;
-        }
-
-        val = *vcpu_reg(vcpu, p->Rt);
-
-        switch (p->CRm) {
-        case 6:                 /* Upgrade DCISW to DCCISW, as per HCR.SWIO */
-        case 14:                /* DCCISW */
-                do_dc_cisw(val);
-                break;
-
-        case 10:                /* DCCSW */
-                do_dc_csw(val);
-                break;
-        }
-
-done:
-        put_cpu();
-
+        kvm_set_way_flush(vcpu);
         return true;
 }
 
 /*
  * Generic accessor for VM registers. Only called as long as HCR_TVM
- * is set.
+ * is set. If the guest enables the MMU, we stop trapping the VM
+ * sys_regs and leave it in complete control of the caches.
  */
 static bool access_vm_reg(struct kvm_vcpu *vcpu,
                           const struct sys_reg_params *p,
                           const struct sys_reg_desc *r)
 {
         unsigned long val;
+        bool was_enabled = vcpu_has_cache_enabled(vcpu);
 
         BUG_ON(!p->is_write);
 
@@ -143,25 +106,7 @@ static bool access_vm_reg(struct kvm_vcpu *vcpu,
                 vcpu_cp15_64_low(vcpu, r->reg) = val & 0xffffffffUL;
         }
 
-        return true;
-}
-
-/*
- * SCTLR_EL1 accessor. Only called as long as HCR_TVM is set.  If the
- * guest enables the MMU, we stop trapping the VM sys_regs and leave
- * it in complete control of the caches.
- */
-static bool access_sctlr(struct kvm_vcpu *vcpu,
-                         const struct sys_reg_params *p,
-                         const struct sys_reg_desc *r)
-{
-        access_vm_reg(vcpu, p, r);
-
-        if (vcpu_has_cache_enabled(vcpu)) {     /* MMU+Caches enabled? */
-                vcpu->arch.hcr_el2 &= ~HCR_TVM;
-                stage2_flush_vm(vcpu->kvm);
-        }
-
+        kvm_toggle_cache(vcpu, was_enabled);
         return true;
 }
 
@@ -377,7 +322,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
           NULL, reset_mpidr, MPIDR_EL1 },
         /* SCTLR_EL1 */
         { Op0(0b11), Op1(0b000), CRn(0b0001), CRm(0b0000), Op2(0b000),
-          access_sctlr, reset_val, SCTLR_EL1, 0x00C50078 },
+          access_vm_reg, reset_val, SCTLR_EL1, 0x00C50078 },
         /* CPACR_EL1 */
         { Op0(0b11), Op1(0b000), CRn(0b0001), CRm(0b0000), Op2(0b010),
           NULL, reset_val, CPACR_EL1, 0 },
@@ -657,7 +602,7 @@ static const struct sys_reg_desc cp14_64_regs[] = {
  * register).
  */
 static const struct sys_reg_desc cp15_regs[] = {
-        { Op1( 0), CRn( 1), CRm( 0), Op2( 0), access_sctlr, NULL, c1_SCTLR },
+        { Op1( 0), CRn( 1), CRm( 0), Op2( 0), access_vm_reg, NULL, c1_SCTLR },
         { Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 },
         { Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 },
         { Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, c2_TTBCR },
diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
index 0eca93327195..d223a8b57c1e 100644
--- a/arch/avr32/mm/fault.c
+++ b/arch/avr32/mm/fault.c
@@ -142,6 +142,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c
index 1790f22e71a2..2686a7aa8ec8 100644
--- a/arch/cris/mm/fault.c
+++ b/arch/cris/mm/fault.c
@@ -176,6 +176,8 @@ retry:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c
index 9a66372fc7c7..ec4917ddf678 100644
--- a/arch/frv/mm/fault.c
+++ b/arch/frv/mm/fault.c
@@ -168,6 +168,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
index 7225dad87094..ba5ba7accd0d 100644
--- a/arch/ia64/mm/fault.c
+++ b/arch/ia64/mm/fault.c
@@ -172,6 +172,8 @@ retry:
                  */
                 if (fault & VM_FAULT_OOM) {
                         goto out_of_memory;
+                } else if (fault & VM_FAULT_SIGSEGV) {
+                        goto bad_area;
                 } else if (fault & VM_FAULT_SIGBUS) {
                         signal = SIGBUS;
                         goto bad_area;
diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c
index e9c6a8014bd6..e3d4d4890104 100644
--- a/arch/m32r/mm/fault.c
+++ b/arch/m32r/mm/fault.c
@@ -200,6 +200,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
index 2bd7487440c4..b2f04aee46ec 100644
--- a/arch/m68k/mm/fault.c
+++ b/arch/m68k/mm/fault.c
@@ -145,6 +145,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto map_err;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto bus_err;
                 BUG();
diff --git a/arch/metag/mm/fault.c b/arch/metag/mm/fault.c
index 332680e5ebf2..2de5dc695a87 100644
--- a/arch/metag/mm/fault.c
+++ b/arch/metag/mm/fault.c
@@ -141,6 +141,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
index fa4cf52aa7a6..d46a5ebb7570 100644
--- a/arch/microblaze/mm/fault.c
+++ b/arch/microblaze/mm/fault.c
@@ -224,6 +224,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index becc42bb1849..70ab5d664332 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -158,6 +158,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
index 3516cbdf1ee9..0c2cc5d39c8e 100644
--- a/arch/mn10300/mm/fault.c
+++ b/arch/mn10300/mm/fault.c
@@ -262,6 +262,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/nios2/mm/fault.c b/arch/nios2/mm/fault.c
index 15a0bb5fc06d..34429d5a0ccd 100644
--- a/arch/nios2/mm/fault.c
+++ b/arch/nios2/mm/fault.c
@@ -135,6 +135,8 @@ survive:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c
index 0703acf7d327..230ac20ae794 100644
--- a/arch/openrisc/mm/fault.c
+++ b/arch/openrisc/mm/fault.c
@@ -171,6 +171,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 3ca9c1131cfe..e5120e653240 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -256,6 +256,8 @@ good_area:
                  */
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto bad_area;
                 BUG();
diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c
index 5a236f082c78..1b5305d4bdab 100644
--- a/arch/powerpc/mm/copro_fault.c
+++ b/arch/powerpc/mm/copro_fault.c
@@ -76,7 +76,7 @@ int copro_handle_mm_fault(struct mm_struct *mm, unsigned long ea,
                 if (*flt & VM_FAULT_OOM) {
                         ret = -ENOMEM;
                         goto out_unlock;
-                } else if (*flt & VM_FAULT_SIGBUS) {
+                } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
                         ret = -EFAULT;
                         goto out_unlock;
                 }
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index eb79907f34fa..6154b0a2b063 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -437,6 +437,8 @@ good_area:
          */
         fault = handle_mm_fault(mm, vma, address, flags);
         if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
+                if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 rc = mm_fault_error(regs, address, fault);
                 if (rc >= MM_FAULT_RETURN)
                         goto bail;
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index b700a329c31d..d2de7d5d7574 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -304,7 +304,7 @@ int pnv_save_sprs_for_winkle(void)
          * all cpus at boot. Get these reg values of current cpu and use the
          * same accross all cpus.
          */
-        uint64_t lpcr_val = mfspr(SPRN_LPCR);
+        uint64_t lpcr_val = mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1;
         uint64_t hid0_val = mfspr(SPRN_HID0);
         uint64_t hid1_val = mfspr(SPRN_HID1);
         uint64_t hid4_val = mfspr(SPRN_HID4);
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 5b150f0c5df9..13c6e200b24e 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -337,6 +337,7 @@ static inline void disable_surveillance(void)
         args.token = rtas_token("set-indicator");
         if (args.token == RTAS_UNKNOWN_SERVICE)
                 return;
+        args.token = cpu_to_be32(args.token);
         args.nargs = cpu_to_be32(3);
         args.nret = cpu_to_be32(1);
         args.rets = &args.args[3];
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 811937bb90be..9065d5aa3932 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -374,6 +374,12 @@ static noinline void do_fault_error(struct pt_regs *regs, int fault)
                                 do_no_context(regs);
                         else
                                 pagefault_out_of_memory();
+                } else if (fault & VM_FAULT_SIGSEGV) {
+                        /* Kernel mode? Handle exceptions or die */
+                        if (!user_mode(regs))
+                                do_no_context(regs);
+                        else
+                                do_sigsegv(regs, SEGV_MAPERR);
                 } else if (fault & VM_FAULT_SIGBUS) {
                         /* Kernel mode? Handle exceptions or die */
                         if (!user_mode(regs))
diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c
index 52238983527d..6860beb2a280 100644
--- a/arch/score/mm/fault.c
+++ b/arch/score/mm/fault.c
@@ -114,6 +114,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c
index 541dc6101508..a58fec9b55e0 100644
--- a/arch/sh/mm/fault.c
+++ b/arch/sh/mm/fault.c
@@ -353,6 +353,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
         } else {
                 if (fault & VM_FAULT_SIGBUS)
                         do_sigbus(regs, error_code, address);
+                else if (fault & VM_FAULT_SIGSEGV)
+                        bad_area(regs, error_code, address);
                 else
                         BUG();
         }
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
index 908e8c17c902..70d817154fe8 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -249,6 +249,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index 18fcd7167095..479823249429 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -446,6 +446,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
index 565e25a98334..0f61a73534e6 100644
--- a/arch/tile/mm/fault.c
+++ b/arch/tile/mm/fault.c
@@ -442,6 +442,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
index 5678c3571e7c..209617302df8 100644
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -80,6 +80,8 @@ good_area:
                 if (unlikely(fault & VM_FAULT_ERROR)) {
                         if (fault & VM_FAULT_OOM) {
                                 goto out_of_memory;
+                        } else if (fault & VM_FAULT_SIGSEGV) {
+                                goto out;
                         } else if (fault & VM_FAULT_SIGBUS) {
                                 err = -EACCES;
                                 goto out;
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index d999398928bc..ad754b4411f7 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -90,7 +90,7 @@ suffix-$(CONFIG_KERNEL_LZO) 	:= lzo
 suffix-$(CONFIG_KERNEL_LZ4)     := lz4
 
 RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
-             perl $(srctree)/arch/x86/tools/calc_run_size.pl)
+             $(CONFIG_SHELL) $(srctree)/arch/x86/tools/calc_run_size.sh)
 quiet_cmd_mkpiggy = MKPIGGY $@
       cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
 
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 944bf019b74f..498b6d967138 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2431,6 +2431,7 @@ __init int intel_pmu_init(void)
                 break;
 
         case 55: /* 22nm Atom "Silvermont"                */
+        case 76: /* 14nm Atom "Airmont"                   */
         case 77: /* 22nm Atom "Silvermont Avoton/Rangely" */
                 memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
                         sizeof(hw_cache_event_ids));
diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
index 6e434f8e5fc8..c4bb8b8e5017 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
@@ -142,7 +142,7 @@ static inline u64 rapl_scale(u64 v)
          * or use ldexp(count, -32).
          * Watts = Joules/Time delta
          */
-        return v << (32 - __this_cpu_read(rapl_pmu->hw_unit));
+        return v << (32 - __this_cpu_read(rapl_pmu)->hw_unit);
 }
 
 static u64 rapl_event_update(struct perf_event *event)
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 10b8d3eaaf15..c635b8b49e93 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -840,7 +840,6 @@ static int uncore_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id
         box->phys_id = phys_id;
         box->pci_dev = pdev;
         box->pmu = pmu;
-        uncore_box_init(box);
         pci_set_drvdata(pdev, box);
 
         raw_spin_lock(&uncore_box_lock);
@@ -1004,10 +1003,8 @@ static int uncore_cpu_starting(int cpu)
                         pmu = &type->pmus[j];
                         box = *per_cpu_ptr(pmu->box, cpu);
                         /* called by uncore_cpu_init? */
-                        if (box && box->phys_id >= 0) {
-                                uncore_box_init(box);
+                        if (box && box->phys_id >= 0)
                                 continue;
-                        }
 
                         for_each_online_cpu(k) {
                                 exist = *per_cpu_ptr(pmu->box, k);
@@ -1023,10 +1020,8 @@ static int uncore_cpu_starting(int cpu)
                                 }
                         }
 
-                        if (box) {
+                        if (box)
                                 box->phys_id = phys_id;
-                                uncore_box_init(box);
-                        }
                 }
         }
         return 0;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
index 863d9b02563e..6c8c1e7e69d8 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
@@ -257,6 +257,14 @@ static inline int uncore_num_counters(struct intel_uncore_box *box)
         return box->pmu->type->num_counters;
 }
 
+static inline void uncore_box_init(struct intel_uncore_box *box)
+{
+        if (!test_and_set_bit(UNCORE_BOX_FLAG_INITIATED, &box->flags)) {
+                if (box->pmu->type->ops->init_box)
+                        box->pmu->type->ops->init_box(box);
+        }
+}
+
 static inline void uncore_disable_box(struct intel_uncore_box *box)
 {
         if (box->pmu->type->ops->disable_box)
@@ -265,6 +273,8 @@ static inline void uncore_disable_box(struct intel_uncore_box *box)
 
 static inline void uncore_enable_box(struct intel_uncore_box *box)
 {
+        uncore_box_init(box);
+
         if (box->pmu->type->ops->enable_box)
                 box->pmu->type->ops->enable_box(box);
 }
@@ -287,14 +297,6 @@ static inline u64 uncore_read_counter(struct intel_uncore_box *box,
         return box->pmu->type->ops->read_counter(box, event);
 }
 
-static inline void uncore_box_init(struct intel_uncore_box *box)
-{
-        if (!test_and_set_bit(UNCORE_BOX_FLAG_INITIATED, &box->flags)) {
-                if (box->pmu->type->ops->init_box)
-                        box->pmu->type->ops->init_box(box);
-        }
-}
-
 static inline bool uncore_box_is_fake(struct intel_uncore_box *box)
 {
         return (box->phys_id < 0);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 4f0c0b954686..d52dcf0776ea 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -192,6 +192,9 @@ static void recalculate_apic_map(struct kvm *kvm)
                 u16 cid, lid;
                 u32 ldr, aid;
 
+                if (!kvm_apic_present(vcpu))
+                        continue;
+
                 aid = kvm_apic_id(apic);
                 ldr = kvm_apic_get_reg(apic, APIC_LDR);
                 cid = apic_cluster_id(new, ldr);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 38dcec403b46..e3ff27a5b634 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -898,6 +898,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
                 if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
                              VM_FAULT_HWPOISON_LARGE))
                         do_sigbus(regs, error_code, address, fault);
+                else if (fault & VM_FAULT_SIGSEGV)
+                        bad_area_nosemaphore(regs, error_code, address);
                 else
                         BUG();
         }
diff --git a/arch/x86/tools/calc_run_size.pl b/arch/x86/tools/calc_run_size.pl
deleted file mode 100644
index 23210baade2d..000000000000
--- a/arch/x86/tools/calc_run_size.pl
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/perl
-#
-# Calculate the amount of space needed to run the kernel, including room for
-# the .bss and .brk sections.
-#
-# Usage:
-# objdump -h a.out | perl calc_run_size.pl
-use strict;
-
-my $mem_size = 0;
-my $file_offset = 0;
-
-my $sections=" *[0-9]+ \.(?:bss|brk) +";
-while (<>) {
-        if (/^$sections([0-9a-f]+) +(?:[0-9a-f]+ +){2}([0-9a-f]+)/) {
-                my $size = hex($1);
-                my $offset = hex($2);
-                $mem_size += $size;
-                if ($file_offset == 0) {
-                        $file_offset = $offset;
-                } elsif ($file_offset != $offset) {
-                        # BFD linker shows the same file offset in ELF.
-                        # Gold linker shows them as consecutive.
-                        next if ($file_offset + $mem_size == $offset + $size);
-
-                        printf STDERR "file_offset: 0x%lx\n", $file_offset;
-                        printf STDERR "mem_size: 0x%lx\n", $mem_size;
-                        printf STDERR "offset: 0x%lx\n", $offset;
-                        printf STDERR "size: 0x%lx\n", $size;
-
-                        die ".bss and .brk are non-contiguous\n";
-                }
-        }
-}
-
-if ($file_offset == 0) {
-        die "Never found .bss or .brk file offset\n";
-}
-printf("%d\n", $mem_size + $file_offset);
diff --git a/arch/x86/tools/calc_run_size.sh b/arch/x86/tools/calc_run_size.sh
new file mode 100644
index 000000000000..1a4c17bb3910
--- /dev/null
+++ b/arch/x86/tools/calc_run_size.sh
@@ -0,0 +1,42 @@
+#!/bin/sh
+#
+# Calculate the amount of space needed to run the kernel, including room for
+# the .bss and .brk sections.
+#
+# Usage:
+# objdump -h a.out | sh calc_run_size.sh
+
+NUM='\([0-9a-fA-F]*[ \t]*\)'
+OUT=$(sed -n 's/^[ \t0-9]*.b[sr][sk][ \t]*'"$NUM$NUM$NUM$NUM"'.*/\1\4/p')
+if [ -z "$OUT" ] ; then
+        echo "Never found .bss or .brk file offset" >&2
+        exit 1
+fi
+
+OUT=$(echo ${OUT# })
+sizeA=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+offsetA=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+sizeB=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+offsetB=$(printf "%d" 0x${OUT%% *})
+
+run_size=$(( $offsetA + $sizeA + $sizeB ))
+
+# BFD linker shows the same file offset in ELF.
+if [ "$offsetA" -ne "$offsetB" ] ; then
+        # Gold linker shows them as consecutive.
+        endB=$(( $offsetB + $sizeB ))
+        if [ "$endB" != "$run_size" ] ; then
+                printf "sizeA: 0x%x\n" $sizeA >&2
+                printf "offsetA: 0x%x\n" $offsetA >&2
+                printf "sizeB: 0x%x\n" $sizeB >&2
+                printf "offsetB: 0x%x\n" $offsetB >&2
+                echo ".bss and .brk are non-contiguous" >&2
+                exit 1
+        fi
+fi
+
+printf "%d\n" $run_size
+exit 0
diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
index b57c4f91f487..9e3571a6535c 100644
--- a/arch/xtensa/mm/fault.c
+++ b/arch/xtensa/mm/fault.c
@@ -117,6 +117,8 @@ good_area:
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
+                else if (fault & VM_FAULT_SIGSEGV)
+                        goto bad_area;
                 else if (fault & VM_FAULT_SIGBUS)
                         goto do_sigbus;
                 BUG();
diff --git a/drivers/Kconfig b/drivers/Kconfig
index 694d5a70d6ce..c70d6e45dc10 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -134,8 +134,6 @@ source "drivers/staging/Kconfig"
 
 source "drivers/platform/Kconfig"
 
-source "drivers/soc/Kconfig"
-
 source "drivers/clk/Kconfig"
 
 source "drivers/hwspinlock/Kconfig"
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 3ec85dfce124..8a86b62466f7 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2098,32 +2098,26 @@ static void rbd_dev_parent_put(struct rbd_device *rbd_dev)
  * If an image has a non-zero parent overlap, get a reference to its
  * parent.
  *
- * We must get the reference before checking for the overlap to
- * coordinate properly with zeroing the parent overlap in
- * rbd_dev_v2_parent_info() when an image gets flattened.  We
- * drop it again if there is no overlap.
- *
  * Returns true if the rbd device has a parent with a non-zero
  * overlap and a reference for it was successfully taken, or
  * false otherwise.
  */
 static bool rbd_dev_parent_get(struct rbd_device *rbd_dev)
 {
-        int counter;
+        int counter = 0;
 
         if (!rbd_dev->parent_spec)
                 return false;
 
-        counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
-        if (counter > 0 && rbd_dev->parent_overlap)
-                return true;
-
-        /* Image was flattened, but parent is not yet torn down */
+        down_read(&rbd_dev->header_rwsem);
+        if (rbd_dev->parent_overlap)
+                counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
+        up_read(&rbd_dev->header_rwsem);
 
         if (counter < 0)
                 rbd_warn(rbd_dev, "parent reference overflow");
 
-        return false;
+        return counter > 0;
 }
 
 /*
@@ -4239,7 +4233,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                  */
                 if (rbd_dev->parent_overlap) {
                         rbd_dev->parent_overlap = 0;
-                        smp_mb();
                         rbd_dev_parent_put(rbd_dev);
                         pr_info("%s: clone image has been flattened\n",
                                 rbd_dev->disk->disk_name);
@@ -4285,7 +4278,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
          * treat it specially.
          */
         rbd_dev->parent_overlap = overlap;
-        smp_mb();
         if (!overlap) {
 
                 /* A null parent_spec indicates it's the initial probe */
@@ -5114,10 +5106,7 @@ static void rbd_dev_unprobe(struct rbd_device *rbd_dev)
 {
         struct rbd_image_header *header;
 
-        /* Drop parent reference unless it's already been done (or none) */
-
-        if (rbd_dev->parent_overlap)
-                rbd_dev_parent_put(rbd_dev);
+        rbd_dev_parent_put(rbd_dev);
 
         /* Free dynamic fields from the header, then zero it out */
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 633532a2e7ec..25bc47f3c1cf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -26,6 +26,7 @@
 #include <linux/slab.h>
 #include "kfd_priv.h"
 #include "kfd_device_queue_manager.h"
+#include "kfd_pm4_headers.h"
 
 #define MQD_SIZE_ALIGNED 768
 
@@ -169,9 +170,8 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
         kfd->shared_resources = *gpu_resources;
 
         /* calculate max size of mqds needed for queues */
-        size = max_num_of_processes *
-                max_num_of_queues_per_process *
-                kfd->device_info->mqd_size_aligned;
+        size = max_num_of_queues_per_device *
+                        kfd->device_info->mqd_size_aligned;
 
         /* add another 512KB for all other allocations on gart */
         size += 512 * 1024;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 30c8fda9622e..0d8694f015c1 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -183,6 +183,13 @@ static int create_queue_nocpsch(struct device_queue_manager *dqm,
 
         mutex_lock(&dqm->lock);
 
+        if (dqm->total_queue_count >= max_num_of_queues_per_device) {
+                pr_warn("amdkfd: Can't create new usermode queue because %d queues were already created\n",
+                                dqm->total_queue_count);
+                mutex_unlock(&dqm->lock);
+                return -EPERM;
+        }
+
         if (list_empty(&qpd->queues_list)) {
                 retval = allocate_vmid(dqm, qpd, q);
                 if (retval != 0) {
@@ -207,6 +214,14 @@ static int create_queue_nocpsch(struct device_queue_manager *dqm,
         list_add(&q->list, &qpd->queues_list);
         dqm->queue_count++;
 
+        /*
+         * Unconditionally increment this counter, regardless of the queue's
+         * type or whether the queue is active.
+         */
+        dqm->total_queue_count++;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
+
         mutex_unlock(&dqm->lock);
         return 0;
 }
@@ -326,6 +341,15 @@ static int destroy_queue_nocpsch(struct device_queue_manager *dqm,
         if (list_empty(&qpd->queues_list))
                 deallocate_vmid(dqm, qpd, q);
         dqm->queue_count--;
+
+        /*
+         * Unconditionally decrement this counter, regardless of the queue's
+         * type
+         */
+        dqm->total_queue_count--;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
+
 out:
         mutex_unlock(&dqm->lock);
         return retval;
@@ -541,10 +565,14 @@ static int init_pipelines(struct device_queue_manager *dqm,
 
         for (i = 0; i < pipes_num; i++) {
                 inx = i + first_pipe;
+                /*
+                 * HPD buffer on GTT is allocated by amdkfd, no need to waste
+                 * space in GTT for pipelines we don't initialize
+                 */
                 pipe_hpd_addr = dqm->pipelines_addr + i * CIK_HPD_EOP_BYTES;
                 pr_debug("kfd: pipeline address %llX\n", pipe_hpd_addr);
                 /* = log2(bytes/4)-1 */
-                kfd2kgd->init_pipeline(dqm->dev->kgd, i,
+                kfd2kgd->init_pipeline(dqm->dev->kgd, inx,
                                 CIK_HPD_EOP_BYTES_LOG2 - 3, pipe_hpd_addr);
         }
 
@@ -560,7 +588,7 @@ static int init_scheduler(struct device_queue_manager *dqm)
 
         pr_debug("kfd: In %s\n", __func__);
 
-        retval = init_pipelines(dqm, get_pipes_num(dqm), KFD_DQM_FIRST_PIPE);
+        retval = init_pipelines(dqm, get_pipes_num(dqm), get_first_pipe(dqm));
         if (retval != 0)
                 return retval;
 
@@ -752,6 +780,21 @@ static int create_kernel_queue_cpsch(struct device_queue_manager *dqm,
         pr_debug("kfd: In func %s\n", __func__);
 
         mutex_lock(&dqm->lock);
+        if (dqm->total_queue_count >= max_num_of_queues_per_device) {
+                pr_warn("amdkfd: Can't create new kernel queue because %d queues were already created\n",
+                                dqm->total_queue_count);
+                mutex_unlock(&dqm->lock);
+                return -EPERM;
+        }
+
+        /*
+         * Unconditionally increment this counter, regardless of the queue's
+         * type or whether the queue is active.
+         */
+        dqm->total_queue_count++;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
+
         list_add(&kq->list, &qpd->priv_queue_list);
         dqm->queue_count++;
         qpd->is_debug = true;
@@ -775,6 +818,13 @@ static void destroy_kernel_queue_cpsch(struct device_queue_manager *dqm,
         dqm->queue_count--;
         qpd->is_debug = false;
         execute_queues_cpsch(dqm, false);
+        /*
+         * Unconditionally decrement this counter, regardless of the queue's
+         * type.
+         */
+        dqm->total_queue_count++;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
         mutex_unlock(&dqm->lock);
 }
 
@@ -793,6 +843,13 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
 
         mutex_lock(&dqm->lock);
 
+        if (dqm->total_queue_count >= max_num_of_queues_per_device) {
+                pr_warn("amdkfd: Can't create new usermode queue because %d queues were already created\n",
+                                dqm->total_queue_count);
+                retval = -EPERM;
+                goto out;
+        }
+
         mqd = dqm->get_mqd_manager(dqm, KFD_MQD_TYPE_CIK_CP);
         if (mqd == NULL) {
                 mutex_unlock(&dqm->lock);
@@ -810,6 +867,15 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
                 retval = execute_queues_cpsch(dqm, false);
         }
 
+        /*
+         * Unconditionally increment this counter, regardless of the queue's
+         * type or whether the queue is active.
+         */
+        dqm->total_queue_count++;
+
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
+
 out:
         mutex_unlock(&dqm->lock);
         return retval;
@@ -930,6 +996,14 @@ static int destroy_queue_cpsch(struct device_queue_manager *dqm,
 
         mqd->uninit_mqd(mqd, q->mqd, q->mqd_mem_obj);
 
+        /*
+         * Unconditionally decrement this counter, regardless of the queue's
+         * type
+         */
+        dqm->total_queue_count--;
+        pr_debug("Total of %d queues are accountable so far\n",
+                        dqm->total_queue_count);
+
         mutex_unlock(&dqm->lock);
 
         return 0;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
index c3f189e8ae35..52035bf0c1cb 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
@@ -130,6 +130,7 @@ struct device_queue_manager {
         struct list_head        queues;
         unsigned int            processes_count;
         unsigned int            queue_count;
+        unsigned int            total_queue_count;
         unsigned int            next_pipe_to_allocate;
         unsigned int            *allocated_queues;
         unsigned int            vmid_bitmap;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
index 95d5af138e6e..a8be6df85347 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
@@ -50,15 +50,10 @@ module_param(sched_policy, int, 0444);
 MODULE_PARM_DESC(sched_policy,
         "Kernel cmdline parameter that defines the amdkfd scheduling policy");
 
-int max_num_of_processes = KFD_MAX_NUM_OF_PROCESSES_DEFAULT;
-module_param(max_num_of_processes, int, 0444);
-MODULE_PARM_DESC(max_num_of_processes,
-        "Kernel cmdline parameter that defines the amdkfd maximum number of supported processes");
-
-int max_num_of_queues_per_process = KFD_MAX_NUM_OF_QUEUES_PER_PROCESS_DEFAULT;
-module_param(max_num_of_queues_per_process, int, 0444);
-MODULE_PARM_DESC(max_num_of_queues_per_process,
-        "Kernel cmdline parameter that defines the amdkfd maximum number of supported queues per process");
+int max_num_of_queues_per_device = KFD_MAX_NUM_OF_QUEUES_PER_DEVICE_DEFAULT;
+module_param(max_num_of_queues_per_device, int, 0444);
+MODULE_PARM_DESC(max_num_of_queues_per_device,
+        "Maximum number of supported queues per device (1 = Minimum, 4096 = default)");
 
 bool kgd2kfd_init(unsigned interface_version,
                   const struct kfd2kgd_calls *f2g,
@@ -100,16 +95,10 @@ static int __init kfd_module_init(void)
         }
 
         /* Verify module parameters */
-        if ((max_num_of_processes < 0) ||
-                (max_num_of_processes > KFD_MAX_NUM_OF_PROCESSES)) {
-                pr_err("kfd: max_num_of_processes must be between 0 to KFD_MAX_NUM_OF_PROCESSES\n");
-                return -1;
-        }
-
-        if ((max_num_of_queues_per_process < 0) ||
-                (max_num_of_queues_per_process >
-                        KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)) {
-                pr_err("kfd: max_num_of_queues_per_process must be between 0 to KFD_MAX_NUM_OF_QUEUES_PER_PROCESS\n");
+        if ((max_num_of_queues_per_device < 0) ||
+                (max_num_of_queues_per_device >
+                        KFD_MAX_NUM_OF_QUEUES_PER_DEVICE)) {
+                pr_err("kfd: max_num_of_queues_per_device must be between 0 to KFD_MAX_NUM_OF_QUEUES_PER_DEVICE\n");
                 return -1;
         }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c b/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
index 4c25ef504f79..6cfe7f1f18cf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_pasid.c
@@ -30,7 +30,7 @@ static DEFINE_MUTEX(pasid_mutex);
 
 int kfd_pasid_init(void)
 {
-        pasid_limit = max_num_of_processes;
+        pasid_limit = KFD_MAX_NUM_OF_PROCESSES;
 
         pasid_bitmap = kcalloc(BITS_TO_LONGS(pasid_limit), sizeof(long), GFP_KERNEL);
         if (!pasid_bitmap)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index b3dc13c83169..96dc10e8904a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -52,20 +52,19 @@
 #define kfd_alloc_struct(ptr_to_struct) \
         ((typeof(ptr_to_struct)) kzalloc(sizeof(*ptr_to_struct), GFP_KERNEL))
 
-/* Kernel module parameter to specify maximum number of supported processes */
-extern int max_num_of_processes;
-
-#define KFD_MAX_NUM_OF_PROCESSES_DEFAULT 32
 #define KFD_MAX_NUM_OF_PROCESSES 512
+#define KFD_MAX_NUM_OF_QUEUES_PER_PROCESS 1024
 
 /*
- * Kernel module parameter to specify maximum number of supported queues
- * per process
+ * Kernel module parameter to specify maximum number of supported queues per
+ * device
  */
-extern int max_num_of_queues_per_process;
+extern int max_num_of_queues_per_device;
 
-#define KFD_MAX_NUM_OF_QUEUES_PER_PROCESS_DEFAULT 128
-#define KFD_MAX_NUM_OF_QUEUES_PER_PROCESS 1024
+#define KFD_MAX_NUM_OF_QUEUES_PER_DEVICE_DEFAULT 4096
+#define KFD_MAX_NUM_OF_QUEUES_PER_DEVICE                \
+        (KFD_MAX_NUM_OF_PROCESSES *                     \
+                        KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)
 
 #define KFD_KERNEL_QUEUE_SIZE 2048
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index 47526780d736..f37cf5efe642 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -54,11 +54,11 @@ static int find_available_queue_slot(struct process_queue_manager *pqm,
         pr_debug("kfd: in %s\n", __func__);
 
         found = find_first_zero_bit(pqm->queue_slot_bitmap,
-                        max_num_of_queues_per_process);
+                        KFD_MAX_NUM_OF_QUEUES_PER_PROCESS);
 
         pr_debug("kfd: the new slot id %lu\n", found);
 
-        if (found >= max_num_of_queues_per_process) {
+        if (found >= KFD_MAX_NUM_OF_QUEUES_PER_PROCESS) {
                 pr_info("amdkfd: Can not open more queues for process with pasid %d\n",
                                 pqm->process->pasid);
                 return -ENOMEM;
@@ -76,7 +76,7 @@ int pqm_init(struct process_queue_manager *pqm, struct kfd_process *p)
 
         INIT_LIST_HEAD(&pqm->queues);
         pqm->queue_slot_bitmap =
-                        kzalloc(DIV_ROUND_UP(max_num_of_queues_per_process,
+                        kzalloc(DIV_ROUND_UP(KFD_MAX_NUM_OF_QUEUES_PER_PROCESS,
                                         BITS_PER_BYTE), GFP_KERNEL);
         if (pqm->queue_slot_bitmap == NULL)
                 return -ENOMEM;
@@ -203,6 +203,7 @@ int pqm_create_queue(struct process_queue_manager *pqm,
                 pqn->kq = NULL;
                 retval = dev->dqm->create_queue(dev->dqm, q, &pdd->qpd,
                                                 &q->properties.vmid);
+                pr_debug("DQM returned %d for create_queue\n", retval);
                 print_queue(q);
                 break;
         case KFD_QUEUE_TYPE_DIQ:
@@ -222,7 +223,7 @@ int pqm_create_queue(struct process_queue_manager *pqm,
         }
 
         if (retval != 0) {
-                pr_err("kfd: error dqm create queue\n");
+                pr_debug("Error dqm create queue\n");
                 goto err_create_queue;
         }
 
@@ -241,7 +242,10 @@ int pqm_create_queue(struct process_queue_manager *pqm,
 err_create_queue:
         kfree(pqn);
 err_allocate_pqn:
+        /* check if queues list is empty unregister process from device */
         clear_bit(*qid, pqm->queue_slot_bitmap);
+        if (list_empty(&pqm->queues))
+                dev->dqm->unregister_process(dev->dqm, &pdd->qpd);
         return retval;
 }
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index cf775a4449c1..dc386ebe5193 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -145,6 +145,31 @@ int drm_fb_helper_add_one_connector(struct drm_fb_helper *fb_helper, struct drm_
 }
 EXPORT_SYMBOL(drm_fb_helper_add_one_connector);
 
+static void remove_from_modeset(struct drm_mode_set *set,
+                struct drm_connector *connector)
+{
+        int i, j;
+
+        for (i = 0; i < set->num_connectors; i++) {
+                if (set->connectors[i] == connector)
+                        break;
+        }
+
+        if (i == set->num_connectors)
+                return;
+
+        for (j = i + 1; j < set->num_connectors; j++) {
+                set->connectors[j - 1] = set->connectors[j];
+        }
+        set->num_connectors--;
+
+        /* because i915 is pissy about this..
+         * TODO maybe need to makes sure we set it back to !=NULL somewhere?
+         */
+        if (set->num_connectors == 0)
+                set->fb = NULL;
+}
+
 int drm_fb_helper_remove_one_connector(struct drm_fb_helper *fb_helper,
                                        struct drm_connector *connector)
 {
@@ -167,6 +192,11 @@ int drm_fb_helper_remove_one_connector(struct drm_fb_helper *fb_helper,
         }
         fb_helper->connector_count--;
         kfree(fb_helper_connector);
+
+        /* also cleanup dangling references to the connector: */
+        for (i = 0; i < fb_helper->crtc_count; i++)
+                remove_from_modeset(&fb_helper->crtc_info[i].mode_set, connector);
+
         return 0;
 }
 EXPORT_SYMBOL(drm_fb_helper_remove_one_connector);
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index d4762799351d..a9041d1a8ff0 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -32,6 +32,8 @@
 struct tda998x_priv {
         struct i2c_client *cec;
         struct i2c_client *hdmi;
+        struct mutex mutex;
+        struct delayed_work dwork;
         uint16_t rev;
         uint8_t current_page;
         int dpms;
@@ -402,9 +404,10 @@ reg_read_range(struct tda998x_priv *priv, uint16_t reg, char *buf, int cnt)
         uint8_t addr = REG2ADDR(reg);
         int ret;
 
+        mutex_lock(&priv->mutex);
         ret = set_page(priv, reg);
         if (ret < 0)
-                return ret;
+                goto out;
 
         ret = i2c_master_send(client, &addr, sizeof(addr));
         if (ret < 0)
@@ -414,10 +417,12 @@ reg_read_range(struct tda998x_priv *priv, uint16_t reg, char *buf, int cnt)
         if (ret < 0)
                 goto fail;
 
-        return ret;
+        goto out;
 
 fail:
         dev_err(&client->dev, "Error %d reading from 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
         return ret;
 }
 
@@ -431,13 +436,16 @@ reg_write_range(struct tda998x_priv *priv, uint16_t reg, uint8_t *p, int cnt)
         buf[0] = REG2ADDR(reg);
         memcpy(&buf[1], p, cnt);
 
+        mutex_lock(&priv->mutex);
         ret = set_page(priv, reg);
         if (ret < 0)
-                return;
+                goto out;
 
         ret = i2c_master_send(client, buf, cnt + 1);
         if (ret < 0)
                 dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
 }
 
 static int
@@ -459,13 +467,16 @@ reg_write(struct tda998x_priv *priv, uint16_t reg, uint8_t val)
         uint8_t buf[] = {REG2ADDR(reg), val};
         int ret;
 
+        mutex_lock(&priv->mutex);
         ret = set_page(priv, reg);
         if (ret < 0)
-                return;
+                goto out;
 
         ret = i2c_master_send(client, buf, sizeof(buf));
         if (ret < 0)
                 dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
 }
 
 static void
@@ -475,13 +486,16 @@ reg_write16(struct tda998x_priv *priv, uint16_t reg, uint16_t val)
         uint8_t buf[] = {REG2ADDR(reg), val >> 8, val};
         int ret;
 
+        mutex_lock(&priv->mutex);
         ret = set_page(priv, reg);
         if (ret < 0)
-                return;
+                goto out;
 
         ret = i2c_master_send(client, buf, sizeof(buf));
         if (ret < 0)
                 dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
+out:
+        mutex_unlock(&priv->mutex);
 }
 
 static void
@@ -536,6 +550,17 @@ tda998x_reset(struct tda998x_priv *priv)
         reg_write(priv, REG_MUX_VP_VIP_OUT, 0x24);
 }
 
+/* handle HDMI connect/disconnect */
+static void tda998x_hpd(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct tda998x_priv *priv =
+                        container_of(dwork, struct tda998x_priv, dwork);
+
+        if (priv->encoder && priv->encoder->dev)
+                drm_kms_helper_hotplug_event(priv->encoder->dev);
+}
+
 /*
  * only 2 interrupts may occur: screen plug/unplug and EDID read
  */
@@ -559,8 +584,7 @@ static irqreturn_t tda998x_irq_thread(int irq, void *data)
                 priv->wq_edid_wait = 0;
                 wake_up(&priv->wq_edid);
         } else if (cec != 0) {                  /* HPD change */
-                if (priv->encoder && priv->encoder->dev)
-                        drm_helper_hpd_irq_event(priv->encoder->dev);
+                schedule_delayed_work(&priv->dwork, HZ/10);
         }
         return IRQ_HANDLED;
 }
@@ -1170,8 +1194,10 @@ static void tda998x_destroy(struct tda998x_priv *priv)
         /* disable all IRQs and free the IRQ handler */
         cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
         reg_clear(priv, REG_INT_FLAGS_2, INT_FLAGS_2_EDID_BLK_RD);
-        if (priv->hdmi->irq)
+        if (priv->hdmi->irq) {
                 free_irq(priv->hdmi->irq, priv);
+                cancel_delayed_work_sync(&priv->dwork);
+        }
 
         i2c_unregister_device(priv->cec);
 }
@@ -1255,6 +1281,7 @@ static int tda998x_create(struct i2c_client *client, struct tda998x_priv *priv)
         struct device_node *np = client->dev.of_node;
         u32 video;
         int rev_lo, rev_hi, ret;
+        unsigned short cec_addr;
 
         priv->vip_cntrl_0 = VIP_CNTRL_0_SWAP_A(2) | VIP_CNTRL_0_SWAP_B(3);
         priv->vip_cntrl_1 = VIP_CNTRL_1_SWAP_C(0) | VIP_CNTRL_1_SWAP_D(1);
@@ -1262,12 +1289,16 @@ static int tda998x_create(struct i2c_client *client, struct tda998x_priv *priv)
 
         priv->current_page = 0xff;
         priv->hdmi = client;
-        priv->cec = i2c_new_dummy(client->adapter, 0x34);
+        /* CEC I2C address bound to TDA998x I2C addr by configuration pins */
+        cec_addr = 0x34 + (client->addr & 0x03);
+        priv->cec = i2c_new_dummy(client->adapter, cec_addr);
         if (!priv->cec)
                 return -ENODEV;
 
         priv->dpms = DRM_MODE_DPMS_OFF;
 
+        mutex_init(&priv->mutex);       /* protect the page access */
+
         /* wake up the device: */
         cec_write(priv, REG_CEC_ENAMODS,
                         CEC_ENAMODS_EN_RXSENS | CEC_ENAMODS_EN_HDMI);
@@ -1323,8 +1354,9 @@ static int tda998x_create(struct i2c_client *client, struct tda998x_priv *priv)
         if (client->irq) {
                 int irqf_trigger;
 
-                /* init read EDID waitqueue */
+                /* init read EDID waitqueue and HDP work */
                 init_waitqueue_head(&priv->wq_edid);
+                INIT_DELAYED_WORK(&priv->dwork, tda998x_hpd);
 
                 /* clear pending interrupts */
                 reg_read(priv, REG_INT_FLAGS_0);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 574057cd1d09..7643300828c3 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -462,19 +462,13 @@ void intel_detect_pch(struct drm_device *dev)
                         } else if (id == INTEL_PCH_LPT_DEVICE_ID_TYPE) {
                                 dev_priv->pch_type = PCH_LPT;
                                 DRM_DEBUG_KMS("Found LynxPoint PCH\n");
-                                WARN_ON(!IS_HASWELL(dev));
-                                WARN_ON(IS_HSW_ULT(dev));
-                        } else if (IS_BROADWELL(dev)) {
-                                dev_priv->pch_type = PCH_LPT;
-                                dev_priv->pch_id =
-                                        INTEL_PCH_LPT_LP_DEVICE_ID_TYPE;
-                                DRM_DEBUG_KMS("This is Broadwell, assuming "
-                                              "LynxPoint LP PCH\n");
+                                WARN_ON(!IS_HASWELL(dev) && !IS_BROADWELL(dev));
+                                WARN_ON(IS_HSW_ULT(dev) || IS_BDW_ULT(dev));
                         } else if (id == INTEL_PCH_LPT_LP_DEVICE_ID_TYPE) {
                                 dev_priv->pch_type = PCH_LPT;
                                 DRM_DEBUG_KMS("Found LynxPoint LP PCH\n");
-                                WARN_ON(!IS_HASWELL(dev));
-                                WARN_ON(!IS_HSW_ULT(dev));
+                                WARN_ON(!IS_HASWELL(dev) && !IS_BROADWELL(dev));
+                                WARN_ON(!IS_HSW_ULT(dev) && !IS_BDW_ULT(dev));
                         } else if (id == INTEL_PCH_SPT_DEVICE_ID_TYPE) {
                                 dev_priv->pch_type = PCH_SPT;
                                 DRM_DEBUG_KMS("Found SunrisePoint PCH\n");
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index e9f891c432f8..9d7a7155bf02 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2159,8 +2159,7 @@ struct drm_i915_cmd_table {
 #define IS_HSW_EARLY_SDV(dev)   (IS_HASWELL(dev) && \
                                  (INTEL_DEVID(dev) & 0xFF00) == 0x0C00)
 #define IS_BDW_ULT(dev)         (IS_BROADWELL(dev) && \
-                                 ((INTEL_DEVID(dev) & 0xf) == 0x2  || \
-                                 (INTEL_DEVID(dev) & 0xf) == 0x6 || \
+                                 ((INTEL_DEVID(dev) & 0xf) == 0x6 ||    \
                                  (INTEL_DEVID(dev) & 0xf) == 0xe))
 #define IS_BDW_GT3(dev)         (IS_BROADWELL(dev) && \
                                  (INTEL_DEVID(dev) & 0x00F0) == 0x0020)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 76354d3ba925..5f614828d365 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3148,6 +3148,13 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
                 u32 size = i915_gem_obj_ggtt_size(obj);
                 uint64_t val;
 
+                /* Adjust fence size to match tiled area */
+                if (obj->tiling_mode != I915_TILING_NONE) {
+                        uint32_t row_size = obj->stride *
+                                (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
+                        size = (size / row_size) * row_size;
+                }
+
                 val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
                                  0xfffff000) << 32;
                 val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
@@ -4884,25 +4891,18 @@ i915_gem_init_hw(struct drm_device *dev)
         for (i = 0; i < NUM_L3_SLICES(dev); i++)
                 i915_gem_l3_remap(&dev_priv->ring[RCS], i);
 
-        /*
-         * XXX: Contexts should only be initialized once. Doing a switch to the
-         * default context switch however is something we'd like to do after
-         * reset or thaw (the latter may not actually be necessary for HW, but
-         * goes with our code better). Context switching requires rings (for
-         * the do_switch), but before enabling PPGTT. So don't move this.
-         */
-        ret = i915_gem_context_enable(dev_priv);
+        ret = i915_ppgtt_init_hw(dev);
         if (ret && ret != -EIO) {
-                DRM_ERROR("Context enable failed %d\n", ret);
+                DRM_ERROR("PPGTT enable failed %d\n", ret);
                 i915_gem_cleanup_ringbuffer(dev);
-
-                return ret;
         }
 
-        ret = i915_ppgtt_init_hw(dev);
+        ret = i915_gem_context_enable(dev_priv);
         if (ret && ret != -EIO) {
-                DRM_ERROR("PPGTT enable failed %d\n", ret);
+                DRM_ERROR("Context enable failed %d\n", ret);
                 i915_gem_cleanup_ringbuffer(dev);
+
+                return ret;
         }
 
         return ret;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 4d63839bd9b4..dfb783a8f2c3 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -962,7 +962,7 @@ void intel_panel_enable_backlight(struct intel_connector *connector)
 
         WARN_ON(panel->backlight.max == 0);
 
-        if (panel->backlight.level == 0) {
+        if (panel->backlight.level <= panel->backlight.min) {
                 panel->backlight.level = panel->backlight.max;
                 if (panel->backlight.device)
                         panel->backlight.device->props.brightness =
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index a0133c74f4cf..42cd0cffe210 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -816,7 +816,6 @@ void cik_sdma_vm_write_pages(struct radeon_device *rdev,
                 for (; ndw > 0; ndw -= 2, --count, pe += 8) {
                         if (flags & R600_PTE_SYSTEM) {
                                 value = radeon_vm_map_gart(rdev, addr);
-                                value &= 0xFFFFFFFFFFFFF000ULL;
                         } else if (flags & R600_PTE_VALID) {
                                 value = addr;
                         } else {
diff --git a/drivers/gpu/drm/radeon/ni_dma.c b/drivers/gpu/drm/radeon/ni_dma.c
index 4be2bb7cbef3..ce787a9f12c0 100644
--- a/drivers/gpu/drm/radeon/ni_dma.c
+++ b/drivers/gpu/drm/radeon/ni_dma.c
@@ -372,7 +372,6 @@ void cayman_dma_vm_write_pages(struct radeon_device *rdev,
                 for (; ndw > 0; ndw -= 2, --count, pe += 8) {
                         if (flags & R600_PTE_SYSTEM) {
                                 value = radeon_vm_map_gart(rdev, addr);
-                                value &= 0xFFFFFFFFFFFFF000ULL;
                         } else if (flags & R600_PTE_VALID) {
                                 value = addr;
                         } else {
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 74f06d540591..279801ca5110 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -644,6 +644,7 @@ int r100_pci_gart_init(struct radeon_device *rdev)
                 return r;
         rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
         rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
+        rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
         rdev->asic->gart.set_page = &r100_pci_gart_set_page;
         return radeon_gart_table_ram_alloc(rdev);
 }
@@ -681,11 +682,16 @@ void r100_pci_gart_disable(struct radeon_device *rdev)
         WREG32(RADEON_AIC_HI_ADDR, 0);
 }
 
+uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags)
+{
+        return addr;
+}
+
 void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
-                            uint64_t addr, uint32_t flags)
+                            uint64_t entry)
 {
         u32 *gtt = rdev->gart.ptr;
-        gtt[i] = cpu_to_le32(lower_32_bits(addr));
+        gtt[i] = cpu_to_le32(lower_32_bits(entry));
 }
 
 void r100_pci_gart_fini(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 064ad5569cca..08d68f3e13e9 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -73,11 +73,8 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
 #define R300_PTE_WRITEABLE (1 << 2)
 #define R300_PTE_READABLE  (1 << 3)
 
-void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
-                              uint64_t addr, uint32_t flags)
+uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags)
 {
-        void __iomem *ptr = rdev->gart.ptr;
-
         addr = (lower_32_bits(addr) >> 8) |
                 ((upper_32_bits(addr) & 0xff) << 24);
         if (flags & RADEON_GART_PAGE_READ)
@@ -86,10 +83,18 @@ void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
                 addr |= R300_PTE_WRITEABLE;
         if (!(flags & RADEON_GART_PAGE_SNOOP))
                 addr |= R300_PTE_UNSNOOPED;
+        return addr;
+}
+
+void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
+                              uint64_t entry)
+{
+        void __iomem *ptr = rdev->gart.ptr;
+
         /* on x86 we want this to be CPU endian, on powerpc
          * on powerpc without HW swappers, it'll get swapped on way
          * into VRAM - so no need for cpu_to_le32 on VRAM tables */
-        writel(addr, ((void __iomem *)ptr) + (i * 4));
+        writel(entry, ((void __iomem *)ptr) + (i * 4));
 }
 
 int rv370_pcie_gart_init(struct radeon_device *rdev)
@@ -109,6 +114,7 @@ int rv370_pcie_gart_init(struct radeon_device *rdev)
                 DRM_ERROR("Failed to register debugfs file for PCIE gart !\n");
         rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
         rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
+        rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
         rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
         return radeon_gart_table_vram_alloc(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 54529b837afa..3f2a8d3febca 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -242,6 +242,7 @@ bool radeon_get_bios(struct radeon_device *rdev);
  * Dummy page
  */
 struct radeon_dummy_page {
+        uint64_t        entry;
         struct page     *page;
         dma_addr_t      addr;
 };
@@ -645,7 +646,7 @@ struct radeon_gart {
         unsigned                        num_cpu_pages;
         unsigned                        table_size;
         struct page                     **pages;
-        dma_addr_t                      *pages_addr;
+        uint64_t                        *pages_entry;
         bool                            ready;
 };
 
@@ -1847,8 +1848,9 @@ struct radeon_asic {
         /* gart */
         struct {
                 void (*tlb_flush)(struct radeon_device *rdev);
+                uint64_t (*get_page_entry)(uint64_t addr, uint32_t flags);
                 void (*set_page)(struct radeon_device *rdev, unsigned i,
-                                 uint64_t addr, uint32_t flags);
+                                 uint64_t entry);
         } gart;
         struct {
                 int (*init)(struct radeon_device *rdev);
@@ -2852,7 +2854,8 @@ static inline void radeon_ring_write(struct radeon_ring *ring, uint32_t v)
 #define radeon_vga_set_state(rdev, state) (rdev)->asic->vga_set_state((rdev), (state))
 #define radeon_asic_reset(rdev) (rdev)->asic->asic_reset((rdev))
 #define radeon_gart_tlb_flush(rdev) (rdev)->asic->gart.tlb_flush((rdev))
-#define radeon_gart_set_page(rdev, i, p, f) (rdev)->asic->gart.set_page((rdev), (i), (p), (f))
+#define radeon_gart_get_page_entry(a, f) (rdev)->asic->gart.get_page_entry((a), (f))
+#define radeon_gart_set_page(rdev, i, e) (rdev)->asic->gart.set_page((rdev), (i), (e))
 #define radeon_asic_vm_init(rdev) (rdev)->asic->vm.init((rdev))
 #define radeon_asic_vm_fini(rdev) (rdev)->asic->vm.fini((rdev))
 #define radeon_asic_vm_copy_pages(rdev, ib, pe, src, count) ((rdev)->asic->vm.copy_pages((rdev), (ib), (pe), (src), (count)))
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 121aff6a3b41..ed0e10eee2dc 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -159,11 +159,13 @@ void radeon_agp_disable(struct radeon_device *rdev)
                 DRM_INFO("Forcing AGP to PCIE mode\n");
                 rdev->flags |= RADEON_IS_PCIE;
                 rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
+                rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
                 rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
         } else {
                 DRM_INFO("Forcing AGP to PCI mode\n");
                 rdev->flags |= RADEON_IS_PCI;
                 rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
+                rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
                 rdev->asic->gart.set_page = &r100_pci_gart_set_page;
         }
         rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
@@ -199,6 +201,7 @@ static struct radeon_asic r100_asic = {
         .mc_wait_for_idle = &r100_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &r100_pci_gart_tlb_flush,
+                .get_page_entry = &r100_pci_gart_get_page_entry,
                 .set_page = &r100_pci_gart_set_page,
         },
         .ring = {
@@ -265,6 +268,7 @@ static struct radeon_asic r200_asic = {
         .mc_wait_for_idle = &r100_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &r100_pci_gart_tlb_flush,
+                .get_page_entry = &r100_pci_gart_get_page_entry,
                 .set_page = &r100_pci_gart_set_page,
         },
         .ring = {
@@ -359,6 +363,7 @@ static struct radeon_asic r300_asic = {
         .mc_wait_for_idle = &r300_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &r100_pci_gart_tlb_flush,
+                .get_page_entry = &r100_pci_gart_get_page_entry,
                 .set_page = &r100_pci_gart_set_page,
         },
         .ring = {
@@ -425,6 +430,7 @@ static struct radeon_asic r300_asic_pcie = {
         .mc_wait_for_idle = &r300_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                 .set_page = &rv370_pcie_gart_set_page,
         },
         .ring = {
@@ -491,6 +497,7 @@ static struct radeon_asic r420_asic = {
         .mc_wait_for_idle = &r300_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                 .set_page = &rv370_pcie_gart_set_page,
         },
         .ring = {
@@ -557,6 +564,7 @@ static struct radeon_asic rs400_asic = {
         .mc_wait_for_idle = &rs400_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &rs400_gart_tlb_flush,
+                .get_page_entry = &rs400_gart_get_page_entry,
                 .set_page = &rs400_gart_set_page,
         },
         .ring = {
@@ -623,6 +631,7 @@ static struct radeon_asic rs600_asic = {
         .mc_wait_for_idle = &rs600_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &rs600_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -691,6 +700,7 @@ static struct radeon_asic rs690_asic = {
         .mc_wait_for_idle = &rs690_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &rs400_gart_tlb_flush,
+                .get_page_entry = &rs400_gart_get_page_entry,
                 .set_page = &rs400_gart_set_page,
         },
         .ring = {
@@ -759,6 +769,7 @@ static struct radeon_asic rv515_asic = {
         .mc_wait_for_idle = &rv515_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                 .set_page = &rv370_pcie_gart_set_page,
         },
         .ring = {
@@ -825,6 +836,7 @@ static struct radeon_asic r520_asic = {
         .mc_wait_for_idle = &r520_mc_wait_for_idle,
         .gart = {
                 .tlb_flush = &rv370_pcie_gart_tlb_flush,
+                .get_page_entry = &rv370_pcie_gart_get_page_entry,
                 .set_page = &rv370_pcie_gart_set_page,
         },
         .ring = {
@@ -919,6 +931,7 @@ static struct radeon_asic r600_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -1004,6 +1017,7 @@ static struct radeon_asic rv6xx_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -1095,6 +1109,7 @@ static struct radeon_asic rs780_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -1199,6 +1214,7 @@ static struct radeon_asic rv770_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &r600_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -1317,6 +1333,7 @@ static struct radeon_asic evergreen_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &evergreen_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -1409,6 +1426,7 @@ static struct radeon_asic sumo_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &evergreen_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -1500,6 +1518,7 @@ static struct radeon_asic btc_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &evergreen_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .ring = {
@@ -1635,6 +1654,7 @@ static struct radeon_asic cayman_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &cayman_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .vm = {
@@ -1738,6 +1758,7 @@ static struct radeon_asic trinity_asic = {
         .get_gpu_clock_counter = &r600_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &cayman_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .vm = {
@@ -1871,6 +1892,7 @@ static struct radeon_asic si_asic = {
         .get_gpu_clock_counter = &si_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &si_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .vm = {
@@ -2032,6 +2054,7 @@ static struct radeon_asic ci_asic = {
         .get_gpu_clock_counter = &cik_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &cik_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .vm = {
@@ -2139,6 +2162,7 @@ static struct radeon_asic kv_asic = {
         .get_gpu_clock_counter = &cik_get_gpu_clock_counter,
         .gart = {
                 .tlb_flush = &cik_pcie_gart_tlb_flush,
+                .get_page_entry = &rs600_gart_get_page_entry,
                 .set_page = &rs600_gart_set_page,
         },
         .vm = {
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 2a45d548d5ec..8d787d115653 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -67,8 +67,9 @@ bool r100_gpu_is_lockup(struct radeon_device *rdev, struct radeon_ring *cp);
 int r100_asic_reset(struct radeon_device *rdev);
 u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
 void r100_pci_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
-                            uint64_t addr, uint32_t flags);
+                            uint64_t entry);
 void r100_ring_start(struct radeon_device *rdev, struct radeon_ring *ring);
 int r100_irq_set(struct radeon_device *rdev);
 int r100_irq_process(struct radeon_device *rdev);
@@ -172,8 +173,9 @@ extern void r300_fence_ring_emit(struct radeon_device *rdev,
                                 struct radeon_fence *fence);
 extern int r300_cs_parse(struct radeon_cs_parser *p);
 extern void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev);
+extern uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags);
 extern void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
-                                     uint64_t addr, uint32_t flags);
+                                     uint64_t entry);
 extern void rv370_set_pcie_lanes(struct radeon_device *rdev, int lanes);
 extern int rv370_get_pcie_lanes(struct radeon_device *rdev);
 extern void r300_set_reg_safe(struct radeon_device *rdev);
@@ -208,8 +210,9 @@ extern void rs400_fini(struct radeon_device *rdev);
 extern int rs400_suspend(struct radeon_device *rdev);
 extern int rs400_resume(struct radeon_device *rdev);
 void rs400_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
-                         uint64_t addr, uint32_t flags);
+                         uint64_t entry);
 uint32_t rs400_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs400_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 int rs400_gart_init(struct radeon_device *rdev);
@@ -232,8 +235,9 @@ int rs600_irq_process(struct radeon_device *rdev);
 void rs600_irq_disable(struct radeon_device *rdev);
 u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc);
 void rs600_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
-                         uint64_t addr, uint32_t flags);
+                         uint64_t entry);
 uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rs600_bandwidth_update(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 0ec65168f331..bd7519fdd3f4 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -774,6 +774,8 @@ int radeon_dummy_page_init(struct radeon_device *rdev)
                 rdev->dummy_page.page = NULL;
                 return -ENOMEM;
         }
+        rdev->dummy_page.entry = radeon_gart_get_page_entry(rdev->dummy_page.addr,
+                                                            RADEON_GART_PAGE_DUMMY);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 84146d5901aa..5450fa95a47e 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -165,6 +165,19 @@ int radeon_gart_table_vram_pin(struct radeon_device *rdev)
                 radeon_bo_unpin(rdev->gart.robj);
         radeon_bo_unreserve(rdev->gart.robj);
         rdev->gart.table_addr = gpu_addr;
+
+        if (!r) {
+                int i;
+
+                /* We might have dropped some GART table updates while it wasn't
+                 * mapped, restore all entries
+                 */
+                for (i = 0; i < rdev->gart.num_gpu_pages; i++)
+                        radeon_gart_set_page(rdev, i, rdev->gart.pages_entry[i]);
+                mb();
+                radeon_gart_tlb_flush(rdev);
+        }
+
         return r;
 }
 
@@ -228,7 +241,6 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
         unsigned t;
         unsigned p;
         int i, j;
-        u64 page_base;
 
         if (!rdev->gart.ready) {
                 WARN(1, "trying to unbind memory from uninitialized GART !\n");
@@ -239,14 +251,12 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
         for (i = 0; i < pages; i++, p++) {
                 if (rdev->gart.pages[p]) {
                         rdev->gart.pages[p] = NULL;
-                        rdev->gart.pages_addr[p] = rdev->dummy_page.addr;
-                        page_base = rdev->gart.pages_addr[p];
                         for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
+                                rdev->gart.pages_entry[t] = rdev->dummy_page.entry;
                                 if (rdev->gart.ptr) {
-                                        radeon_gart_set_page(rdev, t, page_base,
-                                                             RADEON_GART_PAGE_DUMMY);
+                                        radeon_gart_set_page(rdev, t,
+                                                             rdev->dummy_page.entry);
                                 }
-                                page_base += RADEON_GPU_PAGE_SIZE;
                         }
                 }
         }
@@ -274,7 +284,7 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
 {
         unsigned t;
         unsigned p;
-        uint64_t page_base;
+        uint64_t page_base, page_entry;
         int i, j;
 
         if (!rdev->gart.ready) {
@@ -285,14 +295,15 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
         p = t / (PAGE_SIZE / RADEON_GPU_PAGE_SIZE);
 
         for (i = 0; i < pages; i++, p++) {
-                rdev->gart.pages_addr[p] = dma_addr[i];
                 rdev->gart.pages[p] = pagelist[i];
-                if (rdev->gart.ptr) {
-                        page_base = rdev->gart.pages_addr[p];
-                        for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
-                                radeon_gart_set_page(rdev, t, page_base, flags);
-                                page_base += RADEON_GPU_PAGE_SIZE;
+                page_base = dma_addr[i];
+                for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
+                        page_entry = radeon_gart_get_page_entry(page_base, flags);
+                        rdev->gart.pages_entry[t] = page_entry;
+                        if (rdev->gart.ptr) {
+                                radeon_gart_set_page(rdev, t, page_entry);
                         }
+                        page_base += RADEON_GPU_PAGE_SIZE;
                 }
         }
         mb();
@@ -334,16 +345,15 @@ int radeon_gart_init(struct radeon_device *rdev)
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
         }
-        rdev->gart.pages_addr = vzalloc(sizeof(dma_addr_t) *
-                                        rdev->gart.num_cpu_pages);
-        if (rdev->gart.pages_addr == NULL) {
+        rdev->gart.pages_entry = vmalloc(sizeof(uint64_t) *
+                                         rdev->gart.num_gpu_pages);
+        if (rdev->gart.pages_entry == NULL) {
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
         }
         /* set GART entry to point to the dummy page by default */
-        for (i = 0; i < rdev->gart.num_cpu_pages; i++) {
-                rdev->gart.pages_addr[i] = rdev->dummy_page.addr;
-        }
+        for (i = 0; i < rdev->gart.num_gpu_pages; i++)
+                rdev->gart.pages_entry[i] = rdev->dummy_page.entry;
         return 0;
 }
 
@@ -356,15 +366,15 @@ int radeon_gart_init(struct radeon_device *rdev)
  */
 void radeon_gart_fini(struct radeon_device *rdev)
 {
-        if (rdev->gart.pages && rdev->gart.pages_addr && rdev->gart.ready) {
+        if (rdev->gart.ready) {
                 /* unbind pages */
                 radeon_gart_unbind(rdev, 0, rdev->gart.num_cpu_pages);
         }
         rdev->gart.ready = false;
         vfree(rdev->gart.pages);
-        vfree(rdev->gart.pages_addr);
+        vfree(rdev->gart.pages_entry);
         rdev->gart.pages = NULL;
-        rdev->gart.pages_addr = NULL;
+        rdev->gart.pages_entry = NULL;
 
         radeon_dummy_page_fini(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 8bf87f1203cc..bef9a0953284 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -436,7 +436,7 @@ static int kgd_init_memory(struct kgd_dev *kgd)
 static int kgd_init_pipeline(struct kgd_dev *kgd, uint32_t pipe_id,
                                 uint32_t hpd_size, uint64_t hpd_gpu_addr)
 {
-        uint32_t mec = (++pipe_id / CIK_PIPE_PER_MEC) + 1;
+        uint32_t mec = (pipe_id / CIK_PIPE_PER_MEC) + 1;
         uint32_t pipe = (pipe_id % CIK_PIPE_PER_MEC);
 
         lock_srbm(kgd, mec, pipe, 0, 0);
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index cde48c42b30a..06d2246d07f1 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -587,10 +587,8 @@ uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr)
         uint64_t result;
 
         /* page table offset */
-        result = rdev->gart.pages_addr[addr >> PAGE_SHIFT];
-
-        /* in case cpu page size != gpu page size*/
-        result |= addr & (~PAGE_MASK);
+        result = rdev->gart.pages_entry[addr >> RADEON_GPU_PAGE_SHIFT];
+        result &= ~RADEON_GPU_PAGE_MASK;
 
         return result;
 }
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index c5799f16aa4b..34e3235f41d2 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -212,11 +212,9 @@ void rs400_gart_fini(struct radeon_device *rdev)
 #define RS400_PTE_WRITEABLE (1 << 2)
 #define RS400_PTE_READABLE  (1 << 3)
 
-void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
-                         uint64_t addr, uint32_t flags)
+uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags)
 {
         uint32_t entry;
-        u32 *gtt = rdev->gart.ptr;
 
         entry = (lower_32_bits(addr) & PAGE_MASK) |
                 ((upper_32_bits(addr) & 0xff) << 4);
@@ -226,8 +224,14 @@ void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
                 entry |= RS400_PTE_WRITEABLE;
         if (!(flags & RADEON_GART_PAGE_SNOOP))
                 entry |= RS400_PTE_UNSNOOPED;
-        entry = cpu_to_le32(entry);
-        gtt[i] = entry;
+        return entry;
+}
+
+void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
+                         uint64_t entry)
+{
+        u32 *gtt = rdev->gart.ptr;
+        gtt[i] = cpu_to_le32(lower_32_bits(entry));
 }
 
 int rs400_mc_wait_for_idle(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 9acb1c3c005b..74bce91aecc1 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -625,11 +625,8 @@ static void rs600_gart_fini(struct radeon_device *rdev)
         radeon_gart_table_vram_free(rdev);
 }
 
-void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
-                         uint64_t addr, uint32_t flags)
+uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags)
 {
-        void __iomem *ptr = (void *)rdev->gart.ptr;
-
         addr = addr & 0xFFFFFFFFFFFFF000ULL;
         addr |= R600_PTE_SYSTEM;
         if (flags & RADEON_GART_PAGE_VALID)
@@ -640,7 +637,14 @@ void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
                 addr |= R600_PTE_WRITEABLE;
         if (flags & RADEON_GART_PAGE_SNOOP)
                 addr |= R600_PTE_SNOOPED;
-        writeq(addr, ptr + (i * 8));
+        return addr;
+}
+
+void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
+                         uint64_t entry)
+{
+        void __iomem *ptr = (void *)rdev->gart.ptr;
+        writeq(entry, ptr + (i * 8));
 }
 
 int rs600_irq_set(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/si_dma.c b/drivers/gpu/drm/radeon/si_dma.c
index aa7b872b2c43..83207929fc62 100644
--- a/drivers/gpu/drm/radeon/si_dma.c
+++ b/drivers/gpu/drm/radeon/si_dma.c
@@ -123,7 +123,6 @@ void si_dma_vm_write_pages(struct radeon_device *rdev,
                 for (; ndw > 0; ndw -= 2, --count, pe += 8) {
                         if (flags & R600_PTE_SYSTEM) {
                                 value = radeon_vm_map_gart(rdev, addr);
-                                value &= 0xFFFFFFFFFFFFF000ULL;
                         } else if (flags & R600_PTE_VALID) {
                                 value = addr;
                         } else {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 7b5d22110f25..6c6b655defcf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -406,11 +406,9 @@ int vmw_3d_resource_inc(struct vmw_private *dev_priv,
                 if (unlikely(ret != 0))
                         --dev_priv->num_3d_resources;
         } else if (unhide_svga) {
-                mutex_lock(&dev_priv->hw_mutex);
                 vmw_write(dev_priv, SVGA_REG_ENABLE,
                           vmw_read(dev_priv, SVGA_REG_ENABLE) &
                           ~SVGA_REG_ENABLE_HIDE);
-                mutex_unlock(&dev_priv->hw_mutex);
         }
 
         mutex_unlock(&dev_priv->release_mutex);
@@ -433,13 +431,10 @@ void vmw_3d_resource_dec(struct vmw_private *dev_priv,
         mutex_lock(&dev_priv->release_mutex);
         if (unlikely(--dev_priv->num_3d_resources == 0))
                 vmw_release_device(dev_priv);
-        else if (hide_svga) {
-                mutex_lock(&dev_priv->hw_mutex);
+        else if (hide_svga)
                 vmw_write(dev_priv, SVGA_REG_ENABLE,
                           vmw_read(dev_priv, SVGA_REG_ENABLE) |
                           SVGA_REG_ENABLE_HIDE);
-                mutex_unlock(&dev_priv->hw_mutex);
-        }
 
         n3d = (int32_t) dev_priv->num_3d_resources;
         mutex_unlock(&dev_priv->release_mutex);
@@ -600,12 +595,14 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         dev_priv->dev = dev;
         dev_priv->vmw_chipset = chipset;
         dev_priv->last_read_seqno = (uint32_t) -100;
-        mutex_init(&dev_priv->hw_mutex);
         mutex_init(&dev_priv->cmdbuf_mutex);
         mutex_init(&dev_priv->release_mutex);
         mutex_init(&dev_priv->binding_mutex);
         rwlock_init(&dev_priv->resource_lock);
         ttm_lock_init(&dev_priv->reservation_sem);
+        spin_lock_init(&dev_priv->hw_lock);
+        spin_lock_init(&dev_priv->waiter_lock);
+        spin_lock_init(&dev_priv->cap_lock);
 
         for (i = vmw_res_context; i < vmw_res_max; ++i) {
                 idr_init(&dev_priv->res_idr[i]);
@@ -626,14 +623,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 
         dev_priv->enable_fb = enable_fbdev;
 
-        mutex_lock(&dev_priv->hw_mutex);
-
         vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
         svga_id = vmw_read(dev_priv, SVGA_REG_ID);
         if (svga_id != SVGA_ID_2) {
                 ret = -ENOSYS;
                 DRM_ERROR("Unsupported SVGA ID 0x%x\n", svga_id);
-                mutex_unlock(&dev_priv->hw_mutex);
                 goto out_err0;
         }
 
@@ -683,10 +677,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 dev_priv->prim_bb_mem = dev_priv->vram_size;
 
         ret = vmw_dma_masks(dev_priv);
-        if (unlikely(ret != 0)) {
-                mutex_unlock(&dev_priv->hw_mutex);
+        if (unlikely(ret != 0))
                 goto out_err0;
-        }
 
         /*
          * Limit back buffer size to VRAM size.  Remove this once
@@ -695,8 +687,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         if (dev_priv->prim_bb_mem > dev_priv->vram_size)
                 dev_priv->prim_bb_mem = dev_priv->vram_size;
 
-        mutex_unlock(&dev_priv->hw_mutex);
-
         vmw_print_capabilities(dev_priv->capabilities);
 
         if (dev_priv->capabilities & SVGA_CAP_GMR2) {
@@ -1160,9 +1150,7 @@ static int vmw_master_set(struct drm_device *dev,
                 if (unlikely(ret != 0))
                         return ret;
                 vmw_kms_save_vga(dev_priv);
-                mutex_lock(&dev_priv->hw_mutex);
                 vmw_write(dev_priv, SVGA_REG_TRACES, 0);
-                mutex_unlock(&dev_priv->hw_mutex);
         }
 
         if (active) {
@@ -1196,9 +1184,7 @@ out_no_active_lock:
         if (!dev_priv->enable_fb) {
                 vmw_kms_restore_vga(dev_priv);
                 vmw_3d_resource_dec(dev_priv, true);
-                mutex_lock(&dev_priv->hw_mutex);
                 vmw_write(dev_priv, SVGA_REG_TRACES, 1);
-                mutex_unlock(&dev_priv->hw_mutex);
         }
         return ret;
 }
@@ -1233,9 +1219,7 @@ static void vmw_master_drop(struct drm_device *dev,
                         DRM_ERROR("Unable to clean VRAM on master drop.\n");
                 vmw_kms_restore_vga(dev_priv);
                 vmw_3d_resource_dec(dev_priv, true);
-                mutex_lock(&dev_priv->hw_mutex);
                 vmw_write(dev_priv, SVGA_REG_TRACES, 1);
-                mutex_unlock(&dev_priv->hw_mutex);
         }
 
         dev_priv->active_master = &dev_priv->fbdev_master;
@@ -1367,10 +1351,8 @@ static void vmw_pm_complete(struct device *kdev)
         struct drm_device *dev = pci_get_drvdata(pdev);
         struct vmw_private *dev_priv = vmw_priv(dev);
 
-        mutex_lock(&dev_priv->hw_mutex);
         vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
         (void) vmw_read(dev_priv, SVGA_REG_ID);
-        mutex_unlock(&dev_priv->hw_mutex);
 
         /**
          * Reclaim 3d reference held by fbdev and potentially
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 4ee799b43d5d..d26a6daa9719 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -399,7 +399,8 @@ struct vmw_private {
         uint32_t memory_size;
         bool has_gmr;
         bool has_mob;
-        struct mutex hw_mutex;
+        spinlock_t hw_lock;
+        spinlock_t cap_lock;
 
         /*
          * VGA registers.
@@ -449,8 +450,9 @@ struct vmw_private {
         atomic_t marker_seq;
         wait_queue_head_t fence_queue;
         wait_queue_head_t fifo_queue;
-        int fence_queue_waiters; /* Protected by hw_mutex */
-        int goal_queue_waiters; /* Protected by hw_mutex */
+        spinlock_t waiter_lock;
+        int fence_queue_waiters; /* Protected by waiter_lock */
+        int goal_queue_waiters; /* Protected by waiter_lock */
         atomic_t fifo_queue_waiters;
         uint32_t last_read_seqno;
         spinlock_t irq_lock;
@@ -553,20 +555,35 @@ static inline struct vmw_master *vmw_master(struct drm_master *master)
         return (struct vmw_master *) master->driver_priv;
 }
 
+/*
+ * The locking here is fine-grained, so that it is performed once
+ * for every read- and write operation. This is of course costly, but we
+ * don't perform much register access in the timing critical paths anyway.
+ * Instead we have the extra benefit of being sure that we don't forget
+ * the hw lock around register accesses.
+ */
 static inline void vmw_write(struct vmw_private *dev_priv,
                              unsigned int offset, uint32_t value)
 {
+        unsigned long irq_flags;
+
+        spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
         outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
         outl(value, dev_priv->io_start + VMWGFX_VALUE_PORT);
+        spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
 }
 
 static inline uint32_t vmw_read(struct vmw_private *dev_priv,
                                 unsigned int offset)
 {
-        uint32_t val;
+        unsigned long irq_flags;
+        u32 val;
 
+        spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
         outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
         val = inl(dev_priv->io_start + VMWGFX_VALUE_PORT);
+        spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
+
         return val;
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index b7594cb758af..945f1e0dad92 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -35,7 +35,7 @@ struct vmw_fence_manager {
         struct vmw_private *dev_priv;
         spinlock_t lock;
         struct list_head fence_list;
-        struct work_struct work, ping_work;
+        struct work_struct work;
         u32 user_fence_size;
         u32 fence_size;
         u32 event_fence_action_size;
@@ -134,14 +134,6 @@ static const char *vmw_fence_get_timeline_name(struct fence *f)
         return "svga";
 }
 
-static void vmw_fence_ping_func(struct work_struct *work)
-{
-        struct vmw_fence_manager *fman =
-                container_of(work, struct vmw_fence_manager, ping_work);
-
-        vmw_fifo_ping_host(fman->dev_priv, SVGA_SYNC_GENERIC);
-}
-
 static bool vmw_fence_enable_signaling(struct fence *f)
 {
         struct vmw_fence_obj *fence =
@@ -155,11 +147,7 @@ static bool vmw_fence_enable_signaling(struct fence *f)
         if (seqno - fence->base.seqno < VMW_FENCE_WRAP)
                 return false;
 
-        if (mutex_trylock(&dev_priv->hw_mutex)) {
-                vmw_fifo_ping_host_locked(dev_priv, SVGA_SYNC_GENERIC);
-                mutex_unlock(&dev_priv->hw_mutex);
-        } else
-                schedule_work(&fman->ping_work);
+        vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
 
         return true;
 }
@@ -305,7 +293,6 @@ struct vmw_fence_manager *vmw_fence_manager_init(struct vmw_private *dev_priv)
         INIT_LIST_HEAD(&fman->fence_list);
         INIT_LIST_HEAD(&fman->cleanup_list);
         INIT_WORK(&fman->work, &vmw_fence_work_func);
-        INIT_WORK(&fman->ping_work, &vmw_fence_ping_func);
         fman->fifo_down = true;
         fman->user_fence_size = ttm_round_pot(sizeof(struct vmw_user_fence));
         fman->fence_size = ttm_round_pot(sizeof(struct vmw_fence_obj));
@@ -323,7 +310,6 @@ void vmw_fence_manager_takedown(struct vmw_fence_manager *fman)
         bool lists_empty;
 
         (void) cancel_work_sync(&fman->work);
-        (void) cancel_work_sync(&fman->ping_work);
 
         spin_lock_irqsave(&fman->lock, irq_flags);
         lists_empty = list_empty(&fman->fence_list) &&
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index 09e10aefcd8e..39f2b03888e7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -44,10 +44,10 @@ bool vmw_fifo_have_3d(struct vmw_private *dev_priv)
                 if (!dev_priv->has_mob)
                         return false;
 
-                mutex_lock(&dev_priv->hw_mutex);
+                spin_lock(&dev_priv->cap_lock);
                 vmw_write(dev_priv, SVGA_REG_DEV_CAP, SVGA3D_DEVCAP_3D);
                 result = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
-                mutex_unlock(&dev_priv->hw_mutex);
+                spin_unlock(&dev_priv->cap_lock);
 
                 return (result != 0);
         }
@@ -120,7 +120,6 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
         DRM_INFO("height %d\n", vmw_read(dev_priv, SVGA_REG_HEIGHT));
         DRM_INFO("bpp %d\n", vmw_read(dev_priv, SVGA_REG_BITS_PER_PIXEL));
 
-        mutex_lock(&dev_priv->hw_mutex);
         dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
         dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
         dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
@@ -143,7 +142,6 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
         mb();
 
         vmw_write(dev_priv, SVGA_REG_CONFIG_DONE, 1);
-        mutex_unlock(&dev_priv->hw_mutex);
 
         max = ioread32(fifo_mem + SVGA_FIFO_MAX);
         min = ioread32(fifo_mem  + SVGA_FIFO_MIN);
@@ -160,31 +158,28 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
         return vmw_fifo_send_fence(dev_priv, &dummy);
 }
 
-void vmw_fifo_ping_host_locked(struct vmw_private *dev_priv, uint32_t reason)
+void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
 {
         __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+        static DEFINE_SPINLOCK(ping_lock);
+        unsigned long irq_flags;
 
+        /*
+         * The ping_lock is needed because we don't have an atomic
+         * test-and-set of the SVGA_FIFO_BUSY register.
+         */
+        spin_lock_irqsave(&ping_lock, irq_flags);
         if (unlikely(ioread32(fifo_mem + SVGA_FIFO_BUSY) == 0)) {
                 iowrite32(1, fifo_mem + SVGA_FIFO_BUSY);
                 vmw_write(dev_priv, SVGA_REG_SYNC, reason);
         }
-}
-
-void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
-{
-        mutex_lock(&dev_priv->hw_mutex);
-
-        vmw_fifo_ping_host_locked(dev_priv, reason);
-
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock_irqrestore(&ping_lock, irq_flags);
 }
 
 void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
 {
         __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
 
-        mutex_lock(&dev_priv->hw_mutex);
-
         vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
         while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
                 ;
@@ -198,7 +193,6 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
         vmw_write(dev_priv, SVGA_REG_TRACES,
                   dev_priv->traces_state);
 
-        mutex_unlock(&dev_priv->hw_mutex);
         vmw_marker_queue_takedown(&fifo->marker_queue);
 
         if (likely(fifo->static_buffer != NULL)) {
@@ -271,7 +265,7 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
                 return vmw_fifo_wait_noirq(dev_priv, bytes,
                                            interruptible, timeout);
 
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
         if (atomic_add_return(1, &dev_priv->fifo_queue_waiters) > 0) {
                 spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
                 outl(SVGA_IRQFLAG_FIFO_PROGRESS,
@@ -280,7 +274,7 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
                 vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                 spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
         }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 
         if (interruptible)
                 ret = wait_event_interruptible_timeout
@@ -296,14 +290,14 @@ static int vmw_fifo_wait(struct vmw_private *dev_priv,
         else if (likely(ret > 0))
                 ret = 0;
 
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
         if (atomic_dec_and_test(&dev_priv->fifo_queue_waiters)) {
                 spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
                 dev_priv->irq_mask &= ~SVGA_IRQFLAG_FIFO_PROGRESS;
                 vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                 spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
         }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 37881ecf5d7a..69c8ce23123c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -135,13 +135,13 @@ static int vmw_fill_compat_cap(struct vmw_private *dev_priv, void *bounce,
                 (pair_offset + max_size * sizeof(SVGA3dCapPair)) / sizeof(u32);
         compat_cap->header.type = SVGA3DCAPS_RECORD_DEVCAPS;
 
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->cap_lock);
         for (i = 0; i < max_size; ++i) {
                 vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
                 compat_cap->pairs[i][0] = i;
                 compat_cap->pairs[i][1] = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
         }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->cap_lock);
 
         return 0;
 }
@@ -191,12 +191,12 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
                 if (num > SVGA3D_DEVCAP_MAX)
                         num = SVGA3D_DEVCAP_MAX;
 
-                mutex_lock(&dev_priv->hw_mutex);
+                spin_lock(&dev_priv->cap_lock);
                 for (i = 0; i < num; ++i) {
                         vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
                         *bounce32++ = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
                 }
-                mutex_unlock(&dev_priv->hw_mutex);
+                spin_unlock(&dev_priv->cap_lock);
         } else if (gb_objects) {
                 ret = vmw_fill_compat_cap(dev_priv, bounce, size);
                 if (unlikely(ret != 0))
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
index 0c423766c441..9fe9827ee499 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
@@ -62,13 +62,8 @@ irqreturn_t vmw_irq_handler(int irq, void *arg)
 
 static bool vmw_fifo_idle(struct vmw_private *dev_priv, uint32_t seqno)
 {
-        uint32_t busy;
 
-        mutex_lock(&dev_priv->hw_mutex);
-        busy = vmw_read(dev_priv, SVGA_REG_BUSY);
-        mutex_unlock(&dev_priv->hw_mutex);
-
-        return (busy == 0);
+        return (vmw_read(dev_priv, SVGA_REG_BUSY) == 0);
 }
 
 void vmw_update_seqno(struct vmw_private *dev_priv,
@@ -184,7 +179,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
 
 void vmw_seqno_waiter_add(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
         if (dev_priv->fence_queue_waiters++ == 0) {
                 unsigned long irq_flags;
 
@@ -195,12 +190,12 @@ void vmw_seqno_waiter_add(struct vmw_private *dev_priv)
                 vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                 spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
         }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 
 void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
         if (--dev_priv->fence_queue_waiters == 0) {
                 unsigned long irq_flags;
 
@@ -209,13 +204,13 @@ void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)
                 vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                 spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
         }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 
 
 void vmw_goal_waiter_add(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
         if (dev_priv->goal_queue_waiters++ == 0) {
                 unsigned long irq_flags;
 
@@ -226,12 +221,12 @@ void vmw_goal_waiter_add(struct vmw_private *dev_priv)
                 vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                 spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
         }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 
 void vmw_goal_waiter_remove(struct vmw_private *dev_priv)
 {
-        mutex_lock(&dev_priv->hw_mutex);
+        spin_lock(&dev_priv->waiter_lock);
         if (--dev_priv->goal_queue_waiters == 0) {
                 unsigned long irq_flags;
 
@@ -240,7 +235,7 @@ void vmw_goal_waiter_remove(struct vmw_private *dev_priv)
                 vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
                 spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
         }
-        mutex_unlock(&dev_priv->hw_mutex);
+        spin_unlock(&dev_priv->waiter_lock);
 }
 
 int vmw_wait_seqno(struct vmw_private *dev_priv,
@@ -315,9 +310,7 @@ void vmw_irq_uninstall(struct drm_device *dev)
         if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
                 return;
 
-        mutex_lock(&dev_priv->hw_mutex);
         vmw_write(dev_priv, SVGA_REG_IRQMASK, 0);
-        mutex_unlock(&dev_priv->hw_mutex);
 
         status = inl(dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
         outl(status, dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 3725b521d931..8725b79e7847 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1828,9 +1828,7 @@ vmw_du_connector_detect(struct drm_connector *connector, bool force)
         struct vmw_private *dev_priv = vmw_priv(dev);
         struct vmw_display_unit *du = vmw_connector_to_du(connector);
 
-        mutex_lock(&dev_priv->hw_mutex);
         num_displays = vmw_read(dev_priv, SVGA_REG_NUM_DISPLAYS);
-        mutex_unlock(&dev_priv->hw_mutex);
 
         return ((vmw_connector_to_du(connector)->unit < num_displays &&
                  du->pref_active) ?
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 31e8308ba899..ab838d9e28b6 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -881,6 +881,7 @@ config I2C_XLR
 config I2C_RCAR
         tristate "Renesas R-Car I2C Controller"
         depends on ARCH_SHMOBILE || COMPILE_TEST
+        select I2C_SLAVE
         help
           If you say yes to this option, support will be included for the
           R-Car I2C controller.
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index bff20a589621..958c8db4ec30 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -785,14 +785,16 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,
         int ret;
 
         pm_runtime_get_sync(&adap->dev);
-        clk_prepare_enable(i2c->clk);
+        ret = clk_enable(i2c->clk);
+        if (ret)
+                return ret;
 
         for (retry = 0; retry < adap->retries; retry++) {
 
                 ret = s3c24xx_i2c_doxfer(i2c, msgs, num);
 
                 if (ret != -EAGAIN) {
-                        clk_disable_unprepare(i2c->clk);
+                        clk_disable(i2c->clk);
                         pm_runtime_put(&adap->dev);
                         return ret;
                 }
@@ -802,7 +804,7 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,
                 udelay(100);
         }
 
-        clk_disable_unprepare(i2c->clk);
+        clk_disable(i2c->clk);
         pm_runtime_put(&adap->dev);
         return -EREMOTEIO;
 }
@@ -1197,7 +1199,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
 
         clk_prepare_enable(i2c->clk);
         ret = s3c24xx_i2c_init(i2c);
-        clk_disable_unprepare(i2c->clk);
+        clk_disable(i2c->clk);
         if (ret != 0) {
                 dev_err(&pdev->dev, "I2C controller init failed\n");
                 return ret;
@@ -1210,6 +1212,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
                 i2c->irq = ret = platform_get_irq(pdev, 0);
                 if (ret <= 0) {
                         dev_err(&pdev->dev, "cannot find IRQ\n");
+                        clk_unprepare(i2c->clk);
                         return ret;
                 }
 
@@ -1218,6 +1221,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
 
                 if (ret != 0) {
                         dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq);
+                        clk_unprepare(i2c->clk);
                         return ret;
                 }
         }
@@ -1225,6 +1229,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
         ret = s3c24xx_i2c_register_cpufreq(i2c);
         if (ret < 0) {
                 dev_err(&pdev->dev, "failed to register cpufreq notifier\n");
+                clk_unprepare(i2c->clk);
                 return ret;
         }
 
@@ -1241,6 +1246,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
         if (ret < 0) {
                 dev_err(&pdev->dev, "failed to add bus to i2c core\n");
                 s3c24xx_i2c_deregister_cpufreq(i2c);
+                clk_unprepare(i2c->clk);
                 return ret;
         }
 
@@ -1262,6 +1268,8 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev)
 {
         struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
 
+        clk_unprepare(i2c->clk);
+
         pm_runtime_disable(&i2c->adap.dev);
         pm_runtime_disable(&pdev->dev);
 
@@ -1293,13 +1301,16 @@ static int s3c24xx_i2c_resume_noirq(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+        int ret;
 
         if (!IS_ERR(i2c->sysreg))
                 regmap_write(i2c->sysreg, EXYNOS5_SYS_I2C_CFG, i2c->sys_i2c_cfg);
 
-        clk_prepare_enable(i2c->clk);
+        ret = clk_enable(i2c->clk);
+        if (ret)
+                return ret;
         s3c24xx_i2c_init(i2c);
-        clk_disable_unprepare(i2c->clk);
+        clk_disable(i2c->clk);
         i2c->suspended = 0;
 
         return 0;
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 440d5dbc8b5f..007818b3e174 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -139,6 +139,7 @@ struct sh_mobile_i2c_data {
         int pos;
         int sr;
         bool send_stop;
+        bool stop_after_dma;
 
         struct resource *res;
         struct dma_chan *dma_tx;
@@ -407,7 +408,7 @@ static int sh_mobile_i2c_isr_tx(struct sh_mobile_i2c_data *pd)
 
         if (pd->pos == pd->msg->len) {
                 /* Send stop if we haven't yet (DMA case) */
-                if (pd->send_stop && (iic_rd(pd, ICCR) & ICCR_BBSY))
+                if (pd->send_stop && pd->stop_after_dma)
                         i2c_op(pd, OP_TX_STOP, 0);
                 return 1;
         }
@@ -449,6 +450,13 @@ static int sh_mobile_i2c_isr_rx(struct sh_mobile_i2c_data *pd)
                 real_pos = pd->pos - 2;
 
                 if (pd->pos == pd->msg->len) {
+                        if (pd->stop_after_dma) {
+                                /* Simulate PIO end condition after DMA transfer */
+                                i2c_op(pd, OP_RX_STOP, 0);
+                                pd->pos++;
+                                break;
+                        }
+
                         if (real_pos < 0) {
                                 i2c_op(pd, OP_RX_STOP, 0);
                                 break;
@@ -536,6 +544,7 @@ static void sh_mobile_i2c_dma_callback(void *data)
 
         sh_mobile_i2c_dma_unmap(pd);
         pd->pos = pd->msg->len;
+        pd->stop_after_dma = true;
 
         iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
 }
@@ -726,6 +735,7 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
                 bool do_start = pd->send_stop || !i;
                 msg = &msgs[i];
                 pd->send_stop = i == num - 1 || msg->flags & I2C_M_STOP;
+                pd->stop_after_dma = false;
 
                 err = start_ch(pd, msg, do_start);
                 if (err)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 39d25a8cb1ad..e9eae57a2b50 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -2972,6 +2972,7 @@ trace:
 }
 EXPORT_SYMBOL(i2c_smbus_xfer);
 
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
 int i2c_slave_register(struct i2c_client *client, i2c_slave_cb_t slave_cb)
 {
         int ret;
@@ -3019,6 +3020,7 @@ int i2c_slave_unregister(struct i2c_client *client)
         return ret;
 }
 EXPORT_SYMBOL_GPL(i2c_slave_unregister);
+#endif
 
 MODULE_AUTHOR("Simon G. Vogl <simon@tk.uni-linz.ac.at>");
 MODULE_DESCRIPTION("I2C-Bus main module");
diff --git a/drivers/i2c/i2c-slave-eeprom.c b/drivers/i2c/i2c-slave-eeprom.c
index 6631400b5f02..cf9b09db092f 100644
--- a/drivers/i2c/i2c-slave-eeprom.c
+++ b/drivers/i2c/i2c-slave-eeprom.c
@@ -74,7 +74,7 @@ static ssize_t i2c_slave_eeprom_bin_read(struct file *filp, struct kobject *kobj
         struct eeprom_data *eeprom;
         unsigned long flags;
 
-        if (off + count >= attr->size)
+        if (off + count > attr->size)
                 return -EFBIG;
 
         eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
@@ -92,7 +92,7 @@ static ssize_t i2c_slave_eeprom_bin_write(struct file *filp, struct kobject *kob
         struct eeprom_data *eeprom;
         unsigned long flags;
 
-        if (off + count >= attr->size)
+        if (off + count > attr->size)
                 return -EFBIG;
 
         eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 77ecf6d32237..6e22682c8255 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1097,6 +1097,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX31               0x361f00        20, 15, 0e      clickpad
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
+ * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
  * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
  * Lenovo L430             0x350f02        b9, 15, 0c      2 hw buttons (*)
@@ -1475,6 +1477,20 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
                 },
         },
+        {
+                /* Fujitsu LIFEBOOK E554  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
+                },
+        },
+        {
+                /* Fujitsu LIFEBOOK E544  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E544"),
+                },
+        },
 #endif
         { }
 };
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f9472920d986..23e26e0768b5 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -135,8 +135,9 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
                 1232, 5710, 1156, 4696
         },
         {
-                (const char * const []){"LEN0034", "LEN0036", "LEN0039",
-                                        "LEN2002", "LEN2004", NULL},
+                (const char * const []){"LEN0034", "LEN0036", "LEN0037",
+                                        "LEN0039", "LEN2002", "LEN2004",
+                                        NULL},
                 1024, 5112, 2024, 4832
         },
         {
@@ -165,7 +166,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
         "LEN0035", /* X240 */
         "LEN0036", /* T440 */
-        "LEN0037",
+        "LEN0037", /* X1 Carbon 2nd */
         "LEN0038",
         "LEN0039", /* T440s */
         "LEN0041",
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 764857b4e268..c11556563ef0 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -152,6 +152,14 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
                 },
         },
         {
+                /* Medion Akoya E7225 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+                },
+        },
+        {
                 /* Blue FB5601 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "blue"),
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index f722a0c466cf..c48da057dbb1 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -315,6 +315,7 @@ static const struct iommu_ops gart_iommu_ops = {
         .attach_dev     = gart_iommu_attach_dev,
         .detach_dev     = gart_iommu_detach_dev,
         .map            = gart_iommu_map,
+        .map_sg         = default_iommu_map_sg,
         .unmap          = gart_iommu_unmap,
         .iova_to_phys   = gart_iommu_iova_to_phys,
         .pgsize_bitmap  = GART_IOMMU_PGSIZES,
@@ -395,7 +396,7 @@ static int tegra_gart_probe(struct platform_device *pdev)
         do_gart_setup(gart, NULL);
 
         gart_handle = gart;
-        bus_set_iommu(&platform_bus_type, &gart_iommu_ops);
+
         return 0;
 }
 
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 21b156242e42..c1c010498a21 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -683,7 +683,7 @@ static struct dm_cache_metadata *metadata_open(struct block_device *bdev,
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (!cmd) {
                 DMERR("could not allocate metadata struct");
-                return NULL;
+                return ERR_PTR(-ENOMEM);
         }
 
         atomic_set(&cmd->ref_count, 1);
@@ -745,7 +745,7 @@ static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev,
                 return cmd;
 
         cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size);
-        if (cmd) {
+        if (!IS_ERR(cmd)) {
                 mutex_lock(&table_lock);
                 cmd2 = lookup(bdev);
                 if (cmd2) {
@@ -780,9 +780,10 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
 {
         struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size,
                                                        may_format_device, policy_hint_size);
-        if (cmd && !same_params(cmd, data_block_size)) {
+
+        if (!IS_ERR(cmd) && !same_params(cmd, data_block_size)) {
                 dm_cache_metadata_close(cmd);
-                return NULL;
+                return ERR_PTR(-EINVAL);
         }
 
         return cmd;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 493478989dbd..07705ee181e3 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -3385,6 +3385,12 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv)
         struct pool_c *pt = ti->private;
         struct pool *pool = pt->pool;
 
+        if (get_pool_mode(pool) >= PM_READ_ONLY) {
+                DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
+                      dm_device_name(pool->pool_md));
+                return -EINVAL;
+        }
+
         if (!strcasecmp(argv[0], "create_thin"))
                 r = process_create_thin_mesg(argc, argv, pool);
 
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index f94a9fa60488..c672c4dcffac 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -615,6 +615,9 @@ static void c_can_stop(struct net_device *dev)
 
         c_can_irq_control(priv, false);
 
+        /* put ctrl to init on stop to end ongoing transmission */
+        priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_INIT);
+
         /* deactivate pins */
         pinctrl_pm_select_sleep_state(dev->dev.parent);
         priv->can.state = CAN_STATE_STOPPED;
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index c32cd61073bc..7af379ca861b 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -587,7 +587,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
                           usb_sndbulkpipe(dev->udev,
                                           dev->bulk_out->bEndpointAddress),
                           buf, msg->len,
-                          kvaser_usb_simple_msg_callback, priv);
+                          kvaser_usb_simple_msg_callback, netdev);
         usb_anchor_urb(urb, &priv->tx_submitted);
 
         err = usb_submit_urb(urb, GFP_ATOMIC);
@@ -662,11 +662,6 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
         priv = dev->nets[channel];
         stats = &priv->netdev->stats;
 
-        if (status & M16C_STATE_BUS_RESET) {
-                kvaser_usb_unlink_tx_urbs(priv);
-                return;
-        }
-
         skb = alloc_can_err_skb(priv->netdev, &cf);
         if (!skb) {
                 stats->rx_dropped++;
@@ -677,7 +672,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
 
         netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status);
 
-        if (status & M16C_STATE_BUS_OFF) {
+        if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) {
                 cf->can_id |= CAN_ERR_BUSOFF;
 
                 priv->can.can_stats.bus_off++;
@@ -703,9 +698,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
                 }
 
                 new_state = CAN_STATE_ERROR_PASSIVE;
-        }
-
-        if (status == M16C_STATE_BUS_ERROR) {
+        } else if (status & M16C_STATE_BUS_ERROR) {
                 if ((priv->can.state < CAN_STATE_ERROR_WARNING) &&
                     ((txerr >= 96) || (rxerr >= 96))) {
                         cf->can_id |= CAN_ERR_CRTL;
@@ -715,7 +708,8 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
 
                         priv->can.can_stats.error_warning++;
                         new_state = CAN_STATE_ERROR_WARNING;
-                } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) {
+                } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) &&
+                           ((txerr < 96) && (rxerr < 96))) {
                         cf->can_id |= CAN_ERR_PROT;
                         cf->data[2] = CAN_ERR_PROT_ACTIVE;
 
@@ -1590,7 +1584,7 @@ static int kvaser_usb_probe(struct usb_interface *intf,
 {
         struct kvaser_usb *dev;
         int err = -ENOMEM;
-        int i;
+        int i, retry = 3;
 
         dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
         if (!dev)
@@ -1608,7 +1602,15 @@ static int kvaser_usb_probe(struct usb_interface *intf,
 
         usb_set_intfdata(intf, dev);
 
-        err = kvaser_usb_get_software_info(dev);
+        /* On some x86 laptops, plugging a Kvaser device again after
+         * an unplug makes the firmware always ignore the very first
+         * command. For such a case, provide some room for retries
+         * instead of completely exiting the driver.
+         */
+        do {
+                err = kvaser_usb_get_software_info(dev);
+        } while (--retry && err == -ETIMEDOUT);
+
         if (err) {
                 dev_err(&intf->dev,
                         "Cannot get software infos, error %d\n", err);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 75b08c63d39f..29a09271b64a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -767,16 +767,17 @@
 #define MTL_Q_RQOMR                     0x40
 #define MTL_Q_RQMPOCR                   0x44
 #define MTL_Q_RQDR                      0x4c
+#define MTL_Q_RQFCR                     0x50
 #define MTL_Q_IER                       0x70
 #define MTL_Q_ISR                       0x74
 
 /* MTL queue register entry bit positions and sizes */
+#define MTL_Q_RQFCR_RFA_INDEX           1
+#define MTL_Q_RQFCR_RFA_WIDTH           6
+#define MTL_Q_RQFCR_RFD_INDEX           17
+#define MTL_Q_RQFCR_RFD_WIDTH           6
 #define MTL_Q_RQOMR_EHFC_INDEX          7
 #define MTL_Q_RQOMR_EHFC_WIDTH          1
-#define MTL_Q_RQOMR_RFA_INDEX           8
-#define MTL_Q_RQOMR_RFA_WIDTH           3
-#define MTL_Q_RQOMR_RFD_INDEX           13
-#define MTL_Q_RQOMR_RFD_WIDTH           3
 #define MTL_Q_RQOMR_RQS_INDEX           16
 #define MTL_Q_RQOMR_RQS_WIDTH           9
 #define MTL_Q_RQOMR_RSF_INDEX           5
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 53f5f66ec2ee..4c66cd1d1e60 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -2079,10 +2079,10 @@ static void xgbe_config_flow_control_threshold(struct xgbe_prv_data *pdata)
 
         for (i = 0; i < pdata->rx_q_count; i++) {
                 /* Activate flow control when less than 4k left in fifo */
-                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFA, 2);
+                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFA, 2);
 
                 /* De-activate flow control when more than 6k left in fifo */
-                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFD, 4);
+                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFD, 4);
         }
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 1d1147c93d59..e468ed3f210f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3175,7 +3175,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
                 }
 #endif
                 if (!bnx2x_fp_lock_napi(fp))
-                        return work_done;
+                        return budget;
 
                 for_each_cos_in_tx_queue(fp, cos)
                         if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos]))
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index b29e027c476e..e356afa44e7d 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1335,7 +1335,7 @@ static int enic_poll_msix_rq(struct napi_struct *napi, int budget)
         int err;
 
         if (!enic_poll_lock_napi(&enic->rq[rq]))
-                return work_done;
+                return budget;
         /* Service RQ
          */
 
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index a62fc38f045e..1c75829eb166 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -192,6 +192,10 @@ static char mv643xx_eth_driver_version[] = "1.4";
 #define IS_TSO_HEADER(txq, addr) \
         ((addr >= txq->tso_hdrs_dma) && \
          (addr < txq->tso_hdrs_dma + txq->tx_ring_size * TSO_HEADER_SIZE))
+
+#define DESC_DMA_MAP_SINGLE 0
+#define DESC_DMA_MAP_PAGE 1
+
 /*
  * RX/TX descriptors.
  */
@@ -362,6 +366,7 @@ struct tx_queue {
         dma_addr_t tso_hdrs_dma;
 
         struct tx_desc *tx_desc_area;
+        char *tx_desc_mapping; /* array to track the type of the dma mapping */
         dma_addr_t tx_desc_dma;
         int tx_desc_area_size;
 
@@ -750,6 +755,7 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq,
         if (txq->tx_curr_desc == txq->tx_ring_size)
                 txq->tx_curr_desc = 0;
         desc = &txq->tx_desc_area[tx_index];
+        txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
 
         desc->l4i_chk = 0;
         desc->byte_cnt = length;
@@ -879,14 +885,13 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
                 skb_frag_t *this_frag;
                 int tx_index;
                 struct tx_desc *desc;
-                void *addr;
 
                 this_frag = &skb_shinfo(skb)->frags[frag];
-                addr = page_address(this_frag->page.p) + this_frag->page_offset;
                 tx_index = txq->tx_curr_desc++;
                 if (txq->tx_curr_desc == txq->tx_ring_size)
                         txq->tx_curr_desc = 0;
                 desc = &txq->tx_desc_area[tx_index];
+                txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_PAGE;
 
                 /*
                  * The last fragment will generate an interrupt
@@ -902,8 +907,9 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
 
                 desc->l4i_chk = 0;
                 desc->byte_cnt = skb_frag_size(this_frag);
-                desc->buf_ptr = dma_map_single(mp->dev->dev.parent, addr,
-                                               desc->byte_cnt, DMA_TO_DEVICE);
+                desc->buf_ptr = skb_frag_dma_map(mp->dev->dev.parent,
+                                                 this_frag, 0, desc->byte_cnt,
+                                                 DMA_TO_DEVICE);
         }
 }
 
@@ -936,6 +942,7 @@ static int txq_submit_skb(struct tx_queue *txq, struct sk_buff *skb,
         if (txq->tx_curr_desc == txq->tx_ring_size)
                 txq->tx_curr_desc = 0;
         desc = &txq->tx_desc_area[tx_index];
+        txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
 
         if (nr_frags) {
                 txq_submit_frag_skb(txq, skb);
@@ -1047,9 +1054,12 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 int tx_index;
                 struct tx_desc *desc;
                 u32 cmd_sts;
+                char desc_dma_map;
 
                 tx_index = txq->tx_used_desc;
                 desc = &txq->tx_desc_area[tx_index];
+                desc_dma_map = txq->tx_desc_mapping[tx_index];
+
                 cmd_sts = desc->cmd_sts;
 
                 if (cmd_sts & BUFFER_OWNED_BY_DMA) {
@@ -1065,9 +1075,19 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 reclaimed++;
                 txq->tx_desc_count--;
 
-                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
-                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
-                                         desc->byte_cnt, DMA_TO_DEVICE);
+                if (!IS_TSO_HEADER(txq, desc->buf_ptr)) {
+
+                        if (desc_dma_map == DESC_DMA_MAP_PAGE)
+                                dma_unmap_page(mp->dev->dev.parent,
+                                               desc->buf_ptr,
+                                               desc->byte_cnt,
+                                               DMA_TO_DEVICE);
+                        else
+                                dma_unmap_single(mp->dev->dev.parent,
+                                                 desc->buf_ptr,
+                                                 desc->byte_cnt,
+                                                 DMA_TO_DEVICE);
+                }
 
                 if (cmd_sts & TX_ENABLE_INTERRUPT) {
                         struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
@@ -1996,6 +2016,7 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
         struct tx_queue *txq = mp->txq + index;
         struct tx_desc *tx_desc;
         int size;
+        int ret;
         int i;
 
         txq->index = index;
@@ -2048,18 +2069,34 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
                                         nexti * sizeof(struct tx_desc);
         }
 
+        txq->tx_desc_mapping = kcalloc(txq->tx_ring_size, sizeof(char),
+                                       GFP_KERNEL);
+        if (!txq->tx_desc_mapping) {
+                ret = -ENOMEM;
+                goto err_free_desc_area;
+        }
+
         /* Allocate DMA buffers for TSO MAC/IP/TCP headers */
         txq->tso_hdrs = dma_alloc_coherent(mp->dev->dev.parent,
                                            txq->tx_ring_size * TSO_HEADER_SIZE,
                                            &txq->tso_hdrs_dma, GFP_KERNEL);
         if (txq->tso_hdrs == NULL) {
-                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
-                                  txq->tx_desc_area, txq->tx_desc_dma);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_free_desc_mapping;
         }
         skb_queue_head_init(&txq->tx_skb);
 
         return 0;
+
+err_free_desc_mapping:
+        kfree(txq->tx_desc_mapping);
+err_free_desc_area:
+        if (index == 0 && size <= mp->tx_desc_sram_size)
+                iounmap(txq->tx_desc_area);
+        else
+                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
+                                  txq->tx_desc_area, txq->tx_desc_dma);
+        return ret;
 }
 
 static void txq_deinit(struct tx_queue *txq)
@@ -2077,6 +2114,8 @@ static void txq_deinit(struct tx_queue *txq)
         else
                 dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
                                   txq->tx_desc_area, txq->tx_desc_dma);
+        kfree(txq->tx_desc_mapping);
+
         if (txq->tso_hdrs)
                 dma_free_coherent(mp->dev->dev.parent,
                                   txq->tx_ring_size * TSO_HEADER_SIZE,
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 613037584d08..c531c8ae1be4 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -2388,7 +2388,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
 
         work_done = netxen_process_rcv_ring(sds_ring, budget);
 
-        if ((work_done < budget) && tx_complete) {
+        if (!tx_complete)
+                work_done = budget;
+
+        if (work_done < budget) {
                 napi_complete(&sds_ring->napi);
                 if (test_bit(__NX_DEV_UP, &adapter->state))
                         netxen_nic_enable_int(sds_ring);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 6576243222af..04283fe0e6a7 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -396,6 +396,9 @@ static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
         [TSU_ADRL31]    = 0x01fc,
 };
 
+static void sh_eth_rcv_snd_disable(struct net_device *ndev);
+static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev);
+
 static bool sh_eth_is_gether(struct sh_eth_private *mdp)
 {
         return mdp->reg_offset == sh_eth_offset_gigabit;
@@ -1120,6 +1123,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
         int rx_ringsize = sizeof(*rxdesc) * mdp->num_rx_ring;
         int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
+        dma_addr_t dma_addr;
 
         mdp->cur_rx = 0;
         mdp->cur_tx = 0;
@@ -1133,7 +1137,6 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 /* skb */
                 mdp->rx_skbuff[i] = NULL;
                 skb = netdev_alloc_skb(ndev, skbuff_size);
-                mdp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
                 sh_eth_set_receive_align(skb);
@@ -1142,9 +1145,15 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 rxdesc = &mdp->rx_ring[i];
                 /* The size of the buffer is a multiple of 16 bytes. */
                 rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
-                dma_map_single(&ndev->dev, skb->data, rxdesc->buffer_length,
-                               DMA_FROM_DEVICE);
-                rxdesc->addr = virt_to_phys(skb->data);
+                dma_addr = dma_map_single(&ndev->dev, skb->data,
+                                          rxdesc->buffer_length,
+                                          DMA_FROM_DEVICE);
+                if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                        kfree_skb(skb);
+                        break;
+                }
+                mdp->rx_skbuff[i] = skb;
+                rxdesc->addr = dma_addr;
                 rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
 
                 /* Rx descriptor address set */
@@ -1316,8 +1325,10 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
                      RFLR);
 
         sh_eth_write(ndev, sh_eth_read(ndev, EESR), EESR);
-        if (start)
+        if (start) {
+                mdp->irq_enabled = true;
                 sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
+        }
 
         /* PAUSE Prohibition */
         val = (sh_eth_read(ndev, ECMR) & ECMR_DM) |
@@ -1356,6 +1367,33 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
         return ret;
 }
 
+static void sh_eth_dev_exit(struct net_device *ndev)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        int i;
+
+        /* Deactivate all TX descriptors, so DMA should stop at next
+         * packet boundary if it's currently running
+         */
+        for (i = 0; i < mdp->num_tx_ring; i++)
+                mdp->tx_ring[i].status &= ~cpu_to_edmac(mdp, TD_TACT);
+
+        /* Disable TX FIFO egress to MAC */
+        sh_eth_rcv_snd_disable(ndev);
+
+        /* Stop RX DMA at next packet boundary */
+        sh_eth_write(ndev, 0, EDRRR);
+
+        /* Aside from TX DMA, we can't tell when the hardware is
+         * really stopped, so we need to reset to make sure.
+         * Before doing that, wait for long enough to *probably*
+         * finish transmitting the last packet and poll stats.
+         */
+        msleep(2); /* max frame time at 10 Mbps < 1250 us */
+        sh_eth_get_stats(ndev);
+        sh_eth_reset(ndev);
+}
+
 /* free Tx skb function */
 static int sh_eth_txfree(struct net_device *ndev)
 {
@@ -1400,6 +1438,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         u16 pkt_len = 0;
         u32 desc_status;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
+        dma_addr_t dma_addr;
 
         boguscnt = min(boguscnt, *quota);
         limit = boguscnt;
@@ -1447,9 +1486,9 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         mdp->rx_skbuff[entry] = NULL;
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
-                        dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
-                                                ALIGN(mdp->rx_buf_sz, 16),
-                                                DMA_FROM_DEVICE);
+                        dma_unmap_single(&ndev->dev, rxdesc->addr,
+                                         ALIGN(mdp->rx_buf_sz, 16),
+                                         DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
                         skb->protocol = eth_type_trans(skb, ndev);
                         netif_receive_skb(skb);
@@ -1469,15 +1508,20 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 
                 if (mdp->rx_skbuff[entry] == NULL) {
                         skb = netdev_alloc_skb(ndev, skbuff_size);
-                        mdp->rx_skbuff[entry] = skb;
                         if (skb == NULL)
                                 break;  /* Better luck next round. */
                         sh_eth_set_receive_align(skb);
-                        dma_map_single(&ndev->dev, skb->data,
-                                       rxdesc->buffer_length, DMA_FROM_DEVICE);
+                        dma_addr = dma_map_single(&ndev->dev, skb->data,
+                                                  rxdesc->buffer_length,
+                                                  DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                                kfree_skb(skb);
+                                break;
+                        }
+                        mdp->rx_skbuff[entry] = skb;
 
                         skb_checksum_none_assert(skb);
-                        rxdesc->addr = virt_to_phys(skb->data);
+                        rxdesc->addr = dma_addr;
                 }
                 if (entry >= mdp->num_rx_ring - 1)
                         rxdesc->status |=
@@ -1573,7 +1617,6 @@ ignore_link:
                 if (intr_status & EESR_RFRMER) {
                         /* Receive Frame Overflow int */
                         ndev->stats.rx_frame_errors++;
-                        netif_err(mdp, rx_err, ndev, "Receive Abort\n");
                 }
         }
 
@@ -1592,13 +1635,11 @@ ignore_link:
         if (intr_status & EESR_RDE) {
                 /* Receive Descriptor Empty int */
                 ndev->stats.rx_over_errors++;
-                netif_err(mdp, rx_err, ndev, "Receive Descriptor Empty\n");
         }
 
         if (intr_status & EESR_RFE) {
                 /* Receive FIFO Overflow int */
                 ndev->stats.rx_fifo_errors++;
-                netif_err(mdp, rx_err, ndev, "Receive FIFO Overflow\n");
         }
 
         if (!mdp->cd->no_ade && (intr_status & EESR_ADE)) {
@@ -1653,7 +1694,12 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
         if (intr_status & (EESR_RX_CHECK | cd->tx_check | cd->eesr_err_check))
                 ret = IRQ_HANDLED;
         else
-                goto other_irq;
+                goto out;
+
+        if (!likely(mdp->irq_enabled)) {
+                sh_eth_write(ndev, 0, EESIPR);
+                goto out;
+        }
 
         if (intr_status & EESR_RX_CHECK) {
                 if (napi_schedule_prep(&mdp->napi)) {
@@ -1684,7 +1730,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                 sh_eth_error(ndev, intr_status);
         }
 
-other_irq:
+out:
         spin_unlock(&mdp->lock);
 
         return ret;
@@ -1712,7 +1758,8 @@ static int sh_eth_poll(struct napi_struct *napi, int budget)
         napi_complete(napi);
 
         /* Reenable Rx interrupts */
-        sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
+        if (mdp->irq_enabled)
+                sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
 out:
         return budget - quota;
 }
@@ -1968,40 +2015,50 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
                 return -EINVAL;
 
         if (netif_running(ndev)) {
+                netif_device_detach(ndev);
                 netif_tx_disable(ndev);
-                /* Disable interrupts by clearing the interrupt mask. */
-                sh_eth_write(ndev, 0x0000, EESIPR);
-                /* Stop the chip's Tx and Rx processes. */
-                sh_eth_write(ndev, 0, EDTRR);
-                sh_eth_write(ndev, 0, EDRRR);
+
+                /* Serialise with the interrupt handler and NAPI, then
+                 * disable interrupts.  We have to clear the
+                 * irq_enabled flag first to ensure that interrupts
+                 * won't be re-enabled.
+                 */
+                mdp->irq_enabled = false;
                 synchronize_irq(ndev->irq);
-        }
+                napi_synchronize(&mdp->napi);
+                sh_eth_write(ndev, 0x0000, EESIPR);
 
-        /* Free all the skbuffs in the Rx queue. */
-        sh_eth_ring_free(ndev);
-        /* Free DMA buffer */
-        sh_eth_free_dma_buffer(mdp);
+                sh_eth_dev_exit(ndev);
+
+                /* Free all the skbuffs in the Rx queue. */
+                sh_eth_ring_free(ndev);
+                /* Free DMA buffer */
+                sh_eth_free_dma_buffer(mdp);
+        }
 
         /* Set new parameters */
         mdp->num_rx_ring = ring->rx_pending;
         mdp->num_tx_ring = ring->tx_pending;
 
-        ret = sh_eth_ring_init(ndev);
-        if (ret < 0) {
-                netdev_err(ndev, "%s: sh_eth_ring_init failed.\n", __func__);
-                return ret;
-        }
-        ret = sh_eth_dev_init(ndev, false);
-        if (ret < 0) {
-                netdev_err(ndev, "%s: sh_eth_dev_init failed.\n", __func__);
-                return ret;
-        }
-
         if (netif_running(ndev)) {
+                ret = sh_eth_ring_init(ndev);
+                if (ret < 0) {
+                        netdev_err(ndev, "%s: sh_eth_ring_init failed.\n",
+                                   __func__);
+                        return ret;
+                }
+                ret = sh_eth_dev_init(ndev, false);
+                if (ret < 0) {
+                        netdev_err(ndev, "%s: sh_eth_dev_init failed.\n",
+                                   __func__);
+                        return ret;
+                }
+
+                mdp->irq_enabled = true;
                 sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
                 /* Setting the Rx mode will start the Rx process. */
                 sh_eth_write(ndev, EDRRR_R, EDRRR);
-                netif_wake_queue(ndev);
+                netif_device_attach(ndev);
         }
 
         return 0;
@@ -2117,6 +2174,9 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         }
         spin_unlock_irqrestore(&mdp->lock, flags);
 
+        if (skb_padto(skb, ETH_ZLEN))
+                return NETDEV_TX_OK;
+
         entry = mdp->cur_tx % mdp->num_tx_ring;
         mdp->tx_skbuff[entry] = skb;
         txdesc = &mdp->tx_ring[entry];
@@ -2126,10 +2186,11 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                  skb->len + 2);
         txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
                                       DMA_TO_DEVICE);
-        if (skb->len < ETH_ZLEN)
-                txdesc->buffer_length = ETH_ZLEN;
-        else
-                txdesc->buffer_length = skb->len;
+        if (dma_mapping_error(&ndev->dev, txdesc->addr)) {
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+        txdesc->buffer_length = skb->len;
 
         if (entry >= mdp->num_tx_ring - 1)
                 txdesc->status |= cpu_to_edmac(mdp, TD_TACT | TD_TDLE);
@@ -2181,14 +2242,17 @@ static int sh_eth_close(struct net_device *ndev)
 
         netif_stop_queue(ndev);
 
-        /* Disable interrupts by clearing the interrupt mask. */
+        /* Serialise with the interrupt handler and NAPI, then disable
+         * interrupts.  We have to clear the irq_enabled flag first to
+         * ensure that interrupts won't be re-enabled.
+         */
+        mdp->irq_enabled = false;
+        synchronize_irq(ndev->irq);
+        napi_disable(&mdp->napi);
         sh_eth_write(ndev, 0x0000, EESIPR);
 
-        /* Stop the chip's Tx and Rx processes. */
-        sh_eth_write(ndev, 0, EDTRR);
-        sh_eth_write(ndev, 0, EDRRR);
+        sh_eth_dev_exit(ndev);
 
-        sh_eth_get_stats(ndev);
         /* PHY Disconnect */
         if (mdp->phydev) {
                 phy_stop(mdp->phydev);
@@ -2198,8 +2262,6 @@ static int sh_eth_close(struct net_device *ndev)
 
         free_irq(ndev->irq, ndev);
 
-        napi_disable(&mdp->napi);
-
         /* Free all the skbuffs in the Rx queue. */
         sh_eth_ring_free(ndev);
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index 71f5de1171bd..332d3c16d483 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -513,6 +513,7 @@ struct sh_eth_private {
         u32 rx_buf_sz;                  /* Based on MTU+slack. */
         int edmac_endian;
         struct napi_struct napi;
+        bool irq_enabled;
         /* MII transceiver section. */
         u32 phy_id;                     /* PHY ID */
         struct mii_bus *mii_bus;        /* MDIO bus control */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8c6b7c1651e5..cf62ff4c8c56 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2778,6 +2778,9 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
  * @addr: iobase memory address
  * Description: this is the main probe function used to
  * call the alloc_etherdev, allocate the priv structure.
+ * Return:
+ * on success the new private structure is returned, otherwise the error
+ * pointer.
  */
 struct stmmac_priv *stmmac_dvr_probe(struct device *device,
                                      struct plat_stmmacenet_data *plat_dat,
@@ -2789,7 +2792,7 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
 
         ndev = alloc_etherdev(sizeof(struct stmmac_priv));
         if (!ndev)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         SET_NETDEV_DEV(ndev, device);
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index e068d48b0f21..a39131f494ec 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1683,6 +1683,19 @@ static int cpsw_ndo_vlan_rx_add_vid(struct net_device *ndev,
         if (vid == priv->data.default_vlan)
                 return 0;
 
+        if (priv->data.dual_emac) {
+                /* In dual EMAC, reserved VLAN id should not be used for
+                 * creating VLAN interfaces as this can break the dual
+                 * EMAC port separation
+                 */
+                int i;
+
+                for (i = 0; i < priv->data.slaves; i++) {
+                        if (vid == priv->slaves[i].port_vlan)
+                                return -EINVAL;
+                }
+        }
+
         dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid);
         return cpsw_add_vlan_ale_entry(priv, vid);
 }
@@ -1696,6 +1709,15 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev,
         if (vid == priv->data.default_vlan)
                 return 0;
 
+        if (priv->data.dual_emac) {
+                int i;
+
+                for (i = 0; i < priv->data.slaves; i++) {
+                        if (vid == priv->slaves[i].port_vlan)
+                                return -EINVAL;
+                }
+        }
+
         dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid);
         ret = cpsw_ale_del_vlan(priv->ale, vid, 0);
         if (ret != 0)
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index a14d87783245..2e195289ddf4 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -377,9 +377,11 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
         };
 
         dst = ip6_route_output(dev_net(dev), NULL, &fl6);
-        if (IS_ERR(dst))
+        if (dst->error) {
+                ret = dst->error;
+                dst_release(dst);
                 goto err;
-
+        }
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
         err = ip6_local_out(skb);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 9a72640237cb..62b0bf4fdf6b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -285,6 +285,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 
         __ath_cancel_work(sc);
 
+        disable_irq(sc->irq);
         tasklet_disable(&sc->intr_tq);
         tasklet_disable(&sc->bcon_tasklet);
         spin_lock_bh(&sc->sc_pcu_lock);
@@ -331,6 +332,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
                 r = -EIO;
 
 out:
+        enable_irq(sc->irq);
         spin_unlock_bh(&sc->sc_pcu_lock);
         tasklet_enable(&sc->bcon_tasklet);
         tasklet_enable(&sc->intr_tq);
@@ -512,9 +514,6 @@ irqreturn_t ath_isr(int irq, void *dev)
         if (!ah || test_bit(ATH_OP_INVALID, &common->op_flags))
                 return IRQ_NONE;
 
-        if (!AR_SREV_9100(ah) && test_bit(ATH_OP_HW_RESET, &common->op_flags))
-                return IRQ_NONE;
-
         /* shared irq, not for us */
         if (!ath9k_hw_intrpend(ah))
                 return IRQ_NONE;
@@ -529,7 +528,7 @@ irqreturn_t ath_isr(int irq, void *dev)
         ath9k_debug_sync_cause(sc, sync_cause);
         status &= ah->imask;    /* discard unasked-for bits */
 
-        if (AR_SREV_9100(ah) && test_bit(ATH_OP_HW_RESET, &common->op_flags))
+        if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
                 return IRQ_HANDLED;
 
         /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 1bbe4fc47b97..660ddb1b7d8a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -246,6 +246,7 @@ enum iwl_ucode_tlv_flag {
  * @IWL_UCODE_TLV_API_BASIC_DWELL: use only basic dwell time in scan command,
  *      regardless of the band or the number of the probes. FW will calculate
  *      the actual dwell time.
+ * @IWL_UCODE_TLV_API_SINGLE_SCAN_EBS: EBS is supported for single scans too.
  */
 enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
@@ -257,6 +258,7 @@ enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF     = BIT(7),
         IWL_UCODE_TLV_API_FRAGMENTED_SCAN       = BIT(8),
         IWL_UCODE_TLV_API_BASIC_DWELL           = BIT(13),
+        IWL_UCODE_TLV_API_SINGLE_SCAN_EBS       = BIT(16),
 };
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 201846de94e7..cfc0e65b34a5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -653,8 +653,11 @@ enum iwl_scan_channel_flags {
 };
 
 /* iwl_scan_channel_opt - CHANNEL_OPTIMIZATION_API_S
- * @flags: enum iwl_scan_channel_flgs
- * @non_ebs_ratio: how many regular scan iteration before EBS
+ * @flags: enum iwl_scan_channel_flags
+ * @non_ebs_ratio: defines the ratio of number of scan iterations where EBS is
+ *      involved.
+ *      1 - EBS is disabled.
+ *      2 - every second scan will be full scan(and so on).
  */
 struct iwl_scan_channel_opt {
         __le16 flags;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e880f9d4717b..20915587c820 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -3343,18 +3343,16 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                 msk |= mvmsta->tfd_queue_msk;
         }
 
-        if (drop) {
-                if (iwl_mvm_flush_tx_path(mvm, msk, true))
-                        IWL_ERR(mvm, "flush request fail\n");
-                mutex_unlock(&mvm->mutex);
-        } else {
-                mutex_unlock(&mvm->mutex);
+        msk &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
 
-                /* this can take a while, and we may need/want other operations
-                 * to succeed while doing this, so do it without the mutex held
-                 */
-                iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
-        }
+        if (iwl_mvm_flush_tx_path(mvm, msk, true))
+                IWL_ERR(mvm, "flush request fail\n");
+        mutex_unlock(&mvm->mutex);
+
+        /* this can take a while, and we may need/want other operations
+         * to succeed while doing this, so do it without the mutex held
+         */
+        iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
 }
 
 const struct ieee80211_ops iwl_mvm_hw_ops = {
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index ec9a8e7bae1d..844bf7c4c8de 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -72,6 +72,8 @@
 
 #define IWL_PLCP_QUIET_THRESH 1
 #define IWL_ACTIVE_QUIET_TIME 10
+#define IWL_DENSE_EBS_SCAN_RATIO 5
+#define IWL_SPARSE_EBS_SCAN_RATIO 1
 
 struct iwl_mvm_scan_params {
         u32 max_out_time;
@@ -1105,6 +1107,12 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                 return iwl_umac_scan_stop(mvm, IWL_UMAC_SCAN_UID_SCHED_SCAN,
                                           notify);
 
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm))
+                goto out;
+
         if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
             (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN) ||
              mvm->scan_status != IWL_MVM_SCAN_OS)) {
@@ -1141,6 +1149,7 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_OS)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 
+out:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
@@ -1297,18 +1306,6 @@ iwl_mvm_build_generic_unified_scan_cmd(struct iwl_mvm *mvm,
         cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
         cmd->iter_num = cpu_to_le32(1);
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
-            mvm->last_ebs_successful) {
-                cmd->channel_opt[0].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-                cmd->channel_opt[1].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-        }
-
         if (iwl_mvm_rrm_scan_needed(mvm))
                 cmd->scan_flags |=
                         cpu_to_le32(IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED);
@@ -1383,6 +1380,22 @@ int iwl_mvm_unified_scan_lmac(struct iwl_mvm *mvm,
         cmd->schedule[1].iterations = 0;
         cmd->schedule[1].full_scan_mul = 0;
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
+
         for (i = 1; i <= req->req.n_ssids; i++)
                 ssid_bitmap |= BIT(i);
 
@@ -1483,6 +1496,22 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
         cmd->schedule[1].iterations = 0xff;
         cmd->schedule[1].full_scan_mul = IWL_FULL_SCAN_MULTIPLIER;
 
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
+
         iwl_mvm_lmac_scan_cfg_channels(mvm, req->channels, req->n_channels,
                                        ssid_bitmap, cmd);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 4333306ccdee..c59d07567d90 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -90,8 +90,6 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         if (ieee80211_is_probe_resp(fc))
                 tx_flags |= TX_CMD_FLG_TSF;
-        else if (ieee80211_is_back_req(fc))
-                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
 
         if (ieee80211_has_morefrags(fc))
                 tx_flags |= TX_CMD_FLG_MORE_FRAG;
@@ -100,6 +98,15 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
                 tx_cmd->tid_tspec = qc[0] & 0xf;
                 tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
+        } else if (ieee80211_is_back_req(fc)) {
+                struct ieee80211_bar *bar = (void *)skb->data;
+                u16 control = le16_to_cpu(bar->control);
+
+                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
+                tx_cmd->tid_tspec = (control &
+                                     IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+                        IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+                WARN_ON_ONCE(tx_cmd->tid_tspec >= IWL_MAX_TID_COUNT);
         } else {
                 tx_cmd->tid_tspec = IWL_TID_NON_QOS;
                 if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index dfd021e8268f..f4cd0b9b2438 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -177,7 +177,7 @@ struct at91_pinctrl {
         struct device           *dev;
         struct pinctrl_dev      *pctl;
 
-        int                     nbanks;
+        int                     nactive_banks;
 
         uint32_t                *mux_mask;
         int                     nmux;
@@ -653,12 +653,18 @@ static int pin_check_config(struct at91_pinctrl *info, const char *name,
         int mux;
 
         /* check if it's a valid config */
-        if (pin->bank >= info->nbanks) {
+        if (pin->bank >= gpio_banks) {
                 dev_err(info->dev, "%s: pin conf %d bank_id %d >= nbanks %d\n",
-                        name, index, pin->bank, info->nbanks);
+                        name, index, pin->bank, gpio_banks);
                 return -EINVAL;
         }
 
+        if (!gpio_chips[pin->bank]) {
+                dev_err(info->dev, "%s: pin conf %d bank_id %d not enabled\n",
+                        name, index, pin->bank);
+                return -ENXIO;
+        }
+
         if (pin->pin >= MAX_NB_GPIO_PER_BANK) {
                 dev_err(info->dev, "%s: pin conf %d pin_bank_id %d >= %d\n",
                         name, index, pin->pin, MAX_NB_GPIO_PER_BANK);
@@ -981,7 +987,8 @@ static void at91_pinctrl_child_count(struct at91_pinctrl *info,
 
         for_each_child_of_node(np, child) {
                 if (of_device_is_compatible(child, gpio_compat)) {
-                        info->nbanks++;
+                        if (of_device_is_available(child))
+                                info->nactive_banks++;
                 } else {
                         info->nfunctions++;
                         info->ngroups += of_get_child_count(child);
@@ -1003,11 +1010,11 @@ static int at91_pinctrl_mux_mask(struct at91_pinctrl *info,
         }
 
         size /= sizeof(*list);
-        if (!size || size % info->nbanks) {
-                dev_err(info->dev, "wrong mux mask array should be by %d\n", info->nbanks);
+        if (!size || size % gpio_banks) {
+                dev_err(info->dev, "wrong mux mask array should be by %d\n", gpio_banks);
                 return -EINVAL;
         }
-        info->nmux = size / info->nbanks;
+        info->nmux = size / gpio_banks;
 
         info->mux_mask = devm_kzalloc(info->dev, sizeof(u32) * size, GFP_KERNEL);
         if (!info->mux_mask) {
@@ -1131,7 +1138,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
                 of_match_device(at91_pinctrl_of_match, &pdev->dev)->data;
         at91_pinctrl_child_count(info, np);
 
-        if (info->nbanks < 1) {
+        if (gpio_banks < 1) {
                 dev_err(&pdev->dev, "you need to specify at least one gpio-controller\n");
                 return -EINVAL;
         }
@@ -1144,7 +1151,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
 
         dev_dbg(&pdev->dev, "mux-mask\n");
         tmp = info->mux_mask;
-        for (i = 0; i < info->nbanks; i++) {
+        for (i = 0; i < gpio_banks; i++) {
                 for (j = 0; j < info->nmux; j++, tmp++) {
                         dev_dbg(&pdev->dev, "%d:%d\t0x%x\n", i, j, tmp[0]);
                 }
@@ -1162,7 +1169,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
         if (!info->groups)
                 return -ENOMEM;
 
-        dev_dbg(&pdev->dev, "nbanks = %d\n", info->nbanks);
+        dev_dbg(&pdev->dev, "nbanks = %d\n", gpio_banks);
         dev_dbg(&pdev->dev, "nfunctions = %d\n", info->nfunctions);
         dev_dbg(&pdev->dev, "ngroups = %d\n", info->ngroups);
 
@@ -1185,7 +1192,7 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
 {
         struct at91_pinctrl *info;
         struct pinctrl_pin_desc *pdesc;
-        int ret, i, j, k;
+        int ret, i, j, k, ngpio_chips_enabled = 0;
 
         info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
         if (!info)
@@ -1200,23 +1207,27 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
          * to obtain references to the struct gpio_chip * for them, and we
          * need this to proceed.
          */
-        for (i = 0; i < info->nbanks; i++) {
-                if (!gpio_chips[i]) {
-                        dev_warn(&pdev->dev, "GPIO chip %d not registered yet\n", i);
-                        devm_kfree(&pdev->dev, info);
-                        return -EPROBE_DEFER;
-                }
+        for (i = 0; i < gpio_banks; i++)
+                if (gpio_chips[i])
+                        ngpio_chips_enabled++;
+
+        if (ngpio_chips_enabled < info->nactive_banks) {
+                dev_warn(&pdev->dev,
+                         "All GPIO chips are not registered yet (%d/%d)\n",
+                         ngpio_chips_enabled, info->nactive_banks);
+                devm_kfree(&pdev->dev, info);
+                return -EPROBE_DEFER;
         }
 
         at91_pinctrl_desc.name = dev_name(&pdev->dev);
-        at91_pinctrl_desc.npins = info->nbanks * MAX_NB_GPIO_PER_BANK;
+        at91_pinctrl_desc.npins = gpio_banks * MAX_NB_GPIO_PER_BANK;
         at91_pinctrl_desc.pins = pdesc =
                 devm_kzalloc(&pdev->dev, sizeof(*pdesc) * at91_pinctrl_desc.npins, GFP_KERNEL);
 
         if (!at91_pinctrl_desc.pins)
                 return -ENOMEM;
 
-        for (i = 0 , k = 0; i < info->nbanks; i++) {
+        for (i = 0, k = 0; i < gpio_banks; i++) {
                 for (j = 0; j < MAX_NB_GPIO_PER_BANK; j++, k++) {
                         pdesc->number = k;
                         pdesc->name = kasprintf(GFP_KERNEL, "pio%c%d", i + 'A', j);
@@ -1234,8 +1245,9 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
         }
 
         /* We will handle a range of GPIO pins */
-        for (i = 0; i < info->nbanks; i++)
-                pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range);
+        for (i = 0; i < gpio_banks; i++)
+                if (gpio_chips[i])
+                        pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range);
 
         dev_info(&pdev->dev, "initialized AT91 pinctrl driver\n");
 
@@ -1613,9 +1625,10 @@ static void gpio_irq_handler(unsigned irq, struct irq_desc *desc)
 static int at91_gpio_of_irq_setup(struct platform_device *pdev,
                                   struct at91_gpio_chip *at91_gpio)
 {
+        struct gpio_chip        *gpiochip_prev = NULL;
         struct at91_gpio_chip   *prev = NULL;
         struct irq_data         *d = irq_get_irq_data(at91_gpio->pioc_virq);
-        int ret;
+        int ret, i;
 
         at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
 
@@ -1641,24 +1654,33 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
                 return ret;
         }
 
-        /* Setup chained handler */
-        if (at91_gpio->pioc_idx)
-                prev = gpio_chips[at91_gpio->pioc_idx - 1];
-
         /* The top level handler handles one bank of GPIOs, except
          * on some SoC it can handle up to three...
          * We only set up the handler for the first of the list.
          */
-        if (prev && prev->next == at91_gpio)
+        gpiochip_prev = irq_get_handler_data(at91_gpio->pioc_virq);
+        if (!gpiochip_prev) {
+                /* Then register the chain on the parent IRQ */
+                gpiochip_set_chained_irqchip(&at91_gpio->chip,
+                                             &gpio_irqchip,
+                                             at91_gpio->pioc_virq,
+                                             gpio_irq_handler);
                 return 0;
+        }
 
-        /* Then register the chain on the parent IRQ */
-        gpiochip_set_chained_irqchip(&at91_gpio->chip,
-                                     &gpio_irqchip,
-                                     at91_gpio->pioc_virq,
-                                     gpio_irq_handler);
+        prev = container_of(gpiochip_prev, struct at91_gpio_chip, chip);
 
-        return 0;
+        /* we can only have 2 banks before */
+        for (i = 0; i < 2; i++) {
+                if (prev->next) {
+                        prev = prev->next;
+                } else {
+                        prev->next = at91_gpio;
+                        return 0;
+                }
+        }
+
+        return -EINVAL;
 }
 
 /* This structure is replicated for each GPIO block allocated at probe time */
@@ -1675,24 +1697,6 @@ static struct gpio_chip at91_gpio_template = {
         .ngpio                  = MAX_NB_GPIO_PER_BANK,
 };
 
-static void at91_gpio_probe_fixup(void)
-{
-        unsigned i;
-        struct at91_gpio_chip *at91_gpio, *last = NULL;
-
-        for (i = 0; i < gpio_banks; i++) {
-                at91_gpio = gpio_chips[i];
-
-                /*
-                 * GPIO controller are grouped on some SoC:
-                 * PIOC, PIOD and PIOE can share the same IRQ line
-                 */
-                if (last && last->pioc_virq == at91_gpio->pioc_virq)
-                        last->next = at91_gpio;
-                last = at91_gpio;
-        }
-}
-
 static struct of_device_id at91_gpio_of_match[] = {
         { .compatible = "atmel,at91sam9x5-gpio", .data = &at91sam9x5_ops, },
         { .compatible = "atmel,at91rm9200-gpio", .data = &at91rm9200_ops },
@@ -1805,8 +1809,6 @@ static int at91_gpio_probe(struct platform_device *pdev)
         gpio_chips[alias_idx] = at91_chip;
         gpio_banks = max(gpio_banks, alias_idx + 1);
 
-        at91_gpio_probe_fixup();
-
         ret = at91_gpio_of_irq_setup(pdev, at91_chip);
         if (ret)
                 goto irq_setup_err;
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e225711bb8bc..9c48fb32f660 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1488,7 +1488,7 @@ struct regulator *regulator_get_optional(struct device *dev, const char *id)
 }
 EXPORT_SYMBOL_GPL(regulator_get_optional);
 
-/* Locks held by regulator_put() */
+/* regulator_list_mutex lock held by regulator_put() */
 static void _regulator_put(struct regulator *regulator)
 {
         struct regulator_dev *rdev;
@@ -1503,12 +1503,14 @@ static void _regulator_put(struct regulator *regulator)
         /* remove any sysfs entries */
         if (regulator->dev)
                 sysfs_remove_link(&rdev->dev.kobj, regulator->supply_name);
+        mutex_lock(&rdev->mutex);
         kfree(regulator->supply_name);
         list_del(&regulator->list);
         kfree(regulator);
 
         rdev->open_count--;
         rdev->exclusive = 0;
+        mutex_unlock(&rdev->mutex);
 
         module_put(rdev->owner);
 }
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 2809ae0d6bcd..ff828117798f 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -405,6 +405,40 @@ static struct regulator_ops s2mps14_reg_ops;
         .enable_mask    = S2MPS14_ENABLE_MASK                   \
 }
 
+#define regulator_desc_s2mps13_buck7(num, min, step, min_sel) { \
+        .name           = "BUCK"#num,                           \
+        .id             = S2MPS13_BUCK##num,                    \
+        .ops            = &s2mps14_reg_ops,                     \
+        .type           = REGULATOR_VOLTAGE,                    \
+        .owner          = THIS_MODULE,                          \
+        .min_uV         = min,                                  \
+        .uV_step        = step,                                 \
+        .linear_min_sel = min_sel,                              \
+        .n_voltages     = S2MPS14_BUCK_N_VOLTAGES,              \
+        .ramp_delay     = S2MPS13_BUCK_RAMP_DELAY,              \
+        .vsel_reg       = S2MPS13_REG_B1OUT + (num) * 2 - 1,    \
+        .vsel_mask      = S2MPS14_BUCK_VSEL_MASK,               \
+        .enable_reg     = S2MPS13_REG_B1CTRL + (num - 1) * 2,   \
+        .enable_mask    = S2MPS14_ENABLE_MASK                   \
+}
+
+#define regulator_desc_s2mps13_buck8_10(num, min, step, min_sel) {      \
+        .name           = "BUCK"#num,                           \
+        .id             = S2MPS13_BUCK##num,                    \
+        .ops            = &s2mps14_reg_ops,                     \
+        .type           = REGULATOR_VOLTAGE,                    \
+        .owner          = THIS_MODULE,                          \
+        .min_uV         = min,                                  \
+        .uV_step        = step,                                 \
+        .linear_min_sel = min_sel,                              \
+        .n_voltages     = S2MPS14_BUCK_N_VOLTAGES,              \
+        .ramp_delay     = S2MPS13_BUCK_RAMP_DELAY,              \
+        .vsel_reg       = S2MPS13_REG_B1OUT + (num) * 2 - 1,    \
+        .vsel_mask      = S2MPS14_BUCK_VSEL_MASK,               \
+        .enable_reg     = S2MPS13_REG_B1CTRL + (num) * 2 - 1,   \
+        .enable_mask    = S2MPS14_ENABLE_MASK                   \
+}
+
 static const struct regulator_desc s2mps13_regulators[] = {
         regulator_desc_s2mps13_ldo(1,  MIN_800_MV,  STEP_12_5_MV, 0x00),
         regulator_desc_s2mps13_ldo(2,  MIN_1400_MV, STEP_50_MV,   0x0C),
@@ -452,10 +486,10 @@ static const struct regulator_desc s2mps13_regulators[] = {
         regulator_desc_s2mps13_buck(4,  MIN_500_MV,  STEP_6_25_MV, 0x10),
         regulator_desc_s2mps13_buck(5,  MIN_500_MV,  STEP_6_25_MV, 0x10),
         regulator_desc_s2mps13_buck(6,  MIN_500_MV,  STEP_6_25_MV, 0x10),
-        regulator_desc_s2mps13_buck(7,  MIN_500_MV,  STEP_6_25_MV, 0x10),
-        regulator_desc_s2mps13_buck(8,  MIN_1000_MV, STEP_12_5_MV, 0x20),
-        regulator_desc_s2mps13_buck(9,  MIN_1000_MV, STEP_12_5_MV, 0x20),
-        regulator_desc_s2mps13_buck(10, MIN_500_MV,  STEP_6_25_MV, 0x10),
+        regulator_desc_s2mps13_buck7(7,  MIN_500_MV,  STEP_6_25_MV, 0x10),
+        regulator_desc_s2mps13_buck8_10(8,  MIN_1000_MV, STEP_12_5_MV, 0x20),
+        regulator_desc_s2mps13_buck8_10(9,  MIN_1000_MV, STEP_12_5_MV, 0x20),
+        regulator_desc_s2mps13_buck8_10(10, MIN_500_MV,  STEP_6_25_MV, 0x10),
 };
 
 static int s2mps14_regulator_enable(struct regulator_dev *rdev)
diff --git a/drivers/rtc/rtc-s5m.c b/drivers/rtc/rtc-s5m.c
index b5e7c4670205..89ac1d5083c6 100644
--- a/drivers/rtc/rtc-s5m.c
+++ b/drivers/rtc/rtc-s5m.c
@@ -832,6 +832,7 @@ static SIMPLE_DEV_PM_OPS(s5m_rtc_pm_ops, s5m_rtc_suspend, s5m_rtc_resume);
 static const struct platform_device_id s5m_rtc_id[] = {
         { "s5m-rtc",            S5M8767X },
         { "s2mps14-rtc",        S2MPS14X },
+        { },
 };
 
 static struct platform_driver s5m_rtc_driver = {
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index f407e3763432..642c77c76b84 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1784,6 +1784,8 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
         QETH_DBF_TEXT(SETUP, 2, "idxanswr");
         card = CARD_FROM_CDEV(channel->ccwdev);
         iob = qeth_get_buffer(channel);
+        if (!iob)
+                return -ENOMEM;
         iob->callback = idx_reply_cb;
         memcpy(&channel->ccw, READ_CCW, sizeof(struct ccw1));
         channel->ccw.count = QETH_BUFSIZE;
@@ -1834,6 +1836,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
         QETH_DBF_TEXT(SETUP, 2, "idxactch");
 
         iob = qeth_get_buffer(channel);
+        if (!iob)
+                return -ENOMEM;
         iob->callback = idx_reply_cb;
         memcpy(&channel->ccw, WRITE_CCW, sizeof(struct ccw1));
         channel->ccw.count = IDX_ACTIVATE_SIZE;
@@ -2021,10 +2025,36 @@ void qeth_prepare_control_data(struct qeth_card *card, int len,
 }
 EXPORT_SYMBOL_GPL(qeth_prepare_control_data);
 
+/**
+ * qeth_send_control_data() -   send control command to the card
+ * @card:                       qeth_card structure pointer
+ * @len:                        size of the command buffer
+ * @iob:                        qeth_cmd_buffer pointer
+ * @reply_cb:                   callback function pointer
+ * @cb_card:                    pointer to the qeth_card structure
+ * @cb_reply:                   pointer to the qeth_reply structure
+ * @cb_cmd:                     pointer to the original iob for non-IPA
+ *                              commands, or to the qeth_ipa_cmd structure
+ *                              for the IPA commands.
+ * @reply_param:                private pointer passed to the callback
+ *
+ * Returns the value of the `return_code' field of the response
+ * block returned from the hardware, or other error indication.
+ * Value of zero indicates successful execution of the command.
+ *
+ * Callback function gets called one or more times, with cb_cmd
+ * pointing to the response returned by the hardware. Callback
+ * function must return non-zero if more reply blocks are expected,
+ * and zero if the last or only reply block is received. Callback
+ * function can get the value of the reply_param pointer from the
+ * field 'param' of the structure qeth_reply.
+ */
+
 int qeth_send_control_data(struct qeth_card *card, int len,
                 struct qeth_cmd_buffer *iob,
-                int (*reply_cb)(struct qeth_card *, struct qeth_reply *,
-                        unsigned long),
+                int (*reply_cb)(struct qeth_card *cb_card,
+                                struct qeth_reply *cb_reply,
+                                unsigned long cb_cmd),
                 void *reply_param)
 {
         int rc;
@@ -2914,9 +2944,16 @@ struct qeth_cmd_buffer *qeth_get_ipacmd_buffer(struct qeth_card *card,
         struct qeth_cmd_buffer *iob;
         struct qeth_ipa_cmd *cmd;
 
-        iob = qeth_wait_for_buffer(&card->write);
-        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
-        qeth_fill_ipacmd_header(card, cmd, ipacmd, prot);
+        iob = qeth_get_buffer(&card->write);
+        if (iob) {
+                cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
+                qeth_fill_ipacmd_header(card, cmd, ipacmd, prot);
+        } else {
+                dev_warn(&card->gdev->dev,
+                         "The qeth driver ran out of channel command buffers\n");
+                QETH_DBF_MESSAGE(1, "%s The qeth driver ran out of channel command buffers",
+                                 dev_name(&card->gdev->dev));
+        }
 
         return iob;
 }
@@ -2932,6 +2969,12 @@ void qeth_prepare_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob,
 }
 EXPORT_SYMBOL_GPL(qeth_prepare_ipa_cmd);
 
+/**
+ * qeth_send_ipa_cmd() - send an IPA command
+ *
+ * See qeth_send_control_data() for explanation of the arguments.
+ */
+
 int qeth_send_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob,
                 int (*reply_cb)(struct qeth_card *, struct qeth_reply*,
                         unsigned long),
@@ -2968,6 +3011,8 @@ int qeth_send_startlan(struct qeth_card *card)
         QETH_DBF_TEXT(SETUP, 2, "strtlan");
 
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_STARTLAN, 0);
+        if (!iob)
+                return -ENOMEM;
         rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
         return rc;
 }
@@ -3013,11 +3058,13 @@ static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
 
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETADAPTERPARMS,
                                      QETH_PROT_IPV4);
-        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
-        cmd->data.setadapterparms.hdr.cmdlength = cmdlen;
-        cmd->data.setadapterparms.hdr.command_code = command;
-        cmd->data.setadapterparms.hdr.used_total = 1;
-        cmd->data.setadapterparms.hdr.seq_no = 1;
+        if (iob) {
+                cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
+                cmd->data.setadapterparms.hdr.cmdlength = cmdlen;
+                cmd->data.setadapterparms.hdr.command_code = command;
+                cmd->data.setadapterparms.hdr.used_total = 1;
+                cmd->data.setadapterparms.hdr.seq_no = 1;
+        }
 
         return iob;
 }
@@ -3030,6 +3077,8 @@ int qeth_query_setadapterparms(struct qeth_card *card)
         QETH_CARD_TEXT(card, 3, "queryadp");
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_COMMANDS_SUPPORTED,
                                    sizeof(struct qeth_ipacmd_setadpparms));
+        if (!iob)
+                return -ENOMEM;
         rc = qeth_send_ipa_cmd(card, iob, qeth_query_setadapterparms_cb, NULL);
         return rc;
 }
@@ -3080,6 +3129,8 @@ int qeth_query_ipassists(struct qeth_card *card, enum qeth_prot_versions prot)
 
         QETH_DBF_TEXT_(SETUP, 2, "qipassi%i", prot);
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_QIPASSIST, prot);
+        if (!iob)
+                return -ENOMEM;
         rc = qeth_send_ipa_cmd(card, iob, qeth_query_ipassists_cb, NULL);
         return rc;
 }
@@ -3119,6 +3170,8 @@ int qeth_query_switch_attributes(struct qeth_card *card,
                 return -ENOMEDIUM;
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_SWITCH_ATTRIBUTES,
                                 sizeof(struct qeth_ipacmd_setadpparms_hdr));
+        if (!iob)
+                return -ENOMEM;
         return qeth_send_ipa_cmd(card, iob,
                                 qeth_query_switch_attributes_cb, sw_info);
 }
@@ -3146,6 +3199,8 @@ static int qeth_query_setdiagass(struct qeth_card *card)
 
         QETH_DBF_TEXT(SETUP, 2, "qdiagass");
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SET_DIAG_ASS, 0);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.diagass.subcmd_len = 16;
         cmd->data.diagass.subcmd = QETH_DIAGS_CMD_QUERY;
@@ -3197,6 +3252,8 @@ int qeth_hw_trap(struct qeth_card *card, enum qeth_diags_trap_action action)
 
         QETH_DBF_TEXT(SETUP, 2, "diagtrap");
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SET_DIAG_ASS, 0);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.diagass.subcmd_len = 80;
         cmd->data.diagass.subcmd = QETH_DIAGS_CMD_TRAP;
@@ -4162,6 +4219,8 @@ void qeth_setadp_promisc_mode(struct qeth_card *card)
 
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_PROMISC_MODE,
                         sizeof(struct qeth_ipacmd_setadpparms));
+        if (!iob)
+                return;
         cmd = (struct qeth_ipa_cmd *)(iob->data + IPA_PDU_HEADER_SIZE);
         cmd->data.setadapterparms.data.mode = mode;
         qeth_send_ipa_cmd(card, iob, qeth_setadp_promisc_mode_cb, NULL);
@@ -4232,6 +4291,8 @@ int qeth_setadpparms_change_macaddr(struct qeth_card *card)
 
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_ALTER_MAC_ADDRESS,
                                    sizeof(struct qeth_ipacmd_setadpparms));
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.setadapterparms.data.change_addr.cmd = CHANGE_ADDR_READ_MAC;
         cmd->data.setadapterparms.data.change_addr.addr_size = OSA_ADDR_LEN;
@@ -4345,6 +4406,8 @@ static int qeth_setadpparms_set_access_ctrl(struct qeth_card *card,
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_ACCESS_CONTROL,
                                    sizeof(struct qeth_ipacmd_setadpparms_hdr) +
                                    sizeof(struct qeth_set_access_ctrl));
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
         access_ctrl_req->subcmd_code = isolation;
@@ -4588,6 +4651,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
 
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_SNMP_CONTROL,
                                    QETH_SNMP_SETADP_CMDLENGTH + req_len);
+        if (!iob) {
+                rc = -ENOMEM;
+                goto out;
+        }
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         memcpy(&cmd->data.setadapterparms.data.snmp, &ureq->cmd, req_len);
         rc = qeth_send_ipa_snmp_cmd(card, iob, QETH_SETADP_BASE_LEN + req_len,
@@ -4599,7 +4666,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
                 if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
                         rc = -EFAULT;
         }
-
+out:
         kfree(ureq);
         kfree(qinfo.udata);
         return rc;
@@ -4670,6 +4737,10 @@ int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_OAT,
                                    sizeof(struct qeth_ipacmd_setadpparms_hdr) +
                                    sizeof(struct qeth_query_oat));
+        if (!iob) {
+                rc = -ENOMEM;
+                goto out_free;
+        }
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         oat_req = &cmd->data.setadapterparms.data.query_oat;
         oat_req->subcmd_code = oat_data.command;
@@ -4735,6 +4806,8 @@ static int qeth_query_card_info(struct qeth_card *card,
                 return -EOPNOTSUPP;
         iob = qeth_get_adapter_cmd(card, IPA_SETADP_QUERY_CARD_INFO,
                 sizeof(struct qeth_ipacmd_setadpparms_hdr));
+        if (!iob)
+                return -ENOMEM;
         return qeth_send_ipa_cmd(card, iob, qeth_query_card_info_cb,
                                         (void *)carrier_info);
 }
@@ -5060,11 +5133,23 @@ retriable:
         card->options.adp.supported_funcs = 0;
         card->options.sbp.supported_funcs = 0;
         card->info.diagass_support = 0;
-        qeth_query_ipassists(card, QETH_PROT_IPV4);
-        if (qeth_is_supported(card, IPA_SETADAPTERPARMS))
-                qeth_query_setadapterparms(card);
-        if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST))
-                qeth_query_setdiagass(card);
+        rc = qeth_query_ipassists(card, QETH_PROT_IPV4);
+        if (rc == -ENOMEM)
+                goto out;
+        if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
+                rc = qeth_query_setadapterparms(card);
+                if (rc < 0) {
+                        QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+                        goto out;
+                }
+        }
+        if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
+                rc = qeth_query_setdiagass(card);
+                if (rc < 0) {
+                        QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
+                        goto out;
+                }
+        }
         return 0;
 out:
         dev_warn(&card->gdev->dev, "The qeth device driver failed to recover "
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index d02cd1a67943..ce87ae72edbd 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -27,10 +27,7 @@ static int qeth_l2_set_offline(struct ccwgroup_device *);
 static int qeth_l2_stop(struct net_device *);
 static int qeth_l2_send_delmac(struct qeth_card *, __u8 *);
 static int qeth_l2_send_setdelmac(struct qeth_card *, __u8 *,
-                           enum qeth_ipa_cmds,
-                           int (*reply_cb) (struct qeth_card *,
-                                            struct qeth_reply*,
-                                            unsigned long));
+                           enum qeth_ipa_cmds);
 static void qeth_l2_set_multicast_list(struct net_device *);
 static int qeth_l2_recover(void *);
 static void qeth_bridgeport_query_support(struct qeth_card *card);
@@ -130,56 +127,71 @@ static struct net_device *qeth_l2_netdev_by_devno(unsigned char *read_dev_no)
         return ndev;
 }
 
-static int qeth_l2_send_setgroupmac_cb(struct qeth_card *card,
-                                struct qeth_reply *reply,
-                                unsigned long data)
+static int qeth_setdel_makerc(struct qeth_card *card, int retcode)
 {
-        struct qeth_ipa_cmd *cmd;
-        __u8 *mac;
+        int rc;
 
-        QETH_CARD_TEXT(card, 2, "L2Sgmacb");
-        cmd = (struct qeth_ipa_cmd *) data;
-        mac = &cmd->data.setdelmac.mac[0];
-        /* MAC already registered, needed in couple/uncouple case */
-        if (cmd->hdr.return_code ==  IPA_RC_L2_DUP_MAC) {
-                QETH_DBF_MESSAGE(2, "Group MAC %pM already existing on %s \n",
-                          mac, QETH_CARD_IFNAME(card));
-                cmd->hdr.return_code = 0;
+        if (retcode)
+                QETH_CARD_TEXT_(card, 2, "err%04x", retcode);
+        switch (retcode) {
+        case IPA_RC_SUCCESS:
+                rc = 0;
+                break;
+        case IPA_RC_L2_UNSUPPORTED_CMD:
+                rc = -ENOSYS;
+                break;
+        case IPA_RC_L2_ADDR_TABLE_FULL:
+                rc = -ENOSPC;
+                break;
+        case IPA_RC_L2_DUP_MAC:
+        case IPA_RC_L2_DUP_LAYER3_MAC:
+                rc = -EEXIST;
+                break;
+        case IPA_RC_L2_MAC_NOT_AUTH_BY_HYP:
+        case IPA_RC_L2_MAC_NOT_AUTH_BY_ADP:
+                rc = -EPERM;
+                break;
+        case IPA_RC_L2_MAC_NOT_FOUND:
+                rc = -ENOENT;
+                break;
+        case -ENOMEM:
+                rc = -ENOMEM;
+                break;
+        default:
+                rc = -EIO;
+                break;
         }
-        if (cmd->hdr.return_code)
-                QETH_DBF_MESSAGE(2, "Could not set group MAC %pM on %s: %x\n",
-                          mac, QETH_CARD_IFNAME(card), cmd->hdr.return_code);
-        return 0;
+        return rc;
 }
 
 static int qeth_l2_send_setgroupmac(struct qeth_card *card, __u8 *mac)
 {
-        QETH_CARD_TEXT(card, 2, "L2Sgmac");
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETGMAC,
-                                          qeth_l2_send_setgroupmac_cb);
-}
-
-static int qeth_l2_send_delgroupmac_cb(struct qeth_card *card,
-                                struct qeth_reply *reply,
-                                unsigned long data)
-{
-        struct qeth_ipa_cmd *cmd;
-        __u8 *mac;
+        int rc;
 
-        QETH_CARD_TEXT(card, 2, "L2Dgmacb");
-        cmd = (struct qeth_ipa_cmd *) data;
-        mac = &cmd->data.setdelmac.mac[0];
-        if (cmd->hdr.return_code)
-                QETH_DBF_MESSAGE(2, "Could not delete group MAC %pM on %s: %x\n",
-                          mac, QETH_CARD_IFNAME(card), cmd->hdr.return_code);
-        return 0;
+        QETH_CARD_TEXT(card, 2, "L2Sgmac");
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
+                                        IPA_CMD_SETGMAC));
+        if (rc == -EEXIST)
+                QETH_DBF_MESSAGE(2, "Group MAC %pM already existing on %s\n",
+                        mac, QETH_CARD_IFNAME(card));
+        else if (rc)
+                QETH_DBF_MESSAGE(2, "Could not set group MAC %pM on %s: %d\n",
+                        mac, QETH_CARD_IFNAME(card), rc);
+        return rc;
 }
 
 static int qeth_l2_send_delgroupmac(struct qeth_card *card, __u8 *mac)
 {
+        int rc;
+
         QETH_CARD_TEXT(card, 2, "L2Dgmac");
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_DELGMAC,
-                                          qeth_l2_send_delgroupmac_cb);
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
+                                        IPA_CMD_DELGMAC));
+        if (rc)
+                QETH_DBF_MESSAGE(2,
+                        "Could not delete group MAC %pM on %s: %d\n",
+                        mac, QETH_CARD_IFNAME(card), rc);
+        return rc;
 }
 
 static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac, int vmac)
@@ -197,10 +209,11 @@ static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac, int vmac)
         mc->is_vmac = vmac;
 
         if (vmac) {
-                rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC,
-                                        NULL);
+                rc = qeth_setdel_makerc(card,
+                        qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC));
         } else {
-                rc = qeth_l2_send_setgroupmac(card, mac);
+                rc = qeth_setdel_makerc(card,
+                        qeth_l2_send_setgroupmac(card, mac));
         }
 
         if (!rc)
@@ -218,7 +231,7 @@ static void qeth_l2_del_all_mc(struct qeth_card *card, int del)
                 if (del) {
                         if (mc->is_vmac)
                                 qeth_l2_send_setdelmac(card, mc->mc_addr,
-                                        IPA_CMD_DELVMAC, NULL);
+                                        IPA_CMD_DELVMAC);
                         else
                                 qeth_l2_send_delgroupmac(card, mc->mc_addr);
                 }
@@ -291,6 +304,8 @@ static int qeth_l2_send_setdelvlan(struct qeth_card *card, __u16 i,
 
         QETH_CARD_TEXT_(card, 4, "L2sdv%x", ipacmd);
         iob = qeth_get_ipacmd_buffer(card, ipacmd, QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.setdelvlan.vlan_id = i;
         return qeth_send_ipa_cmd(card, iob,
@@ -313,6 +328,7 @@ static int qeth_l2_vlan_rx_add_vid(struct net_device *dev,
 {
         struct qeth_card *card = dev->ml_priv;
         struct qeth_vlan_vid *id;
+        int rc;
 
         QETH_CARD_TEXT_(card, 4, "aid:%d", vid);
         if (!vid)
@@ -328,7 +344,11 @@ static int qeth_l2_vlan_rx_add_vid(struct net_device *dev,
         id = kmalloc(sizeof(struct qeth_vlan_vid), GFP_ATOMIC);
         if (id) {
                 id->vid = vid;
-                qeth_l2_send_setdelvlan(card, vid, IPA_CMD_SETVLAN);
+                rc = qeth_l2_send_setdelvlan(card, vid, IPA_CMD_SETVLAN);
+                if (rc) {
+                        kfree(id);
+                        return rc;
+                }
                 spin_lock_bh(&card->vlanlock);
                 list_add_tail(&id->list, &card->vid_list);
                 spin_unlock_bh(&card->vlanlock);
@@ -343,6 +363,7 @@ static int qeth_l2_vlan_rx_kill_vid(struct net_device *dev,
 {
         struct qeth_vlan_vid *id, *tmpid = NULL;
         struct qeth_card *card = dev->ml_priv;
+        int rc = 0;
 
         QETH_CARD_TEXT_(card, 4, "kid:%d", vid);
         if (card->info.type == QETH_CARD_TYPE_OSM) {
@@ -363,11 +384,11 @@ static int qeth_l2_vlan_rx_kill_vid(struct net_device *dev,
         }
         spin_unlock_bh(&card->vlanlock);
         if (tmpid) {
-                qeth_l2_send_setdelvlan(card, vid, IPA_CMD_DELVLAN);
+                rc = qeth_l2_send_setdelvlan(card, vid, IPA_CMD_DELVLAN);
                 kfree(tmpid);
         }
         qeth_l2_set_multicast_list(card->dev);
-        return 0;
+        return rc;
 }
 
 static int qeth_l2_stop_card(struct qeth_card *card, int recovery_mode)
@@ -539,91 +560,62 @@ out:
 }
 
 static int qeth_l2_send_setdelmac(struct qeth_card *card, __u8 *mac,
-                           enum qeth_ipa_cmds ipacmd,
-                           int (*reply_cb) (struct qeth_card *,
-                                            struct qeth_reply*,
-                                            unsigned long))
+                           enum qeth_ipa_cmds ipacmd)
 {
         struct qeth_ipa_cmd *cmd;
         struct qeth_cmd_buffer *iob;
 
         QETH_CARD_TEXT(card, 2, "L2sdmac");
         iob = qeth_get_ipacmd_buffer(card, ipacmd, QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.setdelmac.mac_length = OSA_ADDR_LEN;
         memcpy(&cmd->data.setdelmac.mac, mac, OSA_ADDR_LEN);
-        return qeth_send_ipa_cmd(card, iob, reply_cb, NULL);
+        return qeth_send_ipa_cmd(card, iob, NULL, NULL);
 }
 
-static int qeth_l2_send_setmac_cb(struct qeth_card *card,
-                           struct qeth_reply *reply,
-                           unsigned long data)
+static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
 {
-        struct qeth_ipa_cmd *cmd;
+        int rc;
 
-        QETH_CARD_TEXT(card, 2, "L2Smaccb");
-        cmd = (struct qeth_ipa_cmd *) data;
-        if (cmd->hdr.return_code) {
-                QETH_CARD_TEXT_(card, 2, "L2er%x", cmd->hdr.return_code);
+        QETH_CARD_TEXT(card, 2, "L2Setmac");
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
+                                        IPA_CMD_SETVMAC));
+        if (rc == 0) {
+                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
+                memcpy(card->dev->dev_addr, mac, OSA_ADDR_LEN);
+                dev_info(&card->gdev->dev,
+                        "MAC address %pM successfully registered on device %s\n",
+                        card->dev->dev_addr, card->dev->name);
+        } else {
                 card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
-                switch (cmd->hdr.return_code) {
-                case IPA_RC_L2_DUP_MAC:
-                case IPA_RC_L2_DUP_LAYER3_MAC:
+                switch (rc) {
+                case -EEXIST:
                         dev_warn(&card->gdev->dev,
-                                "MAC address %pM already exists\n",
-                                cmd->data.setdelmac.mac);
+                                "MAC address %pM already exists\n", mac);
                         break;
-                case IPA_RC_L2_MAC_NOT_AUTH_BY_HYP:
-                case IPA_RC_L2_MAC_NOT_AUTH_BY_ADP:
+                case -EPERM:
                         dev_warn(&card->gdev->dev,
-                                "MAC address %pM is not authorized\n",
-                                cmd->data.setdelmac.mac);
-                        break;
-                default:
+                                "MAC address %pM is not authorized\n", mac);
                         break;
                 }
-        } else {
-                card->info.mac_bits |= QETH_LAYER2_MAC_REGISTERED;
-                memcpy(card->dev->dev_addr, cmd->data.setdelmac.mac,
-                       OSA_ADDR_LEN);
-                dev_info(&card->gdev->dev,
-                        "MAC address %pM successfully registered on device %s\n",
-                        card->dev->dev_addr, card->dev->name);
-        }
-        return 0;
-}
-
-static int qeth_l2_send_setmac(struct qeth_card *card, __u8 *mac)
-{
-        QETH_CARD_TEXT(card, 2, "L2Setmac");
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC,
-                                          qeth_l2_send_setmac_cb);
-}
-
-static int qeth_l2_send_delmac_cb(struct qeth_card *card,
-                           struct qeth_reply *reply,
-                           unsigned long data)
-{
-        struct qeth_ipa_cmd *cmd;
-
-        QETH_CARD_TEXT(card, 2, "L2Dmaccb");
-        cmd = (struct qeth_ipa_cmd *) data;
-        if (cmd->hdr.return_code) {
-                QETH_CARD_TEXT_(card, 2, "err%d", cmd->hdr.return_code);
-                return 0;
         }
-        card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
-
-        return 0;
+        return rc;
 }
 
 static int qeth_l2_send_delmac(struct qeth_card *card, __u8 *mac)
 {
+        int rc;
+
         QETH_CARD_TEXT(card, 2, "L2Delmac");
         if (!(card->info.mac_bits & QETH_LAYER2_MAC_REGISTERED))
                 return 0;
-        return qeth_l2_send_setdelmac(card, mac, IPA_CMD_DELVMAC,
-                                          qeth_l2_send_delmac_cb);
+        rc = qeth_setdel_makerc(card, qeth_l2_send_setdelmac(card, mac,
+                                        IPA_CMD_DELVMAC));
+        if (rc == 0)
+                card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
+        return rc;
 }
 
 static int qeth_l2_request_initial_mac(struct qeth_card *card)
@@ -651,7 +643,7 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
                 if (rc) {
                         QETH_DBF_MESSAGE(2, "couldn't get MAC address on "
                                 "device %s: x%x\n", CARD_BUS_ID(card), rc);
-                        QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+                        QETH_DBF_TEXT_(SETUP, 2, "1err%04x", rc);
                         return rc;
                 }
                 QETH_DBF_HEX(SETUP, 2, card->dev->dev_addr, OSA_ADDR_LEN);
@@ -687,7 +679,7 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
                 return -ERESTARTSYS;
         }
         rc = qeth_l2_send_delmac(card, &card->dev->dev_addr[0]);
-        if (!rc || (rc == IPA_RC_L2_MAC_NOT_FOUND))
+        if (!rc || (rc == -ENOENT))
                 rc = qeth_l2_send_setmac(card, addr->sa_data);
         return rc ? -EINVAL : 0;
 }
@@ -996,7 +988,7 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         recover_flag = card->state;
         rc = qeth_core_hardsetup_card(card);
         if (rc) {
-                QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
+                QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
                 rc = -ENODEV;
                 goto out_remove;
         }
@@ -1730,6 +1722,8 @@ static void qeth_bridgeport_query_support(struct qeth_card *card)
 
         QETH_CARD_TEXT(card, 2, "brqsuppo");
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETBRIDGEPORT, 0);
+        if (!iob)
+                return;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.sbp.hdr.cmdlength =
                 sizeof(struct qeth_ipacmd_sbp_hdr) +
@@ -1805,6 +1799,8 @@ int qeth_bridgeport_query_ports(struct qeth_card *card,
         if (!(card->options.sbp.supported_funcs & IPA_SBP_QUERY_BRIDGE_PORTS))
                 return -EOPNOTSUPP;
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETBRIDGEPORT, 0);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.sbp.hdr.cmdlength =
                 sizeof(struct qeth_ipacmd_sbp_hdr);
@@ -1817,9 +1813,7 @@ int qeth_bridgeport_query_ports(struct qeth_card *card,
         if (rc)
                 return rc;
         rc = qeth_bridgeport_makerc(card, &cbctl, IPA_SBP_QUERY_BRIDGE_PORTS);
-        if (rc)
-                return rc;
-        return 0;
+        return rc;
 }
 EXPORT_SYMBOL_GPL(qeth_bridgeport_query_ports);
 
@@ -1873,6 +1867,8 @@ int qeth_bridgeport_setrole(struct qeth_card *card, enum qeth_sbp_roles role)
         if (!(card->options.sbp.supported_funcs & setcmd))
                 return -EOPNOTSUPP;
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETBRIDGEPORT, 0);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.sbp.hdr.cmdlength = cmdlength;
         cmd->data.sbp.hdr.command_code = setcmd;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 625227ad16ee..e2a0ee845399 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -549,6 +549,8 @@ static int qeth_l3_send_setdelmc(struct qeth_card *card,
         QETH_CARD_TEXT(card, 4, "setdelmc");
 
         iob = qeth_get_ipacmd_buffer(card, ipacmd, addr->proto);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         memcpy(&cmd->data.setdelipm.mac, addr->mac, OSA_ADDR_LEN);
         if (addr->proto == QETH_PROT_IPV6)
@@ -588,6 +590,8 @@ static int qeth_l3_send_setdelip(struct qeth_card *card,
         QETH_CARD_TEXT_(card, 4, "flags%02X", flags);
 
         iob = qeth_get_ipacmd_buffer(card, ipacmd, addr->proto);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         if (addr->proto == QETH_PROT_IPV6) {
                 memcpy(cmd->data.setdelip6.ip_addr, &addr->u.a6.addr,
@@ -616,6 +620,8 @@ static int qeth_l3_send_setrouting(struct qeth_card *card,
 
         QETH_CARD_TEXT(card, 4, "setroutg");
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETRTG, prot);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.setrtg.type = (type);
         rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
@@ -1049,12 +1055,14 @@ static struct qeth_cmd_buffer *qeth_l3_get_setassparms_cmd(
         QETH_CARD_TEXT(card, 4, "getasscm");
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SETASSPARMS, prot);
 
-        cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
-        cmd->data.setassparms.hdr.assist_no = ipa_func;
-        cmd->data.setassparms.hdr.length = 8 + len;
-        cmd->data.setassparms.hdr.command_code = cmd_code;
-        cmd->data.setassparms.hdr.return_code = 0;
-        cmd->data.setassparms.hdr.seq_no = 0;
+        if (iob) {
+                cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
+                cmd->data.setassparms.hdr.assist_no = ipa_func;
+                cmd->data.setassparms.hdr.length = 8 + len;
+                cmd->data.setassparms.hdr.command_code = cmd_code;
+                cmd->data.setassparms.hdr.return_code = 0;
+                cmd->data.setassparms.hdr.seq_no = 0;
+        }
 
         return iob;
 }
@@ -1090,6 +1098,8 @@ static int qeth_l3_send_simple_setassparms_ipv6(struct qeth_card *card,
         QETH_CARD_TEXT(card, 4, "simassp6");
         iob = qeth_l3_get_setassparms_cmd(card, ipa_func, cmd_code,
                                        0, QETH_PROT_IPV6);
+        if (!iob)
+                return -ENOMEM;
         rc = qeth_l3_send_setassparms(card, iob, 0, 0,
                                    qeth_l3_default_setassparms_cb, NULL);
         return rc;
@@ -1108,6 +1118,8 @@ static int qeth_l3_send_simple_setassparms(struct qeth_card *card,
                 length = sizeof(__u32);
         iob = qeth_l3_get_setassparms_cmd(card, ipa_func, cmd_code,
                                        length, QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
         rc = qeth_l3_send_setassparms(card, iob, length, data,
                                    qeth_l3_default_setassparms_cb, NULL);
         return rc;
@@ -1494,6 +1506,8 @@ static int qeth_l3_iqd_read_initial_mac(struct qeth_card *card)
 
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_CREATE_ADDR,
                                      QETH_PROT_IPV6);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         *((__u16 *) &cmd->data.create_destroy_addr.unique_id[6]) =
                         card->info.unique_id;
@@ -1537,6 +1551,8 @@ static int qeth_l3_get_unique_id(struct qeth_card *card)
 
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_CREATE_ADDR,
                                      QETH_PROT_IPV6);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         *((__u16 *) &cmd->data.create_destroy_addr.unique_id[6]) =
                         card->info.unique_id;
@@ -1611,6 +1627,8 @@ qeth_diags_trace(struct qeth_card *card, enum qeth_diags_trace_cmds diags_cmd)
         QETH_DBF_TEXT(SETUP, 2, "diagtrac");
 
         iob = qeth_get_ipacmd_buffer(card, IPA_CMD_SET_DIAG_ASS, 0);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.diagass.subcmd_len = 16;
         cmd->data.diagass.subcmd = QETH_DIAGS_CMD_TRACE;
@@ -2442,6 +2460,8 @@ static int qeth_l3_query_arp_cache_info(struct qeth_card *card,
                         IPA_CMD_ASS_ARP_QUERY_INFO,
                         sizeof(struct qeth_arp_query_data) - sizeof(char),
                         prot);
+        if (!iob)
+                return -ENOMEM;
         cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
         cmd->data.setassparms.data.query_arp.request_bits = 0x000F;
         cmd->data.setassparms.data.query_arp.reply_bits = 0;
@@ -2535,6 +2555,8 @@ static int qeth_l3_arp_add_entry(struct qeth_card *card,
                                        IPA_CMD_ASS_ARP_ADD_ENTRY,
                                        sizeof(struct qeth_arp_cache_entry),
                                        QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
         rc = qeth_l3_send_setassparms(card, iob,
                                    sizeof(struct qeth_arp_cache_entry),
                                    (unsigned long) entry,
@@ -2574,6 +2596,8 @@ static int qeth_l3_arp_remove_entry(struct qeth_card *card,
                                        IPA_CMD_ASS_ARP_REMOVE_ENTRY,
                                        12,
                                        QETH_PROT_IPV4);
+        if (!iob)
+                return -ENOMEM;
         rc = qeth_l3_send_setassparms(card, iob,
                                    12, (unsigned long)buf,
                                    qeth_l3_default_setassparms_cb, NULL);
@@ -3262,6 +3286,8 @@ static const struct net_device_ops qeth_l3_osa_netdev_ops = {
 
 static int qeth_l3_setup_netdev(struct qeth_card *card)
 {
+        int rc;
+
         if (card->info.type == QETH_CARD_TYPE_OSD ||
             card->info.type == QETH_CARD_TYPE_OSX) {
                 if ((card->info.link_type == QETH_LINK_TYPE_LANE_TR) ||
@@ -3293,7 +3319,9 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
                         return -ENODEV;
                 card->dev->flags |= IFF_NOARP;
                 card->dev->netdev_ops = &qeth_l3_netdev_ops;
-                qeth_l3_iqd_read_initial_mac(card);
+                rc = qeth_l3_iqd_read_initial_mac(card);
+                if (rc)
+                        return rc;
                 if (card->options.hsuid[0])
                         memcpy(card->dev->perm_addr, card->options.hsuid, 9);
         } else
@@ -3360,7 +3388,7 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         recover_flag = card->state;
         rc = qeth_core_hardsetup_card(card);
         if (rc) {
-                QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
+                QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
                 rc = -ENODEV;
                 goto out_remove;
         }
@@ -3401,7 +3429,7 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
 contin:
         rc = qeth_l3_setadapter_parms(card);
         if (rc)
-                QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
+                QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
         if (!card->options.sniffer) {
                 rc = qeth_l3_start_ipassists(card);
                 if (rc) {
@@ -3410,10 +3438,10 @@ contin:
                 }
                 rc = qeth_l3_setrouting_v4(card);
                 if (rc)
-                        QETH_DBF_TEXT_(SETUP, 2, "4err%d", rc);
+                        QETH_DBF_TEXT_(SETUP, 2, "4err%04x", rc);
                 rc = qeth_l3_setrouting_v6(card);
                 if (rc)
-                        QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
+                        QETH_DBF_TEXT_(SETUP, 2, "5err%04x", rc);
         }
         netif_tx_disable(card->dev);
 
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index e02885451425..9b3829931f40 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -986,9 +986,9 @@ int scsi_device_get(struct scsi_device *sdev)
                 return -ENXIO;
         if (!get_device(&sdev->sdev_gendev))
                 return -ENXIO;
-        /* We can fail this if we're doing SCSI operations
+        /* We can fail try_module_get if we're doing SCSI operations
          * from module exit (like cache flush) */
-        try_module_get(sdev->host->hostt->module);
+        __module_get(sdev->host->hostt->module);
 
         return 0;
 }
@@ -1004,14 +1004,7 @@ EXPORT_SYMBOL(scsi_device_get);
  */
 void scsi_device_put(struct scsi_device *sdev)
 {
-#ifdef CONFIG_MODULE_UNLOAD
-        struct module *module = sdev->host->hostt->module;
-
-        /* The module refcount will be zero if scsi_device_get()
-         * was called from a module removal routine */
-        if (module && module_refcount(module) != 0)
-                module_put(module);
-#endif
+        module_put(sdev->host->hostt->module);
         put_device(&sdev->sdev_gendev);
 }
 EXPORT_SYMBOL(scsi_device_put);
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index 7281316a5ecb..a67d37c7e3c0 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -271,7 +271,6 @@ int dw_spi_mid_init(struct dw_spi *dws)
         iounmap(clk_reg);
 
         dws->num_cs = 16;
-        dws->fifo_len = 40;     /* FIFO has 40 words buffer */
 
 #ifdef CONFIG_SPI_DW_MID_DMA
         dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL);
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index d0d5542efc06..8edcd1b84562 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -621,13 +621,13 @@ static void spi_hw_init(struct dw_spi *dws)
         if (!dws->fifo_len) {
                 u32 fifo;
 
-                for (fifo = 2; fifo <= 257; fifo++) {
+                for (fifo = 2; fifo <= 256; fifo++) {
                         dw_writew(dws, DW_SPI_TXFLTR, fifo);
                         if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
                                 break;
                 }
 
-                dws->fifo_len = (fifo == 257) ? 0 : fifo;
+                dws->fifo_len = (fifo == 2) ? 0 : fifo - 1;
                 dw_writew(dws, DW_SPI_TXFLTR, 0);
         }
 }
@@ -673,7 +673,7 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
         if (dws->dma_ops && dws->dma_ops->dma_init) {
                 ret = dws->dma_ops->dma_init(dws);
                 if (ret) {
-                        dev_warn(&master->dev, "DMA init failed\n");
+                        dev_warn(dev, "DMA init failed\n");
                         dws->dma_inited = 0;
                 }
         }
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index 05c623cfb078..23822e7df6c1 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -546,8 +546,8 @@ static void giveback(struct driver_data *drv_data)
                         cs_deassert(drv_data);
         }
 
-        spi_finalize_current_message(drv_data->master);
         drv_data->cur_chip = NULL;
+        spi_finalize_current_message(drv_data->master);
 }
 
 static void reset_sccr1(struct driver_data *drv_data)
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 96a5fc0878d8..3ab7a21445fc 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -82,7 +82,7 @@ struct sh_msiof_spi_priv {
 #define MDR1_SYNCMD_LR   0x30000000 /*   L/R mode */
 #define MDR1_SYNCAC_SHIFT        25 /* Sync Polarity (1 = Active-low) */
 #define MDR1_BITLSB_SHIFT        24 /* MSB/LSB First (1 = LSB first) */
-#define MDR1_FLD_MASK    0x000000c0 /* Frame Sync Signal Interval (0-3) */
+#define MDR1_FLD_MASK    0x0000000c /* Frame Sync Signal Interval (0-3) */
 #define MDR1_FLD_SHIFT            2
 #define MDR1_XXSTP       0x00000001 /* Transmission/Reception Stop on FIFO */
 /* TMDR1 */
diff --git a/drivers/staging/lustre/lustre/llite/vvp_io.c b/drivers/staging/lustre/lustre/llite/vvp_io.c
index 930f6010203e..65d610abe06e 100644
--- a/drivers/staging/lustre/lustre/llite/vvp_io.c
+++ b/drivers/staging/lustre/lustre/llite/vvp_io.c
@@ -632,7 +632,7 @@ static int vvp_io_kernel_fault(struct vvp_fault_io *cfio)
                 return 0;
         }
 
-        if (cfio->fault.ft_flags & VM_FAULT_SIGBUS) {
+        if (cfio->fault.ft_flags & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
                 CDEBUG(D_PAGE, "got addr %p - SIGBUS\n", vmf->virtual_address);
                 return -EFAULT;
         }
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 093535c6217b..120b70d72d79 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -85,23 +85,20 @@ static struct nvec_chip *nvec_power_handle;
 static const struct mfd_cell nvec_devices[] = {
         {
                 .name = "nvec-kbd",
-                .id = 1,
         },
         {
                 .name = "nvec-mouse",
-                .id = 1,
         },
         {
                 .name = "nvec-power",
-                .id = 1,
+                .id = 0,
         },
         {
                 .name = "nvec-power",
-                .id = 2,
+                .id = 1,
         },
         {
                 .name = "nvec-paz00",
-                .id = 1,
         },
 };
 
@@ -891,7 +888,7 @@ static int tegra_nvec_probe(struct platform_device *pdev)
                 nvec_msg_free(nvec, msg);
         }
 
-        ret = mfd_add_devices(nvec->dev, -1, nvec_devices,
+        ret = mfd_add_devices(nvec->dev, 0, nvec_devices,
                               ARRAY_SIZE(nvec_devices), NULL, 0, NULL);
         if (ret)
                 dev_err(nvec->dev, "error adding subdevices\n");
diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
index de0c9c9d7091..a6315abe7b7c 100644
--- a/drivers/usb/core/otg_whitelist.h
+++ b/drivers/usb/core/otg_whitelist.h
@@ -55,6 +55,11 @@ static int is_targeted(struct usb_device *dev)
              le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
                 return 0;
 
+        /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
+        if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
+             le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
+                return 1;
+
         /* NOTE: can't use usb_match_id() since interface caches
          * aren't set up yet. this is cut/paste from that code.
          */
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0ffb4ed0a945..41e510ae8c83 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -179,6 +179,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
                         USB_QUIRK_IGNORE_REMOTE_WAKEUP },
 
+        /* Protocol and OTG Electrical Test Device */
+        { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+                        USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
         { }  /* terminating entry must be last */
 };
 
diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
index ad43c5bc1ef1..02e3e2d4ea56 100644
--- a/drivers/usb/dwc2/core_intr.c
+++ b/drivers/usb/dwc2/core_intr.c
@@ -476,13 +476,13 @@ irqreturn_t dwc2_handle_common_intr(int irq, void *dev)
         u32 gintsts;
         irqreturn_t retval = IRQ_NONE;
 
+        spin_lock(&hsotg->lock);
+
         if (!dwc2_is_controller_alive(hsotg)) {
                 dev_warn(hsotg->dev, "Controller is dead\n");
                 goto out;
         }
 
-        spin_lock(&hsotg->lock);
-
         gintsts = dwc2_read_common_intr(hsotg);
         if (gintsts & ~GINTSTS_PRTINT)
                 retval = IRQ_HANDLED;
@@ -515,8 +515,8 @@ irqreturn_t dwc2_handle_common_intr(int irq, void *dev)
                 }
         }
 
-        spin_unlock(&hsotg->lock);
 out:
+        spin_unlock(&hsotg->lock);
         return retval;
 }
 EXPORT_SYMBOL_GPL(dwc2_handle_common_intr);
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index ccfdfb24b240..2f9735b35338 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -34,7 +34,7 @@ static struct usb_phy *__usb_find_phy(struct list_head *list,
                 return phy;
         }
 
-        return ERR_PTR(-EPROBE_DEFER);
+        return ERR_PTR(-ENODEV);
 }
 
 static struct usb_phy *__usb_find_phy_dev(struct device *dev,
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 11c7a9676441..d684b4b8108f 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -507,7 +507,7 @@ UNUSUAL_DEV(  0x04e6, 0x000c, 0x0100, 0x0100,
 UNUSUAL_DEV(  0x04e6, 0x000f, 0x0000, 0x9999,
                 "SCM Microsystems",
                 "eUSB SCSI Adapter (Bus Powered)",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+                USB_SC_SCSI, USB_PR_BULK, usb_stor_euscsi_init,
                 US_FL_SCM_MULT_TARG ),
 
 UNUSUAL_DEV(  0x04e6, 0x0101, 0x0200, 0x0200,
@@ -1995,6 +1995,13 @@ UNUSUAL_DEV(  0x152d, 0x2329, 0x0100, 0x0100,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
 
+/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */
+UNUSUAL_DEV(  0x152d, 0x2566, 0x0114, 0x0114,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
+
 /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
  * and Mac USB Dock USB-SCSI */
 UNUSUAL_DEV(  0x1645, 0x0007, 0x0100, 0x0133,
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 6df4357d9ee3..dbc00e56c7f5 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -140,3 +140,10 @@ UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
                 "External HDD",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_UAS),
+
+/* Reported-by: Richard Henderson <rth@redhat.com> */
+UNUSUAL_DEV(0x4971, 0x8017, 0x0000, 0x9999,
+                "SimpleTech",
+                "External HDD",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_REPORT_OPCODES),
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 2f0fbc374e87..e427cb7ee12c 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -3065,6 +3065,8 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
         path->search_commit_root = 1;
         path->skip_locking = 1;
 
+        ppath->search_commit_root = 1;
+        ppath->skip_locking = 1;
         /*
          * trigger the readahead for extent tree csum tree and wait for
          * completion. During readahead, the scrub is officially paused
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index c8b148bbdc8b..3e193cb36996 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -667,7 +667,7 @@ static void do_qc(struct gfs2_quota_data *qd, s64 change)
 
 static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
                              s64 change, struct gfs2_quota_data *qd,
-                             struct fs_disk_quota *fdq)
+                             struct qc_dqblk *fdq)
 {
         struct inode *inode = &ip->i_inode;
         struct gfs2_sbd *sdp = GFS2_SB(inode);
@@ -697,16 +697,16 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
         be64_add_cpu(&q.qu_value, change);
         qd->qd_qb.qb_value = q.qu_value;
         if (fdq) {
-                if (fdq->d_fieldmask & FS_DQ_BSOFT) {
-                        q.qu_warn = cpu_to_be64(fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift);
+                if (fdq->d_fieldmask & QC_SPC_SOFT) {
+                        q.qu_warn = cpu_to_be64(fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift);
                         qd->qd_qb.qb_warn = q.qu_warn;
                 }
-                if (fdq->d_fieldmask & FS_DQ_BHARD) {
-                        q.qu_limit = cpu_to_be64(fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift);
+                if (fdq->d_fieldmask & QC_SPC_HARD) {
+                        q.qu_limit = cpu_to_be64(fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift);
                         qd->qd_qb.qb_limit = q.qu_limit;
                 }
-                if (fdq->d_fieldmask & FS_DQ_BCOUNT) {
-                        q.qu_value = cpu_to_be64(fdq->d_bcount >> sdp->sd_fsb2bb_shift);
+                if (fdq->d_fieldmask & QC_SPACE) {
+                        q.qu_value = cpu_to_be64(fdq->d_space >> sdp->sd_sb.sb_bsize_shift);
                         qd->qd_qb.qb_value = q.qu_value;
                 }
         }
@@ -1497,7 +1497,7 @@ static int gfs2_quota_get_xstate(struct super_block *sb,
 }
 
 static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
-                          struct fs_disk_quota *fdq)
+                          struct qc_dqblk *fdq)
 {
         struct gfs2_sbd *sdp = sb->s_fs_info;
         struct gfs2_quota_lvb *qlvb;
@@ -1505,7 +1505,7 @@ static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
         struct gfs2_holder q_gh;
         int error;
 
-        memset(fdq, 0, sizeof(struct fs_disk_quota));
+        memset(fdq, 0, sizeof(*fdq));
 
         if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
                 return -ESRCH; /* Crazy XFS error code */
@@ -1522,12 +1522,9 @@ static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
                 goto out;
 
         qlvb = (struct gfs2_quota_lvb *)qd->qd_gl->gl_lksb.sb_lvbptr;
-        fdq->d_version = FS_DQUOT_VERSION;
-        fdq->d_flags = (qid.type == USRQUOTA) ? FS_USER_QUOTA : FS_GROUP_QUOTA;
-        fdq->d_id = from_kqid_munged(current_user_ns(), qid);
-        fdq->d_blk_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_fsb2bb_shift;
-        fdq->d_blk_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_fsb2bb_shift;
-        fdq->d_bcount = be64_to_cpu(qlvb->qb_value) << sdp->sd_fsb2bb_shift;
+        fdq->d_spc_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_sb.sb_bsize_shift;
+        fdq->d_spc_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_sb.sb_bsize_shift;
+        fdq->d_space = be64_to_cpu(qlvb->qb_value) << sdp->sd_sb.sb_bsize_shift;
 
         gfs2_glock_dq_uninit(&q_gh);
 out:
@@ -1536,10 +1533,10 @@ out:
 }
 
 /* GFS2 only supports a subset of the XFS fields */
-#define GFS2_FIELDMASK (FS_DQ_BSOFT|FS_DQ_BHARD|FS_DQ_BCOUNT)
+#define GFS2_FIELDMASK (QC_SPC_SOFT|QC_SPC_HARD|QC_SPACE)
 
 static int gfs2_set_dqblk(struct super_block *sb, struct kqid qid,
-                          struct fs_disk_quota *fdq)
+                          struct qc_dqblk *fdq)
 {
         struct gfs2_sbd *sdp = sb->s_fs_info;
         struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
@@ -1583,17 +1580,17 @@ static int gfs2_set_dqblk(struct super_block *sb, struct kqid qid,
                 goto out_i;
 
         /* If nothing has changed, this is a no-op */
-        if ((fdq->d_fieldmask & FS_DQ_BSOFT) &&
-            ((fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
-                fdq->d_fieldmask ^= FS_DQ_BSOFT;
+        if ((fdq->d_fieldmask & QC_SPC_SOFT) &&
+            ((fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
+                fdq->d_fieldmask ^= QC_SPC_SOFT;
 
-        if ((fdq->d_fieldmask & FS_DQ_BHARD) &&
-            ((fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
-                fdq->d_fieldmask ^= FS_DQ_BHARD;
+        if ((fdq->d_fieldmask & QC_SPC_HARD) &&
+            ((fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
+                fdq->d_fieldmask ^= QC_SPC_HARD;
 
-        if ((fdq->d_fieldmask & FS_DQ_BCOUNT) &&
-            ((fdq->d_bcount >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
-                fdq->d_fieldmask ^= FS_DQ_BCOUNT;
+        if ((fdq->d_fieldmask & QC_SPACE) &&
+            ((fdq->d_space >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
+                fdq->d_fieldmask ^= QC_SPACE;
 
         if (fdq->d_fieldmask == 0)
                 goto out_i;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 10bf07280f4a..294692ff83b1 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -212,6 +212,12 @@ static int nfs_direct_cmp_commit_data_verf(struct nfs_direct_req *dreq,
  */
 ssize_t nfs_direct_IO(int rw, struct kiocb *iocb, struct iov_iter *iter, loff_t pos)
 {
+        struct inode *inode = iocb->ki_filp->f_mapping->host;
+
+        /* we only support swap file calling nfs_direct_IO */
+        if (!IS_SWAPFILE(inode))
+                return 0;
+
 #ifndef CONFIG_NFS_SWAP
         dprintk("NFS: nfs_direct_IO (%pD) off/no(%Ld/%lu) EINVAL\n",
                         iocb->ki_filp, (long long) pos, iter->nr_segs);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 4bffe637ea32..2211f6ba8736 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -352,8 +352,9 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
 
         nfs_attr_check_mountpoint(sb, fattr);
 
-        if (((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0) &&
-            !nfs_attr_use_mounted_on_fileid(fattr))
+        if (nfs_attr_use_mounted_on_fileid(fattr))
+                fattr->fileid = fattr->mounted_on_fileid;
+        else if ((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0)
                 goto out_no_inode;
         if ((fattr->valid & NFS_ATTR_FATTR_TYPE) == 0)
                 goto out_no_inode;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index efaa31c70fbe..b6f34bfa6fe8 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -31,8 +31,6 @@ static inline int nfs_attr_use_mounted_on_fileid(struct nfs_fattr *fattr)
             (((fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) &&
              ((fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) == 0)))
                 return 0;
-
-        fattr->fileid = fattr->mounted_on_fileid;
         return 1;
 }
 
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 953daa44a282..706ad10b8186 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -639,7 +639,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
                         prev = pos;
 
                         status = nfs_wait_client_init_complete(pos);
-                        if (status == 0) {
+                        if (pos->cl_cons_state == NFS_CS_SESSION_INITING) {
                                 nfs4_schedule_lease_recovery(pos);
                                 status = nfs4_wait_clnt_recover(pos);
                         }
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 8f0acef3d184..69df5b239844 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2396,30 +2396,25 @@ static inline qsize_t stoqb(qsize_t space)
 }
 
 /* Generic routine for getting common part of quota structure */
-static void do_get_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+static void do_get_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 {
         struct mem_dqblk *dm = &dquot->dq_dqb;
 
         memset(di, 0, sizeof(*di));
-        di->d_version = FS_DQUOT_VERSION;
-        di->d_flags = dquot->dq_id.type == USRQUOTA ?
-                        FS_USER_QUOTA : FS_GROUP_QUOTA;
-        di->d_id = from_kqid_munged(current_user_ns(), dquot->dq_id);
-
         spin_lock(&dq_data_lock);
-        di->d_blk_hardlimit = stoqb(dm->dqb_bhardlimit);
-        di->d_blk_softlimit = stoqb(dm->dqb_bsoftlimit);
+        di->d_spc_hardlimit = dm->dqb_bhardlimit;
+        di->d_spc_softlimit = dm->dqb_bsoftlimit;
         di->d_ino_hardlimit = dm->dqb_ihardlimit;
         di->d_ino_softlimit = dm->dqb_isoftlimit;
-        di->d_bcount = dm->dqb_curspace + dm->dqb_rsvspace;
-        di->d_icount = dm->dqb_curinodes;
-        di->d_btimer = dm->dqb_btime;
-        di->d_itimer = dm->dqb_itime;
+        di->d_space = dm->dqb_curspace + dm->dqb_rsvspace;
+        di->d_ino_count = dm->dqb_curinodes;
+        di->d_spc_timer = dm->dqb_btime;
+        di->d_ino_timer = dm->dqb_itime;
         spin_unlock(&dq_data_lock);
 }
 
 int dquot_get_dqblk(struct super_block *sb, struct kqid qid,
-                    struct fs_disk_quota *di)
+                    struct qc_dqblk *di)
 {
         struct dquot *dquot;
 
@@ -2433,70 +2428,70 @@ int dquot_get_dqblk(struct super_block *sb, struct kqid qid,
 }
 EXPORT_SYMBOL(dquot_get_dqblk);
 
-#define VFS_FS_DQ_MASK \
-        (FS_DQ_BCOUNT | FS_DQ_BSOFT | FS_DQ_BHARD | \
-         FS_DQ_ICOUNT | FS_DQ_ISOFT | FS_DQ_IHARD | \
-         FS_DQ_BTIMER | FS_DQ_ITIMER)
+#define VFS_QC_MASK \
+        (QC_SPACE | QC_SPC_SOFT | QC_SPC_HARD | \
+         QC_INO_COUNT | QC_INO_SOFT | QC_INO_HARD | \
+         QC_SPC_TIMER | QC_INO_TIMER)
 
 /* Generic routine for setting common part of quota structure */
-static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 {
         struct mem_dqblk *dm = &dquot->dq_dqb;
         int check_blim = 0, check_ilim = 0;
         struct mem_dqinfo *dqi = &sb_dqopt(dquot->dq_sb)->info[dquot->dq_id.type];
 
-        if (di->d_fieldmask & ~VFS_FS_DQ_MASK)
+        if (di->d_fieldmask & ~VFS_QC_MASK)
                 return -EINVAL;
 
-        if (((di->d_fieldmask & FS_DQ_BSOFT) &&
-             (di->d_blk_softlimit > dqi->dqi_maxblimit)) ||
-            ((di->d_fieldmask & FS_DQ_BHARD) &&
-             (di->d_blk_hardlimit > dqi->dqi_maxblimit)) ||
-            ((di->d_fieldmask & FS_DQ_ISOFT) &&
+        if (((di->d_fieldmask & QC_SPC_SOFT) &&
+             stoqb(di->d_spc_softlimit) > dqi->dqi_maxblimit) ||
+            ((di->d_fieldmask & QC_SPC_HARD) &&
+             stoqb(di->d_spc_hardlimit) > dqi->dqi_maxblimit) ||
+            ((di->d_fieldmask & QC_INO_SOFT) &&
              (di->d_ino_softlimit > dqi->dqi_maxilimit)) ||
-            ((di->d_fieldmask & FS_DQ_IHARD) &&
+            ((di->d_fieldmask & QC_INO_HARD) &&
              (di->d_ino_hardlimit > dqi->dqi_maxilimit)))
                 return -ERANGE;
 
         spin_lock(&dq_data_lock);
-        if (di->d_fieldmask & FS_DQ_BCOUNT) {
-                dm->dqb_curspace = di->d_bcount - dm->dqb_rsvspace;
+        if (di->d_fieldmask & QC_SPACE) {
+                dm->dqb_curspace = di->d_space - dm->dqb_rsvspace;
                 check_blim = 1;
                 set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
         }
 
-        if (di->d_fieldmask & FS_DQ_BSOFT)
-                dm->dqb_bsoftlimit = qbtos(di->d_blk_softlimit);
-        if (di->d_fieldmask & FS_DQ_BHARD)
-                dm->dqb_bhardlimit = qbtos(di->d_blk_hardlimit);
-        if (di->d_fieldmask & (FS_DQ_BSOFT | FS_DQ_BHARD)) {
+        if (di->d_fieldmask & QC_SPC_SOFT)
+                dm->dqb_bsoftlimit = di->d_spc_softlimit;
+        if (di->d_fieldmask & QC_SPC_HARD)
+                dm->dqb_bhardlimit = di->d_spc_hardlimit;
+        if (di->d_fieldmask & (QC_SPC_SOFT | QC_SPC_HARD)) {
                 check_blim = 1;
                 set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
         }
 
-        if (di->d_fieldmask & FS_DQ_ICOUNT) {
-                dm->dqb_curinodes = di->d_icount;
+        if (di->d_fieldmask & QC_INO_COUNT) {
+                dm->dqb_curinodes = di->d_ino_count;
                 check_ilim = 1;
                 set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
         }
 
-        if (di->d_fieldmask & FS_DQ_ISOFT)
+        if (di->d_fieldmask & QC_INO_SOFT)
                 dm->dqb_isoftlimit = di->d_ino_softlimit;
-        if (di->d_fieldmask & FS_DQ_IHARD)
+        if (di->d_fieldmask & QC_INO_HARD)
                 dm->dqb_ihardlimit = di->d_ino_hardlimit;
-        if (di->d_fieldmask & (FS_DQ_ISOFT | FS_DQ_IHARD)) {
+        if (di->d_fieldmask & (QC_INO_SOFT | QC_INO_HARD)) {
                 check_ilim = 1;
                 set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
         }
 
-        if (di->d_fieldmask & FS_DQ_BTIMER) {
-                dm->dqb_btime = di->d_btimer;
+        if (di->d_fieldmask & QC_SPC_TIMER) {
+                dm->dqb_btime = di->d_spc_timer;
                 check_blim = 1;
                 set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
         }
 
-        if (di->d_fieldmask & FS_DQ_ITIMER) {
-                dm->dqb_itime = di->d_itimer;
+        if (di->d_fieldmask & QC_INO_TIMER) {
+                dm->dqb_itime = di->d_ino_timer;
                 check_ilim = 1;
                 set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
         }
@@ -2506,7 +2501,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
                     dm->dqb_curspace < dm->dqb_bsoftlimit) {
                         dm->dqb_btime = 0;
                         clear_bit(DQ_BLKS_B, &dquot->dq_flags);
-                } else if (!(di->d_fieldmask & FS_DQ_BTIMER))
+                } else if (!(di->d_fieldmask & QC_SPC_TIMER))
                         /* Set grace only if user hasn't provided his own... */
                         dm->dqb_btime = get_seconds() + dqi->dqi_bgrace;
         }
@@ -2515,7 +2510,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
                     dm->dqb_curinodes < dm->dqb_isoftlimit) {
                         dm->dqb_itime = 0;
                         clear_bit(DQ_INODES_B, &dquot->dq_flags);
-                } else if (!(di->d_fieldmask & FS_DQ_ITIMER))
+                } else if (!(di->d_fieldmask & QC_INO_TIMER))
                         /* Set grace only if user hasn't provided his own... */
                         dm->dqb_itime = get_seconds() + dqi->dqi_igrace;
         }
@@ -2531,7 +2526,7 @@ static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
 }
 
 int dquot_set_dqblk(struct super_block *sb, struct kqid qid,
-                  struct fs_disk_quota *di)
+                  struct qc_dqblk *di)
 {
         struct dquot *dquot;
         int rc;
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index 2aa4151f99d2..6f3856328eea 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -118,17 +118,27 @@ static int quota_setinfo(struct super_block *sb, int type, void __user *addr)
         return sb->s_qcop->set_info(sb, type, &info);
 }
 
-static void copy_to_if_dqblk(struct if_dqblk *dst, struct fs_disk_quota *src)
+static inline qsize_t qbtos(qsize_t blocks)
+{
+        return blocks << QIF_DQBLKSIZE_BITS;
+}
+
+static inline qsize_t stoqb(qsize_t space)
+{
+        return (space + QIF_DQBLKSIZE - 1) >> QIF_DQBLKSIZE_BITS;
+}
+
+static void copy_to_if_dqblk(struct if_dqblk *dst, struct qc_dqblk *src)
 {
         memset(dst, 0, sizeof(*dst));
-        dst->dqb_bhardlimit = src->d_blk_hardlimit;
-        dst->dqb_bsoftlimit = src->d_blk_softlimit;
-        dst->dqb_curspace = src->d_bcount;
+        dst->dqb_bhardlimit = stoqb(src->d_spc_hardlimit);
+        dst->dqb_bsoftlimit = stoqb(src->d_spc_softlimit);
+        dst->dqb_curspace = src->d_space;
         dst->dqb_ihardlimit = src->d_ino_hardlimit;
         dst->dqb_isoftlimit = src->d_ino_softlimit;
-        dst->dqb_curinodes = src->d_icount;
-        dst->dqb_btime = src->d_btimer;
-        dst->dqb_itime = src->d_itimer;
+        dst->dqb_curinodes = src->d_ino_count;
+        dst->dqb_btime = src->d_spc_timer;
+        dst->dqb_itime = src->d_ino_timer;
         dst->dqb_valid = QIF_ALL;
 }
 
@@ -136,7 +146,7 @@ static int quota_getquota(struct super_block *sb, int type, qid_t id,
                           void __user *addr)
 {
         struct kqid qid;
-        struct fs_disk_quota fdq;
+        struct qc_dqblk fdq;
         struct if_dqblk idq;
         int ret;
 
@@ -154,36 +164,36 @@ static int quota_getquota(struct super_block *sb, int type, qid_t id,
         return 0;
 }
 
-static void copy_from_if_dqblk(struct fs_disk_quota *dst, struct if_dqblk *src)
+static void copy_from_if_dqblk(struct qc_dqblk *dst, struct if_dqblk *src)
 {
-        dst->d_blk_hardlimit = src->dqb_bhardlimit;
-        dst->d_blk_softlimit  = src->dqb_bsoftlimit;
-        dst->d_bcount = src->dqb_curspace;
+        dst->d_spc_hardlimit = qbtos(src->dqb_bhardlimit);
+        dst->d_spc_softlimit = qbtos(src->dqb_bsoftlimit);
+        dst->d_space = src->dqb_curspace;
         dst->d_ino_hardlimit = src->dqb_ihardlimit;
         dst->d_ino_softlimit = src->dqb_isoftlimit;
-        dst->d_icount = src->dqb_curinodes;
-        dst->d_btimer = src->dqb_btime;
-        dst->d_itimer = src->dqb_itime;
+        dst->d_ino_count = src->dqb_curinodes;
+        dst->d_spc_timer = src->dqb_btime;
+        dst->d_ino_timer = src->dqb_itime;
 
         dst->d_fieldmask = 0;
         if (src->dqb_valid & QIF_BLIMITS)
-                dst->d_fieldmask |= FS_DQ_BSOFT | FS_DQ_BHARD;
+                dst->d_fieldmask |= QC_SPC_SOFT | QC_SPC_HARD;
         if (src->dqb_valid & QIF_SPACE)
-                dst->d_fieldmask |= FS_DQ_BCOUNT;
+                dst->d_fieldmask |= QC_SPACE;
         if (src->dqb_valid & QIF_ILIMITS)
-                dst->d_fieldmask |= FS_DQ_ISOFT | FS_DQ_IHARD;
+                dst->d_fieldmask |= QC_INO_SOFT | QC_INO_HARD;
         if (src->dqb_valid & QIF_INODES)
-                dst->d_fieldmask |= FS_DQ_ICOUNT;
+                dst->d_fieldmask |= QC_INO_COUNT;
         if (src->dqb_valid & QIF_BTIME)
-                dst->d_fieldmask |= FS_DQ_BTIMER;
+                dst->d_fieldmask |= QC_SPC_TIMER;
         if (src->dqb_valid & QIF_ITIME)
-                dst->d_fieldmask |= FS_DQ_ITIMER;
+                dst->d_fieldmask |= QC_INO_TIMER;
 }
 
 static int quota_setquota(struct super_block *sb, int type, qid_t id,
                           void __user *addr)
 {
-        struct fs_disk_quota fdq;
+        struct qc_dqblk fdq;
         struct if_dqblk idq;
         struct kqid qid;
 
@@ -247,10 +257,78 @@ static int quota_getxstatev(struct super_block *sb, void __user *addr)
         return ret;
 }
 
+/*
+ * XFS defines BBTOB and BTOBB macros inside fs/xfs/ and we cannot move them
+ * out of there as xfsprogs rely on definitions being in that header file. So
+ * just define same functions here for quota purposes.
+ */
+#define XFS_BB_SHIFT 9
+
+static inline u64 quota_bbtob(u64 blocks)
+{
+        return blocks << XFS_BB_SHIFT;
+}
+
+static inline u64 quota_btobb(u64 bytes)
+{
+        return (bytes + (1 << XFS_BB_SHIFT) - 1) >> XFS_BB_SHIFT;
+}
+
+static void copy_from_xfs_dqblk(struct qc_dqblk *dst, struct fs_disk_quota *src)
+{
+        dst->d_spc_hardlimit = quota_bbtob(src->d_blk_hardlimit);
+        dst->d_spc_softlimit = quota_bbtob(src->d_blk_softlimit);
+        dst->d_ino_hardlimit = src->d_ino_hardlimit;
+        dst->d_ino_softlimit = src->d_ino_softlimit;
+        dst->d_space = quota_bbtob(src->d_bcount);
+        dst->d_ino_count = src->d_icount;
+        dst->d_ino_timer = src->d_itimer;
+        dst->d_spc_timer = src->d_btimer;
+        dst->d_ino_warns = src->d_iwarns;
+        dst->d_spc_warns = src->d_bwarns;
+        dst->d_rt_spc_hardlimit = quota_bbtob(src->d_rtb_hardlimit);
+        dst->d_rt_spc_softlimit = quota_bbtob(src->d_rtb_softlimit);
+        dst->d_rt_space = quota_bbtob(src->d_rtbcount);
+        dst->d_rt_spc_timer = src->d_rtbtimer;
+        dst->d_rt_spc_warns = src->d_rtbwarns;
+        dst->d_fieldmask = 0;
+        if (src->d_fieldmask & FS_DQ_ISOFT)
+                dst->d_fieldmask |= QC_INO_SOFT;
+        if (src->d_fieldmask & FS_DQ_IHARD)
+                dst->d_fieldmask |= QC_INO_HARD;
+        if (src->d_fieldmask & FS_DQ_BSOFT)
+                dst->d_fieldmask |= QC_SPC_SOFT;
+        if (src->d_fieldmask & FS_DQ_BHARD)
+                dst->d_fieldmask |= QC_SPC_HARD;
+        if (src->d_fieldmask & FS_DQ_RTBSOFT)
+                dst->d_fieldmask |= QC_RT_SPC_SOFT;
+        if (src->d_fieldmask & FS_DQ_RTBHARD)
+                dst->d_fieldmask |= QC_RT_SPC_HARD;
+        if (src->d_fieldmask & FS_DQ_BTIMER)
+                dst->d_fieldmask |= QC_SPC_TIMER;
+        if (src->d_fieldmask & FS_DQ_ITIMER)
+                dst->d_fieldmask |= QC_INO_TIMER;
+        if (src->d_fieldmask & FS_DQ_RTBTIMER)
+                dst->d_fieldmask |= QC_RT_SPC_TIMER;
+        if (src->d_fieldmask & FS_DQ_BWARNS)
+                dst->d_fieldmask |= QC_SPC_WARNS;
+        if (src->d_fieldmask & FS_DQ_IWARNS)
+                dst->d_fieldmask |= QC_INO_WARNS;
+        if (src->d_fieldmask & FS_DQ_RTBWARNS)
+                dst->d_fieldmask |= QC_RT_SPC_WARNS;
+        if (src->d_fieldmask & FS_DQ_BCOUNT)
+                dst->d_fieldmask |= QC_SPACE;
+        if (src->d_fieldmask & FS_DQ_ICOUNT)
+                dst->d_fieldmask |= QC_INO_COUNT;
+        if (src->d_fieldmask & FS_DQ_RTBCOUNT)
+                dst->d_fieldmask |= QC_RT_SPACE;
+}
+
 static int quota_setxquota(struct super_block *sb, int type, qid_t id,
                            void __user *addr)
 {
         struct fs_disk_quota fdq;
+        struct qc_dqblk qdq;
         struct kqid qid;
 
         if (copy_from_user(&fdq, addr, sizeof(fdq)))
@@ -260,13 +338,44 @@ static int quota_setxquota(struct super_block *sb, int type, qid_t id,
         qid = make_kqid(current_user_ns(), type, id);
         if (!qid_valid(qid))
                 return -EINVAL;
-        return sb->s_qcop->set_dqblk(sb, qid, &fdq);
+        copy_from_xfs_dqblk(&qdq, &fdq);
+        return sb->s_qcop->set_dqblk(sb, qid, &qdq);
+}
+
+static void copy_to_xfs_dqblk(struct fs_disk_quota *dst, struct qc_dqblk *src,
+                              int type, qid_t id)
+{
+        memset(dst, 0, sizeof(*dst));
+        dst->d_version = FS_DQUOT_VERSION;
+        dst->d_id = id;
+        if (type == USRQUOTA)
+                dst->d_flags = FS_USER_QUOTA;
+        else if (type == PRJQUOTA)
+                dst->d_flags = FS_PROJ_QUOTA;
+        else
+                dst->d_flags = FS_GROUP_QUOTA;
+        dst->d_blk_hardlimit = quota_btobb(src->d_spc_hardlimit);
+        dst->d_blk_softlimit = quota_btobb(src->d_spc_softlimit);
+        dst->d_ino_hardlimit = src->d_ino_hardlimit;
+        dst->d_ino_softlimit = src->d_ino_softlimit;
+        dst->d_bcount = quota_btobb(src->d_space);
+        dst->d_icount = src->d_ino_count;
+        dst->d_itimer = src->d_ino_timer;
+        dst->d_btimer = src->d_spc_timer;
+        dst->d_iwarns = src->d_ino_warns;
+        dst->d_bwarns = src->d_spc_warns;
+        dst->d_rtb_hardlimit = quota_btobb(src->d_rt_spc_hardlimit);
+        dst->d_rtb_softlimit = quota_btobb(src->d_rt_spc_softlimit);
+        dst->d_rtbcount = quota_btobb(src->d_rt_space);
+        dst->d_rtbtimer = src->d_rt_spc_timer;
+        dst->d_rtbwarns = src->d_rt_spc_warns;
 }
 
 static int quota_getxquota(struct super_block *sb, int type, qid_t id,
                            void __user *addr)
 {
         struct fs_disk_quota fdq;
+        struct qc_dqblk qdq;
         struct kqid qid;
         int ret;
 
@@ -275,8 +384,11 @@ static int quota_getxquota(struct super_block *sb, int type, qid_t id,
         qid = make_kqid(current_user_ns(), type, id);
         if (!qid_valid(qid))
                 return -EINVAL;
-        ret = sb->s_qcop->get_dqblk(sb, qid, &fdq);
-        if (!ret && copy_to_user(addr, &fdq, sizeof(fdq)))
+        ret = sb->s_qcop->get_dqblk(sb, qid, &qdq);
+        if (ret)
+                return ret;
+        copy_to_xfs_dqblk(&fdq, &qdq, type, id);
+        if (copy_to_user(addr, &fdq, sizeof(fdq)))
                 return -EFAULT;
         return ret;
 }
diff --git a/fs/udf/file.c b/fs/udf/file.c
index bb15771b92ae..08f3555fbeac 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -224,7 +224,7 @@ out:
 static int udf_release_file(struct inode *inode, struct file *filp)
 {
         if (filp->f_mode & FMODE_WRITE &&
-            atomic_read(&inode->i_writecount) > 1) {
+            atomic_read(&inode->i_writecount) == 1) {
                 /*
                  * Grab i_mutex to avoid races with writes changing i_size
                  * while we are running.
diff --git a/fs/xfs/xfs_qm.h b/fs/xfs/xfs_qm.h
index 3a07a937e232..41f6c0b9d51c 100644
--- a/fs/xfs/xfs_qm.h
+++ b/fs/xfs/xfs_qm.h
@@ -166,9 +166,9 @@ extern void		xfs_qm_dqrele_all_inodes(struct xfs_mount *, uint);
 /* quota ops */
 extern int              xfs_qm_scall_trunc_qfiles(struct xfs_mount *, uint);
 extern int              xfs_qm_scall_getquota(struct xfs_mount *, xfs_dqid_t,
-                                        uint, struct fs_disk_quota *);
+                                        uint, struct qc_dqblk *);
 extern int              xfs_qm_scall_setqlim(struct xfs_mount *, xfs_dqid_t, uint,
-                                        struct fs_disk_quota *);
+                                        struct qc_dqblk *);
 extern int              xfs_qm_scall_getqstat(struct xfs_mount *,
                                         struct fs_quota_stat *);
 extern int              xfs_qm_scall_getqstatv(struct xfs_mount *,
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index 74fca68e43b6..cb6168ec92c9 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -39,7 +39,6 @@ STATIC int	xfs_qm_log_quotaoff(xfs_mount_t *, xfs_qoff_logitem_t **, uint);
 STATIC int      xfs_qm_log_quotaoff_end(xfs_mount_t *, xfs_qoff_logitem_t *,
                                         uint);
 STATIC uint     xfs_qm_export_flags(uint);
-STATIC uint     xfs_qm_export_qtype_flags(uint);
 
 /*
  * Turn off quota accounting and/or enforcement for all udquots and/or
@@ -573,8 +572,8 @@ xfs_qm_scall_getqstatv(
         return 0;
 }
 
-#define XFS_DQ_MASK \
-        (FS_DQ_LIMIT_MASK | FS_DQ_TIMER_MASK | FS_DQ_WARNS_MASK)
+#define XFS_QC_MASK \
+        (QC_LIMIT_MASK | QC_TIMER_MASK | QC_WARNS_MASK)
 
 /*
  * Adjust quota limits, and start/stop timers accordingly.
@@ -584,7 +583,7 @@ xfs_qm_scall_setqlim(
         struct xfs_mount        *mp,
         xfs_dqid_t              id,
         uint                    type,
-        fs_disk_quota_t         *newlim)
+        struct qc_dqblk         *newlim)
 {
         struct xfs_quotainfo    *q = mp->m_quotainfo;
         struct xfs_disk_dquot   *ddq;
@@ -593,9 +592,9 @@ xfs_qm_scall_setqlim(
         int                     error;
         xfs_qcnt_t              hard, soft;
 
-        if (newlim->d_fieldmask & ~XFS_DQ_MASK)
+        if (newlim->d_fieldmask & ~XFS_QC_MASK)
                 return -EINVAL;
-        if ((newlim->d_fieldmask & XFS_DQ_MASK) == 0)
+        if ((newlim->d_fieldmask & XFS_QC_MASK) == 0)
                 return 0;
 
         /*
@@ -633,11 +632,11 @@ xfs_qm_scall_setqlim(
         /*
          * Make sure that hardlimits are >= soft limits before changing.
          */
-        hard = (newlim->d_fieldmask & FS_DQ_BHARD) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_hardlimit) :
+        hard = (newlim->d_fieldmask & QC_SPC_HARD) ?
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_hardlimit) :
                         be64_to_cpu(ddq->d_blk_hardlimit);
-        soft = (newlim->d_fieldmask & FS_DQ_BSOFT) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_softlimit) :
+        soft = (newlim->d_fieldmask & QC_SPC_SOFT) ?
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_softlimit) :
                         be64_to_cpu(ddq->d_blk_softlimit);
         if (hard == 0 || hard >= soft) {
                 ddq->d_blk_hardlimit = cpu_to_be64(hard);
@@ -650,11 +649,11 @@ xfs_qm_scall_setqlim(
         } else {
                 xfs_debug(mp, "blkhard %Ld < blksoft %Ld", hard, soft);
         }
-        hard = (newlim->d_fieldmask & FS_DQ_RTBHARD) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_hardlimit) :
+        hard = (newlim->d_fieldmask & QC_RT_SPC_HARD) ?
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_hardlimit) :
                         be64_to_cpu(ddq->d_rtb_hardlimit);
-        soft = (newlim->d_fieldmask & FS_DQ_RTBSOFT) ?
-                (xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_softlimit) :
+        soft = (newlim->d_fieldmask & QC_RT_SPC_SOFT) ?
+                (xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_softlimit) :
                         be64_to_cpu(ddq->d_rtb_softlimit);
         if (hard == 0 || hard >= soft) {
                 ddq->d_rtb_hardlimit = cpu_to_be64(hard);
@@ -667,10 +666,10 @@ xfs_qm_scall_setqlim(
                 xfs_debug(mp, "rtbhard %Ld < rtbsoft %Ld", hard, soft);
         }
 
-        hard = (newlim->d_fieldmask & FS_DQ_IHARD) ?
+        hard = (newlim->d_fieldmask & QC_INO_HARD) ?
                 (xfs_qcnt_t) newlim->d_ino_hardlimit :
                         be64_to_cpu(ddq->d_ino_hardlimit);
-        soft = (newlim->d_fieldmask & FS_DQ_ISOFT) ?
+        soft = (newlim->d_fieldmask & QC_INO_SOFT) ?
                 (xfs_qcnt_t) newlim->d_ino_softlimit :
                         be64_to_cpu(ddq->d_ino_softlimit);
         if (hard == 0 || hard >= soft) {
@@ -687,12 +686,12 @@ xfs_qm_scall_setqlim(
         /*
          * Update warnings counter(s) if requested
          */
-        if (newlim->d_fieldmask & FS_DQ_BWARNS)
-                ddq->d_bwarns = cpu_to_be16(newlim->d_bwarns);
-        if (newlim->d_fieldmask & FS_DQ_IWARNS)
-                ddq->d_iwarns = cpu_to_be16(newlim->d_iwarns);
-        if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
-                ddq->d_rtbwarns = cpu_to_be16(newlim->d_rtbwarns);
+        if (newlim->d_fieldmask & QC_SPC_WARNS)
+                ddq->d_bwarns = cpu_to_be16(newlim->d_spc_warns);
+        if (newlim->d_fieldmask & QC_INO_WARNS)
+                ddq->d_iwarns = cpu_to_be16(newlim->d_ino_warns);
+        if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
+                ddq->d_rtbwarns = cpu_to_be16(newlim->d_rt_spc_warns);
 
         if (id == 0) {
                 /*
@@ -702,24 +701,24 @@ xfs_qm_scall_setqlim(
                  * soft and hard limit values (already done, above), and
                  * for warnings.
                  */
-                if (newlim->d_fieldmask & FS_DQ_BTIMER) {
-                        q->qi_btimelimit = newlim->d_btimer;
-                        ddq->d_btimer = cpu_to_be32(newlim->d_btimer);
+                if (newlim->d_fieldmask & QC_SPC_TIMER) {
+                        q->qi_btimelimit = newlim->d_spc_timer;
+                        ddq->d_btimer = cpu_to_be32(newlim->d_spc_timer);
                 }
-                if (newlim->d_fieldmask & FS_DQ_ITIMER) {
-                        q->qi_itimelimit = newlim->d_itimer;
-                        ddq->d_itimer = cpu_to_be32(newlim->d_itimer);
+                if (newlim->d_fieldmask & QC_INO_TIMER) {
+                        q->qi_itimelimit = newlim->d_ino_timer;
+                        ddq->d_itimer = cpu_to_be32(newlim->d_ino_timer);
                 }
-                if (newlim->d_fieldmask & FS_DQ_RTBTIMER) {
-                        q->qi_rtbtimelimit = newlim->d_rtbtimer;
-                        ddq->d_rtbtimer = cpu_to_be32(newlim->d_rtbtimer);
+                if (newlim->d_fieldmask & QC_RT_SPC_TIMER) {
+                        q->qi_rtbtimelimit = newlim->d_rt_spc_timer;
+                        ddq->d_rtbtimer = cpu_to_be32(newlim->d_rt_spc_timer);
                 }
-                if (newlim->d_fieldmask & FS_DQ_BWARNS)
-                        q->qi_bwarnlimit = newlim->d_bwarns;
-                if (newlim->d_fieldmask & FS_DQ_IWARNS)
-                        q->qi_iwarnlimit = newlim->d_iwarns;
-                if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
-                        q->qi_rtbwarnlimit = newlim->d_rtbwarns;
+                if (newlim->d_fieldmask & QC_SPC_WARNS)
+                        q->qi_bwarnlimit = newlim->d_spc_warns;
+                if (newlim->d_fieldmask & QC_INO_WARNS)
+                        q->qi_iwarnlimit = newlim->d_ino_warns;
+                if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
+                        q->qi_rtbwarnlimit = newlim->d_rt_spc_warns;
         } else {
                 /*
                  * If the user is now over quota, start the timelimit.
@@ -824,7 +823,7 @@ xfs_qm_scall_getquota(
         struct xfs_mount        *mp,
         xfs_dqid_t              id,
         uint                    type,
-        struct fs_disk_quota    *dst)
+        struct qc_dqblk         *dst)
 {
         struct xfs_dquot        *dqp;
         int                     error;
@@ -848,28 +847,25 @@ xfs_qm_scall_getquota(
         }
 
         memset(dst, 0, sizeof(*dst));
-        dst->d_version = FS_DQUOT_VERSION;
-        dst->d_flags = xfs_qm_export_qtype_flags(dqp->q_core.d_flags);
-        dst->d_id = be32_to_cpu(dqp->q_core.d_id);
-        dst->d_blk_hardlimit =
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
-        dst->d_blk_softlimit =
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
+        dst->d_spc_hardlimit =
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
+        dst->d_spc_softlimit =
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
         dst->d_ino_hardlimit = be64_to_cpu(dqp->q_core.d_ino_hardlimit);
         dst->d_ino_softlimit = be64_to_cpu(dqp->q_core.d_ino_softlimit);
-        dst->d_bcount = XFS_FSB_TO_BB(mp, dqp->q_res_bcount);
-        dst->d_icount = dqp->q_res_icount;
-        dst->d_btimer = be32_to_cpu(dqp->q_core.d_btimer);
-        dst->d_itimer = be32_to_cpu(dqp->q_core.d_itimer);
-        dst->d_iwarns = be16_to_cpu(dqp->q_core.d_iwarns);
-        dst->d_bwarns = be16_to_cpu(dqp->q_core.d_bwarns);
-        dst->d_rtb_hardlimit =
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
-        dst->d_rtb_softlimit =
-                XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
-        dst->d_rtbcount = XFS_FSB_TO_BB(mp, dqp->q_res_rtbcount);
-        dst->d_rtbtimer = be32_to_cpu(dqp->q_core.d_rtbtimer);
-        dst->d_rtbwarns = be16_to_cpu(dqp->q_core.d_rtbwarns);
+        dst->d_space = XFS_FSB_TO_B(mp, dqp->q_res_bcount);
+        dst->d_ino_count = dqp->q_res_icount;
+        dst->d_spc_timer = be32_to_cpu(dqp->q_core.d_btimer);
+        dst->d_ino_timer = be32_to_cpu(dqp->q_core.d_itimer);
+        dst->d_ino_warns = be16_to_cpu(dqp->q_core.d_iwarns);
+        dst->d_spc_warns = be16_to_cpu(dqp->q_core.d_bwarns);
+        dst->d_rt_spc_hardlimit =
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
+        dst->d_rt_spc_softlimit =
+                XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
+        dst->d_rt_space = XFS_FSB_TO_B(mp, dqp->q_res_rtbcount);
+        dst->d_rt_spc_timer = be32_to_cpu(dqp->q_core.d_rtbtimer);
+        dst->d_rt_spc_warns = be16_to_cpu(dqp->q_core.d_rtbwarns);
 
         /*
          * Internally, we don't reset all the timers when quota enforcement
@@ -882,23 +878,23 @@ xfs_qm_scall_getquota(
              dqp->q_core.d_flags == XFS_DQ_GROUP) ||
             (!XFS_IS_PQUOTA_ENFORCED(mp) &&
              dqp->q_core.d_flags == XFS_DQ_PROJ)) {
-                dst->d_btimer = 0;
-                dst->d_itimer = 0;
-                dst->d_rtbtimer = 0;
+                dst->d_spc_timer = 0;
+                dst->d_ino_timer = 0;
+                dst->d_rt_spc_timer = 0;
         }
 
 #ifdef DEBUG
-        if (((XFS_IS_UQUOTA_ENFORCED(mp) && dst->d_flags == FS_USER_QUOTA) ||
-             (XFS_IS_GQUOTA_ENFORCED(mp) && dst->d_flags == FS_GROUP_QUOTA) ||
-             (XFS_IS_PQUOTA_ENFORCED(mp) && dst->d_flags == FS_PROJ_QUOTA)) &&
-            dst->d_id != 0) {
-                if ((dst->d_bcount > dst->d_blk_softlimit) &&
-                    (dst->d_blk_softlimit > 0)) {
-                        ASSERT(dst->d_btimer != 0);
+        if (((XFS_IS_UQUOTA_ENFORCED(mp) && type == XFS_DQ_USER) ||
+             (XFS_IS_GQUOTA_ENFORCED(mp) && type == XFS_DQ_GROUP) ||
+             (XFS_IS_PQUOTA_ENFORCED(mp) && type == XFS_DQ_PROJ)) &&
+            id != 0) {
+                if ((dst->d_space > dst->d_spc_softlimit) &&
+                    (dst->d_spc_softlimit > 0)) {
+                        ASSERT(dst->d_spc_timer != 0);
                 }
-                if ((dst->d_icount > dst->d_ino_softlimit) &&
+                if ((dst->d_ino_count > dst->d_ino_softlimit) &&
                     (dst->d_ino_softlimit > 0)) {
-                        ASSERT(dst->d_itimer != 0);
+                        ASSERT(dst->d_ino_timer != 0);
                 }
         }
 #endif
@@ -908,26 +904,6 @@ out_put:
 }
 
 STATIC uint
-xfs_qm_export_qtype_flags(
-        uint flags)
-{
-        /*
-         * Can't be more than one, or none.
-         */
-        ASSERT((flags & (FS_PROJ_QUOTA | FS_USER_QUOTA)) !=
-                (FS_PROJ_QUOTA | FS_USER_QUOTA));
-        ASSERT((flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)) !=
-                (FS_PROJ_QUOTA | FS_GROUP_QUOTA));
-        ASSERT((flags & (FS_USER_QUOTA | FS_GROUP_QUOTA)) !=
-                (FS_USER_QUOTA | FS_GROUP_QUOTA));
-        ASSERT((flags & (FS_PROJ_QUOTA|FS_USER_QUOTA|FS_GROUP_QUOTA)) != 0);
-
-        return (flags & XFS_DQ_USER) ?
-                FS_USER_QUOTA : (flags & XFS_DQ_PROJ) ?
-                        FS_PROJ_QUOTA : FS_GROUP_QUOTA;
-}
-
-STATIC uint
 xfs_qm_export_flags(
         uint flags)
 {
diff --git a/fs/xfs/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
index 7542bbeca6a1..801a84c1cdc3 100644
--- a/fs/xfs/xfs_quotaops.c
+++ b/fs/xfs/xfs_quotaops.c
@@ -131,7 +131,7 @@ STATIC int
 xfs_fs_get_dqblk(
         struct super_block      *sb,
         struct kqid             qid,
-        struct fs_disk_quota    *fdq)
+        struct qc_dqblk         *qdq)
 {
         struct xfs_mount        *mp = XFS_M(sb);
 
@@ -141,14 +141,14 @@ xfs_fs_get_dqblk(
                 return -ESRCH;
 
         return xfs_qm_scall_getquota(mp, from_kqid(&init_user_ns, qid),
-                                      xfs_quota_type(qid.type), fdq);
+                                      xfs_quota_type(qid.type), qdq);
 }
 
 STATIC int
 xfs_fs_set_dqblk(
         struct super_block      *sb,
         struct kqid             qid,
-        struct fs_disk_quota    *fdq)
+        struct qc_dqblk         *qdq)
 {
         struct xfs_mount        *mp = XFS_M(sb);
 
@@ -160,7 +160,7 @@ xfs_fs_set_dqblk(
                 return -ESRCH;
 
         return xfs_qm_scall_setqlim(mp, from_kqid(&init_user_ns, qid),
-                                     xfs_quota_type(qid.type), fdq);
+                                     xfs_quota_type(qid.type), qdq);
 }
 
 const struct quotactl_ops xfs_quotactl_operations = {
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index e3a1721c8354..7c7695940ddd 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -228,7 +228,9 @@ struct i2c_client {
         struct device dev;              /* the device structure         */
         int irq;                        /* irq issued by device         */
         struct list_head detected;
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
         i2c_slave_cb_t slave_cb;        /* callback for slave mode      */
+#endif
 };
 #define to_i2c_client(d) container_of(d, struct i2c_client, dev)
 
@@ -253,6 +255,7 @@ static inline void i2c_set_clientdata(struct i2c_client *dev, void *data)
 
 /* I2C slave support */
 
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
 enum i2c_slave_event {
         I2C_SLAVE_REQ_READ_START,
         I2C_SLAVE_REQ_READ_END,
@@ -269,6 +272,7 @@ static inline int i2c_slave_event(struct i2c_client *client,
 {
         return client->slave_cb(client, event, val);
 }
+#endif
 
 /**
  * struct i2c_board_info - template for device creation
@@ -404,8 +408,10 @@ struct i2c_algorithm {
         /* To determine what the adapter supports */
         u32 (*functionality) (struct i2c_adapter *);
 
+#if IS_ENABLED(CONFIG_I2C_SLAVE)
         int (*reg_slave)(struct i2c_client *client);
         int (*unreg_slave)(struct i2c_client *client);
+#endif
 };
 
 /**
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 5449d2f4a1ef..64ce58bee6f5 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -176,7 +176,7 @@ extern int _cond_resched(void);
  */
 # define might_sleep() \
         do { __might_sleep(__FILE__, __LINE__, 0); might_resched(); } while (0)
-# define sched_annotate_sleep() __set_current_state(TASK_RUNNING)
+# define sched_annotate_sleep() (current->task_state_change = 0)
 #else
   static inline void ___might_sleep(const char *file, int line,
                                    int preempt_offset) { }
diff --git a/include/linux/mfd/samsung/s2mps13.h b/include/linux/mfd/samsung/s2mps13.h
index ce5dda8958fe..b1fd675fa36f 100644
--- a/include/linux/mfd/samsung/s2mps13.h
+++ b/include/linux/mfd/samsung/s2mps13.h
@@ -59,6 +59,7 @@ enum s2mps13_reg {
         S2MPS13_REG_B6CTRL,
         S2MPS13_REG_B6OUT,
         S2MPS13_REG_B7CTRL,
+        S2MPS13_REG_B7SW,
         S2MPS13_REG_B7OUT,
         S2MPS13_REG_B8CTRL,
         S2MPS13_REG_B8OUT,
@@ -102,6 +103,7 @@ enum s2mps13_reg {
         S2MPS13_REG_L26CTRL,
         S2MPS13_REG_L27CTRL,
         S2MPS13_REG_L28CTRL,
+        S2MPS13_REG_L29CTRL,
         S2MPS13_REG_L30CTRL,
         S2MPS13_REG_L31CTRL,
         S2MPS13_REG_L32CTRL,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 80fc92a49649..dd5ea3016fc4 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1070,6 +1070,7 @@ static inline int page_mapped(struct page *page)
 #define VM_FAULT_WRITE  0x0008  /* Special case for get_user_pages */
 #define VM_FAULT_HWPOISON 0x0010        /* Hit poisoned small page */
 #define VM_FAULT_HWPOISON_LARGE 0x0020  /* Hit poisoned large page. Index encoded in upper bits */
+#define VM_FAULT_SIGSEGV 0x0040
 
 #define VM_FAULT_NOPAGE 0x0100  /* ->fault installed the pte, not return page */
 #define VM_FAULT_LOCKED 0x0200  /* ->fault locked the returned page */
@@ -1078,8 +1079,9 @@ static inline int page_mapped(struct page *page)
 
 #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */
 
-#define VM_FAULT_ERROR  (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \
-                         VM_FAULT_FALLBACK | VM_FAULT_HWPOISON_LARGE)
+#define VM_FAULT_ERROR  (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
+                         VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE | \
+                         VM_FAULT_FALLBACK)
 
 /* Encode hstate index for a hwpoisoned large page */
 #define VM_FAULT_SET_HINDEX(x) ((x) << 12)
diff --git a/include/linux/oom.h b/include/linux/oom.h
index 853698c721f7..76200984d1e2 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -85,11 +85,6 @@ static inline void oom_killer_enable(void)
         oom_killer_disabled = false;
 }
 
-static inline bool oom_gfp_allowed(gfp_t gfp_mask)
-{
-        return (gfp_mask & __GFP_FS) && !(gfp_mask & __GFP_NORETRY);
-}
-
 extern struct task_struct *find_lock_task_mm(struct task_struct *p);
 
 static inline bool task_will_free_mem(struct task_struct *task)
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 4f7a61ca4b39..664de5a4ec46 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -450,11 +450,6 @@ struct perf_event {
 #endif /* CONFIG_PERF_EVENTS */
 };
 
-enum perf_event_context_type {
-        task_context,
-        cpu_context,
-};
-
 /**
  * struct perf_event_context - event context structure
  *
@@ -462,7 +457,6 @@ enum perf_event_context_type {
  */
 struct perf_event_context {
         struct pmu                      *pmu;
-        enum perf_event_context_type    type;
         /*
          * Protect the states of the events in the list,
          * nr_active, and the list:
diff --git a/include/linux/printk.h b/include/linux/printk.h
index c8f170324e64..4d5bf5726578 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -10,9 +10,6 @@
 extern const char linux_banner[];
 extern const char linux_proc_banner[];
 
-extern char *log_buf_addr_get(void);
-extern u32 log_buf_len_get(void);
-
 static inline int printk_get_level(const char *buffer)
 {
         if (buffer[0] == KERN_SOH_ASCII && buffer[1]) {
@@ -163,6 +160,8 @@ extern int kptr_restrict;
 
 extern void wake_up_klogd(void);
 
+char *log_buf_addr_get(void);
+u32 log_buf_len_get(void);
 void log_buf_kexec_setup(void);
 void __init setup_log_buf(int early);
 void dump_stack_set_arch_desc(const char *fmt, ...);
@@ -198,6 +197,16 @@ static inline void wake_up_klogd(void)
 {
 }
 
+static inline char *log_buf_addr_get(void)
+{
+        return NULL;
+}
+
+static inline u32 log_buf_len_get(void)
+{
+        return 0;
+}
+
 static inline void log_buf_kexec_setup(void)
 {
 }
diff --git a/include/linux/quota.h b/include/linux/quota.h
index 50978b781a19..097d7eb2441e 100644
--- a/include/linux/quota.h
+++ b/include/linux/quota.h
@@ -321,6 +321,49 @@ struct dquot_operations {
 
 struct path;
 
+/* Structure for communicating via ->get_dqblk() & ->set_dqblk() */
+struct qc_dqblk {
+        int d_fieldmask;        /* mask of fields to change in ->set_dqblk() */
+        u64 d_spc_hardlimit;    /* absolute limit on used space */
+        u64 d_spc_softlimit;    /* preferred limit on used space */
+        u64 d_ino_hardlimit;    /* maximum # allocated inodes */
+        u64 d_ino_softlimit;    /* preferred inode limit */
+        u64 d_space;            /* Space owned by the user */
+        u64 d_ino_count;        /* # inodes owned by the user */
+        s64 d_ino_timer;        /* zero if within inode limits */
+                                /* if not, we refuse service */
+        s64 d_spc_timer;        /* similar to above; for space */
+        int d_ino_warns;        /* # warnings issued wrt num inodes */
+        int d_spc_warns;        /* # warnings issued wrt used space */
+        u64 d_rt_spc_hardlimit; /* absolute limit on realtime space */
+        u64 d_rt_spc_softlimit; /* preferred limit on RT space */
+        u64 d_rt_space;         /* realtime space owned */
+        s64 d_rt_spc_timer;     /* similar to above; for RT space */
+        int d_rt_spc_warns;     /* # warnings issued wrt RT space */
+};
+
+/* Field specifiers for ->set_dqblk() in struct qc_dqblk */
+#define QC_INO_SOFT     (1<<0)
+#define QC_INO_HARD     (1<<1)
+#define QC_SPC_SOFT     (1<<2)
+#define QC_SPC_HARD     (1<<3)
+#define QC_RT_SPC_SOFT  (1<<4)
+#define QC_RT_SPC_HARD  (1<<5)
+#define QC_LIMIT_MASK (QC_INO_SOFT | QC_INO_HARD | QC_SPC_SOFT | QC_SPC_HARD | \
+                       QC_RT_SPC_SOFT | QC_RT_SPC_HARD)
+#define QC_SPC_TIMER    (1<<6)
+#define QC_INO_TIMER    (1<<7)
+#define QC_RT_SPC_TIMER (1<<8)
+#define QC_TIMER_MASK (QC_SPC_TIMER | QC_INO_TIMER | QC_RT_SPC_TIMER)
+#define QC_SPC_WARNS    (1<<9)
+#define QC_INO_WARNS    (1<<10)
+#define QC_RT_SPC_WARNS (1<<11)
+#define QC_WARNS_MASK (QC_SPC_WARNS | QC_INO_WARNS | QC_RT_SPC_WARNS)
+#define QC_SPACE        (1<<12)
+#define QC_INO_COUNT    (1<<13)
+#define QC_RT_SPACE     (1<<14)
+#define QC_ACCT_MASK (QC_SPACE | QC_INO_COUNT | QC_RT_SPACE)
+
 /* Operations handling requests from userspace */
 struct quotactl_ops {
         int (*quota_on)(struct super_block *, int, int, struct path *);
@@ -329,8 +372,8 @@ struct quotactl_ops {
         int (*quota_sync)(struct super_block *, int);
         int (*get_info)(struct super_block *, int, struct if_dqinfo *);
         int (*set_info)(struct super_block *, int, struct if_dqinfo *);
-        int (*get_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
-        int (*set_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
+        int (*get_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
+        int (*set_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
         int (*get_xstate)(struct super_block *, struct fs_quota_stat *);
         int (*set_xstate)(struct super_block *, unsigned int, int);
         int (*get_xstatev)(struct super_block *, struct fs_quota_statv *);
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index f23538a6e411..29e3455f7d41 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -98,9 +98,9 @@ int dquot_quota_sync(struct super_block *sb, int type);
 int dquot_get_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
 int dquot_set_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
 int dquot_get_dqblk(struct super_block *sb, struct kqid id,
-                struct fs_disk_quota *di);
+                struct qc_dqblk *di);
 int dquot_set_dqblk(struct super_block *sb, struct kqid id,
-                struct fs_disk_quota *di);
+                struct qc_dqblk *di);
 
 int __dquot_transfer(struct inode *inode, struct dquot **transfer_to);
 int dquot_transfer(struct inode *inode, struct iattr *iattr);
diff --git a/include/net/ip.h b/include/net/ip.h
index 0bb620702929..f7cbd703d15d 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -39,11 +39,12 @@ struct inet_skb_parm {
         struct ip_options       opt;            /* Compiled IP options          */
         unsigned char           flags;
 
-#define IPSKB_FORWARDED         1
-#define IPSKB_XFRM_TUNNEL_SIZE  2
-#define IPSKB_XFRM_TRANSFORMED  4
-#define IPSKB_FRAG_COMPLETE     8
-#define IPSKB_REROUTED          16
+#define IPSKB_FORWARDED         BIT(0)
+#define IPSKB_XFRM_TUNNEL_SIZE  BIT(1)
+#define IPSKB_XFRM_TRANSFORMED  BIT(2)
+#define IPSKB_FRAG_COMPLETE     BIT(3)
+#define IPSKB_REROUTED          BIT(4)
+#define IPSKB_DOREDIRECT        BIT(5)
 
         u16                     frag_max_size;
 };
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 088ac0b1b106..536edc2be307 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -150,7 +150,7 @@ static int map_lookup_elem(union bpf_attr *attr)
         int ufd = attr->map_fd;
         struct fd f = fdget(ufd);
         struct bpf_map *map;
-        void *key, *value;
+        void *key, *value, *ptr;
         int err;
 
         if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
@@ -169,20 +169,29 @@ static int map_lookup_elem(union bpf_attr *attr)
         if (copy_from_user(key, ukey, map->key_size) != 0)
                 goto free_key;
 
-        err = -ENOENT;
-        rcu_read_lock();
-        value = map->ops->map_lookup_elem(map, key);
+        err = -ENOMEM;
+        value = kmalloc(map->value_size, GFP_USER);
         if (!value)
-                goto err_unlock;
+                goto free_key;
+
+        rcu_read_lock();
+        ptr = map->ops->map_lookup_elem(map, key);
+        if (ptr)
+                memcpy(value, ptr, map->value_size);
+        rcu_read_unlock();
+
+        err = -ENOENT;
+        if (!ptr)
+                goto free_value;
 
         err = -EFAULT;
         if (copy_to_user(uvalue, value, map->value_size) != 0)
-                goto err_unlock;
+                goto free_value;
 
         err = 0;
 
-err_unlock:
-        rcu_read_unlock();
+free_value:
+        kfree(value);
 free_key:
         kfree(key);
 err_put:
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index bb263d0caab3..04cfe8ace520 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1909,7 +1909,7 @@ static void cgroup_kill_sb(struct super_block *sb)
          *
          * And don't kill the default root.
          */
-        if (css_has_online_children(&root->cgrp.self) ||
+        if (!list_empty(&root->cgrp.self.children) ||
             root == &cgrp_dfl_root)
                 cgroup_put(&root->cgrp);
         else
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 882f835a0d85..19efcf13375a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6776,7 +6776,6 @@ skip_type:
                 __perf_event_init_context(&cpuctx->ctx);
                 lockdep_set_class(&cpuctx->ctx.mutex, &cpuctx_mutex);
                 lockdep_set_class(&cpuctx->ctx.lock, &cpuctx_lock);
-                cpuctx->ctx.type = cpu_context;
                 cpuctx->ctx.pmu = pmu;
 
                 __perf_cpu_hrtimer_init(cpuctx, cpu);
@@ -7420,7 +7419,19 @@ SYSCALL_DEFINE5(perf_event_open,
                  * task or CPU context:
                  */
                 if (move_group) {
-                        if (group_leader->ctx->type != ctx->type)
+                        /*
+                         * Make sure we're both on the same task, or both
+                         * per-cpu events.
+                         */
+                        if (group_leader->ctx->task != ctx->task)
+                                goto err_context;
+
+                        /*
+                         * Make sure we're both events for the same CPU;
+                         * grouping events for different CPUs is broken; since
+                         * you can never concurrently schedule them anyhow.
+                         */
+                        if (group_leader->cpu != event->cpu)
                                 goto err_context;
                 } else {
                         if (group_leader->ctx != ctx)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index c0accc00566e..e628cb11b560 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -7292,13 +7292,12 @@ void __might_sleep(const char *file, int line, int preempt_offset)
          * since we will exit with TASK_RUNNING make sure we enter with it,
          * otherwise we will destroy state.
          */
-        if (WARN_ONCE(current->state != TASK_RUNNING,
+        WARN_ONCE(current->state != TASK_RUNNING && current->task_state_change,
                         "do not call blocking ops when !TASK_RUNNING; "
                         "state=%lx set at [<%p>] %pS\n",
                         current->state,
                         (void *)current->task_state_change,
-                        (void *)current->task_state_change))
-                __set_current_state(TASK_RUNNING);
+                        (void *)current->task_state_change);
 
         ___might_sleep(file, line, preempt_offset);
 }
diff --git a/mm/gup.c b/mm/gup.c
index a900759cc807..8dd50ce6326f 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -296,7 +296,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
                         return -ENOMEM;
                 if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
                         return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT;
-                if (ret & VM_FAULT_SIGBUS)
+                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
                         return -EFAULT;
                 BUG();
         }
@@ -571,7 +571,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
                         return -ENOMEM;
                 if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
                         return -EHWPOISON;
-                if (ret & VM_FAULT_SIGBUS)
+                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
                         return -EFAULT;
                 BUG();
         }
diff --git a/mm/ksm.c b/mm/ksm.c
index d247efab5073..15647fb0394f 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -376,7 +376,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
                 else
                         ret = VM_FAULT_WRITE;
                 put_page(page);
-        } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
+        } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM)));
         /*
          * We must loop because handle_mm_fault() may back out if there's
          * any difficulty e.g. if pte accessed bit gets updated concurrently.
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 851924fa5170..683b4782019b 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1477,9 +1477,9 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
 
         pr_info("Task in ");
         pr_cont_cgroup_path(task_cgroup(p, memory_cgrp_id));
-        pr_info(" killed as a result of limit of ");
+        pr_cont(" killed as a result of limit of ");
         pr_cont_cgroup_path(memcg->css.cgroup);
-        pr_info("\n");
+        pr_cont("\n");
 
         rcu_read_unlock();
 
diff --git a/mm/memory.c b/mm/memory.c
index 54f3a9b00956..2c3536cc6c63 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2632,7 +2632,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
 
         /* Check if we need to add a guard page to the stack */
         if (check_stack_guard_page(vma, address) < 0)
-                return VM_FAULT_SIGBUS;
+                return VM_FAULT_SIGSEGV;
 
         /* Use the zero-page for reads */
         if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm)) {
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 7633c503a116..8e20f9c2fa5a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2332,12 +2332,21 @@ static inline struct page *
 __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
         struct zonelist *zonelist, enum zone_type high_zoneidx,
         nodemask_t *nodemask, struct zone *preferred_zone,
-        int classzone_idx, int migratetype)
+        int classzone_idx, int migratetype, unsigned long *did_some_progress)
 {
         struct page *page;
 
-        /* Acquire the per-zone oom lock for each zone */
+        *did_some_progress = 0;
+
+        if (oom_killer_disabled)
+                return NULL;
+
+        /*
+         * Acquire the per-zone oom lock for each zone.  If that
+         * fails, somebody else is making progress for us.
+         */
         if (!oom_zonelist_trylock(zonelist, gfp_mask)) {
+                *did_some_progress = 1;
                 schedule_timeout_uninterruptible(1);
                 return NULL;
         }
@@ -2363,12 +2372,18 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                 goto out;
 
         if (!(gfp_mask & __GFP_NOFAIL)) {
+                /* Coredumps can quickly deplete all memory reserves */
+                if (current->flags & PF_DUMPCORE)
+                        goto out;
                 /* The OOM killer will not help higher order allocs */
                 if (order > PAGE_ALLOC_COSTLY_ORDER)
                         goto out;
                 /* The OOM killer does not needlessly kill tasks for lowmem */
                 if (high_zoneidx < ZONE_NORMAL)
                         goto out;
+                /* The OOM killer does not compensate for light reclaim */
+                if (!(gfp_mask & __GFP_FS))
+                        goto out;
                 /*
                  * GFP_THISNODE contains __GFP_NORETRY and we never hit this.
                  * Sanity check for bare calls of __GFP_THISNODE, not real OOM.
@@ -2381,7 +2396,7 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
         }
         /* Exhausted what can be done so it's blamo time */
         out_of_memory(zonelist, gfp_mask, order, nodemask, false);
-
+        *did_some_progress = 1;
 out:
         oom_zonelist_unlock(zonelist, gfp_mask);
         return page;
@@ -2658,7 +2673,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
             (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
                 goto nopage;
 
-restart:
+retry:
         if (!(gfp_mask & __GFP_NO_KSWAPD))
                 wake_all_kswapds(order, zonelist, high_zoneidx,
                                 preferred_zone, nodemask);
@@ -2681,7 +2696,6 @@ restart:
                 classzone_idx = zonelist_zone_idx(preferred_zoneref);
         }
 
-rebalance:
         /* This is the last chance, in general, before the goto nopage. */
         page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
                         high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
@@ -2788,54 +2802,28 @@ rebalance:
         if (page)
                 goto got_pg;
 
-        /*
-         * If we failed to make any progress reclaiming, then we are
-         * running out of options and have to consider going OOM
-         */
-        if (!did_some_progress) {
-                if (oom_gfp_allowed(gfp_mask)) {
-                        if (oom_killer_disabled)
-                                goto nopage;
-                        /* Coredumps can quickly deplete all memory reserves */
-                        if ((current->flags & PF_DUMPCORE) &&
-                            !(gfp_mask & __GFP_NOFAIL))
-                                goto nopage;
-                        page = __alloc_pages_may_oom(gfp_mask, order,
-                                        zonelist, high_zoneidx,
-                                        nodemask, preferred_zone,
-                                        classzone_idx, migratetype);
-                        if (page)
-                                goto got_pg;
-
-                        if (!(gfp_mask & __GFP_NOFAIL)) {
-                                /*
-                                 * The oom killer is not called for high-order
-                                 * allocations that may fail, so if no progress
-                                 * is being made, there are no other options and
-                                 * retrying is unlikely to help.
-                                 */
-                                if (order > PAGE_ALLOC_COSTLY_ORDER)
-                                        goto nopage;
-                                /*
-                                 * The oom killer is not called for lowmem
-                                 * allocations to prevent needlessly killing
-                                 * innocent tasks.
-                                 */
-                                if (high_zoneidx < ZONE_NORMAL)
-                                        goto nopage;
-                        }
-
-                        goto restart;
-                }
-        }
-
         /* Check if we should retry the allocation */
         pages_reclaimed += did_some_progress;
         if (should_alloc_retry(gfp_mask, order, did_some_progress,
                                                 pages_reclaimed)) {
+                /*
+                 * If we fail to make progress by freeing individual
+                 * pages, but the allocation wants us to keep going,
+                 * start OOM killing tasks.
+                 */
+                if (!did_some_progress) {
+                        page = __alloc_pages_may_oom(gfp_mask, order, zonelist,
+                                                high_zoneidx, nodemask,
+                                                preferred_zone, classzone_idx,
+                                                migratetype,&did_some_progress);
+                        if (page)
+                                goto got_pg;
+                        if (!did_some_progress)
+                                goto nopage;
+                }
                 /* Wait for some write requests to complete then retry */
                 wait_iff_congested(preferred_zone, BLK_RW_ASYNC, HZ/50);
-                goto rebalance;
+                goto retry;
         } else {
                 /*
                  * High-order allocations do not necessarily loop after
diff --git a/mm/vmscan.c b/mm/vmscan.c
index ab2505c3ef54..dcd90c891d8e 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2656,7 +2656,7 @@ static bool throttle_direct_reclaim(gfp_t gfp_mask, struct zonelist *zonelist,
          * should make reasonable progress.
          */
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
-                                        gfp_mask, nodemask) {
+                                        gfp_zone(gfp_mask), nodemask) {
                 if (zone_idx(zone) > ZONE_NORMAL)
                         continue;
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 515569ffde8a..589aafd01fc5 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -46,6 +46,7 @@ void dsa_slave_mii_bus_init(struct dsa_switch *ds)
         snprintf(ds->slave_mii_bus->id, MII_BUS_ID_SIZE, "dsa-%d:%.2x",
                         ds->index, ds->pd->sw_addr);
         ds->slave_mii_bus->parent = ds->master_dev;
+        ds->slave_mii_bus->phy_mask = ~ds->phys_mii_mask;
 }
 
 
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 3a83ce5efa80..787b3c294ce6 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -129,7 +129,8 @@ int ip_forward(struct sk_buff *skb)
          *      We now generate an ICMP HOST REDIRECT giving the route
          *      we calculated.
          */
-        if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
+        if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
+            !skb_sec_path(skb))
                 ip_rt_send_redirect(skb);
 
         skb->priority = rt_tos2priority(iph->tos);
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index c0d82f78d364..2a3720fb5a5f 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -966,8 +966,11 @@ bool ping_rcv(struct sk_buff *skb)
 
         sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
         if (sk != NULL) {
+                struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+
                 pr_debug("rcv on socket %p\n", sk);
-                ping_queue_rcv_skb(sk, skb_get(skb));
+                if (skb2)
+                        ping_queue_rcv_skb(sk, skb2);
                 sock_put(sk);
                 return true;
         }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6a2155b02602..d58dd0ec3e53 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb,
 
         do_cache = res->fi && !itag;
         if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
+            skb->protocol == htons(ETH_P_IP) &&
             (IN_DEV_SHARED_MEDIA(out_dev) ||
-             inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
-                flags |= RTCF_DOREDIRECT;
-                do_cache = false;
-        }
+             inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
+                IPCB(skb)->flags |= IPSKB_DOREDIRECT;
 
         if (skb->protocol != htons(ETH_P_IP)) {
                 /* Not IP (i.e. ARP). Do not create route, if it is
@@ -2303,6 +2302,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
         r->rtm_flags    = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
         if (rt->rt_flags & RTCF_NOTIFY)
                 r->rtm_flags |= RTM_F_NOTIFY;
+        if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
+                r->rtm_flags |= RTCF_DOREDIRECT;
 
         if (nla_put_be32(skb, RTA_DST, dst))
                 goto nla_put_failure;
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index 7927db0a9279..4a000f1dd757 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -99,11 +99,13 @@ static void udp_dump(struct udp_table *table, struct sk_buff *skb, struct netlin
         s_slot = cb->args[0];
         num = s_num = cb->args[1];
 
-        for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) {
+        for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) {
                 struct sock *sk;
                 struct hlist_nulls_node *node;
                 struct udp_hslot *hslot = &table->hash[slot];
 
+                num = 0;
+
                 if (hlist_nulls_empty(&hslot->head))
                         continue;
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index b2d1838897c9..f1c6d5e98322 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -659,6 +659,29 @@ static int fib6_commit_metrics(struct dst_entry *dst,
         return 0;
 }
 
+static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
+                          struct net *net)
+{
+        if (atomic_read(&rt->rt6i_ref) != 1) {
+                /* This route is used as dummy address holder in some split
+                 * nodes. It is not leaked, but it still holds other resources,
+                 * which must be released in time. So, scan ascendant nodes
+                 * and replace dummy references to this route with references
+                 * to still alive ones.
+                 */
+                while (fn) {
+                        if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
+                                fn->leaf = fib6_find_prefix(net, fn);
+                                atomic_inc(&fn->leaf->rt6i_ref);
+                                rt6_release(rt);
+                        }
+                        fn = fn->parent;
+                }
+                /* No more references are possible at this point. */
+                BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
+        }
+}
+
 /*
  *      Insert routing information in a node.
  */
@@ -807,11 +830,12 @@ add:
                 rt->dst.rt6_next = iter->dst.rt6_next;
                 atomic_inc(&rt->rt6i_ref);
                 inet6_rt_notify(RTM_NEWROUTE, rt, info);
-                rt6_release(iter);
                 if (!(fn->fn_flags & RTN_RTINFO)) {
                         info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
                         fn->fn_flags |= RTN_RTINFO;
                 }
+                fib6_purge_rt(iter, fn, info->nl_net);
+                rt6_release(iter);
         }
 
         return 0;
@@ -1322,24 +1346,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
                 fn = fib6_repair_tree(net, fn);
         }
 
-        if (atomic_read(&rt->rt6i_ref) != 1) {
-                /* This route is used as dummy address holder in some split
-                 * nodes. It is not leaked, but it still holds other resources,
-                 * which must be released in time. So, scan ascendant nodes
-                 * and replace dummy references to this route with references
-                 * to still alive ones.
-                 */
-                while (fn) {
-                        if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
-                                fn->leaf = fib6_find_prefix(net, fn);
-                                atomic_inc(&fn->leaf->rt6i_ref);
-                                rt6_release(rt);
-                        }
-                        fn = fn->parent;
-                }
-                /* No more references are possible at this point. */
-                BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
-        }
+        fib6_purge_rt(rt, fn, net);
 
         inet6_rt_notify(RTM_DELROUTE, rt, info);
         rt6_release(rt);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 166e33bed222..495965358d22 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1242,12 +1242,16 @@ restart:
                 rt = net->ipv6.ip6_null_entry;
         else if (rt->dst.error) {
                 rt = net->ipv6.ip6_null_entry;
-        } else if (rt == net->ipv6.ip6_null_entry) {
+                goto out;
+        }
+
+        if (rt == net->ipv6.ip6_null_entry) {
                 fn = fib6_backtrack(fn, &fl6->saddr);
                 if (fn)
                         goto restart;
         }
 
+out:
         dst_hold(&rt->dst);
 
         read_unlock_bh(&table->tb6_lock);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 5f983644373a..48bf5a06847b 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -130,12 +130,18 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 {
         struct flowi6 *fl6 = &fl->u.ip6;
         int onlyproto = 0;
-        u16 offset = skb_network_header_len(skb);
         const struct ipv6hdr *hdr = ipv6_hdr(skb);
+        u16 offset = sizeof(*hdr);
         struct ipv6_opt_hdr *exthdr;
         const unsigned char *nh = skb_network_header(skb);
-        u8 nexthdr = nh[IP6CB(skb)->nhoff];
+        u16 nhoff = IP6CB(skb)->nhoff;
         int oif = 0;
+        u8 nexthdr;
+
+        if (!nhoff)
+                nhoff = offsetof(struct ipv6hdr, nexthdr);
+
+        nexthdr = nh[nhoff];
 
         if (skb_dst(skb))
                 oif = skb_dst(skb)->dev->ifindex;
diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
index 612a5ddaf93b..799bafc2af39 100644
--- a/net/llc/sysctl_net_llc.c
+++ b/net/llc/sysctl_net_llc.c
@@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = {
         {
                 .procname       = "ack",
                 .data           = &sysctl_llc2_ack_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_ack_timeout),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "busy",
                 .data           = &sysctl_llc2_busy_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_busy_timeout),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "p",
                 .data           = &sysctl_llc2_p_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_p_timeout),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "rej",
                 .data           = &sysctl_llc2_rej_timeout,
-                .maxlen         = sizeof(long),
+                .maxlen         = sizeof(sysctl_llc2_rej_timeout),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 4c5192e0d66c..4a95fe3cffbc 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -86,20 +86,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 }
         }
 
-        /* tear down aggregation sessions and remove STAs */
-        mutex_lock(&local->sta_mtx);
-        list_for_each_entry(sta, &local->sta_list, list) {
-                if (sta->uploaded) {
-                        enum ieee80211_sta_state state;
-
-                        state = sta->sta_state;
-                        for (; state > IEEE80211_STA_NOTEXIST; state--)
-                                WARN_ON(drv_sta_state(local, sta->sdata, sta,
-                                                      state, state - 1));
-                }
-        }
-        mutex_unlock(&local->sta_mtx);
-
         /* remove all interfaces that were created in the driver */
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
@@ -111,6 +97,21 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 case NL80211_IFTYPE_STATION:
                         ieee80211_mgd_quiesce(sdata);
                         break;
+                case NL80211_IFTYPE_WDS:
+                        /* tear down aggregation sessions and remove STAs */
+                        mutex_lock(&local->sta_mtx);
+                        sta = sdata->u.wds.sta;
+                        if (sta && sta->uploaded) {
+                                enum ieee80211_sta_state state;
+
+                                state = sta->sta_state;
+                                for (; state > IEEE80211_STA_NOTEXIST; state--)
+                                        WARN_ON(drv_sta_state(local, sta->sdata,
+                                                              sta, state,
+                                                              state - 1));
+                        }
+                        mutex_unlock(&local->sta_mtx);
+                        break;
                 default:
                         break;
                 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 683b10f46505..d69ca513848e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -272,7 +272,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
                 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
         else if (rate)
-                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
+                channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
         else
                 channel_flags |= IEEE80211_CHAN_2GHZ;
         put_unaligned_le16(channel_flags, pos);
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 84c8219c3e1c..f59adf8a4cd7 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -180,6 +180,11 @@ static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
         }
 
         bpf_size = bpf_len * sizeof(*bpf_ops);
+        if (bpf_size != nla_len(tb[TCA_BPF_OPS])) {
+                ret = -EINVAL;
+                goto errout;
+        }
+
         bpf_ops = kzalloc(bpf_size, GFP_KERNEL);
         if (bpf_ops == NULL) {
                 ret = -ENOMEM;
@@ -215,15 +220,21 @@ static u32 cls_bpf_grab_new_handle(struct tcf_proto *tp,
                                    struct cls_bpf_head *head)
 {
         unsigned int i = 0x80000000;
+        u32 handle;
 
         do {
                 if (++head->hgen == 0x7FFFFFFF)
                         head->hgen = 1;
         } while (--i > 0 && cls_bpf_get(tp, head->hgen));
-        if (i == 0)
+
+        if (unlikely(i == 0)) {
                 pr_err("Insufficient number of handles\n");
+                handle = 0;
+        } else {
+                handle = head->hgen;
+        }
 
-        return i;
+        return handle;
 }
 
 static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index f791edd64d6c..26d06dbcc1c8 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1182,7 +1182,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
         asoc->peer.peer_hmacs = new->peer.peer_hmacs;
         new->peer.peer_hmacs = NULL;
 
-        sctp_auth_key_put(asoc->asoc_shared_key);
         sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
 }
 
diff --git a/net/socket.c b/net/socket.c
index a2c33a4dc7ba..418795caa897 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -869,9 +869,6 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
                                          struct sock_iocb *siocb)
 {
-        if (!is_sync_kiocb(iocb))
-                BUG();
-
         siocb->kiocb = iocb;
         iocb->private = siocb;
         return siocb;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7ca4b5133123..8887c6e5fca8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2854,6 +2854,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->get_key)
                 return -EOPNOTSUPP;
 
+        if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+                return -ENOENT;
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
@@ -2873,10 +2876,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
                 goto nla_put_failure;
 
-        if (pairwise && mac_addr &&
-            !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
-                return -ENOENT;
-
         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
                            get_key_callback);
 
@@ -3047,7 +3046,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         wdev_lock(dev->ieee80211_ptr);
         err = nl80211_key_allowed(dev->ieee80211_ptr);
 
-        if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
+        if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
                 err = -ENOENT;
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d0ac795445b7..5488c3662f7d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -308,6 +308,12 @@ unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
                 goto out;
         }
 
+        if (ieee80211_is_mgmt(fc)) {
+                if (ieee80211_has_order(fc))
+                        hdrlen += IEEE80211_HT_CTL_LEN;
+                goto out;
+        }
+
         if (ieee80211_is_ctl(fc)) {
                 /*
                  * ACK and CTS are 10 bytes, all others 16. To see how
diff --git a/samples/bpf/test_maps.c b/samples/bpf/test_maps.c
index e286b42307f3..6299ee95cd11 100644
--- a/samples/bpf/test_maps.c
+++ b/samples/bpf/test_maps.c
@@ -69,9 +69,9 @@ static void test_hashmap_sanity(int i, void *data)
 
         /* iterate over two elements */
         assert(bpf_get_next_key(map_fd, &key, &next_key) == 0 &&
-               next_key == 2);
+               (next_key == 1 || next_key == 2));
         assert(bpf_get_next_key(map_fd, &next_key, &next_key) == 0 &&
-               next_key == 1);
+               (next_key == 1 || next_key == 2));
         assert(bpf_get_next_key(map_fd, &next_key, &next_key) == -1 &&
                errno == ENOENT);
 
diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
index 99ff35e2a25d..35e44e463cfe 100644
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -348,7 +348,6 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
         struct atmel_pcm_dma_params *dma_params;
         int dir, channels, bits;
         u32 tfmr, rfmr, tcmr, rcmr;
-        int start_event;
         int ret;
         int fslen, fslen_ext;
 
@@ -457,19 +456,10 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                  * The SSC transmit clock is obtained from the BCLK signal on
                  * on the TK line, and the SSC receive clock is
                  * generated from the transmit clock.
-                 *
-                 *  For single channel data, one sample is transferred
-                 * on the falling edge of the LRC clock.
-                 * For two channel data, one sample is
-                 * transferred on both edges of the LRC clock.
                  */
-                start_event = ((channels == 1)
-                                ? SSC_START_FALLING_RF
-                                : SSC_START_EDGE_RF);
-
                 rcmr =    SSC_BF(RCMR_PERIOD, 0)
                         | SSC_BF(RCMR_STTDLY, START_DELAY)
-                        | SSC_BF(RCMR_START, start_event)
+                        | SSC_BF(RCMR_START, SSC_START_FALLING_RF)
                         | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
                         | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
                         | SSC_BF(RCMR_CKS, ssc->clk_from_rk_pin ?
@@ -478,14 +468,14 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                 rfmr =    SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE)
                         | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE)
                         | SSC_BF(RFMR_FSLEN, 0)
-                        | SSC_BF(RFMR_DATNB, 0)
+                        | SSC_BF(RFMR_DATNB, (channels - 1))
                         | SSC_BIT(RFMR_MSBF)
                         | SSC_BF(RFMR_LOOP, 0)
                         | SSC_BF(RFMR_DATLEN, (bits - 1));
 
                 tcmr =    SSC_BF(TCMR_PERIOD, 0)
                         | SSC_BF(TCMR_STTDLY, START_DELAY)
-                        | SSC_BF(TCMR_START, start_event)
+                        | SSC_BF(TCMR_START, SSC_START_FALLING_RF)
                         | SSC_BF(TCMR_CKI, SSC_CKI_FALLING)
                         | SSC_BF(TCMR_CKO, SSC_CKO_NONE)
                         | SSC_BF(TCMR_CKS, ssc->clk_from_rk_pin ?
@@ -495,7 +485,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                         | SSC_BF(TFMR_FSDEN, 0)
                         | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE)
                         | SSC_BF(TFMR_FSLEN, 0)
-                        | SSC_BF(TFMR_DATNB, 0)
+                        | SSC_BF(TFMR_DATNB, (channels - 1))
                         | SSC_BIT(TFMR_MSBF)
                         | SSC_BF(TFMR_DATDEF, 0)
                         | SSC_BF(TFMR_DATLEN, (bits - 1));
@@ -512,7 +502,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                 rcmr =    SSC_BF(RCMR_PERIOD, ssc_p->rcmr_period)
                         | SSC_BF(RCMR_STTDLY, 1)
                         | SSC_BF(RCMR_START, SSC_START_RISING_RF)
-                        | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
+                        | SSC_BF(RCMR_CKI, SSC_CKI_FALLING)
                         | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
                         | SSC_BF(RCMR_CKS, SSC_CKS_DIV);
 
@@ -527,7 +517,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                 tcmr =    SSC_BF(TCMR_PERIOD, ssc_p->tcmr_period)
                         | SSC_BF(TCMR_STTDLY, 1)
                         | SSC_BF(TCMR_START, SSC_START_RISING_RF)
-                        | SSC_BF(TCMR_CKI, SSC_CKI_RISING)
+                        | SSC_BF(TCMR_CKI, SSC_CKI_FALLING)
                         | SSC_BF(TCMR_CKO, SSC_CKO_CONTINUOUS)
                         | SSC_BF(TCMR_CKS, SSC_CKS_DIV);
 
@@ -556,7 +546,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
                 rcmr =    SSC_BF(RCMR_PERIOD, 0)
                         | SSC_BF(RCMR_STTDLY, START_DELAY)
                         | SSC_BF(RCMR_START, SSC_START_RISING_RF)
-                        | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
+                        | SSC_BF(RCMR_CKI, SSC_CKI_FALLING)
                         | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
                         | SSC_BF(RCMR_CKS, ssc->clk_from_rk_pin ?
                                            SSC_CKS_PIN : SSC_CKS_CLOCK);
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index c3f2decd643c..1ff726c29249 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -2124,6 +2124,7 @@ MODULE_DEVICE_TABLE(of, rt5640_of_match);
 static struct acpi_device_id rt5640_acpi_match[] = {
         { "INT33CA", 0 },
         { "10EC5640", 0 },
+        { "10EC5642", 0 },
         { },
 };
 MODULE_DEVICE_TABLE(acpi, rt5640_acpi_match);
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index 29cf7ce610f4..aa98be32bb60 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -483,21 +483,21 @@ static int sgtl5000_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
         /* setting i2s data format */
         switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
         case SND_SOC_DAIFMT_DSP_A:
-                i2sctl |= SGTL5000_I2S_MODE_PCM;
+                i2sctl |= SGTL5000_I2S_MODE_PCM << SGTL5000_I2S_MODE_SHIFT;
                 break;
         case SND_SOC_DAIFMT_DSP_B:
-                i2sctl |= SGTL5000_I2S_MODE_PCM;
+                i2sctl |= SGTL5000_I2S_MODE_PCM << SGTL5000_I2S_MODE_SHIFT;
                 i2sctl |= SGTL5000_I2S_LRALIGN;
                 break;
         case SND_SOC_DAIFMT_I2S:
-                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ;
+                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ << SGTL5000_I2S_MODE_SHIFT;
                 break;
         case SND_SOC_DAIFMT_RIGHT_J:
-                i2sctl |= SGTL5000_I2S_MODE_RJ;
+                i2sctl |= SGTL5000_I2S_MODE_RJ << SGTL5000_I2S_MODE_SHIFT;
                 i2sctl |= SGTL5000_I2S_LRPOL;
                 break;
         case SND_SOC_DAIFMT_LEFT_J:
-                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ;
+                i2sctl |= SGTL5000_I2S_MODE_I2S_LJ << SGTL5000_I2S_MODE_SHIFT;
                 i2sctl |= SGTL5000_I2S_LRALIGN;
                 break;
         default:
@@ -1462,6 +1462,9 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
         if (ret)
                 return ret;
 
+        /* Need 8 clocks before I2C accesses */
+        udelay(1);
+
         /* read chip information */
         ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ID, &reg);
         if (ret)
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index b7ebce054b4e..dd222b10ce13 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1046,7 +1046,7 @@ static int aic3x_prepare(struct snd_pcm_substream *substream,
                 delay += aic3x->tdm_delay;
 
         /* Configure data delay */
-        snd_soc_write(codec, AIC3X_ASD_INTF_CTRLC, aic3x->tdm_delay);
+        snd_soc_write(codec, AIC3X_ASD_INTF_CTRLC, delay);
 
         return 0;
 }
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index b9211b42f6e9..b115ed815db9 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -717,6 +717,8 @@ static int wm8731_i2c_probe(struct i2c_client *i2c,
         if (wm8731 == NULL)
                 return -ENOMEM;
 
+        mutex_init(&wm8731->lock);
+
         wm8731->regmap = devm_regmap_init_i2c(i2c, &wm8731_regmap);
         if (IS_ERR(wm8731->regmap)) {
                 ret = PTR_ERR(wm8731->regmap);
diff --git a/sound/soc/intel/sst-haswell-ipc.c b/sound/soc/intel/sst-haswell-ipc.c
index 5bf14040c24a..8156cc1accb7 100644
--- a/sound/soc/intel/sst-haswell-ipc.c
+++ b/sound/soc/intel/sst-haswell-ipc.c
@@ -651,11 +651,11 @@ static void hsw_notification_work(struct work_struct *work)
         }
 
         /* tell DSP that notification has been handled */
-        sst_dsp_shim_update_bits_unlocked(hsw->dsp, SST_IPCD,
+        sst_dsp_shim_update_bits(hsw->dsp, SST_IPCD,
                 SST_IPCD_BUSY | SST_IPCD_DONE, SST_IPCD_DONE);
 
         /* unmask busy interrupt */
-        sst_dsp_shim_update_bits_unlocked(hsw->dsp, SST_IMRX, SST_IMRX_BUSY, 0);
+        sst_dsp_shim_update_bits(hsw->dsp, SST_IMRX, SST_IMRX_BUSY, 0);
 }
 
 static struct ipc_message *reply_find_msg(struct sst_hsw *hsw, u32 header)
diff --git a/tools/perf/scripts/perl/Perf-Trace-Util/Context.c b/tools/perf/scripts/perl/Perf-Trace-Util/Context.c
index 790ceba6ad3f..28431d1bbcf5 100644
--- a/tools/perf/scripts/perl/Perf-Trace-Util/Context.c
+++ b/tools/perf/scripts/perl/Perf-Trace-Util/Context.c
@@ -5,7 +5,10 @@
  *      ANY CHANGES MADE HERE WILL BE LOST! 
  *
  */
-
+#include <stdbool.h>
+#ifndef HAS_BOOL
+# define HAS_BOOL 1
+#endif
 #line 1 "Context.xs"
 /*
  * Context.xs.  XS interfaces for perf script.
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 79999ceaf2be..01bc4e23a2cf 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -177,14 +177,17 @@ static int lock__parse(struct ins_operands *ops)
                 goto out_free_ops;
 
         ops->locked.ins = ins__find(name);
+        free(name);
+
         if (ops->locked.ins == NULL)
                 goto out_free_ops;
 
         if (!ops->locked.ins->ops)
                 return 0;
 
-        if (ops->locked.ins->ops->parse)
-                ops->locked.ins->ops->parse(ops->locked.ops);
+        if (ops->locked.ins->ops->parse &&
+            ops->locked.ins->ops->parse(ops->locked.ops) < 0)
+                goto out_free_ops;
 
         return 0;
 
@@ -208,6 +211,13 @@ static int lock__scnprintf(struct ins *ins, char *bf, size_t size,
 
 static void lock__delete(struct ins_operands *ops)
 {
+        struct ins *ins = ops->locked.ins;
+
+        if (ins && ins->ops->free)
+                ins->ops->free(ops->locked.ops);
+        else
+                ins__delete(ops->locked.ops);
+
         zfree(&ops->locked.ops);
         zfree(&ops->target.raw);
         zfree(&ops->target.name);
@@ -531,8 +541,8 @@ static void disasm_line__init_ins(struct disasm_line *dl)
         if (!dl->ins->ops)
                 return;
 
-        if (dl->ins->ops->parse)
-                dl->ins->ops->parse(&dl->ops);
+        if (dl->ins->ops->parse && dl->ins->ops->parse(&dl->ops) < 0)
+                dl->ins = NULL;
 }
 
 static int disasm_line__parse(char *line, char **namep, char **rawp)
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index cbab1fb77b1d..2e507b5025a3 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -1445,7 +1445,7 @@ int perf_evlist__strerror_tp(struct perf_evlist *evlist __maybe_unused,
         case ENOENT:
                 scnprintf(buf, size, "%s",
                           "Error:\tUnable to find debugfs\n"
-                          "Hint:\tWas your kernel was compiled with debugfs support?\n"
+                          "Hint:\tWas your kernel compiled with debugfs support?\n"
                           "Hint:\tIs the debugfs filesystem mounted?\n"
                           "Hint:\tTry 'sudo mount -t debugfs nodev /sys/kernel/debug'");
                 break;
diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
index 6951a9d42339..0e42438b1e59 100644
--- a/tools/perf/util/map.h
+++ b/tools/perf/util/map.h
@@ -116,6 +116,22 @@ struct thread;
 #define map__for_each_symbol(map, pos, n)       \
         dso__for_each_symbol(map->dso, pos, n, map->type)
 
+/* map__for_each_symbol_with_name - iterate over the symbols in the given map
+ *                                  that have the given name
+ *
+ * @map: the 'struct map *' in which symbols itereated
+ * @sym_name: the symbol name
+ * @pos: the 'struct symbol *' to use as a loop cursor
+ * @filter: to use when loading the DSO
+ */
+#define __map__for_each_symbol_by_name(map, sym_name, pos, filter)      \
+        for (pos = map__find_symbol_by_name(map, sym_name, filter);     \
+             pos && strcmp(pos->name, sym_name) == 0;           \
+             pos = symbol__next_by_name(pos))
+
+#define map__for_each_symbol_by_name(map, sym_name, pos)                \
+        __map__for_each_symbol_by_name(map, sym_name, (pos), NULL)
+
 typedef int (*symbol_filter_t)(struct map *map, struct symbol *sym);
 
 void map__init(struct map *map, enum map_type type,
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 94a717bf007d..919937eb0be2 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -446,7 +446,7 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs,
         }
 
         for (i = 0; i < ntevs; i++) {
-                if (tevs[i].point.address) {
+                if (tevs[i].point.address && !tevs[i].point.retprobe) {
                         tmp = strdup(reloc_sym->name);
                         if (!tmp)
                                 return -ENOMEM;
@@ -2193,18 +2193,17 @@ static int __add_probe_trace_events(struct perf_probe_event *pev,
         return ret;
 }
 
-static char *looking_function_name;
-static int num_matched_functions;
-
-static int probe_function_filter(struct map *map __maybe_unused,
-                                      struct symbol *sym)
+static int find_probe_functions(struct map *map, char *name)
 {
-        if ((sym->binding == STB_GLOBAL || sym->binding == STB_LOCAL) &&
-            strcmp(looking_function_name, sym->name) == 0) {
-                num_matched_functions++;
-                return 0;
+        int found = 0;
+        struct symbol *sym;
+
+        map__for_each_symbol_by_name(map, name, sym) {
+                if (sym->binding == STB_GLOBAL || sym->binding == STB_LOCAL)
+                        found++;
         }
-        return 1;
+
+        return found;
 }
 
 #define strdup_or_goto(str, label)      \
@@ -2222,10 +2221,10 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
         struct kmap *kmap = NULL;
         struct ref_reloc_sym *reloc_sym = NULL;
         struct symbol *sym;
-        struct rb_node *nd;
         struct probe_trace_event *tev;
         struct perf_probe_point *pp = &pev->point;
         struct probe_trace_point *tp;
+        int num_matched_functions;
         int ret, i;
 
         /* Init maps of given executable or kernel */
@@ -2242,10 +2241,8 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
          * Load matched symbols: Since the different local symbols may have
          * same name but different addresses, this lists all the symbols.
          */
-        num_matched_functions = 0;
-        looking_function_name = pp->function;
-        ret = map__load(map, probe_function_filter);
-        if (ret || num_matched_functions == 0) {
+        num_matched_functions = find_probe_functions(map, pp->function);
+        if (num_matched_functions == 0) {
                 pr_err("Failed to find symbol %s in %s\n", pp->function,
                         target ? : "kernel");
                 ret = -ENOENT;
@@ -2257,7 +2254,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
                 goto out;
         }
 
-        if (!pev->uprobes) {
+        if (!pev->uprobes && !pp->retprobe) {
                 kmap = map__kmap(map);
                 reloc_sym = kmap->ref_reloc_sym;
                 if (!reloc_sym) {
@@ -2275,7 +2272,8 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
         }
 
         ret = 0;
-        map__for_each_symbol(map, sym, nd) {
+
+        map__for_each_symbol_by_name(map, pp->function, sym) {
                 tev = (*tevs) + ret;
                 tp = &tev->point;
                 if (ret == num_matched_functions) {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index c24c5b83156c..a194702a0a2f 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -396,6 +396,7 @@ static struct symbol *symbols__find_by_name(struct rb_root *symbols,
                                             const char *name)
 {
         struct rb_node *n;
+        struct symbol_name_rb_node *s;
 
         if (symbols == NULL)
                 return NULL;
@@ -403,7 +404,6 @@ static struct symbol *symbols__find_by_name(struct rb_root *symbols,
         n = symbols->rb_node;
 
         while (n) {
-                struct symbol_name_rb_node *s;
                 int cmp;
 
                 s = rb_entry(n, struct symbol_name_rb_node, rb_node);
@@ -414,10 +414,24 @@ static struct symbol *symbols__find_by_name(struct rb_root *symbols,
                 else if (cmp > 0)
                         n = n->rb_right;
                 else
-                        return &s->sym;
+                        break;
         }
 
-        return NULL;
+        if (n == NULL)
+                return NULL;
+
+        /* return first symbol that has same name (if any) */
+        for (n = rb_prev(n); n; n = rb_prev(n)) {
+                struct symbol_name_rb_node *tmp;
+
+                tmp = rb_entry(n, struct symbol_name_rb_node, rb_node);
+                if (strcmp(tmp->sym.name, s->sym.name))
+                        break;
+
+                s = tmp;
+        }
+
+        return &s->sym;
 }
 
 struct symbol *dso__find_symbol(struct dso *dso,
@@ -436,6 +450,17 @@ struct symbol *dso__next_symbol(struct symbol *sym)
         return symbols__next(sym);
 }
 
+struct symbol *symbol__next_by_name(struct symbol *sym)
+{
+        struct symbol_name_rb_node *s = container_of(sym, struct symbol_name_rb_node, sym);
+        struct rb_node *n = rb_next(&s->rb_node);
+
+        return n ? &rb_entry(n, struct symbol_name_rb_node, rb_node)->sym : NULL;
+}
+
+ /*
+  * Teturns first symbol that matched with @name.
+  */
 struct symbol *dso__find_symbol_by_name(struct dso *dso, enum map_type type,
                                         const char *name)
 {
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 9d602e9c6f59..1650dcb3a67b 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -231,6 +231,7 @@ struct symbol *dso__find_symbol(struct dso *dso, enum map_type type,
                                 u64 addr);
 struct symbol *dso__find_symbol_by_name(struct dso *dso, enum map_type type,
                                         const char *name);
+struct symbol *symbol__next_by_name(struct symbol *sym);
 
 struct symbol *dso__first_symbol(struct dso *dso, enum map_type type);
 struct symbol *dso__next_symbol(struct symbol *sym);