Merge branch 'perf/urgent' into perf/core

Merge the latest fixes before queueing up new changes.

Signed-off-by: Ingo Molnar <mingo@kernel.org>

918 files changed, 10034 insertions, 5585 deletions

diff --git a/.gitignore b/.gitignore
index 7e9932e55475..42fa0d5626a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,3 +92,6 @@ extra_certificates
 signing_key.priv
 signing_key.x509
 x509.genkey
+
+# Kconfig presets
+all.config
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 38f8444bdd0e..07de7e19b4ce 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -29,6 +29,8 @@ DMA-ISA-LPC.txt
         - How to do DMA with ISA (and LPC) devices.
 DMA-attributes.txt
         - listing of the various possible attributes a DMA region can have
+dmatest.txt
+        - how to compile, configure and use the dmatest system.
 DocBook/
         - directory with DocBook templates etc. for kernel documentation.
 EDID/
@@ -77,6 +79,8 @@ arm/
         - directory with info about Linux on the ARM architecture.
 arm64/
         - directory with info about Linux on the 64 bit ARM architecture.
+assoc_array.txt
+        - generic associative array intro.
 atomic_ops.txt
         - semantics and behavior of atomic and bitmask operations.
 auxdisplay/
@@ -87,6 +91,8 @@ bad_memory.txt
         - how to use kernel parameters to exclude bad RAM regions.
 basic_profiling.txt
         - basic instructions for those who wants to profile Linux kernel.
+bcache.txt
+        - Block-layer cache on fast SSDs to improve slow (raid) I/O performance.
 binfmt_misc.txt
         - info on the kernel support for extra binary formats.
 blackfin/
@@ -171,6 +177,8 @@ early-userspace/
         - info about initramfs, klibc, and userspace early during boot.
 edac.txt
         - information on EDAC - Error Detection And Correction
+efi-stub.txt
+        - How to use the EFI boot stub to bypass GRUB or elilo on EFI systems.
 eisa.txt
         - info on EISA bus support.
 email-clients.txt
@@ -195,8 +203,8 @@ futex-requeue-pi.txt
         - info on requeueing of tasks from a non-PI futex to a PI futex
 gcov.txt
         - use of GCC's coverage testing tool "gcov" with the Linux kernel
-gpio.txt
-        - overview of GPIO (General Purpose Input/Output) access conventions.
+gpio/
+        - gpio related documentation
 hid/
         - directory with information on human interface devices
 highuid.txt
@@ -255,6 +263,8 @@ kernel-docs.txt
         - listing of various WWW + books that document kernel internals.
 kernel-parameters.txt
         - summary listing of command line / boot prompt args for the kernel.
+kernel-per-CPU-kthreads.txt
+        - List of all per-CPU kthreads and how they introduce jitter.
 kmemcheck.txt
         - info on dynamic checker that detects uses of uninitialized memory.
 kmemleak.txt
@@ -299,8 +309,6 @@ memory-devices/
         - directory with info on parts like the Texas Instruments EMIF driver
 memory-hotplug.txt
         - Hotpluggable memory support, how to use and current status.
-memory.txt
-        - info on typical Linux memory problems.
 metag/
         - directory with info about Linux on Meta architecture.
 mips/
@@ -311,6 +319,8 @@ mmc/
         - directory with info about the MMC subsystem
 mn10300/
         - directory with info about the mn10300 architecture port
+module-signing.txt
+        - Kernel module signing for increased security when loading modules.
 mtd/
         - directory with info about memory technology devices (flash)
 mono.txt
@@ -343,6 +353,8 @@ pcmcia/
         - info on the Linux PCMCIA driver.
 percpu-rw-semaphore.txt
         - RCU based read-write semaphore optimized for locking for reading
+phy.txt
+        - Description of the generic PHY framework.
 pi-futex.txt
         - documentation on lightweight priority inheritance futexes.
 pinctrl.txt
@@ -431,6 +443,8 @@ sysrq.txt
         - info on the magic SysRq key.
 target/
         - directory with info on generating TCM v4 fabric .ko modules
+this_cpu_ops.txt
+        - List rationale behind and the way to use this_cpu operations.
 thermal/
         - directory with information on managing thermal issues (CPU/temp)
 trace/
@@ -469,6 +483,8 @@ wimax/
         - directory with info about Intel Wireless Wimax Connections
 workqueue.txt
         - information on the Concurrency Managed Workqueue implementation
+ww-mutex-design.txt
+        - Intro to Mutex wait/would deadlock handling.s
 x86/x86_64/
         - directory with info on Linux support for AMD x86-64 (Hammer) machines.
 xtensa/
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index a8d01005f480..10a93696e55a 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -82,7 +82,19 @@ Most of the hard work is done for the driver in the PCI layer.  It simply
 has to request that the PCI layer set up the MSI capability for this
 device.
 
-4.2.1 pci_enable_msi_range
+4.2.1 pci_enable_msi
+
+int pci_enable_msi(struct pci_dev *dev)
+
+A successful call allocates ONE interrupt to the device, regardless
+of how many MSIs the device supports.  The device is switched from
+pin-based interrupt mode to MSI mode.  The dev->irq number is changed
+to a new number which represents the message signaled interrupt;
+consequently, this function should be called before the driver calls
+request_irq(), because an MSI is delivered via a vector that is
+different from the vector of a pin-based interrupt.
+
+4.2.2 pci_enable_msi_range
 
 int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
 
@@ -147,6 +159,11 @@ static int foo_driver_enable_msi(struct pci_dev *pdev, int nvec)
         return pci_enable_msi_range(pdev, nvec, nvec);
 }
 
+Note, unlike pci_enable_msi_exact() function, which could be also used to
+enable a particular number of MSI-X interrupts, pci_enable_msi_range()
+returns either a negative errno or 'nvec' (not negative errno or 0 - as
+pci_enable_msi_exact() does).
+
 4.2.1.3 Single MSI mode
 
 The most notorious example of the request type described above is
@@ -158,7 +175,27 @@ static int foo_driver_enable_single_msi(struct pci_dev *pdev)
         return pci_enable_msi_range(pdev, 1, 1);
 }
 
-4.2.2 pci_disable_msi
+Note, unlike pci_enable_msi() function, which could be also used to
+enable the single MSI mode, pci_enable_msi_range() returns either a
+negative errno or 1 (not negative errno or 0 - as pci_enable_msi()
+does).
+
+4.2.3 pci_enable_msi_exact
+
+int pci_enable_msi_exact(struct pci_dev *dev, int nvec)
+
+This variation on pci_enable_msi_range() call allows a device driver to
+request exactly 'nvec' MSIs.
+
+If this function returns a negative number, it indicates an error and
+the driver should not attempt to request any more MSI interrupts for
+this device.
+
+By contrast with pci_enable_msi_range() function, pci_enable_msi_exact()
+returns zero in case of success, which indicates MSI interrupts have been
+successfully allocated.
+
+4.2.4 pci_disable_msi
 
 void pci_disable_msi(struct pci_dev *dev)
 
@@ -172,7 +209,7 @@ on any interrupt for which it previously called request_irq().
 Failure to do so results in a BUG_ON(), leaving the device with
 MSI enabled and thus leaking its vector.
 
-4.2.3 pci_msi_vec_count
+4.2.4 pci_msi_vec_count
 
 int pci_msi_vec_count(struct pci_dev *dev)
 
@@ -257,8 +294,8 @@ possible, likely up to the limit returned by pci_msix_vec_count() function:
 
 static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 {
-        return pci_enable_msi_range(adapter->pdev, adapter->msix_entries,
-                                    1, nvec);
+        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
+                                     1, nvec);
 }
 
 Note the value of 'minvec' parameter is 1.  As 'minvec' is inclusive,
@@ -269,8 +306,8 @@ In this case the function could look like this:
 
 static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 {
-        return pci_enable_msi_range(adapter->pdev, adapter->msix_entries,
-                                    FOO_DRIVER_MINIMUM_NVEC, nvec);
+        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
+                                     FOO_DRIVER_MINIMUM_NVEC, nvec);
 }
 
 4.3.1.2 Exact number of MSI-X interrupts
@@ -282,10 +319,15 @@ parameters:
 
 static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 {
-        return pci_enable_msi_range(adapter->pdev, adapter->msix_entries,
-                                    nvec, nvec);
+        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
+                                     nvec, nvec);
 }
 
+Note, unlike pci_enable_msix_exact() function, which could be also used to
+enable a particular number of MSI-X interrupts, pci_enable_msix_range()
+returns either a negative errno or 'nvec' (not negative errno or 0 - as
+pci_enable_msix_exact() does).
+
 4.3.1.3 Specific requirements to the number of MSI-X interrupts
 
 As noted above, there could be devices that can not operate with just any
@@ -332,7 +374,64 @@ Note how pci_enable_msix_range() return value is analized for a fallback -
 any error code other than -ENOSPC indicates a fatal error and should not
 be retried.
 
-4.3.2 pci_disable_msix
+4.3.2 pci_enable_msix_exact
+
+int pci_enable_msix_exact(struct pci_dev *dev,
+                          struct msix_entry *entries, int nvec)
+
+This variation on pci_enable_msix_range() call allows a device driver to
+request exactly 'nvec' MSI-Xs.
+
+If this function returns a negative number, it indicates an error and
+the driver should not attempt to allocate any more MSI-X interrupts for
+this device.
+
+By contrast with pci_enable_msix_range() function, pci_enable_msix_exact()
+returns zero in case of success, which indicates MSI-X interrupts have been
+successfully allocated.
+
+Another version of a routine that enables MSI-X mode for a device with
+specific requirements described in chapter 4.3.1.3 might look like this:
+
+/*
+ * Assume 'minvec' and 'maxvec' are non-zero
+ */
+static int foo_driver_enable_msix(struct foo_adapter *adapter,
+                                  int minvec, int maxvec)
+{
+        int rc;
+
+        minvec = roundup_pow_of_two(minvec);
+        maxvec = rounddown_pow_of_two(maxvec);
+
+        if (minvec > maxvec)
+                return -ERANGE;
+
+retry:
+        rc = pci_enable_msix_exact(adapter->pdev,
+                                   adapter->msix_entries, maxvec);
+
+        /*
+         * -ENOSPC is the only error code allowed to be analyzed
+         */
+        if (rc == -ENOSPC) {
+                if (maxvec == 1)
+                        return -ENOSPC;
+
+                maxvec /= 2;
+
+                if (minvec > maxvec)
+                        return -ENOSPC;
+
+                goto retry;
+        } else if (rc < 0) {
+                return rc;
+        }
+
+        return maxvec;
+}
+
+4.3.3 pci_disable_msix
 
 void pci_disable_msix(struct pci_dev *dev)
 
diff --git a/Documentation/RCU/00-INDEX b/Documentation/RCU/00-INDEX
index 1d7a885761f5..fa57139f50bf 100644
--- a/Documentation/RCU/00-INDEX
+++ b/Documentation/RCU/00-INDEX
@@ -8,6 +8,8 @@ listRCU.txt
         - Using RCU to Protect Read-Mostly Linked Lists
 lockdep.txt
         - RCU and lockdep checking
+lockdep-splat.txt
+        - RCU Lockdep splats explained.
 NMI-RCU.txt
         - Using RCU to Protect Dynamic NMI Handlers
 rcubarrier.txt
diff --git a/Documentation/arm/00-INDEX b/Documentation/arm/00-INDEX
index 36420e116c90..a94090cc785d 100644
--- a/Documentation/arm/00-INDEX
+++ b/Documentation/arm/00-INDEX
@@ -4,6 +4,8 @@ Booting
         - requirements for booting
 Interrupts
         - ARM Interrupt subsystem documentation
+IXP4xx
+        - Intel IXP4xx Network processor.
 msm
         - MSM specific documentation
 Netwinder
@@ -24,8 +26,16 @@ SPEAr
         - ST SPEAr platform Linux Overview
 VFP/
         - Release notes for Linux Kernel Vector Floating Point support code
+cluster-pm-race-avoidance.txt
+        - Algorithm for CPU and Cluster setup/teardown
 empeg/
         - Ltd's Empeg MP3 Car Audio Player
+firmware.txt
+        - Secure firmware registration and calling.
+kernel_mode_neon.txt
+        - How to use NEON instructions in kernel mode
+kernel_user_helpers.txt
+        - Helper functions in kernel space made available for userspace.
 mem_alignment
         - alignment abort handler documentation
 memory.txt
@@ -34,3 +44,7 @@ nwfpe/
         - NWFPE floating point emulator documentation
 swp_emulation
         - SWP/SWPB emulation handler/logging description
+tcm.txt
+        - ARM Tightly Coupled Memory
+vlocks.txt
+        - Voting locks, low-level mechanism relying on memory system atomic writes.
diff --git a/Documentation/blackfin/00-INDEX b/Documentation/blackfin/00-INDEX
index 2df0365f2dff..c54fcdd4ae9f 100644
--- a/Documentation/blackfin/00-INDEX
+++ b/Documentation/blackfin/00-INDEX
@@ -1,8 +1,10 @@
 00-INDEX
         - This file
-
+Makefile
+        - Makefile for gptimers example file.
 bfin-gpio-notes.txt
         - Notes in developing/using bfin-gpio driver.
-
 bfin-spi-notes.txt
         - Notes for using bfin spi bus driver.
+gptimers-example.c
+        - gptimers example
diff --git a/Documentation/block/00-INDEX b/Documentation/block/00-INDEX
index 929d9904f74b..e840b47613f7 100644
--- a/Documentation/block/00-INDEX
+++ b/Documentation/block/00-INDEX
@@ -14,6 +14,8 @@ deadline-iosched.txt
         - Deadline IO scheduler tunables
 ioprio.txt
         - Block io priorities (in CFQ scheduler)
+null_blk.txt
+        - Null block for block-layer benchmarking.
 queue-sysfs.txt
         - Queue's sysfs entries
 request.txt
diff --git a/Documentation/devicetree/00-INDEX b/Documentation/devicetree/00-INDEX
index b78f691fd847..8c4102c6a5e7 100644
--- a/Documentation/devicetree/00-INDEX
+++ b/Documentation/devicetree/00-INDEX
@@ -8,3 +8,5 @@ https://lists.ozlabs.org/listinfo/devicetree-discuss
         - this file
 booting-without-of.txt
         - Booting Linux without Open Firmware, describes history and format of device trees.
+usage-model.txt
+        - How Linux uses DT and what DT aims to solve.
\ No newline at end of file
diff --git a/Documentation/devicetree/bindings/arm/omap/omap.txt b/Documentation/devicetree/bindings/arm/omap/omap.txt
index 34dc40cffdfd..af9b4a0d902b 100644
--- a/Documentation/devicetree/bindings/arm/omap/omap.txt
+++ b/Documentation/devicetree/bindings/arm/omap/omap.txt
@@ -91,7 +91,7 @@ Boards:
   compatible = "ti,omap3-beagle", "ti,omap3"
 
 - OMAP3 Tobi with Overo : Commercial expansion board with daughter board
-  compatible = "ti,omap3-tobi", "ti,omap3-overo", "ti,omap3"
+  compatible = "gumstix,omap3-overo-tobi", "gumstix,omap3-overo", "ti,omap3"
 
 - OMAP4 SDP : Software Development Board
   compatible = "ti,omap4-sdp", "ti,omap4430"
diff --git a/Documentation/devicetree/bindings/mmc/atmel-hsmci.txt b/Documentation/devicetree/bindings/mmc/atmel-hsmci.txt
index 0a85c70cd30a..07ad02075a93 100644
--- a/Documentation/devicetree/bindings/mmc/atmel-hsmci.txt
+++ b/Documentation/devicetree/bindings/mmc/atmel-hsmci.txt
@@ -13,6 +13,9 @@ Required properties:
 - #address-cells: should be one. The cell is the slot id.
 - #size-cells: should be zero.
 - at least one slot node
+- clock-names: tuple listing input clock names.
+        Required elements: "mci_clk"
+- clocks: phandles to input clocks.
 
 The node contains child nodes for each slot that the platform uses
 
@@ -24,6 +27,8 @@ mmc0: mmc@f0008000 {
         interrupts = <12 4>;
         #address-cells = <1>;
         #size-cells = <0>;
+        clock-names = "mci_clk";
+        clocks = <&mci0_clk>;
 
         [ child node definitions...]
 };
diff --git a/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt b/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt
index b90bfcd138ff..863d5b8155c7 100644
--- a/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt
+++ b/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt
@@ -1,7 +1,8 @@
 * Allwinner EMAC ethernet controller
 
 Required properties:
-- compatible: should be "allwinner,sun4i-emac".
+- compatible: should be "allwinner,sun4i-a10-emac" (Deprecated:
+              "allwinner,sun4i-emac")
 - reg: address and length of the register set for the device.
 - interrupts: interrupt for the device
 - phy: A phandle to a phy node defining the PHY address (as the reg
@@ -14,7 +15,7 @@ Optional properties:
 Example:
 
 emac: ethernet@01c0b000 {
-       compatible = "allwinner,sun4i-emac";
+       compatible = "allwinner,sun4i-a10-emac";
        reg = <0x01c0b000 0x1000>;
        interrupts = <55>;
        clocks = <&ahb_gates 17>;
diff --git a/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt b/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt
index 00b9f9a3ec1d..4ec56413779d 100644
--- a/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt
+++ b/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt
@@ -1,7 +1,8 @@
 * Allwinner A10 MDIO Ethernet Controller interface
 
 Required properties:
-- compatible: should be "allwinner,sun4i-mdio".
+- compatible: should be "allwinner,sun4i-a10-mdio"
+              (Deprecated: "allwinner,sun4i-mdio").
 - reg: address and length of the register set for the device.
 
 Optional properties:
@@ -9,7 +10,7 @@ Optional properties:
 
 Example at the SoC level:
 mdio@01c0b080 {
-        compatible = "allwinner,sun4i-mdio";
+        compatible = "allwinner,sun4i-a10-mdio";
         reg = <0x01c0b080 0x14>;
         #address-cells = <1>;
         #size-cells = <0>;
diff --git a/Documentation/devicetree/bindings/net/sti-dwmac.txt b/Documentation/devicetree/bindings/net/sti-dwmac.txt
new file mode 100644
index 000000000000..3dd3d0bf112f
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/sti-dwmac.txt
@@ -0,0 +1,58 @@
+STMicroelectronics SoC DWMAC glue layer controller
+
+The device node has following properties.
+
+Required properties:
+ - compatible   : Can be "st,stih415-dwmac", "st,stih416-dwmac" or
+   "st,stid127-dwmac".
+ - reg          : Offset of the glue configuration register map in system
+   configuration regmap pointed by st,syscon property and size.
+
+ - reg-names    : Should be "sti-ethconf".
+
+ - st,syscon    : Should be phandle to system configuration node which
+   encompases this glue registers.
+
+ - st,tx-retime-src: On STi Parts for Giga bit speeds, 125Mhz clocks can be
+   wired up in from different sources. One via TXCLK pin and other via CLK_125
+   pin. This wiring is totally board dependent. However the retiming glue
+   logic should be configured accordingly. Possible values for this property
+
+           "txclk" - if 125Mhz clock is wired up via txclk line.
+           "clk_125" - if 125Mhz clock is wired up via clk_125 line.
+
+   This property is only valid for Giga bit setup( GMII, RGMII), and it is
+   un-used for non-giga bit (MII and RMII) setups. Also note that internal
+   clockgen can not generate stable 125Mhz clock.
+
+ - st,ext-phyclk: This boolean property indicates who is generating the clock
+  for tx and rx. This property is only valid for RMII case where the clock can
+  be generated from the MAC or PHY.
+
+ - clock-names: should be "sti-ethclk".
+ - clocks: Should point to ethernet clockgen which can generate phyclk.
+
+
+Example:
+
+ethernet0: dwmac@fe810000 {
+        device_type     = "network";
+        compatible      = "st,stih416-dwmac", "snps,dwmac", "snps,dwmac-3.710";
+        reg             = <0xfe810000 0x8000>, <0x8bc 0x4>;
+        reg-names       = "stmmaceth", "sti-ethconf";
+        interrupts      = <0 133 0>, <0 134 0>, <0 135 0>;
+        interrupt-names = "macirq", "eth_wake_irq", "eth_lpi";
+        phy-mode        = "mii";
+
+        st,syscon       = <&syscfg_rear>;
+
+        snps,pbl        = <32>;
+        snps,mixed-burst;
+
+        resets          = <&softreset STIH416_ETH0_SOFTRESET>;
+        reset-names     = "stmmaceth";
+        pinctrl-0       = <&pinctrl_mii0>;
+        pinctrl-names   = "default";
+        clocks          = <&CLK_S_GMAC0_PHY>;
+        clock-names     = "stmmaceth";
+};
diff --git a/Documentation/devicetree/bindings/power/bq2415x.txt b/Documentation/devicetree/bindings/power/bq2415x.txt
new file mode 100644
index 000000000000..d0327f0b59ad
--- /dev/null
+++ b/Documentation/devicetree/bindings/power/bq2415x.txt
@@ -0,0 +1,47 @@
+Binding for TI bq2415x Li-Ion Charger
+
+Required properties:
+- compatible: Should contain one of the following:
+ * "ti,bq24150"
+ * "ti,bq24150"
+ * "ti,bq24150a"
+ * "ti,bq24151"
+ * "ti,bq24151a"
+ * "ti,bq24152"
+ * "ti,bq24153"
+ * "ti,bq24153a"
+ * "ti,bq24155"
+ * "ti,bq24156"
+ * "ti,bq24156a"
+ * "ti,bq24158"
+- reg:                     integer, i2c address of the device.
+- ti,current-limit:        integer, initial maximum current charger can pull
+                           from power supply in mA.
+- ti,weak-battery-voltage: integer, weak battery voltage threshold in mV.
+                           The chip will use slow precharge if battery voltage
+                           is below this value.
+- ti,battery-regulation-voltage: integer, maximum charging voltage in mV.
+- ti,charge-current:       integer, maximum charging current in mA.
+- ti,termination-current:  integer, charge will be terminated when current in
+                           constant-voltage phase drops below this value (in mA).
+- ti,resistor-sense:       integer, value of sensing resistor in milliohm.
+
+Optional properties:
+- ti,usb-charger-detection: phandle to usb charger detection device.
+                            (required for auto mode)
+
+Example from Nokia N900:
+
+bq24150a {
+        compatible = "ti,bq24150a";
+        reg = <0x6b>;
+
+        ti,current-limit = <100>;
+        ti,weak-battery-voltage = <3400>;
+        ti,battery-regulation-voltage = <4200>;
+        ti,charge-current = <650>;
+        ti,termination-current = <100>;
+        ti,resistor-sense = <68>;
+
+        ti,usb-charger-detection = <&isp1704>;
+};
diff --git a/Documentation/devicetree/bindings/spi/spi_atmel.txt b/Documentation/devicetree/bindings/spi/spi_atmel.txt
index 07e04cdc0c9e..4f8184d069cb 100644
--- a/Documentation/devicetree/bindings/spi/spi_atmel.txt
+++ b/Documentation/devicetree/bindings/spi/spi_atmel.txt
@@ -5,6 +5,9 @@ Required properties:
 - reg: Address and length of the register set for the device
 - interrupts: Should contain spi interrupt
 - cs-gpios: chipselects
+- clock-names: tuple listing input clock names.
+        Required elements: "spi_clk"
+- clocks: phandles to input clocks.
 
 Example:
 
@@ -14,6 +17,8 @@ spi1: spi@fffcc000 {
         interrupts = <13 4 5>;
         #address-cells = <1>;
         #size-cells = <0>;
+        clocks = <&spi1_clk>;
+        clock-names = "spi_clk";
         cs-gpios = <&pioB 3 0>;
         status = "okay";
 
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 3f900cd51bf0..40ce2df0e0e9 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -8,6 +8,7 @@ ad	Avionic Design GmbH
 adi     Analog Devices, Inc.
 aeroflexgaisler Aeroflex Gaisler AB
 ak      Asahi Kasei Corp.
+allwinner       Allwinner Technology Co., Ltd.
 altr    Altera Corp.
 amcc    Applied Micro Circuits Corporation (APM, formally AMCC)
 amstaos AMS-Taos Inc.
@@ -40,6 +41,7 @@ gmt	Global Mixed-mode Technology, Inc.
 gumstix Gumstix, Inc.
 haoyu   Haoyu Microelectronic Co. Ltd.
 hisilicon       Hisilicon Limited.
+honeywell       Honeywell
 hp      Hewlett Packard
 ibm     International Business Machines (IBM)
 idt     Integrated Device Technologies, Inc.
@@ -55,6 +57,7 @@ maxim	Maxim Integrated Products
 microchip       Microchip Technology Inc.
 mosaixtech      Mosaix Technologies, Inc.
 national        National Semiconductor
+neonode         Neonode Inc.
 nintendo        Nintendo
 nvidia  NVIDIA
 nxp     NXP Semiconductors
@@ -64,7 +67,7 @@ phytec	PHYTEC Messtechnik GmbH
 picochip        Picochip Ltd
 powervr PowerVR (deprecated, use img)
 qca     Qualcomm Atheros, Inc.
-qcom    Qualcomm, Inc.
+qcom    Qualcomm Technologies, Inc
 ralink  Mediatek/Ralink Technology Corp.
 ramtron Ramtron International
 realtek Realtek Semiconductor Corp.
@@ -78,6 +81,7 @@ silabs	Silicon Laboratories
 simtek
 sirf    SiRF Technology, Inc.
 snps    Synopsys, Inc.
+spansion        Spansion Inc.
 st      STMicroelectronics
 ste     ST-Ericsson
 stericsson      ST-Ericsson
diff --git a/Documentation/fb/00-INDEX b/Documentation/fb/00-INDEX
index 30a70542e823..fe85e7c5907a 100644
--- a/Documentation/fb/00-INDEX
+++ b/Documentation/fb/00-INDEX
@@ -5,6 +5,8 @@ please mail me.
 
 00-INDEX
         - this file.
+api.txt
+        - The frame buffer API between applications and buffer devices.
 arkfb.txt
         - info on the fbdev driver for ARK Logic chips.
 aty128fb.txt
@@ -51,12 +53,16 @@ sh7760fb.txt
         - info on the SH7760/SH7763 integrated LCDC Framebuffer driver.
 sisfb.txt
         - info on the framebuffer device driver for various SiS chips.
+sm501.txt
+        - info on the framebuffer device driver for sm501 videoframebuffer.
 sstfb.txt
         - info on the frame buffer driver for 3dfx' Voodoo Graphics boards.
 tgafb.txt
         - info on the TGA (DECChip 21030) frame buffer driver.
 tridentfb.txt
         info on the framebuffer driver for some Trident chip based cards.
+udlfb.txt
+        - Driver for DisplayLink USB 2.0 chips.
 uvesafb.txt
         - info on the userspace VESA (VBE2+ compliant) frame buffer device.
 vesafb.txt
diff --git a/Documentation/filesystems/00-INDEX b/Documentation/filesystems/00-INDEX
index 632211cbdd56..ac28149aede4 100644
--- a/Documentation/filesystems/00-INDEX
+++ b/Documentation/filesystems/00-INDEX
@@ -2,6 +2,8 @@
         - this file (info on some of the filesystems supported by linux).
 Locking
         - info on locking rules as they pertain to Linux VFS.
+Makefile
+        - Makefile for building the filsystems-part of DocBook.
 9p.txt
         - 9p (v9fs) is an implementation of the Plan 9 remote fs protocol.
 adfs.txt
diff --git a/Documentation/filesystems/nfs/00-INDEX b/Documentation/filesystems/nfs/00-INDEX
index 66eb6c8c5334..53f3b596ac0d 100644
--- a/Documentation/filesystems/nfs/00-INDEX
+++ b/Documentation/filesystems/nfs/00-INDEX
@@ -12,6 +12,8 @@ nfs41-server.txt
         - info on the Linux server implementation of NFSv4 minor version 1.
 nfs-rdma.txt
         - how to install and setup the Linux NFS/RDMA client and server software
+nfsd-admin-interfaces.txt
+        - Administrative interfaces for nfsd.
 nfsroot.txt
         - short guide on setting up a diskless box with NFS root filesystem.
 pnfs.txt
@@ -20,5 +22,5 @@ rpc-cache.txt
         - introduction to the caching mechanisms in the sunrpc layer.
 idmapper.txt
         - information for configuring request-keys to be used by idmapper
-knfsd-rpcgss.txt
+rpc-server-gss.txt
         - Information on GSS authentication support in the NFS Server
diff --git a/Documentation/i2c/instantiating-devices b/Documentation/i2c/instantiating-devices
index c70e7a7638d1..0d85ac1935b7 100644
--- a/Documentation/i2c/instantiating-devices
+++ b/Documentation/i2c/instantiating-devices
@@ -8,8 +8,8 @@ reason, the kernel code must instantiate I2C devices explicitly. There are
 several ways to achieve this, depending on the context and requirements.
 
 
-Method 1: Declare the I2C devices by bus number
------------------------------------------------
+Method 1a: Declare the I2C devices by bus number
+------------------------------------------------
 
 This method is appropriate when the I2C bus is a system bus as is the case
 for many embedded systems. On such systems, each I2C bus has a number
@@ -51,6 +51,43 @@ The devices will be automatically unbound and destroyed when the I2C bus
 they sit on goes away (if ever.)
 
 
+Method 1b: Declare the I2C devices via devicetree
+-------------------------------------------------
+
+This method has the same implications as method 1a. The declaration of I2C
+devices is here done via devicetree as subnodes of the master controller.
+
+Example:
+
+        i2c1: i2c@400a0000 {
+                /* ... master properties skipped ... */
+                clock-frequency = <100000>;
+
+                flash@50 {
+                        compatible = "atmel,24c256";
+                        reg = <0x50>;
+                };
+
+                pca9532: gpio@60 {
+                        compatible = "nxp,pca9532";
+                        gpio-controller;
+                        #gpio-cells = <2>;
+                        reg = <0x60>;
+                };
+        };
+
+Here, two devices are attached to the bus using a speed of 100kHz. For
+additional properties which might be needed to set up the device, please refer
+to its devicetree documentation in Documentation/devicetree/bindings/.
+
+
+Method 1c: Declare the I2C devices via ACPI
+-------------------------------------------
+
+ACPI can also describe I2C devices. There is special documentation for this
+which is currently located at Documentation/acpi/enumeration.txt.
+
+
 Method 2: Instantiate the devices explicitly
 --------------------------------------------
 
diff --git a/Documentation/ide/00-INDEX b/Documentation/ide/00-INDEX
index d6b778842b75..22f98ca79539 100644
--- a/Documentation/ide/00-INDEX
+++ b/Documentation/ide/00-INDEX
@@ -10,3 +10,5 @@ ide-tape.txt
         - info on the IDE ATAPI streaming tape driver
 ide.txt
         - important info for users of ATA devices (IDE/EIDE disks and CD-ROMS).
+warm-plug-howto.txt
+        - using sysfs to remove and add IDE devices.
\ No newline at end of file
diff --git a/Documentation/laptops/00-INDEX b/Documentation/laptops/00-INDEX
index fa688538e757..d13b9a9a9e00 100644
--- a/Documentation/laptops/00-INDEX
+++ b/Documentation/laptops/00-INDEX
@@ -1,13 +1,15 @@
 00-INDEX
         - This file
-acer-wmi.txt
-        - information on the Acer Laptop WMI Extras driver.
+Makefile
+        - Makefile for building dslm example program.
 asus-laptop.txt
         - information on the Asus Laptop Extras driver.
 disk-shock-protection.txt
         - information on hard disk shock protection.
 dslm.c
         - Simple Disk Sleep Monitor program
+hpfall.c
+        - (HP) laptop accelerometer program for disk protection.
 laptop-mode.txt
         - how to conserve battery power using laptop-mode.
 sony-laptop.txt
diff --git a/Documentation/leds/00-INDEX b/Documentation/leds/00-INDEX
index 1ecd1596633e..b4ef1f34e25f 100644
--- a/Documentation/leds/00-INDEX
+++ b/Documentation/leds/00-INDEX
@@ -1,3 +1,7 @@
+00-INDEX
+        - This file
+leds-blinkm.txt
+        - Driver for BlinkM LED-devices.
 leds-class.txt
         - documents LED handling under Linux.
 leds-lp3944.txt
@@ -12,3 +16,7 @@ leds-lp55xx.txt
         - description about lp55xx common driver.
 leds-lm3556.txt
         - notes on how to use the leds-lm3556 driver.
+ledtrig-oneshot.txt
+        - One-shot LED trigger for both sporadic and dense events.
+ledtrig-transient.txt
+        - LED Transient Trigger, one shot timer activation.
diff --git a/Documentation/m68k/00-INDEX b/Documentation/m68k/00-INDEX
index a014e9f00765..2be8c6b00e74 100644
--- a/Documentation/m68k/00-INDEX
+++ b/Documentation/m68k/00-INDEX
@@ -1,5 +1,7 @@
 00-INDEX
         - this file
+README.buddha
+        - Amiga Buddha and Catweasel IDE Driver
 kernel-options.txt
         - command line options for Linux/m68k
 
diff --git a/Documentation/networking/00-INDEX b/Documentation/networking/00-INDEX
index f11580f8719a..557b6ef70c26 100644
--- a/Documentation/networking/00-INDEX
+++ b/Documentation/networking/00-INDEX
@@ -6,8 +6,14 @@
         - information on the 3Com Etherlink III Series Ethernet cards.
 6pack.txt
         - info on the 6pack protocol, an alternative to KISS for AX.25
-DLINK.txt
-        - info on the D-Link DE-600/DE-620 parallel port pocket adapters
+LICENSE.qla3xxx
+        - GPLv2 for QLogic Linux Networking HBA Driver
+LICENSE.qlge
+        - GPLv2 for QLogic Linux qlge NIC Driver
+LICENSE.qlcnic
+        - GPLv2 for QLogic Linux qlcnic NIC Driver
+Makefile
+        - Makefile for docsrc.
 PLIP.txt
         - PLIP: The Parallel Line Internet Protocol device driver
 README.ipw2100
@@ -17,7 +23,7 @@ README.ipw2200
 README.sb1000
         - info on General Instrument/NextLevel SURFboard1000 cable modem.
 alias.txt
-        - info on using alias network devices 
+        - info on using alias network devices.
 arcnet-hardware.txt
         - tons of info on ARCnet, hubs, jumper settings for ARCnet cards, etc.
 arcnet.txt
@@ -80,7 +86,7 @@ framerelay.txt
         - info on using Frame Relay/Data Link Connection Identifier (DLCI).
 gen_stats.txt
         - Generic networking statistics for netlink users.
-generic_hdlc.txt
+generic-hdlc.txt
         - The generic High Level Data Link Control (HDLC) layer.
 generic_netlink.txt
         - info on Generic Netlink
@@ -88,6 +94,8 @@ gianfar.txt
         - Gianfar Ethernet Driver.
 i40e.txt
         - README for the Intel Ethernet Controller XL710 Driver (i40e).
+i40evf.txt
+        - Short note on the Driver for the Intel(R) XL710 X710 Virtual Function
 ieee802154.txt
         - Linux IEEE 802.15.4 implementation, API and drivers
 igb.txt
@@ -102,6 +110,8 @@ ipddp.txt
         - AppleTalk-IP Decapsulation and AppleTalk-IP Encapsulation
 iphase.txt
         - Interphase PCI ATM (i)Chip IA Linux driver info.
+ipsec.txt
+        - Note on not compressing IPSec payload and resulting failed policy check.
 ipv6.txt
         - Options to the ipv6 kernel module.
 ipvs-sysctl.txt
@@ -120,6 +130,8 @@ lapb-module.txt
         - programming information of the LAPB module.
 ltpc.txt
         - the Apple or Farallon LocalTalk PC card driver
+mac80211-auth-assoc-deauth.txt
+        - authentication and association / deauth-disassoc with max80211
 mac80211-injection.txt
         - HOWTO use packet injection with mac80211
 multiqueue.txt
@@ -134,6 +146,10 @@ netdevices.txt
         - info on network device driver functions exported to the kernel.
 netif-msg.txt
         - Design of the network interface message level setting (NETIF_MSG_*).
+netlink_mmap.txt
+        - memory mapped I/O with netlink
+nf_conntrack-sysctl.txt
+        - list of netfilter-sysctl knobs.
 nfc.txt
         - The Linux Near Field Communication (NFS) subsystem.
 openvswitch.txt
@@ -176,7 +192,7 @@ skfp.txt
         - SysKonnect FDDI (SK-5xxx, Compaq Netelligent) driver info.
 smc9.txt
         - the driver for SMC's 9000 series of Ethernet cards
-spider-net.txt
+spider_net.txt
         - README for the Spidernet Driver (as found in PS3 / Cell BE).
 stmmac.txt
         - README for the STMicro Synopsys Ethernet driver.
@@ -188,6 +204,8 @@ tcp.txt
         - short blurb on how TCP output takes place.
 tcp-thin.txt
         - kernel tuning options for low rate 'thin' TCP streams.
+team.txt
+        - pointer to information for ethernet teaming devices.
 tlan.txt
         - ThunderLAN (Compaq Netelligent 10/100, Olicom OC-2xxx) driver info.
 tproxy.txt
@@ -200,6 +218,8 @@ vortex.txt
         - info on using 3Com Vortex (3c590, 3c592, 3c595, 3c597) Ethernet cards.
 vxge.txt
         - README for the Neterion X3100 PCIe Server Adapter.
+vxlan.txt
+        - Virtual extensible LAN overview
 x25.txt
         - general info on X.25 development.
 x25-iface.txt
diff --git a/Documentation/networking/3c505.txt b/Documentation/networking/3c505.txt
deleted file mode 100644
index 72f38b13101d..000000000000
--- a/Documentation/networking/3c505.txt
+++ /dev/null
@@ -1,45 +0,0 @@
-The 3Com Etherlink Plus (3c505) driver.
-
-This driver now uses DMA.  There is currently no support for PIO operation.
-The default DMA channel is 6; this is _not_ autoprobed, so you must
-make sure you configure it correctly.  If loading the driver as a
-module, you can do this with "modprobe 3c505 dma=n".  If the driver is
-linked statically into the kernel, you must either use an "ether="
-statement on the command line, or change the definition of ELP_DMA in 3c505.h.
-
-The driver will warn you if it has to fall back on the compiled in
-default DMA channel. 
-
-If no base address is given at boot time, the driver will autoprobe
-ports 0x300, 0x280 and 0x310 (in that order).  If no IRQ is given, the driver
-will try to probe for it.
-
-The driver can be used as a loadable module.
-
-Theoretically, one instance of the driver can now run multiple cards,
-in the standard way (when loading a module, say "modprobe 3c505
-io=0x300,0x340 irq=10,11 dma=6,7" or whatever).  I have not tested
-this, though.
-
-The driver may now support revision 2 hardware; the dependency on
-being able to read the host control register has been removed.  This
-is also untested, since I don't have a suitable card.
-
-Known problems:
- I still see "DMA upload timed out" messages from time to time.  These
-seem to be fairly non-fatal though.
- The card is old and slow.
-
-To do:
- Improve probe/setup code
- Test multicast and promiscuous operation
-
-Authors:
- The driver is mainly written by Craig Southeren, email
- <craigs@ineluki.apana.org.au>.
- Parts of the driver (adapting the driver to 1.1.4+ kernels,
- IRQ/address detection, some changes) and this README by
- Juha Laiho <jlaiho@ichaos.nullnet.fi>.
- DMA mode, more fixes, etc, by Philip Blundell <pjb27@cam.ac.uk>
- Multicard support, Software configurable DMA, etc., by
- Christopher Collins <ccollins@pcug.org.au>
diff --git a/Documentation/phy.txt b/Documentation/phy.txt
index 0103e4b15b0e..ebff6ee52441 100644
--- a/Documentation/phy.txt
+++ b/Documentation/phy.txt
@@ -75,14 +75,26 @@ Before the controller can make use of the PHY, it has to get a reference to
 it. This framework provides the following APIs to get a reference to the PHY.
 
 struct phy *phy_get(struct device *dev, const char *string);
+struct phy *phy_optional_get(struct device *dev, const char *string);
 struct phy *devm_phy_get(struct device *dev, const char *string);
-
-phy_get and devm_phy_get can be used to get the PHY. In the case of dt boot,
-the string arguments should contain the phy name as given in the dt data and
-in the case of non-dt boot, it should contain the label of the PHY.
-The only difference between the two APIs is that devm_phy_get associates the
-device with the PHY using devres on successful PHY get. On driver detach,
-release function is invoked on the the devres data and devres data is freed.
+struct phy *devm_phy_optional_get(struct device *dev, const char *string);
+
+phy_get, phy_optional_get, devm_phy_get and devm_phy_optional_get can
+be used to get the PHY. In the case of dt boot, the string arguments
+should contain the phy name as given in the dt data and in the case of
+non-dt boot, it should contain the label of the PHY.  The two
+devm_phy_get associates the device with the PHY using devres on
+successful PHY get. On driver detach, release function is invoked on
+the the devres data and devres data is freed. phy_optional_get and
+devm_phy_optional_get should be used when the phy is optional. These
+two functions will never return -ENODEV, but instead returns NULL when
+the phy cannot be found.
+
+It should be noted that NULL is a valid phy reference. All phy
+consumer calls on the NULL phy become NOPs. That is the release calls,
+the phy_init() and phy_exit() calls, and phy_power_on() and
+phy_power_off() calls are all NOP when applied to a NULL phy. The NULL
+phy is useful in devices for handling optional phy devices.
 
 5. Releasing a reference to the PHY
 
diff --git a/Documentation/power/00-INDEX b/Documentation/power/00-INDEX
index a4d682f54231..ad04cc8097ed 100644
--- a/Documentation/power/00-INDEX
+++ b/Documentation/power/00-INDEX
@@ -4,6 +4,8 @@ apm-acpi.txt
         - basic info about the APM and ACPI support.
 basic-pm-debugging.txt
         - Debugging suspend and resume
+charger-manager.txt
+        - Battery charger management.
 devices.txt
         - How drivers interact with system-wide power management
 drivers-testing.txt
@@ -22,6 +24,8 @@ pm_qos_interface.txt
         - info on Linux PM Quality of Service interface
 power_supply_class.txt
         - Tells userspace about battery, UPS, AC or DC power supply properties
+runtime_pm.txt
+        - Power management framework for I/O devices.
 s2ram.txt
         - How to get suspend to ram working (and debug it when it isn't)
 states.txt
@@ -38,7 +42,5 @@ tricks.txt
         - How to trick software suspend (to disk) into working when it isn't
 userland-swsusp.txt
         - Experimental implementation of software suspend in userspace
-video_extension.txt
-        - ACPI video extensions
 video.txt
         - Video issues during resume from suspend
diff --git a/Documentation/ptp/testptp.c b/Documentation/ptp/testptp.c
index a74d0a84d329..4aba0436da65 100644
--- a/Documentation/ptp/testptp.c
+++ b/Documentation/ptp/testptp.c
@@ -117,6 +117,7 @@ static void usage(char *progname)
                 " -f val     adjust the ptp clock frequency by 'val' ppb\n"
                 " -g         get the ptp clock time\n"
                 " -h         prints this message\n"
+                " -i val     index for event/trigger\n"
                 " -k val     measure the time offset between system and phc clock\n"
                 "            for 'val' times (Maximum 25)\n"
                 " -p val     enable output with a period of 'val' nanoseconds\n"
@@ -154,6 +155,7 @@ int main(int argc, char *argv[])
         int capabilities = 0;
         int extts = 0;
         int gettime = 0;
+        int index = 0;
         int oneshot = 0;
         int pct_offset = 0;
         int n_samples = 0;
@@ -167,7 +169,7 @@ int main(int argc, char *argv[])
 
         progname = strrchr(argv[0], '/');
         progname = progname ? 1+progname : argv[0];
-        while (EOF != (c = getopt(argc, argv, "a:A:cd:e:f:ghk:p:P:sSt:v"))) {
+        while (EOF != (c = getopt(argc, argv, "a:A:cd:e:f:ghi:k:p:P:sSt:v"))) {
                 switch (c) {
                 case 'a':
                         oneshot = atoi(optarg);
@@ -190,6 +192,9 @@ int main(int argc, char *argv[])
                 case 'g':
                         gettime = 1;
                         break;
+                case 'i':
+                        index = atoi(optarg);
+                        break;
                 case 'k':
                         pct_offset = 1;
                         n_samples = atoi(optarg);
@@ -301,7 +306,7 @@ int main(int argc, char *argv[])
 
         if (extts) {
                 memset(&extts_request, 0, sizeof(extts_request));
-                extts_request.index = 0;
+                extts_request.index = index;
                 extts_request.flags = PTP_ENABLE_FEATURE;
                 if (ioctl(fd, PTP_EXTTS_REQUEST, &extts_request)) {
                         perror("PTP_EXTTS_REQUEST");
@@ -375,7 +380,7 @@ int main(int argc, char *argv[])
                         return -1;
                 }
                 memset(&perout_request, 0, sizeof(perout_request));
-                perout_request.index = 0;
+                perout_request.index = index;
                 perout_request.start.sec = ts.tv_sec + 2;
                 perout_request.start.nsec = 0;
                 perout_request.period.sec = 0;
diff --git a/Documentation/s390/00-INDEX b/Documentation/s390/00-INDEX
index 3a2b96302ecc..10c874ebdfe5 100644
--- a/Documentation/s390/00-INDEX
+++ b/Documentation/s390/00-INDEX
@@ -16,11 +16,13 @@ Debugging390.txt
         - hints for debugging on s390 systems.
 driver-model.txt
         - information on s390 devices and the driver model.
+kvm.txt
+        - ioctl calls to /dev/kvm on s390.
 monreader.txt
         - information on accessing the z/VM monitor stream from Linux.
+qeth.txt
+        - HiperSockets Bridge Port Support.
 s390dbf.txt
         - information on using the s390 debug feature.
-TAPE
-        - information on the driver for channel-attached tapes.
-zfcpdump
+zfcpdump.txt
         - information on the s390 SCSI dump tool.
diff --git a/Documentation/scheduler/00-INDEX b/Documentation/scheduler/00-INDEX
index 46702e4f89c9..eccf7ad2e7f9 100644
--- a/Documentation/scheduler/00-INDEX
+++ b/Documentation/scheduler/00-INDEX
@@ -2,6 +2,8 @@
         - this file.
 sched-arch.txt
         - CPU Scheduler implementation hints for architecture specific code.
+sched-bwc.txt
+        - CFS bandwidth control overview.
 sched-design-CFS.txt
         - goals, design and implementation of the Completely Fair Scheduler.
 sched-domains.txt
diff --git a/Documentation/scsi/00-INDEX b/Documentation/scsi/00-INDEX
index 2044be565d93..c4b978a72f78 100644
--- a/Documentation/scsi/00-INDEX
+++ b/Documentation/scsi/00-INDEX
@@ -36,6 +36,8 @@ NinjaSCSI.txt
         - info on WorkBiT NinjaSCSI-32/32Bi driver
 aacraid.txt
         - Driver supporting Adaptec RAID controllers
+advansys.txt
+        - List of Advansys Host Adapters
 aha152x.txt
         - info on driver for Adaptec AHA152x based adapters
 aic79xx.txt
@@ -44,6 +46,12 @@ aic7xxx.txt
         - info on driver for Adaptec controllers
 arcmsr_spec.txt
         - ARECA FIRMWARE SPEC (for IOP331 adapter)
+bfa.txt
+        - Brocade FC/FCOE adapter driver.
+bnx2fc.txt
+        - FCoE hardware offload for Broadcom network interfaces.
+cxgb3i.txt
+        - Chelsio iSCSI Linux Driver
 dc395x.txt
         - README file for the dc395x SCSI driver
 dpti.txt
@@ -52,18 +60,24 @@ dtc3x80.txt
         - info on driver for DTC 2x80 based adapters
 g_NCR5380.txt
         - info on driver for NCR5380 and NCR53c400 based adapters
+hpsa.txt
+        - HP Smart Array Controller SCSI driver.
 hptiop.txt
         - HIGHPOINT ROCKETRAID 3xxx RAID DRIVER
 in2000.txt
         - info on in2000 driver
 libsas.txt
         - Serial Attached SCSI management layer.
+link_power_management_policy.txt
+        - Link power management options.
 lpfc.txt
         - LPFC driver release notes
 megaraid.txt
         - Common Management Module, shared code handling ioctls for LSI drivers
 ncr53c8xx.txt
         - info on driver for NCR53c8xx based adapters
+osd.txt
+        Object-Based Storage Device, command set introduction.
 osst.txt
         - info on driver for OnStream SC-x0 SCSI tape
 ppa.txt
@@ -74,6 +88,8 @@ scsi-changer.txt
         - README for the SCSI media changer driver
 scsi-generic.txt
         - info on the sg driver for generic (non-disk/CD/tape) SCSI devices.
+scsi-parameters.txt
+        - List of SCSI-parameters to pass to the kernel at module load-time.
 scsi.txt
         - short blurb on using SCSI support as a module.
 scsi_mid_low_api.txt
diff --git a/Documentation/serial/00-INDEX b/Documentation/serial/00-INDEX
index 1f1b22fbd739..f9c6b5ed03e7 100644
--- a/Documentation/serial/00-INDEX
+++ b/Documentation/serial/00-INDEX
@@ -4,10 +4,12 @@ README.cycladesZ
         - info on Cyclades-Z firmware loading.
 digiepca.txt
         - info on Digi Intl. {PC,PCI,EISA}Xx and Xem series cards.
-hayes-esp.txt
-        - info on using the Hayes ESP serial driver.
+driver
+        - intro to the low level serial driver.
 moxa-smartio
         - file with info on installing/using Moxa multiport serial driver.
+n_gsm.txt
+        - GSM 0710 tty multiplexer howto.
 riscom8.txt
         - notes on using the RISCom/8 multi-port serial driver.
 rocket.txt
diff --git a/Documentation/spi/00-INDEX b/Documentation/spi/00-INDEX
new file mode 100644
index 000000000000..a128fa835512
--- /dev/null
+++ b/Documentation/spi/00-INDEX
@@ -0,0 +1,22 @@
+00-INDEX
+        - this file.
+Makefile
+        - Makefile for the example sourcefiles.
+butterfly
+        - AVR Butterfly SPI driver overview and pin configuration.
+ep93xx_spi
+        - Basic EP93xx SPI driver configuration.
+pxa2xx
+        - PXA2xx SPI master controller build by spi_message fifo wq
+spidev
+        - Intro to the userspace API for spi devices
+spidev_fdx.c
+        - spidev example file
+spi-lm70llp
+        - Connecting an LM70-LLP sensor to the kernel via the SPI subsys.
+spi-sc18is602
+        - NXP SC18IS602/603 I2C-bus to SPI bridge
+spi-summary
+        - (Linux) SPI overview. If unsure about SPI or SPI in Linux, start here.
+spidev_test.c
+        - SPI testing utility.
diff --git a/Documentation/spi/spi-summary b/Documentation/spi/spi-summary
index f72e0d1e0da8..7982bcc4d151 100644
--- a/Documentation/spi/spi-summary
+++ b/Documentation/spi/spi-summary
@@ -543,7 +543,22 @@ SPI MASTER METHODS
         queuing transfers that arrive in the meantime. When the driver is
         finished with this message, it must call
         spi_finalize_current_message() so the subsystem can issue the next
-        transfer. This may sleep.
+        message. This may sleep.
+
+    master->transfer_one(struct spi_master *master, struct spi_device *spi,
+                         struct spi_transfer *transfer)
+        The subsystem calls the driver to transfer a single transfer while
+        queuing transfers that arrive in the meantime. When the driver is
+        finished with this transfer, it must call
+        spi_finalize_current_transfer() so the subsystem can issue the next
+        transfer. This may sleep. Note: transfer_one and transfer_one_message
+        are mutually exclusive; when both are set, the generic subsystem does
+        not call your transfer_one callback.
+
+        Return values:
+        negative errno: error
+        0: transfer is finished
+        1: transfer is still in progress
 
     DEPRECATED METHODS
 
diff --git a/Documentation/timers/00-INDEX b/Documentation/timers/00-INDEX
index ef2ccbf77fa2..6d042dc1cce0 100644
--- a/Documentation/timers/00-INDEX
+++ b/Documentation/timers/00-INDEX
@@ -8,6 +8,8 @@ hpet_example.c
         - sample hpet timer test program
 hrtimers.txt
         - subsystem for high-resolution kernel timers
+Makefile
+        - Build and link hpet_example
 NO_HZ.txt
         - Summary of the different methods for the scheduler clock-interrupts management.
 timers-howto.txt
diff --git a/Documentation/virtual/kvm/00-INDEX b/Documentation/virtual/kvm/00-INDEX
index 641ec9220179..fee9f2bf9c64 100644
--- a/Documentation/virtual/kvm/00-INDEX
+++ b/Documentation/virtual/kvm/00-INDEX
@@ -20,5 +20,7 @@ ppc-pv.txt
         - the paravirtualization interface on PowerPC.
 review-checklist.txt
         - review checklist for KVM patches.
+s390-diag.txt
+        - Diagnose hypercall description (for IBM S/390)
 timekeeping.txt
         - timekeeping virtualization for x86-based architectures.
diff --git a/Documentation/vm/00-INDEX b/Documentation/vm/00-INDEX
index a39d06680e1c..081c49777abb 100644
--- a/Documentation/vm/00-INDEX
+++ b/Documentation/vm/00-INDEX
@@ -16,8 +16,6 @@ hwpoison.txt
         - explains what hwpoison is
 ksm.txt
         - how to use the Kernel Samepage Merging feature.
-locking
-        - info on how locking and synchronization is done in the Linux vm code.
 numa
         - information about NUMA specific code in the Linux vm.
 numa_memory_policy.txt
@@ -32,6 +30,8 @@ slub.txt
         - a short users guide for SLUB.
 soft-dirty.txt
         - short explanation for soft-dirty PTEs
+split_page_table_lock
+        - Separate per-table lock to improve scalability of the old page_table_lock.
 transhuge.txt
         - Transparent Hugepage Support, alternative way of using hugepages.
 unevictable-lru.txt
diff --git a/Documentation/w1/masters/00-INDEX b/Documentation/w1/masters/00-INDEX
index d63fa024ac05..8330cf9325f0 100644
--- a/Documentation/w1/masters/00-INDEX
+++ b/Documentation/w1/masters/00-INDEX
@@ -4,7 +4,9 @@ ds2482
         - The Maxim/Dallas Semiconductor DS2482 provides 1-wire busses.
 ds2490
         - The Maxim/Dallas Semiconductor DS2490 builds USB <-> W1 bridges.
-mxc_w1
+mxc-w1
         - W1 master controller driver found on Freescale MX2/MX3 SoCs
+omap-hdq
+        - HDQ/1-wire module of TI OMAP 2430/3430.
 w1-gpio
         - GPIO 1-wire bus master driver.
diff --git a/Documentation/w1/slaves/00-INDEX b/Documentation/w1/slaves/00-INDEX
index 75613c9ac4db..6e18c70c3474 100644
--- a/Documentation/w1/slaves/00-INDEX
+++ b/Documentation/w1/slaves/00-INDEX
@@ -4,3 +4,5 @@ w1_therm
         - The Maxim/Dallas Semiconductor ds18*20 temperature sensor.
 w1_ds2423
         - The Maxim/Dallas Semiconductor ds2423 counter device.
+w1_ds28e04
+        - The Maxim/Dallas Semiconductor ds28e04 eeprom.
diff --git a/Documentation/x86/00-INDEX b/Documentation/x86/00-INDEX
index f37b46d34861..692264456f0f 100644
--- a/Documentation/x86/00-INDEX
+++ b/Documentation/x86/00-INDEX
@@ -1,6 +1,20 @@
 00-INDEX
         - this file
-mtrr.txt
-        - how to use x86 Memory Type Range Registers to increase performance
+boot.txt
+        - List of boot protocol versions
+early-microcode.txt
+        - How to load microcode from an initrd-CPIO archive early to fix CPU issues.
+earlyprintk.txt
+        - Using earlyprintk with a USB2 debug port key.
+entry_64.txt
+        - Describe (some of the) kernel entry points for x86.
 exception-tables.txt
         - why and how Linux kernel uses exception tables on x86
+mtrr.txt
+        - how to use x86 Memory Type Range Registers to increase performance
+pat.txt
+        - Page Attribute Table intro and API
+usb-legacy-support.txt
+        - how to fix/avoid quirks when using emulated PS/2 mouse/keyboard.
+zero-page.txt
+        - layout of the first page of memory.
diff --git a/Documentation/zh_CN/arm64/booting.txt b/Documentation/zh_CN/arm64/booting.txt
index 28fa325b7461..6f6d956ac1c9 100644
--- a/Documentation/zh_CN/arm64/booting.txt
+++ b/Documentation/zh_CN/arm64/booting.txt
@@ -7,7 +7,7 @@ help.  Contact the Chinese maintainer if this translation is outdated
 or if there is a problem with the translation.
 
 Maintainer: Will Deacon <will.deacon@arm.com>
-Chinese maintainer: Fu Wei <tekkamanninja@gmail.com>
+Chinese maintainer: Fu Wei <wefu@redhat.com>
 ---------------------------------------------------------------------
 Documentation/arm64/booting.txt 的中文翻译
 
@@ -16,9 +16,9 @@ Documentation/arm64/booting.txt 的中文翻译
 译存在问题，请�系中文版维护者。
 
 英文版维护者： Will Deacon <will.deacon@arm.com>
-中文版维护者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
-中文版翻译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
-中文版校译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+中文版维护者： 傅炜  Fu Wei <wefu@redhat.com>
+中文版翻译者： 傅炜  Fu Wei <wefu@redhat.com>
+中文版校译者： 傅炜  Fu Wei <wefu@redhat.com>
 
 以下为正文
 ---------------------------------------------------------------------
@@ -64,8 +64,8 @@ RAM，或�能使用对这个设备已知的 RAM 信�，还�能使用任何
 
 必�性: 强制
 
-设备树数��（dtb）大�必须�大于 2 MB，且�于从内核映�起始算起第一个
-512MB 内的 2MB 边界上。这使得内核�以通过�始页表中的�个节�述符�
+设备树数��（dtb）必须 8 字节对�，并�于从内核映�起始算起第一个 512MB
+内，且�得跨越 2MB 对�边界。这使得内核�以通过�始页表中的�个节�述符�
 映射此数��。
 
 
@@ -84,13 +84,23 @@ AArch64 内核当�没有�供自解压代�，因此如果使用了压缩内
 
 必�性: 强制
 
-已解压的内核映�包�一个 32 字节的头，内容如下：
+已解压的内核映�包�一个 64 字节的头，内容如下：
 
-  u32 magic     = 0x14000008;   /* 跳转到 stext, �端 */
-  u32 res0      = 0;            /* �留 */
+  u32 code0;                    /* �执行代� */
+  u32 code1;                    /* �执行代� */
   u64 text_offset;              /* 映�装载�移 */
+  u64 res0      = 0;            /* �留 */
   u64 res1      = 0;            /* �留 */
   u64 res2      = 0;            /* �留 */
+  u64 res3      = 0;            /* �留 */
+  u64 res4      = 0;            /* �留 */
+  u32 magic     = 0x644d5241;   /* 魔数, �端, "ARM\x64" */
+  u32 res5 = 0;                 /* �留 */
+
+
+映�头注释：
+
+- code0/code1 负责跳转到 stext.
 
 映�必须�于系统 RAM 起始处的特定�移（当�是 0x80000）。系统 RAM
 的起始地�必须是以 2MB 对�的。
@@ -118,9 +128,9 @@ AArch64 内核当�没有�供自解压代�，因此如果使用了压缩内
   外部高速缓存（如果存在）必须�置并�用。
 
 - 架构计时器
-  CNTFRQ 必须设定为计时器的频率。
-  如果在 EL1 模�下进入内核，则 CNTHCTL_EL2 中的 EL1PCTEN (bit 0)
-  必须置�。
+  CNTFRQ 必须设定为计时器的频率，且 CNTVOFF 必须设定为对所有 CPU
+  都一致的值。如果在 EL1 模�下进入内核，则 CNTHCTL_EL2 中的
+  EL1PCTEN (bit 0) 必须置�。
 
 - 一致性
   通过内核�动的所有 CPU 在内核入�地�上必须处于相�的一致性域中。
@@ -131,23 +141,40 @@ AArch64 内核当�没有�供自解压代�，因此如果使用了压缩内
   在进入内核映�的异常级中，所有构架中�写的系统寄存器必须通过软件
   在一个更高的异常级别下�始化，以防止在 未知 状�下�行。
 
+以上对于 CPU 模��高速缓存�MMU�架构计时器�一致性�系统寄存器的
+必��件�述适用于所有 CPU。所有 CPU 必须在�一异常级别跳入内核。
+
 引导装载程�必须在�个 CPU 处于以下状�时跳入内核入�：
 
 - 主 CPU 必须直接跳入内核映�的第一�指令。通过此 CPU 传递的设备树
-  数��必须在�个 CPU 节点中包�以下内容：
-
-    1�‘enable-method’属性。目�，此字段支�的值仅为字符串“spin-table�。
-
-    2�‘cpu-release-addr’标识一个 64-bit��始化为零的内存�置。
+  数��必须在�个 CPU 节点中包�一个 ‘enable-method’ 属性，所
+  支�的 enable-method 请�下文。
 
   引导装载程�必须生�这些设备树属性，并在跳入内核入�之�将其�入
   数��。
 
-- 任何辅助 CPU 必须在内存�留区（通过设备树中的 /memreserve/ 域传递
+- enable-method 为 “spin-table� 的 CPU 必须在它们的 CPU
+  节点中包�一个 ‘cpu-release-addr’ 属性。这个属性标识了一个
+  64 �自然对�且�始化为零的内存�置。
+
+  这些 CPU 必须在内存�留区（通过设备树中的 /memreserve/ 域传递
   给内核）中自旋于内核之外，轮询它们的 cpu-release-addr �置（必须
   包�在�留区中）。�通过�入 wfe 指令��低忙循环开销，而主 CPU 将
   �出 sev 指令。当对 cpu-release-addr 所指�置的读��作返回�零值
-  时，CPU 必须直接跳入此值所指�的地�。
+  时，CPU 必须跳入此值所指�的地�。此值为一个�独的 64 ��端值，
+  因此 CPU 须在跳转�将所读�的值转�为其本身的端模�。
+
+- enable-method 为 “psci� 的 CPU ��在内核外（比如，在
+  memory 节点中�述为内核空间的内存区外，或在通过设备树 /memreserve/
+  域中�述为内核�留区的空间中）。内核将会�起在 ARM 文档（编�
+  ARM DEN 0022A：用于 ARM 上的电�状��调接�系统软件）中�述的
+  CPU_ON 调用�将 CPU 带入内核。
+
+  *译者注:到文档翻译时，此文档已更新为 ARM DEN 0022B。
+
+  设备树必须包�一个 ‘psci’ 节点，请�考以下文档：
+  Documentation/devicetree/bindings/arm/psci.txt
+
 
 - 辅助 CPU 通用寄存器设置
   x0 = 0 (�留，将��能使用)
diff --git a/Documentation/zh_CN/arm64/memory.txt b/Documentation/zh_CN/arm64/memory.txt
index a5f6283829f9..a782704c1cb5 100644
--- a/Documentation/zh_CN/arm64/memory.txt
+++ b/Documentation/zh_CN/arm64/memory.txt
@@ -7,7 +7,7 @@ help.  Contact the Chinese maintainer if this translation is outdated
 or if there is a problem with the translation.
 
 Maintainer: Catalin Marinas <catalin.marinas@arm.com>
-Chinese maintainer: Fu Wei <tekkamanninja@gmail.com>
+Chinese maintainer: Fu Wei <wefu@redhat.com>
 ---------------------------------------------------------------------
 Documentation/arm64/memory.txt 的中文翻译
 
@@ -16,9 +16,9 @@ Documentation/arm64/memory.txt 的中文翻译
 译存在问题，请�系中文版维护者。
 
 英文版维护者： Catalin Marinas <catalin.marinas@arm.com>
-中文版维护者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
-中文版翻译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
-中文版校译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+中文版维护者： 傅炜  Fu Wei <wefu@redhat.com>
+中文版翻译者： 傅炜  Fu Wei <wefu@redhat.com>
+中文版校译者： 傅炜  Fu Wei <wefu@redhat.com>
 
 以下为正文
 ---------------------------------------------------------------------
@@ -41,7 +41,7 @@ AArch64 Linux 使用页大å°�为 4KB çš„ 3 级转æ�¢è¡¨é…�置，对于用户和å
 TTBR1 中，且从�写入 TTBR0。
 
 
-AArch64 Linux 内存布局：
+AArch64 Linux 在页大�为 4KB 时的内存布局：
 
 起始地�                    结�地�                    大�          用途
 -----------------------------------------------------------------------
@@ -55,15 +55,42 @@ ffffffbc00000000	ffffffbdffffffff	   8GB		vmemmap
 
 ffffffbe00000000        ffffffbffbbfffff          ~8GB          [防护页，未�用于 vmmemap]
 
+ffffffbffbc00000        ffffffbffbdfffff           2MB          earlyprintk 设备
+
 ffffffbffbe00000        ffffffbffbe0ffff          64KB          PCI I/O 空间
 
-ffffffbbffff0000        ffffffbcffffffff          ~2MB          [防护页]
+ffffffbffbe10000        ffffffbcffffffff          ~2MB          [防护页]
 
 ffffffbffc000000        ffffffbfffffffff          64MB          模�
 
 ffffffc000000000        ffffffffffffffff         256GB          内核逻辑内存映射
 
 
+AArch64 Linux 在页大�为 64KB 时的内存布局：
+
+起始地�                    结�地�                    大�          用途
+-----------------------------------------------------------------------
+0000000000000000        000003ffffffffff           4TB          用户空间
+
+fffffc0000000000        fffffdfbfffeffff          ~2TB          vmalloc
+
+fffffdfbffff0000        fffffdfbffffffff          64KB          [防护页]
+
+fffffdfc00000000        fffffdfdffffffff           8GB          vmemmap
+
+fffffdfe00000000        fffffdfffbbfffff          ~8GB          [防护页，未�用于 vmmemap]
+
+fffffdfffbc00000        fffffdfffbdfffff           2MB          earlyprintk 设备
+
+fffffdfffbe00000        fffffdfffbe0ffff          64KB          PCI I/O 空间
+
+fffffdfffbe10000        fffffdfffbffffff          ~2MB          [防护页]
+
+fffffdfffc000000        fffffdffffffffff          64MB          模�
+
+fffffe0000000000        ffffffffffffffff           2TB          内核逻辑内存映射
+
+
 4KB 页大�的转�表查找：
 
 +--------+--------+--------+--------+--------+--------+--------+--------+
@@ -91,3 +118,10 @@ ffffffc000000000	ffffffffffffffff	 256GB		内核逻辑内存映射
  |                 |    +--------------------------> [41:29] L2 索引 (仅使用 38:29 )
  |                 +-------------------------------> [47:42] L1 索引 (未使用)
  +-------------------------------------------------> [63] TTBR0/1
+
+当使用 KVM 时, 管�程�（hypervisor）在 EL2 中通过相对内核虚拟地�的
+一个固定�移�映射内核页（内核虚拟地�的高 24 �设为零）:
+
+起始地�                    结�地�                    大�          用途
+-----------------------------------------------------------------------
+0000004000000000        0000007fffffffff         256GB          在 HYP 中映射的内核对象
diff --git a/Documentation/zh_CN/arm64/tagged-pointers.txt b/Documentation/zh_CN/arm64/tagged-pointers.txt
new file mode 100644
index 000000000000..2664d1bd5a1c
--- /dev/null
+++ b/Documentation/zh_CN/arm64/tagged-pointers.txt
@@ -0,0 +1,52 @@
+Chinese translated version of Documentation/arm64/tagged-pointers.txt
+
+If you have any comment or update to the content, please contact the
+original document maintainer directly.  However, if you have a problem
+communicating in English you can also ask the Chinese maintainer for
+help.  Contact the Chinese maintainer if this translation is outdated
+or if there is a problem with the translation.
+
+Maintainer: Will Deacon <will.deacon@arm.com>
+Chinese maintainer: Fu Wei <wefu@redhat.com>
+---------------------------------------------------------------------
+Documentation/arm64/tagged-pointers.txt 的中文翻译
+
+如果想评论或更新本文的内容，请直接�系原文档的维护者。如果你使用英文
+交�有困难的�，也�以�中文版维护者求助。如果本翻译更新��时或者翻
+译存在问题，请�系中文版维护者。
+
+英文版维护者： Will Deacon <will.deacon@arm.com>
+中文版维护者： 傅炜  Fu Wei <wefu@redhat.com>
+中文版翻译者： 傅炜  Fu Wei <wefu@redhat.com>
+中文版校译者： 傅炜  Fu Wei <wefu@redhat.com>
+
+以下为正文
+---------------------------------------------------------------------
+                Linux 在 AArch64 中带标记的虚拟地�
+                =================================
+
+作者: Will Deacon <will.deacon@arm.com>
+日期: 2013 年 06 月 12 日
+
+本文档简述了在 AArch64 地�转�系统中�供的带标记的虚拟地��其在
+AArch64 Linux 中的潜在用途。
+
+内核�供的地�转�表�置使通过 TTBR0 完�的虚拟地�转�（�用户空间
+映射），其虚拟地�的最高 8 �（63:56）会被转�硬件所忽略。这�机制
+让这些��供应用程�自由使用，其注�事项如下：
+
+        (1) 内核�求所有传递到 EL1 的用户空间地�带有 0x00 标记。
+            这�味�任何�带用户空间虚拟地�的系统调用（syscall）
+            �数 *必须* 在陷入内核�使它们的最高字节被清零。
+
+        (2) �零标记在传递信�时�被�存。这�味�在应用程�中利用了
+            标记的信�处�函数无法�赖 siginfo_t 的用户空间虚拟
+            地�所�带的包�其内部域信�的标记。此规则的一个例外是
+            当信�是在调试观察点的异常处�程�中产生的，此时标记的
+            信�将被�存。
+
+        (3) 当使用带标记的指针时需特别留心，因为仅对两个虚拟地�
+            的高字节，C 编译器很�能无法判断它们是��的。
+
+此构架会阻止对带标记的 PC 指针的利用，因此在异常返回时，其高字节
+将被设置�一个为 “55� 的扩展符。
diff --git a/MAINTAINERS b/MAINTAINERS
index b2cf5cfb4d29..df8869d49c3f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -538,7 +538,7 @@ F:	arch/alpha/
 ALTERA UART/JTAG UART SERIAL DRIVERS
 M:      Tobias Klauser <tklauser@distanz.ch>
 L:      linux-serial@vger.kernel.org
-L:      nios2-dev@sopc.et.ntust.edu.tw (moderated for non-subscribers)
+L:      nios2-dev@lists.rocketboards.org (moderated for non-subscribers)
 S:      Maintained
 F:      drivers/tty/serial/altera_uart.c
 F:      drivers/tty/serial/altera_jtaguart.c
@@ -1860,6 +1860,7 @@ F:	drivers/net/ethernet/broadcom/bnx2x/
 
 BROADCOM BCM281XX/BCM11XXX ARM ARCHITECTURE
 M:      Christian Daudt <bcm@fixthebug.org>
+M:      Matt Porter <mporter@linaro.org>
 L:      bcm-kernel-feedback-list@broadcom.com
 T:      git git://git.github.com/broadcom/bcm11351
 S:      Maintained
@@ -2367,7 +2368,7 @@ F:	include/linux/cpufreq.h
 
 CPU FREQUENCY DRIVERS - ARM BIG LITTLE
 M:      Viresh Kumar <viresh.kumar@linaro.org>
-M:      Sudeep KarkadaNagesha <sudeep.karkadanagesha@arm.com>
+M:      Sudeep Holla <sudeep.holla@arm.com>
 L:      cpufreq@vger.kernel.org
 L:      linux-pm@vger.kernel.org
 W:      http://www.arm.com/products/processors/technologies/biglittleprocessing.php
@@ -2408,8 +2409,10 @@ F:	tools/power/cpupower/
 
 CPUSETS
 M:      Li Zefan <lizefan@huawei.com>
+L:      cgroups@vger.kernel.org
 W:      http://www.bullopensource.org/cpuset/
 W:      http://oss.sgi.com/projects/cpusets/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git
 S:      Maintained
 F:      Documentation/cgroups/cpusets.txt
 F:      include/linux/cpuset.h
@@ -2608,9 +2611,9 @@ DC395x SCSI driver
 M:      Oliver Neukum <oliver@neukum.org>
 M:      Ali Akcaagac <aliakc@web.de>
 M:      Jamie Lenehan <lenehan@twibble.org>
-W:      http://twibble.org/dist/dc395x/
 L:      dc395x@twibble.org
-L:      http://lists.twibble.org/mailman/listinfo/dc395x/
+W:      http://twibble.org/dist/dc395x/
+W:      http://lists.twibble.org/mailman/listinfo/dc395x/
 S:      Maintained
 F:      Documentation/scsi/dc395x.txt
 F:      drivers/scsi/dc395x.*
@@ -2857,7 +2860,7 @@ M:	Jani Nikula <jani.nikula@linux.intel.com>
 L:      intel-gfx@lists.freedesktop.org
 L:      dri-devel@lists.freedesktop.org
 Q:      http://patchwork.freedesktop.org/project/intel-gfx/
-T:      git git://people.freedesktop.org/~danvet/drm-intel
+T:      git git://anongit.freedesktop.org/drm-intel
 S:      Supported
 F:      drivers/gpu/drm/i915/
 F:      include/drm/i915*
@@ -3324,6 +3327,17 @@ S:	Maintained
 F:      include/linux/netfilter_bridge/
 F:      net/bridge/
 
+ETHERNET PHY LIBRARY
+M:      Florian Fainelli <f.fainelli@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      include/linux/phy.h
+F:      include/linux/phy_fixed.h
+F:      drivers/net/phy/
+F:      Documentation/networking/phy.txt
+F:      drivers/of/of_mdio.c
+F:      drivers/of/of_net.c
+
 EXT2 FILE SYSTEM
 M:      Jan Kara <jack@suse.cz>
 L:      linux-ext4@vger.kernel.org
@@ -7196,7 +7210,7 @@ S:	Maintained
 F:      drivers/net/ethernet/rdc/r6040.c
 
 RDS - RELIABLE DATAGRAM SOCKETS
-M:      Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
+M:      Chien Yen <chien.yen@oracle.com>
 L:      rds-devel@oss.oracle.com (moderated for non-subscribers)
 S:      Supported
 F:      net/rds/
@@ -8429,8 +8443,8 @@ TARGET SUBSYSTEM
 M:      Nicholas A. Bellinger <nab@linux-iscsi.org>
 L:      linux-scsi@vger.kernel.org
 L:      target-devel@vger.kernel.org
-L:      http://groups.google.com/group/linux-iscsi-target-dev
 W:      http://www.linux-iscsi.org
+W:      http://groups.google.com/group/linux-iscsi-target-dev
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending.git master
 S:      Supported
 F:      drivers/target/
@@ -9715,7 +9729,6 @@ F:	drivers/xen/*swiotlb*
 XFS FILESYSTEM
 P:      Silicon Graphics Inc
 M:      Dave Chinner <david@fromorbit.com>
-M:      Ben Myers <bpm@sgi.com>
 M:      xfs@oss.sgi.com
 L:      xfs@oss.sgi.com
 W:      http://oss.sgi.com/projects/xfs
diff --git a/Makefile b/Makefile
index 606ef7c4a544..81f1bf390310 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc4
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
@@ -605,10 +605,11 @@ endif
 ifdef CONFIG_CC_STACKPROTECTOR_REGULAR
   stackp-flag := -fstack-protector
   ifeq ($(call cc-option, $(stackp-flag)),)
-    $(warning Cannot use CONFIG_CC_STACKPROTECTOR: \
-              -fstack-protector not supported by compiler))
+    $(warning Cannot use CONFIG_CC_STACKPROTECTOR_REGULAR: \
+             -fstack-protector not supported by compiler)
   endif
-else ifdef CONFIG_CC_STACKPROTECTOR_STRONG
+else
+ifdef CONFIG_CC_STACKPROTECTOR_STRONG
   stackp-flag := -fstack-protector-strong
   ifeq ($(call cc-option, $(stackp-flag)),)
     $(warning Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: \
@@ -618,6 +619,7 @@ else
   # Force off for distro compilers that enable stack protector by default.
   stackp-flag := $(call cc-option, -fno-stack-protector)
 endif
+endif
 KBUILD_CFLAGS += $(stackp-flag)
 
 # This warning generated too much noise in a regular build.
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index b9d6a8b485e0..032030361bef 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -38,6 +38,7 @@ dtb-$(CONFIG_ARCH_AT91) += at91sam9g35ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += at91sam9x25ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += at91sam9x35ek.dtb
 # sama5d3
+dtb-$(CONFIG_ARCH_AT91) += at91-sama5d3_xplained.dtb
 dtb-$(CONFIG_ARCH_AT91) += sama5d31ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += sama5d33ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += sama5d34ek.dtb
@@ -208,7 +209,8 @@ dtb-$(CONFIG_ARCH_OMAP2PLUS) += omap2420-h4.dtb \
         omap3-n900.dtb \
         omap3-n9.dtb \
         omap3-n950.dtb \
-        omap3-tobi.dtb \
+        omap3-overo-tobi.dtb \
+        omap3-overo-storm-tobi.dtb \
         omap3-gta04.dtb \
         omap3-igep0020.dtb \
         omap3-igep0030.dtb \
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 4718ec4a4dbf..486880b74831 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -121,7 +121,7 @@
                 ti,model = "AM335x-EVMSK";
                 ti,audio-codec = <&tlv320aic3106>;
                 ti,mcasp-controller = <&mcasp1>;
-                ti,codec-clock-rate = <24576000>;
+                ti,codec-clock-rate = <24000000>;
                 ti,audio-routing =
                         "Headphone Jack",       "HPLOUT",
                         "Headphone Jack",       "HPROUT";
@@ -256,6 +256,12 @@
                 >;
         };
 
+        mmc1_pins: pinmux_mmc1_pins {
+                pinctrl-single,pins = <
+                        0x160 (PIN_INPUT | MUX_MODE7) /* spi0_cs1.gpio0_6 */
+                >;
+        };
+
         mcasp1_pins: mcasp1_pins {
                 pinctrl-single,pins = <
                         0x10c (PIN_INPUT_PULLDOWN | MUX_MODE4) /* mii1_crs.mcasp1_aclkx */
@@ -456,6 +462,9 @@
         status = "okay";
         vmmc-supply = <&vmmc_reg>;
         bus-width = <4>;
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc1_pins>;
+        cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
 };
 
 &sham {
diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
index 66609684d41b..9480cf891f8c 100644
--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
@@ -23,6 +23,7 @@
                 gpio0 = &gpio0;
                 gpio1 = &gpio1;
                 gpio2 = &gpio2;
+                eth3 = &eth3;
         };
 
         cpus {
@@ -291,7 +292,7 @@
                                 interrupts = <91>;
                         };
 
-                        ethernet@34000 {
+                        eth3: ethernet@34000 {
                                 compatible = "marvell,armada-370-neta";
                                 reg = <0x34000 0x4000>;
                                 interrupts = <14>;
diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
new file mode 100644
index 000000000000..ce1375595e5f
--- /dev/null
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -0,0 +1,229 @@
+/*
+ * at91-sama5d3_xplained.dts - Device Tree file for the SAMA5D3 Xplained board
+ *
+ *  Copyright (C) 2014 Atmel,
+ *                2014 Nicolas Ferre <nicolas.ferre@atmel.com>
+ *
+ * Licensed under GPLv2 or later.
+ */
+/dts-v1/;
+#include "sama5d36.dtsi"
+
+/ {
+        model = "SAMA5D3 Xplained";
+        compatible = "atmel,sama5d3-xplained", "atmel,sama5d3", "atmel,sama5";
+
+        chosen {
+                bootargs = "console=ttyS0,115200";
+        };
+
+        memory {
+                reg = <0x20000000 0x10000000>;
+        };
+
+        ahb {
+                apb {
+                        mmc0: mmc@f0000000 {
+                                pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_dat4_7 &pinctrl_mmc0_cd>;
+                                status = "okay";
+                                slot@0 {
+                                        reg = <0>;
+                                        bus-width = <8>;
+                                        cd-gpios = <&pioE 0 GPIO_ACTIVE_LOW>;
+                                };
+                        };
+
+                        spi0: spi@f0004000 {
+                                cs-gpios = <&pioD 13 0>;
+                                status = "okay";
+                        };
+
+                        can0: can@f000c000 {
+                                status = "okay";
+                        };
+
+                        i2c0: i2c@f0014000 {
+                                status = "okay";
+                        };
+
+                        i2c1: i2c@f0018000 {
+                                status = "okay";
+                        };
+
+                        macb0: ethernet@f0028000 {
+                                phy-mode = "rgmii";
+                                status = "okay";
+                        };
+
+                        usart0: serial@f001c000 {
+                                status = "okay";
+                        };
+
+                        usart1: serial@f0020000 {
+                                pinctrl-0 = <&pinctrl_usart1 &pinctrl_usart1_rts_cts>;
+                                status = "okay";
+                        };
+
+                        uart0: serial@f0024000 {
+                                status = "okay";
+                        };
+
+                        mmc1: mmc@f8000000 {
+                                pinctrl-0 = <&pinctrl_mmc1_clk_cmd_dat0 &pinctrl_mmc1_dat1_3 &pinctrl_mmc1_cd>;
+                                status = "okay";
+                                slot@0 {
+                                        reg = <0>;
+                                        bus-width = <4>;
+                                        cd-gpios = <&pioE 1 GPIO_ACTIVE_HIGH>;
+                                };
+                        };
+
+                        spi1: spi@f8008000 {
+                                cs-gpios = <&pioC 25 0>, <0>, <0>, <&pioD 16 0>;
+                                status = "okay";
+                        };
+
+                        adc0: adc@f8018000 {
+                                pinctrl-0 = <
+                                        &pinctrl_adc0_adtrg
+                                        &pinctrl_adc0_ad0
+                                        &pinctrl_adc0_ad1
+                                        &pinctrl_adc0_ad2
+                                        &pinctrl_adc0_ad3
+                                        &pinctrl_adc0_ad4
+                                        &pinctrl_adc0_ad5
+                                        &pinctrl_adc0_ad6
+                                        &pinctrl_adc0_ad7
+                                        &pinctrl_adc0_ad8
+                                        &pinctrl_adc0_ad9
+                                        >;
+                                status = "okay";
+                        };
+
+                        i2c2: i2c@f801c000 {
+                                dmas = <0>, <0>;        /* Do not use DMA for i2c2 */
+                                status = "okay";
+                        };
+
+                        macb1: ethernet@f802c000 {
+                                phy-mode = "rmii";
+                                status = "okay";
+                        };
+
+                        dbgu: serial@ffffee00 {
+                                status = "okay";
+                        };
+
+                        pinctrl@fffff200 {
+                                board {
+                                        pinctrl_mmc0_cd: mmc0_cd {
+                                                atmel,pins =
+                                                        <AT91_PIOE 0 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
+                                        };
+
+                                        pinctrl_mmc1_cd: mmc1_cd {
+                                                atmel,pins =
+                                                        <AT91_PIOE 1 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
+                                        };
+
+                                        pinctrl_usba_vbus: usba_vbus {
+                                                atmel,pins =
+                                                        <AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;   /* PE9, conflicts with A9 */
+                                        };
+                                };
+                        };
+
+                        pmc: pmc@fffffc00 {
+                                main: mainck {
+                                        clock-frequency = <12000000>;
+                                };
+                        };
+                };
+
+                nand0: nand@60000000 {
+                        nand-bus-width = <8>;
+                        nand-ecc-mode = "hw";
+                        atmel,has-pmecc;
+                        atmel,pmecc-cap = <4>;
+                        atmel,pmecc-sector-size = <512>;
+                        nand-on-flash-bbt;
+                        status = "okay";
+
+                        at91bootstrap@0 {
+                                label = "at91bootstrap";
+                                reg = <0x0 0x40000>;
+                        };
+
+                        bootloader@40000 {
+                                label = "bootloader";
+                                reg = <0x40000 0x80000>;
+                        };
+
+                        bootloaderenv@c0000 {
+                                label = "bootloader env";
+                                reg = <0xc0000 0xc0000>;
+                        };
+
+                        dtb@180000 {
+                                label = "device tree";
+                                reg = <0x180000 0x80000>;
+                        };
+
+                        kernel@200000 {
+                                label = "kernel";
+                                reg = <0x200000 0x600000>;
+                        };
+
+                        rootfs@800000 {
+                                label = "rootfs";
+                                reg = <0x800000 0x0f800000>;
+                        };
+                };
+
+                usb0: gadget@00500000 {
+                        atmel,vbus-gpio = <&pioE 9 GPIO_ACTIVE_HIGH>;   /* PE9, conflicts with A9 */
+                        pinctrl-names = "default";
+                        pinctrl-0 = <&pinctrl_usba_vbus>;
+                        status = "okay";
+                };
+
+                usb1: ohci@00600000 {
+                        num-ports = <3>;
+                        atmel,vbus-gpio = <0
+                                           &pioE 3 GPIO_ACTIVE_LOW
+                                           &pioE 4 GPIO_ACTIVE_LOW
+                                          >;
+                        status = "okay";
+                };
+
+                usb2: ehci@00700000 {
+                        status = "okay";
+                };
+        };
+
+        gpio_keys {
+                compatible = "gpio-keys";
+
+                bp3 {
+                        label = "PB_USER";
+                        gpios = <&pioE 29 GPIO_ACTIVE_LOW>;
+                        linux,code = <0x104>;
+                        gpio-key,wakeup;
+                };
+        };
+
+        leds {
+                compatible = "gpio-leds";
+
+                d2 {
+                        label = "d2";
+                        gpios = <&pioE 23 GPIO_ACTIVE_LOW>;     /* PE23, conflicts with A23, CTS2 */
+                        linux,default-trigger = "heartbeat";
+                };
+
+                d3 {
+                        label = "d3";
+                        gpios = <&pioE 24 GPIO_ACTIVE_HIGH>;
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index 0042f73068b0..fece8665fb63 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -523,7 +523,7 @@
                         };
 
                         i2c0: i2c@fff88000 {
-                                compatible = "atmel,at91sam9263-i2c";
+                                compatible = "atmel,at91sam9260-i2c";
                                 reg = <0xfff88000 0x100>;
                                 interrupts = <13 IRQ_TYPE_LEVEL_HIGH 6>;
                                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/at91sam9n12ek.dts b/arch/arm/boot/dts/at91sam9n12ek.dts
index e9487f6f0166..924a6a6ffd0f 100644
--- a/arch/arm/boot/dts/at91sam9n12ek.dts
+++ b/arch/arm/boot/dts/at91sam9n12ek.dts
@@ -124,6 +124,10 @@
                         nand-on-flash-bbt;
                         status = "okay";
                 };
+
+                usb0: ohci@00500000 {
+                        status = "okay";
+                };
         };
 
         leds {
diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
index 2b76524f4aa7..187fd46b7b5e 100644
--- a/arch/arm/boot/dts/dove.dtsi
+++ b/arch/arm/boot/dts/dove.dtsi
@@ -379,15 +379,6 @@
                                 #clock-cells = <1>;
                         };
 
-                        pmu_intc: pmu-interrupt-ctrl@d0050 {
-                                compatible = "marvell,dove-pmu-intc";
-                                interrupt-controller;
-                                #interrupt-cells = <1>;
-                                reg = <0xd0050 0x8>;
-                                interrupts = <33>;
-                                marvell,#interrupts = <7>;
-                        };
-
                         pinctrl: pin-ctrl@d0200 {
                                 compatible = "marvell,dove-pinctrl";
                                 reg = <0xd0200 0x10>;
@@ -610,8 +601,6 @@
                         rtc: real-time-clock@d8500 {
                                 compatible = "marvell,orion-rtc";
                                 reg = <0xd8500 0x20>;
-                                interrupt-parent = <&pmu_intc>;
-                                interrupts = <5>;
                         };
 
                         gpio2: gpio-ctrl@e8400 {
diff --git a/arch/arm/boot/dts/imx6dl-hummingboard.dts b/arch/arm/boot/dts/imx6dl-hummingboard.dts
index fd8fc7cd53f3..5bfae54fb780 100644
--- a/arch/arm/boot/dts/imx6dl-hummingboard.dts
+++ b/arch/arm/boot/dts/imx6dl-hummingboard.dts
@@ -52,12 +52,6 @@
                 };
         };
 
-        codec: spdif-transmitter {
-                compatible = "linux,spdif-dit";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_hummingboard_spdif>;
-        };
-
         sound-spdif {
                 compatible = "fsl,imx-audio-spdif";
                 model = "imx-spdif";
@@ -111,7 +105,7 @@
                 };
 
                 pinctrl_hummingboard_spdif: hummingboard-spdif {
-                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x1b0b0>;
+                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x13091>;
                 };
 
                 pinctrl_hummingboard_usbh1_vbus: hummingboard-usbh1-vbus {
@@ -142,6 +136,8 @@
 };
 
 &spdif {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_hummingboard_spdif>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
index 64daa3b311f6..c2a24888a276 100644
--- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
@@ -46,12 +46,6 @@
                 };
         };
 
-        codec: spdif-transmitter {
-                compatible = "linux,spdif-dit";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_cubox_i_spdif>;
-        };
-
         sound-spdif {
                 compatible = "fsl,imx-audio-spdif";
                 model = "imx-spdif";
@@ -89,7 +83,7 @@
                 };
 
                 pinctrl_cubox_i_spdif: cubox-i-spdif {
-                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x1b0b0>;
+                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x13091>;
                 };
 
                 pinctrl_cubox_i_usbh1_vbus: cubox-i-usbh1-vbus {
@@ -121,6 +115,8 @@
 };
 
 &spdif {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_cubox_i_spdif>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/omap3-gta04.dts b/arch/arm/boot/dts/omap3-gta04.dts
index b9b55c95a566..c551e4af4d83 100644
--- a/arch/arm/boot/dts/omap3-gta04.dts
+++ b/arch/arm/boot/dts/omap3-gta04.dts
@@ -32,7 +32,7 @@
                 aux-button {
                         label = "aux";
                         linux,code = <169>;
-                        gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
+                        gpios = <&gpio1 7 GPIO_ACTIVE_HIGH>;
                         gpio-key,wakeup;
                 };
         };
@@ -92,6 +92,8 @@
         bmp085@77 {
                 compatible = "bosch,bmp085";
                 reg = <0x77>;
+                interrupt-parent = <&gpio4>;
+                interrupts = <17 IRQ_TYPE_EDGE_RISING>;
         };
 
         /* leds */
@@ -141,8 +143,8 @@
         pinctrl-names = "default";
         pinctrl-0 = <&mmc1_pins>;
         vmmc-supply = <&vmmc1>;
-        vmmc_aux-supply = <&vsim>;
         bus-width = <4>;
+        ti,non-removable;
 };
 
 &mmc2 {
diff --git a/arch/arm/boot/dts/omap3-n9.dts b/arch/arm/boot/dts/omap3-n9.dts
index 39828ce464ee..9938b5dc1909 100644
--- a/arch/arm/boot/dts/omap3-n9.dts
+++ b/arch/arm/boot/dts/omap3-n9.dts
@@ -14,5 +14,5 @@
 
 / {
         model = "Nokia N9";
-        compatible = "nokia,omap3-n9", "ti,omap3";
+        compatible = "nokia,omap3-n9", "ti,omap36xx", "ti,omap3";
 };
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 6fc85f963530..0bf40c90faba 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2013 Pavel Machek <pavel@ucw.cz>
- * Copyright 2013 Aaro Koskinen <aaro.koskinen@iki.fi>
+ * Copyright (C) 2013-2014 Aaro Koskinen <aaro.koskinen@iki.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 (or later) as
@@ -13,7 +13,7 @@
 
 / {
         model = "Nokia N900";
-        compatible = "nokia,omap3-n900", "ti,omap3";
+        compatible = "nokia,omap3-n900", "ti,omap3430", "ti,omap3";
 
         cpus {
                 cpu@0 {
diff --git a/arch/arm/boot/dts/omap3-n950.dts b/arch/arm/boot/dts/omap3-n950.dts
index b076a526b999..261c5589bfa3 100644
--- a/arch/arm/boot/dts/omap3-n950.dts
+++ b/arch/arm/boot/dts/omap3-n950.dts
@@ -14,5 +14,5 @@
 
 / {
         model = "Nokia N950";
-        compatible = "nokia,omap3-n950", "ti,omap3";
+        compatible = "nokia,omap3-n950", "ti,omap36xx", "ti,omap3";
 };
diff --git a/arch/arm/boot/dts/omap3-overo-storm-tobi.dts b/arch/arm/boot/dts/omap3-overo-storm-tobi.dts
new file mode 100644
index 000000000000..966b5c9cd96a
--- /dev/null
+++ b/arch/arm/boot/dts/omap3-overo-storm-tobi.dts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2012 Florian Vaussard, EPFL Mobots group
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * Tobi expansion board is manufactured by Gumstix Inc.
+ */
+
+/dts-v1/;
+
+#include "omap36xx.dtsi"
+#include "omap3-overo-tobi-common.dtsi"
+
+/ {
+        model = "OMAP36xx/AM37xx/DM37xx Gumstix Overo on Tobi";
+        compatible = "gumstix,omap3-overo-tobi", "gumstix,omap3-overo", "ti,omap36xx", "ti,omap3";
+};
+
diff --git a/arch/arm/boot/dts/omap3-tobi.dts b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
index 7e4ad2aec37a..4edc013a91c1 100644
--- a/arch/arm/boot/dts/omap3-tobi.dts
+++ b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
@@ -13,9 +13,6 @@
 #include "omap3-overo.dtsi"
 
 / {
-        model = "TI OMAP3 Gumstix Overo on Tobi";
-        compatible = "ti,omap3-tobi", "ti,omap3-overo", "ti,omap3";
-
         leds {
                 compatible = "gpio-leds";
                 heartbeat {
diff --git a/arch/arm/boot/dts/omap3-overo-tobi.dts b/arch/arm/boot/dts/omap3-overo-tobi.dts
new file mode 100644
index 000000000000..de5653e1b5ca
--- /dev/null
+++ b/arch/arm/boot/dts/omap3-overo-tobi.dts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2012 Florian Vaussard, EPFL Mobots group
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * Tobi expansion board is manufactured by Gumstix Inc.
+ */
+
+/dts-v1/;
+
+#include "omap34xx.dtsi"
+#include "omap3-overo-tobi-common.dtsi"
+
+/ {
+        model = "OMAP35xx Gumstix Overo on Tobi";
+        compatible = "gumstix,omap3-overo-tobi", "gumstix,omap3-overo", "ti,omap3430", "ti,omap3";
+};
+
diff --git a/arch/arm/boot/dts/omap3-overo.dtsi b/arch/arm/boot/dts/omap3-overo.dtsi
index a461d2fd1fb0..597099907f8e 100644
--- a/arch/arm/boot/dts/omap3-overo.dtsi
+++ b/arch/arm/boot/dts/omap3-overo.dtsi
@@ -9,9 +9,6 @@
 /*
  * The Gumstix Overo must be combined with an expansion board.
  */
-/dts-v1/;
-
-#include "omap34xx.dtsi"
 
 / {
         pwmleds {
diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
index 52447c17537a..3d5faf85f51b 100644
--- a/arch/arm/boot/dts/sama5d3.dtsi
+++ b/arch/arm/boot/dts/sama5d3.dtsi
@@ -1228,7 +1228,7 @@
                         compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00600000 0x100000>;
                         interrupts = <32 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&udphs_clk>,
+                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>,
                                  <&uhpck>;
                         clock-names = "usb_clk", "ohci_clk", "hclk", "uhpck";
                         status = "disabled";
diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
index 0c1e8d871ed1..6cb9b68e2188 100644
--- a/arch/arm/boot/dts/ste-href.dtsi
+++ b/arch/arm/boot/dts/ste-href.dtsi
@@ -188,7 +188,6 @@
                 msp2: msp@80117000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp2_default_mode>;
-                        status = "okay";
                 };
 
                 msp3: msp@80125000 {
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 040bb0eba152..10666ca8aee1 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -315,7 +315,7 @@
                 ranges;
 
                 emac: ethernet@01c0b000 {
-                        compatible = "allwinner,sun4i-emac";
+                        compatible = "allwinner,sun4i-a10-emac";
                         reg = <0x01c0b000 0x1000>;
                         interrupts = <55>;
                         clocks = <&ahb_gates 17>;
@@ -323,7 +323,7 @@
                 };
 
                 mdio@01c0b080 {
-                        compatible = "allwinner,sun4i-mdio";
+                        compatible = "allwinner,sun4i-a10-mdio";
                         reg = <0x01c0b080 0x14>;
                         status = "disabled";
                         #address-cells = <1>;
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index ea16054857a4..64961595e8d6 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -278,7 +278,7 @@
                 ranges;
 
                 emac: ethernet@01c0b000 {
-                        compatible = "allwinner,sun4i-emac";
+                        compatible = "allwinner,sun4i-a10-emac";
                         reg = <0x01c0b000 0x1000>;
                         interrupts = <55>;
                         clocks = <&ahb_gates 17>;
@@ -286,7 +286,7 @@
                 };
 
                 mdio@01c0b080 {
-                        compatible = "allwinner,sun4i-mdio";
+                        compatible = "allwinner,sun4i-a10-mdio";
                         reg = <0x01c0b080 0x14>;
                         status = "disabled";
                         #address-cells = <1>;
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 119f066f0d98..9ff09484847b 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -340,7 +340,7 @@
                 ranges;
 
                 emac: ethernet@01c0b000 {
-                        compatible = "allwinner,sun4i-emac";
+                        compatible = "allwinner,sun4i-a10-emac";
                         reg = <0x01c0b000 0x1000>;
                         interrupts = <0 55 4>;
                         clocks = <&ahb_gates 17>;
@@ -348,7 +348,7 @@
                 };
 
                 mdio@01c0b080 {
-                        compatible = "allwinner,sun4i-mdio";
+                        compatible = "allwinner,sun4i-a10-mdio";
                         reg = <0x01c0b080 0x14>;
                         status = "disabled";
                         #address-cells = <1>;
diff --git a/arch/arm/boot/dts/tegra114.dtsi b/arch/arm/boot/dts/tegra114.dtsi
index 389e987ec281..44ec401ec366 100644
--- a/arch/arm/boot/dts/tegra114.dtsi
+++ b/arch/arm/boot/dts/tegra114.dtsi
@@ -57,6 +57,8 @@
                         resets = <&tegra_car 27>;
                         reset-names = "dc";
 
+                        nvidia,head = <0>;
+
                         rgb {
                                 status = "disabled";
                         };
@@ -72,6 +74,8 @@
                         resets = <&tegra_car 26>;
                         reset-names = "dc";
 
+                        nvidia,head = <1>;
+
                         rgb {
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
index 480ecda3416b..48d2a7f4d0c0 100644
--- a/arch/arm/boot/dts/tegra20.dtsi
+++ b/arch/arm/boot/dts/tegra20.dtsi
@@ -94,6 +94,8 @@
                         resets = <&tegra_car 27>;
                         reset-names = "dc";
 
+                        nvidia,head = <0>;
+
                         rgb {
                                 status = "disabled";
                         };
@@ -109,6 +111,8 @@
                         resets = <&tegra_car 26>;
                         reset-names = "dc";
 
+                        nvidia,head = <1>;
+
                         rgb {
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi
index 9104224124ee..1e156d9d0506 100644
--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi
+++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi
@@ -28,7 +28,7 @@
         compatible = "nvidia,cardhu", "nvidia,tegra30";
 
         aliases {
-                rtc0 = "/i2c@7000d000/tps6586x@34";
+                rtc0 = "/i2c@7000d000/tps65911@2d";
                 rtc1 = "/rtc@7000e000";
         };
 
diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
index ed8e7700b46d..19a84e933f4e 100644
--- a/arch/arm/boot/dts/tegra30.dtsi
+++ b/arch/arm/boot/dts/tegra30.dtsi
@@ -170,6 +170,8 @@
                         resets = <&tegra_car 27>;
                         reset-names = "dc";
 
+                        nvidia,head = <0>;
+
                         rgb {
                                 status = "disabled";
                         };
@@ -185,6 +187,8 @@
                         resets = <&tegra_car 26>;
                         reset-names = "dc";
 
+                        nvidia,head = <1>;
+
                         rgb {
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/testcases/tests.dtsi b/arch/arm/boot/dts/testcases/tests.dtsi
deleted file mode 100644
index 3f123ecc9dd7..000000000000
--- a/arch/arm/boot/dts/testcases/tests.dtsi
+++ /dev/null
@@ -1,2 +0,0 @@
-/include/ "tests-phandle.dtsi"
-/include/ "tests-interrupts.dtsi"
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index f43907c40c93..65f657711323 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -1,4 +1,4 @@
-/include/ "versatile-ab.dts"
+#include <versatile-ab.dts>
 
 / {
         model = "ARM Versatile PB";
@@ -47,4 +47,4 @@
         };
 };
 
-/include/ "testcases/tests.dtsi"
+#include <testcases.dtsi>
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 845bc745706b..ee6982976d66 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -29,6 +29,7 @@ CONFIG_ARCH_OMAP3=y
 CONFIG_ARCH_OMAP4=y
 CONFIG_SOC_OMAP5=y
 CONFIG_SOC_AM33XX=y
+CONFIG_SOC_DRA7XX=y
 CONFIG_SOC_AM43XX=y
 CONFIG_ARCH_ROCKCHIP=y
 CONFIG_ARCH_SOCFPGA=y
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index e9a49fe0284e..8b8b61685a34 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -212,6 +212,7 @@ extern void copy_to_user_page(struct vm_area_struct *, struct page *,
 static inline void __flush_icache_all(void)
 {
         __flush_icache_preferred();
+        dsb();
 }
 
 /*
diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
index 03243f7eeddf..85c60adc8b60 100644
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -120,13 +120,16 @@
 /*
  * 2nd stage PTE definitions for LPAE.
  */
-#define L_PTE_S2_MT_UNCACHED     (_AT(pteval_t, 0x5) << 2) /* MemAttr[3:0] */
-#define L_PTE_S2_MT_WRITETHROUGH (_AT(pteval_t, 0xa) << 2) /* MemAttr[3:0] */
-#define L_PTE_S2_MT_WRITEBACK    (_AT(pteval_t, 0xf) << 2) /* MemAttr[3:0] */
-#define L_PTE_S2_RDONLY          (_AT(pteval_t, 1) << 6)   /* HAP[1]   */
-#define L_PTE_S2_RDWR            (_AT(pteval_t, 3) << 6)   /* HAP[2:1] */
+#define L_PTE_S2_MT_UNCACHED            (_AT(pteval_t, 0x0) << 2) /* strongly ordered */
+#define L_PTE_S2_MT_WRITETHROUGH        (_AT(pteval_t, 0xa) << 2) /* normal inner write-through */
+#define L_PTE_S2_MT_WRITEBACK           (_AT(pteval_t, 0xf) << 2) /* normal inner write-back */
+#define L_PTE_S2_MT_DEV_SHARED          (_AT(pteval_t, 0x1) << 2) /* device */
+#define L_PTE_S2_MT_MASK                (_AT(pteval_t, 0xf) << 2)
 
-#define L_PMD_S2_RDWR            (_AT(pmdval_t, 3) << 6)   /* HAP[2:1] */
+#define L_PTE_S2_RDONLY                 (_AT(pteval_t, 1) << 6)   /* HAP[1]   */
+#define L_PTE_S2_RDWR                   (_AT(pteval_t, 3) << 6)   /* HAP[2:1] */
+
+#define L_PMD_S2_RDWR                   (_AT(pmdval_t, 3) << 6)   /* HAP[2:1] */
 
 /*
  * Hyp-mode PL2 PTE definitions for LPAE.
diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h
index ef3c6072aa45..ac4bfae26702 100644
--- a/arch/arm/include/asm/spinlock.h
+++ b/arch/arm/include/asm/spinlock.h
@@ -37,18 +37,9 @@
 
 static inline void dsb_sev(void)
 {
-#if __LINUX_ARM_ARCH__ >= 7
-        __asm__ __volatile__ (
-                "dsb ishst\n"
-                SEV
-        );
-#else
-        __asm__ __volatile__ (
-                "mcr p15, 0, %0, c7, c10, 4\n"
-                SEV
-                : : "r" (0)
-        );
-#endif
+
+        dsb(ishst);
+        __asm__(SEV);
 }
 
 /*
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index b0df9761de6d..1e8b030dbefd 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -731,7 +731,7 @@ static void __init request_standard_resources(const struct machine_desc *mdesc)
         kernel_data.end     = virt_to_phys(_end - 1);
 
         for_each_memblock(memory, region) {
-                res = memblock_virt_alloc_low(sizeof(*res), 0);
+                res = memblock_virt_alloc(sizeof(*res), 0);
                 res->name  = "System RAM";
                 res->start = __pfn_to_phys(memblock_region_memory_base_pfn(region));
                 res->end = __pfn_to_phys(memblock_region_memory_end_pfn(region)) - 1;
diff --git a/arch/arm/mach-hisi/Kconfig b/arch/arm/mach-hisi/Kconfig
index 8f4649b301b2..1abae5f6a418 100644
--- a/arch/arm/mach-hisi/Kconfig
+++ b/arch/arm/mach-hisi/Kconfig
@@ -8,7 +8,7 @@ config ARCH_HI3xxx
         select CLKSRC_OF
         select GENERIC_CLOCKEVENTS
         select HAVE_ARM_SCU
-        select HAVE_ARM_TWD
+        select HAVE_ARM_TWD if SMP
         select HAVE_SMP
         select PINCTRL
         select PINCTRL_SINGLE
diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index befcaf5d0574..ec419649320f 100644
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -101,11 +101,9 @@ obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o
 obj-$(CONFIG_SOC_IMX6Q) += clk-imx6q.o mach-imx6q.o
 obj-$(CONFIG_SOC_IMX6SL) += clk-imx6sl.o mach-imx6sl.o
 
-ifeq ($(CONFIG_PM),y)
 obj-$(CONFIG_SOC_IMX6Q) += pm-imx6q.o headsmp.o
 # i.MX6SL reuses i.MX6Q code
 obj-$(CONFIG_SOC_IMX6SL) += pm-imx6q.o headsmp.o
-endif
 
 # i.MX5 based machines
 obj-$(CONFIG_MACH_MX51_BABBAGE) += mach-mx51_babbage.o
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index af2e582d2b74..4d677f442539 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -482,6 +482,9 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
         if (IS_ENABLED(CONFIG_PCI_IMX6))
                 clk_set_parent(clk[lvds1_sel], clk[sata_ref]);
 
+        /* Set initial power mode */
+        imx6q_set_lpm(WAIT_CLOCKED);
+
         np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-gpt");
         base = of_iomap(np, 0);
         WARN_ON(!base);
diff --git a/arch/arm/mach-imx/clk-imx6sl.c b/arch/arm/mach-imx/clk-imx6sl.c
index 3781a1853998..4c86f3035205 100644
--- a/arch/arm/mach-imx/clk-imx6sl.c
+++ b/arch/arm/mach-imx/clk-imx6sl.c
@@ -266,6 +266,9 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
         /* Audio-related clocks configuration */
         clk_set_parent(clks[IMX6SL_CLK_SPDIF0_SEL], clks[IMX6SL_CLK_PLL3_PFD3]);
 
+        /* Set initial power mode */
+        imx6q_set_lpm(WAIT_CLOCKED);
+
         np = of_find_compatible_node(NULL, NULL, "fsl,imx6sl-gpt");
         base = of_iomap(np, 0);
         WARN_ON(!base);
diff --git a/arch/arm/mach-imx/common.h b/arch/arm/mach-imx/common.h
index 59c3b9b26bb4..baf439dc22d8 100644
--- a/arch/arm/mach-imx/common.h
+++ b/arch/arm/mach-imx/common.h
@@ -144,13 +144,11 @@ void imx6q_set_chicken_bit(void);
 void imx_cpu_die(unsigned int cpu);
 int imx_cpu_kill(unsigned int cpu);
 
-#ifdef CONFIG_PM
 void imx6q_pm_init(void);
 void imx6q_pm_set_ccm_base(void __iomem *base);
+#ifdef CONFIG_PM
 void imx5_pm_init(void);
 #else
-static inline void imx6q_pm_init(void) {}
-static inline void imx6q_pm_set_ccm_base(void __iomem *base) {}
 static inline void imx5_pm_init(void) {}
 #endif
 
diff --git a/arch/arm/mach-imx/pm-imx6q.c b/arch/arm/mach-imx/pm-imx6q.c
index 9d47adc078aa..7a9b98589db7 100644
--- a/arch/arm/mach-imx/pm-imx6q.c
+++ b/arch/arm/mach-imx/pm-imx6q.c
@@ -236,8 +236,6 @@ void __init imx6q_pm_init(void)
                 regmap_update_bits(gpr, IOMUXC_GPR1, IMX6Q_GPR1_GINT,
                                    IMX6Q_GPR1_GINT);
 
-        /* Set initial power mode */
-        imx6q_set_lpm(WAIT_CLOCKED);
 
         suspend_set_ops(&imx6q_pm_ops);
 }
diff --git a/arch/arm/mach-moxart/Kconfig b/arch/arm/mach-moxart/Kconfig
index ba470d64493b..3795ae28a613 100644
--- a/arch/arm/mach-moxart/Kconfig
+++ b/arch/arm/mach-moxart/Kconfig
@@ -2,7 +2,6 @@ config ARCH_MOXART
         bool "MOXA ART SoC" if ARCH_MULTI_V4T
         select CPU_FA526
         select ARM_DMA_MEM_BUFFERABLE
-        select DMA_OF
         select USE_OF
         select CLKSRC_OF
         select CLKSRC_MMIO
diff --git a/arch/arm/mach-omap1/board-nokia770.c b/arch/arm/mach-omap1/board-nokia770.c
index 91449c5cb70f..85089d821982 100644
--- a/arch/arm/mach-omap1/board-nokia770.c
+++ b/arch/arm/mach-omap1/board-nokia770.c
@@ -156,6 +156,7 @@ static struct omap_usb_config nokia770_usb_config __initdata = {
         .register_dev   = 1,
         .hmc_mode       = 16,
         .pins[0]        = 6,
+        .extcon         = "tahvo-usb",
 };
 
 #if defined(CONFIG_MMC_OMAP) || defined(CONFIG_MMC_OMAP_MODULE)
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 653b489479e0..0af7ca02314d 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -50,11 +50,12 @@ config SOC_OMAP5
         bool "TI OMAP5"
         depends on ARCH_MULTI_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select ARM_CPU_SUSPEND if PM
         select ARM_GIC
         select CPU_V7
         select HAVE_ARM_SCU if SMP
-        select HAVE_ARM_TWD if LOCAL_TIMERS
+        select HAVE_ARM_TWD if SMP
         select HAVE_SMP
         select HAVE_ARM_ARCH_TIMER
         select ARM_ERRATA_798181 if SMP
@@ -63,6 +64,7 @@ config SOC_AM33XX
         bool "TI AM33XX"
         depends on ARCH_MULTI_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select ARM_CPU_SUSPEND if PM
         select CPU_V7
         select MULTI_IRQ_HANDLER
@@ -72,6 +74,7 @@ config SOC_AM43XX
         depends on ARCH_MULTI_V7
         select CPU_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select MULTI_IRQ_HANDLER
         select ARM_GIC
         select MACH_OMAP_GENERIC
@@ -80,6 +83,7 @@ config SOC_DRA7XX
         bool "TI DRA7XX"
         depends on ARCH_MULTI_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select ARM_CPU_SUSPEND if PM
         select ARM_GIC
         select CPU_V7
@@ -268,9 +272,6 @@ config MACH_OMAP_3430SDP
         default y
         select OMAP_PACKAGE_CBB
 
-config MACH_NOKIA_N800
-       bool
-
 config MACH_NOKIA_N810
        bool
 
@@ -281,7 +282,6 @@ config MACH_NOKIA_N8X0
         bool "Nokia N800/N810"
         depends on SOC_OMAP2420
         default y
-        select MACH_NOKIA_N800
         select MACH_NOKIA_N810
         select MACH_NOKIA_N810_WIMAX
         select OMAP_PACKAGE_ZAC
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index d24926e6340f..ab43755364f5 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -1339,7 +1339,7 @@ static void __maybe_unused gpmc_read_timings_dt(struct device_node *np,
                 of_property_read_bool(np, "gpmc,time-para-granularity");
 }
 
-#ifdef CONFIG_MTD_NAND
+#if IS_ENABLED(CONFIG_MTD_NAND)
 
 static const char * const nand_xfer_types[] = {
         [NAND_OMAP_PREFETCH_POLLED]             = "prefetch-polled",
@@ -1429,7 +1429,7 @@ static int gpmc_probe_nand_child(struct platform_device *pdev,
 }
 #endif
 
-#ifdef CONFIG_MTD_ONENAND
+#if IS_ENABLED(CONFIG_MTD_ONENAND)
 static int gpmc_probe_onenand_child(struct platform_device *pdev,
                                  struct device_node *child)
 {
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index d408b15b4fbf..af432b191255 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -179,15 +179,6 @@ static struct map_desc omap34xx_io_desc[] __initdata = {
                 .length         = L4_EMU_34XX_SIZE,
                 .type           = MT_DEVICE
         },
-#if defined(CONFIG_DEBUG_LL) &&                                                 \
-        (defined(CONFIG_MACH_OMAP_ZOOM2) || defined(CONFIG_MACH_OMAP_ZOOM3))
-        {
-                .virtual        = ZOOM_UART_VIRT,
-                .pfn            = __phys_to_pfn(ZOOM_UART_BASE),
-                .length         = SZ_1M,
-                .type           = MT_DEVICE
-        },
-#endif
 };
 #endif
 
diff --git a/arch/arm/mach-pxa/am300epd.c b/arch/arm/mach-pxa/am300epd.c
index c9f309ae88c5..8b90c4f2d430 100644
--- a/arch/arm/mach-pxa/am300epd.c
+++ b/arch/arm/mach-pxa/am300epd.c
@@ -30,6 +30,7 @@
 
 #include <mach/gumstix.h>
 #include <mach/mfp-pxa25x.h>
+#include <mach/irqs.h>
 #include <linux/platform_data/video-pxafb.h>
 
 #include "generic.h"
diff --git a/arch/arm/mach-pxa/include/mach/balloon3.h b/arch/arm/mach-pxa/include/mach/balloon3.h
index 954641e6c8b1..1b0825911e62 100644
--- a/arch/arm/mach-pxa/include/mach/balloon3.h
+++ b/arch/arm/mach-pxa/include/mach/balloon3.h
@@ -14,6 +14,8 @@
 #ifndef ASM_ARCH_BALLOON3_H
 #define ASM_ARCH_BALLOON3_H
 
+#include "irqs.h" /* PXA_NR_BUILTIN_GPIO */
+
 enum balloon3_features {
         BALLOON3_FEATURE_OHCI,
         BALLOON3_FEATURE_MMC,
diff --git a/arch/arm/mach-pxa/include/mach/corgi.h b/arch/arm/mach-pxa/include/mach/corgi.h
index f3c3493b468d..c030d955bbd7 100644
--- a/arch/arm/mach-pxa/include/mach/corgi.h
+++ b/arch/arm/mach-pxa/include/mach/corgi.h
@@ -13,6 +13,7 @@
 #ifndef __ASM_ARCH_CORGI_H
 #define __ASM_ARCH_CORGI_H  1
 
+#include "irqs.h" /* PXA_NR_BUILTIN_GPIO */
 
 /*
  * Corgi (Non Standard) GPIO Definitions
diff --git a/arch/arm/mach-pxa/include/mach/csb726.h b/arch/arm/mach-pxa/include/mach/csb726.h
index 2628e7b72116..00cfbbbf73f7 100644
--- a/arch/arm/mach-pxa/include/mach/csb726.h
+++ b/arch/arm/mach-pxa/include/mach/csb726.h
@@ -11,6 +11,8 @@
 #ifndef CSB726_H
 #define CSB726_H
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 #define CSB726_GPIO_IRQ_LAN     52
 #define CSB726_GPIO_IRQ_SM501   53
 #define CSB726_GPIO_MMC_DETECT  100
diff --git a/arch/arm/mach-pxa/include/mach/gumstix.h b/arch/arm/mach-pxa/include/mach/gumstix.h
index dba14b6503ad..f7df27bbb42e 100644
--- a/arch/arm/mach-pxa/include/mach/gumstix.h
+++ b/arch/arm/mach-pxa/include/mach/gumstix.h
@@ -6,6 +6,7 @@
  * published by the Free Software Foundation.
  */
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
 
 /* BTRESET - Reset line to Bluetooth module, active low signal. */
 #define GPIO_GUMSTIX_BTRESET          7
diff --git a/arch/arm/mach-pxa/include/mach/idp.h b/arch/arm/mach-pxa/include/mach/idp.h
index 22a96f87232b..7e63f4680271 100644
--- a/arch/arm/mach-pxa/include/mach/idp.h
+++ b/arch/arm/mach-pxa/include/mach/idp.h
@@ -23,6 +23,7 @@
  * IDP hardware.
  */
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
 
 #define IDP_FLASH_PHYS          (PXA_CS0_PHYS)
 #define IDP_ALT_FLASH_PHYS      (PXA_CS1_PHYS)
diff --git a/arch/arm/mach-pxa/include/mach/palmld.h b/arch/arm/mach-pxa/include/mach/palmld.h
index 2c4471336570..b184f296023b 100644
--- a/arch/arm/mach-pxa/include/mach/palmld.h
+++ b/arch/arm/mach-pxa/include/mach/palmld.h
@@ -13,6 +13,8 @@
 #ifndef _INCLUDE_PALMLD_H_
 #define _INCLUDE_PALMLD_H_
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 /** HERE ARE GPIOs **/
 
 /* GPIOs */
diff --git a/arch/arm/mach-pxa/include/mach/palmt5.h b/arch/arm/mach-pxa/include/mach/palmt5.h
index 0bd4f036c72f..e342c5921405 100644
--- a/arch/arm/mach-pxa/include/mach/palmt5.h
+++ b/arch/arm/mach-pxa/include/mach/palmt5.h
@@ -15,6 +15,8 @@
 #ifndef _INCLUDE_PALMT5_H_
 #define _INCLUDE_PALMT5_H_
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 /** HERE ARE GPIOs **/
 
 /* GPIOs */
diff --git a/arch/arm/mach-pxa/include/mach/palmtc.h b/arch/arm/mach-pxa/include/mach/palmtc.h
index c383a21680b6..81c727b3cfd2 100644
--- a/arch/arm/mach-pxa/include/mach/palmtc.h
+++ b/arch/arm/mach-pxa/include/mach/palmtc.h
@@ -16,6 +16,8 @@
 #ifndef _INCLUDE_PALMTC_H_
 #define _INCLUDE_PALMTC_H_
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 /** HERE ARE GPIOs **/
 
 /* GPIOs */
diff --git a/arch/arm/mach-pxa/include/mach/palmtx.h b/arch/arm/mach-pxa/include/mach/palmtx.h
index f2e530380253..92bc1f05300d 100644
--- a/arch/arm/mach-pxa/include/mach/palmtx.h
+++ b/arch/arm/mach-pxa/include/mach/palmtx.h
@@ -16,6 +16,8 @@
 #ifndef _INCLUDE_PALMTX_H_
 #define _INCLUDE_PALMTX_H_
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 /** HERE ARE GPIOs **/
 
 /* GPIOs */
diff --git a/arch/arm/mach-pxa/include/mach/pcm027.h b/arch/arm/mach-pxa/include/mach/pcm027.h
index 6bf28de228bd..86ebd7b6c960 100644
--- a/arch/arm/mach-pxa/include/mach/pcm027.h
+++ b/arch/arm/mach-pxa/include/mach/pcm027.h
@@ -23,6 +23,8 @@
  * Definitions of CPU card resources only
  */
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 /* phyCORE-PXA270 (PCM027) Interrupts */
 #define PCM027_IRQ(x)          (IRQ_BOARD_START + (x))
 #define PCM027_BTDET_IRQ       PCM027_IRQ(0)
diff --git a/arch/arm/mach-pxa/include/mach/pcm990_baseboard.h b/arch/arm/mach-pxa/include/mach/pcm990_baseboard.h
index 0260aaa2fc17..7e544c14967e 100644
--- a/arch/arm/mach-pxa/include/mach/pcm990_baseboard.h
+++ b/arch/arm/mach-pxa/include/mach/pcm990_baseboard.h
@@ -20,6 +20,7 @@
  */
 
 #include <mach/pcm027.h>
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
 
 /*
  * definitions relevant only when the PCM-990
diff --git a/arch/arm/mach-pxa/include/mach/poodle.h b/arch/arm/mach-pxa/include/mach/poodle.h
index f32ff75dcca8..b56b19351a03 100644
--- a/arch/arm/mach-pxa/include/mach/poodle.h
+++ b/arch/arm/mach-pxa/include/mach/poodle.h
@@ -15,6 +15,8 @@
 #ifndef __ASM_ARCH_POODLE_H
 #define __ASM_ARCH_POODLE_H  1
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 /*
  * GPIOs
  */
diff --git a/arch/arm/mach-pxa/include/mach/spitz.h b/arch/arm/mach-pxa/include/mach/spitz.h
index 0bfe6507c95d..25c9f62e46aa 100644
--- a/arch/arm/mach-pxa/include/mach/spitz.h
+++ b/arch/arm/mach-pxa/include/mach/spitz.h
@@ -15,8 +15,8 @@
 #define __ASM_ARCH_SPITZ_H  1
 #endif
 
+#include "irqs.h" /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */
 #include <linux/fb.h>
-#include <linux/gpio.h>
 
 /* Spitz/Akita GPIOs */
 
diff --git a/arch/arm/mach-pxa/include/mach/tosa.h b/arch/arm/mach-pxa/include/mach/tosa.h
index 2bb0e862598c..0497d95cef25 100644
--- a/arch/arm/mach-pxa/include/mach/tosa.h
+++ b/arch/arm/mach-pxa/include/mach/tosa.h
@@ -13,6 +13,8 @@
 #ifndef _ASM_ARCH_TOSA_H_
 #define _ASM_ARCH_TOSA_H_ 1
 
+#include "irqs.h" /* PXA_NR_BUILTIN_GPIO */
+
 /*  TOSA Chip selects  */
 #define TOSA_LCDC_PHYS          PXA_CS4_PHYS
 /* Internel Scoop */
diff --git a/arch/arm/mach-pxa/include/mach/trizeps4.h b/arch/arm/mach-pxa/include/mach/trizeps4.h
index d2ca01053f69..ae3ca013afab 100644
--- a/arch/arm/mach-pxa/include/mach/trizeps4.h
+++ b/arch/arm/mach-pxa/include/mach/trizeps4.h
@@ -10,6 +10,8 @@
 #ifndef _TRIPEPS4_H_
 #define _TRIPEPS4_H_
 
+#include "irqs.h" /* PXA_GPIO_TO_IRQ */
+
 /* physical memory regions */
 #define TRIZEPS4_FLASH_PHYS     (PXA_CS0_PHYS)  /* Flash region */
 #define TRIZEPS4_DISK_PHYS      (PXA_CS1_PHYS)  /* Disk On Chip region */
diff --git a/arch/arm/mach-pxa/mioa701.c b/arch/arm/mach-pxa/mioa701.c
index f70583fee59f..29997bde277d 100644
--- a/arch/arm/mach-pxa/mioa701.c
+++ b/arch/arm/mach-pxa/mioa701.c
@@ -38,6 +38,7 @@
 #include <linux/mtd/physmap.h>
 #include <linux/usb/gpio_vbus.h>
 #include <linux/reboot.h>
+#include <linux/regulator/fixed.h>
 #include <linux/regulator/max1586.h>
 #include <linux/slab.h>
 #include <linux/i2c/pxa-i2c.h>
@@ -714,6 +715,10 @@ static struct gpio global_gpios[] = {
         { GPIO56_MT9M111_nOE, GPIOF_OUT_INIT_LOW, "Camera nOE" },
 };
 
+static struct regulator_consumer_supply fixed_5v0_consumers[] = {
+        REGULATOR_SUPPLY("power", "pwm-backlight"),
+};
+
 static void __init mioa701_machine_init(void)
 {
         int rc;
@@ -753,6 +758,10 @@ static void __init mioa701_machine_init(void)
         pxa_set_i2c_info(&i2c_pdata);
         pxa27x_set_i2c_power_info(NULL);
         pxa_set_camera_info(&mioa701_pxacamera_platform_data);
+
+        regulator_register_always_on(0, "fixed-5.0V", fixed_5v0_consumers,
+                                     ARRAY_SIZE(fixed_5v0_consumers),
+                                     5000000);
 }
 
 static void mioa701_machine_exit(void)
diff --git a/arch/arm/mach-shmobile/Kconfig b/arch/arm/mach-shmobile/Kconfig
index 338640631e08..05fa505df585 100644
--- a/arch/arm/mach-shmobile/Kconfig
+++ b/arch/arm/mach-shmobile/Kconfig
@@ -8,7 +8,7 @@ config ARCH_SHMOBILE_MULTI
         select CPU_V7
         select GENERIC_CLOCKEVENTS
         select HAVE_ARM_SCU if SMP
-        select HAVE_ARM_TWD if LOCAL_TIMERS
+        select HAVE_ARM_TWD if SMP
         select HAVE_SMP
         select ARM_GIC
         select MIGHT_HAVE_CACHE_L2X0
diff --git a/arch/arm/mach-tegra/pm.c b/arch/arm/mach-tegra/pm.c
index 4ae0286b468d..f55b05a29b55 100644
--- a/arch/arm/mach-tegra/pm.c
+++ b/arch/arm/mach-tegra/pm.c
@@ -24,6 +24,7 @@
 #include <linux/cpu_pm.h>
 #include <linux/suspend.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/clk/tegra.h>
 
 #include <asm/smp_plat.h>
diff --git a/arch/arm/mach-tegra/tegra.c b/arch/arm/mach-tegra/tegra.c
index 303a285d80fd..6191603379e1 100644
--- a/arch/arm/mach-tegra/tegra.c
+++ b/arch/arm/mach-tegra/tegra.c
@@ -73,10 +73,20 @@ u32 tegra_uart_config[3] = {
 static void __init tegra_init_cache(void)
 {
 #ifdef CONFIG_CACHE_L2X0
+        static const struct of_device_id pl310_ids[] __initconst = {
+                { .compatible = "arm,pl310-cache",  },
+                {}
+        };
+
+        struct device_node *np;
         int ret;
         void __iomem *p = IO_ADDRESS(TEGRA_ARM_PERIF_BASE) + 0x3000;
         u32 aux_ctrl, cache_type;
 
+        np = of_find_matching_node(NULL, pl310_ids);
+        if (!np)
+                return;
+
         cache_type = readl(p + L2X0_CACHE_TYPE);
         aux_ctrl = (cache_type & 0x700) << (17-8);
         aux_ctrl |= 0x7C400001;
diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c
index 1db2a5ca9ab8..8c09a8393fb6 100644
--- a/arch/arm/mach-zynq/common.c
+++ b/arch/arm/mach-zynq/common.c
@@ -25,6 +25,7 @@
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <linux/of.h>
+#include <linux/memblock.h>
 #include <linux/irqchip.h>
 #include <linux/irqchip/arm-gic.h>
 
@@ -41,6 +42,18 @@
 
 void __iomem *zynq_scu_base;
 
+/**
+ * zynq_memory_init - Initialize special memory
+ *
+ * We need to stop things allocating the low memory as DMA can't work in
+ * the 1st 512K of memory.
+ */
+static void __init zynq_memory_init(void)
+{
+        if (!__pa(PAGE_OFFSET))
+                memblock_reserve(__pa(PAGE_OFFSET), __pa(swapper_pg_dir));
+}
+
 static struct platform_device zynq_cpuidle_device = {
         .name = "cpuidle-zynq",
 };
@@ -117,5 +130,6 @@ DT_MACHINE_START(XILINX_EP107, "Xilinx Zynq Platform")
         .init_machine   = zynq_init_machine,
         .init_time      = zynq_timer_init,
         .dt_compat      = zynq_dt_match,
+        .reserve        = zynq_memory_init,
         .restart        = zynq_system_reset,
 MACHINE_END
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 1a77450e728a..11b3914660d2 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1358,7 +1358,7 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
         *handle = DMA_ERROR_CODE;
         size = PAGE_ALIGN(size);
 
-        if (gfp & GFP_ATOMIC)
+        if (!(gfp & __GFP_WAIT))
                 return __iommu_alloc_atomic(dev, size, handle);
 
         /*
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index d5a982d15a88..7ea641b7aa7d 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -38,6 +38,7 @@ static inline pmd_t *pmd_off_k(unsigned long virt)
 
 struct mem_type {
         pteval_t prot_pte;
+        pteval_t prot_pte_s2;
         pmdval_t prot_l1;
         pmdval_t prot_sect;
         unsigned int domain;
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4f08c133cc25..a623cb3ad012 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -232,12 +232,16 @@ __setup("noalign", noalign_setup);
 #endif /* ifdef CONFIG_CPU_CP15 / else */
 
 #define PROT_PTE_DEVICE         L_PTE_PRESENT|L_PTE_YOUNG|L_PTE_DIRTY|L_PTE_XN
+#define PROT_PTE_S2_DEVICE      PROT_PTE_DEVICE
 #define PROT_SECT_DEVICE        PMD_TYPE_SECT|PMD_SECT_AP_WRITE
 
 static struct mem_type mem_types[] = {
         [MT_DEVICE] = {           /* Strongly ordered / ARMv6 shared device */
                 .prot_pte       = PROT_PTE_DEVICE | L_PTE_MT_DEV_SHARED |
                                   L_PTE_SHARED,
+                .prot_pte_s2    = s2_policy(PROT_PTE_S2_DEVICE) |
+                                  s2_policy(L_PTE_S2_MT_DEV_SHARED) |
+                                  L_PTE_SHARED,
                 .prot_l1        = PMD_TYPE_TABLE,
                 .prot_sect      = PROT_SECT_DEVICE | PMD_SECT_S,
                 .domain         = DOMAIN_IO,
@@ -508,7 +512,8 @@ static void __init build_mem_type_table(void)
         cp = &cache_policies[cachepolicy];
         vecs_pgprot = kern_pgprot = user_pgprot = cp->pte;
         s2_pgprot = cp->pte_s2;
-        hyp_device_pgprot = s2_device_pgprot = mem_types[MT_DEVICE].prot_pte;
+        hyp_device_pgprot = mem_types[MT_DEVICE].prot_pte;
+        s2_device_pgprot = mem_types[MT_DEVICE].prot_pte_s2;
 
         /*
          * ARMv6 and above have extended page tables.
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 45dc29f85d56..32b3558321c4 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -208,7 +208,6 @@ __v6_setup:
         mcr     p15, 0, r0, c7, c14, 0          @ clean+invalidate D cache
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c15, 0          @ clean+invalidate cache
-        mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
 #ifdef CONFIG_MMU
         mcr     p15, 0, r0, c8, c7, 0           @ invalidate I + D TLBs
         mcr     p15, 0, r0, c2, c0, 2           @ TTB control register
@@ -218,6 +217,8 @@ __v6_setup:
         ALT_UP(orr      r8, r8, #TTB_FLAGS_UP)
         mcr     p15, 0, r8, c2, c0, 1           @ load TTB1
 #endif /* CONFIG_MMU */
+        mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer and
+                                                @ complete invalidations
         adr     r5, v6_crval
         ldmia   r5, {r5, r6}
  ARM_BE8(orr    r6, r6, #1 << 25)               @ big-endian page tables
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index bd1781979a39..74f6033e76dd 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -351,7 +351,6 @@ __v7_setup:
 
 4:      mov     r10, #0
         mcr     p15, 0, r10, c7, c5, 0          @ I+BTB cache invalidate
-        dsb
 #ifdef CONFIG_MMU
         mcr     p15, 0, r10, c8, c7, 0          @ invalidate I + D TLBs
         v7_ttb_setup r10, r4, r8, r5            @ TTBCR, TTBRx setup
@@ -360,6 +359,7 @@ __v7_setup:
         mcr     p15, 0, r5, c10, c2, 0          @ write PRRR
         mcr     p15, 0, r6, c10, c2, 1          @ write NMRR
 #endif
+        dsb                                     @ Complete invalidations
 #ifndef CONFIG_ARM_THUMBEE
         mrc     p15, 0, r0, c0, c1, 0           @ read ID_PFR0 for ThumbEE
         and     r0, r0, #(0xf << 12)            @ ThumbEE enabled field
diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h
index 495ab6f84a61..eaf54a30bedc 100644
--- a/arch/arm64/include/uapi/asm/kvm.h
+++ b/arch/arm64/include/uapi/asm/kvm.h
@@ -148,6 +148,15 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_TIMER_CNT           ARM64_SYS_REG(3, 3, 14, 3, 2)
 #define KVM_REG_ARM_TIMER_CVAL          ARM64_SYS_REG(3, 3, 14, 0, 2)
 
+/* Device Control API: ARM VGIC */
+#define KVM_DEV_ARM_VGIC_GRP_ADDR       0
+#define KVM_DEV_ARM_VGIC_GRP_DIST_REGS  1
+#define KVM_DEV_ARM_VGIC_GRP_CPU_REGS   2
+#define   KVM_DEV_ARM_VGIC_CPUID_SHIFT  32
+#define   KVM_DEV_ARM_VGIC_CPUID_MASK   (0xffULL << KVM_DEV_ARM_VGIC_CPUID_SHIFT)
+#define   KVM_DEV_ARM_VGIC_OFFSET_SHIFT 0
+#define   KVM_DEV_ARM_VGIC_OFFSET_MASK  (0xffffffffULL << KVM_DEV_ARM_VGIC_OFFSET_SHIFT)
+
 /* KVM_IRQ_LINE irq field index values */
 #define KVM_ARM_IRQ_TYPE_SHIFT          24
 #define KVM_ARM_IRQ_TYPE_MASK           0xff
diff --git a/arch/avr32/Makefile b/arch/avr32/Makefile
index 22fb66590dcd..dba48a5d5bb9 100644
--- a/arch/avr32/Makefile
+++ b/arch/avr32/Makefile
@@ -11,7 +11,7 @@ all: uImage vmlinux.elf
 
 KBUILD_DEFCONFIG        := atstk1002_defconfig
 
-KBUILD_CFLAGS   += -pipe -fno-builtin -mno-pic
+KBUILD_CFLAGS   += -pipe -fno-builtin -mno-pic -D__linux__
 KBUILD_AFLAGS   += -mrelax -mno-pic
 KBUILD_CFLAGS_MODULE += -mno-relax
 LDFLAGS_vmlinux += --relax
diff --git a/arch/avr32/boards/mimc200/fram.c b/arch/avr32/boards/mimc200/fram.c
index 9764a1a1073e..c1466a872b9c 100644
--- a/arch/avr32/boards/mimc200/fram.c
+++ b/arch/avr32/boards/mimc200/fram.c
@@ -11,6 +11,7 @@
 #define FRAM_VERSION    "1.0"
 
 #include <linux/miscdevice.h>
+#include <linux/module.h>
 #include <linux/proc_fs.h>
 #include <linux/mm.h>
 #include <linux/io.h>
diff --git a/arch/avr32/include/asm/Kbuild b/arch/avr32/include/asm/Kbuild
index cfb9fe1b8df9..c7c64a63c29f 100644
--- a/arch/avr32/include/asm/Kbuild
+++ b/arch/avr32/include/asm/Kbuild
@@ -17,5 +17,6 @@ generic-y       += scatterlist.h
 generic-y       += sections.h
 generic-y       += topology.h
 generic-y       += trace_clock.h
+generic-y += vga.h
 generic-y       += xor.h
 generic-y       += hash.h
diff --git a/arch/avr32/include/asm/io.h b/arch/avr32/include/asm/io.h
index fc6483f83ccc..4f5ec2bb7172 100644
--- a/arch/avr32/include/asm/io.h
+++ b/arch/avr32/include/asm/io.h
@@ -295,6 +295,8 @@ extern void __iounmap(void __iomem *addr);
 #define iounmap(addr)                           \
         __iounmap(addr)
 
+#define ioremap_wc ioremap_nocache
+
 #define cached(addr) P1SEGADDR(addr)
 #define uncached(addr) P2SEGADDR(addr)
 
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 7cc8c364924d..6fb9e813a910 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,4 +1,4 @@
-
+generic-y += barrier.h
 generic-y += bitsperlong.h
 generic-y += clkdev.h
 generic-y += cputime.h
@@ -6,6 +6,7 @@ generic-y += device.h
 generic-y += emergency-restart.h
 generic-y += errno.h
 generic-y += exec.h
+generic-y += hash.h
 generic-y += hw_irq.h
 generic-y += ioctl.h
 generic-y += ipcbuf.h
@@ -18,6 +19,7 @@ generic-y += local.h
 generic-y += mman.h
 generic-y += mutex.h
 generic-y += percpu.h
+generic-y += preempt.h
 generic-y += resource.h
 generic-y += scatterlist.h
 generic-y += sections.h
@@ -31,5 +33,3 @@ generic-y += trace_clock.h
 generic-y += types.h
 generic-y += word-at-a-time.h
 generic-y += xor.h
-generic-y += preempt.h
-generic-y += hash.h
diff --git a/arch/m68k/include/asm/barrier.h b/arch/m68k/include/asm/barrier.h
deleted file mode 100644
index 15c5f77c1614..000000000000
--- a/arch/m68k/include/asm/barrier.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef _M68K_BARRIER_H
-#define _M68K_BARRIER_H
-
-#define nop()           do { asm volatile ("nop"); barrier(); } while (0)
-
-#include <asm-generic/barrier.h>
-
-#endif /* _M68K_BARRIER_H */
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 014f288fc813..9d38b73989eb 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             349
+#define NR_syscalls             351
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 625f321001dc..b932dd470041 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -354,5 +354,7 @@
 #define __NR_process_vm_writev  346
 #define __NR_kcmp               347
 #define __NR_finit_module       348
+#define __NR_sched_setattr      349
+#define __NR_sched_getattr      350
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 3f04ea0ab802..b6223dc41d82 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -369,4 +369,6 @@ ENTRY(sys_call_table)
         .long sys_process_vm_writev
         .long sys_kcmp
         .long sys_finit_module
+        .long sys_sched_setattr
+        .long sys_sched_getattr         /* 350 */
 
diff --git a/arch/microblaze/include/asm/delay.h b/arch/microblaze/include/asm/delay.h
index 05b7d39e4391..66fc24c24238 100644
--- a/arch/microblaze/include/asm/delay.h
+++ b/arch/microblaze/include/asm/delay.h
@@ -13,6 +13,8 @@
 #ifndef _ASM_MICROBLAZE_DELAY_H
 #define _ASM_MICROBLAZE_DELAY_H
 
+#include <linux/param.h>
+
 extern inline void __delay(unsigned long loops)
 {
         asm volatile ("# __delay                \n\t"           \
diff --git a/arch/microblaze/include/asm/io.h b/arch/microblaze/include/asm/io.h
index a2cea7206077..3fbb7f1db3bc 100644
--- a/arch/microblaze/include/asm/io.h
+++ b/arch/microblaze/include/asm/io.h
@@ -89,6 +89,11 @@ static inline unsigned int readl(const volatile void __iomem *addr)
 {
         return le32_to_cpu(*(volatile unsigned int __force *)addr);
 }
+#define readq readq
+static inline u64 readq(const volatile void __iomem *addr)
+{
+        return le64_to_cpu(__raw_readq(addr));
+}
 static inline void writeb(unsigned char v, volatile void __iomem *addr)
 {
         *(volatile unsigned char __force *)addr = v;
@@ -101,6 +106,7 @@ static inline void writel(unsigned int v, volatile void __iomem *addr)
 {
         *(volatile unsigned int __force *)addr = cpu_to_le32(v);
 }
+#define writeq(b, addr) __raw_writeq(cpu_to_le64(b), addr)
 
 /* ioread and iowrite variants. thease are for now same as __raw_
  * variants of accessors. we might check for endianess in the feature
diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index b7fb0438458c..17645b2e2f07 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -66,7 +66,7 @@ real_start:
         mts     rmsr, r0
 /* Disable stack protection from bootloader */
         mts     rslr, r0
-        addi    r8, r0, 0xFFFFFFF
+        addi    r8, r0, 0xFFFFFFFF
         mts     rshr, r8
 /*
  * According to Xilinx, msrclr instruction behaves like 'mfs rX,rpc'
diff --git a/arch/powerpc/include/asm/dma-mapping.h b/arch/powerpc/include/asm/dma-mapping.h
index e27e9ad6818e..150866b2a3fe 100644
--- a/arch/powerpc/include/asm/dma-mapping.h
+++ b/arch/powerpc/include/asm/dma-mapping.h
@@ -134,6 +134,7 @@ static inline int dma_supported(struct device *dev, u64 mask)
 }
 
 extern int dma_set_mask(struct device *dev, u64 dma_mask);
+extern int __dma_set_mask(struct device *dev, u64 dma_mask);
 
 #define dma_alloc_coherent(d,s,h,f)     dma_alloc_attrs(d,s,h,f,NULL)
 
diff --git a/arch/powerpc/include/asm/eeh.h b/arch/powerpc/include/asm/eeh.h
index 9e39ceb1d19f..d4dd41fb951b 100644
--- a/arch/powerpc/include/asm/eeh.h
+++ b/arch/powerpc/include/asm/eeh.h
@@ -172,10 +172,20 @@ struct eeh_ops {
 };
 
 extern struct eeh_ops *eeh_ops;
-extern int eeh_subsystem_enabled;
+extern bool eeh_subsystem_enabled;
 extern raw_spinlock_t confirm_error_lock;
 extern int eeh_probe_mode;
 
+static inline bool eeh_enabled(void)
+{
+        return eeh_subsystem_enabled;
+}
+
+static inline void eeh_set_enable(bool mode)
+{
+        eeh_subsystem_enabled = mode;
+}
+
 #define EEH_PROBE_MODE_DEV      (1<<0)  /* From PCI device      */
 #define EEH_PROBE_MODE_DEVTREE  (1<<1)  /* From device tree     */
 
@@ -246,7 +256,7 @@ void eeh_remove_device(struct pci_dev *);
  * If this macro yields TRUE, the caller relays to eeh_check_failure()
  * which does further tests out of line.
  */
-#define EEH_POSSIBLE_ERROR(val, type)   ((val) == (type)~0 && eeh_subsystem_enabled)
+#define EEH_POSSIBLE_ERROR(val, type)   ((val) == (type)~0 && eeh_enabled())
 
 /*
  * Reads from a device which has been isolated by EEH will return
@@ -257,6 +267,13 @@ void eeh_remove_device(struct pci_dev *);
 
 #else /* !CONFIG_EEH */
 
+static inline bool eeh_enabled(void)
+{
+        return false;
+}
+
+static inline void eeh_set_enable(bool mode) { }
+
 static inline int eeh_init(void)
 {
         return 0;
diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h
index d750336b171d..623f2971ce0e 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -127,7 +127,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
                                             unsigned long addr, pte_t *ptep)
 {
 #ifdef CONFIG_PPC64
-        return __pte(pte_update(mm, addr, ptep, ~0UL, 1));
+        return __pte(pte_update(mm, addr, ptep, ~0UL, 0, 1));
 #else
         return __pte(pte_update(ptep, ~0UL, 0));
 #endif
diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
index f7a8036579b5..42632c7a2a4e 100644
--- a/arch/powerpc/include/asm/iommu.h
+++ b/arch/powerpc/include/asm/iommu.h
@@ -77,6 +77,7 @@ struct iommu_table {
 #ifdef CONFIG_IOMMU_API
         struct iommu_group *it_group;
 #endif
+        void (*set_bypass)(struct iommu_table *tbl, bool enable);
 };
 
 /* Pure 2^n version of get_order */
diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h
index bc141c950b1e..eb9261024f51 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -195,6 +195,7 @@ extern void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
 static inline unsigned long pte_update(struct mm_struct *mm,
                                        unsigned long addr,
                                        pte_t *ptep, unsigned long clr,
+                                       unsigned long set,
                                        int huge)
 {
 #ifdef PTE_ATOMIC_UPDATES
@@ -205,14 +206,15 @@ static inline unsigned long pte_update(struct mm_struct *mm,
         andi.   %1,%0,%6\n\
         bne-    1b \n\
         andc    %1,%0,%4 \n\
+        or      %1,%1,%7\n\
         stdcx.  %1,0,%3 \n\
         bne-    1b"
         : "=&r" (old), "=&r" (tmp), "=m" (*ptep)
-        : "r" (ptep), "r" (clr), "m" (*ptep), "i" (_PAGE_BUSY)
+        : "r" (ptep), "r" (clr), "m" (*ptep), "i" (_PAGE_BUSY), "r" (set)
         : "cc" );
 #else
         unsigned long old = pte_val(*ptep);
-        *ptep = __pte(old & ~clr);
+        *ptep = __pte((old & ~clr) | set);
 #endif
         /* huge pages use the old page table lock */
         if (!huge)
@@ -231,9 +233,9 @@ static inline int __ptep_test_and_clear_young(struct mm_struct *mm,
 {
         unsigned long old;
 
-        if ((pte_val(*ptep) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
+        if ((pte_val(*ptep) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
                 return 0;
-        old = pte_update(mm, addr, ptep, _PAGE_ACCESSED, 0);
+        old = pte_update(mm, addr, ptep, _PAGE_ACCESSED, 0, 0);
         return (old & _PAGE_ACCESSED) != 0;
 }
 #define __HAVE_ARCH_PTEP_TEST_AND_CLEAR_YOUNG
@@ -252,7 +254,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
         if ((pte_val(*ptep) & _PAGE_RW) == 0)
                 return;
 
-        pte_update(mm, addr, ptep, _PAGE_RW, 0);
+        pte_update(mm, addr, ptep, _PAGE_RW, 0, 0);
 }
 
 static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
@@ -261,7 +263,7 @@ static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
         if ((pte_val(*ptep) & _PAGE_RW) == 0)
                 return;
 
-        pte_update(mm, addr, ptep, _PAGE_RW, 1);
+        pte_update(mm, addr, ptep, _PAGE_RW, 0, 1);
 }
 
 /*
@@ -284,14 +286,14 @@ static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
 static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
                                        unsigned long addr, pte_t *ptep)
 {
-        unsigned long old = pte_update(mm, addr, ptep, ~0UL, 0);
+        unsigned long old = pte_update(mm, addr, ptep, ~0UL, 0, 0);
         return __pte(old);
 }
 
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr,
                              pte_t * ptep)
 {
-        pte_update(mm, addr, ptep, ~0UL, 0);
+        pte_update(mm, addr, ptep, ~0UL, 0, 0);
 }
 
 
@@ -506,7 +508,9 @@ extern int pmdp_set_access_flags(struct vm_area_struct *vma,
 
 extern unsigned long pmd_hugepage_update(struct mm_struct *mm,
                                          unsigned long addr,
-                                         pmd_t *pmdp, unsigned long clr);
+                                         pmd_t *pmdp,
+                                         unsigned long clr,
+                                         unsigned long set);
 
 static inline int __pmdp_test_and_clear_young(struct mm_struct *mm,
                                               unsigned long addr, pmd_t *pmdp)
@@ -515,7 +519,7 @@ static inline int __pmdp_test_and_clear_young(struct mm_struct *mm,
 
         if ((pmd_val(*pmdp) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
                 return 0;
-        old = pmd_hugepage_update(mm, addr, pmdp, _PAGE_ACCESSED);
+        old = pmd_hugepage_update(mm, addr, pmdp, _PAGE_ACCESSED, 0);
         return ((old & _PAGE_ACCESSED) != 0);
 }
 
@@ -542,7 +546,7 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm, unsigned long addr,
         if ((pmd_val(*pmdp) & _PAGE_RW) == 0)
                 return;
 
-        pmd_hugepage_update(mm, addr, pmdp, _PAGE_RW);
+        pmd_hugepage_update(mm, addr, pmdp, _PAGE_RW, 0);
 }
 
 #define __HAVE_ARCH_PMDP_SPLITTING_FLUSH
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index f83b6f3e1b39..3ebb188c3ff5 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -75,12 +75,34 @@ static inline pte_t pte_mknuma(pte_t pte)
         return pte;
 }
 
+#define ptep_set_numa ptep_set_numa
+static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pte_t *ptep)
+{
+        if ((pte_val(*ptep) & _PAGE_PRESENT) == 0)
+                VM_BUG_ON(1);
+
+        pte_update(mm, addr, ptep, _PAGE_PRESENT, _PAGE_NUMA, 0);
+        return;
+}
+
 #define pmd_numa pmd_numa
 static inline int pmd_numa(pmd_t pmd)
 {
         return pte_numa(pmd_pte(pmd));
 }
 
+#define pmdp_set_numa pmdp_set_numa
+static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pmd_t *pmdp)
+{
+        if ((pmd_val(*pmdp) & _PAGE_PRESENT) == 0)
+                VM_BUG_ON(1);
+
+        pmd_hugepage_update(mm, addr, pmdp, _PAGE_PRESENT, _PAGE_NUMA);
+        return;
+}
+
 #define pmd_mknonnuma pmd_mknonnuma
 static inline pmd_t pmd_mknonnuma(pmd_t pmd)
 {
diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h
index 4ee06fe15de4..d0e784e0ff48 100644
--- a/arch/powerpc/include/asm/sections.h
+++ b/arch/powerpc/include/asm/sections.h
@@ -8,6 +8,7 @@
 
 #ifdef __powerpc64__
 
+extern char __start_interrupts[];
 extern char __end_interrupts[];
 
 extern char __prom_init_toc_start[];
@@ -21,6 +22,17 @@ static inline int in_kernel_text(unsigned long addr)
         return 0;
 }
 
+static inline int overlaps_interrupt_vector_text(unsigned long start,
+                                                        unsigned long end)
+{
+        unsigned long real_start, real_end;
+        real_start = __start_interrupts - _stext;
+        real_end = __end_interrupts - _stext;
+
+        return start < (unsigned long)__va(real_end) &&
+                (unsigned long)__va(real_start) < end;
+}
+
 static inline int overlaps_kernel_text(unsigned long start, unsigned long end)
 {
         return start < (unsigned long)__init_end &&
diff --git a/arch/powerpc/include/asm/vdso.h b/arch/powerpc/include/asm/vdso.h
index 0d9cecddf8a4..c53f5f6d1761 100644
--- a/arch/powerpc/include/asm/vdso.h
+++ b/arch/powerpc/include/asm/vdso.h
@@ -4,11 +4,11 @@
 #ifdef __KERNEL__
 
 /* Default link addresses for the vDSOs */
-#define VDSO32_LBASE    0x100000
-#define VDSO64_LBASE    0x100000
+#define VDSO32_LBASE    0x0
+#define VDSO64_LBASE    0x0
 
 /* Default map addresses for 32bit vDSO */
-#define VDSO32_MBASE    VDSO32_LBASE
+#define VDSO32_MBASE    0x100000
 
 #define VDSO_VERSION_STRING     LINUX_2.6.15
 
diff --git a/arch/powerpc/kernel/dma.c b/arch/powerpc/kernel/dma.c
index 8032b97ccdcb..ee78f6e49d64 100644
--- a/arch/powerpc/kernel/dma.c
+++ b/arch/powerpc/kernel/dma.c
@@ -191,12 +191,10 @@ EXPORT_SYMBOL(dma_direct_ops);
 
 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
 
-int dma_set_mask(struct device *dev, u64 dma_mask)
+int __dma_set_mask(struct device *dev, u64 dma_mask)
 {
         struct dma_map_ops *dma_ops = get_dma_ops(dev);
 
-        if (ppc_md.dma_set_mask)
-                return ppc_md.dma_set_mask(dev, dma_mask);
         if ((dma_ops != NULL) && (dma_ops->set_dma_mask != NULL))
                 return dma_ops->set_dma_mask(dev, dma_mask);
         if (!dev->dma_mask || !dma_supported(dev, dma_mask))
@@ -204,6 +202,12 @@ int dma_set_mask(struct device *dev, u64 dma_mask)
         *dev->dma_mask = dma_mask;
         return 0;
 }
+int dma_set_mask(struct device *dev, u64 dma_mask)
+{
+        if (ppc_md.dma_set_mask)
+                return ppc_md.dma_set_mask(dev, dma_mask);
+        return __dma_set_mask(dev, dma_mask);
+}
 EXPORT_SYMBOL(dma_set_mask);
 
 u64 dma_get_required_mask(struct device *dev)
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 148db72a8c43..e7b76a6bf150 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -28,6 +28,7 @@
 #include <linux/pci.h>
 #include <linux/proc_fs.h>
 #include <linux/rbtree.h>
+#include <linux/reboot.h>
 #include <linux/seq_file.h>
 #include <linux/spinlock.h>
 #include <linux/export.h>
@@ -89,7 +90,7 @@
 /* Platform dependent EEH operations */
 struct eeh_ops *eeh_ops = NULL;
 
-int eeh_subsystem_enabled;
+bool eeh_subsystem_enabled = false;
 EXPORT_SYMBOL(eeh_subsystem_enabled);
 
 /*
@@ -364,7 +365,7 @@ int eeh_dev_check_failure(struct eeh_dev *edev)
 
         eeh_stats.total_mmio_ffs++;
 
-        if (!eeh_subsystem_enabled)
+        if (!eeh_enabled())
                 return 0;
 
         if (!edev) {
@@ -747,6 +748,17 @@ int __exit eeh_ops_unregister(const char *name)
         return -EEXIST;
 }
 
+static int eeh_reboot_notifier(struct notifier_block *nb,
+                               unsigned long action, void *unused)
+{
+        eeh_set_enable(false);
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block eeh_reboot_nb = {
+        .notifier_call = eeh_reboot_notifier,
+};
+
 /**
  * eeh_init - EEH initialization
  *
@@ -778,6 +790,14 @@ int eeh_init(void)
         if (machine_is(powernv) && cnt++ <= 0)
                 return ret;
 
+        /* Register reboot notifier */
+        ret = register_reboot_notifier(&eeh_reboot_nb);
+        if (ret) {
+                pr_warn("%s: Failed to register notifier (%d)\n",
+                        __func__, ret);
+                return ret;
+        }
+
         /* call platform initialization function */
         if (!eeh_ops) {
                 pr_warning("%s: Platform EEH operation not found\n",
@@ -822,7 +842,7 @@ int eeh_init(void)
                         return ret;
         }
 
-        if (eeh_subsystem_enabled)
+        if (eeh_enabled())
                 pr_info("EEH: PCI Enhanced I/O Error Handling Enabled\n");
         else
                 pr_warning("EEH: No capable adapters found\n");
@@ -897,7 +917,7 @@ void eeh_add_device_late(struct pci_dev *dev)
         struct device_node *dn;
         struct eeh_dev *edev;
 
-        if (!dev || !eeh_subsystem_enabled)
+        if (!dev || !eeh_enabled())
                 return;
 
         pr_debug("EEH: Adding device %s\n", pci_name(dev));
@@ -1005,7 +1025,7 @@ void eeh_remove_device(struct pci_dev *dev)
 {
         struct eeh_dev *edev;
 
-        if (!dev || !eeh_subsystem_enabled)
+        if (!dev || !eeh_enabled())
                 return;
         edev = pci_dev_to_eeh_dev(dev);
 
@@ -1045,7 +1065,7 @@ void eeh_remove_device(struct pci_dev *dev)
 
 static int proc_eeh_show(struct seq_file *m, void *v)
 {
-        if (0 == eeh_subsystem_enabled) {
+        if (!eeh_enabled()) {
                 seq_printf(m, "EEH Subsystem is globally disabled\n");
                 seq_printf(m, "eeh_total_mmio_ffs=%llu\n", eeh_stats.total_mmio_ffs);
         } else {
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 7bb30dca4e19..fdc679d309ec 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -362,9 +362,13 @@ static void *eeh_rmv_device(void *data, void *userdata)
          */
         if (!dev || (dev->hdr_type & PCI_HEADER_TYPE_BRIDGE))
                 return NULL;
+
         driver = eeh_pcid_get(dev);
-        if (driver && driver->err_handler)
-                return NULL;
+        if (driver) {
+                eeh_pcid_put(dev);
+                if (driver->err_handler)
+                        return NULL;
+        }
 
         /* Remove it from PCI subsystem */
         pr_debug("EEH: Removing %s without EEH sensitive driver\n",
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index d773dd440a45..88e3ec6e1d96 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -1088,6 +1088,14 @@ int iommu_take_ownership(struct iommu_table *tbl)
         memset(tbl->it_map, 0xff, sz);
         iommu_clear_tces_and_put_pages(tbl, tbl->it_offset, tbl->it_size);
 
+        /*
+         * Disable iommu bypass, otherwise the user can DMA to all of
+         * our physical memory via the bypass window instead of just
+         * the pages that has been explicitly mapped into the iommu
+         */
+        if (tbl->set_bypass)
+                tbl->set_bypass(tbl, false);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(iommu_take_ownership);
@@ -1102,6 +1110,10 @@ void iommu_release_ownership(struct iommu_table *tbl)
         /* Restore bit#0 set by iommu_init_table() */
         if (tbl->it_offset == 0)
                 set_bit(0, tbl->it_map);
+
+        /* The kernel owns the device now, we can restore the iommu bypass */
+        if (tbl->set_bypass)
+                tbl->set_bypass(tbl, true);
 }
 EXPORT_SYMBOL_GPL(iommu_release_ownership);
 
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 9729b23bfb0a..1d0848bba049 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -559,8 +559,13 @@ void exc_lvl_ctx_init(void)
 #ifdef CONFIG_PPC64
                 cpu_nr = i;
 #else
+#ifdef CONFIG_SMP
                 cpu_nr = get_hard_smp_processor_id(i);
+#else
+                cpu_nr = 0;
 #endif
+#endif
+
                 memset((void *)critirq_ctx[cpu_nr], 0, THREAD_SIZE);
                 tp = critirq_ctx[cpu_nr];
                 tp->cpu = cpu_nr;
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index 75d4f7340da8..015ae55c1868 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -196,7 +196,9 @@ int overlaps_crashkernel(unsigned long start, unsigned long size)
 
 /* Values we need to export to the second kernel via the device tree. */
 static phys_addr_t kernel_end;
+static phys_addr_t crashk_base;
 static phys_addr_t crashk_size;
+static unsigned long long mem_limit;
 
 static struct property kernel_end_prop = {
         .name = "linux,kernel-end",
@@ -207,7 +209,7 @@ static struct property kernel_end_prop = {
 static struct property crashk_base_prop = {
         .name = "linux,crashkernel-base",
         .length = sizeof(phys_addr_t),
-        .value = &crashk_res.start,
+        .value = &crashk_base
 };
 
 static struct property crashk_size_prop = {
@@ -219,9 +221,11 @@ static struct property crashk_size_prop = {
 static struct property memory_limit_prop = {
         .name = "linux,memory-limit",
         .length = sizeof(unsigned long long),
-        .value = &memory_limit,
+        .value = &mem_limit,
 };
 
+#define cpu_to_be_ulong __PASTE(cpu_to_be, BITS_PER_LONG)
+
 static void __init export_crashk_values(struct device_node *node)
 {
         struct property *prop;
@@ -237,8 +241,9 @@ static void __init export_crashk_values(struct device_node *node)
                 of_remove_property(node, prop);
 
         if (crashk_res.start != 0) {
+                crashk_base = cpu_to_be_ulong(crashk_res.start),
                 of_add_property(node, &crashk_base_prop);
-                crashk_size = resource_size(&crashk_res);
+                crashk_size = cpu_to_be_ulong(resource_size(&crashk_res));
                 of_add_property(node, &crashk_size_prop);
         }
 
@@ -246,6 +251,7 @@ static void __init export_crashk_values(struct device_node *node)
          * memory_limit is required by the kexec-tools to limit the
          * crash regions to the actual memory used.
          */
+        mem_limit = cpu_to_be_ulong(memory_limit);
         of_update_property(node, &memory_limit_prop);
 }
 
@@ -264,7 +270,7 @@ static int __init kexec_setup(void)
                 of_remove_property(node, prop);
 
         /* information needed by userspace when using default_machine_kexec */
-        kernel_end = __pa(_end);
+        kernel_end = cpu_to_be_ulong(__pa(_end));
         of_add_property(node, &kernel_end_prop);
 
         export_crashk_values(node);
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index be4e6d648f60..59d229a2a3e0 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -369,6 +369,7 @@ void default_machine_kexec(struct kimage *image)
 
 /* Values we need to export to the second kernel via the device tree. */
 static unsigned long htab_base;
+static unsigned long htab_size;
 
 static struct property htab_base_prop = {
         .name = "linux,htab-base",
@@ -379,7 +380,7 @@ static struct property htab_base_prop = {
 static struct property htab_size_prop = {
         .name = "linux,htab-size",
         .length = sizeof(unsigned long),
-        .value = &htab_size_bytes,
+        .value = &htab_size,
 };
 
 static int __init export_htab_values(void)
@@ -403,8 +404,9 @@ static int __init export_htab_values(void)
         if (prop)
                 of_remove_property(node, prop);
 
-        htab_base = __pa(htab_address);
+        htab_base = cpu_to_be64(__pa(htab_address));
         of_add_property(node, &htab_base_prop);
+        htab_size = cpu_to_be64(htab_size_bytes);
         of_add_property(node, &htab_size_prop);
 
         of_node_put(node);
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index 879f09620f83..7c6bb4b17b49 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -57,11 +57,14 @@ _GLOBAL(call_do_softirq)
         mtlr    r0
         blr
 
+/*
+ * void call_do_irq(struct pt_regs *regs, struct thread_info *irqtp);
+ */
 _GLOBAL(call_do_irq)
         mflr    r0
         stw     r0,4(r1)
         lwz     r10,THREAD+KSP_LIMIT(r2)
-        addi    r11,r3,THREAD_INFO_GAP
+        addi    r11,r4,THREAD_INFO_GAP
         stwu    r1,THREAD_SIZE-STACK_FRAME_OVERHEAD(r4)
         mr      r1,r4
         stw     r10,8(r1)
diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S
index b47a0e1ab001..1482327cfeba 100644
--- a/arch/powerpc/kernel/reloc_64.S
+++ b/arch/powerpc/kernel/reloc_64.S
@@ -69,8 +69,8 @@ _GLOBAL(relocate)
          * R_PPC64_RELATIVE ones.
          */
         mtctr   r8
-5:      lwz     r0,12(9)        /* ELF64_R_TYPE(reloc->r_info) */
-        cmpwi   r0,R_PPC64_RELATIVE
+5:      ld      r0,8(9)         /* ELF64_R_TYPE(reloc->r_info) */
+        cmpdi   r0,R_PPC64_RELATIVE
         bne     6f
         ld      r6,0(r9)        /* reloc->r_offset */
         ld      r0,16(r9)       /* reloc->r_addend */
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index 2b0da27eaee4..04cc4fcca78b 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -247,7 +247,12 @@ static void __init exc_lvl_early_init(void)
         /* interrupt stacks must be in lowmem, we get that for free on ppc32
          * as the memblock is limited to lowmem by MEMBLOCK_REAL_LIMIT */
         for_each_possible_cpu(i) {
+#ifdef CONFIG_SMP
                 hw_cpu = get_hard_smp_processor_id(i);
+#else
+                hw_cpu = 0;
+#endif
+
                 critirq_ctx[hw_cpu] = (struct thread_info *)
                         __va(memblock_alloc(THREAD_SIZE, THREAD_SIZE));
 #ifdef CONFIG_BOOKE
diff --git a/arch/powerpc/kernel/vdso32/vdso32_wrapper.S b/arch/powerpc/kernel/vdso32/vdso32_wrapper.S
index 79683d0393f5..6ac107ac402a 100644
--- a/arch/powerpc/kernel/vdso32/vdso32_wrapper.S
+++ b/arch/powerpc/kernel/vdso32/vdso32_wrapper.S
@@ -6,7 +6,7 @@
         .globl vdso32_start, vdso32_end
         .balign PAGE_SIZE
 vdso32_start:
-        .incbin "arch/powerpc/kernel/vdso32/vdso32.so"
+        .incbin "arch/powerpc/kernel/vdso32/vdso32.so.dbg"
         .balign PAGE_SIZE
 vdso32_end:
 
diff --git a/arch/powerpc/kernel/vdso64/vdso64_wrapper.S b/arch/powerpc/kernel/vdso64/vdso64_wrapper.S
index 8df9e2463007..df60fca6a13d 100644
--- a/arch/powerpc/kernel/vdso64/vdso64_wrapper.S
+++ b/arch/powerpc/kernel/vdso64/vdso64_wrapper.S
@@ -6,7 +6,7 @@
         .globl vdso64_start, vdso64_end
         .balign PAGE_SIZE
 vdso64_start:
-        .incbin "arch/powerpc/kernel/vdso64/vdso64.so"
+        .incbin "arch/powerpc/kernel/vdso64/vdso64.so.dbg"
         .balign PAGE_SIZE
 vdso64_end:
 
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index de6881259aef..d766d6ee33fe 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -207,6 +207,20 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend,
                 if (overlaps_kernel_text(vaddr, vaddr + step))
                         tprot &= ~HPTE_R_N;
 
+                /*
+                 * If relocatable, check if it overlaps interrupt vectors that
+                 * are copied down to real 0. For relocatable kernel
+                 * (e.g. kdump case) we copy interrupt vectors down to real
+                 * address 0. Mark that region as executable. This is
+                 * because on p8 system with relocation on exception feature
+                 * enabled, exceptions are raised with MMU (IR=DR=1) ON. Hence
+                 * in order to execute the interrupt handlers in virtual
+                 * mode the vector region need to be marked as executable.
+                 */
+                if ((PHYSICAL_START > MEMORY_START) &&
+                        overlaps_interrupt_vector_text(vaddr, vaddr + step))
+                                tprot &= ~HPTE_R_N;
+
                 hash = hpt_hash(vpn, shift, ssize);
                 hpteg = ((hash & htab_hash_mask) * HPTES_PER_GROUP);
 
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 65b7b65e8708..62bf5e8e78da 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -510,7 +510,8 @@ int pmdp_set_access_flags(struct vm_area_struct *vma, unsigned long address,
 }
 
 unsigned long pmd_hugepage_update(struct mm_struct *mm, unsigned long addr,
-                                  pmd_t *pmdp, unsigned long clr)
+                                  pmd_t *pmdp, unsigned long clr,
+                                  unsigned long set)
 {
 
         unsigned long old, tmp;
@@ -526,14 +527,15 @@ unsigned long pmd_hugepage_update(struct mm_struct *mm, unsigned long addr,
                 andi.   %1,%0,%6\n\
                 bne-    1b \n\
                 andc    %1,%0,%4 \n\
+                or      %1,%1,%7\n\
                 stdcx.  %1,0,%3 \n\
                 bne-    1b"
         : "=&r" (old), "=&r" (tmp), "=m" (*pmdp)
-        : "r" (pmdp), "r" (clr), "m" (*pmdp), "i" (_PAGE_BUSY)
+        : "r" (pmdp), "r" (clr), "m" (*pmdp), "i" (_PAGE_BUSY), "r" (set)
         : "cc" );
 #else
         old = pmd_val(*pmdp);
-        *pmdp = __pmd(old & ~clr);
+        *pmdp = __pmd((old & ~clr) | set);
 #endif
         if (old & _PAGE_HASHPTE)
                 hpte_do_hugepage_flush(mm, addr, pmdp);
@@ -708,7 +710,7 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
 void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
                      pmd_t *pmdp)
 {
-        pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_PRESENT);
+        pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_PRESENT, 0);
 }
 
 /*
@@ -835,7 +837,7 @@ pmd_t pmdp_get_and_clear(struct mm_struct *mm,
         unsigned long old;
         pgtable_t *pgtable_slot;
 
-        old = pmd_hugepage_update(mm, addr, pmdp, ~0UL);
+        old = pmd_hugepage_update(mm, addr, pmdp, ~0UL, 0);
         old_pmd = __pmd(old);
         /*
          * We have pmd == none and we are holding page_table_lock.
diff --git a/arch/powerpc/mm/subpage-prot.c b/arch/powerpc/mm/subpage-prot.c
index a770df2dae70..6c0b1f5f8d2c 100644
--- a/arch/powerpc/mm/subpage-prot.c
+++ b/arch/powerpc/mm/subpage-prot.c
@@ -78,7 +78,7 @@ static void hpte_flush_range(struct mm_struct *mm, unsigned long addr,
         pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
         arch_enter_lazy_mmu_mode();
         for (; npages > 0; --npages) {
-                pte_update(mm, addr, pte, 0, 0);
+                pte_update(mm, addr, pte, 0, 0, 0);
                 addr += PAGE_SIZE;
                 ++pte;
         }
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 29b89e863d7c..67cf22083f4c 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -1147,6 +1147,9 @@ static void power_pmu_enable(struct pmu *pmu)
         mmcr0 = ebb_switch_in(ebb, cpuhw->mmcr[0]);
 
         mb();
+        if (cpuhw->bhrb_users)
+                ppmu->config_bhrb(cpuhw->bhrb_filter);
+
         write_mmcr0(cpuhw, mmcr0);
 
         /*
@@ -1158,8 +1161,6 @@ static void power_pmu_enable(struct pmu *pmu)
         }
 
  out:
-        if (cpuhw->bhrb_users)
-                ppmu->config_bhrb(cpuhw->bhrb_filter);
 
         local_irq_restore(flags);
 }
diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
index a3f7abd2f13f..96cee20dcd34 100644
--- a/arch/powerpc/perf/power8-pmu.c
+++ b/arch/powerpc/perf/power8-pmu.c
@@ -25,6 +25,37 @@
 #define PM_BRU_FIN                      0x10068
 #define PM_BR_MPRED_CMPL                0x400f6
 
+/* All L1 D cache load references counted at finish, gated by reject */
+#define PM_LD_REF_L1                    0x100ee
+/* Load Missed L1 */
+#define PM_LD_MISS_L1                   0x3e054
+/* Store Missed L1 */
+#define PM_ST_MISS_L1                   0x300f0
+/* L1 cache data prefetches */
+#define PM_L1_PREF                      0x0d8b8
+/* Instruction fetches from L1 */
+#define PM_INST_FROM_L1                 0x04080
+/* Demand iCache Miss */
+#define PM_L1_ICACHE_MISS               0x200fd
+/* Instruction Demand sectors wriittent into IL1 */
+#define PM_L1_DEMAND_WRITE              0x0408c
+/* Instruction prefetch written into IL1 */
+#define PM_IC_PREF_WRITE                0x0408e
+/* The data cache was reloaded from local core's L3 due to a demand load */
+#define PM_DATA_FROM_L3                 0x4c042
+/* Demand LD - L3 Miss (not L2 hit and not L3 hit) */
+#define PM_DATA_FROM_L3MISS             0x300fe
+/* All successful D-side store dispatches for this thread */
+#define PM_L2_ST                        0x17080
+/* All successful D-side store dispatches for this thread that were L2 Miss */
+#define PM_L2_ST_MISS                   0x17082
+/* Total HW L3 prefetches(Load+store) */
+#define PM_L3_PREF_ALL                  0x4e052
+/* Data PTEG reload */
+#define PM_DTLB_MISS                    0x300fc
+/* ITLB Reloaded */
+#define PM_ITLB_MISS                    0x400fc
+
 
 /*
  * Raw event encoding for POWER8:
@@ -557,6 +588,8 @@ static int power8_generic_events[] = {
         [PERF_COUNT_HW_INSTRUCTIONS] =                  PM_INST_CMPL,
         [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] =           PM_BRU_FIN,
         [PERF_COUNT_HW_BRANCH_MISSES] =                 PM_BR_MPRED_CMPL,
+        [PERF_COUNT_HW_CACHE_REFERENCES] =              PM_LD_REF_L1,
+        [PERF_COUNT_HW_CACHE_MISSES] =                  PM_LD_MISS_L1,
 };
 
 static u64 power8_bhrb_filter_map(u64 branch_sample_type)
@@ -596,6 +629,116 @@ static void power8_config_bhrb(u64 pmu_bhrb_filter)
         mtspr(SPRN_MMCRA, (mfspr(SPRN_MMCRA) | pmu_bhrb_filter));
 }
 
+#define C(x)    PERF_COUNT_HW_CACHE_##x
+
+/*
+ * Table of generalized cache-related events.
+ * 0 means not supported, -1 means nonsensical, other values
+ * are event codes.
+ */
+static int power8_cache_events[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = {
+        [ C(L1D) ] = {
+                [ C(OP_READ) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_LD_REF_L1,
+                        [ C(RESULT_MISS)   ] = PM_LD_MISS_L1,
+                },
+                [ C(OP_WRITE) ] = {
+                        [ C(RESULT_ACCESS) ] = 0,
+                        [ C(RESULT_MISS)   ] = PM_ST_MISS_L1,
+                },
+                [ C(OP_PREFETCH) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_L1_PREF,
+                        [ C(RESULT_MISS)   ] = 0,
+                },
+        },
+        [ C(L1I) ] = {
+                [ C(OP_READ) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_INST_FROM_L1,
+                        [ C(RESULT_MISS)   ] = PM_L1_ICACHE_MISS,
+                },
+                [ C(OP_WRITE) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_L1_DEMAND_WRITE,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+                [ C(OP_PREFETCH) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_IC_PREF_WRITE,
+                        [ C(RESULT_MISS)   ] = 0,
+                },
+        },
+        [ C(LL) ] = {
+                [ C(OP_READ) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_DATA_FROM_L3,
+                        [ C(RESULT_MISS)   ] = PM_DATA_FROM_L3MISS,
+                },
+                [ C(OP_WRITE) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_L2_ST,
+                        [ C(RESULT_MISS)   ] = PM_L2_ST_MISS,
+                },
+                [ C(OP_PREFETCH) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_L3_PREF_ALL,
+                        [ C(RESULT_MISS)   ] = 0,
+                },
+        },
+        [ C(DTLB) ] = {
+                [ C(OP_READ) ] = {
+                        [ C(RESULT_ACCESS) ] = 0,
+                        [ C(RESULT_MISS)   ] = PM_DTLB_MISS,
+                },
+                [ C(OP_WRITE) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+                [ C(OP_PREFETCH) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+        },
+        [ C(ITLB) ] = {
+                [ C(OP_READ) ] = {
+                        [ C(RESULT_ACCESS) ] = 0,
+                        [ C(RESULT_MISS)   ] = PM_ITLB_MISS,
+                },
+                [ C(OP_WRITE) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+                [ C(OP_PREFETCH) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+        },
+        [ C(BPU) ] = {
+                [ C(OP_READ) ] = {
+                        [ C(RESULT_ACCESS) ] = PM_BRU_FIN,
+                        [ C(RESULT_MISS)   ] = PM_BR_MPRED_CMPL,
+                },
+                [ C(OP_WRITE) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+                [ C(OP_PREFETCH) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+        },
+        [ C(NODE) ] = {
+                [ C(OP_READ) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+                [ C(OP_WRITE) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+                [ C(OP_PREFETCH) ] = {
+                        [ C(RESULT_ACCESS) ] = -1,
+                        [ C(RESULT_MISS)   ] = -1,
+                },
+        },
+};
+
+#undef C
+
 static struct power_pmu power8_pmu = {
         .name                   = "POWER8",
         .n_counter              = 6,
@@ -611,6 +754,7 @@ static struct power_pmu power8_pmu = {
         .flags                  = PPMU_HAS_SSLOT | PPMU_HAS_SIER | PPMU_BHRB | PPMU_EBB,
         .n_generic              = ARRAY_SIZE(power8_generic_events),
         .generic_events         = power8_generic_events,
+        .cache_events           = &power8_cache_events,
         .attr_groups            = power8_pmu_attr_groups,
         .bhrb_nr                = 32,
 };
diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
index e1e71618b70c..f51474336460 100644
--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
+++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
@@ -44,7 +44,8 @@ static int ioda_eeh_event(struct notifier_block *nb,
 
         /* We simply send special EEH event */
         if ((changed_evts & OPAL_EVENT_PCI_ERROR) &&
-            (events & OPAL_EVENT_PCI_ERROR))
+            (events & OPAL_EVENT_PCI_ERROR) &&
+            eeh_enabled())
                 eeh_send_failure_event(NULL);
 
         return 0;
@@ -489,8 +490,7 @@ static int ioda_eeh_bridge_reset(struct pci_controller *hose,
 static int ioda_eeh_reset(struct eeh_pe *pe, int option)
 {
         struct pci_controller *hose = pe->phb;
-        struct eeh_dev *edev;
-        struct pci_dev *dev;
+        struct pci_bus *bus;
         int ret;
 
         /*
@@ -519,31 +519,11 @@ static int ioda_eeh_reset(struct eeh_pe *pe, int option)
         if (pe->type & EEH_PE_PHB) {
                 ret = ioda_eeh_phb_reset(hose, option);
         } else {
-                if (pe->type & EEH_PE_DEVICE) {
-                        /*
-                         * If it's device PE, we didn't refer to the parent
-                         * PCI bus yet. So we have to figure it out indirectly.
-                         */
-                        edev = list_first_entry(&pe->edevs,
-                                        struct eeh_dev, list);
-                        dev = eeh_dev_to_pci_dev(edev);
-                        dev = dev->bus->self;
-                } else {
-                        /*
-                         * If it's bus PE, the parent PCI bus is already there
-                         * and just pick it up.
-                         */
-                        dev = pe->bus->self;
-                }
-
-                /*
-                 * Do reset based on the fact that the direct upstream bridge
-                 * is root bridge (port) or not.
-                 */
-                if (dev->bus->number == 0)
+                bus = eeh_pe_bus_get(pe);
+                if (pci_is_root_bus(bus))
                         ret = ioda_eeh_root_reset(hose, option);
                 else
-                        ret = ioda_eeh_bridge_reset(hose, dev, option);
+                        ret = ioda_eeh_bridge_reset(hose, bus->self, option);
         }
 
         return ret;
diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
index a79fddc5e74e..a59788e83b8b 100644
--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
@@ -145,7 +145,7 @@ static int powernv_eeh_dev_probe(struct pci_dev *dev, void *flag)
          * Enable EEH explicitly so that we will do EEH check
          * while accessing I/O stuff
          */
-        eeh_subsystem_enabled = 1;
+        eeh_set_enable(true);
 
         /* Save memory bars */
         eeh_save_bars(edev);
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 7d6dcc6d5fa9..3b2b4fb3585b 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -21,6 +21,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/msi.h>
+#include <linux/memblock.h>
 
 #include <asm/sections.h>
 #include <asm/io.h>
@@ -460,9 +461,39 @@ static void pnv_pci_ioda_dma_dev_setup(struct pnv_phb *phb, struct pci_dev *pdev
                 return;
 
         pe = &phb->ioda.pe_array[pdn->pe_number];
+        WARN_ON(get_dma_ops(&pdev->dev) != &dma_iommu_ops);
         set_iommu_table_base_and_group(&pdev->dev, &pe->tce32_table);
 }
 
+static int pnv_pci_ioda_dma_set_mask(struct pnv_phb *phb,
+                                     struct pci_dev *pdev, u64 dma_mask)
+{
+        struct pci_dn *pdn = pci_get_pdn(pdev);
+        struct pnv_ioda_pe *pe;
+        uint64_t top;
+        bool bypass = false;
+
+        if (WARN_ON(!pdn || pdn->pe_number == IODA_INVALID_PE))
+                return -ENODEV;;
+
+        pe = &phb->ioda.pe_array[pdn->pe_number];
+        if (pe->tce_bypass_enabled) {
+                top = pe->tce_bypass_base + memblock_end_of_DRAM() - 1;
+                bypass = (dma_mask >= top);
+        }
+
+        if (bypass) {
+                dev_info(&pdev->dev, "Using 64-bit DMA iommu bypass\n");
+                set_dma_ops(&pdev->dev, &dma_direct_ops);
+                set_dma_offset(&pdev->dev, pe->tce_bypass_base);
+        } else {
+                dev_info(&pdev->dev, "Using 32-bit DMA via iommu\n");
+                set_dma_ops(&pdev->dev, &dma_iommu_ops);
+                set_iommu_table_base(&pdev->dev, &pe->tce32_table);
+        }
+        return 0;
+}
+
 static void pnv_ioda_setup_bus_dma(struct pnv_ioda_pe *pe, struct pci_bus *bus)
 {
         struct pci_dev *dev;
@@ -657,6 +688,56 @@ static void pnv_pci_ioda_setup_dma_pe(struct pnv_phb *phb,
                 __free_pages(tce_mem, get_order(TCE32_TABLE_SIZE * segs));
 }
 
+static void pnv_pci_ioda2_set_bypass(struct iommu_table *tbl, bool enable)
+{
+        struct pnv_ioda_pe *pe = container_of(tbl, struct pnv_ioda_pe,
+                                              tce32_table);
+        uint16_t window_id = (pe->pe_number << 1 ) + 1;
+        int64_t rc;
+
+        pe_info(pe, "%sabling 64-bit DMA bypass\n", enable ? "En" : "Dis");
+        if (enable) {
+                phys_addr_t top = memblock_end_of_DRAM();
+
+                top = roundup_pow_of_two(top);
+                rc = opal_pci_map_pe_dma_window_real(pe->phb->opal_id,
+                                                     pe->pe_number,
+                                                     window_id,
+                                                     pe->tce_bypass_base,
+                                                     top);
+        } else {
+                rc = opal_pci_map_pe_dma_window_real(pe->phb->opal_id,
+                                                     pe->pe_number,
+                                                     window_id,
+                                                     pe->tce_bypass_base,
+                                                     0);
+
+                /*
+                 * We might want to reset the DMA ops of all devices on
+                 * this PE. However in theory, that shouldn't be necessary
+                 * as this is used for VFIO/KVM pass-through and the device
+                 * hasn't yet been returned to its kernel driver
+                 */
+        }
+        if (rc)
+                pe_err(pe, "OPAL error %lld configuring bypass window\n", rc);
+        else
+                pe->tce_bypass_enabled = enable;
+}
+
+static void pnv_pci_ioda2_setup_bypass_pe(struct pnv_phb *phb,
+                                          struct pnv_ioda_pe *pe)
+{
+        /* TVE #1 is selected by PCI address bit 59 */
+        pe->tce_bypass_base = 1ull << 59;
+
+        /* Install set_bypass callback for VFIO */
+        pe->tce32_table.set_bypass = pnv_pci_ioda2_set_bypass;
+
+        /* Enable bypass by default */
+        pnv_pci_ioda2_set_bypass(&pe->tce32_table, true);
+}
+
 static void pnv_pci_ioda2_setup_dma_pe(struct pnv_phb *phb,
                                        struct pnv_ioda_pe *pe)
 {
@@ -727,6 +808,8 @@ static void pnv_pci_ioda2_setup_dma_pe(struct pnv_phb *phb,
         else
                 pnv_ioda_setup_bus_dma(pe, pe->pbus);
 
+        /* Also create a bypass window */
+        pnv_pci_ioda2_setup_bypass_pe(phb, pe);
         return;
 fail:
         if (pe->tce32_seg >= 0)
@@ -1286,6 +1369,7 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np,
 
         /* Setup TCEs */
         phb->dma_dev_setup = pnv_pci_ioda_dma_dev_setup;
+        phb->dma_set_mask = pnv_pci_ioda_dma_set_mask;
 
         /* Setup shutdown function for kexec */
         phb->shutdown = pnv_pci_ioda_shutdown;
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index b555ebc57ef5..95633d79ef5d 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -634,6 +634,16 @@ static void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
                 pnv_pci_dma_fallback_setup(hose, pdev);
 }
 
+int pnv_pci_dma_set_mask(struct pci_dev *pdev, u64 dma_mask)
+{
+        struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+        struct pnv_phb *phb = hose->private_data;
+
+        if (phb && phb->dma_set_mask)
+                return phb->dma_set_mask(phb, pdev, dma_mask);
+        return __dma_set_mask(&pdev->dev, dma_mask);
+}
+
 void pnv_pci_shutdown(void)
 {
         struct pci_controller *hose;
diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
index 13f1942a9a5f..cde169442775 100644
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -54,7 +54,9 @@ struct pnv_ioda_pe {
         struct iommu_table      tce32_table;
         phys_addr_t             tce_inval_reg_phys;
 
-        /* XXX TODO: Add support for additional 64-bit iommus */
+        /* 64-bit TCE bypass region */
+        bool                    tce_bypass_enabled;
+        uint64_t                tce_bypass_base;
 
         /* MSIs. MVE index is identical for for 32 and 64 bit MSI
          * and -1 if not supported. (It's actually identical to the
@@ -113,6 +115,8 @@ struct pnv_phb {
                          unsigned int hwirq, unsigned int virq,
                          unsigned int is_64, struct msi_msg *msg);
         void (*dma_dev_setup)(struct pnv_phb *phb, struct pci_dev *pdev);
+        int (*dma_set_mask)(struct pnv_phb *phb, struct pci_dev *pdev,
+                            u64 dma_mask);
         void (*fixup_phb)(struct pci_controller *hose);
         u32 (*bdfn_to_pe)(struct pnv_phb *phb, struct pci_bus *bus, u32 devfn);
         void (*shutdown)(struct pnv_phb *phb);
diff --git a/arch/powerpc/platforms/powernv/powernv.h b/arch/powerpc/platforms/powernv/powernv.h
index de6819be1f95..0051e108ef0f 100644
--- a/arch/powerpc/platforms/powernv/powernv.h
+++ b/arch/powerpc/platforms/powernv/powernv.h
@@ -7,12 +7,20 @@ extern void pnv_smp_init(void);
 static inline void pnv_smp_init(void) { }
 #endif
 
+struct pci_dev;
+
 #ifdef CONFIG_PCI
 extern void pnv_pci_init(void);
 extern void pnv_pci_shutdown(void);
+extern int pnv_pci_dma_set_mask(struct pci_dev *pdev, u64 dma_mask);
 #else
 static inline void pnv_pci_init(void) { }
 static inline void pnv_pci_shutdown(void) { }
+
+static inline int pnv_pci_dma_set_mask(struct pci_dev *pdev, u64 dma_mask)
+{
+        return -ENODEV;
+}
 #endif
 
 extern void pnv_lpc_init(void);
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 21166f65c97c..110f4fbd319f 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -27,6 +27,7 @@
 #include <linux/interrupt.h>
 #include <linux/bug.h>
 #include <linux/cpuidle.h>
+#include <linux/pci.h>
 
 #include <asm/machdep.h>
 #include <asm/firmware.h>
@@ -141,6 +142,13 @@ static void pnv_progress(char *s, unsigned short hex)
 {
 }
 
+static int pnv_dma_set_mask(struct device *dev, u64 dma_mask)
+{
+        if (dev_is_pci(dev))
+                return pnv_pci_dma_set_mask(to_pci_dev(dev), dma_mask);
+        return __dma_set_mask(dev, dma_mask);
+}
+
 static void pnv_shutdown(void)
 {
         /* Let the PCI code clear up IODA tables */
@@ -238,6 +246,7 @@ define_machine(powernv) {
         .machine_shutdown       = pnv_shutdown,
         .power_save             = powernv_idle,
         .calibrate_decr         = generic_calibrate_decr,
+        .dma_set_mask           = pnv_dma_set_mask,
 #ifdef CONFIG_KEXEC
         .kexec_cpu_down         = pnv_kexec_cpu_down,
 #endif
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 37300f6ee244..80b1d57c306a 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -20,6 +20,7 @@ config PPC_PSERIES
         select PPC_DOORBELL
         select HAVE_CONTEXT_TRACKING
         select HOTPLUG_CPU if SMP
+        select ARCH_RANDOM
         default y
 
 config PPC_SPLPAR
diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
index 9ef3cc8ebc11..8a8f0472d98f 100644
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -265,7 +265,7 @@ static void *pseries_eeh_of_probe(struct device_node *dn, void *flag)
                         enable = 1;
 
                 if (enable) {
-                        eeh_subsystem_enabled = 1;
+                        eeh_set_enable(true);
                         eeh_add_to_parent_pe(edev);
 
                         pr_debug("%s: EEH enabled on %s PHB#%d-PE#%x, config addr#%x\n",
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index 70670a2d9cf2..c413ec158ff5 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -113,7 +113,8 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
 {
         struct device_node *dn, *pdn;
         struct pci_bus *bus;
-        const __be32 *pcie_link_speed_stats;
+        u32 pcie_link_speed_stats[2];
+        int rc;
 
         bus = bridge->bus;
 
@@ -122,38 +123,45 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
                 return 0;
 
         for (pdn = dn; pdn != NULL; pdn = of_get_next_parent(pdn)) {
-                pcie_link_speed_stats = of_get_property(pdn,
-                        "ibm,pcie-link-speed-stats", NULL);
-                if (pcie_link_speed_stats)
+                rc = of_property_read_u32_array(pdn,
+                                "ibm,pcie-link-speed-stats",
+                                &pcie_link_speed_stats[0], 2);
+                if (!rc)
                         break;
         }
 
         of_node_put(pdn);
 
-        if (!pcie_link_speed_stats) {
+        if (rc) {
                 pr_err("no ibm,pcie-link-speed-stats property\n");
                 return 0;
         }
 
-        switch (be32_to_cpup(pcie_link_speed_stats)) {
+        switch (pcie_link_speed_stats[0]) {
         case 0x01:
                 bus->max_bus_speed = PCIE_SPEED_2_5GT;
                 break;
         case 0x02:
                 bus->max_bus_speed = PCIE_SPEED_5_0GT;
                 break;
+        case 0x04:
+                bus->max_bus_speed = PCIE_SPEED_8_0GT;
+                break;
         default:
                 bus->max_bus_speed = PCI_SPEED_UNKNOWN;
                 break;
         }
 
-        switch (be32_to_cpup(pcie_link_speed_stats)) {
+        switch (pcie_link_speed_stats[1]) {
         case 0x01:
                 bus->cur_bus_speed = PCIE_SPEED_2_5GT;
                 break;
         case 0x02:
                 bus->cur_bus_speed = PCIE_SPEED_5_0GT;
                 break;
+        case 0x04:
+                bus->cur_bus_speed = PCIE_SPEED_8_0GT;
+                break;
         default:
                 bus->cur_bus_speed = PCI_SPEED_UNKNOWN;
                 break;
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 8e639d7cbda7..972df0ffd4dc 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -430,8 +430,7 @@ static void pSeries_machine_kexec(struct kimage *image)
 {
         long rc;
 
-        if (firmware_has_feature(FW_FEATURE_SET_MODE) &&
-            (image->type != KEXEC_TYPE_CRASH)) {
+        if (firmware_has_feature(FW_FEATURE_SET_MODE)) {
                 rc = pSeries_disable_reloc_on_exc();
                 if (rc != H_SUCCESS)
                         pr_warning("Warning: Failed to disable relocation on "
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 0e166ed4cd16..8209744b2829 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -886,25 +886,25 @@ int mpic_set_irq_type(struct irq_data *d, unsigned int flow_type)
 
         /* Default: read HW settings */
         if (flow_type == IRQ_TYPE_DEFAULT) {
-                switch(vold & (MPIC_INFO(VECPRI_POLARITY_MASK) |
-                               MPIC_INFO(VECPRI_SENSE_MASK))) {
-                        case MPIC_INFO(VECPRI_SENSE_EDGE) |
-                             MPIC_INFO(VECPRI_POLARITY_POSITIVE):
-                                flow_type = IRQ_TYPE_EDGE_RISING;
-                                break;
-                        case MPIC_INFO(VECPRI_SENSE_EDGE) |
-                             MPIC_INFO(VECPRI_POLARITY_NEGATIVE):
-                                flow_type = IRQ_TYPE_EDGE_FALLING;
-                                break;
-                        case MPIC_INFO(VECPRI_SENSE_LEVEL) |
-                             MPIC_INFO(VECPRI_POLARITY_POSITIVE):
-                                flow_type = IRQ_TYPE_LEVEL_HIGH;
-                                break;
-                        case MPIC_INFO(VECPRI_SENSE_LEVEL) |
-                             MPIC_INFO(VECPRI_POLARITY_NEGATIVE):
-                                flow_type = IRQ_TYPE_LEVEL_LOW;
-                                break;
-                }
+                int vold_ps;
+
+                vold_ps = vold & (MPIC_INFO(VECPRI_POLARITY_MASK) |
+                                  MPIC_INFO(VECPRI_SENSE_MASK));
+
+                if (vold_ps == (MPIC_INFO(VECPRI_SENSE_EDGE) |
+                                MPIC_INFO(VECPRI_POLARITY_POSITIVE)))
+                        flow_type = IRQ_TYPE_EDGE_RISING;
+                else if (vold_ps == (MPIC_INFO(VECPRI_SENSE_EDGE) |
+                                     MPIC_INFO(VECPRI_POLARITY_NEGATIVE)))
+                        flow_type = IRQ_TYPE_EDGE_FALLING;
+                else if (vold_ps == (MPIC_INFO(VECPRI_SENSE_LEVEL) |
+                                     MPIC_INFO(VECPRI_POLARITY_POSITIVE)))
+                        flow_type = IRQ_TYPE_LEVEL_HIGH;
+                else if (vold_ps == (MPIC_INFO(VECPRI_SENSE_LEVEL) |
+                                     MPIC_INFO(VECPRI_POLARITY_NEGATIVE)))
+                        flow_type = IRQ_TYPE_LEVEL_LOW;
+                else
+                        WARN_ONCE(1, "mpic: unknown IRQ type %d\n", vold);
         }
 
         /* Apply to irq desc */
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index a90731b3d44a..b07909850f77 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -309,16 +309,23 @@ static void get_output_lock(void)
 
         if (xmon_speaker == me)
                 return;
+
         for (;;) {
-                if (xmon_speaker == 0) {
-                        last_speaker = cmpxchg(&xmon_speaker, 0, me);
-                        if (last_speaker == 0)
-                                return;
-                }
-                timeout = 10000000;
+                last_speaker = cmpxchg(&xmon_speaker, 0, me);
+                if (last_speaker == 0)
+                        return;
+
+                /*
+                 * Wait a full second for the lock, we might be on a slow
+                 * console, but check every 100us.
+                 */
+                timeout = 10000;
                 while (xmon_speaker == last_speaker) {
-                        if (--timeout > 0)
+                        if (--timeout > 0) {
+                                udelay(100);
                                 continue;
+                        }
+
                         /* hostile takeover */
                         prev = cmpxchg(&xmon_speaker, last_speaker, me);
                         if (prev == last_speaker)
@@ -397,7 +404,6 @@ static int xmon_core(struct pt_regs *regs, int fromipi)
         }
 
         xmon_fault_jmp[cpu] = recurse_jmp;
-        cpumask_set_cpu(cpu, &cpus_in_xmon);
 
         bp = NULL;
         if ((regs->msr & (MSR_IR|MSR_PR|MSR_64BIT)) == (MSR_IR|MSR_64BIT))
@@ -419,6 +425,8 @@ static int xmon_core(struct pt_regs *regs, int fromipi)
                 release_output_lock();
         }
 
+        cpumask_set_cpu(cpu, &cpus_in_xmon);
+
  waiting:
         secondary = 1;
         while (secondary && !xmon_gate) {
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index 4c4a1cef5208..47c8630c93cd 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -529,6 +529,7 @@ static int __init appldata_init(void)
 {
         int rc;
 
+        init_virt_timer(&appldata_timer);
         appldata_timer.function = appldata_timer_function;
         appldata_timer.data = (unsigned long) &appldata_work;
 
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 59c8efce1b99..0248949a756d 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1421,5 +1421,5 @@ ENTRY(sys_sched_setattr_wrapper)
 ENTRY(sys_sched_getattr_wrapper)
         lgfr    %r2,%r2                 # pid_t
         llgtr   %r3,%r3                 # const char __user *
-        llgfr   %r3,%r3                 # unsigned int
+        llgfr   %r4,%r4                 # unsigned int
         jg      sys_sched_getattr
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index b9e25ae2579c..d7c00507568a 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -59,7 +59,7 @@ ENTRY(startup_continue)
         .quad   0                       # cr12: tracing off
         .quad   0                       # cr13: home space segment table
         .quad   0xc0000000              # cr14: machine check handling off
-        .quad   0                       # cr15: linkage stack operations
+        .quad   .Llinkage_stack         # cr15: linkage stack operations
 .Lpcmsk:.quad   0x0000000180000000
 .L4malign:.quad 0xffffffffffc00000
 .Lscan2g:.quad  0x80000000 + 0x20000 - 8        # 2GB + 128K - 8
@@ -67,12 +67,15 @@ ENTRY(startup_continue)
 .Lparmaddr:
         .quad   PARMAREA
         .align  64
-.Lduct: .long   0,0,0,0,.Lduald,0,0,0
+.Lduct: .long   0,.Laste,.Laste,0,.Lduald,0,0,0
         .long   0,0,0,0,0,0,0,0
+.Laste: .quad   0,0xffffffffffffffff,0,0,0,0,0,0
         .align  128
 .Lduald:.rept   8
         .long   0x80000000,0,0,0        # invalid access-list entries
         .endr
+.Llinkage_stack:
+        .long   0,0,0x89000000,0,0,0,0x8a000000,0
 
 ENTRY(_ehead)
 
diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c
index a90d45e9dfb0..27c50f4d90cb 100644
--- a/arch/s390/mm/page-states.c
+++ b/arch/s390/mm/page-states.c
@@ -12,6 +12,8 @@
 #include <linux/mm.h>
 #include <linux/gfp.h>
 #include <linux/init.h>
+#include <asm/setup.h>
+#include <asm/ipl.h>
 
 #define ESSA_SET_STABLE         1
 #define ESSA_SET_UNUSED         2
@@ -41,6 +43,14 @@ void __init cmma_init(void)
 
         if (!cmma_flag)
                 return;
+        /*
+         * Disable CMM for dump, otherwise  the tprot based memory
+         * detection can fail because of unstable pages.
+         */
+        if (OLDMEM_BASE || ipl_info.type == IPL_TYPE_FCP_DUMP) {
+                cmma_flag = 0;
+                return;
+        }
         asm volatile(
                 "       .insn rrf,0xb9ab0000,%1,%1,0,0\n"
                 "0:     la      %0,0\n"
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 60c11a629d96..f91c03119804 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -206,11 +206,13 @@ static void dma_cleanup_tables(struct zpci_dev *zdev)
         zdev->dma_table = NULL;
 }
 
-static unsigned long __dma_alloc_iommu(struct zpci_dev *zdev, unsigned long start,
-                                   int size)
+static unsigned long __dma_alloc_iommu(struct zpci_dev *zdev,
+                                       unsigned long start, int size)
 {
-        unsigned long boundary_size = 0x1000000;
+        unsigned long boundary_size;
 
+        boundary_size = ALIGN(dma_get_seg_boundary(&zdev->pdev->dev) + 1,
+                              PAGE_SIZE) >> PAGE_SHIFT;
         return iommu_area_alloc(zdev->iommu_bitmap, zdev->iommu_pages,
                                 start, size, 0, boundary_size, 0);
 }
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index c51efdcd07a2..7d8b7e94b93b 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -27,7 +27,7 @@ config SPARC
         select RTC_DRV_M48T59
         select HAVE_DMA_ATTRS
         select HAVE_DMA_API_DEBUG
-        select HAVE_ARCH_JUMP_LABEL
+        select HAVE_ARCH_JUMP_LABEL if SPARC64
         select GENERIC_IRQ_SHOW
         select ARCH_WANT_IPC_PARSE_VERSION
         select GENERIC_PCI_IOMAP
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index 869023abe5a4..cfbe53c17b0d 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -14,6 +14,7 @@
 #include <linux/pagemap.h>
 #include <linux/vmalloc.h>
 #include <linux/kdebug.h>
+#include <linux/export.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/log2.h>
@@ -62,6 +63,7 @@ extern unsigned long last_valid_pfn;
 static pgd_t *srmmu_swapper_pg_dir;
 
 const struct sparc32_cachetlb_ops *sparc32_cachetlb_ops;
+EXPORT_SYMBOL(sparc32_cachetlb_ops);
 
 #ifdef CONFIG_SMP
 const struct sparc32_cachetlb_ops *local_ops;
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 3b978c472d08..3d6b9f81cc68 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -132,6 +132,8 @@ extern void __init efi_map_region_fixed(efi_memory_desc_t *md);
 extern void efi_sync_low_kernel_mappings(void);
 extern void efi_setup_page_tables(void);
 extern void __init old_map_region(efi_memory_desc_t *md);
+extern void __init runtime_code_page_mkexec(void);
+extern void __init efi_runtime_mkexec(void);
 
 struct efi_setup_data {
         u64 fw_vendor;
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index bbc8b12fa443..5ad38ad07890 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -445,10 +445,20 @@ static inline int pte_same(pte_t a, pte_t b)
         return a.pte == b.pte;
 }
 
+static inline int pteval_present(pteval_t pteval)
+{
+        /*
+         * Yes Linus, _PAGE_PROTNONE == _PAGE_NUMA. Expressing it this
+         * way clearly states that the intent is that protnone and numa
+         * hinting ptes are considered present for the purposes of
+         * pagetable operations like zapping, protection changes, gup etc.
+         */
+        return pteval & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_NUMA);
+}
+
 static inline int pte_present(pte_t a)
 {
-        return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE |
-                               _PAGE_NUMA);
+        return pteval_present(pte_flags(a));
 }
 
 #define pte_accessible pte_accessible
diff --git a/arch/x86/include/asm/tsc.h b/arch/x86/include/asm/tsc.h
index 57ae63cd6ee2..94605c0e9cee 100644
--- a/arch/x86/include/asm/tsc.h
+++ b/arch/x86/include/asm/tsc.h
@@ -66,6 +66,6 @@ extern void tsc_save_sched_clock_state(void);
 extern void tsc_restore_sched_clock_state(void);
 
 /* MSR based TSC calibration for Intel Atom SoC platforms */
-int try_msr_calibrate_tsc(unsigned long *fast_calibrate);
+unsigned long try_msr_calibrate_tsc(void);
 
 #endif /* _ASM_X86_TSC_H */
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 24b6fd10625a..8e28bf2fc3ef 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -284,8 +284,13 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
         raw_local_save_flags(eflags);
         BUG_ON(eflags & X86_EFLAGS_AC);
 
-        if (cpu_has(c, X86_FEATURE_SMAP))
+        if (cpu_has(c, X86_FEATURE_SMAP)) {
+#ifdef CONFIG_X86_SMAP
                 set_in_cr4(X86_CR4_SMAP);
+#else
+                clear_in_cr4(X86_CR4_SMAP);
+#endif
+        }
 }
 
 /*
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 895604f2e916..79f9f848bee4 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1192,6 +1192,9 @@ static void x86_pmu_del(struct perf_event *event, int flags)
         for (i = 0; i < cpuc->n_events; i++) {
                 if (event == cpuc->event_list[i]) {
 
+                        if (i >= cpuc->n_events - cpuc->n_added)
+                                --cpuc->n_added;
+
                         if (x86_pmu.put_event_constraints)
                                 x86_pmu.put_event_constraints(cpuc, event);
 
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 0fa4f242f050..aa333d966886 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1361,10 +1361,8 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
         intel_pmu_disable_all();
         handled = intel_pmu_drain_bts_buffer();
         status = intel_pmu_get_status();
-        if (!status) {
-                intel_pmu_enable_all(0);
-                return handled;
-        }
+        if (!status)
+                goto done;
 
         loops = 0;
 again:
@@ -2310,10 +2308,7 @@ __init int intel_pmu_init(void)
         if (version > 1)
                 x86_pmu.num_counters_fixed = max((int)edx.split.num_counters_fixed, 3);
 
-        /*
-         * v2 and above have a perf capabilities MSR
-         */
-        if (version > 1) {
+        if (boot_cpu_has(X86_FEATURE_PDCM)) {
                 u64 capabilities;
 
                 rdmsrl(MSR_IA32_PERF_CAPABILITIES, capabilities);
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index de5c56899ae3..b262c6124cf3 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -542,8 +542,11 @@ static struct extra_reg snbep_uncore_cbox_extra_regs[] = {
         SNBEP_CBO_EVENT_EXTRA_REG(SNBEP_CBO_PMON_CTL_TID_EN,
                                   SNBEP_CBO_PMON_CTL_TID_EN, 0x1),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0334, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4334, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0534, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4534, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0934, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4934, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x4134, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0135, 0xffff, 0x8),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0335, 0xffff, 0x8),
@@ -1219,10 +1222,15 @@ static struct extra_reg ivt_uncore_cbox_extra_regs[] = {
         SNBEP_CBO_EVENT_EXTRA_REG(SNBEP_CBO_PMON_CTL_TID_EN,
                                   SNBEP_CBO_PMON_CTL_TID_EN, 0x1),
         SNBEP_CBO_EVENT_EXTRA_REG(0x1031, 0x10ff, 0x2),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x1134, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4134, 0xffff, 0xc),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x5134, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0334, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4334, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0534, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4534, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0934, 0xffff, 0x4),
-        SNBEP_CBO_EVENT_EXTRA_REG(0x4134, 0xffff, 0xc),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4934, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0135, 0xffff, 0x10),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0335, 0xffff, 0x10),
         SNBEP_CBO_EVENT_EXTRA_REG(0x2135, 0xffff, 0x10),
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index d4bdd253fea7..e6253195a301 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -77,8 +77,7 @@ within(unsigned long addr, unsigned long start, unsigned long end)
         return addr >= start && addr < end;
 }
 
-static int
-do_ftrace_mod_code(unsigned long ip, const void *new_code)
+static unsigned long text_ip_addr(unsigned long ip)
 {
         /*
          * On x86_64, kernel text mappings are mapped read-only with
@@ -91,7 +90,7 @@ do_ftrace_mod_code(unsigned long ip, const void *new_code)
         if (within(ip, (unsigned long)_text, (unsigned long)_etext))
                 ip = (unsigned long)__va(__pa_symbol(ip));
 
-        return probe_kernel_write((void *)ip, new_code, MCOUNT_INSN_SIZE);
+        return ip;
 }
 
 static const unsigned char *ftrace_nop_replace(void)
@@ -123,8 +122,10 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code,
         if (memcmp(replaced, old_code, MCOUNT_INSN_SIZE) != 0)
                 return -EINVAL;
 
+        ip = text_ip_addr(ip);
+
         /* replace the text with the new text */
-        if (do_ftrace_mod_code(ip, new_code))
+        if (probe_kernel_write((void *)ip, new_code, MCOUNT_INSN_SIZE))
                 return -EPERM;
 
         sync_core();
@@ -221,37 +222,51 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
         return -EINVAL;
 }
 
-int ftrace_update_ftrace_func(ftrace_func_t func)
+static unsigned long ftrace_update_func;
+
+static int update_ftrace_func(unsigned long ip, void *new)
 {
-        unsigned long ip = (unsigned long)(&ftrace_call);
-        unsigned char old[MCOUNT_INSN_SIZE], *new;
+        unsigned char old[MCOUNT_INSN_SIZE];
         int ret;
 
-        memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
-        new = ftrace_call_replace(ip, (unsigned long)func);
+        memcpy(old, (void *)ip, MCOUNT_INSN_SIZE);
+
+        ftrace_update_func = ip;
+        /* Make sure the breakpoints see the ftrace_update_func update */
+        smp_wmb();
 
         /* See comment above by declaration of modifying_ftrace_code */
         atomic_inc(&modifying_ftrace_code);
 
         ret = ftrace_modify_code(ip, old, new);
 
+        atomic_dec(&modifying_ftrace_code);
+
+        return ret;
+}
+
+int ftrace_update_ftrace_func(ftrace_func_t func)
+{
+        unsigned long ip = (unsigned long)(&ftrace_call);
+        unsigned char *new;
+        int ret;
+
+        new = ftrace_call_replace(ip, (unsigned long)func);
+        ret = update_ftrace_func(ip, new);
+
         /* Also update the regs callback function */
         if (!ret) {
                 ip = (unsigned long)(&ftrace_regs_call);
-                memcpy(old, &ftrace_regs_call, MCOUNT_INSN_SIZE);
                 new = ftrace_call_replace(ip, (unsigned long)func);
-                ret = ftrace_modify_code(ip, old, new);
+                ret = update_ftrace_func(ip, new);
         }
 
-        atomic_dec(&modifying_ftrace_code);
-
         return ret;
 }
 
 static int is_ftrace_caller(unsigned long ip)
 {
-        if (ip == (unsigned long)(&ftrace_call) ||
-                ip == (unsigned long)(&ftrace_regs_call))
+        if (ip == ftrace_update_func)
                 return 1;
 
         return 0;
@@ -677,45 +692,41 @@ int __init ftrace_dyn_arch_init(void *data)
 #ifdef CONFIG_DYNAMIC_FTRACE
 extern void ftrace_graph_call(void);
 
-static int ftrace_mod_jmp(unsigned long ip,
-                          int old_offset, int new_offset)
+static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr)
 {
-        unsigned char code[MCOUNT_INSN_SIZE];
+        static union ftrace_code_union calc;
 
-        if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
-                return -EFAULT;
+        /* Jmp not a call (ignore the .e8) */
+        calc.e8         = 0xe9;
+        calc.offset     = ftrace_calc_offset(ip + MCOUNT_INSN_SIZE, addr);
 
-        if (code[0] != 0xe9 || old_offset != *(int *)(&code[1]))
-                return -EINVAL;
+        /*
+         * ftrace external locks synchronize the access to the static variable.
+         */
+        return calc.code;
+}
 
-        *(int *)(&code[1]) = new_offset;
+static int ftrace_mod_jmp(unsigned long ip, void *func)
+{
+        unsigned char *new;
 
-        if (do_ftrace_mod_code(ip, &code))
-                return -EPERM;
+        new = ftrace_jmp_replace(ip, (unsigned long)func);
 
-        return 0;
+        return update_ftrace_func(ip, new);
 }
 
 int ftrace_enable_ftrace_graph_caller(void)
 {
         unsigned long ip = (unsigned long)(&ftrace_graph_call);
-        int old_offset, new_offset;
 
-        old_offset = (unsigned long)(&ftrace_stub) - (ip + MCOUNT_INSN_SIZE);
-        new_offset = (unsigned long)(&ftrace_graph_caller) - (ip + MCOUNT_INSN_SIZE);
-
-        return ftrace_mod_jmp(ip, old_offset, new_offset);
+        return ftrace_mod_jmp(ip, &ftrace_graph_caller);
 }
 
 int ftrace_disable_ftrace_graph_caller(void)
 {
         unsigned long ip = (unsigned long)(&ftrace_graph_call);
-        int old_offset, new_offset;
-
-        old_offset = (unsigned long)(&ftrace_graph_caller) - (ip + MCOUNT_INSN_SIZE);
-        new_offset = (unsigned long)(&ftrace_stub) - (ip + MCOUNT_INSN_SIZE);
 
-        return ftrace_mod_jmp(ip, old_offset, new_offset);
+        return ftrace_mod_jmp(ip, &ftrace_stub);
 }
 
 #endif /* !CONFIG_DYNAMIC_FTRACE */
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 872079a67e4d..f7d0672481fd 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -100,8 +100,10 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
         flag |= __GFP_ZERO;
 again:
         page = NULL;
-        if (!(flag & GFP_ATOMIC))
+        /* CMA can be used only in the context which permits sleeping */
+        if (flag & __GFP_WAIT)
                 page = dma_alloc_from_contiguous(dev, count, get_order(size));
+        /* fallback */
         if (!page)
                 page = alloc_pages_node(dev_to_node(dev), flag, get_order(size));
         if (!page)
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 19e5adb49a27..cfbe99f88830 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -209,7 +209,7 @@ static inline unsigned long long cycles_2_ns(unsigned long long cyc)
          * dance when its actually needed.
          */
 
-        preempt_disable();
+        preempt_disable_notrace();
         data = this_cpu_read(cyc2ns.head);
         tail = this_cpu_read(cyc2ns.tail);
 
@@ -229,7 +229,7 @@ static inline unsigned long long cycles_2_ns(unsigned long long cyc)
                 if (!--data->__count)
                         this_cpu_write(cyc2ns.tail, data);
         }
-        preempt_enable();
+        preempt_enable_notrace();
 
         return ns;
 }
@@ -653,13 +653,10 @@ unsigned long native_calibrate_tsc(void)
 
         /* Calibrate TSC using MSR for Intel Atom SoCs */
         local_irq_save(flags);
-        i = try_msr_calibrate_tsc(&fast_calibrate);
+        fast_calibrate = try_msr_calibrate_tsc();
         local_irq_restore(flags);
-        if (i >= 0) {
-                if (i == 0)
-                        pr_warn("Fast TSC calibration using MSR failed\n");
+        if (fast_calibrate)
                 return fast_calibrate;
-        }
 
         local_irq_save(flags);
         fast_calibrate = quick_pit_calibrate();
diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
index 8b5434f4389f..92ae6acac8a7 100644
--- a/arch/x86/kernel/tsc_msr.c
+++ b/arch/x86/kernel/tsc_msr.c
@@ -53,7 +53,7 @@ static struct freq_desc freq_desc_tables[] = {
         /* TNG */
         { 6, 0x4a, 1, { 0, FREQ_100, FREQ_133, 0, 0, 0, 0, 0 } },
         /* VLV2 */
-        { 6, 0x37, 1, { 0, FREQ_100, FREQ_133, FREQ_166, 0, 0, 0, 0 } },
+        { 6, 0x37, 1, { FREQ_83, FREQ_100, FREQ_133, FREQ_166, 0, 0, 0, 0 } },
         /* ANN */
         { 6, 0x5a, 1, { FREQ_83, FREQ_100, FREQ_133, FREQ_100, 0, 0, 0, 0 } },
 };
@@ -77,21 +77,18 @@ static int match_cpu(u8 family, u8 model)
 
 /*
  * Do MSR calibration only for known/supported CPUs.
- * Return values:
- * -1: CPU is unknown/unsupported for MSR based calibration
- *  0: CPU is known/supported, but calibration failed
- *  1: CPU is known/supported, and calibration succeeded
+ *
+ * Returns the calibration value or 0 if MSR calibration failed.
  */
-int try_msr_calibrate_tsc(unsigned long *fast_calibrate)
+unsigned long try_msr_calibrate_tsc(void)
 {
-        int cpu_index;
         u32 lo, hi, ratio, freq_id, freq;
+        unsigned long res;
+        int cpu_index;
 
         cpu_index = match_cpu(boot_cpu_data.x86, boot_cpu_data.x86_model);
         if (cpu_index < 0)
-                return -1;
-
-        *fast_calibrate = 0;
+                return 0;
 
         if (freq_desc_tables[cpu_index].msr_plat) {
                 rdmsr(MSR_PLATFORM_INFO, lo, hi);
@@ -103,7 +100,7 @@ int try_msr_calibrate_tsc(unsigned long *fast_calibrate)
         pr_info("Maximum core-clock to bus-clock ratio: 0x%x\n", ratio);
 
         if (!ratio)
-                return 0;
+                goto fail;
 
         /* Get FSB FREQ ID */
         rdmsr(MSR_FSB_FREQ, lo, hi);
@@ -112,16 +109,19 @@ int try_msr_calibrate_tsc(unsigned long *fast_calibrate)
         pr_info("Resolved frequency ID: %u, frequency: %u KHz\n",
                                 freq_id, freq);
         if (!freq)
-                return 0;
+                goto fail;
 
         /* TSC frequency = maximum resolved freq * maximum resolved bus ratio */
-        *fast_calibrate = freq * ratio;
-        pr_info("TSC runs at %lu KHz\n", *fast_calibrate);
+        res = freq * ratio;
+        pr_info("TSC runs at %lu KHz\n", res);
 
 #ifdef CONFIG_X86_LOCAL_APIC
         lapic_timer_frequency = (freq * 1000) / HZ;
         pr_info("lapic_timer_frequency = %d\n", lapic_timer_frequency);
 #endif
+        return res;
 
-        return 1;
+fail:
+        pr_warn("Fast TSC calibration using MSR failed\n");
+        return 0;
 }
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9d591c895803..6dea040cc3a1 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1001,6 +1001,12 @@ static int fault_in_kernel_space(unsigned long address)
 
 static inline bool smap_violation(int error_code, struct pt_regs *regs)
 {
+        if (!IS_ENABLED(CONFIG_X86_SMAP))
+                return false;
+
+        if (!static_cpu_has(X86_FEATURE_SMAP))
+                return false;
+
         if (error_code & PF_USER)
                 return false;
 
@@ -1087,11 +1093,9 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
         if (unlikely(error_code & PF_RSVD))
                 pgtable_bad(regs, error_code, address);
 
-        if (static_cpu_has(X86_FEATURE_SMAP)) {
-                if (unlikely(smap_violation(error_code, regs))) {
-                        bad_area_nosemaphore(regs, error_code, address);
-                        return;
-                }
+        if (unlikely(smap_violation(error_code, regs))) {
+                bad_area_nosemaphore(regs, error_code, address);
+                return;
         }
 
         /*
diff --git a/arch/x86/platform/efi/efi-bgrt.c b/arch/x86/platform/efi/efi-bgrt.c
index 4df9591eadad..f15103dff4b4 100644
--- a/arch/x86/platform/efi/efi-bgrt.c
+++ b/arch/x86/platform/efi/efi-bgrt.c
@@ -42,7 +42,7 @@ void __init efi_bgrt_init(void)
 
         if (bgrt_tab->header.length < sizeof(*bgrt_tab))
                 return;
-        if (bgrt_tab->version != 1)
+        if (bgrt_tab->version != 1 || bgrt_tab->status != 1)
                 return;
         if (bgrt_tab->image_type != 0 || !bgrt_tab->image_address)
                 return;
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index d62ec87a2b26..1a201ac7cef8 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -792,7 +792,7 @@ void __init efi_set_executable(efi_memory_desc_t *md, bool executable)
                 set_memory_nx(addr, npages);
 }
 
-static void __init runtime_code_page_mkexec(void)
+void __init runtime_code_page_mkexec(void)
 {
         efi_memory_desc_t *md;
         void *p;
@@ -1069,8 +1069,7 @@ void __init efi_enter_virtual_mode(void)
         efi.update_capsule = virt_efi_update_capsule;
         efi.query_capsule_caps = virt_efi_query_capsule_caps;
 
-        if (efi_enabled(EFI_OLD_MEMMAP) && (__supported_pte_mask & _PAGE_NX))
-                runtime_code_page_mkexec();
+        efi_runtime_mkexec();
 
         kfree(new_memmap);
 
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
index 249b183cf417..0b74cdf7f816 100644
--- a/arch/x86/platform/efi/efi_32.c
+++ b/arch/x86/platform/efi/efi_32.c
@@ -77,3 +77,9 @@ void efi_call_phys_epilog(void)
 
         local_irq_restore(efi_rt_eflags);
 }
+
+void __init efi_runtime_mkexec(void)
+{
+        if (__supported_pte_mask & _PAGE_NX)
+                runtime_code_page_mkexec();
+}
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 6284f158a47d..0c2a234fef1e 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -233,3 +233,12 @@ void __init parse_efi_setup(u64 phys_addr, u32 data_len)
 {
         efi_setup = phys_addr + sizeof(struct setup_data);
 }
+
+void __init efi_runtime_mkexec(void)
+{
+        if (!efi_enabled(EFI_OLD_MEMMAP))
+                return;
+
+        if (__supported_pte_mask & _PAGE_NX)
+                runtime_code_page_mkexec();
+}
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 2423ef04ffea..256282e7888b 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -365,7 +365,7 @@ void xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
 /* Assume pteval_t is equivalent to all the other *val_t types. */
 static pteval_t pte_mfn_to_pfn(pteval_t val)
 {
-        if (val & _PAGE_PRESENT) {
+        if (pteval_present(val)) {
                 unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
                 unsigned long pfn = mfn_to_pfn(mfn);
 
@@ -381,7 +381,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
 
 static pteval_t pte_pfn_to_mfn(pteval_t val)
 {
-        if (val & _PAGE_PRESENT) {
+        if (pteval_present(val)) {
                 unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
                 pteval_t flags = val & PTE_FLAGS_MASK;
                 unsigned long mfn;
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index ba56e11cbf77..c87ae7c6e5f9 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -20,6 +20,7 @@ config XTENSA
         select HAVE_FUNCTION_TRACER
         select HAVE_IRQ_TIME_ACCOUNTING
         select HAVE_PERF_EVENTS
+        select COMMON_CLK
         help
           Xtensa processors are 32-bit RISC machines designed by Tensilica
           primarily for embedded systems.  These processors are both
@@ -80,7 +81,6 @@ choice
 config XTENSA_VARIANT_FSF
         bool "fsf - default (not generic) configuration"
         select MMU
-        select HAVE_XTENSA_GPIO32
 
 config XTENSA_VARIANT_DC232B
         bool "dc232b - Diamond 232L Standard Core Rev.B (LE)"
@@ -135,7 +135,6 @@ config HAVE_SMP
 config SMP
         bool "Enable Symmetric multi-processing support"
         depends on HAVE_SMP
-        select USE_GENERIC_SMP_HELPERS
         select GENERIC_SMP_IDLE_THREAD
         help
           Enabled SMP Software; allows more than one CPU/CORE
diff --git a/arch/xtensa/boot/dts/xtfpga.dtsi b/arch/xtensa/boot/dts/xtfpga.dtsi
index 46b4f5eab421..e7370b11348e 100644
--- a/arch/xtensa/boot/dts/xtfpga.dtsi
+++ b/arch/xtensa/boot/dts/xtfpga.dtsi
@@ -35,6 +35,13 @@
                 interrupt-controller;
         };
 
+        clocks {
+                osc: main-oscillator {
+                        #clock-cells = <0>;
+                        compatible = "fixed-clock";
+                };
+        };
+
         serial0: serial@fd050020 {
                 device_type = "serial";
                 compatible = "ns16550a";
@@ -42,9 +49,7 @@
                 reg = <0xfd050020 0x20>;
                 reg-shift = <2>;
                 interrupts = <0 1>; /* external irq 0 */
-                /* Filled in by platform_setup from FPGA register
-                 * clock-frequency = <100000000>;
-                 */
+                clocks = <&osc>;
         };
 
         enet0: ethoc@fd030000 {
@@ -52,5 +57,6 @@
                 reg = <0xfd030000 0x4000 0xfd800000 0x4000>;
                 interrupts = <1 1>; /* external irq 1 */
                 local-mac-address = [00 50 c2 13 6f 00];
+                clocks = <&osc>;
         };
 };
diff --git a/arch/xtensa/include/asm/io.h b/arch/xtensa/include/asm/io.h
index 2a042d430c25..74944207167e 100644
--- a/arch/xtensa/include/asm/io.h
+++ b/arch/xtensa/include/asm/io.h
@@ -25,7 +25,7 @@
 
 #ifdef CONFIG_MMU
 
-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && CONFIG_OF
+#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
 extern unsigned long xtensa_kio_paddr;
 
 static inline unsigned long xtensa_get_kio_paddr(void)
diff --git a/arch/xtensa/include/asm/traps.h b/arch/xtensa/include/asm/traps.h
index 8c194f6af45e..677bfcf4ee5d 100644
--- a/arch/xtensa/include/asm/traps.h
+++ b/arch/xtensa/include/asm/traps.h
@@ -23,25 +23,37 @@ void secondary_trap_init(void);
 
 static inline void spill_registers(void)
 {
-
+#if XCHAL_NUM_AREGS > 16
         __asm__ __volatile__ (
-                "movi   a14, "__stringify((1 << PS_EXCM_BIT) | LOCKLEVEL)"\n\t"
-                "mov    a12, a0\n\t"
-                "rsr    a13, sar\n\t"
-                "xsr    a14, ps\n\t"
-                "movi   a0, _spill_registers\n\t"
-                "rsync\n\t"
-                "callx0 a0\n\t"
-                "mov    a0, a12\n\t"
-                "wsr    a13, sar\n\t"
-                "wsr    a14, ps\n\t"
-                : :
-#if defined(CONFIG_FRAME_POINTER)
-                : "a2", "a3", "a4",       "a11", "a12", "a13", "a14", "a15",
+                "       call12  1f\n"
+                "       _j      2f\n"
+                "       retw\n"
+                "       .align  4\n"
+                "1:\n"
+                "       _entry  a1, 48\n"
+                "       addi    a12, a0, 3\n"
+#if XCHAL_NUM_AREGS > 32
+                "       .rept   (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n"
+                "       _entry  a1, 48\n"
+                "       mov     a12, a0\n"
+                "       .endr\n"
+#endif
+                "       _entry  a1, 48\n"
+#if XCHAL_NUM_AREGS % 12 == 0
+                "       mov     a8, a8\n"
+#elif XCHAL_NUM_AREGS % 12 == 4
+                "       mov     a12, a12\n"
+#elif XCHAL_NUM_AREGS % 12 == 8
+                "       mov     a4, a4\n"
+#endif
+                "       retw\n"
+                "2:\n"
+                : : : "a12", "a13", "memory");
 #else
-                : "a2", "a3", "a4", "a7", "a11", "a12", "a13", "a14", "a15",
+        __asm__ __volatile__ (
+                "       mov     a12, a12\n"
+                : : : "memory");
 #endif
-                  "memory");
 }
 
 #endif /* _XTENSA_TRAPS_H */
diff --git a/arch/xtensa/include/asm/vectors.h b/arch/xtensa/include/asm/vectors.h
index 5791b45d5a5d..f74ddfbb92ef 100644
--- a/arch/xtensa/include/asm/vectors.h
+++ b/arch/xtensa/include/asm/vectors.h
@@ -25,7 +25,7 @@
 #define XCHAL_KIO_DEFAULT_PADDR         0xf0000000
 #define XCHAL_KIO_SIZE                  0x10000000
 
-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && CONFIG_OF
+#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
 #define XCHAL_KIO_PADDR                 xtensa_get_kio_paddr()
 #else
 #define XCHAL_KIO_PADDR                 XCHAL_KIO_DEFAULT_PADDR
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index 51940fec6990..b9395529f02d 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -734,7 +734,12 @@ __SYSCALL(332, sys_finit_module, 3)
 #define __NR_accept4                            333
 __SYSCALL(333, sys_accept4, 4)
 
-#define __NR_syscall_count                      334
+#define __NR_sched_setattr                      334
+__SYSCALL(334, sys_sched_setattr, 2)
+#define __NR_sched_getattr                      335
+__SYSCALL(335, sys_sched_getattr, 3)
+
+#define __NR_syscall_count                      336
 
 /*
  * sysxtensa syscall handler
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index 21dbe6bdb8ed..ef7f4990722b 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1081,196 +1081,53 @@ ENTRY(fast_syscall_spill_registers)
 
         rsr     a0, sar
         s32i    a3, a2, PT_AREG3
-        s32i    a4, a2, PT_AREG4
-        s32i    a0, a2, PT_AREG5        # store SAR to PT_AREG5
+        s32i    a0, a2, PT_SAR
 
-        /* The spill routine might clobber a7, a11, and a15. */
+        /* The spill routine might clobber a4, a7, a8, a11, a12, and a15. */
 
+        s32i    a4, a2, PT_AREG4
         s32i    a7, a2, PT_AREG7
+        s32i    a8, a2, PT_AREG8
         s32i    a11, a2, PT_AREG11
+        s32i    a12, a2, PT_AREG12
         s32i    a15, a2, PT_AREG15
 
-        call0   _spill_registers        # destroys a3, a4, and SAR
-
-        /* Advance PC, restore registers and SAR, and return from exception. */
-
-        l32i    a3, a2, PT_AREG5
-        l32i    a4, a2, PT_AREG4
-        l32i    a0, a2, PT_AREG0
-        wsr     a3, sar
-        l32i    a3, a2, PT_AREG3
-
-        /* Restore clobbered registers. */
-
-        l32i    a7, a2, PT_AREG7
-        l32i    a11, a2, PT_AREG11
-        l32i    a15, a2, PT_AREG15
-
-        movi    a2, 0
-        rfe
-
-ENDPROC(fast_syscall_spill_registers)
-
-/* Fixup handler.
- *
- * We get here if the spill routine causes an exception, e.g. tlb miss.
- * We basically restore WINDOWBASE and WINDOWSTART to the condition when
- * we entered the spill routine and jump to the user exception handler.
- *
- * a0: value of depc, original value in depc
- * a2: trashed, original value in EXC_TABLE_DOUBLE_SAVE
- * a3: exctable, original value in excsave1
- */
-
-ENTRY(fast_syscall_spill_registers_fixup)
-
-        rsr     a2, windowbase  # get current windowbase (a2 is saved)
-        xsr     a0, depc        # restore depc and a0
-        ssl     a2              # set shift (32 - WB)
-
-        /* We need to make sure the current registers (a0-a3) are preserved.
-         * To do this, we simply set the bit for the current window frame
-         * in WS, so that the exception handlers save them to the task stack.
-         */
-
-        xsr     a3, excsave1    # get spill-mask
-        slli    a3, a3, 1       # shift left by one
-
-        slli    a2, a3, 32-WSBITS
-        src     a2, a3, a2      # a2 = xxwww1yyxxxwww1yy......
-        wsr     a2, windowstart # set corrected windowstart
-
-        srli    a3, a3, 1
-        rsr     a2, excsave1
-        l32i    a2, a2, EXC_TABLE_DOUBLE_SAVE   # restore a2
-        xsr     a2, excsave1
-        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE   # save a3
-        l32i    a3, a2, EXC_TABLE_PARAM # original WB (in user task)
-        xsr     a2, excsave1
-
-        /* Return to the original (user task) WINDOWBASE.
-         * We leave the following frame behind:
-         * a0, a1, a2   same
-         * a3:          trashed (saved in EXC_TABLE_DOUBLE_SAVE)
-         * depc:        depc (we have to return to that address)
-         * excsave_1:   exctable
-         */
-
-        wsr     a3, windowbase
-        rsync
-
-        /* We are now in the original frame when we entered _spill_registers:
-         *  a0: return address
-         *  a1: used, stack pointer
-         *  a2: kernel stack pointer
-         *  a3: available
-         *  depc: exception address
-         *  excsave: exctable
-         * Note: This frame might be the same as above.
-         */
-
-        /* Setup stack pointer. */
-
-        addi    a2, a2, -PT_USER_SIZE
-        s32i    a0, a2, PT_AREG0
-
-        /* Make sure we return to this fixup handler. */
-
-        movi    a3, fast_syscall_spill_registers_fixup_return
-        s32i    a3, a2, PT_DEPC         # setup depc
-
-        /* Jump to the exception handler. */
-
-        rsr     a3, excsave1
-        rsr     a0, exccause
-        addx4   a0, a0, a3                      # find entry in table
-        l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
-        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
-        jx      a0
-
-ENDPROC(fast_syscall_spill_registers_fixup)
-
-ENTRY(fast_syscall_spill_registers_fixup_return)
-
-        /* When we return here, all registers have been restored (a2: DEPC) */
-
-        wsr     a2, depc                # exception address
-
-        /* Restore fixup handler. */
-
-        rsr     a2, excsave1
-        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE
-        movi    a3, fast_syscall_spill_registers_fixup
-        s32i    a3, a2, EXC_TABLE_FIXUP
-        rsr     a3, windowbase
-        s32i    a3, a2, EXC_TABLE_PARAM
-        l32i    a2, a2, EXC_TABLE_KSTK
-
-        /* Load WB at the time the exception occurred. */
-
-        rsr     a3, sar                 # WB is still in SAR
-        neg     a3, a3
-        wsr     a3, windowbase
-        rsync
-
-        rsr     a3, excsave1
-        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
-
-        rfde
-
-ENDPROC(fast_syscall_spill_registers_fixup_return)
-
-/*
- * spill all registers.
- *
- * This is not a real function. The following conditions must be met:
- *
- *  - must be called with call0.
- *  - uses a3, a4 and SAR.
- *  - the last 'valid' register of each frame are clobbered.
- *  - the caller must have registered a fixup handler
- *    (or be inside a critical section)
- *  - PS_EXCM must be set (PS_WOE cleared?)
- */
-
-ENTRY(_spill_registers)
-
         /*
          * Rotate ws so that the current windowbase is at bit 0.
          * Assume ws = xxxwww1yy (www1 current window frame).
          * Rotate ws right so that a4 = yyxxxwww1.
          */
 
-        rsr     a4, windowbase
+        rsr     a0, windowbase
         rsr     a3, windowstart         # a3 = xxxwww1yy
-        ssr     a4                      # holds WB
-        slli    a4, a3, WSBITS
-        or      a3, a3, a4              # a3 = xxxwww1yyxxxwww1yy
+        ssr     a0                      # holds WB
+        slli    a0, a3, WSBITS
+        or      a3, a3, a0              # a3 = xxxwww1yyxxxwww1yy
         srl     a3, a3                  # a3 = 00xxxwww1yyxxxwww1
 
         /* We are done if there are no more than the current register frame. */
 
         extui   a3, a3, 1, WSBITS-1     # a3 = 0yyxxxwww
-        movi    a4, (1 << (WSBITS-1))
+        movi    a0, (1 << (WSBITS-1))
         _beqz   a3, .Lnospill           # only one active frame? jump
 
         /* We want 1 at the top, so that we return to the current windowbase */
 
-        or      a3, a3, a4              # 1yyxxxwww
+        or      a3, a3, a0              # 1yyxxxwww
 
         /* Skip empty frames - get 'oldest' WINDOWSTART-bit. */
 
         wsr     a3, windowstart         # save shifted windowstart
-        neg     a4, a3
-        and     a3, a4, a3              # first bit set from right: 000010000
+        neg     a0, a3
+        and     a3, a0, a3              # first bit set from right: 000010000
 
-        ffs_ws  a4, a3                  # a4: shifts to skip empty frames
+        ffs_ws  a0, a3                  # a0: shifts to skip empty frames
         movi    a3, WSBITS
-        sub     a4, a3, a4              # WSBITS-a4:number of 0-bits from right
-        ssr     a4                      # save in SAR for later.
+        sub     a0, a3, a0              # WSBITS-a0:number of 0-bits from right
+        ssr     a0                      # save in SAR for later.
 
         rsr     a3, windowbase
-        add     a3, a3, a4
+        add     a3, a3, a0
         wsr     a3, windowbase
         rsync
 
@@ -1285,22 +1142,6 @@ ENTRY(_spill_registers)
          * we have to save 4,8. or 12 registers.
          */
 
-        _bbsi.l a3, 1, .Lc4
-        _bbsi.l a3, 2, .Lc8
-
-        /* Special case: we have a call12-frame starting at a4. */
-
-        _bbci.l a3, 3, .Lc12    # bit 3 shouldn't be zero! (Jump to Lc12 first)
-
-        s32e    a4, a1, -16     # a1 is valid with an empty spill area
-        l32e    a4, a5, -12
-        s32e    a8, a4, -48
-        mov     a8, a4
-        l32e    a4, a1, -16
-        j       .Lc12c
-
-.Lnospill:
-        ret
 
 .Lloop: _bbsi.l a3, 1, .Lc4
         _bbci.l a3, 2, .Lc12
@@ -1314,20 +1155,10 @@ ENTRY(_spill_registers)
         s32e    a9, a4, -28
         s32e    a10, a4, -24
         s32e    a11, a4, -20
-
         srli    a11, a3, 2              # shift windowbase by 2
         rotw    2
         _bnei   a3, 1, .Lloop
-
-.Lexit: /* Done. Do the final rotation, set WS, and return. */
-
-        rotw    1
-        rsr     a3, windowbase
-        ssl     a3
-        movi    a3, 1
-        sll     a3, a3
-        wsr     a3, windowstart
-        ret
+        j       .Lexit
 
 .Lc4:   s32e    a4, a9, -16
         s32e    a5, a9, -12
@@ -1343,11 +1174,11 @@ ENTRY(_spill_registers)
 
         /* 12-register frame (call12) */
 
-        l32e    a2, a5, -12
-        s32e    a8, a2, -48
-        mov     a8, a2
+        l32e    a0, a5, -12
+        s32e    a8, a0, -48
+        mov     a8, a0
 
-.Lc12c: s32e    a9, a8, -44
+        s32e    a9, a8, -44
         s32e    a10, a8, -40
         s32e    a11, a8, -36
         s32e    a12, a8, -32
@@ -1367,30 +1198,54 @@ ENTRY(_spill_registers)
          */
 
         rotw    1
-        mov     a5, a13
+        mov     a4, a13
         rotw    -1
 
-        s32e    a4, a9, -16
-        s32e    a5, a9, -12
-        s32e    a6, a9, -8
-        s32e    a7, a9, -4
+        s32e    a4, a8, -16
+        s32e    a5, a8, -12
+        s32e    a6, a8, -8
+        s32e    a7, a8, -4
 
         rotw    3
 
         _beqi   a3, 1, .Lexit
         j       .Lloop
 
-.Linvalid_mask:
+.Lexit:
 
-        /* We get here because of an unrecoverable error in the window
-         * registers. If we are in user space, we kill the application,
-         * however, this condition is unrecoverable in kernel space.
-         */
+        /* Done. Do the final rotation and set WS */
+
+        rotw    1
+        rsr     a3, windowbase
+        ssl     a3
+        movi    a3, 1
+        sll     a3, a3
+        wsr     a3, windowstart
+.Lnospill:
+
+        /* Advance PC, restore registers and SAR, and return from exception. */
+
+        l32i    a3, a2, PT_SAR
+        l32i    a0, a2, PT_AREG0
+        wsr     a3, sar
+        l32i    a3, a2, PT_AREG3
 
-        rsr     a0, ps
-        _bbci.l a0, PS_UM_BIT, 1f
+        /* Restore clobbered registers. */
 
-        /* User space: Setup a dummy frame and kill application.
+        l32i    a4, a2, PT_AREG4
+        l32i    a7, a2, PT_AREG7
+        l32i    a8, a2, PT_AREG8
+        l32i    a11, a2, PT_AREG11
+        l32i    a12, a2, PT_AREG12
+        l32i    a15, a2, PT_AREG15
+
+        movi    a2, 0
+        rfe
+
+.Linvalid_mask:
+
+        /* We get here because of an unrecoverable error in the window
+         * registers, so set up a dummy frame and kill the user application.
          * Note: We assume EXC_TABLE_KSTK contains a valid stack pointer.
          */
 
@@ -1414,14 +1269,136 @@ ENTRY(_spill_registers)
         movi    a4, do_exit
         callx4  a4
 
-1:      /* Kernel space: PANIC! */
+        /* shouldn't return, so panic */
 
         wsr     a0, excsave1
         movi    a0, unrecoverable_exception
         callx0  a0              # should not return
 1:      j       1b
 
-ENDPROC(_spill_registers)
+
+ENDPROC(fast_syscall_spill_registers)
+
+/* Fixup handler.
+ *
+ * We get here if the spill routine causes an exception, e.g. tlb miss.
+ * We basically restore WINDOWBASE and WINDOWSTART to the condition when
+ * we entered the spill routine and jump to the user exception handler.
+ *
+ * Note that we only need to restore the bits in windowstart that have not
+ * been spilled yet by the _spill_register routine. Luckily, a3 contains a
+ * rotated windowstart with only those bits set for frames that haven't been
+ * spilled yet. Because a3 is rotated such that bit 0 represents the register
+ * frame for the current windowbase - 1, we need to rotate a3 left by the
+ * value of the current windowbase + 1 and move it to windowstart.
+ *
+ * a0: value of depc, original value in depc
+ * a2: trashed, original value in EXC_TABLE_DOUBLE_SAVE
+ * a3: exctable, original value in excsave1
+ */
+
+ENTRY(fast_syscall_spill_registers_fixup)
+
+        rsr     a2, windowbase  # get current windowbase (a2 is saved)
+        xsr     a0, depc        # restore depc and a0
+        ssl     a2              # set shift (32 - WB)
+
+        /* We need to make sure the current registers (a0-a3) are preserved.
+         * To do this, we simply set the bit for the current window frame
+         * in WS, so that the exception handlers save them to the task stack.
+         *
+         * Note: we use a3 to set the windowbase, so we take a special care
+         * of it, saving it in the original _spill_registers frame across
+         * the exception handler call.
+         */
+
+        xsr     a3, excsave1    # get spill-mask
+        slli    a3, a3, 1       # shift left by one
+        addi    a3, a3, 1       # set the bit for the current window frame
+
+        slli    a2, a3, 32-WSBITS
+        src     a2, a3, a2      # a2 = xxwww1yyxxxwww1yy......
+        wsr     a2, windowstart # set corrected windowstart
+
+        srli    a3, a3, 1
+        rsr     a2, excsave1
+        l32i    a2, a2, EXC_TABLE_DOUBLE_SAVE   # restore a2
+        xsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE   # save a3
+        l32i    a3, a2, EXC_TABLE_PARAM # original WB (in user task)
+        xsr     a2, excsave1
+
+        /* Return to the original (user task) WINDOWBASE.
+         * We leave the following frame behind:
+         * a0, a1, a2   same
+         * a3:          trashed (saved in EXC_TABLE_DOUBLE_SAVE)
+         * depc:        depc (we have to return to that address)
+         * excsave_1:   exctable
+         */
+
+        wsr     a3, windowbase
+        rsync
+
+        /* We are now in the original frame when we entered _spill_registers:
+         *  a0: return address
+         *  a1: used, stack pointer
+         *  a2: kernel stack pointer
+         *  a3: available
+         *  depc: exception address
+         *  excsave: exctable
+         * Note: This frame might be the same as above.
+         */
+
+        /* Setup stack pointer. */
+
+        addi    a2, a2, -PT_USER_SIZE
+        s32i    a0, a2, PT_AREG0
+
+        /* Make sure we return to this fixup handler. */
+
+        movi    a3, fast_syscall_spill_registers_fixup_return
+        s32i    a3, a2, PT_DEPC         # setup depc
+
+        /* Jump to the exception handler. */
+
+        rsr     a3, excsave1
+        rsr     a0, exccause
+        addx4   a0, a0, a3                      # find entry in table
+        l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
+        jx      a0
+
+ENDPROC(fast_syscall_spill_registers_fixup)
+
+ENTRY(fast_syscall_spill_registers_fixup_return)
+
+        /* When we return here, all registers have been restored (a2: DEPC) */
+
+        wsr     a2, depc                # exception address
+
+        /* Restore fixup handler. */
+
+        rsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE
+        movi    a3, fast_syscall_spill_registers_fixup
+        s32i    a3, a2, EXC_TABLE_FIXUP
+        rsr     a3, windowbase
+        s32i    a3, a2, EXC_TABLE_PARAM
+        l32i    a2, a2, EXC_TABLE_KSTK
+
+        /* Load WB at the time the exception occurred. */
+
+        rsr     a3, sar                 # WB is still in SAR
+        neg     a3, a3
+        wsr     a3, windowbase
+        rsync
+
+        rsr     a3, excsave1
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
+
+        rfde
+
+ENDPROC(fast_syscall_spill_registers_fixup_return)
 
 #ifdef CONFIG_MMU
 /*
@@ -1794,6 +1771,43 @@ ENTRY(system_call)
 
 ENDPROC(system_call)
 
+/*
+ * Spill live registers on the kernel stack macro.
+ *
+ * Entry condition: ps.woe is set, ps.excm is cleared
+ * Exit condition: windowstart has single bit set
+ * May clobber: a12, a13
+ */
+        .macro  spill_registers_kernel
+
+#if XCHAL_NUM_AREGS > 16
+        call12  1f
+        _j      2f
+        retw
+        .align  4
+1:
+        _entry  a1, 48
+        addi    a12, a0, 3
+#if XCHAL_NUM_AREGS > 32
+        .rept   (XCHAL_NUM_AREGS - 32) / 12
+        _entry  a1, 48
+        mov     a12, a0
+        .endr
+#endif
+        _entry  a1, 48
+#if XCHAL_NUM_AREGS % 12 == 0
+        mov     a8, a8
+#elif XCHAL_NUM_AREGS % 12 == 4
+        mov     a12, a12
+#elif XCHAL_NUM_AREGS % 12 == 8
+        mov     a4, a4
+#endif
+        retw
+2:
+#else
+        mov     a12, a12
+#endif
+        .endm
 
 /*
  * Task switch.
@@ -1806,21 +1820,20 @@ ENTRY(_switch_to)
 
         entry   a1, 16
 
-        mov     a12, a2                 # preserve 'prev' (a2)
-        mov     a13, a3                 # and 'next' (a3)
+        mov     a10, a2                 # preserve 'prev' (a2)
+        mov     a11, a3                 # and 'next' (a3)
 
         l32i    a4, a2, TASK_THREAD_INFO
         l32i    a5, a3, TASK_THREAD_INFO
 
-        save_xtregs_user a4 a6 a8 a9 a10 a11 THREAD_XTREGS_USER
+        save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
 
-        s32i    a0, a12, THREAD_RA      # save return address
-        s32i    a1, a12, THREAD_SP      # save stack pointer
+        s32i    a0, a10, THREAD_RA      # save return address
+        s32i    a1, a10, THREAD_SP      # save stack pointer
 
         /* Disable ints while we manipulate the stack pointer. */
 
-        movi    a14, (1 << PS_EXCM_BIT) | LOCKLEVEL
-        xsr     a14, ps
+        rsil    a14, LOCKLEVEL
         rsr     a3, excsave1
         rsync
         s32i    a3, a3, EXC_TABLE_FIXUP /* enter critical section */
@@ -1835,7 +1848,7 @@ ENTRY(_switch_to)
 
         /* Flush register file. */
 
-        call0   _spill_registers        # destroys a3, a4, and SAR
+        spill_registers_kernel
 
         /* Set kernel stack (and leave critical section)
          * Note: It's save to set it here. The stack will not be overwritten
@@ -1851,13 +1864,13 @@ ENTRY(_switch_to)
 
         /* restore context of the task 'next' */
 
-        l32i    a0, a13, THREAD_RA      # restore return address
-        l32i    a1, a13, THREAD_SP      # restore stack pointer
+        l32i    a0, a11, THREAD_RA      # restore return address
+        l32i    a1, a11, THREAD_SP      # restore stack pointer
 
-        load_xtregs_user a5 a6 a8 a9 a10 a11 THREAD_XTREGS_USER
+        load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
 
         wsr     a14, ps
-        mov     a2, a12                 # return 'prev'
+        mov     a2, a10                 # return 'prev'
         rsync
 
         retw
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 7d12af1317f1..84fe931bb60e 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -22,6 +22,7 @@
 #include <linux/bootmem.h>
 #include <linux/kernel.h>
 #include <linux/percpu.h>
+#include <linux/clk-provider.h>
 #include <linux/cpu.h>
 #include <linux/of_fdt.h>
 #include <linux/of_platform.h>
@@ -276,6 +277,7 @@ void __init early_init_devtree(void *params)
 
 static int __init xtensa_device_probe(void)
 {
+        of_clk_init(NULL);
         of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
         return 0;
 }
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index 08b769d3b3a1..2a1823de69cc 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -30,6 +30,7 @@
 #include <asm/platform.h>
 
 unsigned long ccount_freq;              /* ccount Hz */
+EXPORT_SYMBOL(ccount_freq);
 
 static cycle_t ccount_read(struct clocksource *cs)
 {
diff --git a/arch/xtensa/kernel/vectors.S b/arch/xtensa/kernel/vectors.S
index cb8fd44caabc..f9e1ec346e35 100644
--- a/arch/xtensa/kernel/vectors.S
+++ b/arch/xtensa/kernel/vectors.S
@@ -235,7 +235,7 @@ ENTRY(_DoubleExceptionVector)
 
         /* Check for overflow/underflow exception, jump if overflow. */
 
-        _bbci.l a0, 6, _DoubleExceptionVector_WindowOverflow
+        bbci.l  a0, 6, _DoubleExceptionVector_WindowOverflow
 
         /*
          * Restart window underflow exception.
diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index 74a60c7e085e..80b33ed51f31 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -122,9 +122,7 @@ EXPORT_SYMBOL(insw);
 EXPORT_SYMBOL(insl);
 
 extern long common_exception_return;
-extern long _spill_registers;
 EXPORT_SYMBOL(common_exception_return);
-EXPORT_SYMBOL(_spill_registers);
 
 #ifdef CONFIG_FUNCTION_TRACER
 EXPORT_SYMBOL(_mcount);
diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
index 479d7537a32a..aff108df92d3 100644
--- a/arch/xtensa/mm/init.c
+++ b/arch/xtensa/mm/init.c
@@ -90,7 +90,7 @@ int __init mem_reserve(unsigned long start, unsigned long end, int must_exist)
 
 
 /*
- * Initialize the bootmem system and give it all the memory we have available.
+ * Initialize the bootmem system and give it all low memory we have available.
  */
 
 void __init bootmem_init(void)
@@ -142,9 +142,14 @@ void __init bootmem_init(void)
 
         /* Add all remaining memory pieces into the bootmem map */
 
-        for (i=0; i<sysmem.nr_banks; i++)
-                free_bootmem(sysmem.bank[i].start,
-                             sysmem.bank[i].end - sysmem.bank[i].start);
+        for (i = 0; i < sysmem.nr_banks; i++) {
+                if (sysmem.bank[i].start >> PAGE_SHIFT < max_low_pfn) {
+                        unsigned long end = min(max_low_pfn << PAGE_SHIFT,
+                                                sysmem.bank[i].end);
+                        free_bootmem(sysmem.bank[i].start,
+                                     end - sysmem.bank[i].start);
+                }
+        }
 
 }
 
diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
index 36ec171698b8..861203e958da 100644
--- a/arch/xtensa/mm/mmu.c
+++ b/arch/xtensa/mm/mmu.c
@@ -39,7 +39,7 @@ void init_mmu(void)
         set_itlbcfg_register(0);
         set_dtlbcfg_register(0);
 #endif
-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && CONFIG_OF
+#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
         /*
          * Update the IO area mapping in case xtensa_kio_paddr has changed
          */
diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index 800227862fe8..57fd08b36f51 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -135,11 +135,11 @@ static void __init update_local_mac(struct device_node *node)
 
 static int __init machine_setup(void)
 {
-        struct device_node *serial;
+        struct device_node *clock;
         struct device_node *eth = NULL;
 
-        for_each_compatible_node(serial, NULL, "ns16550a")
-                update_clock_frequency(serial);
+        for_each_node_by_name(clock, "main-oscillator")
+                update_clock_frequency(clock);
 
         if ((eth = of_find_compatible_node(eth, NULL, "opencores,ethoc")))
                 update_local_mac(eth);
@@ -290,6 +290,7 @@ static int __init xtavnet_init(void)
          * knows whether they set it correctly on the DIP switches.
          */
         pr_info("XTFPGA: Ethernet MAC %pM\n", ethoc_pdata.hwaddr);
+        ethoc_pdata.eth_clkfreq = *(long *)XTFPGA_CLKFRQ_VADDR;
 
         return 0;
 }
diff --git a/arch/xtensa/variants/fsf/include/variant/tie.h b/arch/xtensa/variants/fsf/include/variant/tie.h
index bf4020116df5..244cdea4dee5 100644
--- a/arch/xtensa/variants/fsf/include/variant/tie.h
+++ b/arch/xtensa/variants/fsf/include/variant/tie.h
@@ -18,13 +18,6 @@
 #define XCHAL_CP_MASK                   0x00    /* bitmask of all CPs by ID */
 #define XCHAL_CP_PORT_MASK              0x00    /* bitmask of only port CPs */
 
-/*  Basic parameters of each coprocessor:  */
-#define XCHAL_CP7_NAME                  "XTIOP"
-#define XCHAL_CP7_IDENT                 XTIOP
-#define XCHAL_CP7_SA_SIZE               0       /* size of state save area */
-#define XCHAL_CP7_SA_ALIGN              1       /* min alignment of save area */
-#define XCHAL_CP_ID_XTIOP               7       /* coprocessor ID (0..7) */
-
 /*  Filler info for unassigned coprocessors, to simplify arrays etc:  */
 #define XCHAL_NCP_SA_SIZE               0
 #define XCHAL_NCP_SA_ALIGN              1
@@ -42,6 +35,8 @@
 #define XCHAL_CP5_SA_ALIGN              1
 #define XCHAL_CP6_SA_SIZE               0
 #define XCHAL_CP6_SA_ALIGN              1
+#define XCHAL_CP7_SA_SIZE               0
+#define XCHAL_CP7_SA_ALIGN              1
 
 /*  Save area for non-coprocessor optional and custom (TIE) state:  */
 #define XCHAL_NCP_SA_SIZE               0
diff --git a/block/blk-core.c b/block/blk-core.c
index c00e0bdeab4a..853f92749202 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -693,11 +693,20 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
         if (!uninit_q)
                 return NULL;
 
+        uninit_q->flush_rq = kzalloc(sizeof(struct request), GFP_KERNEL);
+        if (!uninit_q->flush_rq)
+                goto out_cleanup_queue;
+
         q = blk_init_allocated_queue(uninit_q, rfn, lock);
         if (!q)
-                blk_cleanup_queue(uninit_q);
-
+                goto out_free_flush_rq;
         return q;
+
+out_free_flush_rq:
+        kfree(uninit_q->flush_rq);
+out_cleanup_queue:
+        blk_cleanup_queue(uninit_q);
+        return NULL;
 }
 EXPORT_SYMBOL(blk_init_queue_node);
 
@@ -1127,7 +1136,7 @@ static struct request *blk_old_get_request(struct request_queue *q, int rw,
 struct request *blk_get_request(struct request_queue *q, int rw, gfp_t gfp_mask)
 {
         if (q->mq_ops)
-                return blk_mq_alloc_request(q, rw, gfp_mask, false);
+                return blk_mq_alloc_request(q, rw, gfp_mask);
         else
                 return blk_old_get_request(q, rw, gfp_mask);
 }
@@ -1278,6 +1287,11 @@ void __blk_put_request(struct request_queue *q, struct request *req)
         if (unlikely(!q))
                 return;
 
+        if (q->mq_ops) {
+                blk_mq_free_request(req);
+                return;
+        }
+
         blk_pm_put_request(req);
 
         elv_completed_request(q, req);
diff --git a/block/blk-exec.c b/block/blk-exec.c
index bbfc072a79c2..c68613bb4c79 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -65,7 +65,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
          * be resued after dying flag is set
          */
         if (q->mq_ops) {
-                blk_mq_insert_request(q, rq, true);
+                blk_mq_insert_request(q, rq, at_head, true);
                 return;
         }
 
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 9288aaf35c21..66e2b697f5db 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -130,20 +130,26 @@ static void blk_flush_restore_request(struct request *rq)
         blk_clear_rq_complete(rq);
 }
 
-static void mq_flush_data_run(struct work_struct *work)
+static void mq_flush_run(struct work_struct *work)
 {
         struct request *rq;
 
-        rq = container_of(work, struct request, mq_flush_data);
+        rq = container_of(work, struct request, mq_flush_work);
 
         memset(&rq->csd, 0, sizeof(rq->csd));
         blk_mq_run_request(rq, true, false);
 }
 
-static void blk_mq_flush_data_insert(struct request *rq)
+static bool blk_flush_queue_rq(struct request *rq)
 {
-        INIT_WORK(&rq->mq_flush_data, mq_flush_data_run);
-        kblockd_schedule_work(rq->q, &rq->mq_flush_data);
+        if (rq->q->mq_ops) {
+                INIT_WORK(&rq->mq_flush_work, mq_flush_run);
+                kblockd_schedule_work(rq->q, &rq->mq_flush_work);
+                return false;
+        } else {
+                list_add_tail(&rq->queuelist, &rq->q->queue_head);
+                return true;
+        }
 }
 
 /**
@@ -187,12 +193,7 @@ static bool blk_flush_complete_seq(struct request *rq, unsigned int seq,
 
         case REQ_FSEQ_DATA:
                 list_move_tail(&rq->flush.list, &q->flush_data_in_flight);
-                if (q->mq_ops)
-                        blk_mq_flush_data_insert(rq);
-                else {
-                        list_add(&rq->queuelist, &q->queue_head);
-                        queued = true;
-                }
+                queued = blk_flush_queue_rq(rq);
                 break;
 
         case REQ_FSEQ_DONE:
@@ -216,9 +217,6 @@ static bool blk_flush_complete_seq(struct request *rq, unsigned int seq,
         }
 
         kicked = blk_kick_flush(q);
-        /* blk_mq_run_flush will run queue */
-        if (q->mq_ops)
-                return queued;
         return kicked | queued;
 }
 
@@ -230,10 +228,9 @@ static void flush_end_io(struct request *flush_rq, int error)
         struct request *rq, *n;
         unsigned long flags = 0;
 
-        if (q->mq_ops) {
-                blk_mq_free_request(flush_rq);
+        if (q->mq_ops)
                 spin_lock_irqsave(&q->mq_flush_lock, flags);
-        }
+
         running = &q->flush_queue[q->flush_running_idx];
         BUG_ON(q->flush_pending_idx == q->flush_running_idx);
 
@@ -263,49 +260,14 @@ static void flush_end_io(struct request *flush_rq, int error)
          * kblockd.
          */
         if (queued || q->flush_queue_delayed) {
-                if (!q->mq_ops)
-                        blk_run_queue_async(q);
-                else
-                /*
-                 * This can be optimized to only run queues with requests
-                 * queued if necessary.
-                 */
-                        blk_mq_run_queues(q, true);
+                WARN_ON(q->mq_ops);
+                blk_run_queue_async(q);
         }
         q->flush_queue_delayed = 0;
         if (q->mq_ops)
                 spin_unlock_irqrestore(&q->mq_flush_lock, flags);
 }
 
-static void mq_flush_work(struct work_struct *work)
-{
-        struct request_queue *q;
-        struct request *rq;
-
-        q = container_of(work, struct request_queue, mq_flush_work);
-
-        /* We don't need set REQ_FLUSH_SEQ, it's for consistency */
-        rq = blk_mq_alloc_request(q, WRITE_FLUSH|REQ_FLUSH_SEQ,
-                __GFP_WAIT|GFP_ATOMIC, true);
-        rq->cmd_type = REQ_TYPE_FS;
-        rq->end_io = flush_end_io;
-
-        blk_mq_run_request(rq, true, false);
-}
-
-/*
- * We can't directly use q->flush_rq, because it doesn't have tag and is not in
- * hctx->rqs[]. so we must allocate a new request, since we can't sleep here,
- * so offload the work to workqueue.
- *
- * Note: we assume a flush request finished in any hardware queue will flush
- * the whole disk cache.
- */
-static void mq_run_flush(struct request_queue *q)
-{
-        kblockd_schedule_work(q, &q->mq_flush_work);
-}
-
 /**
  * blk_kick_flush - consider issuing flush request
  * @q: request_queue being kicked
@@ -340,19 +302,31 @@ static bool blk_kick_flush(struct request_queue *q)
          * different from running_idx, which means flush is in flight.
          */
         q->flush_pending_idx ^= 1;
+
         if (q->mq_ops) {
-                mq_run_flush(q);
-                return true;
+                struct blk_mq_ctx *ctx = first_rq->mq_ctx;
+                struct blk_mq_hw_ctx *hctx = q->mq_ops->map_queue(q, ctx->cpu);
+
+                blk_mq_rq_init(hctx, q->flush_rq);
+                q->flush_rq->mq_ctx = ctx;
+
+                /*
+                 * Reuse the tag value from the fist waiting request,
+                 * with blk-mq the tag is generated during request
+                 * allocation and drivers can rely on it being inside
+                 * the range they asked for.
+                 */
+                q->flush_rq->tag = first_rq->tag;
+        } else {
+                blk_rq_init(q, q->flush_rq);
         }
 
-        blk_rq_init(q, &q->flush_rq);
-        q->flush_rq.cmd_type = REQ_TYPE_FS;
-        q->flush_rq.cmd_flags = WRITE_FLUSH | REQ_FLUSH_SEQ;
-        q->flush_rq.rq_disk = first_rq->rq_disk;
-        q->flush_rq.end_io = flush_end_io;
+        q->flush_rq->cmd_type = REQ_TYPE_FS;
+        q->flush_rq->cmd_flags = WRITE_FLUSH | REQ_FLUSH_SEQ;
+        q->flush_rq->rq_disk = first_rq->rq_disk;
+        q->flush_rq->end_io = flush_end_io;
 
-        list_add_tail(&q->flush_rq.queuelist, &q->queue_head);
-        return true;
+        return blk_flush_queue_rq(q->flush_rq);
 }
 
 static void flush_data_end_io(struct request *rq, int error)
@@ -558,5 +532,4 @@ EXPORT_SYMBOL(blkdev_issue_flush);
 void blk_mq_init_flush(struct request_queue *q)
 {
         spin_lock_init(&q->mq_flush_lock);
-        INIT_WORK(&q->mq_flush_work, mq_flush_work);
 }
diff --git a/block/blk-lib.c b/block/blk-lib.c
index 2da76c999ef3..97a733cf3d5f 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -119,6 +119,14 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
 
                 atomic_inc(&bb.done);
                 submit_bio(type, bio);
+
+                /*
+                 * We can loop for a long time in here, if someone does
+                 * full device discards (like mkfs). Be nice and allow
+                 * us to schedule out to avoid softlocking if preempt
+                 * is disabled.
+                 */
+                cond_resched();
         }
         blk_finish_plug(&plug);
 
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 8f8adaa95466..6c583f9c5b65 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -21,6 +21,16 @@ static unsigned int __blk_recalc_rq_segments(struct request_queue *q,
         if (!bio)
                 return 0;
 
+        /*
+         * This should probably be returning 0, but blk_add_request_payload()
+         * (Christoph!!!!)
+         */
+        if (bio->bi_rw & REQ_DISCARD)
+                return 1;
+
+        if (bio->bi_rw & REQ_WRITE_SAME)
+                return 1;
+
         fbio = bio;
         cluster = blk_queue_cluster(q);
         seg_size = 0;
@@ -161,30 +171,60 @@ new_segment:
         *bvprv = *bvec;
 }
 
-/*
- * map a request to scatterlist, return number of sg entries setup. Caller
- * must make sure sg can hold rq->nr_phys_segments entries
- */
-int blk_rq_map_sg(struct request_queue *q, struct request *rq,
-                  struct scatterlist *sglist)
+static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio,
+                             struct scatterlist *sglist,
+                             struct scatterlist **sg)
 {
         struct bio_vec bvec, bvprv = { NULL };
-        struct req_iterator iter;
-        struct scatterlist *sg;
+        struct bvec_iter iter;
         int nsegs, cluster;
 
         nsegs = 0;
         cluster = blk_queue_cluster(q);
 
-        /*
-         * for each bio in rq
-         */
-        sg = NULL;
-        rq_for_each_segment(bvec, rq, iter) {
-                __blk_segment_map_sg(q, &bvec, sglist, &bvprv, &sg,
-                                     &nsegs, &cluster);
-        } /* segments in rq */
+        if (bio->bi_rw & REQ_DISCARD) {
+                /*
+                 * This is a hack - drivers should be neither modifying the
+                 * biovec, nor relying on bi_vcnt - but because of
+                 * blk_add_request_payload(), a discard bio may or may not have
+                 * a payload we need to set up here (thank you Christoph) and
+                 * bi_vcnt is really the only way of telling if we need to.
+                 */
+
+                if (bio->bi_vcnt)
+                        goto single_segment;
+
+                return 0;
+        }
+
+        if (bio->bi_rw & REQ_WRITE_SAME) {
+single_segment:
+                *sg = sglist;
+                bvec = bio_iovec(bio);
+                sg_set_page(*sg, bvec.bv_page, bvec.bv_len, bvec.bv_offset);
+                return 1;
+        }
+
+        for_each_bio(bio)
+                bio_for_each_segment(bvec, bio, iter)
+                        __blk_segment_map_sg(q, &bvec, sglist, &bvprv, sg,
+                                             &nsegs, &cluster);
 
+        return nsegs;
+}
+
+/*
+ * map a request to scatterlist, return number of sg entries setup. Caller
+ * must make sure sg can hold rq->nr_phys_segments entries
+ */
+int blk_rq_map_sg(struct request_queue *q, struct request *rq,
+                  struct scatterlist *sglist)
+{
+        struct scatterlist *sg = NULL;
+        int nsegs = 0;
+
+        if (rq->bio)
+                nsegs = __blk_bios_map_sg(q, rq->bio, sglist, &sg);
 
         if (unlikely(rq->cmd_flags & REQ_COPY_USER) &&
             (blk_rq_bytes(rq) & q->dma_pad_mask)) {
@@ -230,20 +270,13 @@ EXPORT_SYMBOL(blk_rq_map_sg);
 int blk_bio_map_sg(struct request_queue *q, struct bio *bio,
                    struct scatterlist *sglist)
 {
-        struct bio_vec bvec, bvprv = { NULL };
-        struct scatterlist *sg;
-        int nsegs, cluster;
-        struct bvec_iter iter;
-
-        nsegs = 0;
-        cluster = blk_queue_cluster(q);
-
-        sg = NULL;
-        bio_for_each_segment(bvec, bio, iter) {
-                __blk_segment_map_sg(q, &bvec, sglist, &bvprv, &sg,
-                                     &nsegs, &cluster);
-        } /* segments in bio */
+        struct scatterlist *sg = NULL;
+        int nsegs;
+        struct bio *next = bio->bi_next;
+        bio->bi_next = NULL;
 
+        nsegs = __blk_bios_map_sg(q, bio, sglist, &sg);
+        bio->bi_next = next;
         if (sg)
                 sg_mark_end(sg);
 
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 5d70edc9855f..83ae96c51a27 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -184,7 +184,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags)
 ssize_t blk_mq_tag_sysfs_show(struct blk_mq_tags *tags, char *page)
 {
         char *orig_page = page;
-        int cpu;
+        unsigned int cpu;
 
         if (!tags)
                 return 0;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 57039fcd9c93..1fa9dd153fde 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -226,15 +226,14 @@ static struct request *blk_mq_alloc_request_pinned(struct request_queue *q,
         return rq;
 }
 
-struct request *blk_mq_alloc_request(struct request_queue *q, int rw,
-                gfp_t gfp, bool reserved)
+struct request *blk_mq_alloc_request(struct request_queue *q, int rw, gfp_t gfp)
 {
         struct request *rq;
 
         if (blk_mq_queue_enter(q))
                 return NULL;
 
-        rq = blk_mq_alloc_request_pinned(q, rw, gfp, reserved);
+        rq = blk_mq_alloc_request_pinned(q, rw, gfp, false);
         if (rq)
                 blk_mq_put_ctx(rq->mq_ctx);
         return rq;
@@ -258,7 +257,7 @@ EXPORT_SYMBOL(blk_mq_alloc_reserved_request);
 /*
  * Re-init and set pdu, if we have it
  */
-static void blk_mq_rq_init(struct blk_mq_hw_ctx *hctx, struct request *rq)
+void blk_mq_rq_init(struct blk_mq_hw_ctx *hctx, struct request *rq)
 {
         blk_rq_init(hctx->queue, rq);
 
@@ -305,7 +304,7 @@ static void blk_mq_bio_endio(struct request *rq, struct bio *bio, int error)
                 bio_endio(bio, error);
 }
 
-void blk_mq_complete_request(struct request *rq, int error)
+void blk_mq_end_io(struct request *rq, int error)
 {
         struct bio *bio = rq->bio;
         unsigned int bytes = 0;
@@ -330,48 +329,55 @@ void blk_mq_complete_request(struct request *rq, int error)
         else
                 blk_mq_free_request(rq);
 }
+EXPORT_SYMBOL(blk_mq_end_io);
 
-void __blk_mq_end_io(struct request *rq, int error)
-{
-        if (!blk_mark_rq_complete(rq))
-                blk_mq_complete_request(rq, error);
-}
-
-static void blk_mq_end_io_remote(void *data)
+static void __blk_mq_complete_request_remote(void *data)
 {
         struct request *rq = data;
 
-        __blk_mq_end_io(rq, rq->errors);
+        rq->q->softirq_done_fn(rq);
 }
 
-/*
- * End IO on this request on a multiqueue enabled driver. We'll either do
- * it directly inline, or punt to a local IPI handler on the matching
- * remote CPU.
- */
-void blk_mq_end_io(struct request *rq, int error)
+void __blk_mq_complete_request(struct request *rq)
 {
         struct blk_mq_ctx *ctx = rq->mq_ctx;
         int cpu;
 
-        if (!ctx->ipi_redirect)
-                return __blk_mq_end_io(rq, error);
+        if (!ctx->ipi_redirect) {
+                rq->q->softirq_done_fn(rq);
+                return;
+        }
 
         cpu = get_cpu();
         if (cpu != ctx->cpu && cpu_online(ctx->cpu)) {
-                rq->errors = error;
-                rq->csd.func = blk_mq_end_io_remote;
+                rq->csd.func = __blk_mq_complete_request_remote;
                 rq->csd.info = rq;
                 rq->csd.flags = 0;
                 __smp_call_function_single(ctx->cpu, &rq->csd, 0);
         } else {
-                __blk_mq_end_io(rq, error);
+                rq->q->softirq_done_fn(rq);
         }
         put_cpu();
 }
-EXPORT_SYMBOL(blk_mq_end_io);
 
-static void blk_mq_start_request(struct request *rq)
+/**
+ * blk_mq_complete_request - end I/O on a request
+ * @rq:         the request being processed
+ *
+ * Description:
+ *      Ends all I/O on a request. It does not handle partial completions.
+ *      The actual completion happens out-of-order, through a IPI handler.
+ **/
+void blk_mq_complete_request(struct request *rq)
+{
+        if (unlikely(blk_should_fake_timeout(rq->q)))
+                return;
+        if (!blk_mark_rq_complete(rq))
+                __blk_mq_complete_request(rq);
+}
+EXPORT_SYMBOL(blk_mq_complete_request);
+
+static void blk_mq_start_request(struct request *rq, bool last)
 {
         struct request_queue *q = rq->q;
 
@@ -384,6 +390,25 @@ static void blk_mq_start_request(struct request *rq)
          */
         rq->deadline = jiffies + q->rq_timeout;
         set_bit(REQ_ATOM_STARTED, &rq->atomic_flags);
+
+        if (q->dma_drain_size && blk_rq_bytes(rq)) {
+                /*
+                 * Make sure space for the drain appears.  We know we can do
+                 * this because max_hw_segments has been adjusted to be one
+                 * fewer than the device can handle.
+                 */
+                rq->nr_phys_segments++;
+        }
+
+        /*
+         * Flag the last request in the series so that drivers know when IO
+         * should be kicked off, if they don't do it on a per-request basis.
+         *
+         * Note: the flag isn't the only condition drivers should do kick off.
+         * If drive is busy, the last request might not have the bit set.
+         */
+        if (last)
+                rq->cmd_flags |= REQ_END;
 }
 
 static void blk_mq_requeue_request(struct request *rq)
@@ -392,6 +417,11 @@ static void blk_mq_requeue_request(struct request *rq)
 
         trace_block_rq_requeue(q, rq);
         clear_bit(REQ_ATOM_STARTED, &rq->atomic_flags);
+
+        rq->cmd_flags &= ~REQ_END;
+
+        if (q->dma_drain_size && blk_rq_bytes(rq))
+                rq->nr_phys_segments--;
 }
 
 struct blk_mq_timeout_data {
@@ -559,19 +589,8 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
 
                 rq = list_first_entry(&rq_list, struct request, queuelist);
                 list_del_init(&rq->queuelist);
-                blk_mq_start_request(rq);
 
-                /*
-                 * Last request in the series. Flag it as such, this
-                 * enables drivers to know when IO should be kicked off,
-                 * if they don't do it on a per-request basis.
-                 *
-                 * Note: the flag isn't the only condition drivers
-                 * should do kick off. If drive is busy, the last
-                 * request might not have the bit set.
-                 */
-                if (list_empty(&rq_list))
-                        rq->cmd_flags |= REQ_END;
+                blk_mq_start_request(rq, list_empty(&rq_list));
 
                 ret = q->mq_ops->queue_rq(hctx, rq);
                 switch (ret) {
@@ -589,8 +608,8 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
                         break;
                 default:
                         pr_err("blk-mq: bad return on queue: %d\n", ret);
-                        rq->errors = -EIO;
                 case BLK_MQ_RQ_QUEUE_ERROR:
+                        rq->errors = -EIO;
                         blk_mq_end_io(rq, rq->errors);
                         break;
                 }
@@ -693,13 +712,16 @@ static void blk_mq_work_fn(struct work_struct *work)
 }
 
 static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
-                                    struct request *rq)
+                                    struct request *rq, bool at_head)
 {
         struct blk_mq_ctx *ctx = rq->mq_ctx;
 
         trace_block_rq_insert(hctx->queue, rq);
 
-        list_add_tail(&rq->queuelist, &ctx->rq_list);
+        if (at_head)
+                list_add(&rq->queuelist, &ctx->rq_list);
+        else
+                list_add_tail(&rq->queuelist, &ctx->rq_list);
         blk_mq_hctx_mark_pending(hctx, ctx);
 
         /*
@@ -709,7 +731,7 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
 }
 
 void blk_mq_insert_request(struct request_queue *q, struct request *rq,
-                           bool run_queue)
+                           bool at_head, bool run_queue)
 {
         struct blk_mq_hw_ctx *hctx;
         struct blk_mq_ctx *ctx, *current_ctx;
@@ -728,7 +750,7 @@ void blk_mq_insert_request(struct request_queue *q, struct request *rq,
                         rq->mq_ctx = ctx;
                 }
                 spin_lock(&ctx->lock);
-                __blk_mq_insert_request(hctx, rq);
+                __blk_mq_insert_request(hctx, rq, at_head);
                 spin_unlock(&ctx->lock);
 
                 blk_mq_put_ctx(current_ctx);
@@ -760,7 +782,7 @@ void blk_mq_run_request(struct request *rq, bool run_queue, bool async)
 
         /* ctx->cpu might be offline */
         spin_lock(&ctx->lock);
-        __blk_mq_insert_request(hctx, rq);
+        __blk_mq_insert_request(hctx, rq, false);
         spin_unlock(&ctx->lock);
 
         blk_mq_put_ctx(current_ctx);
@@ -798,7 +820,7 @@ static void blk_mq_insert_requests(struct request_queue *q,
                 rq = list_first_entry(list, struct request, queuelist);
                 list_del_init(&rq->queuelist);
                 rq->mq_ctx = ctx;
-                __blk_mq_insert_request(hctx, rq);
+                __blk_mq_insert_request(hctx, rq, false);
         }
         spin_unlock(&ctx->lock);
 
@@ -888,6 +910,11 @@ static void blk_mq_make_request(struct request_queue *q, struct bio *bio)
 
         blk_queue_bounce(q, &bio);
 
+        if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) {
+                bio_endio(bio, -EIO);
+                return;
+        }
+
         if (use_plug && blk_attempt_plug_merge(q, bio, &request_count))
                 return;
 
@@ -950,7 +977,7 @@ static void blk_mq_make_request(struct request_queue *q, struct bio *bio)
                 __blk_mq_free_request(hctx, ctx, rq);
         else {
                 blk_mq_bio_to_request(rq, bio);
-                __blk_mq_insert_request(hctx, rq);
+                __blk_mq_insert_request(hctx, rq, false);
         }
 
         spin_unlock(&ctx->lock);
@@ -1309,15 +1336,6 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_reg *reg,
                 reg->queue_depth = BLK_MQ_MAX_DEPTH;
         }
 
-        /*
-         * Set aside a tag for flush requests.  It will only be used while
-         * another flush request is in progress but outside the driver.
-         *
-         * TODO: only allocate if flushes are supported
-         */
-        reg->queue_depth++;
-        reg->reserved_tags++;
-
         if (reg->queue_depth < (reg->reserved_tags + BLK_MQ_TAG_MIN))
                 return ERR_PTR(-EINVAL);
 
@@ -1360,17 +1378,27 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_reg *reg,
         q->mq_ops = reg->ops;
         q->queue_flags |= QUEUE_FLAG_MQ_DEFAULT;
 
+        q->sg_reserved_size = INT_MAX;
+
         blk_queue_make_request(q, blk_mq_make_request);
         blk_queue_rq_timed_out(q, reg->ops->timeout);
         if (reg->timeout)
                 blk_queue_rq_timeout(q, reg->timeout);
 
+        if (reg->ops->complete)
+                blk_queue_softirq_done(q, reg->ops->complete);
+
         blk_mq_init_flush(q);
         blk_mq_init_cpu_queues(q, reg->nr_hw_queues);
 
-        if (blk_mq_init_hw_queues(q, reg, driver_data))
+        q->flush_rq = kzalloc(round_up(sizeof(struct request) + reg->cmd_size,
+                                cache_line_size()), GFP_KERNEL);
+        if (!q->flush_rq)
                 goto err_hw;
 
+        if (blk_mq_init_hw_queues(q, reg, driver_data))
+                goto err_flush_rq;
+
         blk_mq_map_swqueue(q);
 
         mutex_lock(&all_q_mutex);
@@ -1378,6 +1406,9 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_reg *reg,
         mutex_unlock(&all_q_mutex);
 
         return q;
+
+err_flush_rq:
+        kfree(q->flush_rq);
 err_hw:
         kfree(q->mq_map);
 err_map:
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 5c3917984b00..ed0035cd458e 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -22,13 +22,13 @@ struct blk_mq_ctx {
         struct kobject          kobj;
 };
 
-void __blk_mq_end_io(struct request *rq, int error);
-void blk_mq_complete_request(struct request *rq, int error);
+void __blk_mq_complete_request(struct request *rq);
 void blk_mq_run_request(struct request *rq, bool run_queue, bool async);
 void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
 void blk_mq_init_flush(struct request_queue *q);
 void blk_mq_drain_queue(struct request_queue *q);
 void blk_mq_free_queue(struct request_queue *q);
+void blk_mq_rq_init(struct blk_mq_hw_ctx *hctx, struct request *rq);
 
 /*
  * CPU hotplug helpers
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 8095c4a21fc0..7500f876dae4 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -549,6 +549,8 @@ static void blk_release_queue(struct kobject *kobj)
         if (q->mq_ops)
                 blk_mq_free_queue(q);
 
+        kfree(q->flush_rq);
+
         blk_trace_shutdown(q);
 
         bdi_destroy(&q->backing_dev_info);
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index bba81c9348e1..d96f7061c6fd 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -91,7 +91,7 @@ static void blk_rq_timed_out(struct request *req)
         case BLK_EH_HANDLED:
                 /* Can we use req->errors here? */
                 if (q->mq_ops)
-                        blk_mq_complete_request(req, req->errors);
+                        __blk_mq_complete_request(req);
                 else
                         __blk_complete_request(req);
                 break;
diff --git a/block/blk.h b/block/blk.h
index c90e1d8f7a2b..d23b415b8a28 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -113,7 +113,7 @@ static inline struct request *__elv_next_request(struct request_queue *q)
                         q->flush_queue_delayed = 1;
                         return NULL;
                 }
-                if (unlikely(blk_queue_dying(q)) ||
+                if (unlikely(blk_queue_bypass(q)) ||
                     !q->elevator->type->ops.elevator_dispatch_fn(q, 0))
                         return NULL;
         }
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index e7515aa43d6b..6f190bc2b8b7 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -243,6 +243,8 @@ static int acpi_ac_resume(struct device *dev)
                 kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
         return 0;
 }
+#else
+#define acpi_ac_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_ac_pm_ops, NULL, acpi_ac_resume);
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 018a42883706..797a6938d051 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -841,6 +841,8 @@ static int acpi_battery_resume(struct device *dev)
         acpi_battery_update(battery);
         return 0;
 }
+#else
+#define acpi_battery_resume NULL
 #endif
 
 static SIMPLE_DEV_PM_OPS(acpi_battery_pm, NULL, acpi_battery_resume);
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 10e4964d051a..afec4526c48a 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -260,14 +260,6 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
         },
         {
         .callback = dmi_disable_osi_win8,
-        .ident = "Dell Inspiron 15R SE",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7520"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
         .ident = "ThinkPad Edge E530",
         .matches = {
                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -322,56 +314,6 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                      DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
                 },
         },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ProBook 2013 models",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook "),
-                     DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP EliteBook 2013 models",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook "),
-                     DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ZBook 14",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 14"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ZBook 15",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 15"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ZBook 17",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 17"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP EliteBook 8780w",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8780w"),
-                },
-        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 11c11f6b8fa1..714e957a871a 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -80,6 +80,8 @@ static void acpi_button_notify(struct acpi_device *device, u32 event);
 
 #ifdef CONFIG_PM_SLEEP
 static int acpi_button_resume(struct device *dev);
+#else
+#define acpi_button_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_button_pm, NULL, acpi_button_resume);
 
diff --git a/drivers/acpi/container.c b/drivers/acpi/container.c
index 0b6ae6eb5c4a..368f9ddb8480 100644
--- a/drivers/acpi/container.c
+++ b/drivers/acpi/container.c
@@ -79,9 +79,10 @@ static int container_device_attach(struct acpi_device *adev,
         ACPI_COMPANION_SET(dev, adev);
         dev->release = acpi_container_release;
         ret = device_register(dev);
-        if (ret)
+        if (ret) {
+                put_device(dev);
                 return ret;
-
+        }
         adev->driver_data = dev;
         return 1;
 }
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index c431c88faaff..5bfd769fc91f 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -609,7 +609,7 @@ static int handle_eject_request(struct dock_station *ds, u32 event)
 static void dock_notify(struct dock_station *ds, u32 event)
 {
         acpi_handle handle = ds->handle;
-        struct acpi_device *ad;
+        struct acpi_device *adev = NULL;
         int surprise_removal = 0;
 
         /*
@@ -632,7 +632,8 @@ static void dock_notify(struct dock_station *ds, u32 event)
         switch (event) {
         case ACPI_NOTIFY_BUS_CHECK:
         case ACPI_NOTIFY_DEVICE_CHECK:
-                if (!dock_in_progress(ds) && acpi_bus_get_device(handle, &ad)) {
+                acpi_bus_get_device(handle, &adev);
+                if (!dock_in_progress(ds) && !acpi_device_enumerated(adev)) {
                         begin_dock(ds);
                         dock(ds);
                         if (!dock_present(ds)) {
@@ -712,13 +713,11 @@ static acpi_status __init find_dock_devices(acpi_handle handle, u32 lvl,
 static ssize_t show_docked(struct device *dev,
                            struct device_attribute *attr, char *buf)
 {
-        struct acpi_device *tmp;
-
         struct dock_station *dock_station = dev->platform_data;
+        struct acpi_device *adev = NULL;
 
-        if (!acpi_bus_get_device(dock_station->handle, &tmp))
-                return snprintf(buf, PAGE_SIZE, "1\n");
-        return snprintf(buf, PAGE_SIZE, "0\n");
+        acpi_bus_get_device(dock_station->handle, &adev);
+        return snprintf(buf, PAGE_SIZE, "%u\n", acpi_device_enumerated(adev));
 }
 static DEVICE_ATTR(docked, S_IRUGO, show_docked, NULL);
 
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 1fb62900f32a..09e423f3d8ad 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -55,6 +55,9 @@ MODULE_DEVICE_TABLE(acpi, fan_device_ids);
 #ifdef CONFIG_PM_SLEEP
 static int acpi_fan_suspend(struct device *dev);
 static int acpi_fan_resume(struct device *dev);
+#else
+#define acpi_fan_suspend NULL
+#define acpi_fan_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_fan_pm, acpi_fan_suspend, acpi_fan_resume);
 
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index 52d45ea2bc4f..361b40c10c3f 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -430,6 +430,7 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
                                  pin_name(pin));
                 }
 
+                kfree(entry);
                 return 0;
         }
 
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index d465ae6cdd00..dbd48498b938 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -450,7 +450,7 @@ static ssize_t acpi_battery_alarm_store(struct device *dev,
 {
         unsigned long x;
         struct acpi_battery *battery = to_acpi_battery(dev_get_drvdata(dev));
-        if (sscanf(buf, "%ld\n", &x) == 1)
+        if (sscanf(buf, "%lu\n", &x) == 1)
                 battery->alarm_capacity = x /
                         (1000 * acpi_battery_scale(battery));
         if (battery->present)
@@ -668,6 +668,8 @@ static int acpi_sbs_resume(struct device *dev)
         acpi_sbs_callback(sbs);
         return 0;
 }
+#else
+#define acpi_sbs_resume NULL
 #endif
 
 static SIMPLE_DEV_PM_OPS(acpi_sbs_pm, NULL, acpi_sbs_resume);
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 8349a555b92b..08626c851be7 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -102,6 +102,8 @@ MODULE_DEVICE_TABLE(acpi, thermal_device_ids);
 
 #ifdef CONFIG_PM_SLEEP
 static int acpi_thermal_resume(struct device *dev);
+#else
+#define acpi_thermal_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_thermal_pm, NULL, acpi_thermal_resume);
 
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index b727d105046d..b6ba88ed31ae 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -81,11 +81,12 @@ static bool allow_duplicates;
 module_param(allow_duplicates, bool, 0644);
 
 /*
- * For Windows 8 systems: if set ture and the GPU driver has
- * registered a backlight interface, skip registering ACPI video's.
+ * For Windows 8 systems: used to decide if video module
+ * should skip registering backlight interface of its own.
  */
-static bool use_native_backlight = false;
-module_param(use_native_backlight, bool, 0644);
+static int use_native_backlight_param = -1;
+module_param_named(use_native_backlight, use_native_backlight_param, int, 0444);
+static bool use_native_backlight_dmi = false;
 
 static int register_count;
 static struct mutex video_list_lock;
@@ -231,9 +232,17 @@ static int acpi_video_get_next_level(struct acpi_video_device *device,
 static int acpi_video_switch_brightness(struct acpi_video_device *device,
                                          int event);
 
+static bool acpi_video_use_native_backlight(void)
+{
+        if (use_native_backlight_param != -1)
+                return use_native_backlight_param;
+        else
+                return use_native_backlight_dmi;
+}
+
 static bool acpi_video_verify_backlight_support(void)
 {
-        if (acpi_osi_is_win8() && use_native_backlight &&
+        if (acpi_osi_is_win8() && acpi_video_use_native_backlight() &&
             backlight_device_registered(BACKLIGHT_RAW))
                 return false;
         return acpi_video_backlight_support();
@@ -398,6 +407,12 @@ static int __init video_set_bqc_offset(const struct dmi_system_id *d)
         return 0;
 }
 
+static int __init video_set_use_native_backlight(const struct dmi_system_id *d)
+{
+        use_native_backlight_dmi = true;
+        return 0;
+}
+
 static struct dmi_system_id video_dmi_table[] __initdata = {
         /*
          * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
@@ -442,6 +457,120 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720"),
                 },
         },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "ThinkPad T430s",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "ThinkPad X230",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X230"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "ThinkPad X1 Carbon",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X1 Carbon"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Lenovo Yoga 13",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo IdeaPad Yoga 13"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Dell Inspiron 7520",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "Inspiron 7520"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Acer Aspire 5733Z",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5733Z"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Acer Aspire V5-431",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire V5-431"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ProBook 4340s",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "HP ProBook 4340s"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ProBook 2013 models",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook "),
+                DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP EliteBook 2013 models",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook "),
+                DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ZBook 14",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 14"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ZBook 15",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 15"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ZBook 17",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 17"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP EliteBook 8780w",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8780w"),
+                },
+        },
         {}
 };
 
@@ -685,6 +814,7 @@ acpi_video_init_brightness(struct acpi_video_device *device)
         union acpi_object *o;
         struct acpi_video_device_brightness *br = NULL;
         int result = -EINVAL;
+        u32 value;
 
         if (!ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) {
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available "
@@ -715,7 +845,12 @@ acpi_video_init_brightness(struct acpi_video_device *device)
                         printk(KERN_ERR PREFIX "Invalid data\n");
                         continue;
                 }
-                br->levels[count] = (u32) o->integer.value;
+                value = (u32) o->integer.value;
+                /* Skip duplicate entries */
+                if (count > 2 && br->levels[count - 1] == value)
+                        continue;
+
+                br->levels[count] = value;
 
                 if (br->levels[count] > max_level)
                         max_level = br->levels[count];
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index a697b77b8865..19080c8e2f2a 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -168,22 +168,6 @@ static struct dmi_system_id video_detect_dmi_table[] = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"),
                 },
         },
-        {
-        .callback = video_detect_force_vendor,
-        .ident = "HP EliteBook Revolve 810",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook Revolve 810 G1"),
-                },
-        },
-        {
-        .callback = video_detect_force_vendor,
-        .ident = "Lenovo Yoga 13",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo IdeaPad Yoga 13"),
-                },
-        },
         { },
 };
 
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 4e737728aee2..868429a47be4 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -247,6 +247,7 @@ config SATA_HIGHBANK
 
 config SATA_MV
         tristate "Marvell SATA support"
+        select GENERIC_PHY
         help
           This option enables support for the Marvell Serial ATA family.
           Currently supports 88SX[56]0[48][01] PCI(-X) chips,
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index dc2756fb6f33..c81d809c111b 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -61,6 +61,7 @@ enum board_ids {
         /* board IDs by feature in alphabetical order */
         board_ahci,
         board_ahci_ign_iferr,
+        board_ahci_noncq,
         board_ahci_nosntf,
         board_ahci_yes_fbs,
 
@@ -121,6 +122,13 @@ static const struct ata_port_info ahci_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &ahci_ops,
         },
+        [board_ahci_noncq] = {
+                AHCI_HFLAGS     (AHCI_HFLAG_NO_NCQ),
+                .flags          = AHCI_FLAG_COMMON,
+                .pio_mask       = ATA_PIO4,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &ahci_ops,
+        },
         [board_ahci_nosntf] = {
                 AHCI_HFLAGS     (AHCI_HFLAG_NO_SNTF),
                 .flags          = AHCI_FLAG_COMMON,
@@ -452,6 +460,12 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },   /* ASM1061 */
         { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
+        /*
+         * Samsung SSDs found on some macbooks.  NCQ times out.
+         * https://bugzilla.kernel.org/show_bug.cgi?id=60731
+         */
+        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq },
+
         /* Enmotus */
         { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
 
@@ -1170,8 +1184,10 @@ static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
 
         nvec = rc;
         rc = pci_enable_msi_block(pdev, nvec);
-        if (rc)
+        if (rc < 0)
                 goto intx;
+        else if (rc > 0)
+                goto single_msi;
 
         return nvec;
 
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 20fd337a5731..7ccc084bf1df 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -447,8 +447,11 @@ static void sata_pmp_quirks(struct ata_port *ap)
                  * otherwise.  Don't try hard to recover it.
                  */
                 ap->pmp_link[ap->nr_pmp_links - 1].flags |= ATA_LFLAG_NO_RETRY;
-        } else if (vendor == 0x197b && devid == 0x2352) {
-                /* chip found in Thermaltake BlackX Duet, jmicron JMB350? */
+        } else if (vendor == 0x197b && (devid == 0x2352 || devid == 0x0325)) {
+                /*
+                 * 0x2352: found in Thermaltake BlackX Duet, jmicron JMB350?
+                 * 0x0325: jmicron JMB394.
+                 */
                 ata_for_each_link(link, ap, EDGE) {
                         /* SRST breaks detection and disks get misclassified
                          * LPM disabled to avoid potential problems
diff --git a/drivers/ata/pata_imx.c b/drivers/ata/pata_imx.c
index 26386f0b89a8..b0b18ec5465f 100644
--- a/drivers/ata/pata_imx.c
+++ b/drivers/ata/pata_imx.c
@@ -119,7 +119,9 @@ static int pata_imx_probe(struct platform_device *pdev)
                 return PTR_ERR(priv->clk);
         }
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         host = ata_host_alloc(&pdev->dev, 1);
         if (!host) {
@@ -212,7 +214,9 @@ static int pata_imx_resume(struct device *dev)
         struct ata_host *host = dev_get_drvdata(dev);
         struct pata_imx_priv *priv = host->private_data;
 
-        clk_prepare_enable(priv->clk);
+        int ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         __raw_writel(priv->ata_ctl, priv->host_regs + PATA_IMX_ATA_CONTROL);
 
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 20a7517bd339..05c8a44adf8e 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4104,7 +4104,6 @@ static int mv_platform_probe(struct platform_device *pdev)
         if (!hpriv->port_phys)
                 return -ENOMEM;
         host->private_data = hpriv;
-        hpriv->n_ports = n_ports;
         hpriv->board_idx = chip_soc;
 
         host->iomap = NULL;
@@ -4126,17 +4125,24 @@ static int mv_platform_probe(struct platform_device *pdev)
                         clk_prepare_enable(hpriv->port_clks[port]);
 
                 sprintf(port_number, "port%d", port);
-                hpriv->port_phys[port] = devm_phy_get(&pdev->dev, port_number);
+                hpriv->port_phys[port] = devm_phy_optional_get(&pdev->dev,
+                                                               port_number);
                 if (IS_ERR(hpriv->port_phys[port])) {
                         rc = PTR_ERR(hpriv->port_phys[port]);
                         hpriv->port_phys[port] = NULL;
-                        if ((rc != -EPROBE_DEFER) && (rc != -ENODEV))
-                                dev_warn(&pdev->dev, "error getting phy");
+                        if (rc != -EPROBE_DEFER)
+                                dev_warn(&pdev->dev, "error getting phy %d", rc);
+
+                        /* Cleanup only the initialized ports */
+                        hpriv->n_ports = port;
                         goto err;
                 } else
                         phy_power_on(hpriv->port_phys[port]);
         }
 
+        /* All the ports have been initialized */
+        hpriv->n_ports = n_ports;
+
         /*
          * (Re-)program MBUS remapping windows if we are asked to.
          */
@@ -4174,7 +4180,7 @@ err:
                 clk_disable_unprepare(hpriv->clk);
                 clk_put(hpriv->clk);
         }
-        for (port = 0; port < n_ports; port++) {
+        for (port = 0; port < hpriv->n_ports; port++) {
                 if (!IS_ERR(hpriv->port_clks[port])) {
                         clk_disable_unprepare(hpriv->port_clks[port]);
                         clk_put(hpriv->port_clks[port]);
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index d67fc351343c..b7695e804635 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -157,6 +157,7 @@ static const struct sil_drivelist {
         { "ST380011ASL",        SIL_QUIRK_MOD15WRITE },
         { "ST3120022ASL",       SIL_QUIRK_MOD15WRITE },
         { "ST3160021ASL",       SIL_QUIRK_MOD15WRITE },
+        { "TOSHIBA MK2561GSYN", SIL_QUIRK_MOD15WRITE },
         { "Maxtor 4D060H3",     SIL_QUIRK_UDMA5MAX },
         { }
 };
diff --git a/drivers/base/component.c b/drivers/base/component.c
index c53efe6c6d8e..c4778995cd72 100644
--- a/drivers/base/component.c
+++ b/drivers/base/component.c
@@ -133,9 +133,16 @@ static int try_to_bring_up_master(struct master *master,
                         goto out;
                 }
 
+                if (!devres_open_group(master->dev, NULL, GFP_KERNEL)) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+
                 /* Found all components */
                 ret = master->ops->bind(master->dev);
                 if (ret < 0) {
+                        devres_release_group(master->dev, NULL);
+                        dev_info(master->dev, "master bind failed: %d\n", ret);
                         master_remove_components(master);
                         goto out;
                 }
@@ -166,6 +173,7 @@ static void take_down_master(struct master *master)
 {
         if (master->bound) {
                 master->ops->unbind(master->dev);
+                devres_release_group(master->dev, NULL);
                 master->bound = false;
         }
 
diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c
index 1e16cbd61da2..61d6d62cc0d3 100644
--- a/drivers/base/dma-buf.c
+++ b/drivers/base/dma-buf.c
@@ -616,36 +616,35 @@ static int dma_buf_describe(struct seq_file *s)
         if (ret)
                 return ret;
 
-        seq_printf(s, "\nDma-buf Objects:\n");
-        seq_printf(s, "\texp_name\tsize\tflags\tmode\tcount\n");
+        seq_puts(s, "\nDma-buf Objects:\n");
+        seq_puts(s, "size\tflags\tmode\tcount\texp_name\n");
 
         list_for_each_entry(buf_obj, &db_list.head, list_node) {
                 ret = mutex_lock_interruptible(&buf_obj->lock);
 
                 if (ret) {
-                        seq_printf(s,
-                                  "\tERROR locking buffer object: skipping\n");
+                        seq_puts(s,
+                                 "\tERROR locking buffer object: skipping\n");
                         continue;
                 }
 
-                seq_printf(s, "\t");
-
-                seq_printf(s, "\t%s\t%08zu\t%08x\t%08x\t%08ld\n",
-                                buf_obj->exp_name, buf_obj->size,
+                seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\n",
+                                buf_obj->size,
                                 buf_obj->file->f_flags, buf_obj->file->f_mode,
-                                (long)(buf_obj->file->f_count.counter));
+                                (long)(buf_obj->file->f_count.counter),
+                                buf_obj->exp_name);
 
-                seq_printf(s, "\t\tAttached Devices:\n");
+                seq_puts(s, "\tAttached Devices:\n");
                 attach_count = 0;
 
                 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
-                        seq_printf(s, "\t\t");
+                        seq_puts(s, "\t");
 
-                        seq_printf(s, "%s\n", attach_obj->dev->init_name);
+                        seq_printf(s, "%s\n", dev_name(attach_obj->dev));
                         attach_count++;
                 }
 
-                seq_printf(s, "\n\t\tTotal %d devices attached\n",
+                seq_printf(s, "Total %d devices attached\n\n",
                                 attach_count);
 
                 count++;
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 3107282a9741..091b9ea14feb 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -60,7 +60,9 @@ enum {
         NULL_IRQ_NONE           = 0,
         NULL_IRQ_SOFTIRQ        = 1,
         NULL_IRQ_TIMER          = 2,
+};
 
+enum {
         NULL_Q_BIO              = 0,
         NULL_Q_RQ               = 1,
         NULL_Q_MQ               = 2,
@@ -172,18 +174,20 @@ static struct nullb_cmd *alloc_cmd(struct nullb_queue *nq, int can_wait)
 
 static void end_cmd(struct nullb_cmd *cmd)
 {
-        if (cmd->rq) {
-                if (queue_mode == NULL_Q_MQ)
-                        blk_mq_end_io(cmd->rq, 0);
-                else {
-                        INIT_LIST_HEAD(&cmd->rq->queuelist);
-                        blk_end_request_all(cmd->rq, 0);
-                }
-        } else if (cmd->bio)
+        switch (queue_mode)  {
+        case NULL_Q_MQ:
+                blk_mq_end_io(cmd->rq, 0);
+                return;
+        case NULL_Q_RQ:
+                INIT_LIST_HEAD(&cmd->rq->queuelist);
+                blk_end_request_all(cmd->rq, 0);
+                break;
+        case NULL_Q_BIO:
                 bio_endio(cmd->bio, 0);
+                break;
+        }
 
-        if (queue_mode != NULL_Q_MQ)
-                free_cmd(cmd);
+        free_cmd(cmd);
 }
 
 static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
@@ -195,6 +199,7 @@ static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
         cq = &per_cpu(completion_queues, smp_processor_id());
 
         while ((entry = llist_del_all(&cq->list)) != NULL) {
+                entry = llist_reverse_order(entry);
                 do {
                         cmd = container_of(entry, struct nullb_cmd, ll_list);
                         end_cmd(cmd);
@@ -221,61 +226,31 @@ static void null_cmd_end_timer(struct nullb_cmd *cmd)
 
 static void null_softirq_done_fn(struct request *rq)
 {
-        blk_end_request_all(rq, 0);
-}
-
-#ifdef CONFIG_SMP
-
-static void null_ipi_cmd_end_io(void *data)
-{
-        struct completion_queue *cq;
-        struct llist_node *entry, *next;
-        struct nullb_cmd *cmd;
-
-        cq = &per_cpu(completion_queues, smp_processor_id());
-
-        entry = llist_del_all(&cq->list);
-
-        while (entry) {
-                next = entry->next;
-                cmd = llist_entry(entry, struct nullb_cmd, ll_list);
-                end_cmd(cmd);
-                entry = next;
-        }
-}
-
-static void null_cmd_end_ipi(struct nullb_cmd *cmd)
-{
-        struct call_single_data *data = &cmd->csd;
-        int cpu = get_cpu();
-        struct completion_queue *cq = &per_cpu(completion_queues, cpu);
-
-        cmd->ll_list.next = NULL;
-
-        if (llist_add(&cmd->ll_list, &cq->list)) {
-                data->func = null_ipi_cmd_end_io;
-                data->flags = 0;
-                __smp_call_function_single(cpu, data, 0);
-        }
-
-        put_cpu();
+        end_cmd(rq->special);
 }
 
-#endif /* CONFIG_SMP */
-
 static inline void null_handle_cmd(struct nullb_cmd *cmd)
 {
         /* Complete IO by inline, softirq or timer */
         switch (irqmode) {
-        case NULL_IRQ_NONE:
-                end_cmd(cmd);
-                break;
         case NULL_IRQ_SOFTIRQ:
-#ifdef CONFIG_SMP
-                null_cmd_end_ipi(cmd);
-#else
+                switch (queue_mode)  {
+                case NULL_Q_MQ:
+                        blk_mq_complete_request(cmd->rq);
+                        break;
+                case NULL_Q_RQ:
+                        blk_complete_request(cmd->rq);
+                        break;
+                case NULL_Q_BIO:
+                        /*
+                         * XXX: no proper submitting cpu information available.
+                         */
+                        end_cmd(cmd);
+                        break;
+                }
+                break;
+        case NULL_IRQ_NONE:
                 end_cmd(cmd);
-#endif
                 break;
         case NULL_IRQ_TIMER:
                 null_cmd_end_timer(cmd);
@@ -411,6 +386,7 @@ static struct blk_mq_ops null_mq_ops = {
         .queue_rq       = null_queue_rq,
         .map_queue      = blk_mq_map_queue,
         .init_hctx      = null_init_hctx,
+        .complete       = null_softirq_done_fn,
 };
 
 static struct blk_mq_reg null_mq_reg = {
@@ -609,13 +585,6 @@ static int __init null_init(void)
 {
         unsigned int i;
 
-#if !defined(CONFIG_SMP)
-        if (irqmode == NULL_IRQ_SOFTIRQ) {
-                pr_warn("null_blk: softirq completions not available.\n");
-                pr_warn("null_blk: using direct completions.\n");
-                irqmode = NULL_IRQ_NONE;
-        }
-#endif
         if (bs > PAGE_SIZE) {
                 pr_warn("null_blk: invalid block size\n");
                 pr_warn("null_blk: defaults block size to %lu\n", PAGE_SIZE);
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 6a680d4de7f1..b1cb3f4c4db4 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -110,9 +110,9 @@ static int __virtblk_add_req(struct virtqueue *vq,
         return virtqueue_add_sgs(vq, sgs, num_out, num_in, vbr, GFP_ATOMIC);
 }
 
-static inline void virtblk_request_done(struct virtblk_req *vbr)
+static inline void virtblk_request_done(struct request *req)
 {
-        struct request *req = vbr->req;
+        struct virtblk_req *vbr = req->special;
         int error = virtblk_result(vbr);
 
         if (req->cmd_type == REQ_TYPE_BLOCK_PC) {
@@ -138,7 +138,7 @@ static void virtblk_done(struct virtqueue *vq)
         do {
                 virtqueue_disable_cb(vq);
                 while ((vbr = virtqueue_get_buf(vblk->vq, &len)) != NULL) {
-                        virtblk_request_done(vbr);
+                        blk_mq_complete_request(vbr->req);
                         req_done = true;
                 }
                 if (unlikely(virtqueue_is_broken(vq)))
@@ -479,6 +479,7 @@ static struct blk_mq_ops virtio_mq_ops = {
         .map_queue      = blk_mq_map_queue,
         .alloc_hctx     = blk_mq_alloc_single_hw_queue,
         .free_hctx      = blk_mq_free_single_hw_queue,
+        .complete       = virtblk_request_done,
 };
 
 static struct blk_mq_reg virtio_mq_reg = {
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 4b97b86da926..64c60edcdfbc 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -299,7 +299,7 @@ static void free_persistent_gnts(struct xen_blkif *blkif, struct rb_root *root,
         BUG_ON(num != 0);
 }
 
-static void unmap_purged_grants(struct work_struct *work)
+void xen_blkbk_unmap_purged_grants(struct work_struct *work)
 {
         struct gnttab_unmap_grant_ref unmap[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         struct page *pages[BLKIF_MAX_SEGMENTS_PER_REQUEST];
@@ -375,7 +375,7 @@ static void purge_persistent_gnt(struct xen_blkif *blkif)
 
         pr_debug(DRV_PFX "Going to purge %u persistent grants\n", num_clean);
 
-        INIT_LIST_HEAD(&blkif->persistent_purge_list);
+        BUG_ON(!list_empty(&blkif->persistent_purge_list));
         root = &blkif->persistent_gnts;
 purge_list:
         foreach_grant_safe(persistent_gnt, n, root, node) {
@@ -420,7 +420,6 @@ finished:
         blkif->vbd.overflow_max_grants = 0;
 
         /* We can defer this work */
-        INIT_WORK(&blkif->persistent_purge_work, unmap_purged_grants);
         schedule_work(&blkif->persistent_purge_work);
         pr_debug(DRV_PFX "Purged %u/%u\n", (total - num_clean), total);
         return;
@@ -625,9 +624,23 @@ purge_gnt_list:
                         print_stats(blkif);
         }
 
-        /* Since we are shutting down remove all pages from the buffer */
-        shrink_free_pagepool(blkif, 0 /* All */);
+        /* Drain pending purge work */
+        flush_work(&blkif->persistent_purge_work);
 
+        if (log_stats)
+                print_stats(blkif);
+
+        blkif->xenblkd = NULL;
+        xen_blkif_put(blkif);
+
+        return 0;
+}
+
+/*
+ * Remove persistent grants and empty the pool of free pages
+ */
+void xen_blkbk_free_caches(struct xen_blkif *blkif)
+{
         /* Free all persistent grant pages */
         if (!RB_EMPTY_ROOT(&blkif->persistent_gnts))
                 free_persistent_gnts(blkif, &blkif->persistent_gnts,
@@ -636,13 +649,8 @@ purge_gnt_list:
         BUG_ON(!RB_EMPTY_ROOT(&blkif->persistent_gnts));
         blkif->persistent_gnt_c = 0;
 
-        if (log_stats)
-                print_stats(blkif);
-
-        blkif->xenblkd = NULL;
-        xen_blkif_put(blkif);
-
-        return 0;
+        /* Since we are shutting down remove all pages from the buffer */
+        shrink_free_pagepool(blkif, 0 /* All */);
 }
 
 /*
@@ -838,7 +846,7 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
         struct grant_page **pages = pending_req->indirect_pages;
         struct xen_blkif *blkif = pending_req->blkif;
         int indirect_grefs, rc, n, nseg, i;
-        struct blkif_request_segment_aligned *segments = NULL;
+        struct blkif_request_segment *segments = NULL;
 
         nseg = pending_req->nr_pages;
         indirect_grefs = INDIRECT_PAGES(nseg);
@@ -934,9 +942,7 @@ static void xen_blk_drain_io(struct xen_blkif *blkif)
 {
         atomic_set(&blkif->drain, 1);
         do {
-                /* The initial value is one, and one refcnt taken at the
-                 * start of the xen_blkif_schedule thread. */
-                if (atomic_read(&blkif->refcnt) <= 2)
+                if (atomic_read(&blkif->inflight) == 0)
                         break;
                 wait_for_completion_interruptible_timeout(
                                 &blkif->drain_complete, HZ);
@@ -976,17 +982,30 @@ static void __end_block_io_op(struct pending_req *pending_req, int error)
          * the proper response on the ring.
          */
         if (atomic_dec_and_test(&pending_req->pendcnt)) {
-                xen_blkbk_unmap(pending_req->blkif,
+                struct xen_blkif *blkif = pending_req->blkif;
+
+                xen_blkbk_unmap(blkif,
                                 pending_req->segments,
                                 pending_req->nr_pages);
-                make_response(pending_req->blkif, pending_req->id,
+                make_response(blkif, pending_req->id,
                               pending_req->operation, pending_req->status);
-                xen_blkif_put(pending_req->blkif);
-                if (atomic_read(&pending_req->blkif->refcnt) <= 2) {
-                        if (atomic_read(&pending_req->blkif->drain))
-                                complete(&pending_req->blkif->drain_complete);
+                free_req(blkif, pending_req);
+                /*
+                 * Make sure the request is freed before releasing blkif,
+                 * or there could be a race between free_req and the
+                 * cleanup done in xen_blkif_free during shutdown.
+                 *
+                 * NB: The fact that we might try to wake up pending_free_wq
+                 * before drain_complete (in case there's a drain going on)
+                 * it's not a problem with our current implementation
+                 * because we can assure there's no thread waiting on
+                 * pending_free_wq if there's a drain going on, but it has
+                 * to be taken into account if the current model is changed.
+                 */
+                if (atomic_dec_and_test(&blkif->inflight) && atomic_read(&blkif->drain)) {
+                        complete(&blkif->drain_complete);
                 }
-                free_req(pending_req->blkif, pending_req);
+                xen_blkif_put(blkif);
         }
 }
 
@@ -1240,6 +1259,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
          * below (in "!bio") if we are handling a BLKIF_OP_DISCARD.
          */
         xen_blkif_get(blkif);
+        atomic_inc(&blkif->inflight);
 
         for (i = 0; i < nseg; i++) {
                 while ((bio == NULL) ||
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 8d8807563d99..be052773ad03 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -57,7 +57,7 @@
 #define MAX_INDIRECT_SEGMENTS 256
 
 #define SEGS_PER_INDIRECT_FRAME \
-        (PAGE_SIZE/sizeof(struct blkif_request_segment_aligned))
+        (PAGE_SIZE/sizeof(struct blkif_request_segment))
 #define MAX_INDIRECT_PAGES \
         ((MAX_INDIRECT_SEGMENTS + SEGS_PER_INDIRECT_FRAME - 1)/SEGS_PER_INDIRECT_FRAME)
 #define INDIRECT_PAGES(_segs) \
@@ -278,6 +278,7 @@ struct xen_blkif {
         /* for barrier (drain) requests */
         struct completion       drain_complete;
         atomic_t                drain;
+        atomic_t                inflight;
         /* One thread per one blkif. */
         struct task_struct      *xenblkd;
         unsigned int            waiting_reqs;
@@ -376,6 +377,7 @@ int xen_blkif_xenbus_init(void);
 irqreturn_t xen_blkif_be_int(int irq, void *dev_id);
 int xen_blkif_schedule(void *arg);
 int xen_blkif_purge_persistent(void *arg);
+void xen_blkbk_free_caches(struct xen_blkif *blkif);
 
 int xen_blkbk_flush_diskcache(struct xenbus_transaction xbt,
                               struct backend_info *be, int state);
@@ -383,6 +385,7 @@ int xen_blkbk_flush_diskcache(struct xenbus_transaction xbt,
 int xen_blkbk_barrier(struct xenbus_transaction xbt,
                       struct backend_info *be, int state);
 struct xenbus_device *xen_blkbk_xenbus(struct backend_info *be);
+void xen_blkbk_unmap_purged_grants(struct work_struct *work);
 
 static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                                         struct blkif_x86_32_request *src)
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index c2014a0aa206..9a547e6b6ebf 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -125,8 +125,11 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid)
         blkif->persistent_gnts.rb_node = NULL;
         spin_lock_init(&blkif->free_pages_lock);
         INIT_LIST_HEAD(&blkif->free_pages);
+        INIT_LIST_HEAD(&blkif->persistent_purge_list);
         blkif->free_pages_num = 0;
         atomic_set(&blkif->persistent_gnt_in_use, 0);
+        atomic_set(&blkif->inflight, 0);
+        INIT_WORK(&blkif->persistent_purge_work, xen_blkbk_unmap_purged_grants);
 
         INIT_LIST_HEAD(&blkif->pending_free);
 
@@ -259,6 +262,17 @@ static void xen_blkif_free(struct xen_blkif *blkif)
         if (!atomic_dec_and_test(&blkif->refcnt))
                 BUG();
 
+        /* Remove all persistent grants and the cache of ballooned pages. */
+        xen_blkbk_free_caches(blkif);
+
+        /* Make sure everything is drained before shutting down */
+        BUG_ON(blkif->persistent_gnt_c != 0);
+        BUG_ON(atomic_read(&blkif->persistent_gnt_in_use) != 0);
+        BUG_ON(blkif->free_pages_num != 0);
+        BUG_ON(!list_empty(&blkif->persistent_purge_list));
+        BUG_ON(!list_empty(&blkif->free_pages));
+        BUG_ON(!RB_EMPTY_ROOT(&blkif->persistent_gnts));
+
         /* Check that there is no request in use */
         list_for_each_entry_safe(req, n, &blkif->pending_free, free_list) {
                 list_del(&req->free_list);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 8dcfb54f1603..efe1b4761735 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -162,7 +162,7 @@ static DEFINE_SPINLOCK(minor_lock);
 #define DEV_NAME        "xvd"   /* name in /dev */
 
 #define SEGS_PER_INDIRECT_FRAME \
-        (PAGE_SIZE/sizeof(struct blkif_request_segment_aligned))
+        (PAGE_SIZE/sizeof(struct blkif_request_segment))
 #define INDIRECT_GREFS(_segs) \
         ((_segs + SEGS_PER_INDIRECT_FRAME - 1)/SEGS_PER_INDIRECT_FRAME)
 
@@ -393,7 +393,7 @@ static int blkif_queue_request(struct request *req)
         unsigned long id;
         unsigned int fsect, lsect;
         int i, ref, n;
-        struct blkif_request_segment_aligned *segments = NULL;
+        struct blkif_request_segment *segments = NULL;
 
         /*
          * Used to store if we are able to queue the request by just using
@@ -550,7 +550,7 @@ static int blkif_queue_request(struct request *req)
                         } else {
                                 n = i % SEGS_PER_INDIRECT_FRAME;
                                 segments[n] =
-                                        (struct blkif_request_segment_aligned) {
+                                        (struct blkif_request_segment) {
                                                         .gref       = ref,
                                                         .first_sect = fsect,
                                                         .last_sect  = lsect };
@@ -1904,13 +1904,16 @@ static void blkback_changed(struct xenbus_device *dev,
         case XenbusStateReconfiguring:
         case XenbusStateReconfigured:
         case XenbusStateUnknown:
-        case XenbusStateClosed:
                 break;
 
         case XenbusStateConnected:
                 blkfront_connect(info);
                 break;
 
+        case XenbusStateClosed:
+                if (dev->state == XenbusStateClosed)
+                        break;
+                /* Missed the backend's Closing state -- fallthrough */
         case XenbusStateClosing:
                 blkfront_closing(info);
                 break;
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index fa3243d71c76..1386749b48ff 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -499,6 +499,7 @@ config RAW_DRIVER
 config MAX_RAW_DEVS
         int "Maximum number of RAW devices to support (1-65536)"
         depends on RAW_DRIVER
+        range 1 65536
         default "256"
         help
           The maximum number of RAW devices that are supported.
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index f3223aac4df1..6e8d65e9b1d3 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev)
         struct raw_device_data *rawdev;
         struct block_device *bdev;
 
-        if (number <= 0 || number >= MAX_RAW_MINORS)
+        if (number <= 0 || number >= max_raw_minors)
                 return -EINVAL;
 
         rawdev = &raw_devices[number];
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index feea87cc6b8f..6928d094451d 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -890,12 +890,10 @@ static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
         } else {
                 /* Failback to copying a page */
                 struct page *page = alloc_page(GFP_KERNEL);
-                char *src = buf->ops->map(pipe, buf, 1);
-                char *dst;
+                char *src;
 
                 if (!page)
                         return -ENOMEM;
-                dst = kmap(page);
 
                 offset = sd->pos & ~PAGE_MASK;
 
@@ -903,9 +901,8 @@ static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
                 if (len + offset > PAGE_SIZE)
                         len = PAGE_SIZE - offset;
 
-                memcpy(dst + offset, src + buf->offset, len);
-
-                kunmap(page);
+                src = buf->ops->map(pipe, buf, 1);
+                memcpy(page_address(page) + offset, src + buf->offset, len);
                 buf->ops->unmap(pipe, buf, src);
 
                 sg_set_page(&(sgl->sg[sgl->n]), page, len, offset);
diff --git a/drivers/clocksource/bcm_kona_timer.c b/drivers/clocksource/bcm_kona_timer.c
index 974b2db2fe10..0595dc6c453e 100644
--- a/drivers/clocksource/bcm_kona_timer.c
+++ b/drivers/clocksource/bcm_kona_timer.c
@@ -99,31 +99,6 @@ kona_timer_get_counter(void *timer_base, uint32_t *msw, uint32_t *lsw)
         return;
 }
 
-static void __init kona_timers_init(struct device_node *node)
-{
-        u32 freq;
-        struct clk *external_clk;
-
-        external_clk = of_clk_get_by_name(node, NULL);
-
-        if (!IS_ERR(external_clk)) {
-                arch_timer_rate = clk_get_rate(external_clk);
-                clk_prepare_enable(external_clk);
-        } else if (!of_property_read_u32(node, "clock-frequency", &freq)) {
-                arch_timer_rate = freq;
-        } else {
-                panic("unable to determine clock-frequency");
-        }
-
-        /* Setup IRQ numbers */
-        timers.tmr_irq = irq_of_parse_and_map(node, 0);
-
-        /* Setup IO addresses */
-        timers.tmr_regs = of_iomap(node, 0);
-
-        kona_timer_disable_and_clear(timers.tmr_regs);
-}
-
 static int kona_timer_set_next_event(unsigned long clc,
                                   struct clock_event_device *unused)
 {
@@ -198,7 +173,34 @@ static struct irqaction kona_timer_irq = {
 
 static void __init kona_timer_init(struct device_node *node)
 {
-        kona_timers_init(node);
+        u32 freq;
+        struct clk *external_clk;
+
+        if (!of_device_is_available(node)) {
+                pr_info("Kona Timer v1 marked as disabled in device tree\n");
+                return;
+        }
+
+        external_clk = of_clk_get_by_name(node, NULL);
+
+        if (!IS_ERR(external_clk)) {
+                arch_timer_rate = clk_get_rate(external_clk);
+                clk_prepare_enable(external_clk);
+        } else if (!of_property_read_u32(node, "clock-frequency", &freq)) {
+                arch_timer_rate = freq;
+        } else {
+                pr_err("Kona Timer v1 unable to determine clock-frequency");
+                return;
+        }
+
+        /* Setup IRQ numbers */
+        timers.tmr_irq = irq_of_parse_and_map(node, 0);
+
+        /* Setup IO addresses */
+        timers.tmr_regs = of_iomap(node, 0);
+
+        kona_timer_disable_and_clear(timers.tmr_regs);
+
         kona_timer_clockevents_init();
         setup_irq(timers.tmr_irq, &kona_timer_irq);
         kona_timer_set_next_event((arch_timer_rate / HZ), NULL);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 08ca8c9f41cd..cb003a6b72c8 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1323,8 +1323,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
         up_read(&policy->rwsem);
 
         if (cpu != policy->cpu) {
-                if (!frozen)
-                        sysfs_remove_link(&dev->kobj, "cpufreq");
+                sysfs_remove_link(&dev->kobj, "cpufreq");
         } else if (cpus > 1) {
                 new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu);
                 if (new_cpu >= 0) {
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 79606f473f48..e90816105921 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -34,8 +34,10 @@
 
 #define SAMPLE_COUNT            3
 
-#define BYT_RATIOS      0x66a
-#define BYT_VIDS        0x66b
+#define BYT_RATIOS              0x66a
+#define BYT_VIDS                0x66b
+#define BYT_TURBO_RATIOS        0x66c
+
 
 #define FRAC_BITS 8
 #define int_tofp(X) ((int64_t)(X) << FRAC_BITS)
@@ -51,8 +53,6 @@ static inline int32_t div_fp(int32_t x, int32_t y)
         return div_s64((int64_t)x << FRAC_BITS, (int64_t)y);
 }
 
-static u64 energy_divisor;
-
 struct sample {
         int32_t core_pct_busy;
         u64 aperf;
@@ -359,7 +359,7 @@ static int byt_get_min_pstate(void)
 {
         u64 value;
         rdmsrl(BYT_RATIOS, value);
-        return value & 0xFF;
+        return (value >> 8) & 0xFF;
 }
 
 static int byt_get_max_pstate(void)
@@ -369,6 +369,13 @@ static int byt_get_max_pstate(void)
         return (value >> 16) & 0xFF;
 }
 
+static int byt_get_turbo_pstate(void)
+{
+        u64 value;
+        rdmsrl(BYT_TURBO_RATIOS, value);
+        return value & 0x3F;
+}
+
 static void byt_set_pstate(struct cpudata *cpudata, int pstate)
 {
         u64 val;
@@ -471,7 +478,7 @@ static struct cpu_defaults byt_params = {
         .funcs = {
                 .get_max = byt_get_max_pstate,
                 .get_min = byt_get_min_pstate,
-                .get_turbo = byt_get_max_pstate,
+                .get_turbo = byt_get_turbo_pstate,
                 .set = byt_set_pstate,
                 .get_vid = byt_get_vid,
         },
@@ -630,12 +637,10 @@ static void intel_pstate_timer_func(unsigned long __data)
 {
         struct cpudata *cpu = (struct cpudata *) __data;
         struct sample *sample;
-        u64 energy;
 
         intel_pstate_sample(cpu);
 
         sample = &cpu->samples[cpu->sample_ptr];
-        rdmsrl(MSR_PKG_ENERGY_STATUS, energy);
 
         intel_pstate_adjust_busy_pstate(cpu);
 
@@ -644,7 +649,6 @@ static void intel_pstate_timer_func(unsigned long __data)
                         cpu->pstate.current_pstate,
                         sample->mperf,
                         sample->aperf,
-                        div64_u64(energy, energy_divisor),
                         sample->freq);
 
         intel_pstate_set_sample_time(cpu);
@@ -926,7 +930,6 @@ static int __init intel_pstate_init(void)
         int cpu, rc = 0;
         const struct x86_cpu_id *id;
         struct cpu_defaults *cpu_info;
-        u64 units;
 
         if (no_load)
                 return -ENODEV;
@@ -960,9 +963,6 @@ static int __init intel_pstate_init(void)
         if (rc)
                 goto out;
 
-        rdmsrl(MSR_RAPL_POWER_UNIT, units);
-        energy_divisor = 1 << ((units >> 8) & 0x1f); /* bits{12:8} */
-
         intel_pstate_debug_expose_params();
         intel_pstate_sysfs_expose_params();
 
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index e10b646634d7..6684e0342792 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -1076,7 +1076,7 @@ static int powernowk8_cpu_init(struct cpufreq_policy *pol)
 {
         struct powernow_k8_data *data;
         struct init_on_cpu init_on_cpu;
-        int rc;
+        int rc, cpu;
 
         smp_call_function_single(pol->cpu, check_supported_cpu, &rc, 1);
         if (rc)
@@ -1140,7 +1140,9 @@ static int powernowk8_cpu_init(struct cpufreq_policy *pol)
         pr_debug("cpu_init done, current fid 0x%x, vid 0x%x\n",
                  data->currfid, data->currvid);
 
-        per_cpu(powernow_data, pol->cpu) = data;
+        /* Point all the CPUs in this policy to the same data */
+        for_each_cpu(cpu, pol->cpus)
+                per_cpu(powernow_data, cpu) = data;
 
         return 0;
 
@@ -1155,6 +1157,7 @@ err_out:
 static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
 {
         struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
+        int cpu;
 
         if (!data)
                 return -EINVAL;
@@ -1165,7 +1168,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
 
         kfree(data->powernow_table);
         kfree(data);
-        per_cpu(powernow_data, pol->cpu) = NULL;
+        for_each_cpu(cpu, pol->cpus)
+                per_cpu(powernow_data, cpu) = NULL;
 
         return 0;
 }
diff --git a/drivers/crypto/nx/nx-842.c b/drivers/crypto/nx/nx-842.c
index 6c4c000671c5..1e5481d88a26 100644
--- a/drivers/crypto/nx/nx-842.c
+++ b/drivers/crypto/nx/nx-842.c
@@ -158,6 +158,15 @@ static inline unsigned long nx842_get_scatterlist_size(
         return sl->entry_nr * sizeof(struct nx842_slentry);
 }
 
+static inline unsigned long nx842_get_pa(void *addr)
+{
+        if (is_vmalloc_addr(addr))
+                return page_to_phys(vmalloc_to_page(addr))
+                       + offset_in_page(addr);
+        else
+                return __pa(addr);
+}
+
 static int nx842_build_scatterlist(unsigned long buf, int len,
                         struct nx842_scatterlist *sl)
 {
@@ -168,7 +177,7 @@ static int nx842_build_scatterlist(unsigned long buf, int len,
 
         entry = sl->entries;
         while (len) {
-                entry->ptr = __pa(buf);
+                entry->ptr = nx842_get_pa((void *)buf);
                 nextpage = ALIGN(buf + 1, NX842_HW_PAGE_SIZE);
                 if (nextpage < buf + len) {
                         /* we aren't at the end yet */
@@ -370,8 +379,8 @@ int nx842_compress(const unsigned char *in, unsigned int inlen,
         op.flags = NX842_OP_COMPRESS;
         csbcpb = &workmem->csbcpb;
         memset(csbcpb, 0, sizeof(*csbcpb));
-        op.csbcpb = __pa(csbcpb);
-        op.out = __pa(slout.entries);
+        op.csbcpb = nx842_get_pa(csbcpb);
+        op.out = nx842_get_pa(slout.entries);
 
         for (i = 0; i < hdr->blocks_nr; i++) {
                 /*
@@ -401,13 +410,13 @@ int nx842_compress(const unsigned char *in, unsigned int inlen,
                  */
                 if (likely(max_sync_size == NX842_HW_PAGE_SIZE)) {
                         /* Create direct DDE */
-                        op.in = __pa(inbuf);
+                        op.in = nx842_get_pa((void *)inbuf);
                         op.inlen = max_sync_size;
 
                 } else {
                         /* Create indirect DDE (scatterlist) */
                         nx842_build_scatterlist(inbuf, max_sync_size, &slin);
-                        op.in = __pa(slin.entries);
+                        op.in = nx842_get_pa(slin.entries);
                         op.inlen = -nx842_get_scatterlist_size(&slin);
                 }
 
@@ -565,7 +574,7 @@ int nx842_decompress(const unsigned char *in, unsigned int inlen,
         op.flags = NX842_OP_DECOMPRESS;
         csbcpb = &workmem->csbcpb;
         memset(csbcpb, 0, sizeof(*csbcpb));
-        op.csbcpb = __pa(csbcpb);
+        op.csbcpb = nx842_get_pa(csbcpb);
 
         /*
          * max_sync_size may have changed since compression,
@@ -597,12 +606,12 @@ int nx842_decompress(const unsigned char *in, unsigned int inlen,
                 if (likely((inbuf & NX842_HW_PAGE_MASK) ==
                         ((inbuf + hdr->sizes[i] - 1) & NX842_HW_PAGE_MASK))) {
                         /* Create direct DDE */
-                        op.in = __pa(inbuf);
+                        op.in = nx842_get_pa((void *)inbuf);
                         op.inlen = hdr->sizes[i];
                 } else {
                         /* Create indirect DDE (scatterlist) */
                         nx842_build_scatterlist(inbuf, hdr->sizes[i] , &slin);
-                        op.in = __pa(slin.entries);
+                        op.in = nx842_get_pa(slin.entries);
                         op.inlen = -nx842_get_scatterlist_size(&slin);
                 }
 
@@ -613,12 +622,12 @@ int nx842_decompress(const unsigned char *in, unsigned int inlen,
                  */
                 if (likely(max_sync_size == NX842_HW_PAGE_SIZE)) {
                         /* Create direct DDE */
-                        op.out = __pa(outbuf);
+                        op.out = nx842_get_pa((void *)outbuf);
                         op.outlen = max_sync_size;
                 } else {
                         /* Create indirect DDE (scatterlist) */
                         nx842_build_scatterlist(outbuf, max_sync_size, &slout);
-                        op.out = __pa(slout.entries);
+                        op.out = nx842_get_pa(slout.entries);
                         op.outlen = -nx842_get_scatterlist_size(&slout);
                 }
 
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 9bed1a2a67a1..605b016bcea4 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -346,6 +346,7 @@ config MOXART_DMA
         tristate "MOXART DMA support"
         depends on ARCH_MOXART
         select DMA_ENGINE
+        select DMA_OF
         select DMA_VIRTUAL_CHANNELS
         help
           Enable support for the MOXA ART SoC DMA controller.
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 87529181efcc..4e3549a16132 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -77,7 +77,8 @@ static irqreturn_t ioat_dma_do_interrupt(int irq, void *data)
         attnstatus = readl(instance->reg_base + IOAT_ATTNSTATUS_OFFSET);
         for_each_set_bit(bit, &attnstatus, BITS_PER_LONG) {
                 chan = ioat_chan_by_index(instance, bit);
-                tasklet_schedule(&chan->cleanup_task);
+                if (test_bit(IOAT_RUN, &chan->state))
+                        tasklet_schedule(&chan->cleanup_task);
         }
 
         writeb(intrctrl, instance->reg_base + IOAT_INTRCTRL_OFFSET);
@@ -93,7 +94,8 @@ static irqreturn_t ioat_dma_do_interrupt_msix(int irq, void *data)
 {
         struct ioat_chan_common *chan = data;
 
-        tasklet_schedule(&chan->cleanup_task);
+        if (test_bit(IOAT_RUN, &chan->state))
+                tasklet_schedule(&chan->cleanup_task);
 
         return IRQ_HANDLED;
 }
@@ -116,7 +118,6 @@ void ioat_init_channel(struct ioatdma_device *device, struct ioat_chan_common *c
         chan->timer.function = device->timer_fn;
         chan->timer.data = data;
         tasklet_init(&chan->cleanup_task, device->cleanup_fn, data);
-        tasklet_disable(&chan->cleanup_task);
 }
 
 /**
@@ -354,13 +355,49 @@ static int ioat1_dma_alloc_chan_resources(struct dma_chan *c)
         writel(((u64) chan->completion_dma) >> 32,
                chan->reg_base + IOAT_CHANCMP_OFFSET_HIGH);
 
-        tasklet_enable(&chan->cleanup_task);
+        set_bit(IOAT_RUN, &chan->state);
         ioat1_dma_start_null_desc(ioat);  /* give chain to dma device */
         dev_dbg(to_dev(chan), "%s: allocated %d descriptors\n",
                 __func__, ioat->desccount);
         return ioat->desccount;
 }
 
+void ioat_stop(struct ioat_chan_common *chan)
+{
+        struct ioatdma_device *device = chan->device;
+        struct pci_dev *pdev = device->pdev;
+        int chan_id = chan_num(chan);
+        struct msix_entry *msix;
+
+        /* 1/ stop irq from firing tasklets
+         * 2/ stop the tasklet from re-arming irqs
+         */
+        clear_bit(IOAT_RUN, &chan->state);
+
+        /* flush inflight interrupts */
+        switch (device->irq_mode) {
+        case IOAT_MSIX:
+                msix = &device->msix_entries[chan_id];
+                synchronize_irq(msix->vector);
+                break;
+        case IOAT_MSI:
+        case IOAT_INTX:
+                synchronize_irq(pdev->irq);
+                break;
+        default:
+                break;
+        }
+
+        /* flush inflight timers */
+        del_timer_sync(&chan->timer);
+
+        /* flush inflight tasklet runs */
+        tasklet_kill(&chan->cleanup_task);
+
+        /* final cleanup now that everything is quiesced and can't re-arm */
+        device->cleanup_fn((unsigned long) &chan->common);
+}
+
 /**
  * ioat1_dma_free_chan_resources - release all the descriptors
  * @chan: the channel to be cleaned
@@ -379,9 +416,7 @@ static void ioat1_dma_free_chan_resources(struct dma_chan *c)
         if (ioat->desccount == 0)
                 return;
 
-        tasklet_disable(&chan->cleanup_task);
-        del_timer_sync(&chan->timer);
-        ioat1_cleanup(ioat);
+        ioat_stop(chan);
 
         /* Delay 100ms after reset to allow internal DMA logic to quiesce
          * before removing DMA descriptor resources.
@@ -526,8 +561,11 @@ ioat1_dma_prep_memcpy(struct dma_chan *c, dma_addr_t dma_dest,
 static void ioat1_cleanup_event(unsigned long data)
 {
         struct ioat_dma_chan *ioat = to_ioat_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat1_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index 11fb877ddca9..e982f00a9843 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -356,6 +356,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
 void ioat_kobject_del(struct ioatdma_device *device);
 int ioat_dma_setup_interrupts(struct ioatdma_device *device);
+void ioat_stop(struct ioat_chan_common *chan);
 extern const struct sysfs_ops ioat_sysfs_ops;
 extern struct ioat_sysfs_entry ioat_version_attr;
 extern struct ioat_sysfs_entry ioat_cap_attr;
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 5d3affe7e976..8d1058085eeb 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -190,8 +190,11 @@ static void ioat2_cleanup(struct ioat2_dma_chan *ioat)
 void ioat2_cleanup_event(unsigned long data)
 {
         struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat2_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
@@ -553,10 +556,10 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         ioat->issued = 0;
         ioat->tail = 0;
         ioat->alloc_order = order;
+        set_bit(IOAT_RUN, &chan->state);
         spin_unlock_bh(&ioat->prep_lock);
         spin_unlock_bh(&chan->cleanup_lock);
 
-        tasklet_enable(&chan->cleanup_task);
         ioat2_start_null_desc(ioat);
 
         /* check that we got off the ground */
@@ -566,7 +569,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         } while (i++ < 20 && !is_ioat_active(status) && !is_ioat_idle(status));
 
         if (is_ioat_active(status) || is_ioat_idle(status)) {
-                set_bit(IOAT_RUN, &chan->state);
                 return 1 << ioat->alloc_order;
         } else {
                 u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
@@ -809,11 +811,8 @@ void ioat2_free_chan_resources(struct dma_chan *c)
         if (!ioat->ring)
                 return;
 
-        tasklet_disable(&chan->cleanup_task);
-        del_timer_sync(&chan->timer);
-        device->cleanup_fn((unsigned long) c);
+        ioat_stop(chan);
         device->reset_hw(chan);
-        clear_bit(IOAT_RUN, &chan->state);
 
         spin_lock_bh(&chan->cleanup_lock);
         spin_lock_bh(&ioat->prep_lock);
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 820817e97e62..b9b38a1cf92f 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -464,8 +464,11 @@ static void ioat3_cleanup(struct ioat2_dma_chan *ioat)
 static void ioat3_cleanup_event(unsigned long data)
 {
         struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat3_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 53fb0c8365b0..766b68ed505c 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -497,8 +497,8 @@ mv_xor_tx_submit(struct dma_async_tx_descriptor *tx)
                 if (!mv_can_chain(grp_start))
                         goto submit_done;
 
-                dev_dbg(mv_chan_to_devp(mv_chan), "Append to last desc %x\n",
-                        old_chain_tail->async_tx.phys);
+                dev_dbg(mv_chan_to_devp(mv_chan), "Append to last desc %pa\n",
+                        &old_chain_tail->async_tx.phys);
 
                 /* fix up the hardware chain */
                 mv_desc_set_next_desc(old_chain_tail, grp_start->async_tx.phys);
@@ -527,7 +527,8 @@ submit_done:
 /* returns the number of allocated descriptors */
 static int mv_xor_alloc_chan_resources(struct dma_chan *chan)
 {
-        char *hw_desc;
+        void *virt_desc;
+        dma_addr_t dma_desc;
         int idx;
         struct mv_xor_chan *mv_chan = to_mv_xor_chan(chan);
         struct mv_xor_desc_slot *slot = NULL;
@@ -542,17 +543,16 @@ static int mv_xor_alloc_chan_resources(struct dma_chan *chan)
                                 " %d descriptor slots", idx);
                         break;
                 }
-                hw_desc = (char *) mv_chan->dma_desc_pool_virt;
-                slot->hw_desc = (void *) &hw_desc[idx * MV_XOR_SLOT_SIZE];
+                virt_desc = mv_chan->dma_desc_pool_virt;
+                slot->hw_desc = virt_desc + idx * MV_XOR_SLOT_SIZE;
 
                 dma_async_tx_descriptor_init(&slot->async_tx, chan);
                 slot->async_tx.tx_submit = mv_xor_tx_submit;
                 INIT_LIST_HEAD(&slot->chain_node);
                 INIT_LIST_HEAD(&slot->slot_node);
                 INIT_LIST_HEAD(&slot->tx_list);
-                hw_desc = (char *) mv_chan->dma_desc_pool;
-                slot->async_tx.phys =
-                        (dma_addr_t) &hw_desc[idx * MV_XOR_SLOT_SIZE];
+                dma_desc = mv_chan->dma_desc_pool;
+                slot->async_tx.phys = dma_desc + idx * MV_XOR_SLOT_SIZE;
                 slot->idx = idx++;
 
                 spin_lock_bh(&mv_chan->lock);
@@ -582,8 +582,8 @@ mv_xor_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
         int slot_cnt;
 
         dev_dbg(mv_chan_to_devp(mv_chan),
-                "%s dest: %x src %x len: %u flags: %ld\n",
-                __func__, dest, src, len, flags);
+                "%s dest: %pad src %pad len: %u flags: %ld\n",
+                __func__, &dest, &src, len, flags);
         if (unlikely(len < MV_XOR_MIN_BYTE_COUNT))
                 return NULL;
 
@@ -626,8 +626,8 @@ mv_xor_prep_dma_xor(struct dma_chan *chan, dma_addr_t dest, dma_addr_t *src,
         BUG_ON(len > MV_XOR_MAX_BYTE_COUNT);
 
         dev_dbg(mv_chan_to_devp(mv_chan),
-                "%s src_cnt: %d len: dest %x %u flags: %ld\n",
-                __func__, src_cnt, len, dest, flags);
+                "%s src_cnt: %d len: %u dest %pad flags: %ld\n",
+                __func__, src_cnt, len, &dest, flags);
 
         spin_lock_bh(&mv_chan->lock);
         slot_cnt = mv_chan_xor_slot_count(len, src_cnt);
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index e8c9ef03495b..33edd6766344 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -559,7 +559,8 @@ static void edac_mc_workq_function(struct work_struct *work_req)
  *
  *              called with the mem_ctls_mutex held
  */
-static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec)
+static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec,
+                                bool init)
 {
         edac_dbg(0, "\n");
 
@@ -567,7 +568,9 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec)
         if (mci->op_state != OP_RUNNING_POLL)
                 return;
 
-        INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function);
+        if (init)
+                INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function);
+
         mod_delayed_work(edac_workqueue, &mci->work, msecs_to_jiffies(msec));
 }
 
@@ -601,7 +604,7 @@ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
  *      user space has updated our poll period value, need to
  *      reset our workq delays
  */
-void edac_mc_reset_delay_period(int value)
+void edac_mc_reset_delay_period(unsigned long value)
 {
         struct mem_ctl_info *mci;
         struct list_head *item;
@@ -611,7 +614,7 @@ void edac_mc_reset_delay_period(int value)
         list_for_each(item, &mc_devices) {
                 mci = list_entry(item, struct mem_ctl_info, link);
 
-                edac_mc_workq_setup(mci, (unsigned long) value);
+                edac_mc_workq_setup(mci, value, false);
         }
 
         mutex_unlock(&mem_ctls_mutex);
@@ -782,7 +785,7 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
                 /* This instance is NOW RUNNING */
                 mci->op_state = OP_RUNNING_POLL;
 
-                edac_mc_workq_setup(mci, edac_mc_get_poll_msec());
+                edac_mc_workq_setup(mci, edac_mc_get_poll_msec(), true);
         } else {
                 mci->op_state = OP_RUNNING_INTERRUPT;
         }
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 51c0362acf5c..b335c6ab5efe 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -52,18 +52,20 @@ int edac_mc_get_poll_msec(void)
 
 static int edac_set_poll_msec(const char *val, struct kernel_param *kp)
 {
-        long l;
+        unsigned long l;
         int ret;
 
         if (!val)
                 return -EINVAL;
 
-        ret = kstrtol(val, 0, &l);
+        ret = kstrtoul(val, 0, &l);
         if (ret)
                 return ret;
-        if ((int)l != l)
+
+        if (l < 1000)
                 return -EINVAL;
-        *((int *)kp->arg) = l;
+
+        *((unsigned long *)kp->arg) = l;
 
         /* notify edac_mc engine to reset the poll period */
         edac_mc_reset_delay_period(l);
diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
index 3d139c6e7fe3..f2118bfcf8df 100644
--- a/drivers/edac/edac_module.h
+++ b/drivers/edac/edac_module.h
@@ -52,7 +52,7 @@ extern void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev,
 extern void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev);
 extern void edac_device_reset_delay_period(struct edac_device_ctl_info
                                            *edac_dev, unsigned long value);
-extern void edac_mc_reset_delay_period(int value);
+extern void edac_mc_reset_delay_period(unsigned long value);
 
 extern void *edac_align_ptr(void **p, unsigned size, int n_elems);
 
diff --git a/drivers/fmc/fmc-write-eeprom.c b/drivers/fmc/fmc-write-eeprom.c
index ee5b47904130..9bb2cbd5c9f2 100644
--- a/drivers/fmc/fmc-write-eeprom.c
+++ b/drivers/fmc/fmc-write-eeprom.c
@@ -27,7 +27,7 @@ FMC_PARAM_BUSID(fwe_drv);
 /* The "file=" is like the generic "gateware=" used elsewhere */
 static char *fwe_file[FMC_MAX_CARDS];
 static int fwe_file_n;
-module_param_array_named(file, fwe_file, charp, &fwe_file_n, 444);
+module_param_array_named(file, fwe_file, charp, &fwe_file_n, 0444);
 
 static int fwe_run_tlv(struct fmc_device *fmc, const struct firmware *fw,
         int write)
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 697338772b64..903f24d28ba0 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -403,6 +403,7 @@ config GPIO_GRGPIO
 
 config GPIO_TB10X
         bool
+        select GENERIC_IRQ_CHIP
         select OF_GPIO
 
 comment "I2C GPIO expanders:"
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index 233d088ac59f..f32357e2d78d 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2013 Broadcom Corporation
+ * Copyright (C) 2012-2014 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -657,6 +657,6 @@ static struct platform_driver bcm_kona_gpio_driver = {
 
 module_platform_driver(bcm_kona_gpio_driver);
 
-MODULE_AUTHOR("Broadcom");
+MODULE_AUTHOR("Broadcom Corporation <bcm-kernel-feedback-list@broadcom.com>");
 MODULE_DESCRIPTION("Broadcom Kona GPIO Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/gpio/gpio-clps711x.c b/drivers/gpio/gpio-clps711x.c
index d3550274b8f7..3c2ba2ad0ada 100644
--- a/drivers/gpio/gpio-clps711x.c
+++ b/drivers/gpio/gpio-clps711x.c
@@ -97,3 +97,4 @@ module_platform_driver(clps711x_gpio_driver);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Alexander Shiyan <shc_work@mail.ru>");
 MODULE_DESCRIPTION("CLPS711X GPIO driver");
+MODULE_ALIAS("platform:clps711x-gpio");
diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c
index d1b50ef5fab8..e585163f1ad5 100644
--- a/drivers/gpio/gpio-intel-mid.c
+++ b/drivers/gpio/gpio-intel-mid.c
@@ -394,8 +394,8 @@ static const struct irq_domain_ops intel_gpio_irq_ops = {
 
 static int intel_gpio_runtime_idle(struct device *dev)
 {
-        pm_schedule_suspend(dev, 500);
-        return -EBUSY;
+        int err = pm_schedule_suspend(dev, 500);
+        return err ?: -EBUSY;
 }
 
 static const struct dev_pm_ops intel_gpio_pm_ops = {
diff --git a/drivers/gpio/gpio-xtensa.c b/drivers/gpio/gpio-xtensa.c
index 1d136eceda62..7081304d6797 100644
--- a/drivers/gpio/gpio-xtensa.c
+++ b/drivers/gpio/gpio-xtensa.c
@@ -40,6 +40,8 @@
 #error GPIO32 option is not enabled for your xtensa core variant
 #endif
 
+#if XCHAL_HAVE_CP
+
 static inline unsigned long enable_cp(unsigned long *cpenable)
 {
         unsigned long flags;
@@ -57,6 +59,20 @@ static inline void disable_cp(unsigned long flags, unsigned long cpenable)
         local_irq_restore(flags);
 }
 
+#else
+
+static inline unsigned long enable_cp(unsigned long *cpenable)
+{
+        *cpenable = 0; /* avoid uninitialized value warning */
+        return 0;
+}
+
+static inline void disable_cp(unsigned long flags, unsigned long cpenable)
+{
+}
+
+#endif /* XCHAL_HAVE_CP */
+
 static int xtensa_impwire_get_direction(struct gpio_chip *gc, unsigned offset)
 {
         return 1; /* input only */
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index dffc836144cc..f4dc9b7a3831 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -296,6 +296,18 @@ int drm_getcap(struct drm_device *dev, void *data, struct drm_file *file_priv)
         case DRM_CAP_ASYNC_PAGE_FLIP:
                 req->value = dev->mode_config.async_page_flip;
                 break;
+        case DRM_CAP_CURSOR_WIDTH:
+                if (dev->mode_config.cursor_width)
+                        req->value = dev->mode_config.cursor_width;
+                else
+                        req->value = 64;
+                break;
+        case DRM_CAP_CURSOR_HEIGHT:
+                if (dev->mode_config.cursor_height)
+                        req->value = dev->mode_config.cursor_height;
+                else
+                        req->value = 64;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index f227f544aa36..6e1a1a20cf6b 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -51,7 +51,7 @@ config DRM_EXYNOS_G2D
 
 config DRM_EXYNOS_IPP
         bool "Exynos DRM IPP"
-        depends on DRM_EXYNOS && !ARCH_MULTIPLATFORM
+        depends on DRM_EXYNOS
         help
           Choose this option if you want to use IPP feature for DRM.
 
@@ -69,6 +69,6 @@ config DRM_EXYNOS_ROTATOR
 
 config DRM_EXYNOS_GSC
         bool "Exynos DRM GSC"
-        depends on DRM_EXYNOS_IPP && ARCH_EXYNOS5
+        depends on DRM_EXYNOS_IPP && ARCH_EXYNOS5 && !ARCH_MULTIPLATFORM
         help
           Choose this option if you want to use Exynos GSC for DRM.
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 9d096a0c5f8d..215131ab1dd2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -171,22 +171,24 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
         file->driver_priv = file_priv;
 
         ret = exynos_drm_subdrv_open(dev, file);
-        if (ret) {
-                kfree(file_priv);
-                file->driver_priv = NULL;
-        }
+        if (ret)
+                goto out;
 
         anon_filp = anon_inode_getfile("exynos_gem", &exynos_drm_gem_fops,
                                         NULL, 0);
         if (IS_ERR(anon_filp)) {
-                kfree(file_priv);
-                return PTR_ERR(anon_filp);
+                ret = PTR_ERR(anon_filp);
+                goto out;
         }
 
         anon_filp->f_mode = FMODE_READ | FMODE_WRITE;
         file_priv->anon_filp = anon_filp;
 
         return ret;
+out:
+        kfree(file_priv);
+        file->driver_priv = NULL;
+        return ret;
 }
 
 static void exynos_drm_preclose(struct drm_device *dev,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 380aec28840b..6c1885eedfdf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -607,7 +607,7 @@ static enum g2d_reg_type g2d_get_reg_type(int reg_offset)
                 reg_type = REG_TYPE_NONE;
                 DRM_ERROR("Unknown register offset![%d]\n", reg_offset);
                 break;
-        };
+        }
 
         return reg_type;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index d519a4e5fe40..09312b877470 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -16,7 +16,6 @@
 #include <linux/types.h>
 #include <linux/clk.h>
 #include <linux/pm_runtime.h>
-#include <plat/map-base.h>
 
 #include <drm/drmP.h>
 #include <drm/exynos_drm.h>
@@ -826,7 +825,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
                 DRM_DEBUG_KMS("count[%d]e[0x%x]\n", count++, (int)e);
 
                 /*
-                 * quf == NULL condition means all event deletion.
+                 * qbuf == NULL condition means all event deletion.
                  * stop operations want to delete all event list.
                  * another case delete only same buf id.
                  */
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index a0e10aeb0e67..c021ddc1ffb4 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -34,6 +34,7 @@
 #include <linux/io.h>
 #include <linux/of.h>
 #include <linux/of_gpio.h>
+#include <linux/hdmi.h>
 
 #include <drm/exynos_drm.h>
 
@@ -59,19 +60,6 @@
 #define HDMI_AUI_VERSION        0x01
 #define HDMI_AUI_LENGTH 0x0A
 
-/* HDMI infoframe to configure HDMI out packet header, AUI and AVI */
-enum HDMI_PACKET_TYPE {
-        /* refer to Table 5-8 Packet Type in HDMI specification v1.4a */
-        /* InfoFrame packet type */
-        HDMI_PACKET_TYPE_INFOFRAME = 0x80,
-        /* Vendor-Specific InfoFrame */
-        HDMI_PACKET_TYPE_VSI = HDMI_PACKET_TYPE_INFOFRAME + 1,
-        /* Auxiliary Video information InfoFrame */
-        HDMI_PACKET_TYPE_AVI = HDMI_PACKET_TYPE_INFOFRAME + 2,
-        /* Audio information InfoFrame */
-        HDMI_PACKET_TYPE_AUI = HDMI_PACKET_TYPE_INFOFRAME + 4
-};
-
 enum hdmi_type {
         HDMI_TYPE13,
         HDMI_TYPE14,
@@ -379,12 +367,6 @@ static const struct hdmiphy_config hdmiphy_v14_configs[] = {
         },
 };
 
-struct hdmi_infoframe {
-        enum HDMI_PACKET_TYPE type;
-        u8 ver;
-        u8 len;
-};
-
 static inline u32 hdmi_reg_read(struct hdmi_context *hdata, u32 reg_id)
 {
         return readl(hdata->regs + reg_id);
@@ -682,7 +664,7 @@ static u8 hdmi_chksum(struct hdmi_context *hdata,
 }
 
 static void hdmi_reg_infoframe(struct hdmi_context *hdata,
-                        struct hdmi_infoframe *infoframe)
+                        union hdmi_infoframe *infoframe)
 {
         u32 hdr_sum;
         u8 chksum;
@@ -700,13 +682,15 @@ static void hdmi_reg_infoframe(struct hdmi_context *hdata,
                 return;
         }
 
-        switch (infoframe->type) {
-        case HDMI_PACKET_TYPE_AVI:
+        switch (infoframe->any.type) {
+        case HDMI_INFOFRAME_TYPE_AVI:
                 hdmi_reg_writeb(hdata, HDMI_AVI_CON, HDMI_AVI_CON_EVERY_VSYNC);
-                hdmi_reg_writeb(hdata, HDMI_AVI_HEADER0, infoframe->type);
-                hdmi_reg_writeb(hdata, HDMI_AVI_HEADER1, infoframe->ver);
-                hdmi_reg_writeb(hdata, HDMI_AVI_HEADER2, infoframe->len);
-                hdr_sum = infoframe->type + infoframe->ver + infoframe->len;
+                hdmi_reg_writeb(hdata, HDMI_AVI_HEADER0, infoframe->any.type);
+                hdmi_reg_writeb(hdata, HDMI_AVI_HEADER1,
+                                infoframe->any.version);
+                hdmi_reg_writeb(hdata, HDMI_AVI_HEADER2, infoframe->any.length);
+                hdr_sum = infoframe->any.type + infoframe->any.version +
+                          infoframe->any.length;
 
                 /* Output format zero hardcoded ,RGB YBCR selection */
                 hdmi_reg_writeb(hdata, HDMI_AVI_BYTE(1), 0 << 5 |
@@ -722,18 +706,20 @@ static void hdmi_reg_infoframe(struct hdmi_context *hdata,
                 hdmi_reg_writeb(hdata, HDMI_AVI_BYTE(4), vic);
 
                 chksum = hdmi_chksum(hdata, HDMI_AVI_BYTE(1),
-                                        infoframe->len, hdr_sum);
+                                        infoframe->any.length, hdr_sum);
                 DRM_DEBUG_KMS("AVI checksum = 0x%x\n", chksum);
                 hdmi_reg_writeb(hdata, HDMI_AVI_CHECK_SUM, chksum);
                 break;
-        case HDMI_PACKET_TYPE_AUI:
+        case HDMI_INFOFRAME_TYPE_AUDIO:
                 hdmi_reg_writeb(hdata, HDMI_AUI_CON, 0x02);
-                hdmi_reg_writeb(hdata, HDMI_AUI_HEADER0, infoframe->type);
-                hdmi_reg_writeb(hdata, HDMI_AUI_HEADER1, infoframe->ver);
-                hdmi_reg_writeb(hdata, HDMI_AUI_HEADER2, infoframe->len);
-                hdr_sum = infoframe->type + infoframe->ver + infoframe->len;
+                hdmi_reg_writeb(hdata, HDMI_AUI_HEADER0, infoframe->any.type);
+                hdmi_reg_writeb(hdata, HDMI_AUI_HEADER1,
+                                infoframe->any.version);
+                hdmi_reg_writeb(hdata, HDMI_AUI_HEADER2, infoframe->any.length);
+                hdr_sum = infoframe->any.type + infoframe->any.version +
+                          infoframe->any.length;
                 chksum = hdmi_chksum(hdata, HDMI_AUI_BYTE(1),
-                                        infoframe->len, hdr_sum);
+                                        infoframe->any.length, hdr_sum);
                 DRM_DEBUG_KMS("AUI checksum = 0x%x\n", chksum);
                 hdmi_reg_writeb(hdata, HDMI_AUI_CHECK_SUM, chksum);
                 break;
@@ -985,7 +971,7 @@ static void hdmi_conf_reset(struct hdmi_context *hdata)
 
 static void hdmi_conf_init(struct hdmi_context *hdata)
 {
-        struct hdmi_infoframe infoframe;
+        union hdmi_infoframe infoframe;
 
         /* disable HPD interrupts from HDMI IP block, use GPIO instead */
         hdmi_reg_writemask(hdata, HDMI_INTC_CON, 0, HDMI_INTC_EN_GLOBAL |
@@ -1021,14 +1007,14 @@ static void hdmi_conf_init(struct hdmi_context *hdata)
                 hdmi_reg_writeb(hdata, HDMI_V13_AUI_CON, 0x02);
                 hdmi_reg_writeb(hdata, HDMI_V13_ACR_CON, 0x04);
         } else {
-                infoframe.type = HDMI_PACKET_TYPE_AVI;
-                infoframe.ver = HDMI_AVI_VERSION;
-                infoframe.len = HDMI_AVI_LENGTH;
+                infoframe.any.type = HDMI_INFOFRAME_TYPE_AVI;
+                infoframe.any.version = HDMI_AVI_VERSION;
+                infoframe.any.length = HDMI_AVI_LENGTH;
                 hdmi_reg_infoframe(hdata, &infoframe);
 
-                infoframe.type = HDMI_PACKET_TYPE_AUI;
-                infoframe.ver = HDMI_AUI_VERSION;
-                infoframe.len = HDMI_AUI_LENGTH;
+                infoframe.any.type = HDMI_INFOFRAME_TYPE_AUDIO;
+                infoframe.any.version = HDMI_AUI_VERSION;
+                infoframe.any.length = HDMI_AUI_LENGTH;
                 hdmi_reg_infoframe(hdata, &infoframe);
 
                 /* enable AVI packet every vsync, fixes purple line problem */
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 400b0c4a10fb..faa77f543a07 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -208,7 +208,7 @@ struct tda998x_priv {
 # define PLL_SERIAL_1_SRL_IZ(x)   (((x) & 3) << 1)
 # define PLL_SERIAL_1_SRL_MAN_IZ  (1 << 6)
 #define REG_PLL_SERIAL_2          REG(0x02, 0x01)     /* read/write */
-# define PLL_SERIAL_2_SRL_NOSC(x) (((x) & 3) << 0)
+# define PLL_SERIAL_2_SRL_NOSC(x) ((x) << 0)
 # define PLL_SERIAL_2_SRL_PR(x)   (((x) & 0xf) << 4)
 #define REG_PLL_SERIAL_3          REG(0x02, 0x02)     /* read/write */
 # define PLL_SERIAL_3_SRL_CCIR    (1 << 0)
@@ -528,10 +528,10 @@ tda998x_write_aif(struct drm_encoder *encoder, struct tda998x_encoder_params *p)
 {
         uint8_t buf[PB(5) + 1];
 
+        memset(buf, 0, sizeof(buf));
         buf[HB(0)] = 0x84;
         buf[HB(1)] = 0x01;
         buf[HB(2)] = 10;
-        buf[PB(0)] = 0;
         buf[PB(1)] = p->audio_frame[1] & 0x07; /* CC */
         buf[PB(2)] = p->audio_frame[2] & 0x1c; /* SF */
         buf[PB(4)] = p->audio_frame[4];
@@ -824,6 +824,11 @@ tda998x_encoder_mode_set(struct drm_encoder *encoder,
         }
 
         div = 148500 / mode->clock;
+        if (div != 0) {
+                div--;
+                if (div > 3)
+                        div = 3;
+        }
 
         /* mute the audio FIFO: */
         reg_set(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_FIFO);
@@ -913,7 +918,7 @@ tda998x_encoder_mode_set(struct drm_encoder *encoder,
 
         if (priv->rev == TDA19988) {
                 /* let incoming pixels fill the active space (if any) */
-                reg_write(encoder, REG_ENABLE_SPACE, 0x01);
+                reg_write(encoder, REG_ENABLE_SPACE, 0x00);
         }
 
         /* must be last register set: */
@@ -1094,6 +1099,8 @@ tda998x_encoder_destroy(struct drm_encoder *encoder)
 {
         struct tda998x_priv *priv = to_tda998x_priv(encoder);
         drm_i2c_encoder_destroy(encoder);
+        if (priv->cec)
+                i2c_unregister_device(priv->cec);
         kfree(priv);
 }
 
@@ -1142,8 +1149,12 @@ tda998x_encoder_init(struct i2c_client *client,
         priv->vip_cntrl_1 = VIP_CNTRL_1_SWAP_C(0) | VIP_CNTRL_1_SWAP_D(1);
         priv->vip_cntrl_2 = VIP_CNTRL_2_SWAP_E(4) | VIP_CNTRL_2_SWAP_F(5);
 
-        priv->current_page = 0;
+        priv->current_page = 0xff;
         priv->cec = i2c_new_dummy(client->adapter, 0x34);
+        if (!priv->cec) {
+                kfree(priv);
+                return -ENODEV;
+        }
         priv->dpms = DRM_MODE_DPMS_OFF;
 
         encoder_slave->slave_priv = priv;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 4a2bf8e3f739..df77e20e3c3d 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1831,6 +1831,14 @@ struct drm_i915_file_private {
 
 /* Early gen2 have a totally busted CS tlb and require pinned batches. */
 #define HAS_BROKEN_CS_TLB(dev)          (IS_I830(dev) || IS_845G(dev))
+/*
+ * dp aux and gmbus irq on gen4 seems to be able to generate legacy interrupts
+ * even when in MSI mode. This results in spurious interrupt warnings if the
+ * legacy irq no. is shared with another device. The kernel then disables that
+ * interrupt source and so prevents the other device from working properly.
+ */
+#define HAS_AUX_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
+#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
 
 /* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
  * rows, which changed the alignment requirements and fence programming.
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index d7fd2fd2f0a5..990cf8f43efd 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -146,7 +146,10 @@ static void i915_error_vprintf(struct drm_i915_error_state_buf *e,
                 va_list tmp;
 
                 va_copy(tmp, args);
-                if (!__i915_error_seek(e, vsnprintf(NULL, 0, f, tmp)))
+                len = vsnprintf(NULL, 0, f, tmp);
+                va_end(tmp);
+
+                if (!__i915_error_seek(e, len))
                         return;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 17d8fcb1b6f7..9fec71175571 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -567,8 +567,7 @@ static u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
 
                 vbl_start = mode->crtc_vblank_start * mode->crtc_htotal;
         } else {
-                enum transcoder cpu_transcoder =
-                        intel_pipe_to_cpu_transcoder(dev_priv, pipe);
+                enum transcoder cpu_transcoder = (enum transcoder) pipe;
                 u32 htotal;
 
                 htotal = ((I915_READ(HTOTAL(cpu_transcoder)) >> 16) & 0x1fff) + 1;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9fa24347963a..4c1672809493 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8586,6 +8586,20 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
         if (ring->id == RCS)
                 len += 6;
 
+        /*
+         * BSpec MI_DISPLAY_FLIP for IVB:
+         * "The full packet must be contained within the same cache line."
+         *
+         * Currently the LRI+SRM+MI_DISPLAY_FLIP all fit within the same
+         * cacheline, if we ever start emitting more commands before
+         * the MI_DISPLAY_FLIP we may need to first emit everything else,
+         * then do the cacheline alignment, and finally emit the
+         * MI_DISPLAY_FLIP.
+         */
+        ret = intel_ring_cacheline_align(ring);
+        if (ret)
+                goto err_unpin;
+
         ret = intel_ring_begin(ring, len);
         if (ret)
                 goto err_unpin;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 5ede4e8e290d..57552eb386b0 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -404,7 +404,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
         int i, ret, recv_bytes;
         uint32_t status;
         int try, precharge, clock = 0;
-        bool has_aux_irq = true;
+        bool has_aux_irq = HAS_AUX_IRQ(dev);
         uint32_t timeout;
 
         /* dp aux is extremely sensitive to irq latency, hence request the
@@ -537,6 +537,7 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp,
         uint8_t msg[20];
         int msg_bytes;
         uint8_t ack;
+        int retry;
 
         if (WARN_ON(send_bytes > 16))
                 return -E2BIG;
@@ -548,19 +549,21 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp,
         msg[3] = send_bytes - 1;
         memcpy(&msg[4], send, send_bytes);
         msg_bytes = send_bytes + 4;
-        for (;;) {
+        for (retry = 0; retry < 7; retry++) {
                 ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes, &ack, 1);
                 if (ret < 0)
                         return ret;
                 ack >>= 4;
                 if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_ACK)
-                        break;
+                        return send_bytes;
                 else if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_DEFER)
-                        udelay(100);
+                        usleep_range(400, 500);
                 else
                         return -EIO;
         }
-        return send_bytes;
+
+        DRM_ERROR("too many retries, giving up\n");
+        return -EIO;
 }
 
 /* Write a single byte to the aux channel in native mode */
@@ -582,6 +585,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
         int reply_bytes;
         uint8_t ack;
         int ret;
+        int retry;
 
         if (WARN_ON(recv_bytes > 19))
                 return -E2BIG;
@@ -595,7 +599,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
         msg_bytes = 4;
         reply_bytes = recv_bytes + 1;
 
-        for (;;) {
+        for (retry = 0; retry < 7; retry++) {
                 ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes,
                                       reply, reply_bytes);
                 if (ret == 0)
@@ -608,10 +612,13 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
                         return ret - 1;
                 }
                 else if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_DEFER)
-                        udelay(100);
+                        usleep_range(400, 500);
                 else
                         return -EIO;
         }
+
+        DRM_ERROR("too many retries, giving up\n");
+        return -EIO;
 }
 
 static int
@@ -1869,10 +1876,12 @@ static void vlv_pre_enable_dp(struct intel_encoder *encoder)
 
         mutex_unlock(&dev_priv->dpio_lock);
 
-        /* init power sequencer on this pipe and port */
-        intel_dp_init_panel_power_sequencer(dev, intel_dp, &power_seq);
-        intel_dp_init_panel_power_sequencer_registers(dev, intel_dp,
-                                                      &power_seq);
+        if (is_edp(intel_dp)) {
+                /* init power sequencer on this pipe and port */
+                intel_dp_init_panel_power_sequencer(dev, intel_dp, &power_seq);
+                intel_dp_init_panel_power_sequencer_registers(dev, intel_dp,
+                                                              &power_seq);
+        }
 
         intel_enable_dp(encoder);
 
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index b1dc33f47899..d33b61d0dd33 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -258,13 +258,6 @@ intel_gpio_setup(struct intel_gmbus *bus, u32 pin)
         algo->data = bus;
 }
 
-/*
- * gmbus on gen4 seems to be able to generate legacy interrupts even when in MSI
- * mode. This results in spurious interrupt warnings if the legacy irq no. is
- * shared with another device. The kernel then disables that interrupt source
- * and so prevents the other device from working properly.
- */
-#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
 static int
 gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
                      u32 gmbus2_status,
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index 4e960ec7419f..acde2945eb8a 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -226,6 +226,8 @@ struct opregion_asle {
 #define ACPI_DIGITAL_OUTPUT (3<<8)
 #define ACPI_LVDS_OUTPUT (4<<8)
 
+#define MAX_DSLP        1500
+
 #ifdef CONFIG_ACPI
 static int swsci(struct drm_device *dev, u32 function, u32 parm, u32 *parm_out)
 {
@@ -260,10 +262,11 @@ static int swsci(struct drm_device *dev, u32 function, u32 parm, u32 *parm_out)
                 /* The spec says 2ms should be the default, but it's too small
                  * for some machines. */
                 dslp = 50;
-        } else if (dslp > 500) {
+        } else if (dslp > MAX_DSLP) {
                 /* Hey bios, trust must be earned. */
-                WARN_ONCE(1, "excessive driver sleep timeout (DSPL) %u\n", dslp);
-                dslp = 500;
+                DRM_INFO_ONCE("ACPI BIOS requests an excessive sleep of %u ms, "
+                              "using %u ms instead\n", dslp, MAX_DSLP);
+                dslp = MAX_DSLP;
         }
 
         /* The spec tells us to do this, but we are the only user... */
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b7f1742caf87..31b36c5ac894 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1653,6 +1653,27 @@ int intel_ring_begin(struct intel_ring_buffer *ring,
         return 0;
 }
 
+/* Align the ring tail to a cacheline boundary */
+int intel_ring_cacheline_align(struct intel_ring_buffer *ring)
+{
+        int num_dwords = (64 - (ring->tail & 63)) / sizeof(uint32_t);
+        int ret;
+
+        if (num_dwords == 0)
+                return 0;
+
+        ret = intel_ring_begin(ring, num_dwords);
+        if (ret)
+                return ret;
+
+        while (num_dwords--)
+                intel_ring_emit(ring, MI_NOOP);
+
+        intel_ring_advance(ring);
+
+        return 0;
+}
+
 void intel_ring_init_seqno(struct intel_ring_buffer *ring, u32 seqno)
 {
         struct drm_i915_private *dev_priv = ring->dev->dev_private;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 71a73f4fe252..0b243ce33714 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -233,6 +233,7 @@ intel_write_status_page(struct intel_ring_buffer *ring,
 void intel_cleanup_ring_buffer(struct intel_ring_buffer *ring);
 
 int __must_check intel_ring_begin(struct intel_ring_buffer *ring, int n);
+int __must_check intel_ring_cacheline_align(struct intel_ring_buffer *ring);
 static inline void intel_ring_emit(struct intel_ring_buffer *ring,
                                    u32 data)
 {
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
index 1964f4f0d452..84c5b13b33c9 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
@@ -39,6 +39,7 @@ struct mdp4_crtc {
                 spinlock_t lock;
                 bool stale;
                 uint32_t width, height;
+                uint32_t x, y;
 
                 /* next cursor to scan-out: */
                 uint32_t next_iova;
@@ -57,9 +58,16 @@ struct mdp4_crtc {
 #define PENDING_FLIP   0x2
         atomic_t pending;
 
-        /* the fb that we currently hold a scanout ref to: */
+        /* the fb that we logically (from PoV of KMS API) hold a ref
+         * to.  Which we may not yet be scanning out (we may still
+         * be scanning out previous in case of page_flip while waiting
+         * for gpu rendering to complete:
+         */
         struct drm_framebuffer *fb;
 
+        /* the fb that we currently hold a scanout ref to: */
+        struct drm_framebuffer *scanout_fb;
+
         /* for unref'ing framebuffers after scanout completes: */
         struct drm_flip_work unref_fb_work;
 
@@ -77,24 +85,73 @@ static struct mdp4_kms *get_kms(struct drm_crtc *crtc)
         return to_mdp4_kms(to_mdp_kms(priv->kms));
 }
 
-static void update_fb(struct drm_crtc *crtc, bool async,
-                struct drm_framebuffer *new_fb)
+static void request_pending(struct drm_crtc *crtc, uint32_t pending)
 {
         struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
-        struct drm_framebuffer *old_fb = mdp4_crtc->fb;
 
-        if (old_fb)
-                drm_flip_work_queue(&mdp4_crtc->unref_fb_work, old_fb);
+        atomic_or(pending, &mdp4_crtc->pending);
+        mdp_irq_register(&get_kms(crtc)->base, &mdp4_crtc->vblank);
+}
+
+static void crtc_flush(struct drm_crtc *crtc)
+{
+        struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+        struct mdp4_kms *mdp4_kms = get_kms(crtc);
+        uint32_t i, flush = 0;
+
+        for (i = 0; i < ARRAY_SIZE(mdp4_crtc->planes); i++) {
+                struct drm_plane *plane = mdp4_crtc->planes[i];
+                if (plane) {
+                        enum mdp4_pipe pipe_id = mdp4_plane_pipe(plane);
+                        flush |= pipe2flush(pipe_id);
+                }
+        }
+        flush |= ovlp2flush(mdp4_crtc->ovlp);
+
+        DBG("%s: flush=%08x", mdp4_crtc->name, flush);
+
+        mdp4_write(mdp4_kms, REG_MDP4_OVERLAY_FLUSH, flush);
+}
+
+static void update_fb(struct drm_crtc *crtc, struct drm_framebuffer *new_fb)
+{
+        struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+        struct drm_framebuffer *old_fb = mdp4_crtc->fb;
 
         /* grab reference to incoming scanout fb: */
         drm_framebuffer_reference(new_fb);
         mdp4_crtc->base.fb = new_fb;
         mdp4_crtc->fb = new_fb;
 
-        if (!async) {
-                /* enable vblank to pick up the old_fb */
-                mdp_irq_register(&get_kms(crtc)->base, &mdp4_crtc->vblank);
-        }
+        if (old_fb)
+                drm_flip_work_queue(&mdp4_crtc->unref_fb_work, old_fb);
+}
+
+/* unlike update_fb(), take a ref to the new scanout fb *before* updating
+ * plane, then call this.  Needed to ensure we don't unref the buffer that
+ * is actually still being scanned out.
+ *
+ * Note that this whole thing goes away with atomic.. since we can defer
+ * calling into driver until rendering is done.
+ */
+static void update_scanout(struct drm_crtc *crtc, struct drm_framebuffer *fb)
+{
+        struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+
+        /* flush updates, to make sure hw is updated to new scanout fb,
+         * so that we can safely queue unref to current fb (ie. next
+         * vblank we know hw is done w/ previous scanout_fb).
+         */
+        crtc_flush(crtc);
+
+        if (mdp4_crtc->scanout_fb)
+                drm_flip_work_queue(&mdp4_crtc->unref_fb_work,
+                                mdp4_crtc->scanout_fb);
+
+        mdp4_crtc->scanout_fb = fb;
+
+        /* enable vblank to complete flip: */
+        request_pending(crtc, PENDING_FLIP);
 }
 
 /* if file!=NULL, this is preclose potential cancel-flip path */
@@ -120,34 +177,6 @@ static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
         spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 
-static void crtc_flush(struct drm_crtc *crtc)
-{
-        struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
-        struct mdp4_kms *mdp4_kms = get_kms(crtc);
-        uint32_t i, flush = 0;
-
-        for (i = 0; i < ARRAY_SIZE(mdp4_crtc->planes); i++) {
-                struct drm_plane *plane = mdp4_crtc->planes[i];
-                if (plane) {
-                        enum mdp4_pipe pipe_id = mdp4_plane_pipe(plane);
-                        flush |= pipe2flush(pipe_id);
-                }
-        }
-        flush |= ovlp2flush(mdp4_crtc->ovlp);
-
-        DBG("%s: flush=%08x", mdp4_crtc->name, flush);
-
-        mdp4_write(mdp4_kms, REG_MDP4_OVERLAY_FLUSH, flush);
-}
-
-static void request_pending(struct drm_crtc *crtc, uint32_t pending)
-{
-        struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
-
-        atomic_or(pending, &mdp4_crtc->pending);
-        mdp_irq_register(&get_kms(crtc)->base, &mdp4_crtc->vblank);
-}
-
 static void pageflip_cb(struct msm_fence_cb *cb)
 {
         struct mdp4_crtc *mdp4_crtc =
@@ -158,11 +187,9 @@ static void pageflip_cb(struct msm_fence_cb *cb)
         if (!fb)
                 return;
 
+        drm_framebuffer_reference(fb);
         mdp4_plane_set_scanout(mdp4_crtc->plane, fb);
-        crtc_flush(crtc);
-
-        /* enable vblank to complete flip: */
-        request_pending(crtc, PENDING_FLIP);
+        update_scanout(crtc, fb);
 }
 
 static void unref_fb_worker(struct drm_flip_work *work, void *val)
@@ -320,6 +347,20 @@ static int mdp4_crtc_mode_set(struct drm_crtc *crtc,
                         mode->vsync_end, mode->vtotal,
                         mode->type, mode->flags);
 
+        /* grab extra ref for update_scanout() */
+        drm_framebuffer_reference(crtc->fb);
+
+        ret = mdp4_plane_mode_set(mdp4_crtc->plane, crtc, crtc->fb,
+                        0, 0, mode->hdisplay, mode->vdisplay,
+                        x << 16, y << 16,
+                        mode->hdisplay << 16, mode->vdisplay << 16);
+        if (ret) {
+                drm_framebuffer_unreference(crtc->fb);
+                dev_err(crtc->dev->dev, "%s: failed to set mode on plane: %d\n",
+                                mdp4_crtc->name, ret);
+                return ret;
+        }
+
         mdp4_write(mdp4_kms, REG_MDP4_DMA_SRC_SIZE(dma),
                         MDP4_DMA_SRC_SIZE_WIDTH(mode->hdisplay) |
                         MDP4_DMA_SRC_SIZE_HEIGHT(mode->vdisplay));
@@ -341,24 +382,15 @@ static int mdp4_crtc_mode_set(struct drm_crtc *crtc,
 
         mdp4_write(mdp4_kms, REG_MDP4_OVLP_CFG(ovlp), 1);
 
-        update_fb(crtc, false, crtc->fb);
-
-        ret = mdp4_plane_mode_set(mdp4_crtc->plane, crtc, crtc->fb,
-                        0, 0, mode->hdisplay, mode->vdisplay,
-                        x << 16, y << 16,
-                        mode->hdisplay << 16, mode->vdisplay << 16);
-        if (ret) {
-                dev_err(crtc->dev->dev, "%s: failed to set mode on plane: %d\n",
-                                mdp4_crtc->name, ret);
-                return ret;
-        }
-
         if (dma == DMA_E) {
                 mdp4_write(mdp4_kms, REG_MDP4_DMA_E_QUANT(0), 0x00ff0000);
                 mdp4_write(mdp4_kms, REG_MDP4_DMA_E_QUANT(1), 0x00ff0000);
                 mdp4_write(mdp4_kms, REG_MDP4_DMA_E_QUANT(2), 0x00ff0000);
         }
 
+        update_fb(crtc, crtc->fb);
+        update_scanout(crtc, crtc->fb);
+
         return 0;
 }
 
@@ -385,13 +417,24 @@ static int mdp4_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
         struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
         struct drm_plane *plane = mdp4_crtc->plane;
         struct drm_display_mode *mode = &crtc->mode;
+        int ret;
 
-        update_fb(crtc, false, crtc->fb);
+        /* grab extra ref for update_scanout() */
+        drm_framebuffer_reference(crtc->fb);
 
-        return mdp4_plane_mode_set(plane, crtc, crtc->fb,
+        ret = mdp4_plane_mode_set(plane, crtc, crtc->fb,
                         0, 0, mode->hdisplay, mode->vdisplay,
                         x << 16, y << 16,
                         mode->hdisplay << 16, mode->vdisplay << 16);
+        if (ret) {
+                drm_framebuffer_unreference(crtc->fb);
+                return ret;
+        }
+
+        update_fb(crtc, crtc->fb);
+        update_scanout(crtc, crtc->fb);
+
+        return 0;
 }
 
 static void mdp4_crtc_load_lut(struct drm_crtc *crtc)
@@ -419,7 +462,7 @@ static int mdp4_crtc_page_flip(struct drm_crtc *crtc,
         mdp4_crtc->event = event;
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
-        update_fb(crtc, true, new_fb);
+        update_fb(crtc, new_fb);
 
         return msm_gem_queue_inactive_cb(obj, &mdp4_crtc->pageflip_cb);
 }
@@ -442,12 +485,12 @@ static int mdp4_crtc_set_property(struct drm_crtc *crtc,
 static void update_cursor(struct drm_crtc *crtc)
 {
         struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+        struct mdp4_kms *mdp4_kms = get_kms(crtc);
         enum mdp4_dma dma = mdp4_crtc->dma;
         unsigned long flags;
 
         spin_lock_irqsave(&mdp4_crtc->cursor.lock, flags);
         if (mdp4_crtc->cursor.stale) {
-                struct mdp4_kms *mdp4_kms = get_kms(crtc);
                 struct drm_gem_object *next_bo = mdp4_crtc->cursor.next_bo;
                 struct drm_gem_object *prev_bo = mdp4_crtc->cursor.scanout_bo;
                 uint32_t iova = mdp4_crtc->cursor.next_iova;
@@ -479,6 +522,11 @@ static void update_cursor(struct drm_crtc *crtc)
                 mdp4_crtc->cursor.scanout_bo = next_bo;
                 mdp4_crtc->cursor.stale = false;
         }
+
+        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_POS(dma),
+                        MDP4_DMA_CURSOR_POS_X(mdp4_crtc->cursor.x) |
+                        MDP4_DMA_CURSOR_POS_Y(mdp4_crtc->cursor.y));
+
         spin_unlock_irqrestore(&mdp4_crtc->cursor.lock, flags);
 }
 
@@ -530,6 +578,7 @@ static int mdp4_crtc_cursor_set(struct drm_crtc *crtc,
                 drm_gem_object_unreference_unlocked(old_bo);
         }
 
+        crtc_flush(crtc);
         request_pending(crtc, PENDING_CURSOR);
 
         return 0;
@@ -542,12 +591,15 @@ fail:
 static int mdp4_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
 {
         struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
-        struct mdp4_kms *mdp4_kms = get_kms(crtc);
-        enum mdp4_dma dma = mdp4_crtc->dma;
+        unsigned long flags;
 
-        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_POS(dma),
-                        MDP4_DMA_CURSOR_POS_X(x) |
-                        MDP4_DMA_CURSOR_POS_Y(y));
+        spin_lock_irqsave(&mdp4_crtc->cursor.lock, flags);
+        mdp4_crtc->cursor.x = x;
+        mdp4_crtc->cursor.y = y;
+        spin_unlock_irqrestore(&mdp4_crtc->cursor.lock, flags);
+
+        crtc_flush(crtc);
+        request_pending(crtc, PENDING_CURSOR);
 
         return 0;
 }
@@ -713,6 +765,7 @@ struct drm_crtc *mdp4_crtc_init(struct drm_device *dev,
         crtc = &mdp4_crtc->base;
 
         mdp4_crtc->plane = plane;
+        mdp4_crtc->id = id;
 
         mdp4_crtc->ovlp = ovlp_id;
         mdp4_crtc->dma = dma_id;
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c
index 2406027200ec..1e893dd13859 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c
@@ -170,8 +170,8 @@ int mdp4_plane_mode_set(struct drm_plane *plane,
                         MDP4_PIPE_DST_SIZE_HEIGHT(crtc_h));
 
         mdp4_write(mdp4_kms, REG_MDP4_PIPE_DST_XY(pipe),
-                        MDP4_PIPE_SRC_XY_X(crtc_x) |
-                        MDP4_PIPE_SRC_XY_Y(crtc_y));
+                        MDP4_PIPE_DST_XY_X(crtc_x) |
+                        MDP4_PIPE_DST_XY_Y(crtc_y));
 
         mdp4_plane_set_scanout(plane, fb);
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 71a3b2345eb3..f2794021f086 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -296,6 +296,7 @@ static int mdp5_crtc_mode_set(struct drm_crtc *crtc,
                         x << 16, y << 16,
                         mode->hdisplay << 16, mode->vdisplay << 16);
         if (ret) {
+                drm_framebuffer_unreference(crtc->fb);
                 dev_err(crtc->dev->dev, "%s: failed to set mode on plane: %d\n",
                                 mdp5_crtc->name, ret);
                 return ret;
@@ -343,11 +344,15 @@ static int mdp5_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
                         0, 0, mode->hdisplay, mode->vdisplay,
                         x << 16, y << 16,
                         mode->hdisplay << 16, mode->vdisplay << 16);
+        if (ret) {
+                drm_framebuffer_unreference(crtc->fb);
+                return ret;
+        }
 
         update_fb(crtc, crtc->fb);
         update_scanout(crtc, crtc->fb);
 
-        return ret;
+        return 0;
 }
 
 static void mdp5_crtc_load_lut(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index d8d60c969ac7..3da8264d3039 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -644,7 +644,7 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev,
 
 fail:
         if (obj)
-                drm_gem_object_unreference_unlocked(obj);
+                drm_gem_object_unreference(obj);
 
         return ERR_PTR(ret);
 }
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 5281d4bc37f7..5423e914e491 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -163,7 +163,7 @@ retry:
 
 
                 /* if locking succeeded, pin bo: */
-                ret = msm_gem_get_iova(&msm_obj->base,
+                ret = msm_gem_get_iova_locked(&msm_obj->base,
                                 submit->gpu->id, &iova);
 
                 /* this would break the logic in the fail path.. there is no
@@ -247,7 +247,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
         /* For now, just map the entire thing.  Eventually we probably
          * to do it page-by-page, w/ kmap() if not vmap()d..
          */
-        ptr = msm_gem_vaddr(&obj->base);
+        ptr = msm_gem_vaddr_locked(&obj->base);
 
         if (IS_ERR(ptr)) {
                 ret = PTR_ERR(ptr);
@@ -307,14 +307,12 @@ static void submit_cleanup(struct msm_gem_submit *submit, bool fail)
 {
         unsigned i;
 
-        mutex_lock(&submit->dev->struct_mutex);
         for (i = 0; i < submit->nr_bos; i++) {
                 struct msm_gem_object *msm_obj = submit->bos[i].obj;
                 submit_unlock_unpin_bo(submit, i);
                 list_del_init(&msm_obj->submit_entry);
                 drm_gem_object_unreference(&msm_obj->base);
         }
-        mutex_unlock(&submit->dev->struct_mutex);
 
         ww_acquire_fini(&submit->ticket);
         kfree(submit);
@@ -342,6 +340,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (args->nr_cmds > MAX_CMDS)
                 return -EINVAL;
 
+        mutex_lock(&dev->struct_mutex);
+
         submit = submit_create(dev, gpu, args->nr_bos);
         if (!submit) {
                 ret = -ENOMEM;
@@ -410,5 +410,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
 out:
         if (submit)
                 submit_cleanup(submit, !!ret);
+        mutex_unlock(&dev->struct_mutex);
         return ret;
 }
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 4ebce8be489d..0cfe3f426ee4 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -298,8 +298,6 @@ int msm_gpu_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
         struct msm_drm_private *priv = dev->dev_private;
         int i, ret;
 
-        mutex_lock(&dev->struct_mutex);
-
         submit->fence = ++priv->next_fence;
 
         gpu->submitted_fence = submit->fence;
@@ -331,7 +329,6 @@ int msm_gpu_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
                         msm_gem_move_to_active(&msm_obj->base, gpu, true, submit->fence);
         }
         hangcheck_timer_reset(gpu);
-        mutex_unlock(&dev->struct_mutex);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index e88145ba1bf5..d310c195bdfe 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -141,6 +141,7 @@ nouveau-y += core/subdev/mc/base.o
 nouveau-y += core/subdev/mc/nv04.o
 nouveau-y += core/subdev/mc/nv40.o
 nouveau-y += core/subdev/mc/nv44.o
+nouveau-y += core/subdev/mc/nv4c.o
 nouveau-y += core/subdev/mc/nv50.o
 nouveau-y += core/subdev/mc/nv94.o
 nouveau-y += core/subdev/mc/nv98.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv40.c b/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
index 1b653dd74a70..08b88591ed60 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
@@ -311,7 +311,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
@@ -334,7 +334,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv4e_fb_oclass;
@@ -357,7 +357,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
@@ -380,7 +380,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
@@ -403,7 +403,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 940eaa5d8b9a..9ad722e4e087 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -1142,7 +1142,7 @@ nv50_disp_intr_unk20_2(struct nv50_disp_priv *priv, int head)
         if (conf != ~0) {
                 if (outp.location == 0 && outp.type == DCB_OUTPUT_DP) {
                         u32 soff = (ffs(outp.or) - 1) * 0x08;
-                        u32 ctrl = nv_rd32(priv, 0x610798 + soff);
+                        u32 ctrl = nv_rd32(priv, 0x610794 + soff);
                         u32 datarate;
 
                         switch ((ctrl & 0x000f0000) >> 16) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
index 9a850fe19515..54c1b5b471cd 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
@@ -112,7 +112,7 @@ nve0_fifo_runlist_update(struct nve0_fifo_priv *priv, u32 engine)
 
         nv_wr32(priv, 0x002270, cur->addr >> 12);
         nv_wr32(priv, 0x002274, (engine << 20) | (p >> 3));
-        if (!nv_wait(priv, 0x002284 + (engine * 4), 0x00100000, 0x00000000))
+        if (!nv_wait(priv, 0x002284 + (engine * 8), 0x00100000, 0x00000000))
                 nv_error(priv, "runlist %d update timeout\n", engine);
         mutex_unlock(&nv_subdev(priv)->mutex);
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c b/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
index 30ed19c52e05..7a367c402978 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
@@ -539,7 +539,7 @@ nv50_priv_tp_trap(struct nv50_graph_priv *priv, int type, u32 ustatus_old,
                                 ustatus &= ~0x04030000;
                         }
                         if (ustatus && display) {
-                                nv_error("%s - TP%d:", name, i);
+                                nv_error(priv, "%s - TP%d:", name, i);
                                 nouveau_bitfield_print(nv50_mpc_traps, ustatus);
                                 pr_cont("\n");
                                 ustatus = 0;
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
index adc88b73d911..3c6738edd127 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
@@ -47,6 +47,7 @@ struct nouveau_mc_oclass {
 extern struct nouveau_oclass *nv04_mc_oclass;
 extern struct nouveau_oclass *nv40_mc_oclass;
 extern struct nouveau_oclass *nv44_mc_oclass;
+extern struct nouveau_oclass *nv4c_mc_oclass;
 extern struct nouveau_oclass *nv50_mc_oclass;
 extern struct nouveau_oclass *nv94_mc_oclass;
 extern struct nouveau_oclass *nv98_mc_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
index aa0fbbec7f08..ef0c9c4a8cc3 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
@@ -130,6 +130,10 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
         u16 pcir;
         int i;
 
+        /* there is no prom on nv4x IGP's */
+        if (device->card_type == NV_40 && device->chipset >= 0x4c)
+                return;
+
         /* enable access to rom */
         if (device->card_type >= NV_50)
                 pcireg = 0x088050;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c
index 9159a5ccee93..265d1253624a 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c
@@ -36,7 +36,7 @@ nv1a_fb_oclass = &(struct nv04_fb_impl) {
                 .fini = _nouveau_fb_fini,
         },
         .base.memtype = nv04_fb_memtype_valid,
-        .base.ram = &nv10_ram_oclass,
+        .base.ram = &nv1a_ram_oclass,
         .tile.regions = 8,
         .tile.init = nv10_fb_tile_init,
         .tile.fini = nv10_fb_tile_fini,
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
index b0d5c31606c1..81a408e7d034 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
@@ -14,6 +14,7 @@ int  nv04_mc_ctor(struct nouveau_object *, struct nouveau_object *,
 extern const struct nouveau_mc_intr nv04_mc_intr[];
 int  nv04_mc_init(struct nouveau_object *);
 void nv40_mc_msi_rearm(struct nouveau_mc *);
+int  nv44_mc_init(struct nouveau_object *object);
 int  nv50_mc_init(struct nouveau_object *);
 extern const struct nouveau_mc_intr nv50_mc_intr[];
 extern const struct nouveau_mc_intr nvc0_mc_intr[];
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
index 3bfee5c6c4f2..cc4d0d2d886e 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
@@ -24,7 +24,7 @@
 
 #include "nv04.h"
 
-static int
+int
 nv44_mc_init(struct nouveau_object *object)
 {
         struct nv04_mc_priv *priv = (void *)object;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
new file mode 100644
index 000000000000..a75c35ccf25c
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2014 Ilia Mirkin
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ilia Mirkin
+ */
+
+#include "nv04.h"
+
+static void
+nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
+{
+        struct nv04_mc_priv *priv = (void *)pmc;
+        nv_wr08(priv, 0x088050, 0xff);
+}
+
+struct nouveau_oclass *
+nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
+        .base.handle = NV_SUBDEV(MC, 0x4c),
+        .base.ofuncs = &(struct nouveau_ofuncs) {
+                .ctor = nv04_mc_ctor,
+                .dtor = _nouveau_mc_dtor,
+                .init = nv44_mc_init,
+                .fini = _nouveau_mc_fini,
+        },
+        .intr = nv04_mc_intr,
+        .msi_rearm = nv4c_mc_msi_rearm,
+}.base;
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 4ef83df2b246..83face3f608f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -106,6 +106,29 @@ static int nouveau_optimus_dsm(acpi_handle handle, int func, int arg, uint32_t *
         return 0;
 }
 
+/*
+ * On some platforms, _DSM(nouveau_op_dsm_muid, func0) has special
+ * requirements on the fourth parameter, so a private implementation
+ * instead of using acpi_check_dsm().
+ */
+static int nouveau_check_optimus_dsm(acpi_handle handle)
+{
+        int result;
+
+        /*
+         * Function 0 returns a Buffer containing available functions.
+         * The args parameter is ignored for function 0, so just put 0 in it
+         */
+        if (nouveau_optimus_dsm(handle, 0, 0, &result))
+                return 0;
+
+        /*
+         * ACPI Spec v4 9.14.1: if bit 0 is zero, no function is supported.
+         * If the n-th bit is enabled, function n is supported
+         */
+        return result & 1 && result & (1 << NOUVEAU_DSM_OPTIMUS_CAPS);
+}
+
 static int nouveau_dsm(acpi_handle handle, int func, int arg)
 {
         int ret = 0;
@@ -207,8 +230,7 @@ static int nouveau_dsm_pci_probe(struct pci_dev *pdev)
                            1 << NOUVEAU_DSM_POWER))
                 retval |= NOUVEAU_DSM_HAS_MUX;
 
-        if (acpi_check_dsm(dhandle, nouveau_op_dsm_muid, 0x00000100,
-                           1 << NOUVEAU_DSM_OPTIMUS_CAPS))
+        if (nouveau_check_optimus_dsm(dhandle))
                 retval |= NOUVEAU_DSM_HAS_OPT;
 
         if (retval & NOUVEAU_DSM_HAS_OPT) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 488686d490c0..4aed1714b9ab 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1249,7 +1249,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem)
                         mem->bus.is_iomem = !dev->agp->cant_use_aperture;
                 }
 #endif
-                if (!node->memtype)
+                if (nv_device(drm->device)->card_type < NV_50 || !node->memtype)
                         /* untiled */
                         break;
                 /* fallthrough, tiled memory */
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 78c8e7146d56..89c484d8ac26 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -376,6 +376,8 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto fail_device;
 
+        dev->irq_enabled = true;
+
         /* workaround an odd issue on nvc1 by disabling the device's
          * nosnoop capability.  hopefully won't cause issues until a
          * better fix is found - assuming there is one...
@@ -475,6 +477,7 @@ nouveau_drm_remove(struct pci_dev *pdev)
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nouveau_object *device;
 
+        dev->irq_enabled = false;
         device = drm->client.base.device;
         drm_put_dev(dev);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index 81638d7f2eff..471347edc27e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -14,7 +14,9 @@ nouveau_vga_set_decode(void *priv, bool state)
 {
         struct nouveau_device *device = nouveau_dev(priv);
 
-        if (device->chipset >= 0x40)
+        if (device->card_type == NV_40 && device->chipset >= 0x4c)
+                nv_wr32(device, 0x088060, state);
+        else if (device->chipset >= 0x40)
                 nv_wr32(device, 0x088054, state);
         else
                 nv_wr32(device, 0x001854, state);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index a9338c85630f..0d19f4f94d5a 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -559,7 +559,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
         u32 adjusted_clock = mode->clock;
         int encoder_mode = atombios_get_encoder_mode(encoder);
         u32 dp_clock = mode->clock;
-        int bpc = radeon_get_monitor_bpc(connector);
+        int bpc = radeon_crtc->bpc;
         bool is_duallink = radeon_dig_monitor_is_duallink(encoder, mode->clock);
 
         /* reset the pll flags */
@@ -1176,7 +1176,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                 evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
 
                 /* Set NUM_BANKS. */
-                if (rdev->family >= CHIP_BONAIRE) {
+                if (rdev->family >= CHIP_TAHITI) {
                         unsigned tileb, index, num_banks, tile_split_bytes;
 
                         /* Calculate the macrotile mode index. */
@@ -1194,13 +1194,14 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                                 return -EINVAL;
                         }
 
-                        num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
+                        if (rdev->family >= CHIP_BONAIRE)
+                                num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
+                        else
+                                num_banks = (rdev->config.si.tile_mode_array[index] >> 20) & 0x3;
                         fb_format |= EVERGREEN_GRPH_NUM_BANKS(num_banks);
                 } else {
-                        /* SI and older. */
-                        if (rdev->family >= CHIP_TAHITI)
-                                tmp = rdev->config.si.tile_config;
-                        else if (rdev->family >= CHIP_CAYMAN)
+                        /* NI and older. */
+                        if (rdev->family >= CHIP_CAYMAN)
                                 tmp = rdev->config.cayman.tile_config;
                         else
                                 tmp = rdev->config.evergreen.tile_config;
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index a42d61571f49..2cec2ab02f80 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -464,11 +464,12 @@ atombios_tv_setup(struct drm_encoder *encoder, int action)
 
 static u8 radeon_atom_get_bpc(struct drm_encoder *encoder)
 {
-        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
         int bpc = 8;
 
-        if (connector)
-                bpc = radeon_get_monitor_bpc(connector);
+        if (encoder->crtc) {
+                struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
+                bpc = radeon_crtc->bpc;
+        }
 
         switch (bpc) {
         case 0:
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 0fbd36f3d4e9..ea103ccdf4bd 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -29,6 +29,7 @@
 #include "cypress_dpm.h"
 #include "btc_dpm.h"
 #include "atom.h"
+#include <linux/seq_file.h>
 
 #define MC_CG_ARB_FREQ_F0           0x0a
 #define MC_CG_ARB_FREQ_F1           0x0b
@@ -2756,6 +2757,37 @@ void btc_dpm_fini(struct radeon_device *rdev)
         r600_free_extended_power_table(rdev);
 }
 
+void btc_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
+                                                     struct seq_file *m)
+{
+        struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
+        struct radeon_ps *rps = &eg_pi->current_rps;
+        struct rv7xx_ps *ps = rv770_get_ps(rps);
+        struct rv7xx_pl *pl;
+        u32 current_index =
+                (RREG32(TARGET_AND_CURRENT_PROFILE_INDEX) & CURRENT_PROFILE_INDEX_MASK) >>
+                CURRENT_PROFILE_INDEX_SHIFT;
+
+        if (current_index > 2) {
+                seq_printf(m, "invalid dpm profile %d\n", current_index);
+        } else {
+                if (current_index == 0)
+                        pl = &ps->low;
+                else if (current_index == 1)
+                        pl = &ps->medium;
+                else /* current_index == 2 */
+                        pl = &ps->high;
+                seq_printf(m, "uvd    vclk: %d dclk: %d\n", rps->vclk, rps->dclk);
+                if (rdev->family >= CHIP_CEDAR) {
+                        seq_printf(m, "power level %d    sclk: %u mclk: %u vddc: %u vddci: %u\n",
+                                   current_index, pl->sclk, pl->mclk, pl->vddc, pl->vddci);
+                } else {
+                        seq_printf(m, "power level %d    sclk: %u mclk: %u vddc: %u\n",
+                                   current_index, pl->sclk, pl->mclk, pl->vddc);
+                }
+        }
+}
+
 u32 btc_dpm_get_sclk(struct radeon_device *rdev, bool low)
 {
         struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
diff --git a/drivers/gpu/drm/radeon/btcd.h b/drivers/gpu/drm/radeon/btcd.h
index 29e32de7e025..9c65be2d55a9 100644
--- a/drivers/gpu/drm/radeon/btcd.h
+++ b/drivers/gpu/drm/radeon/btcd.h
@@ -44,6 +44,10 @@
 #       define DYN_SPREAD_SPECTRUM_EN                   (1 << 23)
 #       define AC_DC_SW                                 (1 << 24)
 
+#define TARGET_AND_CURRENT_PROFILE_INDEX                  0x66c
+#       define CURRENT_PROFILE_INDEX_MASK                 (0xf << 4)
+#       define CURRENT_PROFILE_INDEX_SHIFT                4
+
 #define CG_BIF_REQ_AND_RSP                              0x7f4
 #define         CG_CLIENT_REQ(x)                        ((x) << 0)
 #define         CG_CLIENT_REQ_MASK                      (0xff << 0)
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f2b9e21ce4da..5623e7542d99 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1680,7 +1680,7 @@ bool evergreen_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd)
         case RADEON_HPD_6:
                 if (RREG32(DC_HPD6_INT_STATUS) & DC_HPDx_SENSE)
                         connected = true;
-                        break;
+                break;
         default:
                 break;
         }
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index b6e01d5d2cce..351db361239d 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -1223,7 +1223,7 @@ int kv_dpm_enable(struct radeon_device *rdev)
 
 int kv_dpm_late_enable(struct radeon_device *rdev)
 {
-        int ret;
+        int ret = 0;
 
         if (rdev->irq.installed &&
             r600_is_internal_thermal_sensor(rdev->pm.int_thermal_type)) {
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index c351226ecb31..ca814276b075 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -2588,7 +2588,7 @@ static int ni_populate_sq_ramping_values(struct radeon_device *rdev,
         if (NISLANDS_DPM2_SQ_RAMP_STI_SIZE > (STI_SIZE_MASK >> STI_SIZE_SHIFT))
                 enable_sq_ramping = false;
 
-        if (NISLANDS_DPM2_SQ_RAMP_LTI_RATIO <= (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
+        if (NISLANDS_DPM2_SQ_RAMP_LTI_RATIO > (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
                 enable_sq_ramping = false;
 
         for (i = 0; i < state->performance_level_count; i++) {
@@ -3945,7 +3945,6 @@ static void ni_parse_pplib_clock_info(struct radeon_device *rdev,
         struct rv7xx_power_info *pi = rv770_get_pi(rdev);
         struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
         struct ni_ps *ps = ni_get_ps(rps);
-        u16 vddc;
         struct rv7xx_pl *pl = &ps->performance_levels[index];
 
         ps->performance_level_count = index + 1;
@@ -3961,8 +3960,8 @@ static void ni_parse_pplib_clock_info(struct radeon_device *rdev,
 
         /* patch up vddc if necessary */
         if (pl->vddc == 0xff01) {
-                if (radeon_atom_get_max_vddc(rdev, 0, 0, &vddc) == 0)
-                        pl->vddc = vddc;
+                if (pi->max_vddc)
+                        pl->vddc = pi->max_vddc;
         }
 
         if (rps->class & ATOM_PPLIB_CLASSIFICATION_ACPI) {
@@ -4322,7 +4321,8 @@ void ni_dpm_print_power_state(struct radeon_device *rdev,
 void ni_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
                                                     struct seq_file *m)
 {
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
+        struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
+        struct radeon_ps *rps = &eg_pi->current_rps;
         struct ni_ps *ps = ni_get_ps(rps);
         struct rv7xx_pl *pl;
         u32 current_index =
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 56140b4e5bb2..cdbc4171fe73 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3991,6 +3991,10 @@ restart_ih:
                                 break;
                         }
                         break;
+                case 124: /* UVD */
+                        DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
+                        radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
+                        break;
                 case 176: /* CP_INT in ring buffer */
                 case 177: /* CP_INT in IB1 */
                 case 178: /* CP_INT in IB2 */
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 4a8ac1cd6b4c..024db37b1832 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -135,6 +135,9 @@ extern int radeon_hard_reset;
 /* R600+ */
 #define R600_RING_TYPE_UVD_INDEX        5
 
+/* number of hw syncs before falling back on blocking */
+#define RADEON_NUM_SYNCS                        4
+
 /* hardcode those limit for now */
 #define RADEON_VA_IB_OFFSET                     (1 << 20)
 #define RADEON_VA_RESERVED_SIZE                 (8 << 20)
@@ -554,7 +557,6 @@ int radeon_mode_dumb_mmap(struct drm_file *filp,
 /*
  * Semaphores.
  */
-/* everything here is constant */
 struct radeon_semaphore {
         struct radeon_sa_bo             *sa_bo;
         signed                          waiters;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index f74db43346fd..dda02bfc10a4 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1555,7 +1555,7 @@ static struct radeon_asic btc_asic = {
                 .get_sclk = &btc_dpm_get_sclk,
                 .get_mclk = &btc_dpm_get_mclk,
                 .print_power_state = &rv770_dpm_print_power_state,
-                .debugfs_print_current_performance_level = &rv770_dpm_debugfs_print_current_performance_level,
+                .debugfs_print_current_performance_level = &btc_dpm_debugfs_print_current_performance_level,
                 .force_performance_level = &rv770_dpm_force_performance_level,
                 .vblank_too_short = &btc_dpm_vblank_too_short,
         },
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index b3bc433eed4c..ae637cfda783 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -551,6 +551,8 @@ void btc_dpm_fini(struct radeon_device *rdev);
 u32 btc_dpm_get_sclk(struct radeon_device *rdev, bool low);
 u32 btc_dpm_get_mclk(struct radeon_device *rdev, bool low);
 bool btc_dpm_vblank_too_short(struct radeon_device *rdev);
+void btc_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
+                                                     struct seq_file *m);
 int sumo_dpm_init(struct radeon_device *rdev);
 int sumo_dpm_enable(struct radeon_device *rdev);
 int sumo_dpm_late_enable(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index d680608f6f5b..fbd8b930f2be 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -571,6 +571,8 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
                 radeon_crtc->max_cursor_width = CURSOR_WIDTH;
                 radeon_crtc->max_cursor_height = CURSOR_HEIGHT;
         }
+        dev->mode_config.cursor_width = radeon_crtc->max_cursor_width;
+        dev->mode_config.cursor_height = radeon_crtc->max_cursor_height;
 
 #if 0
         radeon_crtc->mode_set.crtc = &radeon_crtc->base;
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 1b783f0e6d3a..15e44a7281ab 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -139,7 +139,7 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
         }
 
         /* 64 dwords should be enough for fence too */
-        r = radeon_ring_lock(rdev, ring, 64 + RADEON_NUM_RINGS * 8);
+        r = radeon_ring_lock(rdev, ring, 64 + RADEON_NUM_SYNCS * 8);
         if (r) {
                 dev_err(rdev->dev, "scheduling IB failed (%d).\n", r);
                 return r;
diff --git a/drivers/gpu/drm/radeon/radeon_semaphore.c b/drivers/gpu/drm/radeon/radeon_semaphore.c
index 2b42aa1914f2..9006b32d5eed 100644
--- a/drivers/gpu/drm/radeon/radeon_semaphore.c
+++ b/drivers/gpu/drm/radeon/radeon_semaphore.c
@@ -34,14 +34,15 @@
 int radeon_semaphore_create(struct radeon_device *rdev,
                             struct radeon_semaphore **semaphore)
 {
+        uint32_t *cpu_addr;
         int i, r;
 
         *semaphore = kmalloc(sizeof(struct radeon_semaphore), GFP_KERNEL);
         if (*semaphore == NULL) {
                 return -ENOMEM;
         }
-        r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo,
-                             &(*semaphore)->sa_bo, 8, 8, true);
+        r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo, &(*semaphore)->sa_bo,
+                             8 * RADEON_NUM_SYNCS, 8, true);
         if (r) {
                 kfree(*semaphore);
                 *semaphore = NULL;
@@ -49,7 +50,10 @@ int radeon_semaphore_create(struct radeon_device *rdev,
         }
         (*semaphore)->waiters = 0;
         (*semaphore)->gpu_addr = radeon_sa_bo_gpu_addr((*semaphore)->sa_bo);
-        *((uint64_t*)radeon_sa_bo_cpu_addr((*semaphore)->sa_bo)) = 0;
+
+        cpu_addr = radeon_sa_bo_cpu_addr((*semaphore)->sa_bo);
+        for (i = 0; i < RADEON_NUM_SYNCS; ++i)
+                cpu_addr[i] = 0;
 
         for (i = 0; i < RADEON_NUM_RINGS; ++i)
                 (*semaphore)->sync_to[i] = NULL;
@@ -125,6 +129,7 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                                 struct radeon_semaphore *semaphore,
                                 int ring)
 {
+        unsigned count = 0;
         int i, r;
 
         for (i = 0; i < RADEON_NUM_RINGS; ++i) {
@@ -140,6 +145,12 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                         return -EINVAL;
                 }
 
+                if (++count > RADEON_NUM_SYNCS) {
+                        /* not enough room, wait manually */
+                        radeon_fence_wait_locked(fence);
+                        continue;
+                }
+
                 /* allocate enough space for sync command */
                 r = radeon_ring_alloc(rdev, &rdev->ring[i], 16);
                 if (r) {
@@ -164,6 +175,8 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
 
                 radeon_ring_commit(rdev, &rdev->ring[i]);
                 radeon_fence_note_sync(fence, ring);
+
+                semaphore->gpu_addr += 8;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 80c595aba359..b5f63f5e22a3 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2174,7 +2174,6 @@ static void rv7xx_parse_pplib_clock_info(struct radeon_device *rdev,
         struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
         struct rv7xx_ps *ps = rv770_get_ps(rps);
         u32 sclk, mclk;
-        u16 vddc;
         struct rv7xx_pl *pl;
 
         switch (index) {
@@ -2214,8 +2213,8 @@ static void rv7xx_parse_pplib_clock_info(struct radeon_device *rdev,
 
         /* patch up vddc if necessary */
         if (pl->vddc == 0xff01) {
-                if (radeon_atom_get_max_vddc(rdev, 0, 0, &vddc) == 0)
-                        pl->vddc = vddc;
+                if (pi->max_vddc)
+                        pl->vddc = pi->max_vddc;
         }
 
         if (rps->class & ATOM_PPLIB_CLASSIFICATION_ACPI) {
@@ -2527,14 +2526,7 @@ u32 rv770_dpm_get_mclk(struct radeon_device *rdev, bool low)
 bool rv770_dpm_vblank_too_short(struct radeon_device *rdev)
 {
         u32 vblank_time = r600_dpm_get_vblank_time(rdev);
-        u32 switch_limit = 300;
-
-        /* quirks */
-        /* ASUS K70AF */
-        if ((rdev->pdev->device == 0x9553) &&
-            (rdev->pdev->subsystem_vendor == 0x1043) &&
-            (rdev->pdev->subsystem_device == 0x1c42))
-                switch_limit = 200;
+        u32 switch_limit = 200; /* 300 */
 
         /* RV770 */
         /* mclk switching doesn't seem to work reliably on desktop RV770s */
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 09ec4f6c53bb..83578324e5d1 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6338,6 +6338,10 @@ restart_ih:
                                 break;
                         }
                         break;
+                case 124: /* UVD */
+                        DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
+                        radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
+                        break;
                 case 146:
                 case 147:
                         addr = RREG32(VM_CONTEXT1_PROTECTION_FAULT_ADDR);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 0471501338fb..0a2f5b4bca43 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2395,7 +2395,7 @@ static int si_populate_sq_ramping_values(struct radeon_device *rdev,
         if (SISLANDS_DPM2_SQ_RAMP_STI_SIZE > (STI_SIZE_MASK >> STI_SIZE_SHIFT))
                 enable_sq_ramping = false;
 
-        if (SISLANDS_DPM2_SQ_RAMP_LTI_RATIO <= (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
+        if (SISLANDS_DPM2_SQ_RAMP_LTI_RATIO > (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
                 enable_sq_ramping = false;
 
         for (i = 0; i < state->performance_level_count; i++) {
@@ -6472,7 +6472,8 @@ void si_dpm_fini(struct radeon_device *rdev)
 void si_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
                                                     struct seq_file *m)
 {
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
+        struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
+        struct radeon_ps *rps = &eg_pi->current_rps;
         struct ni_ps *ps = ni_get_ps(rps);
         struct rv7xx_pl *pl;
         u32 current_index =
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index f121efe12dc5..8b47b3cd0357 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1807,7 +1807,7 @@ void sumo_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev
                                                       struct seq_file *m)
 {
         struct sumo_power_info *pi = sumo_get_pi(rdev);
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
+        struct radeon_ps *rps = &pi->current_rps;
         struct sumo_ps *ps = sumo_get_ps(rps);
         struct sumo_pl *pl;
         u32 current_index =
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 2d447192d6f7..2da0e17eb960 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1926,7 +1926,8 @@ void trinity_dpm_print_power_state(struct radeon_device *rdev,
 void trinity_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
                                                          struct seq_file *m)
 {
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
+        struct trinity_power_info *pi = trinity_get_pi(rdev);
+        struct radeon_ps *rps = &pi->current_rps;
         struct trinity_ps *ps = trinity_get_ps(rps);
         struct trinity_pl *pl;
         u32 current_index =
diff --git a/drivers/gpu/drm/radeon/uvd_v2_2.c b/drivers/gpu/drm/radeon/uvd_v2_2.c
index 824550db3fed..d1771004cb52 100644
--- a/drivers/gpu/drm/radeon/uvd_v2_2.c
+++ b/drivers/gpu/drm/radeon/uvd_v2_2.c
@@ -57,7 +57,6 @@ void uvd_v2_2_fence_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, 0);
         radeon_ring_write(ring, PACKET0(UVD_GPCOM_VCPU_CMD, 0));
         radeon_ring_write(ring, 2);
-        return;
 }
 
 /**
diff --git a/drivers/gpu/drm/ttm/ttm_agp_backend.c b/drivers/gpu/drm/ttm/ttm_agp_backend.c
index 3302f99e7497..764be36397fd 100644
--- a/drivers/gpu/drm/ttm/ttm_agp_backend.c
+++ b/drivers/gpu/drm/ttm/ttm_agp_backend.c
@@ -126,6 +126,7 @@ struct ttm_tt *ttm_agp_tt_create(struct ttm_bo_device *bdev,
         agp_be->ttm.func = &ttm_agp_func;
 
         if (ttm_tt_init(&agp_be->ttm, bdev, size, page_flags, dummy_read_page)) {
+                kfree(agp_be);
                 return NULL;
         }
 
diff --git a/drivers/gpu/drm/vmwgfx/svga3d_reg.h b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
index b645647b7776..bb594c11605e 100644
--- a/drivers/gpu/drm/vmwgfx/svga3d_reg.h
+++ b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
@@ -1223,9 +1223,19 @@ typedef enum {
 #define SVGA_3D_CMD_INVALIDATE_GB_IMAGE_PARTIAL 1129
 
 #define SVGA_3D_CMD_SET_GB_SHADERCONSTS_INLINE  1130
-
+#define SVGA_3D_CMD_GB_SCREEN_DMA               1131
+#define SVGA_3D_CMD_BIND_GB_SURFACE_WITH_PITCH  1132
+#define SVGA_3D_CMD_GB_MOB_FENCE                1133
+#define SVGA_3D_CMD_DEFINE_GB_SURFACE_V2        1134
 #define SVGA_3D_CMD_DEFINE_GB_MOB64          1135
 #define SVGA_3D_CMD_REDEFINE_GB_MOB64        1136
+#define SVGA_3D_CMD_NOP_ERROR                1137
+
+#define SVGA_3D_CMD_RESERVED1                1138
+#define SVGA_3D_CMD_RESERVED2                1139
+#define SVGA_3D_CMD_RESERVED3                1140
+#define SVGA_3D_CMD_RESERVED4                1141
+#define SVGA_3D_CMD_RESERVED5                1142
 
 #define SVGA_3D_CMD_MAX                      1142
 #define SVGA_3D_CMD_FUTURE_MAX               3000
@@ -1973,8 +1983,7 @@ struct {
    uint32 sizeInBytes;
    uint32 validSizeInBytes;
    SVGAMobFormat ptDepth;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdSetOTableBase;  /* SVGA_3D_CMD_SET_OTABLE_BASE */
 
 typedef
@@ -1984,15 +1993,13 @@ struct {
    uint32 sizeInBytes;
    uint32 validSizeInBytes;
    SVGAMobFormat ptDepth;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdSetOTableBase64;  /* SVGA_3D_CMD_SET_OTABLE_BASE64 */
 
 typedef
 struct {
    SVGAOTableType type;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdReadbackOTable;  /* SVGA_3D_CMD_READBACK_OTABLE */
 
 /*
@@ -2005,8 +2012,7 @@ struct SVGA3dCmdDefineGBMob {
    SVGAMobFormat ptDepth;
    PPN base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdDefineGBMob;   /* SVGA_3D_CMD_DEFINE_GB_MOB */
 
 
@@ -2017,8 +2023,7 @@ SVGA3dCmdDefineGBMob;   /* SVGA_3D_CMD_DEFINE_GB_MOB */
 typedef
 struct SVGA3dCmdDestroyGBMob {
    SVGAMobId mobid;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdDestroyGBMob;   /* SVGA_3D_CMD_DESTROY_GB_MOB */
 
 /*
@@ -2031,8 +2036,7 @@ struct SVGA3dCmdRedefineGBMob {
    SVGAMobFormat ptDepth;
    PPN base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdRedefineGBMob;   /* SVGA_3D_CMD_REDEFINE_GB_MOB */
 
 /*
@@ -2045,8 +2049,7 @@ struct SVGA3dCmdDefineGBMob64 {
    SVGAMobFormat ptDepth;
    PPN64 base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdDefineGBMob64;   /* SVGA_3D_CMD_DEFINE_GB_MOB64 */
 
 /*
@@ -2059,8 +2062,7 @@ struct SVGA3dCmdRedefineGBMob64 {
    SVGAMobFormat ptDepth;
    PPN64 base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdRedefineGBMob64;   /* SVGA_3D_CMD_REDEFINE_GB_MOB64 */
 
 /*
@@ -2070,8 +2072,7 @@ SVGA3dCmdRedefineGBMob64;   /* SVGA_3D_CMD_REDEFINE_GB_MOB64 */
 typedef
 struct SVGA3dCmdUpdateGBMobMapping {
    SVGAMobId mobid;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdUpdateGBMobMapping;   /* SVGA_3D_CMD_UPDATE_GB_MOB_MAPPING */
 
 /*
@@ -2087,7 +2088,8 @@ struct SVGA3dCmdDefineGBSurface {
    uint32 multisampleCount;
    SVGA3dTextureFilter autogenFilter;
    SVGA3dSize size;
-} SVGA3dCmdDefineGBSurface;   /* SVGA_3D_CMD_DEFINE_GB_SURFACE */
+} __packed
+SVGA3dCmdDefineGBSurface;   /* SVGA_3D_CMD_DEFINE_GB_SURFACE */
 
 /*
  * Destroy a guest-backed surface.
@@ -2096,7 +2098,8 @@ struct SVGA3dCmdDefineGBSurface {
 typedef
 struct SVGA3dCmdDestroyGBSurface {
    uint32 sid;
-} SVGA3dCmdDestroyGBSurface;   /* SVGA_3D_CMD_DESTROY_GB_SURFACE */
+} __packed
+SVGA3dCmdDestroyGBSurface;   /* SVGA_3D_CMD_DESTROY_GB_SURFACE */
 
 /*
  * Bind a guest-backed surface to an object.
@@ -2106,7 +2109,8 @@ typedef
 struct SVGA3dCmdBindGBSurface {
    uint32 sid;
    SVGAMobId mobid;
-} SVGA3dCmdBindGBSurface;   /* SVGA_3D_CMD_BIND_GB_SURFACE */
+} __packed
+SVGA3dCmdBindGBSurface;   /* SVGA_3D_CMD_BIND_GB_SURFACE */
 
 /*
  * Conditionally bind a mob to a guest backed surface if testMobid
@@ -2123,7 +2127,7 @@ struct{
    SVGAMobId testMobid;
    SVGAMobId mobid;
    uint32 flags;
-}
+} __packed
 SVGA3dCmdCondBindGBSurface;          /* SVGA_3D_CMD_COND_BIND_GB_SURFACE */
 
 /*
@@ -2135,7 +2139,8 @@ typedef
 struct SVGA3dCmdUpdateGBImage {
    SVGA3dSurfaceImageId image;
    SVGA3dBox box;
-} SVGA3dCmdUpdateGBImage;   /* SVGA_3D_CMD_UPDATE_GB_IMAGE */
+} __packed
+SVGA3dCmdUpdateGBImage;   /* SVGA_3D_CMD_UPDATE_GB_IMAGE */
 
 /*
  * Update an entire guest-backed surface.
@@ -2145,7 +2150,8 @@ struct SVGA3dCmdUpdateGBImage {
 typedef
 struct SVGA3dCmdUpdateGBSurface {
    uint32 sid;
-} SVGA3dCmdUpdateGBSurface;   /* SVGA_3D_CMD_UPDATE_GB_SURFACE */
+} __packed
+SVGA3dCmdUpdateGBSurface;   /* SVGA_3D_CMD_UPDATE_GB_SURFACE */
 
 /*
  * Readback an image in a guest-backed surface.
@@ -2155,7 +2161,8 @@ struct SVGA3dCmdUpdateGBSurface {
 typedef
 struct SVGA3dCmdReadbackGBImage {
    SVGA3dSurfaceImageId image;
-} SVGA3dCmdReadbackGBImage;   /* SVGA_3D_CMD_READBACK_GB_IMAGE*/
+} __packed
+SVGA3dCmdReadbackGBImage;   /* SVGA_3D_CMD_READBACK_GB_IMAGE*/
 
 /*
  * Readback an entire guest-backed surface.
@@ -2165,7 +2172,8 @@ struct SVGA3dCmdReadbackGBImage {
 typedef
 struct SVGA3dCmdReadbackGBSurface {
    uint32 sid;
-} SVGA3dCmdReadbackGBSurface;   /* SVGA_3D_CMD_READBACK_GB_SURFACE */
+} __packed
+SVGA3dCmdReadbackGBSurface;   /* SVGA_3D_CMD_READBACK_GB_SURFACE */
 
 /*
  * Readback a sub rect of an image in a guest-backed surface.  After
@@ -2179,7 +2187,7 @@ struct SVGA3dCmdReadbackGBImagePartial {
    SVGA3dSurfaceImageId image;
    SVGA3dBox box;
    uint32 invertBox;
-}
+} __packed
 SVGA3dCmdReadbackGBImagePartial; /* SVGA_3D_CMD_READBACK_GB_IMAGE_PARTIAL */
 
 /*
@@ -2190,7 +2198,8 @@ SVGA3dCmdReadbackGBImagePartial; /* SVGA_3D_CMD_READBACK_GB_IMAGE_PARTIAL */
 typedef
 struct SVGA3dCmdInvalidateGBImage {
    SVGA3dSurfaceImageId image;
-} SVGA3dCmdInvalidateGBImage;   /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE */
+} __packed
+SVGA3dCmdInvalidateGBImage;   /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE */
 
 /*
  * Invalidate an entire guest-backed surface.
@@ -2200,7 +2209,8 @@ struct SVGA3dCmdInvalidateGBImage {
 typedef
 struct SVGA3dCmdInvalidateGBSurface {
    uint32 sid;
-} SVGA3dCmdInvalidateGBSurface; /* SVGA_3D_CMD_INVALIDATE_GB_SURFACE */
+} __packed
+SVGA3dCmdInvalidateGBSurface; /* SVGA_3D_CMD_INVALIDATE_GB_SURFACE */
 
 /*
  * Invalidate a sub rect of an image in a guest-backed surface.  After
@@ -2214,7 +2224,7 @@ struct SVGA3dCmdInvalidateGBImagePartial {
    SVGA3dSurfaceImageId image;
    SVGA3dBox box;
    uint32 invertBox;
-}
+} __packed
 SVGA3dCmdInvalidateGBImagePartial; /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE_PARTIAL */
 
 /*
@@ -2224,7 +2234,8 @@ SVGA3dCmdInvalidateGBImagePartial; /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE_PARTIAL */
 typedef
 struct SVGA3dCmdDefineGBContext {
    uint32 cid;
-} SVGA3dCmdDefineGBContext;   /* SVGA_3D_CMD_DEFINE_GB_CONTEXT */
+} __packed
+SVGA3dCmdDefineGBContext;   /* SVGA_3D_CMD_DEFINE_GB_CONTEXT */
 
 /*
  * Destroy a guest-backed context.
@@ -2233,7 +2244,8 @@ struct SVGA3dCmdDefineGBContext {
 typedef
 struct SVGA3dCmdDestroyGBContext {
    uint32 cid;
-} SVGA3dCmdDestroyGBContext;   /* SVGA_3D_CMD_DESTROY_GB_CONTEXT */
+} __packed
+SVGA3dCmdDestroyGBContext;   /* SVGA_3D_CMD_DESTROY_GB_CONTEXT */
 
 /*
  * Bind a guest-backed context.
@@ -2252,7 +2264,8 @@ struct SVGA3dCmdBindGBContext {
    uint32 cid;
    SVGAMobId mobid;
    uint32 validContents;
-} SVGA3dCmdBindGBContext;   /* SVGA_3D_CMD_BIND_GB_CONTEXT */
+} __packed
+SVGA3dCmdBindGBContext;   /* SVGA_3D_CMD_BIND_GB_CONTEXT */
 
 /*
  * Readback a guest-backed context.
@@ -2262,7 +2275,8 @@ struct SVGA3dCmdBindGBContext {
 typedef
 struct SVGA3dCmdReadbackGBContext {
    uint32 cid;
-} SVGA3dCmdReadbackGBContext;   /* SVGA_3D_CMD_READBACK_GB_CONTEXT */
+} __packed
+SVGA3dCmdReadbackGBContext;   /* SVGA_3D_CMD_READBACK_GB_CONTEXT */
 
 /*
  * Invalidate a guest-backed context.
@@ -2270,7 +2284,8 @@ struct SVGA3dCmdReadbackGBContext {
 typedef
 struct SVGA3dCmdInvalidateGBContext {
    uint32 cid;
-} SVGA3dCmdInvalidateGBContext;   /* SVGA_3D_CMD_INVALIDATE_GB_CONTEXT */
+} __packed
+SVGA3dCmdInvalidateGBContext;   /* SVGA_3D_CMD_INVALIDATE_GB_CONTEXT */
 
 /*
  * Define a guest-backed shader.
@@ -2281,7 +2296,8 @@ struct SVGA3dCmdDefineGBShader {
    uint32 shid;
    SVGA3dShaderType type;
    uint32 sizeInBytes;
-} SVGA3dCmdDefineGBShader;   /* SVGA_3D_CMD_DEFINE_GB_SHADER */
+} __packed
+SVGA3dCmdDefineGBShader;   /* SVGA_3D_CMD_DEFINE_GB_SHADER */
 
 /*
  * Bind a guest-backed shader.
@@ -2291,7 +2307,8 @@ typedef struct SVGA3dCmdBindGBShader {
    uint32 shid;
    SVGAMobId mobid;
    uint32 offsetInBytes;
-} SVGA3dCmdBindGBShader;   /* SVGA_3D_CMD_BIND_GB_SHADER */
+} __packed
+SVGA3dCmdBindGBShader;   /* SVGA_3D_CMD_BIND_GB_SHADER */
 
 /*
  * Destroy a guest-backed shader.
@@ -2299,7 +2316,8 @@ typedef struct SVGA3dCmdBindGBShader {
 
 typedef struct SVGA3dCmdDestroyGBShader {
    uint32 shid;
-} SVGA3dCmdDestroyGBShader;   /* SVGA_3D_CMD_DESTROY_GB_SHADER */
+} __packed
+SVGA3dCmdDestroyGBShader;   /* SVGA_3D_CMD_DESTROY_GB_SHADER */
 
 typedef
 struct {
@@ -2314,14 +2332,16 @@ struct {
     * Note that FLOAT and INT constants are 4-dwords in length, while
     * BOOL constants are 1-dword in length.
     */
-} SVGA3dCmdSetGBShaderConstInline;
+} __packed
+SVGA3dCmdSetGBShaderConstInline;
 /* SVGA_3D_CMD_SET_GB_SHADERCONSTS_INLINE */
 
 typedef
 struct {
    uint32               cid;
    SVGA3dQueryType      type;
-} SVGA3dCmdBeginGBQuery;           /* SVGA_3D_CMD_BEGIN_GB_QUERY */
+} __packed
+SVGA3dCmdBeginGBQuery;           /* SVGA_3D_CMD_BEGIN_GB_QUERY */
 
 typedef
 struct {
@@ -2329,7 +2349,8 @@ struct {
    SVGA3dQueryType      type;
    SVGAMobId mobid;
    uint32 offset;
-} SVGA3dCmdEndGBQuery;                  /* SVGA_3D_CMD_END_GB_QUERY */
+} __packed
+SVGA3dCmdEndGBQuery;                  /* SVGA_3D_CMD_END_GB_QUERY */
 
 
 /*
@@ -2346,21 +2367,22 @@ struct {
    SVGA3dQueryType      type;
    SVGAMobId mobid;
    uint32 offset;
-} SVGA3dCmdWaitForGBQuery;          /* SVGA_3D_CMD_WAIT_FOR_GB_QUERY */
+} __packed
+SVGA3dCmdWaitForGBQuery;          /* SVGA_3D_CMD_WAIT_FOR_GB_QUERY */
 
 typedef
 struct {
    SVGAMobId mobid;
    uint32 fbOffset;
    uint32 initalized;
-}
+} __packed
 SVGA3dCmdEnableGart;              /* SVGA_3D_CMD_ENABLE_GART */
 
 typedef
 struct {
    SVGAMobId mobid;
    uint32 gartOffset;
-}
+} __packed
 SVGA3dCmdMapMobIntoGart;          /* SVGA_3D_CMD_MAP_MOB_INTO_GART */
 
 
@@ -2368,7 +2390,7 @@ typedef
 struct {
    uint32 gartOffset;
    uint32 numPages;
-}
+} __packed
 SVGA3dCmdUnmapGartRange;          /* SVGA_3D_CMD_UNMAP_GART_RANGE */
 
 
@@ -2385,27 +2407,27 @@ struct {
    int32 xRoot;
    int32 yRoot;
    uint32 flags;
-}
+} __packed
 SVGA3dCmdDefineGBScreenTarget;    /* SVGA_3D_CMD_DEFINE_GB_SCREENTARGET */
 
 typedef
 struct {
    uint32 stid;
-}
+} __packed
 SVGA3dCmdDestroyGBScreenTarget;  /* SVGA_3D_CMD_DESTROY_GB_SCREENTARGET */
 
 typedef
 struct {
    uint32 stid;
    SVGA3dSurfaceImageId image;
-}
+} __packed
 SVGA3dCmdBindGBScreenTarget;  /* SVGA_3D_CMD_BIND_GB_SCREENTARGET */
 
 typedef
 struct {
    uint32 stid;
    SVGA3dBox box;
-}
+} __packed
 SVGA3dCmdUpdateGBScreenTarget;  /* SVGA_3D_CMD_UPDATE_GB_SCREENTARGET */
 
 /*
diff --git a/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h b/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h
index 8369c3ba10fe..ef3385096145 100644
--- a/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h
+++ b/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h
@@ -38,8 +38,11 @@
 
 #define DIV_ROUND_UP(x, y)  (((x) + (y) - 1) / (y))
 #define max_t(type, x, y)  ((x) > (y) ? (x) : (y))
+#define min_t(type, x, y)  ((x) < (y) ? (x) : (y))
 #define surf_size_struct SVGA3dSize
 #define u32 uint32
+#define u64 uint64_t
+#define U32_MAX ((u32)~0U)
 
 #endif /* __KERNEL__ */
 
@@ -704,8 +707,8 @@ static const struct svga3d_surface_desc svga3d_surface_descs[] = {
 
 static inline u32 clamped_umul32(u32 a, u32 b)
 {
-        uint64_t tmp = (uint64_t) a*b;
-        return (tmp > (uint64_t) ((u32) -1)) ? (u32) -1 : tmp;
+        u64 tmp = (u64) a*b;
+        return (tmp > (u64) U32_MAX) ? U32_MAX : tmp;
 }
 
 static inline const struct svga3d_surface_desc *
@@ -834,7 +837,7 @@ svga3dsurface_get_serialized_size(SVGA3dSurfaceFormat format,
                                   bool cubemap)
 {
         const struct svga3d_surface_desc *desc = svga3dsurface_get_desc(format);
-        u32 total_size = 0;
+        u64 total_size = 0;
         u32 mip;
 
         for (mip = 0; mip < num_mip_levels; mip++) {
@@ -847,7 +850,7 @@ svga3dsurface_get_serialized_size(SVGA3dSurfaceFormat format,
         if (cubemap)
                 total_size *= SVGA3D_MAX_SURFACE_FACES;
 
-        return total_size;
+        return (u32) min_t(u64, total_size, (u64) U32_MAX);
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/svga_reg.h b/drivers/gpu/drm/vmwgfx/svga_reg.h
index 71defa4d2d75..11323dd5196f 100644
--- a/drivers/gpu/drm/vmwgfx/svga_reg.h
+++ b/drivers/gpu/drm/vmwgfx/svga_reg.h
@@ -169,10 +169,17 @@ enum {
    SVGA_REG_TRACES = 45,            /* Enable trace-based updates even when FIFO is on */
    SVGA_REG_GMRS_MAX_PAGES = 46,    /* Maximum number of 4KB pages for all GMRs */
    SVGA_REG_MEMORY_SIZE = 47,       /* Total dedicated device memory excluding FIFO */
+   SVGA_REG_COMMAND_LOW = 48,       /* Lower 32 bits and submits commands */
+   SVGA_REG_COMMAND_HIGH = 49,      /* Upper 32 bits of command buffer PA */
    SVGA_REG_MAX_PRIMARY_BOUNDING_BOX_MEM = 50,   /* Max primary memory */
    SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB = 51, /* Suggested limit on mob mem */
    SVGA_REG_DEV_CAP = 52,           /* Write dev cap index, read value */
-   SVGA_REG_TOP = 53,               /* Must be 1 more than the last register */
+   SVGA_REG_CMD_PREPEND_LOW = 53,
+   SVGA_REG_CMD_PREPEND_HIGH = 54,
+   SVGA_REG_SCREENTARGET_MAX_WIDTH = 55,
+   SVGA_REG_SCREENTARGET_MAX_HEIGHT = 56,
+   SVGA_REG_MOB_MAX_SIZE = 57,
+   SVGA_REG_TOP = 58,               /* Must be 1 more than the last register */
 
    SVGA_PALETTE_BASE = 1024,        /* Base of SVGA color map */
    /* Next 768 (== 256*3) registers exist for colormap */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
index 9426c53fb483..1e80152674b5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
@@ -551,8 +551,7 @@ static int vmw_context_scrub_shader(struct vmw_ctx_bindinfo *bi, bool rebind)
         cmd->header.size = sizeof(cmd->body);
         cmd->body.cid = bi->ctx->id;
         cmd->body.type = bi->i1.shader_type;
-        cmd->body.shid =
-                cpu_to_le32((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
+        cmd->body.shid = ((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
 
         return 0;
@@ -585,8 +584,7 @@ static int vmw_context_scrub_render_target(struct vmw_ctx_bindinfo *bi,
         cmd->header.size = sizeof(cmd->body);
         cmd->body.cid = bi->ctx->id;
         cmd->body.type = bi->i1.rt_type;
-        cmd->body.target.sid =
-                cpu_to_le32((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
+        cmd->body.target.sid = ((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
         cmd->body.target.face = 0;
         cmd->body.target.mipmap = 0;
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
@@ -628,8 +626,7 @@ static int vmw_context_scrub_texture(struct vmw_ctx_bindinfo *bi,
         cmd->body.c.cid = bi->ctx->id;
         cmd->body.s1.stage = bi->i1.texture_stage;
         cmd->body.s1.name = SVGA3D_TS_BIND_TEXTURE;
-        cmd->body.s1.value =
-                cpu_to_le32((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
+        cmd->body.s1.value = ((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
 
         return 0;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 3bdc0adc656d..0083cbf99edf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -667,6 +667,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 dev_priv->memory_size = 512*1024*1024;
         }
         dev_priv->max_mob_pages = 0;
+        dev_priv->max_mob_size = 0;
         if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
                 uint64_t mem_size =
                         vmw_read(dev_priv,
@@ -676,6 +677,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 dev_priv->prim_bb_mem =
                         vmw_read(dev_priv,
                                  SVGA_REG_MAX_PRIMARY_BOUNDING_BOX_MEM);
+                dev_priv->max_mob_size =
+                        vmw_read(dev_priv, SVGA_REG_MOB_MAX_SIZE);
         } else
                 dev_priv->prim_bb_mem = dev_priv->vram_size;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index ecaa302a6154..9e4be1725985 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -386,6 +386,7 @@ struct vmw_private {
         uint32_t max_gmr_ids;
         uint32_t max_gmr_pages;
         uint32_t max_mob_pages;
+        uint32_t max_mob_size;
         uint32_t memory_size;
         bool has_gmr;
         bool has_mob;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 269b85cc875a..efb575a7996c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -602,7 +602,7 @@ static int vmw_cmd_cid_check(struct vmw_private *dev_priv,
 {
         struct vmw_cid_cmd {
                 SVGA3dCmdHeader header;
-                __le32 cid;
+                uint32_t cid;
         } *cmd;
 
         cmd = container_of(header, struct vmw_cid_cmd, header);
@@ -1835,7 +1835,7 @@ static int vmw_cmd_check_not_3d(struct vmw_private *dev_priv,
         return 0;
 }
 
-static const struct vmw_cmd_entry const vmw_cmd_entries[SVGA_3D_CMD_MAX] = {
+static const struct vmw_cmd_entry vmw_cmd_entries[SVGA_3D_CMD_MAX] = {
         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DEFINE, &vmw_cmd_invalid,
                     false, false, false),
         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DESTROY, &vmw_cmd_invalid,
@@ -2032,6 +2032,9 @@ static int vmw_cmd_check(struct vmw_private *dev_priv,
                 goto out_invalid;
 
         entry = &vmw_cmd_entries[cmd_id];
+        if (unlikely(!entry->func))
+                goto out_invalid;
+
         if (unlikely(!entry->user_allow && !sw_context->kernel))
                 goto out_privileged;
 
@@ -2469,7 +2472,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,
         if (dev_priv->has_mob) {
                 ret = vmw_rebind_contexts(sw_context);
                 if (unlikely(ret != 0))
-                        goto out_err;
+                        goto out_unlock_binding;
         }
 
         cmd = vmw_fifo_reserve(dev_priv, command_size);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index f9881f9e62bd..47b70949bf3a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -102,6 +102,9 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                 vmw_fp->gb_aware = true;
                 param->value = dev_priv->max_mob_pages * PAGE_SIZE;
                 break;
+        case DRM_VMW_PARAM_MAX_MOB_SIZE:
+                param->value = dev_priv->max_mob_size;
+                break;
         default:
                 DRM_ERROR("Illegal vmwgfx get param request: %d\n",
                           param->param);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
index 217d941b8176..ee3856578a12 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -371,13 +371,13 @@ int vmw_shader_destroy_ioctl(struct drm_device *dev, void *data,
                                          TTM_REF_USAGE);
 }
 
-int vmw_shader_alloc(struct vmw_private *dev_priv,
-                     struct vmw_dma_buffer *buffer,
-                     size_t shader_size,
-                     size_t offset,
-                     SVGA3dShaderType shader_type,
-                     struct ttm_object_file *tfile,
-                     u32 *handle)
+static int vmw_shader_alloc(struct vmw_private *dev_priv,
+                            struct vmw_dma_buffer *buffer,
+                            size_t shader_size,
+                            size_t offset,
+                            SVGA3dShaderType shader_type,
+                            struct ttm_object_file *tfile,
+                            u32 *handle)
 {
         struct vmw_user_shader *ushader;
         struct vmw_resource *res, *tmp;
@@ -779,6 +779,8 @@ vmw_compat_shader_man_create(struct vmw_private *dev_priv)
         int ret;
 
         man = kzalloc(sizeof(*man), GFP_KERNEL);
+        if (man == NULL)
+                return ERR_PTR(-ENOMEM);
 
         man->dev_priv = dev_priv;
         INIT_LIST_HEAD(&man->list);
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 497558127bb3..f822fd2a1ada 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -469,6 +469,9 @@ static const struct hid_device_id apple_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
                                 USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
+                                USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS),
+                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_JIS),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3bfac3accd22..cc32a6f96c64 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1679,6 +1679,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_AUREAL, USB_DEVICE_ID_AUREAL_W01RN) },
@@ -1779,6 +1780,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
index 8fae6d1414cc..c24908f14934 100644
--- a/drivers/hid/hid-hyperv.c
+++ b/drivers/hid/hid-hyperv.c
@@ -157,6 +157,7 @@ struct mousevsc_dev {
         u32                     report_desc_size;
         struct hv_input_dev_info hid_dev_info;
         struct hid_device       *hid_device;
+        u8                      input_buf[HID_MAX_BUFFER_SIZE];
 };
 
 
@@ -256,6 +257,7 @@ static void mousevsc_on_receive(struct hv_device *device,
         struct synthhid_msg *hid_msg;
         struct mousevsc_dev *input_dev = hv_get_drvdata(device);
         struct synthhid_input_report *input_report;
+        size_t len;
 
         pipe_msg = (struct pipe_prt_msg *)((unsigned long)packet +
                                                 (packet->offset8 << 3));
@@ -300,9 +302,12 @@ static void mousevsc_on_receive(struct hv_device *device,
                         (struct synthhid_input_report *)pipe_msg->data;
                 if (!input_dev->init_complete)
                         break;
-                hid_input_report(input_dev->hid_device,
-                                HID_INPUT_REPORT, input_report->buffer,
-                                input_report->header.size, 1);
+
+                len = min(input_report->header.size,
+                          (u32)sizeof(input_dev->input_buf));
+                memcpy(input_dev->input_buf, input_report->buffer, len);
+                hid_input_report(input_dev->hid_device, HID_INPUT_REPORT,
+                                 input_dev->input_buf, len, 1);
                 break;
         default:
                 pr_err("unsupported hid msg type - type %d len %d",
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5a5248f2cc07..22f28d6b33a8 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -135,6 +135,7 @@
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI  0x0255
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
+#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS   0x0257
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
@@ -240,6 +241,7 @@
 
 #define USB_VENDOR_ID_CYGNAL            0x10c4
 #define USB_DEVICE_ID_CYGNAL_RADIO_SI470X       0x818a
+#define USB_DEVICE_ID_FOCALTECH_FTXXXX_MULTITOUCH       0x81b9
 
 #define USB_DEVICE_ID_CYGNAL_RADIO_SI4713       0x8244
 
@@ -451,6 +453,9 @@
 #define USB_VENDOR_ID_INTEL_1           0x8087
 #define USB_DEVICE_ID_INTEL_HID_SENSOR  0x09fa
 
+#define USB_VENDOR_ID_STM_0             0x0483
+#define USB_DEVICE_ID_STM_HID_SENSOR    0x91d1
+
 #define USB_VENDOR_ID_ION               0x15e4
 #define USB_DEVICE_ID_ICADE             0x0132
 
@@ -619,6 +624,8 @@
 #define USB_DEVICE_ID_MS_PRESENTER_8K_USB       0x0713
 #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K       0x0730
 #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500     0x076c
+#define USB_DEVICE_ID_MS_TOUCH_COVER_2  0x07a7
+#define USB_DEVICE_ID_MS_TYPE_COVER_2   0x07a9
 
 #define USB_VENDOR_ID_MOJO              0x8282
 #define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
@@ -644,6 +651,7 @@
 
 #define USB_VENDOR_ID_NEXIO             0x1870
 #define USB_DEVICE_ID_NEXIO_MULTITOUCH_420      0x010d
+#define USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750  0x0110
 
 #define USB_VENDOR_ID_NEXTWINDOW        0x1926
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index d50e7313b171..a713e6211419 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1178,7 +1178,7 @@ static void hidinput_led_worker(struct work_struct *work)
 
         /* fall back to generic raw-output-report */
         len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
-        buf = kmalloc(len, GFP_KERNEL);
+        buf = hid_alloc_report_buf(report, GFP_KERNEL);
         if (!buf)
                 return;
 
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index c6ef6eed3091..404a3a8a82f1 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -208,6 +208,10 @@ static const struct hid_device_id ms_devices[] = {
                 .driver_data = MS_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
                 .driver_data = MS_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2),
+                .driver_data = 0 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2),
+                .driver_data = 0 },
 
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
                 .driver_data = MS_PRESENTER },
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f134d73beca1..221d503f1c24 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1166,6 +1166,11 @@ static const struct hid_device_id mt_devices[] = {
                 MT_USB_DEVICE(USB_VENDOR_ID_FLATFROG,
                         USB_DEVICE_ID_MULTITOUCH_3200) },
 
+        /* FocalTech Panels */
+        { .driver_data = MT_CLS_SERIAL,
+                MT_USB_DEVICE(USB_VENDOR_ID_CYGNAL,
+                        USB_DEVICE_ID_FOCALTECH_FTXXXX_MULTITOUCH) },
+
         /* GeneralTouch panel */
         { .driver_data = MT_CLS_GENERALTOUCH_TWOFINGERS,
                 MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 46f4480035bc..9c22e14c57f0 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -665,6 +665,9 @@ static const struct hid_device_id sensor_hub_devices[] = {
         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_INTEL_1,
                         USB_DEVICE_ID_INTEL_HID_SENSOR),
                         .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
+        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_STM_0,
+                        USB_DEVICE_ID_STM_HID_SENSOR),
+                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, HID_ANY_ID,
                      HID_ANY_ID) },
         { }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index d1f81f52481a..42eebd14de1f 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -582,7 +582,7 @@ static void i2c_hid_request(struct hid_device *hid, struct hid_report *rep,
         int ret;
         int len = i2c_hid_get_report_length(rep) - 2;
 
-        buf = kzalloc(len, GFP_KERNEL);
+        buf = hid_alloc_report_buf(rep, GFP_KERNEL);
         if (!buf)
                 return;
 
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 175ec0afb70c..dbd83878ff99 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -74,6 +74,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index af6edf9b1936..f2d7bf90c9fe 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -67,7 +67,6 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
         int ret = 0;
         struct vmbus_channel_initiate_contact *msg;
         unsigned long flags;
-        int t;
 
         init_completion(&msginfo->waitevent);
 
@@ -78,6 +77,8 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
         msg->interrupt_page = virt_to_phys(vmbus_connection.int_page);
         msg->monitor_page1 = virt_to_phys(vmbus_connection.monitor_pages[0]);
         msg->monitor_page2 = virt_to_phys(vmbus_connection.monitor_pages[1]);
+        if (version == VERSION_WIN8)
+                msg->target_vcpu = hv_context.vp_index[smp_processor_id()];
 
         /*
          * Add to list before we send the request since we may
@@ -100,15 +101,7 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
         }
 
         /* Wait for the connection response */
-        t =  wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
-        if (t == 0) {
-                spin_lock_irqsave(&vmbus_connection.channelmsg_lock,
-                                flags);
-                list_del(&msginfo->msglistentry);
-                spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock,
-                                        flags);
-                return -ETIMEDOUT;
-        }
+        wait_for_completion(&msginfo->waitevent);
 
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
         list_del(&msginfo->msglistentry);
diff --git a/drivers/hwmon/max1668.c b/drivers/hwmon/max1668.c
index a7626358c95d..029b65e6c589 100644
--- a/drivers/hwmon/max1668.c
+++ b/drivers/hwmon/max1668.c
@@ -243,7 +243,7 @@ static ssize_t set_temp_min(struct device *dev,
         data->temp_min[index] = clamp_val(temp/1000, -128, 127);
         if (i2c_smbus_write_byte_data(client,
                                         MAX1668_REG_LIML_WR(index),
-                                        data->temp_max[index]))
+                                        data->temp_min[index]))
                 count = -EIO;
         mutex_unlock(&data->update_lock);
 
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index 8c23203915af..8a17f01e8672 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -145,7 +145,7 @@ struct ntc_data {
 static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 {
         struct iio_channel *channel = pdata->chan;
-        unsigned int result;
+        s64 result;
         int val, ret;
 
         ret = iio_read_channel_raw(channel, &val);
@@ -155,10 +155,10 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
         }
 
         /* unit: mV */
-        result = pdata->pullup_uv * val;
+        result = pdata->pullup_uv * (s64) val;
         result >>= 12;
 
-        return result;
+        return (int)result;
 }
 
 static const struct of_device_id ntc_match[] = {
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index b8c5187b9ee0..d52d84937ad3 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -97,7 +97,6 @@ enum {
 enum {
         MV64XXX_I2C_ACTION_INVALID,
         MV64XXX_I2C_ACTION_CONTINUE,
-        MV64XXX_I2C_ACTION_OFFLOAD_SEND_START,
         MV64XXX_I2C_ACTION_SEND_START,
         MV64XXX_I2C_ACTION_SEND_RESTART,
         MV64XXX_I2C_ACTION_OFFLOAD_RESTART,
@@ -204,6 +203,9 @@ static int mv64xxx_i2c_offload_msg(struct mv64xxx_i2c_data *drv_data)
         unsigned long ctrl_reg;
         struct i2c_msg *msg = drv_data->msgs;
 
+        if (!drv_data->offload_enabled)
+                return -EOPNOTSUPP;
+
         drv_data->msg = msg;
         drv_data->byte_posn = 0;
         drv_data->bytes_left = msg->len;
@@ -433,8 +435,7 @@ mv64xxx_i2c_do_action(struct mv64xxx_i2c_data *drv_data)
 
                 drv_data->msgs++;
                 drv_data->num_msgs--;
-                if (!(drv_data->offload_enabled &&
-                                mv64xxx_i2c_offload_msg(drv_data))) {
+                if (mv64xxx_i2c_offload_msg(drv_data) < 0) {
                         drv_data->cntl_bits |= MV64XXX_I2C_REG_CONTROL_START;
                         writel(drv_data->cntl_bits,
                         drv_data->reg_base + drv_data->reg_offsets.control);
@@ -458,15 +459,14 @@ mv64xxx_i2c_do_action(struct mv64xxx_i2c_data *drv_data)
                         drv_data->reg_base + drv_data->reg_offsets.control);
                 break;
 
-        case MV64XXX_I2C_ACTION_OFFLOAD_SEND_START:
-                if (!mv64xxx_i2c_offload_msg(drv_data))
-                        break;
-                else
-                        drv_data->action = MV64XXX_I2C_ACTION_SEND_START;
-                /* FALLTHRU */
         case MV64XXX_I2C_ACTION_SEND_START:
-                writel(drv_data->cntl_bits | MV64XXX_I2C_REG_CONTROL_START,
-                        drv_data->reg_base + drv_data->reg_offsets.control);
+                /* Can we offload this msg ? */
+                if (mv64xxx_i2c_offload_msg(drv_data) < 0) {
+                        /* No, switch to standard path */
+                        mv64xxx_i2c_prepare_for_io(drv_data, drv_data->msgs);
+                        writel(drv_data->cntl_bits | MV64XXX_I2C_REG_CONTROL_START,
+                                drv_data->reg_base + drv_data->reg_offsets.control);
+                }
                 break;
 
         case MV64XXX_I2C_ACTION_SEND_ADDR_1:
@@ -625,15 +625,10 @@ mv64xxx_i2c_execute_msg(struct mv64xxx_i2c_data *drv_data, struct i2c_msg *msg,
         unsigned long   flags;
 
         spin_lock_irqsave(&drv_data->lock, flags);
-        if (drv_data->offload_enabled) {
-                drv_data->action = MV64XXX_I2C_ACTION_OFFLOAD_SEND_START;
-                drv_data->state = MV64XXX_I2C_STATE_WAITING_FOR_START_COND;
-        } else {
-                mv64xxx_i2c_prepare_for_io(drv_data, msg);
 
-                drv_data->action = MV64XXX_I2C_ACTION_SEND_START;
-                drv_data->state = MV64XXX_I2C_STATE_WAITING_FOR_START_COND;
-        }
+        drv_data->action = MV64XXX_I2C_ACTION_SEND_START;
+        drv_data->state = MV64XXX_I2C_STATE_WAITING_FOR_START_COND;
+
         drv_data->send_stop = is_last;
         drv_data->block = 1;
         mv64xxx_i2c_do_action(drv_data);
diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index 3bec9220df04..bfec313492b3 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -447,14 +447,14 @@ static const struct iio_chan_spec_ext_info bma180_ext_info[] = {
         { },
 };
 
-#define BMA180_CHANNEL(_index) {                                        \
+#define BMA180_CHANNEL(_axis) {                                 \
         .type = IIO_ACCEL,                                              \
-        .indexed = 1,                                                   \
-        .channel = (_index),                                            \
+        .modified = 1,                                                  \
+        .channel2 = IIO_MOD_##_axis,                                    \
         .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |                  \
                 BIT(IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY),       \
         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),           \
-        .scan_index = (_index),                                         \
+        .scan_index = AXIS_##_axis,                                     \
         .scan_type = {                                                  \
                 .sign = 's',                                            \
                 .realbits = 14,                                         \
@@ -465,10 +465,10 @@ static const struct iio_chan_spec_ext_info bma180_ext_info[] = {
 }
 
 static const struct iio_chan_spec bma180_channels[] = {
-        BMA180_CHANNEL(AXIS_X),
-        BMA180_CHANNEL(AXIS_Y),
-        BMA180_CHANNEL(AXIS_Z),
-        IIO_CHAN_SOFT_TIMESTAMP(4),
+        BMA180_CHANNEL(X),
+        BMA180_CHANNEL(Y),
+        BMA180_CHANNEL(Z),
+        IIO_CHAN_SOFT_TIMESTAMP(3),
 };
 
 static irqreturn_t bma180_trigger_handler(int irq, void *p)
diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c
index e283f2f2ee2f..360259266d4f 100644
--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1560,7 +1560,7 @@ static int max1363_probe(struct i2c_client *client,
         st->client = client;
 
         st->vref_uv = st->chip_info->int_vref_mv * 1000;
-        vref = devm_regulator_get(&client->dev, "vref");
+        vref = devm_regulator_get_optional(&client->dev, "vref");
         if (!IS_ERR(vref)) {
                 int vref_uv;
 
diff --git a/drivers/iio/imu/adis16400.h b/drivers/iio/imu/adis16400.h
index 2f8f9d632386..0916bf6b6c31 100644
--- a/drivers/iio/imu/adis16400.h
+++ b/drivers/iio/imu/adis16400.h
@@ -189,6 +189,7 @@ enum {
         ADIS16300_SCAN_INCLI_X,
         ADIS16300_SCAN_INCLI_Y,
         ADIS16400_SCAN_ADC,
+        ADIS16400_SCAN_TIMESTAMP,
 };
 
 #ifdef CONFIG_IIO_BUFFER
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index 368660dfe135..7c582f7ae34e 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -632,7 +632,7 @@ static const struct iio_chan_spec adis16400_channels[] = {
         ADIS16400_MAGN_CHAN(Z, ADIS16400_ZMAGN_OUT, 14),
         ADIS16400_TEMP_CHAN(ADIS16400_TEMP_OUT, 12),
         ADIS16400_AUX_ADC_CHAN(ADIS16400_AUX_ADC, 12),
-        IIO_CHAN_SOFT_TIMESTAMP(12)
+        IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
 };
 
 static const struct iio_chan_spec adis16448_channels[] = {
@@ -659,7 +659,7 @@ static const struct iio_chan_spec adis16448_channels[] = {
                 },
         },
         ADIS16400_TEMP_CHAN(ADIS16448_TEMP_OUT, 12),
-        IIO_CHAN_SOFT_TIMESTAMP(11)
+        IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
 };
 
 static const struct iio_chan_spec adis16350_channels[] = {
@@ -677,7 +677,7 @@ static const struct iio_chan_spec adis16350_channels[] = {
         ADIS16400_MOD_TEMP_CHAN(X, ADIS16350_XTEMP_OUT, 12),
         ADIS16400_MOD_TEMP_CHAN(Y, ADIS16350_YTEMP_OUT, 12),
         ADIS16400_MOD_TEMP_CHAN(Z, ADIS16350_ZTEMP_OUT, 12),
-        IIO_CHAN_SOFT_TIMESTAMP(11)
+        IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
 };
 
 static const struct iio_chan_spec adis16300_channels[] = {
@@ -690,7 +690,7 @@ static const struct iio_chan_spec adis16300_channels[] = {
         ADIS16400_AUX_ADC_CHAN(ADIS16300_AUX_ADC, 12),
         ADIS16400_INCLI_CHAN(X, ADIS16300_PITCH_OUT, 13),
         ADIS16400_INCLI_CHAN(Y, ADIS16300_ROLL_OUT, 13),
-        IIO_CHAN_SOFT_TIMESTAMP(14)
+        IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
 };
 
 static const struct iio_chan_spec adis16334_channels[] = {
@@ -701,7 +701,7 @@ static const struct iio_chan_spec adis16334_channels[] = {
         ADIS16400_ACCEL_CHAN(Y, ADIS16400_YACCL_OUT, 14),
         ADIS16400_ACCEL_CHAN(Z, ADIS16400_ZACCL_OUT, 14),
         ADIS16400_TEMP_CHAN(ADIS16350_XTEMP_OUT, 12),
-        IIO_CHAN_SOFT_TIMESTAMP(8)
+        IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
 };
 
 static struct attribute *adis16400_attributes[] = {
diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c
index 3d8110157f2d..94daa9fc1247 100644
--- a/drivers/iio/light/tsl2563.c
+++ b/drivers/iio/light/tsl2563.c
@@ -460,10 +460,14 @@ static int tsl2563_write_raw(struct iio_dev *indio_dev,
 {
         struct tsl2563_chip *chip = iio_priv(indio_dev);
 
-        if (chan->channel == IIO_MOD_LIGHT_BOTH)
+        if (mask != IIO_CHAN_INFO_CALIBSCALE)
+                return -EINVAL;
+        if (chan->channel2 == IIO_MOD_LIGHT_BOTH)
                 chip->calib0 = calib_from_sysfs(val);
-        else
+        else if (chan->channel2 == IIO_MOD_LIGHT_IR)
                 chip->calib1 = calib_from_sysfs(val);
+        else
+                return -EINVAL;
 
         return 0;
 }
@@ -472,14 +476,14 @@ static int tsl2563_read_raw(struct iio_dev *indio_dev,
                             struct iio_chan_spec const *chan,
                             int *val,
                             int *val2,
-                            long m)
+                            long mask)
 {
         int ret = -EINVAL;
         u32 calib0, calib1;
         struct tsl2563_chip *chip = iio_priv(indio_dev);
 
         mutex_lock(&chip->lock);
-        switch (m) {
+        switch (mask) {
         case IIO_CHAN_INFO_RAW:
         case IIO_CHAN_INFO_PROCESSED:
                 switch (chan->type) {
@@ -498,7 +502,7 @@ static int tsl2563_read_raw(struct iio_dev *indio_dev,
                         ret = tsl2563_get_adc(chip);
                         if (ret)
                                 goto error_ret;
-                        if (chan->channel == 0)
+                        if (chan->channel2 == IIO_MOD_LIGHT_BOTH)
                                 *val = chip->data0;
                         else
                                 *val = chip->data1;
@@ -510,7 +514,7 @@ static int tsl2563_read_raw(struct iio_dev *indio_dev,
                 break;
 
         case IIO_CHAN_INFO_CALIBSCALE:
-                if (chan->channel == 0)
+                if (chan->channel2 == IIO_MOD_LIGHT_BOTH)
                         *val = calib_to_sysfs(chip->calib0);
                 else
                         *val = calib_to_sysfs(chip->calib1);
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index ff284e5afd95..05423543f89d 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -85,6 +85,7 @@
 #define AK8975_MAX_CONVERSION_TIMEOUT   500
 #define AK8975_CONVERSION_DONE_POLL_TIME 10
 #define AK8975_DATA_READY_TIMEOUT       ((100*HZ)/1000)
+#define RAW_TO_GAUSS(asa) ((((asa) + 128) * 3000) / 256)
 
 /*
  * Per-instance context data for the device.
@@ -265,15 +266,15 @@ static int ak8975_setup(struct i2c_client *client)
  *
  * Since 1uT = 0.01 gauss, our final scale factor becomes:
  *
- * Hadj = H * ((ASA + 128) / 256) * 3/10 * 100
- * Hadj = H * ((ASA + 128) * 30 / 256
+ * Hadj = H * ((ASA + 128) / 256) * 3/10 * 1/100
+ * Hadj = H * ((ASA + 128) * 0.003) / 256
  *
  * Since ASA doesn't change, we cache the resultant scale factor into the
  * device context in ak8975_setup().
  */
-        data->raw_to_gauss[0] = ((data->asa[0] + 128) * 30) >> 8;
-        data->raw_to_gauss[1] = ((data->asa[1] + 128) * 30) >> 8;
-        data->raw_to_gauss[2] = ((data->asa[2] + 128) * 30) >> 8;
+        data->raw_to_gauss[0] = RAW_TO_GAUSS(data->asa[0]);
+        data->raw_to_gauss[1] = RAW_TO_GAUSS(data->asa[1]);
+        data->raw_to_gauss[2] = RAW_TO_GAUSS(data->asa[2]);
 
         return 0;
 }
@@ -428,8 +429,9 @@ static int ak8975_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_RAW:
                 return ak8975_read_axis(indio_dev, chan->address, val);
         case IIO_CHAN_INFO_SCALE:
-                *val = data->raw_to_gauss[chan->address];
-                return IIO_VAL_INT;
+                *val = 0;
+                *val2 = data->raw_to_gauss[chan->address];
+                return IIO_VAL_INT_PLUS_MICRO;
         }
         return -EINVAL;
 }
diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
index 4b65b6d3bdb1..f66955fb3509 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -106,7 +106,7 @@ static ssize_t mag3110_show_int_plus_micros(char *buf,
 
         while (n-- > 0)
                 len += scnprintf(buf + len, PAGE_SIZE - len,
-                        "%d.%d ", vals[n][0], vals[n][1]);
+                        "%d.%06d ", vals[n][0], vals[n][1]);
 
         /* replace trailing space by newline */
         buf[len - 1] = '\n';
@@ -154,6 +154,9 @@ static int mag3110_read_raw(struct iio_dev *indio_dev,
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
+                if (iio_buffer_enabled(indio_dev))
+                        return -EBUSY;
+
                 switch (chan->type) {
                 case IIO_MAGN: /* in 0.1 uT / LSB */
                         ret = mag3110_read(data, buffer);
@@ -199,6 +202,9 @@ static int mag3110_write_raw(struct iio_dev *indio_dev,
         struct mag3110_data *data = iio_priv(indio_dev);
         int rate;
 
+        if (iio_buffer_enabled(indio_dev))
+                return -EBUSY;
+
         switch (mask) {
         case IIO_CHAN_INFO_SAMP_FREQ:
                 rate = mag3110_get_samp_freq_index(data, val, val2);
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index d53cf519f42a..00400c352c1a 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1082,6 +1082,7 @@ static int c2_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
 
         /* Initialize network device */
         if ((netdev = c2_devinit(c2dev, mmio_regs)) == NULL) {
+                ret = -ENOMEM;
                 iounmap(mmio_regs);
                 goto bail4;
         }
@@ -1151,7 +1152,8 @@ static int c2_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
                 goto bail10;
         }
 
-        if (c2_register_device(c2dev))
+        ret = c2_register_device(c2dev);
+        if (ret)
                 goto bail10;
 
         return 0;
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index b7c986990053..d2a6d961344b 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -576,7 +576,8 @@ int c2_rnic_init(struct c2_dev *c2dev)
                 goto bail4;
 
         /* Initialize cached the adapter limits */
-        if (c2_rnic_query(c2dev, &c2dev->props))
+        err = c2_rnic_query(c2dev, &c2dev->props);
+        if (err)
                 goto bail5;
 
         /* Initialize the PD pool */
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 45126879ad28..d286bdebe2ab 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -3352,6 +3352,7 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
                 goto free_dst;
         }
 
+        neigh_release(neigh);
         step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
         rss_qid = dev->rdev.lldi.rxq_ids[pi->port_id * step];
         window = (__force u16) htons((__force u16)tcph->window);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index c2702f549f10..e81c5547e647 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -347,7 +347,7 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port,
         props->active_width     =  (((u8 *)mailbox->buf)[5] == 0x40) ?
                                                 IB_WIDTH_4X : IB_WIDTH_1X;
         props->active_speed     = IB_SPEED_QDR;
-        props->port_cap_flags   = IB_PORT_CM_SUP;
+        props->port_cap_flags   = IB_PORT_CM_SUP | IB_PORT_IP_BASED_GIDS;
         props->gid_tbl_len      = mdev->dev->caps.gid_table_len[port];
         props->max_msg_sz       = mdev->dev->caps.max_msg_sz;
         props->pkey_tbl_len     = 1;
@@ -1357,6 +1357,21 @@ static struct device_attribute *mlx4_class_attributes[] = {
         &dev_attr_board_id
 };
 
+static void mlx4_addrconf_ifid_eui48(u8 *eui, u16 vlan_id,
+                                     struct net_device *dev)
+{
+        memcpy(eui, dev->dev_addr, 3);
+        memcpy(eui + 5, dev->dev_addr + 3, 3);
+        if (vlan_id < 0x1000) {
+                eui[3] = vlan_id >> 8;
+                eui[4] = vlan_id & 0xff;
+        } else {
+                eui[3] = 0xff;
+                eui[4] = 0xfe;
+        }
+        eui[0] ^= 2;
+}
+
 static void update_gids_task(struct work_struct *work)
 {
         struct update_gid_work *gw = container_of(work, struct update_gid_work, work);
@@ -1393,7 +1408,6 @@ static void reset_gids_task(struct work_struct *work)
         struct mlx4_cmd_mailbox *mailbox;
         union ib_gid *gids;
         int err;
-        int i;
         struct mlx4_dev *dev = gw->dev->dev;
 
         mailbox = mlx4_alloc_cmd_mailbox(dev);
@@ -1405,18 +1419,16 @@ static void reset_gids_task(struct work_struct *work)
         gids = mailbox->buf;
         memcpy(gids, gw->gids, sizeof(gw->gids));
 
-        for (i = 1; i < gw->dev->num_ports + 1; i++) {
-                if (mlx4_ib_port_link_layer(&gw->dev->ib_dev, i) ==
-                                            IB_LINK_LAYER_ETHERNET) {
-                        err = mlx4_cmd(dev, mailbox->dma,
-                                       MLX4_SET_PORT_GID_TABLE << 8 | i,
-                                       1, MLX4_CMD_SET_PORT,
-                                       MLX4_CMD_TIME_CLASS_B,
-                                       MLX4_CMD_WRAPPED);
-                        if (err)
-                                pr_warn(KERN_WARNING
-                                        "set port %d command failed\n", i);
-                }
+        if (mlx4_ib_port_link_layer(&gw->dev->ib_dev, gw->port) ==
+                                    IB_LINK_LAYER_ETHERNET) {
+                err = mlx4_cmd(dev, mailbox->dma,
+                               MLX4_SET_PORT_GID_TABLE << 8 | gw->port,
+                               1, MLX4_CMD_SET_PORT,
+                               MLX4_CMD_TIME_CLASS_B,
+                               MLX4_CMD_WRAPPED);
+                if (err)
+                        pr_warn(KERN_WARNING
+                                "set port %d command failed\n", gw->port);
         }
 
         mlx4_free_cmd_mailbox(dev, mailbox);
@@ -1425,7 +1437,8 @@ free:
 }
 
 static int update_gid_table(struct mlx4_ib_dev *dev, int port,
-                            union ib_gid *gid, int clear)
+                            union ib_gid *gid, int clear,
+                            int default_gid)
 {
         struct update_gid_work *work;
         int i;
@@ -1434,26 +1447,31 @@ static int update_gid_table(struct mlx4_ib_dev *dev, int port,
         int found = -1;
         int max_gids;
 
-        max_gids = dev->dev->caps.gid_table_len[port];
-        for (i = 0; i < max_gids; ++i) {
-                if (!memcmp(&dev->iboe.gid_table[port - 1][i], gid,
-                            sizeof(*gid)))
-                        found = i;
-
-                if (clear) {
-                        if (found >= 0) {
-                                need_update = 1;
-                                dev->iboe.gid_table[port - 1][found] = zgid;
-                                break;
-                        }
-                } else {
-                        if (found >= 0)
-                                break;
-
-                        if (free < 0 &&
-                            !memcmp(&dev->iboe.gid_table[port - 1][i], &zgid,
+        if (default_gid) {
+                free = 0;
+        } else {
+                max_gids = dev->dev->caps.gid_table_len[port];
+                for (i = 1; i < max_gids; ++i) {
+                        if (!memcmp(&dev->iboe.gid_table[port - 1][i], gid,
                                     sizeof(*gid)))
-                                free = i;
+                                found = i;
+
+                        if (clear) {
+                                if (found >= 0) {
+                                        need_update = 1;
+                                        dev->iboe.gid_table[port - 1][found] =
+                                                zgid;
+                                        break;
+                                }
+                        } else {
+                                if (found >= 0)
+                                        break;
+
+                                if (free < 0 &&
+                                    !memcmp(&dev->iboe.gid_table[port - 1][i],
+                                            &zgid, sizeof(*gid)))
+                                        free = i;
+                        }
                 }
         }
 
@@ -1478,18 +1496,26 @@ static int update_gid_table(struct mlx4_ib_dev *dev, int port,
         return 0;
 }
 
-static int reset_gid_table(struct mlx4_ib_dev *dev)
+static void mlx4_make_default_gid(struct  net_device *dev, union ib_gid *gid)
 {
-        struct update_gid_work *work;
+        gid->global.subnet_prefix = cpu_to_be64(0xfe80000000000000LL);
+        mlx4_addrconf_ifid_eui48(&gid->raw[8], 0xffff, dev);
+}
+
 
+static int reset_gid_table(struct mlx4_ib_dev *dev, u8 port)
+{
+        struct update_gid_work *work;
 
         work = kzalloc(sizeof(*work), GFP_ATOMIC);
         if (!work)
                 return -ENOMEM;
-        memset(dev->iboe.gid_table, 0, sizeof(dev->iboe.gid_table));
+
+        memset(dev->iboe.gid_table[port - 1], 0, sizeof(work->gids));
         memset(work->gids, 0, sizeof(work->gids));
         INIT_WORK(&work->work, reset_gids_task);
         work->dev = dev;
+        work->port = port;
         queue_work(wq, &work->work);
         return 0;
 }
@@ -1502,6 +1528,12 @@ static int mlx4_ib_addr_event(int event, struct net_device *event_netdev,
         struct net_device *real_dev = rdma_vlan_dev_real_dev(event_netdev) ?
                                 rdma_vlan_dev_real_dev(event_netdev) :
                                 event_netdev;
+        union ib_gid default_gid;
+
+        mlx4_make_default_gid(real_dev, &default_gid);
+
+        if (!memcmp(gid, &default_gid, sizeof(*gid)))
+                return 0;
 
         if (event != NETDEV_DOWN && event != NETDEV_UP)
                 return 0;
@@ -1520,7 +1552,7 @@ static int mlx4_ib_addr_event(int event, struct net_device *event_netdev,
                      (!netif_is_bond_master(real_dev) &&
                      (real_dev == iboe->netdevs[port - 1])))
                         update_gid_table(ibdev, port, gid,
-                                         event == NETDEV_DOWN);
+                                         event == NETDEV_DOWN, 0);
 
         spin_unlock(&iboe->lock);
         return 0;
@@ -1536,7 +1568,6 @@ static u8 mlx4_ib_get_dev_port(struct net_device *dev,
                                 rdma_vlan_dev_real_dev(dev) : dev;
 
         iboe = &ibdev->iboe;
-        spin_lock(&iboe->lock);
 
         for (port = 1; port <= MLX4_MAX_PORTS; ++port)
                 if ((netif_is_bond_master(real_dev) &&
@@ -1545,8 +1576,6 @@ static u8 mlx4_ib_get_dev_port(struct net_device *dev,
                      (real_dev == iboe->netdevs[port - 1])))
                         break;
 
-        spin_unlock(&iboe->lock);
-
         if ((port == 0) || (port > MLX4_MAX_PORTS))
                 return 0;
         else
@@ -1607,7 +1636,7 @@ static void mlx4_ib_get_dev_addr(struct net_device *dev,
                         /*ifa->ifa_address;*/
                         ipv6_addr_set_v4mapped(ifa->ifa_address,
                                                (struct in6_addr *)&gid);
-                        update_gid_table(ibdev, port, &gid, 0);
+                        update_gid_table(ibdev, port, &gid, 0, 0);
                 }
                 endfor_ifa(in_dev);
                 in_dev_put(in_dev);
@@ -1619,7 +1648,7 @@ static void mlx4_ib_get_dev_addr(struct net_device *dev,
                 read_lock_bh(&in6_dev->lock);
                 list_for_each_entry(ifp, &in6_dev->addr_list, if_list) {
                         pgid = (union ib_gid *)&ifp->addr;
-                        update_gid_table(ibdev, port, pgid, 0);
+                        update_gid_table(ibdev, port, pgid, 0, 0);
                 }
                 read_unlock_bh(&in6_dev->lock);
                 in6_dev_put(in6_dev);
@@ -1627,14 +1656,26 @@ static void mlx4_ib_get_dev_addr(struct net_device *dev,
 #endif
 }
 
+static void mlx4_ib_set_default_gid(struct mlx4_ib_dev *ibdev,
+                                 struct  net_device *dev, u8 port)
+{
+        union ib_gid gid;
+        mlx4_make_default_gid(dev, &gid);
+        update_gid_table(ibdev, port, &gid, 0, 1);
+}
+
 static int mlx4_ib_init_gid_table(struct mlx4_ib_dev *ibdev)
 {
         struct  net_device *dev;
+        struct mlx4_ib_iboe *iboe = &ibdev->iboe;
+        int i;
 
-        if (reset_gid_table(ibdev))
-                return -1;
+        for (i = 1; i <= ibdev->num_ports; ++i)
+                if (reset_gid_table(ibdev, i))
+                        return -1;
 
         read_lock(&dev_base_lock);
+        spin_lock(&iboe->lock);
 
         for_each_netdev(&init_net, dev) {
                 u8 port = mlx4_ib_get_dev_port(dev, ibdev);
@@ -1642,6 +1683,7 @@ static int mlx4_ib_init_gid_table(struct mlx4_ib_dev *ibdev)
                         mlx4_ib_get_dev_addr(dev, ibdev, port);
         }
 
+        spin_unlock(&iboe->lock);
         read_unlock(&dev_base_lock);
 
         return 0;
@@ -1656,25 +1698,57 @@ static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev)
 
         spin_lock(&iboe->lock);
         mlx4_foreach_ib_transport_port(port, ibdev->dev) {
+                enum ib_port_state      port_state = IB_PORT_NOP;
                 struct net_device *old_master = iboe->masters[port - 1];
+                struct net_device *curr_netdev;
                 struct net_device *curr_master;
+
                 iboe->netdevs[port - 1] =
                         mlx4_get_protocol_dev(ibdev->dev, MLX4_PROT_ETH, port);
+                if (iboe->netdevs[port - 1])
+                        mlx4_ib_set_default_gid(ibdev,
+                                                iboe->netdevs[port - 1], port);
+                curr_netdev = iboe->netdevs[port - 1];
 
                 if (iboe->netdevs[port - 1] &&
                     netif_is_bond_slave(iboe->netdevs[port - 1])) {
-                        rtnl_lock();
                         iboe->masters[port - 1] = netdev_master_upper_dev_get(
                                 iboe->netdevs[port - 1]);
-                        rtnl_unlock();
+                } else {
+                        iboe->masters[port - 1] = NULL;
                 }
                 curr_master = iboe->masters[port - 1];
 
+                if (curr_netdev) {
+                        port_state = (netif_running(curr_netdev) && netif_carrier_ok(curr_netdev)) ?
+                                                IB_PORT_ACTIVE : IB_PORT_DOWN;
+                        mlx4_ib_set_default_gid(ibdev, curr_netdev, port);
+                } else {
+                        reset_gid_table(ibdev, port);
+                }
+                /* if using bonding/team and a slave port is down, we don't the bond IP
+                 * based gids in the table since flows that select port by gid may get
+                 * the down port.
+                 */
+                if (curr_master && (port_state == IB_PORT_DOWN)) {
+                        reset_gid_table(ibdev, port);
+                        mlx4_ib_set_default_gid(ibdev, curr_netdev, port);
+                }
                 /* if bonding is used it is possible that we add it to masters
-                    only after IP address is assigned to the net bonding
-                    interface */
-                if (curr_master && (old_master != curr_master))
+                 * only after IP address is assigned to the net bonding
+                 * interface.
+                */
+                if (curr_master && (old_master != curr_master)) {
+                        reset_gid_table(ibdev, port);
+                        mlx4_ib_set_default_gid(ibdev, curr_netdev, port);
                         mlx4_ib_get_dev_addr(curr_master, ibdev, port);
+                }
+
+                if (!curr_master && (old_master != curr_master)) {
+                        reset_gid_table(ibdev, port);
+                        mlx4_ib_set_default_gid(ibdev, curr_netdev, port);
+                        mlx4_ib_get_dev_addr(curr_netdev, ibdev, port);
+                }
         }
 
         spin_unlock(&iboe->lock);
@@ -1810,6 +1884,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
         int i, j;
         int err;
         struct mlx4_ib_iboe *iboe;
+        int ib_num_ports = 0;
 
         pr_info_once("%s", mlx4_ib_version);
 
@@ -1985,10 +2060,14 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                                 ibdev->counters[i] = -1;
         }
 
+        mlx4_foreach_port(i, dev, MLX4_PORT_TYPE_IB)
+                ib_num_ports++;
+
         spin_lock_init(&ibdev->sm_lock);
         mutex_init(&ibdev->cap_mask_mutex);
 
-        if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED) {
+        if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED &&
+            ib_num_ports) {
                 ibdev->steer_qpn_count = MLX4_IB_UC_MAX_NUM_QPS;
                 err = mlx4_qp_reserve_range(dev, ibdev->steer_qpn_count,
                                             MLX4_IB_UC_STEER_QPN_ALIGN,
@@ -2051,7 +2130,11 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                         }
                 }
 #endif
+                for (i = 1 ; i <= ibdev->num_ports ; ++i)
+                        reset_gid_table(ibdev, i);
+                rtnl_lock();
                 mlx4_ib_scan_netdevs(ibdev);
+                rtnl_unlock();
                 mlx4_ib_init_gid_table(ibdev);
         }
 
diff --git a/drivers/infiniband/hw/mlx5/Kconfig b/drivers/infiniband/hw/mlx5/Kconfig
index 8e6aebfaf8a4..10df386c6344 100644
--- a/drivers/infiniband/hw/mlx5/Kconfig
+++ b/drivers/infiniband/hw/mlx5/Kconfig
@@ -1,6 +1,6 @@
 config MLX5_INFINIBAND
         tristate "Mellanox Connect-IB HCA support"
-        depends on NETDEVICES && ETHERNET && PCI && X86
+        depends on NETDEVICES && ETHERNET && PCI
         select NET_VENDOR_MELLANOX
         select MLX5_CORE
         ---help---
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 9660d093f8cf..aa03e732b6a8 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -261,8 +261,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
         props->device_cap_flags    = IB_DEVICE_CHANGE_PHY_PORT |
                 IB_DEVICE_PORT_ACTIVE_EVENT             |
                 IB_DEVICE_SYS_IMAGE_GUID                |
-                IB_DEVICE_RC_RNR_NAK_GEN                |
-                IB_DEVICE_BLOCK_MULTICAST_LOOPBACK;
+                IB_DEVICE_RC_RNR_NAK_GEN;
         flags = dev->mdev.caps.flags;
         if (flags & MLX5_DEV_CAP_FLAG_BAD_PKEY_CNTR)
                 props->device_cap_flags |= IB_DEVICE_BAD_PKEY_CNTR;
@@ -536,24 +535,38 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
                                                   struct ib_udata *udata)
 {
         struct mlx5_ib_dev *dev = to_mdev(ibdev);
-        struct mlx5_ib_alloc_ucontext_req req;
+        struct mlx5_ib_alloc_ucontext_req_v2 req;
         struct mlx5_ib_alloc_ucontext_resp resp;
         struct mlx5_ib_ucontext *context;
         struct mlx5_uuar_info *uuari;
         struct mlx5_uar *uars;
         int gross_uuars;
         int num_uars;
+        int ver;
         int uuarn;
         int err;
         int i;
+        int reqlen;
 
         if (!dev->ib_active)
                 return ERR_PTR(-EAGAIN);
 
-        err = ib_copy_from_udata(&req, udata, sizeof(req));
+        memset(&req, 0, sizeof(req));
+        reqlen = udata->inlen - sizeof(struct ib_uverbs_cmd_hdr);
+        if (reqlen == sizeof(struct mlx5_ib_alloc_ucontext_req))
+                ver = 0;
+        else if (reqlen == sizeof(struct mlx5_ib_alloc_ucontext_req_v2))
+                ver = 2;
+        else
+                return ERR_PTR(-EINVAL);
+
+        err = ib_copy_from_udata(&req, udata, reqlen);
         if (err)
                 return ERR_PTR(err);
 
+        if (req.flags || req.reserved)
+                return ERR_PTR(-EINVAL);
+
         if (req.total_num_uuars > MLX5_MAX_UUARS)
                 return ERR_PTR(-ENOMEM);
 
@@ -626,6 +639,7 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
         if (err)
                 goto out_uars;
 
+        uuari->ver = ver;
         uuari->num_low_latency_uuars = req.num_low_latency_uuars;
         uuari->uars = uars;
         uuari->num_uars = num_uars;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index ae37fb9bf262..7dfe8a1c84cf 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -216,7 +216,9 @@ static int sq_overhead(enum ib_qp_type qp_type)
 
         case IB_QPT_UC:
                 size += sizeof(struct mlx5_wqe_ctrl_seg) +
-                        sizeof(struct mlx5_wqe_raddr_seg);
+                        sizeof(struct mlx5_wqe_raddr_seg) +
+                        sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+                        sizeof(struct mlx5_mkey_seg);
                 break;
 
         case IB_QPT_UD:
@@ -428,11 +430,17 @@ static int alloc_uuar(struct mlx5_uuar_info *uuari,
                 break;
 
         case MLX5_IB_LATENCY_CLASS_MEDIUM:
-                uuarn = alloc_med_class_uuar(uuari);
+                if (uuari->ver < 2)
+                        uuarn = -ENOMEM;
+                else
+                        uuarn = alloc_med_class_uuar(uuari);
                 break;
 
         case MLX5_IB_LATENCY_CLASS_HIGH:
-                uuarn = alloc_high_class_uuar(uuari);
+                if (uuari->ver < 2)
+                        uuarn = -ENOMEM;
+                else
+                        uuarn = alloc_high_class_uuar(uuari);
                 break;
 
         case MLX5_IB_LATENCY_CLASS_FAST_PATH:
@@ -657,8 +665,8 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev,
         int err;
 
         uuari = &dev->mdev.priv.uuari;
-        if (init_attr->create_flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK)
-                qp->flags |= MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK;
+        if (init_attr->create_flags)
+                return -EINVAL;
 
         if (init_attr->qp_type == MLX5_IB_QPT_REG_UMR)
                 lc = MLX5_IB_LATENCY_CLASS_FAST_PATH;
diff --git a/drivers/infiniband/hw/mlx5/user.h b/drivers/infiniband/hw/mlx5/user.h
index 32a2a5dfc523..0f4f8e42a17f 100644
--- a/drivers/infiniband/hw/mlx5/user.h
+++ b/drivers/infiniband/hw/mlx5/user.h
@@ -62,6 +62,13 @@ struct mlx5_ib_alloc_ucontext_req {
         __u32   num_low_latency_uuars;
 };
 
+struct mlx5_ib_alloc_ucontext_req_v2 {
+        __u32   total_num_uuars;
+        __u32   num_low_latency_uuars;
+        __u32   flags;
+        __u32   reserved;
+};
+
 struct mlx5_ib_alloc_ucontext_resp {
         __u32   qp_tab_size;
         __u32   bf_reg_size;
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index 429141078eec..353c7b05a90a 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -675,8 +675,11 @@ static int nes_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
         INIT_DELAYED_WORK(&nesdev->work, nes_recheck_link_status);
 
         /* Initialize network devices */
-        if ((netdev = nes_netdev_init(nesdev, mmio_regs)) == NULL)
+        netdev = nes_netdev_init(nesdev, mmio_regs);
+        if (netdev == NULL) {
+                ret = -ENOMEM;
                 goto bail7;
+        }
 
         /* Register network device */
         ret = register_netdev(netdev);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 2ca86ca818bd..1a8a945efa60 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -127,7 +127,7 @@ static int ocrdma_addr_event(unsigned long event, struct net_device *netdev,
 
         is_vlan = netdev->priv_flags & IFF_802_1Q_VLAN;
         if (is_vlan)
-                netdev = vlan_dev_real_dev(netdev);
+                netdev = rdma_vlan_dev_real_dev(netdev);
 
         rcu_read_lock();
         list_for_each_entry_rcu(dev, &ocrdma_dev_list, entry) {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index aa92f40c9d50..e0cc201be41a 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -176,7 +176,7 @@ int ocrdma_query_port(struct ib_device *ibdev,
         props->port_cap_flags =
             IB_PORT_CM_SUP |
             IB_PORT_REINIT_SUP |
-            IB_PORT_DEVICE_MGMT_SUP | IB_PORT_VENDOR_CLASS_SUP;
+            IB_PORT_DEVICE_MGMT_SUP | IB_PORT_VENDOR_CLASS_SUP | IB_PORT_IP_BASED_GIDS;
         props->gid_tbl_len = OCRDMA_MAX_SGID;
         props->pkey_tbl_len = 1;
         props->bad_pkey_cntr = 0;
@@ -1416,7 +1416,7 @@ int ocrdma_query_qp(struct ib_qp *ibqp,
                                           OCRDMA_QP_PARAMS_HOP_LMT_MASK) >>
                                                 OCRDMA_QP_PARAMS_HOP_LMT_SHIFT;
         qp_attr->ah_attr.grh.traffic_class = (params.tclass_sq_psn &
-                                              OCRDMA_QP_PARAMS_SQ_PSN_MASK) >>
+                                              OCRDMA_QP_PARAMS_TCLASS_MASK) >>
                                                 OCRDMA_QP_PARAMS_TCLASS_SHIFT;
 
         qp_attr->ah_attr.ah_flags = IB_AH_GRH;
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 5bfc02f450e6..d1bd21319d7d 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -2395,6 +2395,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
         qib_write_kreg_port(ppd, krp_ibcctrl_a, ppd->cpspec->ibcctrl_a);
         qib_write_kreg(dd, kr_scratch, 0ULL);
 
+        /* ensure previous Tx parameters are not still forced */
+        qib_write_kreg_port(ppd, krp_tx_deemph_override,
+                SYM_MASK(IBSD_TX_DEEMPHASIS_OVERRIDE_0,
+                reset_tx_deemphasis_override));
+
         if (qib_compat_ddr_negotiate) {
                 ppd->cpspec->ibdeltainprog = 1;
                 ppd->cpspec->ibsymsnap = read_7322_creg32_port(ppd,
diff --git a/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c b/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
index 7ecc6061f1f4..f8dfd76be89f 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
@@ -629,6 +629,7 @@ static int qp_grp_id_from_flow(struct usnic_ib_qp_grp_flow *qp_flow,
 {
         enum usnic_transport_type trans_type = qp_flow->trans_type;
         int err;
+        uint16_t port_num = 0;
 
         switch (trans_type) {
         case USNIC_TRANSPORT_ROCE_CUSTOM:
@@ -637,9 +638,15 @@ static int qp_grp_id_from_flow(struct usnic_ib_qp_grp_flow *qp_flow,
         case USNIC_TRANSPORT_IPV4_UDP:
                 err = usnic_transport_sock_get_addr(qp_flow->udp.sock,
                                                         NULL, NULL,
-                                                        (uint16_t *) id);
+                                                        &port_num);
                 if (err)
                         return err;
+                /*
+                 * Copy port_num to stack first and then to *id,
+                 * so that the short to int cast works for little
+                 * and big endian systems.
+                 */
+                *id = port_num;
                 break;
         default:
                 usnic_err("Unsupported transport %u\n", trans_type);
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 538822684d5b..334f34b1cd46 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -610,11 +610,12 @@ void iser_snd_completion(struct iser_tx_desc *tx_desc,
                 ib_dma_unmap_single(device->ib_device, tx_desc->dma_addr,
                                         ISER_HEADERS_LEN, DMA_TO_DEVICE);
                 kmem_cache_free(ig.desc_cache, tx_desc);
+                tx_desc = NULL;
         }
 
         atomic_dec(&ib_conn->post_send_buf_count);
 
-        if (tx_desc->type == ISCSI_TX_CONTROL) {
+        if (tx_desc && tx_desc->type == ISCSI_TX_CONTROL) {
                 /* this arithmetic is legal by libiscsi dd_data allocation */
                 task = (void *) ((long)(void *)tx_desc -
                                   sizeof(struct iscsi_task));
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index afe95674008b..ca37edef2791 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -652,9 +652,13 @@ static int iser_disconnected_handler(struct rdma_cm_id *cma_id)
         /* getting here when the state is UP means that the conn is being *
          * terminated asynchronously from the iSCSI layer's perspective.  */
         if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
-                                      ISER_CONN_TERMINATING))
-                iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
-                                   ISCSI_ERR_CONN_FAILED);
+                                        ISER_CONN_TERMINATING)){
+                if (ib_conn->iser_conn)
+                        iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
+                                           ISCSI_ERR_CONN_FAILED);
+                else
+                        iser_err("iscsi_iser connection isn't bound\n");
+        }
 
         /* Complete the termination process if no posts are pending */
         if (ib_conn->post_recv_buf_count == 0 &&
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 2b161be3c1a3..d18d08a076e8 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -453,6 +453,7 @@ isert_conn_create_fastreg_pool(struct isert_conn *isert_conn)
                 if (ret) {
                         pr_err("Failed to create fastreg descriptor err=%d\n",
                                ret);
+                        kfree(fr_desc);
                         goto err;
                 }
 
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 520a7e5a490b..0e537d8d0e47 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -3666,9 +3666,9 @@ static ssize_t srpt_tpg_attrib_store_srp_max_rdma_size(
         unsigned long val;
         int ret;
 
-        ret = strict_strtoul(page, 0, &val);
+        ret = kstrtoul(page, 0, &val);
         if (ret < 0) {
-                pr_err("strict_strtoul() failed with ret: %d\n", ret);
+                pr_err("kstrtoul() failed with ret: %d\n", ret);
                 return -EINVAL;
         }
         if (val > MAX_SRPT_RDMA_SIZE) {
@@ -3706,9 +3706,9 @@ static ssize_t srpt_tpg_attrib_store_srp_max_rsp_size(
         unsigned long val;
         int ret;
 
-        ret = strict_strtoul(page, 0, &val);
+        ret = kstrtoul(page, 0, &val);
         if (ret < 0) {
-                pr_err("strict_strtoul() failed with ret: %d\n", ret);
+                pr_err("kstrtoul() failed with ret: %d\n", ret);
                 return -EINVAL;
         }
         if (val > MAX_SRPT_RSP_SIZE) {
@@ -3746,9 +3746,9 @@ static ssize_t srpt_tpg_attrib_store_srp_sq_size(
         unsigned long val;
         int ret;
 
-        ret = strict_strtoul(page, 0, &val);
+        ret = kstrtoul(page, 0, &val);
         if (ret < 0) {
-                pr_err("strict_strtoul() failed with ret: %d\n", ret);
+                pr_err("kstrtoul() failed with ret: %d\n", ret);
                 return -EINVAL;
         }
         if (val > MAX_SRPT_SRQ_SIZE) {
@@ -3793,7 +3793,7 @@ static ssize_t srpt_tpg_store_enable(
         unsigned long tmp;
         int ret;
 
-        ret = strict_strtoul(page, 0, &tmp);
+        ret = kstrtoul(page, 0, &tmp);
         if (ret < 0) {
                 printk(KERN_ERR "Unable to extract srpt_tpg_store_enable\n");
                 return -EINVAL;
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 8911850c9444..1d9ab39af29f 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -79,7 +79,6 @@
 
 #define ARM_SMMU_PTE_CONT_SIZE          (PAGE_SIZE * ARM_SMMU_PTE_CONT_ENTRIES)
 #define ARM_SMMU_PTE_CONT_MASK          (~(ARM_SMMU_PTE_CONT_SIZE - 1))
-#define ARM_SMMU_PTE_HWTABLE_SIZE       (PTRS_PER_PTE * sizeof(pte_t))
 
 /* Stage-1 PTE */
 #define ARM_SMMU_PTE_AP_UNPRIV          (((pteval_t)1) << 6)
@@ -191,6 +190,9 @@
 #define ARM_SMMU_GR1_CBAR(n)            (0x0 + ((n) << 2))
 #define CBAR_VMID_SHIFT                 0
 #define CBAR_VMID_MASK                  0xff
+#define CBAR_S1_BPSHCFG_SHIFT           8
+#define CBAR_S1_BPSHCFG_MASK            3
+#define CBAR_S1_BPSHCFG_NSH             3
 #define CBAR_S1_MEMATTR_SHIFT           12
 #define CBAR_S1_MEMATTR_MASK            0xf
 #define CBAR_S1_MEMATTR_WB              0xf
@@ -393,7 +395,7 @@ struct arm_smmu_domain {
         struct arm_smmu_cfg             root_cfg;
         phys_addr_t                     output_mask;
 
-        struct mutex                    lock;
+        spinlock_t                      lock;
 };
 
 static DEFINE_SPINLOCK(arm_smmu_devices_lock);
@@ -632,6 +634,28 @@ static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
+static void arm_smmu_flush_pgtable(struct arm_smmu_device *smmu, void *addr,
+                                   size_t size)
+{
+        unsigned long offset = (unsigned long)addr & ~PAGE_MASK;
+
+
+        /* Ensure new page tables are visible to the hardware walker */
+        if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK) {
+                dsb();
+        } else {
+                /*
+                 * If the SMMU can't walk tables in the CPU caches, treat them
+                 * like non-coherent DMA since we need to flush the new entries
+                 * all the way out to memory. There's no possibility of
+                 * recursion here as the SMMU table walker will not be wired
+                 * through another SMMU.
+                 */
+                dma_map_page(smmu->dev, virt_to_page(addr), offset, size,
+                                DMA_TO_DEVICE);
+        }
+}
+
 static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain)
 {
         u32 reg;
@@ -650,11 +674,16 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain)
         if (smmu->version == 1)
               reg |= root_cfg->irptndx << CBAR_IRPTNDX_SHIFT;
 
-        /* Use the weakest memory type, so it is overridden by the pte */
-        if (stage1)
-                reg |= (CBAR_S1_MEMATTR_WB << CBAR_S1_MEMATTR_SHIFT);
-        else
+        /*
+         * Use the weakest shareability/memory types, so they are
+         * overridden by the ttbcr/pte.
+         */
+        if (stage1) {
+                reg |= (CBAR_S1_BPSHCFG_NSH << CBAR_S1_BPSHCFG_SHIFT) |
+                        (CBAR_S1_MEMATTR_WB << CBAR_S1_MEMATTR_SHIFT);
+        } else {
                 reg |= ARM_SMMU_CB_VMID(root_cfg) << CBAR_VMID_SHIFT;
+        }
         writel_relaxed(reg, gr1_base + ARM_SMMU_GR1_CBAR(root_cfg->cbndx));
 
         if (smmu->version > 1) {
@@ -715,6 +744,8 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain)
         }
 
         /* TTBR0 */
+        arm_smmu_flush_pgtable(smmu, root_cfg->pgd,
+                               PTRS_PER_PGD * sizeof(pgd_t));
         reg = __pa(root_cfg->pgd);
         writel_relaxed(reg, cb_base + ARM_SMMU_CB_TTBR0_LO);
         reg = (phys_addr_t)__pa(root_cfg->pgd) >> 32;
@@ -901,7 +932,7 @@ static int arm_smmu_domain_init(struct iommu_domain *domain)
                 goto out_free_domain;
         smmu_domain->root_cfg.pgd = pgd;
 
-        mutex_init(&smmu_domain->lock);
+        spin_lock_init(&smmu_domain->lock);
         domain->priv = smmu_domain;
         return 0;
 
@@ -1128,6 +1159,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
         struct arm_smmu_domain *smmu_domain = domain->priv;
         struct arm_smmu_device *device_smmu = dev->archdata.iommu;
         struct arm_smmu_master *master;
+        unsigned long flags;
 
         if (!device_smmu) {
                 dev_err(dev, "cannot attach to SMMU, is it on the same bus?\n");
@@ -1138,7 +1170,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
          * Sanity check the domain. We don't currently support domains
          * that cross between different SMMU chains.
          */
-        mutex_lock(&smmu_domain->lock);
+        spin_lock_irqsave(&smmu_domain->lock, flags);
         if (!smmu_domain->leaf_smmu) {
                 /* Now that we have a master, we can finalise the domain */
                 ret = arm_smmu_init_domain_context(domain, dev);
@@ -1153,7 +1185,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                         dev_name(device_smmu->dev));
                 goto err_unlock;
         }
-        mutex_unlock(&smmu_domain->lock);
+        spin_unlock_irqrestore(&smmu_domain->lock, flags);
 
         /* Looks ok, so add the device to the domain */
         master = find_smmu_master(smmu_domain->leaf_smmu, dev->of_node);
@@ -1163,7 +1195,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
         return arm_smmu_domain_add_master(smmu_domain, master);
 
 err_unlock:
-        mutex_unlock(&smmu_domain->lock);
+        spin_unlock_irqrestore(&smmu_domain->lock, flags);
         return ret;
 }
 
@@ -1177,23 +1209,6 @@ static void arm_smmu_detach_dev(struct iommu_domain *domain, struct device *dev)
                 arm_smmu_domain_remove_master(smmu_domain, master);
 }
 
-static void arm_smmu_flush_pgtable(struct arm_smmu_device *smmu, void *addr,
-                                   size_t size)
-{
-        unsigned long offset = (unsigned long)addr & ~PAGE_MASK;
-
-        /*
-         * If the SMMU can't walk tables in the CPU caches, treat them
-         * like non-coherent DMA since we need to flush the new entries
-         * all the way out to memory. There's no possibility of recursion
-         * here as the SMMU table walker will not be wired through another
-         * SMMU.
-         */
-        if (!(smmu->features & ARM_SMMU_FEAT_COHERENT_WALK))
-                dma_map_page(smmu->dev, virt_to_page(addr), offset, size,
-                             DMA_TO_DEVICE);
-}
-
 static bool arm_smmu_pte_is_contiguous_range(unsigned long addr,
                                              unsigned long end)
 {
@@ -1210,12 +1225,11 @@ static int arm_smmu_alloc_init_pte(struct arm_smmu_device *smmu, pmd_t *pmd,
 
         if (pmd_none(*pmd)) {
                 /* Allocate a new set of tables */
-                pgtable_t table = alloc_page(PGALLOC_GFP);
+                pgtable_t table = alloc_page(GFP_ATOMIC|__GFP_ZERO);
                 if (!table)
                         return -ENOMEM;
 
-                arm_smmu_flush_pgtable(smmu, page_address(table),
-                                       ARM_SMMU_PTE_HWTABLE_SIZE);
+                arm_smmu_flush_pgtable(smmu, page_address(table), PAGE_SIZE);
                 if (!pgtable_page_ctor(table)) {
                         __free_page(table);
                         return -ENOMEM;
@@ -1317,9 +1331,15 @@ static int arm_smmu_alloc_init_pmd(struct arm_smmu_device *smmu, pud_t *pud,
 
 #ifndef __PAGETABLE_PMD_FOLDED
         if (pud_none(*pud)) {
-                pmd = pmd_alloc_one(NULL, addr);
+                pmd = (pmd_t *)get_zeroed_page(GFP_ATOMIC);
                 if (!pmd)
                         return -ENOMEM;
+
+                arm_smmu_flush_pgtable(smmu, pmd, PAGE_SIZE);
+                pud_populate(NULL, pud, pmd);
+                arm_smmu_flush_pgtable(smmu, pud, sizeof(*pud));
+
+                pmd += pmd_index(addr);
         } else
 #endif
                 pmd = pmd_offset(pud, addr);
@@ -1328,8 +1348,6 @@ static int arm_smmu_alloc_init_pmd(struct arm_smmu_device *smmu, pud_t *pud,
                 next = pmd_addr_end(addr, end);
                 ret = arm_smmu_alloc_init_pte(smmu, pmd, addr, end, pfn,
                                               flags, stage);
-                pud_populate(NULL, pud, pmd);
-                arm_smmu_flush_pgtable(smmu, pud, sizeof(*pud));
                 phys += next - addr;
         } while (pmd++, addr = next, addr < end);
 
@@ -1346,9 +1364,15 @@ static int arm_smmu_alloc_init_pud(struct arm_smmu_device *smmu, pgd_t *pgd,
 
 #ifndef __PAGETABLE_PUD_FOLDED
         if (pgd_none(*pgd)) {
-                pud = pud_alloc_one(NULL, addr);
+                pud = (pud_t *)get_zeroed_page(GFP_ATOMIC);
                 if (!pud)
                         return -ENOMEM;
+
+                arm_smmu_flush_pgtable(smmu, pud, PAGE_SIZE);
+                pgd_populate(NULL, pgd, pud);
+                arm_smmu_flush_pgtable(smmu, pgd, sizeof(*pgd));
+
+                pud += pud_index(addr);
         } else
 #endif
                 pud = pud_offset(pgd, addr);
@@ -1357,8 +1381,6 @@ static int arm_smmu_alloc_init_pud(struct arm_smmu_device *smmu, pgd_t *pgd,
                 next = pud_addr_end(addr, end);
                 ret = arm_smmu_alloc_init_pmd(smmu, pud, addr, next, phys,
                                               flags, stage);
-                pgd_populate(NULL, pud, pgd);
-                arm_smmu_flush_pgtable(smmu, pgd, sizeof(*pgd));
                 phys += next - addr;
         } while (pud++, addr = next, addr < end);
 
@@ -1375,6 +1397,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         struct arm_smmu_cfg *root_cfg = &smmu_domain->root_cfg;
         pgd_t *pgd = root_cfg->pgd;
         struct arm_smmu_device *smmu = root_cfg->smmu;
+        unsigned long irqflags;
 
         if (root_cfg->cbar == CBAR_TYPE_S2_TRANS) {
                 stage = 2;
@@ -1397,7 +1420,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         if (paddr & ~output_mask)
                 return -ERANGE;
 
-        mutex_lock(&smmu_domain->lock);
+        spin_lock_irqsave(&smmu_domain->lock, irqflags);
         pgd += pgd_index(iova);
         end = iova + size;
         do {
@@ -1413,11 +1436,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         } while (pgd++, iova != end);
 
 out_unlock:
-        mutex_unlock(&smmu_domain->lock);
-
-        /* Ensure new page tables are visible to the hardware walker */
-        if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
-                dsb();
+        spin_unlock_irqrestore(&smmu_domain->lock, irqflags);
 
         return ret;
 }
@@ -1987,8 +2006,10 @@ static int __init arm_smmu_init(void)
         if (!iommu_present(&platform_bus_type))
                 bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
 
+#ifdef CONFIG_ARM_AMBA
         if (!iommu_present(&amba_bustype))
                 bus_set_iommu(&amba_bustype, &arm_smmu_ops);
+#endif
 
         return 0;
 }
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index d97fbe4fb9b1..80fffba7f12d 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -354,8 +354,8 @@ DEBUG_FOPS(mem);
                         return -ENOMEM;                                 \
         }
 
-#define DEBUG_ADD_FILE(name) __DEBUG_ADD_FILE(name, 600)
-#define DEBUG_ADD_FILE_RO(name) __DEBUG_ADD_FILE(name, 400)
+#define DEBUG_ADD_FILE(name) __DEBUG_ADD_FILE(name, 0600)
+#define DEBUG_ADD_FILE_RO(name) __DEBUG_ADD_FILE(name, 0400)
 
 static int iommu_debug_register(struct device *dev, void *data)
 {
diff --git a/drivers/irqchip/irq-orion.c b/drivers/irqchip/irq-orion.c
index e51d40031884..8e41be62812e 100644
--- a/drivers/irqchip/irq-orion.c
+++ b/drivers/irqchip/irq-orion.c
@@ -111,7 +111,8 @@ IRQCHIP_DECLARE(orion_intc, "marvell,orion-intc", orion_irq_init);
 static void orion_bridge_irq_handler(unsigned int irq, struct irq_desc *desc)
 {
         struct irq_domain *d = irq_get_handler_data(irq);
-        struct irq_chip_generic *gc = irq_get_domain_generic_chip(d, irq);
+
+        struct irq_chip_generic *gc = irq_get_domain_generic_chip(d, 0);
         u32 stat = readl_relaxed(gc->reg_base + ORION_BRIDGE_IRQ_CAUSE) &
                    gc->mask_cache;
 
@@ -123,6 +124,19 @@ static void orion_bridge_irq_handler(unsigned int irq, struct irq_desc *desc)
         }
 }
 
+/*
+ * Bridge IRQ_CAUSE is asserted regardless of IRQ_MASK register.
+ * To avoid interrupt events on stale irqs, we clear them before unmask.
+ */
+static unsigned int orion_bridge_irq_startup(struct irq_data *d)
+{
+        struct irq_chip_type *ct = irq_data_get_chip_type(d);
+
+        ct->chip.irq_ack(d);
+        ct->chip.irq_unmask(d);
+        return 0;
+}
+
 static int __init orion_bridge_irq_init(struct device_node *np,
                                         struct device_node *parent)
 {
@@ -143,7 +157,7 @@ static int __init orion_bridge_irq_init(struct device_node *np,
         }
 
         ret = irq_alloc_domain_generic_chips(domain, nrirqs, 1, np->name,
-                             handle_level_irq, clr, 0, IRQ_GC_INIT_MASK_CACHE);
+                             handle_edge_irq, clr, 0, IRQ_GC_INIT_MASK_CACHE);
         if (ret) {
                 pr_err("%s: unable to alloc irq domain gc\n", np->name);
                 return ret;
@@ -176,12 +190,14 @@ static int __init orion_bridge_irq_init(struct device_node *np,
 
         gc->chip_types[0].regs.ack = ORION_BRIDGE_IRQ_CAUSE;
         gc->chip_types[0].regs.mask = ORION_BRIDGE_IRQ_MASK;
+        gc->chip_types[0].chip.irq_startup = orion_bridge_irq_startup;
         gc->chip_types[0].chip.irq_ack = irq_gc_ack_clr_bit;
         gc->chip_types[0].chip.irq_mask = irq_gc_mask_clr_bit;
         gc->chip_types[0].chip.irq_unmask = irq_gc_mask_set_bit;
 
-        /* mask all interrupts */
+        /* mask and clear all interrupts */
         writel(0, gc->reg_base + ORION_BRIDGE_IRQ_MASK);
+        writel(0, gc->reg_base + ORION_BRIDGE_IRQ_CAUSE);
 
         irq_set_handler_data(irq, domain);
         irq_set_chained_handler(irq, orion_bridge_irq_handler);
diff --git a/drivers/isdn/hisax/q931.c b/drivers/isdn/hisax/q931.c
index af1b020a81f1..b420f8bd862e 100644
--- a/drivers/isdn/hisax/q931.c
+++ b/drivers/isdn/hisax/q931.c
@@ -810,7 +810,7 @@ prfeatureind(char *dest, u_char *p)
         dp += sprintf(dp, "    octet 3  ");
         dp += prbits(dp, *p, 8, 8);
         *dp++ = '\n';
-        if (!(*p++ & 80)) {
+        if (!(*p++ & 0x80)) {
                 dp += sprintf(dp, "    octet 4  ");
                 dp += prbits(dp, *p++, 8, 8);
                 *dp++ = '\n';
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 0c707e4f4eaf..a4c7306ff43d 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -210,7 +210,9 @@ BITMASK(GC_MARK,	 struct bucket, gc_mark, 0, 2);
 #define GC_MARK_RECLAIMABLE     0
 #define GC_MARK_DIRTY           1
 #define GC_MARK_METADATA        2
-BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 13);
+#define GC_SECTORS_USED_SIZE    13
+#define MAX_GC_SECTORS_USED     (~(~0ULL << GC_SECTORS_USED_SIZE))
+BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, GC_SECTORS_USED_SIZE);
 BITMASK(GC_MOVE, struct bucket, gc_mark, 15, 1);
 
 #include "journal.h"
diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
index 4f6b5940e609..3f74b4b0747b 100644
--- a/drivers/md/bcache/bset.c
+++ b/drivers/md/bcache/bset.c
@@ -23,7 +23,7 @@ void bch_dump_bset(struct btree_keys *b, struct bset *i, unsigned set)
         for (k = i->start; k < bset_bkey_last(i); k = next) {
                 next = bkey_next(k);
 
-                printk(KERN_ERR "block %u key %zi/%u: ", set,
+                printk(KERN_ERR "block %u key %li/%u: ", set,
                        (uint64_t *) k - i->d, i->keys);
 
                 if (b->ops->key_dump)
@@ -1185,9 +1185,12 @@ static void __btree_sort(struct btree_keys *b, struct btree_iter *iter,
         struct bset *out = (void *) __get_free_pages(__GFP_NOWARN|GFP_NOIO,
                                                      order);
         if (!out) {
+                struct page *outp;
+
                 BUG_ON(order > state->page_order);
 
-                out = page_address(mempool_alloc(state->pool, GFP_NOIO));
+                outp = mempool_alloc(state->pool, GFP_NOIO);
+                out = page_address(outp);
                 used_mempool = true;
                 order = state->page_order;
         }
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 98cc0a810a36..5f9c2a665ca5 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1167,7 +1167,7 @@ uint8_t __bch_btree_mark_key(struct cache_set *c, int level, struct bkey *k)
                 /* guard against overflow */
                 SET_GC_SECTORS_USED(g, min_t(unsigned,
                                              GC_SECTORS_USED(g) + KEY_SIZE(k),
-                                             (1 << 14) - 1));
+                                             MAX_GC_SECTORS_USED));
 
                 BUG_ON(!GC_SECTORS_USED(g));
         }
@@ -1805,7 +1805,7 @@ static bool btree_insert_key(struct btree *b, struct bkey *k,
 
 static size_t insert_u64s_remaining(struct btree *b)
 {
-        ssize_t ret = bch_btree_keys_u64s_remaining(&b->keys);
+        long ret = bch_btree_keys_u64s_remaining(&b->keys);
 
         /*
          * Might land in the middle of an existing extent and have to split it
diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c
index c3ead586dc27..416d1a3e028e 100644
--- a/drivers/md/bcache/extents.c
+++ b/drivers/md/bcache/extents.c
@@ -194,7 +194,7 @@ err:
         mutex_unlock(&b->c->bucket_lock);
         bch_extent_to_text(buf, sizeof(buf), k);
         btree_bug(b,
-"inconsistent btree pointer %s: bucket %li pin %i prio %i gen %i last_gc %i mark %llu gc_gen %i",
+"inconsistent btree pointer %s: bucket %zi pin %i prio %i gen %i last_gc %i mark %llu gc_gen %i",
                   buf, PTR_BUCKET_NR(b->c, k, i), atomic_read(&g->pin),
                   g->prio, g->gen, g->last_gc, GC_MARK(g), g->gc_gen);
         return true;
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 72cd213f213f..5d5d031cf381 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -353,14 +353,14 @@ static void bch_data_insert_start(struct closure *cl)
         struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
         struct bio *bio = op->bio, *n;
 
-        if (op->bypass)
-                return bch_data_invalidate(cl);
-
         if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) {
                 set_gc_sectors(op->c);
                 wake_up_gc(op->c);
         }
 
+        if (op->bypass)
+                return bch_data_invalidate(cl);
+
         /*
          * Journal writes are marked REQ_FLUSH; if the original write was a
          * flush, it'll wait on the journal write.
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index c6ab69333a6d..d8458d477a12 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -416,7 +416,7 @@ static int btree_bset_stats(struct btree_op *b_op, struct btree *b)
         return MAP_CONTINUE;
 }
 
-int bch_bset_print_stats(struct cache_set *c, char *buf)
+static int bch_bset_print_stats(struct cache_set *c, char *buf)
 {
         struct bset_stats_op op;
         int ret;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index fd3a2a14b587..4a6ca1cb2e78 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1953,11 +1953,15 @@ static int process_checks(struct r1bio *r1_bio)
         for (i = 0; i < conf->raid_disks * 2; i++) {
                 int j;
                 int size;
+                int uptodate;
                 struct bio *b = r1_bio->bios[i];
                 if (b->bi_end_io != end_sync_read)
                         continue;
-                /* fixup the bio for reuse */
+                /* fixup the bio for reuse, but preserve BIO_UPTODATE */
+                uptodate = test_bit(BIO_UPTODATE, &b->bi_flags);
                 bio_reset(b);
+                if (!uptodate)
+                        clear_bit(BIO_UPTODATE, &b->bi_flags);
                 b->bi_vcnt = vcnt;
                 b->bi_iter.bi_size = r1_bio->sectors << 9;
                 b->bi_iter.bi_sector = r1_bio->sector +
@@ -1990,11 +1994,14 @@ static int process_checks(struct r1bio *r1_bio)
                 int j;
                 struct bio *pbio = r1_bio->bios[primary];
                 struct bio *sbio = r1_bio->bios[i];
+                int uptodate = test_bit(BIO_UPTODATE, &sbio->bi_flags);
 
                 if (sbio->bi_end_io != end_sync_read)
                         continue;
+                /* Now we can 'fixup' the BIO_UPTODATE flag */
+                set_bit(BIO_UPTODATE, &sbio->bi_flags);
 
-                if (test_bit(BIO_UPTODATE, &sbio->bi_flags)) {
+                if (uptodate) {
                         for (j = vcnt; j-- ; ) {
                                 struct page *p, *s;
                                 p = pbio->bi_io_vec[j].bv_page;
@@ -2009,7 +2016,7 @@ static int process_checks(struct r1bio *r1_bio)
                 if (j >= 0)
                         atomic64_add(r1_bio->sectors, &mddev->resync_mismatches);
                 if (j < 0 || (test_bit(MD_RECOVERY_CHECK, &mddev->recovery)
-                              && test_bit(BIO_UPTODATE, &sbio->bi_flags))) {
+                              && uptodate)) {
                         /* No need to write to this device. */
                         sbio->bi_end_io = NULL;
                         rdev_dec_pending(conf->mirrors[i].rdev, mddev);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index f1feadeb7bb2..16f5c21963db 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5514,23 +5514,43 @@ raid5_size(struct mddev *mddev, sector_t sectors, int raid_disks)
         return sectors * (raid_disks - conf->max_degraded);
 }
 
+static void free_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
+{
+        safe_put_page(percpu->spare_page);
+        kfree(percpu->scribble);
+        percpu->spare_page = NULL;
+        percpu->scribble = NULL;
+}
+
+static int alloc_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
+{
+        if (conf->level == 6 && !percpu->spare_page)
+                percpu->spare_page = alloc_page(GFP_KERNEL);
+        if (!percpu->scribble)
+                percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
+
+        if (!percpu->scribble || (conf->level == 6 && !percpu->spare_page)) {
+                free_scratch_buffer(conf, percpu);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
 static void raid5_free_percpu(struct r5conf *conf)
 {
-        struct raid5_percpu *percpu;
         unsigned long cpu;
 
         if (!conf->percpu)
                 return;
 
-        get_online_cpus();
-        for_each_possible_cpu(cpu) {
-                percpu = per_cpu_ptr(conf->percpu, cpu);
-                safe_put_page(percpu->spare_page);
-                kfree(percpu->scribble);
-        }
 #ifdef CONFIG_HOTPLUG_CPU
         unregister_cpu_notifier(&conf->cpu_notify);
 #endif
+
+        get_online_cpus();
+        for_each_possible_cpu(cpu)
+                free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
         put_online_cpus();
 
         free_percpu(conf->percpu);
@@ -5557,15 +5577,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
         switch (action) {
         case CPU_UP_PREPARE:
         case CPU_UP_PREPARE_FROZEN:
-                if (conf->level == 6 && !percpu->spare_page)
-                        percpu->spare_page = alloc_page(GFP_KERNEL);
-                if (!percpu->scribble)
-                        percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
-
-                if (!percpu->scribble ||
-                    (conf->level == 6 && !percpu->spare_page)) {
-                        safe_put_page(percpu->spare_page);
-                        kfree(percpu->scribble);
+                if (alloc_scratch_buffer(conf, percpu)) {
                         pr_err("%s: failed memory allocation for cpu%ld\n",
                                __func__, cpu);
                         return notifier_from_errno(-ENOMEM);
@@ -5573,10 +5585,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
                 break;
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
-                safe_put_page(percpu->spare_page);
-                kfree(percpu->scribble);
-                percpu->spare_page = NULL;
-                percpu->scribble = NULL;
+                free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
                 break;
         default:
                 break;
@@ -5588,40 +5597,29 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
 static int raid5_alloc_percpu(struct r5conf *conf)
 {
         unsigned long cpu;
-        struct page *spare_page;
-        struct raid5_percpu __percpu *allcpus;
-        void *scribble;
-        int err;
+        int err = 0;
 
-        allcpus = alloc_percpu(struct raid5_percpu);
-        if (!allcpus)
+        conf->percpu = alloc_percpu(struct raid5_percpu);
+        if (!conf->percpu)
                 return -ENOMEM;
-        conf->percpu = allcpus;
+
+#ifdef CONFIG_HOTPLUG_CPU
+        conf->cpu_notify.notifier_call = raid456_cpu_notify;
+        conf->cpu_notify.priority = 0;
+        err = register_cpu_notifier(&conf->cpu_notify);
+        if (err)
+                return err;
+#endif
 
         get_online_cpus();
-        err = 0;
         for_each_present_cpu(cpu) {
-                if (conf->level == 6) {
-                        spare_page = alloc_page(GFP_KERNEL);
-                        if (!spare_page) {
-                                err = -ENOMEM;
-                                break;
-                        }
-                        per_cpu_ptr(conf->percpu, cpu)->spare_page = spare_page;
-                }
-                scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
-                if (!scribble) {
-                        err = -ENOMEM;
+                err = alloc_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
+                if (err) {
+                        pr_err("%s: failed memory allocation for cpu%ld\n",
+                               __func__, cpu);
                         break;
                 }
-                per_cpu_ptr(conf->percpu, cpu)->scribble = scribble;
         }
-#ifdef CONFIG_HOTPLUG_CPU
-        conf->cpu_notify.notifier_call = raid456_cpu_notify;
-        conf->cpu_notify.priority = 0;
-        if (err == 0)
-                err = register_cpu_notifier(&conf->cpu_notify);
-#endif
         put_online_cpus();
 
         return err;
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index a60c188c2bd9..04bd3b6de401 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -754,19 +754,19 @@ static long i2o_cfg_compat_ioctl(struct file *file, unsigned cmd,
                                  unsigned long arg)
 {
         int ret;
-        mutex_lock(&i2o_cfg_mutex);
         switch (cmd) {
         case I2OGETIOPS:
                 ret = i2o_cfg_ioctl(file, cmd, arg);
                 break;
         case I2OPASSTHRU32:
+                mutex_lock(&i2o_cfg_mutex);
                 ret = i2o_cfg_passthru32(file, cmd, arg);
+                mutex_unlock(&i2o_cfg_mutex);
                 break;
         default:
                 ret = -ENOIOCTLCMD;
                 break;
         }
-        mutex_unlock(&i2o_cfg_mutex);
         return ret;
 }
 
diff --git a/drivers/mfd/da9055-i2c.c b/drivers/mfd/da9055-i2c.c
index 13af7e50021e..8103e4362132 100644
--- a/drivers/mfd/da9055-i2c.c
+++ b/drivers/mfd/da9055-i2c.c
@@ -53,17 +53,25 @@ static int da9055_i2c_remove(struct i2c_client *i2c)
         return 0;
 }
 
+/*
+ * DO NOT change the device Ids. The naming is intentionally specific as both
+ * the PMIC and CODEC parts of this chip are instantiated separately as I2C
+ * devices (both have configurable I2C addresses, and are to all intents and
+ * purposes separate). As a result there are specific DA9055 ids for PMIC
+ * and CODEC, which must be different to operate together.
+ */
 static struct i2c_device_id da9055_i2c_id[] = {
-        {"da9055", 0},
+        {"da9055-pmic", 0},
         { }
 };
+MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
 
 static struct i2c_driver da9055_i2c_driver = {
         .probe = da9055_i2c_probe,
         .remove = da9055_i2c_remove,
         .id_table = da9055_i2c_id,
         .driver = {
-                .name = "da9055",
+                .name = "da9055-pmic",
                 .owner = THIS_MODULE,
         },
 };
diff --git a/drivers/mfd/max14577.c b/drivers/mfd/max14577.c
index ac514fb2b877..71aa14a6bfbb 100644
--- a/drivers/mfd/max14577.c
+++ b/drivers/mfd/max14577.c
@@ -173,6 +173,7 @@ static const struct i2c_device_id max14577_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, max14577_i2c_id);
 
+#ifdef CONFIG_PM_SLEEP
 static int max14577_suspend(struct device *dev)
 {
         struct i2c_client *i2c = container_of(dev, struct i2c_client, dev);
@@ -208,6 +209,7 @@ static int max14577_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP */
 
 static struct of_device_id max14577_dt_match[] = {
         { .compatible = "maxim,max14577", },
diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
index be88a3bf7b85..5adede0fb04c 100644
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -164,15 +164,15 @@ static struct max8997_platform_data *max8997_i2c_parse_dt_pdata(
         return pd;
 }
 
-static inline int max8997_i2c_get_driver_data(struct i2c_client *i2c,
+static inline unsigned long max8997_i2c_get_driver_data(struct i2c_client *i2c,
                                                 const struct i2c_device_id *id)
 {
         if (IS_ENABLED(CONFIG_OF) && i2c->dev.of_node) {
                 const struct of_device_id *match;
                 match = of_match_node(max8997_pmic_dt_match, i2c->dev.of_node);
-                return (int)match->data;
+                return (unsigned long)match->data;
         }
-        return (int)id->driver_data;
+        return id->driver_data;
 }
 
 static int max8997_i2c_probe(struct i2c_client *i2c,
diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
index 612ca404e150..5d5e186b5d8b 100644
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -169,16 +169,16 @@ static struct max8998_platform_data *max8998_i2c_parse_dt_pdata(
         return pd;
 }
 
-static inline int max8998_i2c_get_driver_data(struct i2c_client *i2c,
+static inline unsigned long max8998_i2c_get_driver_data(struct i2c_client *i2c,
                                                 const struct i2c_device_id *id)
 {
         if (IS_ENABLED(CONFIG_OF) && i2c->dev.of_node) {
                 const struct of_device_id *match;
                 match = of_match_node(max8998_dt_match, i2c->dev.of_node);
-                return (int)(long)match->data;
+                return (unsigned long)match->data;
         }
 
-        return (int)id->driver_data;
+        return id->driver_data;
 }
 
 static int max8998_i2c_probe(struct i2c_client *i2c,
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index a139798b8065..714e2135210e 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -315,6 +315,7 @@ static int sec_pmic_remove(struct i2c_client *i2c)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int sec_pmic_suspend(struct device *dev)
 {
         struct i2c_client *i2c = container_of(dev, struct i2c_client, dev);
@@ -349,6 +350,7 @@ static int sec_pmic_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP */
 
 static SIMPLE_DEV_PM_OPS(sec_pmic_pm_ops, sec_pmic_suspend, sec_pmic_resume);
 
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index 966cf65c5c36..3cc4c7084b92 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -158,7 +158,7 @@ static int tps65217_probe(struct i2c_client *client,
 {
         struct tps65217 *tps;
         unsigned int version;
-        unsigned int chip_id = ids->driver_data;
+        unsigned long chip_id = ids->driver_data;
         const struct of_device_id *match;
         bool status_off = false;
         int ret;
@@ -170,7 +170,7 @@ static int tps65217_probe(struct i2c_client *client,
                                 "Failed to find matching dt id\n");
                         return -EINVAL;
                 }
-                chip_id = (unsigned int)(unsigned long)match->data;
+                chip_id = (unsigned long)match->data;
                 status_off = of_property_read_bool(client->dev.of_node,
                                         "ti,pmic-shutdown-controller");
         }
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index ba04f1bc70eb..e6fab94e2c8a 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -636,7 +636,7 @@ static int wm8994_i2c_probe(struct i2c_client *i2c,
         if (i2c->dev.of_node) {
                 of_id = of_match_device(wm8994_of_match, &i2c->dev);
                 if (of_id)
-                        wm8994->type = (int)of_id->data;
+                        wm8994->type = (enum wm8994_type)of_id->data;
         } else {
                 wm8994->type = id->driver_data;
         }
diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
index 8f8a6b327cdb..2c2c9cc75231 100644
--- a/drivers/misc/genwqe/card_dev.c
+++ b/drivers/misc/genwqe/card_dev.c
@@ -787,6 +787,7 @@ static int genwqe_pin_mem(struct genwqe_file *cfile, struct genwqe_mem *m)
         if (rc != 0) {
                 dev_err(&pci_dev->dev,
                         "[%s] genwqe_user_vmap rc=%d\n", __func__, rc);
+                kfree(dma_map);
                 return rc;
         }
 
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1ee2b9492a82..89a557972d1b 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -666,7 +666,6 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
                 goto err;
 
         cb->fop_type = MEI_FOP_READ;
-        cl->read_cb = cb;
         if (dev->hbuf_is_ready) {
                 dev->hbuf_is_ready = false;
                 if (mei_hbm_cl_flow_control_req(dev, cl)) {
@@ -678,6 +677,9 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
         } else {
                 list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
         }
+
+        cl->read_cb = cb;
+
         return rets;
 err:
         mei_io_cb_free(cb);
@@ -908,7 +910,6 @@ void mei_cl_all_disconnect(struct mei_device *dev)
         list_for_each_entry_safe(cl, next, &dev->file_list, link) {
                 cl->state = MEI_FILE_DISCONNECTED;
                 cl->mei_flow_ctrl_creds = 0;
-                cl->read_cb = NULL;
                 cl->timer_count = 0;
         }
 }
@@ -942,8 +943,16 @@ void mei_cl_all_wakeup(struct mei_device *dev)
 void mei_cl_all_write_clear(struct mei_device *dev)
 {
         struct mei_cl_cb *cb, *next;
+        struct list_head *list;
+
+        list = &dev->write_list.list;
+        list_for_each_entry_safe(cb, next, list, list) {
+                list_del(&cb->list);
+                mei_io_cb_free(cb);
+        }
 
-        list_for_each_entry_safe(cb, next, &dev->write_list.list, list) {
+        list = &dev->write_waiting_list.list;
+        list_for_each_entry_safe(cb, next, list, list) {
                 list_del(&cb->list);
                 mei_io_cb_free(cb);
         }
diff --git a/drivers/misc/mic/host/mic_virtio.c b/drivers/misc/mic/host/mic_virtio.c
index 752ff873f891..7e1ef0ebbb80 100644
--- a/drivers/misc/mic/host/mic_virtio.c
+++ b/drivers/misc/mic/host/mic_virtio.c
@@ -156,7 +156,8 @@ static int mic_vringh_copy(struct mic_vdev *mvdev, struct vringh_kiov *iov,
 static int _mic_virtio_copy(struct mic_vdev *mvdev,
         struct mic_copy_desc *copy)
 {
-        int ret = 0, iovcnt = copy->iovcnt;
+        int ret = 0;
+        u32 iovcnt = copy->iovcnt;
         struct iovec iov;
         struct iovec __user *u_iov = copy->iov;
         void __user *ubuf = NULL;
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 9b2062d17327..2bef3f76032a 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -139,8 +139,11 @@ static int gru_dump_context(struct gru_state *gru, int ctxnum,
 
         ubuf += sizeof(hdr);
         ubufcch = ubuf;
-        if (gru_user_copy_handle(&ubuf, cch))
-                goto fail;
+        if (gru_user_copy_handle(&ubuf, cch)) {
+                if (cch_locked)
+                        unlock_cch_handle(cch);
+                return -EFAULT;
+        }
         if (cch_locked)
                 ubufcch->delresp = 0;
         bytes = sizeof(hdr) + GRU_CACHE_LINE_BYTES;
@@ -179,10 +182,6 @@ static int gru_dump_context(struct gru_state *gru, int ctxnum,
                 ret = -EFAULT;
 
         return ret ? ret : bytes;
-
-fail:
-        unlock_cch_handle(cch);
-        return -EFAULT;
 }
 
 int gru_dump_chiplet_request(unsigned long arg)
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index 357bbc54fe4b..3e049c13429c 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -197,7 +197,7 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         struct mmc_queue_req *mqrq_prev = &mq->mqrq[1];
 
         if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
-                limit = dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
+                limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
 
         mq->card = card;
         mq->queue = blk_init_queue(mmc_request_fn, lock);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 59eba5d2c685..9715a7ba164a 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1584,7 +1584,7 @@ read_retry:
                         }
 
                         if (mtd->ecc_stats.failed - ecc_failures) {
-                                if (retry_mode + 1 <= chip->read_retries) {
+                                if (retry_mode + 1 < chip->read_retries) {
                                         retry_mode++;
                                         ret = nand_setup_read_retry(mtd,
                                                         retry_mode);
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index ef4190a02b7b..bf642ceef681 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -1633,6 +1633,7 @@ static int omap_nand_probe(struct platform_device *pdev)
         int                             i;
         dma_cap_mask_t                  mask;
         unsigned                        sig;
+        unsigned                        oob_index;
         struct resource                 *res;
         struct mtd_part_parser_data     ppdata = {};
 
@@ -1826,11 +1827,14 @@ static int omap_nand_probe(struct platform_device *pdev)
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
                 if (nand_chip->options & NAND_BUSWIDTH_16)
-                        ecclayout->eccpos[0]    = BADBLOCK_MARKER_LENGTH;
+                        oob_index               = BADBLOCK_MARKER_LENGTH;
                 else
-                        ecclayout->eccpos[0]    = 1;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                        oob_index               = 1;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* no reserved-marker in ecclayout for this ecc-scheme */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 break;
 
         case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
@@ -1847,9 +1851,15 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
+                        ecclayout->eccpos[i] = oob_index;
+                        if (((i + 1) % nand_chip->ecc.bytes) == 0)
+                                oob_index++;
+                }
+                /* include reserved-marker in ecclayout->oobfree calculation */
+                ecclayout->oobfree->offset      = 1 +
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* software bch library is used for locating errors */
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
@@ -1883,9 +1893,12 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* reserved marker already included in ecclayout->eccbytes */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* This ECC scheme requires ELM H/W block */
                 if (is_elm_present(info, pdata->elm_of_node, BCH4_ECC) < 0) {
                         pr_err("nand: error: could not initialize ELM\n");
@@ -1913,9 +1926,15 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
+                        ecclayout->eccpos[i] = oob_index;
+                        if (((i + 1) % nand_chip->ecc.bytes) == 0)
+                                oob_index++;
+                }
+                /* include reserved-marker in ecclayout->oobfree calculation */
+                ecclayout->oobfree->offset      = 1 +
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* software bch library is used for locating errors */
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
@@ -1956,9 +1975,12 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* reserved marker already included in ecclayout->eccbytes */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 break;
 #else
                 pr_err("nand: error: CONFIG_MTD_NAND_OMAP_BCH not enabled\n");
@@ -1972,11 +1994,8 @@ static int omap_nand_probe(struct platform_device *pdev)
                 goto return_error;
         }
 
-        /* populate remaining ECC layout data */
-        ecclayout->oobfree->length = mtd->oobsize - (BADBLOCK_MARKER_LENGTH +
-                                                        ecclayout->eccbytes);
-        for (i = 1; i < ecclayout->eccbytes; i++)
-                ecclayout->eccpos[i] = ecclayout->eccpos[0] + i;
+        /* all OOB bytes from oobfree->offset till end off OOB are free */
+        ecclayout->oobfree->length = mtd->oobsize - ecclayout->oobfree->offset;
         /* check if NAND device's OOB is enough to store ECC signatures */
         if (mtd->oobsize < (ecclayout->eccbytes + BADBLOCK_MARKER_LENGTH)) {
                 pr_err("not enough OOB bytes required = %d, available=%d\n",
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index f342278539d5..494b888a6568 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -139,7 +139,7 @@ config MACVTAP
           This adds a specialized tap character device driver that is based
           on the MAC-VLAN network interface, called macvtap. A macvtap device
           can be added in the same way as a macvlan device, using 'type
-          macvlan', and then be accessed through the tap user space interface.
+          macvtap', and then be accessed through the tap user space interface.
 
           To compile this driver as a module, choose M here: the module
           will be called macvtap.
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index cce1f1bf90b4..6d20fbde8d43 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1796,8 +1796,6 @@ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout)
         BOND_AD_INFO(bond).agg_select_timer = timeout;
 }
 
-static u16 aggregator_identifier;
-
 /**
  * bond_3ad_initialize - initialize a bond's 802.3ad parameters and structures
  * @bond: bonding struct to work on
@@ -1811,7 +1809,7 @@ void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution)
         if (!MAC_ADDRESS_EQUAL(&(BOND_AD_INFO(bond).system.sys_mac_addr),
                                 bond->dev->dev_addr)) {
 
-                aggregator_identifier = 0;
+                BOND_AD_INFO(bond).aggregator_identifier = 0;
 
                 BOND_AD_INFO(bond).system.sys_priority = 0xFFFF;
                 BOND_AD_INFO(bond).system.sys_mac_addr = *((struct mac_addr *)bond->dev->dev_addr);
@@ -1880,7 +1878,7 @@ void bond_3ad_bind_slave(struct slave *slave)
                 ad_initialize_agg(aggregator);
 
                 aggregator->aggregator_mac_address = *((struct mac_addr *)bond->dev->dev_addr);
-                aggregator->aggregator_identifier = (++aggregator_identifier);
+                aggregator->aggregator_identifier = ++BOND_AD_INFO(bond).aggregator_identifier;
                 aggregator->slave = slave;
                 aggregator->is_active = 0;
                 aggregator->num_of_ports = 0;
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index 13dc9d3c5e34..f4dd9592ac62 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -253,6 +253,7 @@ struct ad_system {
 struct ad_bond_info {
         struct ad_system system;            /* 802.3ad system structure */
         u32 agg_select_timer;       // Timer to select aggregator after all adapter's hand shakes
+        u16 aggregator_identifier;
 };
 
 struct ad_slave_info {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4c08018d7333..1c6104d3501d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1270,9 +1270,13 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         if (slave_ops->ndo_set_mac_address == NULL) {
                 if (!bond_has_slaves(bond)) {
-                        pr_warning("%s: Warning: The first slave device specified does not support setting the MAC address. Setting fail_over_mac to active.",
-                                   bond_dev->name);
-                        bond->params.fail_over_mac = BOND_FOM_ACTIVE;
+                        pr_warn("%s: Warning: The first slave device specified does not support setting the MAC address.\n",
+                                bond_dev->name);
+                        if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) {
+                                bond->params.fail_over_mac = BOND_FOM_ACTIVE;
+                                pr_warn("%s: Setting fail_over_mac to active for active-backup mode.\n",
+                                        bond_dev->name);
+                        }
                 } else if (bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
                         pr_err("%s: Error: The slave device specified does not support setting the MAC address, but fail_over_mac is not set to active.\n",
                                bond_dev->name);
@@ -1315,7 +1319,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
          */
         memcpy(new_slave->perm_hwaddr, slave_dev->dev_addr, ETH_ALEN);
 
-        if (!bond->params.fail_over_mac) {
+        if (!bond->params.fail_over_mac ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                 /*
                  * Set slave to master's mac address.  The application already
                  * set the master's mac address to that of the first slave
@@ -1505,7 +1510,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         slave_dev->npinfo = bond->dev->npinfo;
         if (slave_dev->npinfo) {
                 if (slave_enable_netpoll(new_slave)) {
-                        read_unlock(&bond->lock);
                         pr_info("Error, %s: master_dev is using netpoll, "
                                  "but new slave device does not support netpoll.\n",
                                  bond_dev->name);
@@ -1539,9 +1543,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         bond_set_carrier(bond);
 
         if (USES_PRIMARY(bond->params.mode)) {
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         }
 
         pr_info("%s: enslaving %s as a%s interface with a%s link.\n",
@@ -1567,10 +1573,12 @@ err_detach:
         if (bond->primary_slave == new_slave)
                 bond->primary_slave = NULL;
         if (bond->curr_active_slave == new_slave) {
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_change_active_slave(bond, NULL);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         }
         slave_disable_netpoll(new_slave);
 
@@ -1579,7 +1587,8 @@ err_close:
         dev_close(slave_dev);
 
 err_restore_mac:
-        if (!bond->params.fail_over_mac) {
+        if (!bond->params.fail_over_mac ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                 /* XXX TODO - fom follow mode needs to change master's
                  * MAC if this slave's MAC is in use by the bond, or at
                  * least print a warning.
@@ -1672,7 +1681,8 @@ static int __bond_release_one(struct net_device *bond_dev,
 
         bond->current_arp_slave = NULL;
 
-        if (!all && !bond->params.fail_over_mac) {
+        if (!all && (!bond->params.fail_over_mac ||
+                     bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
                 if (ether_addr_equal_64bits(bond_dev->dev_addr, slave->perm_hwaddr) &&
                     bond_has_slaves(bond))
                         pr_warn("%s: Warning: the permanent HWaddr of %s - %pM - is still in use by %s. Set the HWaddr of %s to a different address to avoid conflicts.\n",
@@ -1769,7 +1779,8 @@ static int __bond_release_one(struct net_device *bond_dev,
         /* close slave before restoring its mac address */
         dev_close(slave_dev);
 
-        if (bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
+        if (bond->params.fail_over_mac != BOND_FOM_ACTIVE ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                 /* restore original ("permanent") mac address */
                 memcpy(addr.sa_data, slave->perm_hwaddr, ETH_ALEN);
                 addr.sa_family = slave_dev->type;
@@ -2857,9 +2868,12 @@ static int bond_slave_netdev_event(unsigned long event,
                 pr_info("%s: Primary slave changed to %s, reselecting active slave.\n",
                         bond->dev->name, bond->primary_slave ? slave_dev->name :
                                                                "none");
+
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
                 break;
         case NETDEV_FEAT_CHANGE:
                 bond_compute_features(bond);
@@ -3431,7 +3445,8 @@ static int bond_set_mac_address(struct net_device *bond_dev, void *addr)
         /* If fail_over_mac is enabled, do nothing and return success.
          * Returning an error causes ifenslave to fail.
          */
-        if (bond->params.fail_over_mac)
+        if (bond->params.fail_over_mac &&
+            bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                 return 0;
 
         if (!is_valid_ether_addr(sa->sa_data))
@@ -3692,7 +3707,7 @@ static inline int bond_slave_override(struct bonding *bond,
 
 
 static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb,
-                             void *accel_priv)
+                             void *accel_priv, select_queue_fallback_t fallback)
 {
         /*
          * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 11cb943222d5..c37878432717 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -14,7 +14,7 @@
 #include <linux/errno.h>
 #include <linux/if.h>
 #include <linux/netdevice.h>
-#include <linux/rwlock.h>
+#include <linux/spinlock.h>
 #include <linux/rcupdate.h>
 #include <linux/ctype.h>
 #include <linux/inet.h>
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index d447b881bbde..9e7d95dae2c7 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -104,7 +104,7 @@ config CAN_JANZ_ICAN3
 
 config CAN_FLEXCAN
         tristate "Support for Freescale FLEXCAN based chips"
-        depends on (ARM && CPU_LITTLE_ENDIAN) || PPC
+        depends on ARM || PPC
         ---help---
           Say Y here if you want to support for Freescale FlexCAN.
 
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 13a909822e25..fc59bc6f040b 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -323,19 +323,10 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
         }
 
         if (!priv->echo_skb[idx]) {
-                struct sock *srcsk = skb->sk;
 
-                if (atomic_read(&skb->users) != 1) {
-                        struct sk_buff *old_skb = skb;
-
-                        skb = skb_clone(old_skb, GFP_ATOMIC);
-                        kfree_skb(old_skb);
-                        if (!skb)
-                                return;
-                } else
-                        skb_orphan(skb);
-
-                skb->sk = srcsk;
+                skb = can_create_echo_skb(skb);
+                if (!skb)
+                        return;
 
                 /* make settings for echo to reduce code in irq context */
                 skb->protocol = htons(ETH_P_CAN);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index aaed97bee471..320bef2dba42 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -235,9 +235,12 @@ static const struct can_bittiming_const flexcan_bittiming_const = {
 };
 
 /*
- * Abstract off the read/write for arm versus ppc.
+ * Abstract off the read/write for arm versus ppc. This
+ * assumes that PPC uses big-endian registers and everything
+ * else uses little-endian registers, independent of CPU
+ * endianess.
  */
-#if defined(__BIG_ENDIAN)
+#if defined(CONFIG_PPC)
 static inline u32 flexcan_read(void __iomem *addr)
 {
         return in_be32(addr);
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index e24e6690d672..71594e5676fd 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -18,6 +18,7 @@
 #include <linux/netdevice.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
+#include <linux/can/skb.h>
 #include <linux/can/error.h>
 
 #include <linux/mfd/janz.h>
@@ -1133,20 +1134,9 @@ static void ican3_handle_message(struct ican3_dev *mod, struct ican3_msg *msg)
  */
 static void ican3_put_echo_skb(struct ican3_dev *mod, struct sk_buff *skb)
 {
-        struct sock *srcsk = skb->sk;
-
-        if (atomic_read(&skb->users) != 1) {
-                struct sk_buff *old_skb = skb;
-
-                skb = skb_clone(old_skb, GFP_ATOMIC);
-                kfree_skb(old_skb);
-                if (!skb)
-                        return;
-        } else {
-                skb_orphan(skb);
-        }
-
-        skb->sk = srcsk;
+        skb = can_create_echo_skb(skb);
+        if (!skb)
+                return;
 
         /* save this skb for tx interrupt echo handling */
         skb_queue_tail(&mod->echoq, skb);
@@ -1322,7 +1312,7 @@ static int ican3_napi(struct napi_struct *napi, int budget)
 
         /* process all communication messages */
         while (true) {
-                struct ican3_msg msg;
+                struct ican3_msg uninitialized_var(msg);
                 ret = ican3_recv_msg(mod, &msg);
                 if (ret)
                         break;
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 6c859bba8b65..e77d11049747 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -473,6 +473,8 @@ static int kvaser_usb_get_card_info(struct kvaser_usb *dev)
                 return err;
 
         dev->nchannels = msg.u.cardinfo.nchannels;
+        if (dev->nchannels > MAX_NET_DEVICES)
+                return -EINVAL;
 
         return 0;
 }
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index 0a2a5ee79a17..4e94057ef5cf 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -46,6 +46,7 @@
 #include <linux/if_ether.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
+#include <linux/can/skb.h>
 #include <linux/slab.h>
 #include <net/rtnetlink.h>
 
@@ -109,25 +110,23 @@ static netdev_tx_t vcan_tx(struct sk_buff *skb, struct net_device *dev)
                         stats->rx_packets++;
                         stats->rx_bytes += cfd->len;
                 }
-                kfree_skb(skb);
+                consume_skb(skb);
                 return NETDEV_TX_OK;
         }
 
         /* perform standard echo handling for CAN network interfaces */
 
         if (loop) {
-                struct sock *srcsk = skb->sk;
 
-                skb = skb_share_check(skb, GFP_ATOMIC);
+                skb = can_create_echo_skb(skb);
                 if (!skb)
                         return NETDEV_TX_OK;
 
                 /* receive with packet counting */
-                skb->sk = srcsk;
                 vcan_rx(skb, dev);
         } else {
                 /* no looped packets => no counting */
-                kfree_skb(skb);
+                consume_skb(skb);
         }
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 0f4241c6e97e..238ccea965c8 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -3294,7 +3294,6 @@ static int __init vortex_init(void)
 
 static void __exit vortex_eisa_cleanup(void)
 {
-        struct vortex_private *vp;
         void __iomem *ioaddr;
 
 #ifdef CONFIG_EISA
@@ -3303,7 +3302,6 @@ static void __exit vortex_eisa_cleanup(void)
 #endif
 
         if (compaq_net_device) {
-                vp = netdev_priv(compaq_net_device);
                 ioaddr = ioport_map(compaq_net_device->base_addr,
                                     VORTEX_TOTAL_SIZE);
 
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 0cc21437478c..511f6eecd58b 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -929,6 +929,9 @@ static int emac_resume(struct platform_device *dev)
 }
 
 static const struct of_device_id emac_of_match[] = {
+        {.compatible = "allwinner,sun4i-a10-emac",},
+
+        /* Deprecated */
         {.compatible = "allwinner,sun4i-emac",},
         {},
 };
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index e92ffd6e1c15..2e45f6ec1bf0 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1292,6 +1292,7 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         alx = netdev_priv(netdev);
         spin_lock_init(&alx->hw.mdio_lock);
         spin_lock_init(&alx->irq_lock);
+        spin_lock_init(&alx->stats_lock);
         alx->dev = netdev;
         alx->hw.pdev = pdev;
         alx->msg_enable = NETIF_MSG_LINK | NETIF_MSG_HW | NETIF_MSG_IFUP |
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 9d2dedadf2df..cda25ac45b47 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -85,7 +85,7 @@ MODULE_FIRMWARE(FW_RV2P_FILE_09_Ax);
 
 static int disable_msi = 0;
 
-module_param(disable_msi, int, 0);
+module_param(disable_msi, int, S_IRUGO);
 MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
 
 typedef enum {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 9d7419e0390b..66c0df78c3ff 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1873,7 +1873,7 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 }
 
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
-                       void *accel_priv)
+                       void *accel_priv, select_queue_fallback_t fallback)
 {
         struct bnx2x *bp = netdev_priv(dev);
 
@@ -1895,7 +1895,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
         }
 
         /* select a non-FCoE queue */
-        return __netdev_pick_tx(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index 17d1689aec6b..a89a40f88c25 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -496,7 +496,7 @@ int bnx2x_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos);
 
 /* select_queue callback */
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
-                       void *accel_priv);
+                       void *accel_priv, select_queue_fallback_t fallback);
 
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
                                         struct bnx2x_fastpath *fp,
@@ -936,7 +936,7 @@ static inline int bnx2x_func_start(struct bnx2x *bp)
         else /* CHIP_IS_E1X */
                 start_params->network_cos_mode = FW_WRR;
 
-        start_params->gre_tunnel_mode = IPGRE_TUNNEL;
+        start_params->gre_tunnel_mode = L2GRE_TUNNEL;
         start_params->gre_tunnel_rss = GRE_INNER_HEADERS_RSS;
 
         return bnx2x_func_state_change(bp, &func_params);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index c9c445e7b4a5..7d4382286457 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -95,29 +95,29 @@ MODULE_FIRMWARE(FW_FILE_NAME_E1H);
 MODULE_FIRMWARE(FW_FILE_NAME_E2);
 
 int bnx2x_num_queues;
-module_param_named(num_queues, bnx2x_num_queues, int, 0);
+module_param_named(num_queues, bnx2x_num_queues, int, S_IRUGO);
 MODULE_PARM_DESC(num_queues,
                  " Set number of queues (default is as a number of CPUs)");
 
 static int disable_tpa;
-module_param(disable_tpa, int, 0);
+module_param(disable_tpa, int, S_IRUGO);
 MODULE_PARM_DESC(disable_tpa, " Disable the TPA (LRO) feature");
 
 static int int_mode;
-module_param(int_mode, int, 0);
+module_param(int_mode, int, S_IRUGO);
 MODULE_PARM_DESC(int_mode, " Force interrupt mode other than MSI-X "
                                 "(1 INT#x; 2 MSI)");
 
 static int dropless_fc;
-module_param(dropless_fc, int, 0);
+module_param(dropless_fc, int, S_IRUGO);
 MODULE_PARM_DESC(dropless_fc, " Pause on exhausted host ring");
 
 static int mrrs = -1;
-module_param(mrrs, int, 0);
+module_param(mrrs, int, S_IRUGO);
 MODULE_PARM_DESC(mrrs, " Force Max Read Req Size (0..3) (for debug)");
 
 static int debug;
-module_param(debug, int, 0);
+module_param(debug, int, S_IRUGO);
 MODULE_PARM_DESC(debug, " Default debug msglevel");
 
 struct workqueue_struct *bnx2x_wq;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index aec5ef2ed7ce..e42f48df6e94 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1446,12 +1446,12 @@ static void bnx2x_vf_igu_reset(struct bnx2x *bp, struct bnx2x_virtf *vf)
         if (vf->cfg_flags & VF_CFG_INT_SIMD)
                 val |= IGU_VF_CONF_SINGLE_ISR_EN;
         val &= ~IGU_VF_CONF_PARENT_MASK;
-        val |= BP_FUNC(bp) << IGU_VF_CONF_PARENT_SHIFT; /* parent PF */
+        val |= (BP_ABS_FUNC(bp) >> 1) << IGU_VF_CONF_PARENT_SHIFT;
         REG_WR(bp, IGU_REG_VF_CONFIGURATION, val);
 
         DP(BNX2X_MSG_IOV,
-           "value in IGU_REG_VF_CONFIGURATION of vf %d after write %x\n",
-           vf->abs_vfid, REG_RD(bp, IGU_REG_VF_CONFIGURATION));
+           "value in IGU_REG_VF_CONFIGURATION of vf %d after write is 0x%08x\n",
+           vf->abs_vfid, val);
 
         bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index e2ca03e23dc1..3167ed6593b0 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -2609,13 +2609,14 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
 
         tg3_writephy(tp, MII_CTRL1000, phy9_orig);
 
-        if (!tg3_readphy(tp, MII_TG3_EXT_CTRL, &reg32)) {
-                reg32 &= ~0x3000;
-                tg3_writephy(tp, MII_TG3_EXT_CTRL, reg32);
-        } else if (!err)
-                err = -EBUSY;
+        err = tg3_readphy(tp, MII_TG3_EXT_CTRL, &reg32);
+        if (err)
+                return err;
 
-        return err;
+        reg32 &= ~0x3000;
+        tg3_writephy(tp, MII_TG3_EXT_CTRL, reg32);
+
+        return 0;
 }
 
 static void tg3_carrier_off(struct tg3 *tp)
@@ -14113,12 +14114,12 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 
         tg3_netif_stop(tp);
 
+        tg3_set_mtu(dev, tp, new_mtu);
+
         tg3_full_lock(tp, 1);
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
 
-        tg3_set_mtu(dev, tp, new_mtu);
-
         /* Reset PHY, otherwise the read DMA engine will be in a mode that
          * breaks all requests to 256 bytes.
          */
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index add05f14b38b..1642de78aac8 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -1939,6 +1939,7 @@ static void tulip_remove_one(struct pci_dev *pdev)
         pci_iounmap(pdev, tp->base_addr);
         free_netdev (dev);
         pci_release_regions (pdev);
+        pci_disable_device(pdev);
 
         /* pci_power_off (pdev, -1); */
 }
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 4de8cfd149cf..55e0fa03dc90 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -13,6 +13,7 @@
 
 #include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
+#include <linux/clk.h>
 #include <linux/crc32.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
@@ -51,6 +52,7 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
 #define ETH_HASH0       0x48
 #define ETH_HASH1       0x4c
 #define ETH_TXCTRL      0x50
+#define ETH_END         0x54
 
 /* mode register */
 #define MODER_RXEN      (1 <<  0) /* receive enable */
@@ -179,6 +181,7 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
  * @membase:    pointer to buffer memory region
  * @dma_alloc:  dma allocated buffer size
  * @io_region_size:     I/O memory region size
+ * @num_bd:     number of buffer descriptors
  * @num_tx:     number of send buffers
  * @cur_tx:     last send buffer written
  * @dty_tx:     last buffer actually sent
@@ -199,6 +202,7 @@ struct ethoc {
         int dma_alloc;
         resource_size_t io_region_size;
 
+        unsigned int num_bd;
         unsigned int num_tx;
         unsigned int cur_tx;
         unsigned int dty_tx;
@@ -216,6 +220,7 @@ struct ethoc {
 
         struct phy_device *phy;
         struct mii_bus *mdio;
+        struct clk *clk;
         s8 phy_id;
 };
 
@@ -688,6 +693,11 @@ static int ethoc_mdio_probe(struct net_device *dev)
         }
 
         priv->phy = phy;
+        phy->advertising &= ~(ADVERTISED_1000baseT_Full |
+                              ADVERTISED_1000baseT_Half);
+        phy->supported &= ~(SUPPORTED_1000baseT_Full |
+                            SUPPORTED_1000baseT_Half);
+
         return 0;
 }
 
@@ -890,6 +900,102 @@ out:
         return NETDEV_TX_OK;
 }
 
+static int ethoc_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phy;
+
+        if (!phydev)
+                return -EOPNOTSUPP;
+
+        return phy_ethtool_gset(phydev, cmd);
+}
+
+static int ethoc_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phy;
+
+        if (!phydev)
+                return -EOPNOTSUPP;
+
+        return phy_ethtool_sset(phydev, cmd);
+}
+
+static int ethoc_get_regs_len(struct net_device *netdev)
+{
+        return ETH_END;
+}
+
+static void ethoc_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                           void *p)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        u32 *regs_buff = p;
+        unsigned i;
+
+        regs->version = 0;
+        for (i = 0; i < ETH_END / sizeof(u32); ++i)
+                regs_buff[i] = ethoc_read(priv, i * sizeof(u32));
+}
+
+static void ethoc_get_ringparam(struct net_device *dev,
+                                struct ethtool_ringparam *ring)
+{
+        struct ethoc *priv = netdev_priv(dev);
+
+        ring->rx_max_pending = priv->num_bd - 1;
+        ring->rx_mini_max_pending = 0;
+        ring->rx_jumbo_max_pending = 0;
+        ring->tx_max_pending = priv->num_bd - 1;
+
+        ring->rx_pending = priv->num_rx;
+        ring->rx_mini_pending = 0;
+        ring->rx_jumbo_pending = 0;
+        ring->tx_pending = priv->num_tx;
+}
+
+static int ethoc_set_ringparam(struct net_device *dev,
+                               struct ethtool_ringparam *ring)
+{
+        struct ethoc *priv = netdev_priv(dev);
+
+        if (ring->tx_pending < 1 || ring->rx_pending < 1 ||
+            ring->tx_pending + ring->rx_pending > priv->num_bd)
+                return -EINVAL;
+        if (ring->rx_mini_pending || ring->rx_jumbo_pending)
+                return -EINVAL;
+
+        if (netif_running(dev)) {
+                netif_tx_disable(dev);
+                ethoc_disable_rx_and_tx(priv);
+                ethoc_disable_irq(priv, INT_MASK_TX | INT_MASK_RX);
+                synchronize_irq(dev->irq);
+        }
+
+        priv->num_tx = rounddown_pow_of_two(ring->tx_pending);
+        priv->num_rx = ring->rx_pending;
+        ethoc_init_ring(priv, dev->mem_start);
+
+        if (netif_running(dev)) {
+                ethoc_enable_irq(priv, INT_MASK_TX | INT_MASK_RX);
+                ethoc_enable_rx_and_tx(priv);
+                netif_wake_queue(dev);
+        }
+        return 0;
+}
+
+const struct ethtool_ops ethoc_ethtool_ops = {
+        .get_settings = ethoc_get_settings,
+        .set_settings = ethoc_set_settings,
+        .get_regs_len = ethoc_get_regs_len,
+        .get_regs = ethoc_get_regs,
+        .get_link = ethtool_op_get_link,
+        .get_ringparam = ethoc_get_ringparam,
+        .set_ringparam = ethoc_set_ringparam,
+        .get_ts_info = ethtool_op_get_ts_info,
+};
+
 static const struct net_device_ops ethoc_netdev_ops = {
         .ndo_open = ethoc_open,
         .ndo_stop = ethoc_stop,
@@ -917,6 +1023,8 @@ static int ethoc_probe(struct platform_device *pdev)
         int num_bd;
         int ret = 0;
         bool random_mac = false;
+        struct ethoc_platform_data *pdata = dev_get_platdata(&pdev->dev);
+        u32 eth_clkfreq = pdata ? pdata->eth_clkfreq : 0;
 
         /* allocate networking device */
         netdev = alloc_etherdev(sizeof(struct ethoc));
@@ -1016,6 +1124,7 @@ static int ethoc_probe(struct platform_device *pdev)
                 ret = -ENODEV;
                 goto error;
         }
+        priv->num_bd = num_bd;
         /* num_tx must be a power of two */
         priv->num_tx = rounddown_pow_of_two(num_bd >> 1);
         priv->num_rx = num_bd - priv->num_tx;
@@ -1030,8 +1139,7 @@ static int ethoc_probe(struct platform_device *pdev)
         }
 
         /* Allow the platform setup code to pass in a MAC address. */
-        if (dev_get_platdata(&pdev->dev)) {
-                struct ethoc_platform_data *pdata = dev_get_platdata(&pdev->dev);
+        if (pdata) {
                 memcpy(netdev->dev_addr, pdata->hwaddr, IFHWADDRLEN);
                 priv->phy_id = pdata->phy_id;
         } else {
@@ -1069,6 +1177,27 @@ static int ethoc_probe(struct platform_device *pdev)
         if (random_mac)
                 netdev->addr_assign_type = NET_ADDR_RANDOM;
 
+        /* Allow the platform setup code to adjust MII management bus clock. */
+        if (!eth_clkfreq) {
+                struct clk *clk = devm_clk_get(&pdev->dev, NULL);
+
+                if (!IS_ERR(clk)) {
+                        priv->clk = clk;
+                        clk_prepare_enable(clk);
+                        eth_clkfreq = clk_get_rate(clk);
+                }
+        }
+        if (eth_clkfreq) {
+                u32 clkdiv = MIIMODER_CLKDIV(eth_clkfreq / 2500000 + 1);
+
+                if (!clkdiv)
+                        clkdiv = 2;
+                dev_dbg(&pdev->dev, "setting MII clkdiv to %u\n", clkdiv);
+                ethoc_write(priv, MIIMODER,
+                            (ethoc_read(priv, MIIMODER) & MIIMODER_NOPRE) |
+                            clkdiv);
+        }
+
         /* register MII bus */
         priv->mdio = mdiobus_alloc();
         if (!priv->mdio) {
@@ -1111,6 +1240,7 @@ static int ethoc_probe(struct platform_device *pdev)
         netdev->netdev_ops = &ethoc_netdev_ops;
         netdev->watchdog_timeo = ETHOC_TIMEOUT;
         netdev->features |= 0;
+        netdev->ethtool_ops = &ethoc_ethtool_ops;
 
         /* setup NAPI */
         netif_napi_add(netdev, &priv->napi, ethoc_poll, 64);
@@ -1133,6 +1263,8 @@ free_mdio:
         kfree(priv->mdio->irq);
         mdiobus_free(priv->mdio);
 free:
+        if (priv->clk)
+                clk_disable_unprepare(priv->clk);
         free_netdev(netdev);
 out:
         return ret;
@@ -1157,6 +1289,8 @@ static int ethoc_remove(struct platform_device *pdev)
                         kfree(priv->mdio->irq);
                         mdiobus_free(priv->mdio);
                 }
+                if (priv->clk)
+                        clk_disable_unprepare(priv->clk);
                 unregister_netdev(netdev);
                 free_netdev(netdev);
         }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d4782b42401b..903362a7b584 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1778,8 +1778,6 @@ fec_enet_open(struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         int ret;
 
-        napi_enable(&fep->napi);
-
         /* I should reset the ring buffers here, but I don't yet know
          * a simple way to do that.
          */
@@ -1794,6 +1792,8 @@ fec_enet_open(struct net_device *ndev)
                 fec_enet_free_buffers(ndev);
                 return ret;
         }
+
+        napi_enable(&fep->napi);
         phy_start(fep->phy_dev);
         netif_start_queue(ndev);
         fep->opened = 1;
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index cbaba4442d4b..bf7a01ef9a57 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -3034,7 +3034,7 @@ static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake)
                 *enable_wake = false;
         }
 
-        pci_disable_device(pdev);
+        pci_clear_master(pdev);
 }
 
 static int __e100_power_off(struct pci_dev *pdev, bool wake)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 6d4ada72dfd0..18076c4178b4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6881,7 +6881,7 @@ static inline int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, u16 size)
 }
 
 static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
-                              void *accel_priv)
+                              void *accel_priv, select_queue_fallback_t fallback)
 {
         struct ixgbe_fwd_adapter *fwd_adapter = accel_priv;
 #ifdef IXGBE_FCOE
@@ -6907,7 +6907,7 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
                 if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
                         break;
         default:
-                return __netdev_pick_tx(dev, skb);
+                return fallback(dev, skb);
         }
 
         f = &adapter->ring_feature[RING_F_FCOE];
@@ -6920,7 +6920,7 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
 
         return txq + f->offset;
 #else
-        return __netdev_pick_tx(dev, skb);
+        return fallback(dev, skb);
 #endif
 }
 
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 8f9266c64c75..fd4b6aecf6ee 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -619,7 +619,7 @@ ltq_etop_set_multicast_list(struct net_device *dev)
 
 static u16
 ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb,
-                      void *accel_priv)
+                      void *accel_priv, select_queue_fallback_t fallback)
 {
         /* we are currently only using the first queue */
         return 0;
diff --git a/drivers/net/ethernet/marvell/Kconfig b/drivers/net/ethernet/marvell/Kconfig
index 6300fd27f2db..68e6a6613e9a 100644
--- a/drivers/net/ethernet/marvell/Kconfig
+++ b/drivers/net/ethernet/marvell/Kconfig
@@ -43,12 +43,12 @@ config MVMDIO
           This driver is used by the MV643XX_ETH and MVNETA drivers.
 
 config MVNETA
-        tristate "Marvell Armada 370/XP network interface support"
-        depends on MACH_ARMADA_370_XP
+        tristate "Marvell Armada 370/38x/XP network interface support"
+        depends on PLAT_ORION
         select MVMDIO
         ---help---
           This driver supports the network interface units in the
-          Marvell ARMADA XP and ARMADA 370 SoC family.
+          Marvell ARMADA XP, ARMADA 370 and ARMADA 38x SoC family.
 
           Note that this driver is distinct from the mv643xx_eth
           driver, which should be used for the older Marvell SoCs
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 8e8a7eb43a2c..13457032d15f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -629,7 +629,7 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, struct sk_buff *sk
 }
 
 u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
-                         void *accel_priv)
+                         void *accel_priv, select_queue_fallback_t fallback)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         u16 rings_p_up = priv->num_tx_rings_p_up;
@@ -641,7 +641,7 @@ u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
         if (vlan_tx_tag_present(skb))
                 up = vlan_tx_tag_get(skb) >> VLAN_PRIO_SHIFT;
 
-        return __netdev_pick_tx(dev, skb) % rings_p_up + up * rings_p_up;
+        return fallback(dev, skb) % rings_p_up + up * rings_p_up;
 }
 
 static void mlx4_bf_copy(void __iomem *dst, unsigned long *src, unsigned bytecnt)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 3af04c3f42ea..9ca223bc90fc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -723,7 +723,7 @@ int mlx4_en_arm_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 
 void mlx4_en_tx_irq(struct mlx4_cq *mcq);
 u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
-                         void *accel_priv);
+                         void *accel_priv, select_queue_fallback_t fallback);
 netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev);
 
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index 157fe8df2c3e..8ff57e8e3e91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -4,5 +4,5 @@
 
 config MLX5_CORE
         tristate
-        depends on PCI && X86
+        depends on PCI
         default n
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index 1ded50ca1600..e46e8698e630 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -726,9 +726,6 @@ static int vxge_learn_mac(struct vxgedev *vdev, u8 *mac_header)
         int vpath_idx = 0;
         enum vxge_hw_status status = VXGE_HW_OK;
         struct vxge_vpath *vpath = NULL;
-        struct __vxge_hw_device *hldev;
-
-        hldev = pci_get_drvdata(vdev->pdev);
 
         mac_address = (u8 *)&mac_addr;
         memcpy(mac_address, mac_header, ETH_ALEN);
@@ -2443,9 +2440,6 @@ static void vxge_rem_msix_isr(struct vxgedev *vdev)
 
 static void vxge_rem_isr(struct vxgedev *vdev)
 {
-        struct __vxge_hw_device *hldev;
-        hldev = pci_get_drvdata(vdev->pdev);
-
 #ifdef CONFIG_PCI_MSI
         if (vdev->config.intr_type == MSI_X) {
                 vxge_rem_msix_isr(vdev);
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index c49d1fb16965..75d11fa4eb0a 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -429,7 +429,9 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         }
 
         /* Transfer ownership of the skb to the final buffer */
+#ifdef EFX_USE_PIO
 finish_packet:
+#endif
         buffer->skb = skb;
         buffer->flags = EFX_TX_BUF_SKB | dma_flags;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index e2f202e3932f..f2d7c702c77f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -37,6 +37,17 @@ config DWMAC_SUNXI
           stmmac device driver. This driver is used for A20/A31
           GMAC    ethernet controller.
 
+config DWMAC_STI
+        bool "STi GMAC support"
+        depends on STMMAC_PLATFORM && ARCH_STI
+        default y
+        ---help---
+          Support for ethernet controller on STi SOCs.
+
+          This selects STi SoC glue layer support for the stmmac
+          device driver. This driver is used on for the STi series
+          SOCs GMAC ethernet controller.
+
 config STMMAC_PCI
         bool "STMMAC PCI bus support"
         depends on STMMAC_ETH && PCI
diff --git a/drivers/net/ethernet/stmicro/stmmac/Makefile b/drivers/net/ethernet/stmicro/stmmac/Makefile
index ecadecea79b2..dcef28775dad 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Makefile
+++ b/drivers/net/ethernet/stmicro/stmmac/Makefile
@@ -2,6 +2,7 @@ obj-$(CONFIG_STMMAC_ETH) += stmmac.o
 stmmac-$(CONFIG_STMMAC_PLATFORM) += stmmac_platform.o
 stmmac-$(CONFIG_STMMAC_PCI) += stmmac_pci.o
 stmmac-$(CONFIG_DWMAC_SUNXI) += dwmac-sunxi.o
+stmmac-$(CONFIG_DWMAC_STI) += dwmac-sti.o
 stmmac-objs:= stmmac_main.o stmmac_ethtool.o stmmac_mdio.o ring_mode.o  \
               chain_mode.o dwmac_lib.o dwmac1000_core.o  dwmac1000_dma.o \
               dwmac100_core.o dwmac100_dma.o enh_desc.o  norm_desc.o \
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
new file mode 100644
index 000000000000..552bbc17863c
--- /dev/null
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -0,0 +1,330 @@
+/**
+ * dwmac-sti.c - STMicroelectronics DWMAC Specific Glue layer
+ *
+ * Copyright (C) 2003-2014 STMicroelectronics (R&D) Limited
+ * Author: Srinivas Kandagatla <srinivas.kandagatla@st.com>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/stmmac.h>
+#include <linux/phy.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/of_net.h>
+
+/**
+ *                      STi GMAC glue logic.
+ *                      --------------------
+ *
+ *               _
+ *              |  \
+ *      --------|0  \ ETH_SEL_INTERNAL_NOTEXT_PHYCLK
+ * phyclk       |    |___________________________________________
+ *              |    |  |                       (phyclk-in)
+ *      --------|1  /   |
+ * int-clk      |_ /    |
+ *                      |        _
+ *                      |       |  \
+ *                      |_______|1  \ ETH_SEL_TX_RETIME_CLK
+ *                              |    |___________________________
+ *                              |    |          (tx-retime-clk)
+ *                       _______|0  /
+ *                      |       |_ /
+ *               _      |
+ *              |  \    |
+ *      --------|0  \   |
+ * clk_125      |    |__|
+ *              |    |  ETH_SEL_TXCLK_NOT_CLK125
+ *      --------|1  /
+ * txclk        |_ /
+ *
+ *
+ * ETH_SEL_INTERNAL_NOTEXT_PHYCLK is valid only for RMII where PHY can
+ * generate 50MHz clock or MAC can generate it.
+ * This bit is configured by "st,ext-phyclk" property.
+ *
+ * ETH_SEL_TXCLK_NOT_CLK125 is only valid for gigabit modes, where the 125Mhz
+ * clock either comes from clk-125 pin or txclk pin. This configuration is
+ * totally driven by the board wiring. This bit is configured by
+ * "st,tx-retime-src" property.
+ *
+ * TXCLK configuration is different for different phy interface modes
+ * and changes according to link speed in modes like RGMII.
+ *
+ * Below table summarizes the clock requirement and clock sources for
+ * supported phy interface modes with link speeds.
+ * ________________________________________________
+ *|  PHY_MODE   | 1000 Mbit Link | 100 Mbit Link   |
+ * ------------------------------------------------
+ *|     MII     |       n/a      |      25Mhz      |
+ *|             |                |      txclk      |
+ * ------------------------------------------------
+ *|     GMII    |     125Mhz     |      25Mhz      |
+ *|             |  clk-125/txclk |      txclk      |
+ * ------------------------------------------------
+ *|     RGMII   |     125Mhz     |      25Mhz      |
+ *|             |  clk-125/txclk |      clkgen     |
+ * ------------------------------------------------
+ *|     RMII    |       n/a      |      25Mhz      |
+ *|             |                |clkgen/phyclk-in |
+ * ------------------------------------------------
+ *
+ * TX lines are always retimed with a clk, which can vary depending
+ * on the board configuration. Below is the table of these bits
+ * in eth configuration register depending on source of retime clk.
+ *
+ *---------------------------------------------------------------
+ * src   | tx_rt_clk    | int_not_ext_phyclk    | txclk_n_clk125|
+ *---------------------------------------------------------------
+ * txclk |      0       |       n/a             |       1       |
+ *---------------------------------------------------------------
+ * ck_125|      0       |       n/a             |       0       |
+ *---------------------------------------------------------------
+ * phyclk|      1       |       0               |       n/a     |
+ *---------------------------------------------------------------
+ * clkgen|      1       |       1               |       n/a     |
+ *---------------------------------------------------------------
+ */
+
+ /* Register definition */
+
+ /* 3 bits [8:6]
+  *  [6:6]      ETH_SEL_TXCLK_NOT_CLK125
+  *  [7:7]      ETH_SEL_INTERNAL_NOTEXT_PHYCLK
+  *  [8:8]      ETH_SEL_TX_RETIME_CLK
+  *
+  */
+
+#define TX_RETIME_SRC_MASK              GENMASK(8, 6)
+#define ETH_SEL_TX_RETIME_CLK           BIT(8)
+#define ETH_SEL_INTERNAL_NOTEXT_PHYCLK  BIT(7)
+#define ETH_SEL_TXCLK_NOT_CLK125        BIT(6)
+
+#define ENMII_MASK                      GENMASK(5, 5)
+#define ENMII                           BIT(5)
+
+/**
+ * 3 bits [4:2]
+ *      000-GMII/MII
+ *      001-RGMII
+ *      010-SGMII
+ *      100-RMII
+*/
+#define MII_PHY_SEL_MASK                GENMASK(4, 2)
+#define ETH_PHY_SEL_RMII                BIT(4)
+#define ETH_PHY_SEL_SGMII               BIT(3)
+#define ETH_PHY_SEL_RGMII               BIT(2)
+#define ETH_PHY_SEL_GMII                0x0
+#define ETH_PHY_SEL_MII                 0x0
+
+#define IS_PHY_IF_MODE_RGMII(iface)     (iface == PHY_INTERFACE_MODE_RGMII || \
+                        iface == PHY_INTERFACE_MODE_RGMII_ID || \
+                        iface == PHY_INTERFACE_MODE_RGMII_RXID || \
+                        iface == PHY_INTERFACE_MODE_RGMII_TXID)
+
+#define IS_PHY_IF_MODE_GBIT(iface)      (IS_PHY_IF_MODE_RGMII(iface) || \
+                        iface == PHY_INTERFACE_MODE_GMII)
+
+struct sti_dwmac {
+        int interface;
+        bool ext_phyclk;
+        bool is_tx_retime_src_clk_125;
+        struct clk *clk;
+        int reg;
+        struct device *dev;
+        struct regmap *regmap;
+};
+
+static u32 phy_intf_sels[] = {
+        [PHY_INTERFACE_MODE_MII] = ETH_PHY_SEL_MII,
+        [PHY_INTERFACE_MODE_GMII] = ETH_PHY_SEL_GMII,
+        [PHY_INTERFACE_MODE_RGMII] = ETH_PHY_SEL_RGMII,
+        [PHY_INTERFACE_MODE_RGMII_ID] = ETH_PHY_SEL_RGMII,
+        [PHY_INTERFACE_MODE_SGMII] = ETH_PHY_SEL_SGMII,
+        [PHY_INTERFACE_MODE_RMII] = ETH_PHY_SEL_RMII,
+};
+
+enum {
+        TX_RETIME_SRC_NA = 0,
+        TX_RETIME_SRC_TXCLK = 1,
+        TX_RETIME_SRC_CLK_125,
+        TX_RETIME_SRC_PHYCLK,
+        TX_RETIME_SRC_CLKGEN,
+};
+
+static const char *const tx_retime_srcs[] = {
+        [TX_RETIME_SRC_NA] = "",
+        [TX_RETIME_SRC_TXCLK] = "txclk",
+        [TX_RETIME_SRC_CLK_125] = "clk_125",
+        [TX_RETIME_SRC_PHYCLK] = "phyclk",
+        [TX_RETIME_SRC_CLKGEN] = "clkgen",
+};
+
+static u32 tx_retime_val[] = {
+        [TX_RETIME_SRC_TXCLK] = ETH_SEL_TXCLK_NOT_CLK125,
+        [TX_RETIME_SRC_CLK_125] = 0x0,
+        [TX_RETIME_SRC_PHYCLK] = ETH_SEL_TX_RETIME_CLK,
+        [TX_RETIME_SRC_CLKGEN] = ETH_SEL_TX_RETIME_CLK |
+            ETH_SEL_INTERNAL_NOTEXT_PHYCLK,
+};
+
+static void setup_retime_src(struct sti_dwmac *dwmac, u32 spd)
+{
+        u32 src = 0, freq = 0;
+
+        if (spd == SPEED_100) {
+                if (dwmac->interface == PHY_INTERFACE_MODE_MII ||
+                    dwmac->interface == PHY_INTERFACE_MODE_GMII) {
+                        src = TX_RETIME_SRC_TXCLK;
+                } else if (dwmac->interface == PHY_INTERFACE_MODE_RMII) {
+                        if (dwmac->ext_phyclk) {
+                                src = TX_RETIME_SRC_PHYCLK;
+                        } else {
+                                src = TX_RETIME_SRC_CLKGEN;
+                                freq = 50000000;
+                        }
+
+                } else if (IS_PHY_IF_MODE_RGMII(dwmac->interface)) {
+                        src = TX_RETIME_SRC_CLKGEN;
+                        freq = 25000000;
+                }
+
+                if (src == TX_RETIME_SRC_CLKGEN && dwmac->clk)
+                        clk_set_rate(dwmac->clk, freq);
+
+        } else if (spd == SPEED_1000) {
+                if (dwmac->is_tx_retime_src_clk_125)
+                        src = TX_RETIME_SRC_CLK_125;
+                else
+                        src = TX_RETIME_SRC_TXCLK;
+        }
+
+        regmap_update_bits(dwmac->regmap, dwmac->reg,
+                           TX_RETIME_SRC_MASK, tx_retime_val[src]);
+}
+
+static void sti_dwmac_exit(struct platform_device *pdev, void *priv)
+{
+        struct sti_dwmac *dwmac = priv;
+
+        if (dwmac->clk)
+                clk_disable_unprepare(dwmac->clk);
+}
+
+static void sti_fix_mac_speed(void *priv, unsigned int spd)
+{
+        struct sti_dwmac *dwmac = priv;
+
+        setup_retime_src(dwmac, spd);
+
+        return;
+}
+
+static int sti_dwmac_parse_data(struct sti_dwmac *dwmac,
+                                struct platform_device *pdev)
+{
+        struct resource *res;
+        struct device *dev = &pdev->dev;
+        struct device_node *np = dev->of_node;
+        struct regmap *regmap;
+        int err;
+
+        if (!np)
+                return -EINVAL;
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "sti-ethconf");
+        if (!res)
+                return -ENODATA;
+
+        regmap = syscon_regmap_lookup_by_phandle(np, "st,syscon");
+        if (IS_ERR(regmap))
+                return PTR_ERR(regmap);
+
+        dwmac->dev = dev;
+        dwmac->interface = of_get_phy_mode(np);
+        dwmac->regmap = regmap;
+        dwmac->reg = res->start;
+        dwmac->ext_phyclk = of_property_read_bool(np, "st,ext-phyclk");
+        dwmac->is_tx_retime_src_clk_125 = false;
+
+        if (IS_PHY_IF_MODE_GBIT(dwmac->interface)) {
+                const char *rs;
+
+                err = of_property_read_string(np, "st,tx-retime-src", &rs);
+                if (err < 0) {
+                        dev_err(dev, "st,tx-retime-src not specified\n");
+                        return err;
+                }
+
+                if (!strcasecmp(rs, "clk_125"))
+                        dwmac->is_tx_retime_src_clk_125 = true;
+        }
+
+        dwmac->clk = devm_clk_get(dev, "sti-ethclk");
+
+        if (IS_ERR(dwmac->clk))
+                dwmac->clk = NULL;
+
+        return 0;
+}
+
+static int sti_dwmac_init(struct platform_device *pdev, void *priv)
+{
+        struct sti_dwmac *dwmac = priv;
+        struct regmap *regmap = dwmac->regmap;
+        int iface = dwmac->interface;
+        u32 reg = dwmac->reg;
+        u32 val, spd;
+
+        if (dwmac->clk)
+                clk_prepare_enable(dwmac->clk);
+
+        regmap_update_bits(regmap, reg, MII_PHY_SEL_MASK, phy_intf_sels[iface]);
+
+        val = (iface == PHY_INTERFACE_MODE_REVMII) ? 0 : ENMII;
+        regmap_update_bits(regmap, reg, ENMII_MASK, val);
+
+        if (IS_PHY_IF_MODE_GBIT(iface))
+                spd = SPEED_1000;
+        else
+                spd = SPEED_100;
+
+        setup_retime_src(dwmac, spd);
+
+        return 0;
+}
+
+static void *sti_dwmac_setup(struct platform_device *pdev)
+{
+        struct sti_dwmac *dwmac;
+        int ret;
+
+        dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
+        if (!dwmac)
+                return ERR_PTR(-ENOMEM);
+
+        ret = sti_dwmac_parse_data(dwmac, pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "Unable to parse OF data\n");
+                return ERR_PTR(ret);
+        }
+
+        return dwmac;
+}
+
+const struct stmmac_of_data sti_gmac_data = {
+        .fix_mac_speed = sti_fix_mac_speed,
+        .setup = sti_dwmac_setup,
+        .init = sti_dwmac_init,
+        .exit = sti_dwmac_exit,
+};
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index d9af26ed58ee..f9e60d7918c4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -133,6 +133,9 @@ bool stmmac_eee_init(struct stmmac_priv *priv);
 #ifdef CONFIG_DWMAC_SUNXI
 extern const struct stmmac_of_data sun7i_gmac_data;
 #endif
+#ifdef CONFIG_DWMAC_STI
+extern const struct stmmac_of_data sti_gmac_data;
+#endif
 extern struct platform_driver stmmac_pltfr_driver;
 static inline int stmmac_register_platform(void)
 {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 5884a7d2063b..c61bc72b8e90 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -33,6 +33,11 @@ static const struct of_device_id stmmac_dt_ids[] = {
 #ifdef CONFIG_DWMAC_SUNXI
         { .compatible = "allwinner,sun7i-a20-gmac", .data = &sun7i_gmac_data},
 #endif
+#ifdef CONFIG_DWMAC_STI
+        { .compatible = "st,stih415-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stih416-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stih127-dwmac", .data = &sti_gmac_data},
+#endif
         /* SoC specific glue layers should come before generic bindings */
         { .compatible = "st,spear600-gmac"},
         { .compatible = "snps,dwmac-3.610"},
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index bde63e3af96f..651087b5c8da 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -554,7 +554,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                  * common for both the interface as the interface shares
                  * the same hardware resource.
                  */
-                for (i = 0; i <= priv->data.slaves; i++)
+                for (i = 0; i < priv->data.slaves; i++)
                         if (priv->slaves[i].ndev->flags & IFF_PROMISC)
                                 flag = true;
 
@@ -578,7 +578,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                         unsigned long timeout = jiffies + HZ;
 
                         /* Disable Learn for all ports */
-                        for (i = 0; i <= priv->data.slaves; i++) {
+                        for (i = 0; i < priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 1);
                                 cpsw_ale_control_set(ale, i,
@@ -606,7 +606,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 0);
 
                         /* Enable Learn for all ports */
-                        for (i = 0; i <= priv->data.slaves; i++) {
+                        for (i = 0; i < priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 0);
                                 cpsw_ale_control_set(ale, i,
@@ -1878,14 +1878,29 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                 phyid = be32_to_cpup(parp+1);
                 mdio = of_find_device_by_node(mdio_node);
-                snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                         PHY_ID_FMT, mdio->name, phyid);
+
+                if (strncmp(mdio->name, "gpio", 4) == 0) {
+                        /* GPIO bitbang MDIO driver attached */
+                        struct mii_bus *bus = dev_get_drvdata(&mdio->dev);
+
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, bus->id, phyid);
+                } else {
+                        /* davinci MDIO driver attached */
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, mdio->name, phyid);
+                }
 
                 mac_addr = of_get_mac_address(slave_node);
                 if (mac_addr)
                         memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN);
 
                 slave_data->phy_if = of_get_phy_mode(slave_node);
+                if (slave_data->phy_if < 0) {
+                        pr_err("Missing or malformed slave[%d] phy-mode property\n",
+                               i);
+                        return slave_data->phy_if;
+                }
 
                 if (data->dual_emac) {
                         if (of_property_read_u32(slave_node, "dual_emac_res_vlan",
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 023237a65720..17503da9f7a5 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2071,7 +2071,7 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
 
 /* Return subqueue id on this core (one per core). */
 static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb,
-                                 void *accel_priv)
+                                 void *accel_priv, select_queue_fallback_t fallback)
 {
         return smp_processor_id();
 }
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 1ec65feebb9e..4bfdf8c7ada0 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -26,6 +26,7 @@
 #include <linux/netdevice.h>
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
+#include <linux/of_irq.h>
 #include <linux/of_address.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
@@ -600,7 +601,8 @@ static void axienet_start_xmit_done(struct net_device *ndev)
                 size += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK;
                 packets++;
 
-                lp->tx_bd_ci = ++lp->tx_bd_ci % TX_BD_NUM;
+                ++lp->tx_bd_ci;
+                lp->tx_bd_ci %= TX_BD_NUM;
                 cur_p = &lp->tx_bd_v[lp->tx_bd_ci];
                 status = cur_p->status;
         }
@@ -686,7 +688,8 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                      skb_headlen(skb), DMA_TO_DEVICE);
 
         for (ii = 0; ii < num_frag; ii++) {
-                lp->tx_bd_tail = ++lp->tx_bd_tail % TX_BD_NUM;
+                ++lp->tx_bd_tail;
+                lp->tx_bd_tail %= TX_BD_NUM;
                 cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
                 frag = &skb_shinfo(skb)->frags[ii];
                 cur_p->phys = dma_map_single(ndev->dev.parent,
@@ -702,7 +705,8 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         tail_p = lp->tx_bd_p + sizeof(*lp->tx_bd_v) * lp->tx_bd_tail;
         /* Start the transfer */
         axienet_dma_out32(lp, XAXIDMA_TX_TDESC_OFFSET, tail_p);
-        lp->tx_bd_tail = ++lp->tx_bd_tail % TX_BD_NUM;
+        ++lp->tx_bd_tail;
+        lp->tx_bd_tail %= TX_BD_NUM;
 
         return NETDEV_TX_OK;
 }
@@ -774,7 +778,8 @@ static void axienet_recv(struct net_device *ndev)
                 cur_p->status = 0;
                 cur_p->sw_id_offset = (u32) new_skb;
 
-                lp->rx_bd_ci = ++lp->rx_bd_ci % RX_BD_NUM;
+                ++lp->rx_bd_ci;
+                lp->rx_bd_ci %= RX_BD_NUM;
                 cur_p = &lp->rx_bd_v[lp->rx_bd_ci];
         }
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 7756118c2f0a..7141a1937360 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -88,8 +88,12 @@ static int netvsc_open(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
         struct hv_device *device_obj = net_device_ctx->device_ctx;
+        struct netvsc_device *nvdev;
+        struct rndis_device *rdev;
         int ret = 0;
 
+        netif_carrier_off(net);
+
         /* Open up the device */
         ret = rndis_filter_open(device_obj);
         if (ret != 0) {
@@ -99,6 +103,11 @@ static int netvsc_open(struct net_device *net)
 
         netif_start_queue(net);
 
+        nvdev = hv_get_drvdata(device_obj);
+        rdev = nvdev->extension;
+        if (!rdev->link_state)
+                netif_carrier_on(net);
+
         return ret;
 }
 
@@ -229,23 +238,24 @@ void netvsc_linkstatus_callback(struct hv_device *device_obj,
         struct net_device *net;
         struct net_device_context *ndev_ctx;
         struct netvsc_device *net_device;
+        struct rndis_device *rdev;
 
         net_device = hv_get_drvdata(device_obj);
+        rdev = net_device->extension;
+
+        rdev->link_state = status != 1;
+
         net = net_device->ndev;
 
-        if (!net) {
-                netdev_err(net, "got link status but net device "
-                                "not initialized yet\n");
+        if (!net || net->reg_state != NETREG_REGISTERED)
                 return;
-        }
 
+        ndev_ctx = netdev_priv(net);
         if (status == 1) {
-                netif_carrier_on(net);
-                ndev_ctx = netdev_priv(net);
                 schedule_delayed_work(&ndev_ctx->dwork, 0);
                 schedule_delayed_work(&ndev_ctx->dwork, msecs_to_jiffies(20));
         } else {
-                netif_carrier_off(net);
+                schedule_delayed_work(&ndev_ctx->dwork, 0);
         }
 }
 
@@ -388,17 +398,35 @@ static const struct net_device_ops device_ops = {
  * current context when receiving RNDIS_STATUS_MEDIA_CONNECT event. So, add
  * another netif_notify_peers() into a delayed work, otherwise GARP packet
  * will not be sent after quick migration, and cause network disconnection.
+ * Also, we update the carrier status here.
  */
-static void netvsc_send_garp(struct work_struct *w)
+static void netvsc_link_change(struct work_struct *w)
 {
         struct net_device_context *ndev_ctx;
         struct net_device *net;
         struct netvsc_device *net_device;
+        struct rndis_device *rdev;
+        bool notify;
+
+        rtnl_lock();
 
         ndev_ctx = container_of(w, struct net_device_context, dwork.work);
         net_device = hv_get_drvdata(ndev_ctx->device_ctx);
+        rdev = net_device->extension;
         net = net_device->ndev;
-        netdev_notify_peers(net);
+
+        if (rdev->link_state) {
+                netif_carrier_off(net);
+                notify = false;
+        } else {
+                netif_carrier_on(net);
+                notify = true;
+        }
+
+        rtnl_unlock();
+
+        if (notify)
+                netdev_notify_peers(net);
 }
 
 
@@ -414,13 +442,10 @@ static int netvsc_probe(struct hv_device *dev,
         if (!net)
                 return -ENOMEM;
 
-        /* Set initial state */
-        netif_carrier_off(net);
-
         net_device_ctx = netdev_priv(net);
         net_device_ctx->device_ctx = dev;
         hv_set_drvdata(dev, net);
-        INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_send_garp);
+        INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
         INIT_WORK(&net_device_ctx->work, do_set_multicast);
 
         net->netdev_ops = &device_ops;
@@ -443,8 +468,6 @@ static int netvsc_probe(struct hv_device *dev,
         }
         memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
 
-        netif_carrier_on(net);
-
         ret = register_netdev(net);
         if (ret != 0) {
                 pr_err("Unable to register netdev.\n");
diff --git a/drivers/net/irda/Kconfig b/drivers/net/irda/Kconfig
index 2dc82f1d2e70..3da44d5d9149 100644
--- a/drivers/net/irda/Kconfig
+++ b/drivers/net/irda/Kconfig
@@ -210,13 +210,6 @@ config KINGSUN_DONGLE
           To compile it as a module, choose M here: the module will be called
           kingsun-sir.
 
-config EP7211_DONGLE
-        tristate "Cirrus Logic clps711x I/R support"
-        depends on IRTTY_SIR && ARCH_CLPS711X && IRDA
-        help
-          Say Y here if you want to build support for the Cirrus logic
-          EP7211 chipset's infrared module.
-
 config KSDAZZLE_DONGLE
         tristate "KingSun Dazzle IrDA-USB dongle"
         depends on IRDA && USB
diff --git a/drivers/net/irda/Makefile b/drivers/net/irda/Makefile
index dfc64537f62f..be8ab5b9a4a2 100644
--- a/drivers/net/irda/Makefile
+++ b/drivers/net/irda/Makefile
@@ -35,7 +35,6 @@ obj-$(CONFIG_MCP2120_DONGLE)	+= mcp2120-sir.o
 obj-$(CONFIG_ACT200L_DONGLE)    += act200l-sir.o
 obj-$(CONFIG_MA600_DONGLE)      += ma600-sir.o
 obj-$(CONFIG_TOIM3232_DONGLE)   += toim3232-sir.o
-obj-$(CONFIG_EP7211_DONGLE)     += ep7211-sir.o
 obj-$(CONFIG_KINGSUN_DONGLE)    += kingsun-sir.o
 obj-$(CONFIG_KSDAZZLE_DONGLE)   += ksdazzle-sir.o
 obj-$(CONFIG_KS959_DONGLE)      += ks959-sir.o
diff --git a/drivers/net/irda/ep7211-sir.c b/drivers/net/irda/ep7211-sir.c
deleted file mode 100644
index 5fe1f4dd3369..000000000000
--- a/drivers/net/irda/ep7211-sir.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * IR port driver for the Cirrus Logic CLPS711X processors
- *
- * Copyright 2001, Blue Mug Inc.  All rights reserved.
- * Copyright 2007, Samuel Ortiz <samuel@sortiz.org>
- */
-
-#include <linux/module.h>
-#include <linux/platform_device.h>
-
-#include <mach/hardware.h>
-
-#include "sir-dev.h"
-
-static int clps711x_dongle_open(struct sir_dev *dev)
-{
-        unsigned int syscon;
-
-        /* Turn on the SIR encoder. */
-        syscon = clps_readl(SYSCON1);
-        syscon |= SYSCON1_SIREN;
-        clps_writel(syscon, SYSCON1);
-
-        return 0;
-}
-
-static int clps711x_dongle_close(struct sir_dev *dev)
-{
-        unsigned int syscon;
-
-        /* Turn off the SIR encoder. */
-        syscon = clps_readl(SYSCON1);
-        syscon &= ~SYSCON1_SIREN;
-        clps_writel(syscon, SYSCON1);
-
-        return 0;
-}
-
-static struct dongle_driver clps711x_dongle = {
-        .owner          = THIS_MODULE,
-        .driver_name    = "EP7211 IR driver",
-        .type           = IRDA_EP7211_DONGLE,
-        .open           = clps711x_dongle_open,
-        .close          = clps711x_dongle_close,
-};
-
-static int clps711x_sir_probe(struct platform_device *pdev)
-{
-        return irda_register_dongle(&clps711x_dongle);
-}
-
-static int clps711x_sir_remove(struct platform_device *pdev)
-{
-        return irda_unregister_dongle(&clps711x_dongle);
-}
-
-static struct platform_driver clps711x_sir_driver = {
-        .driver = {
-                .name   = "sir-clps711x",
-                .owner  = THIS_MODULE,
-        },
-        .probe  = clps711x_sir_probe,
-        .remove = clps711x_sir_remove,
-};
-module_platform_driver(clps711x_sir_driver);
-
-MODULE_AUTHOR("Samuel Ortiz <samuel@sortiz.org>");
-MODULE_DESCRIPTION("EP7211 IR dongle driver");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("irda-dongle-13"); /* IRDA_EP7211_DONGLE */
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index 177441afeb96..24b6dddd7f2f 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -522,7 +522,6 @@ static void irtty_close(struct tty_struct *tty)
         sirdev_put_instance(priv->dev);
 
         /* Stop tty */
-        irtty_stop_receiver(tty, TRUE);
         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
         if (tty->ops->stop)
                 tty->ops->stop(tty);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 8433de4509c7..a5d21893670d 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -879,14 +879,15 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         dev->priv_flags |= IFF_MACVLAN;
         err = netdev_upper_dev_link(lowerdev, dev);
         if (err)
-                goto destroy_port;
-
+                goto unregister_netdev;
 
         list_add_tail_rcu(&vlan->list, &port->vlans);
         netif_stacked_transfer_operstate(lowerdev, dev);
 
         return 0;
 
+unregister_netdev:
+        unregister_netdevice(dev);
 destroy_port:
         port->count -= 1;
         if (!port->count)
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 547725fa8671..98e7cbf720a5 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -437,7 +437,10 @@ static int ptp_dp83640_enable(struct ptp_clock_info *ptp,
                 if (on) {
                         gpio_num = gpio_tab[EXTTS0_GPIO + index];
                         evnt |= (gpio_num & EVNT_GPIO_MASK) << EVNT_GPIO_SHIFT;
-                        evnt |= EVNT_RISE;
+                        if (rq->extts.flags & PTP_FALLING_EDGE)
+                                evnt |= EVNT_FALL;
+                        else
+                                evnt |= EVNT_RISE;
                 }
                 ext_write(0, phydev, PAGE5, PTP_EVNT, evnt);
                 return 0;
@@ -1003,11 +1006,6 @@ static int dp83640_probe(struct phy_device *phydev)
         } else
                 list_add_tail(&dp83640->list, &clock->phylist);
 
-        if (clock->chosen && !list_empty(&clock->phylist))
-                recalibrate(clock);
-        else
-                enable_broadcast(dp83640->phydev, clock->page, 1);
-
         dp83640_clock_put(clock);
         return 0;
 
@@ -1058,6 +1056,21 @@ static void dp83640_remove(struct phy_device *phydev)
         kfree(dp83640);
 }
 
+static int dp83640_config_init(struct phy_device *phydev)
+{
+        struct dp83640_private *dp83640 = phydev->priv;
+        struct dp83640_clock *clock = dp83640->clock;
+
+        if (clock->chosen && !list_empty(&clock->phylist))
+                recalibrate(clock);
+        else
+                enable_broadcast(phydev, clock->page, 1);
+
+        enable_status_frames(phydev, true);
+        ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
+        return 0;
+}
+
 static int dp83640_ack_interrupt(struct phy_device *phydev)
 {
         int err = phy_read(phydev, MII_DP83640_MISR);
@@ -1195,11 +1208,6 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
 
         mutex_lock(&dp83640->clock->extreg_lock);
 
-        if (dp83640->hwts_tx_en || dp83640->hwts_rx_en) {
-                enable_status_frames(phydev, true);
-                ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
-        }
-
         ext_write(0, phydev, PAGE5, PTP_TXCFG0, txcfg0);
         ext_write(0, phydev, PAGE5, PTP_RXCFG0, rxcfg0);
 
@@ -1281,6 +1289,7 @@ static void dp83640_txtstamp(struct phy_device *phydev,
                 }
                 /* fall through */
         case HWTSTAMP_TX_ON:
+                skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
                 skb_queue_tail(&dp83640->tx_queue, skb);
                 schedule_work(&dp83640->ts_work);
                 break;
@@ -1330,6 +1339,7 @@ static struct phy_driver dp83640_driver = {
         .flags          = PHY_HAS_INTERRUPT,
         .probe          = dp83640_probe,
         .remove         = dp83640_remove,
+        .config_init    = dp83640_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
         .ack_interrupt  = dp83640_ack_interrupt,
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index bb88bc7d81fb..9367acc84fbb 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -170,6 +170,9 @@ static int sun4i_mdio_remove(struct platform_device *pdev)
 }
 
 static const struct of_device_id sun4i_mdio_dt_ids[] = {
+        { .compatible = "allwinner,sun4i-a10-mdio" },
+
+        /* Deprecated */
         { .compatible = "allwinner,sun4i-mdio" },
         { }
 };
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 4b03e63639b7..82514e72b3d8 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -719,7 +719,7 @@ int phy_resume(struct phy_device *phydev)
 static int genphy_config_advert(struct phy_device *phydev)
 {
         u32 advertise;
-        int oldadv, adv;
+        int oldadv, adv, bmsr;
         int err, changed = 0;
 
         /* Only allow advertising what this PHY supports */
@@ -744,26 +744,36 @@ static int genphy_config_advert(struct phy_device *phydev)
                 changed = 1;
         }
 
+        bmsr = phy_read(phydev, MII_BMSR);
+        if (bmsr < 0)
+                return bmsr;
+
+        /* Per 802.3-2008, Section 22.2.4.2.16 Extended status all
+         * 1000Mbits/sec capable PHYs shall have the BMSR_ESTATEN bit set to a
+         * logical 1.
+         */
+        if (!(bmsr & BMSR_ESTATEN))
+                return changed;
+
         /* Configure gigabit if it's supported */
+        adv = phy_read(phydev, MII_CTRL1000);
+        if (adv < 0)
+                return adv;
+
+        oldadv = adv;
+        adv &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
+
         if (phydev->supported & (SUPPORTED_1000baseT_Half |
                                  SUPPORTED_1000baseT_Full)) {
-                adv = phy_read(phydev, MII_CTRL1000);
-                if (adv < 0)
-                        return adv;
-
-                oldadv = adv;
-                adv &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
                 adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
-
-                if (adv != oldadv) {
-                        err = phy_write(phydev, MII_CTRL1000, adv);
-
-                        if (err < 0)
-                                return err;
+                if (adv != oldadv)
                         changed = 1;
-                }
         }
 
+        err = phy_write(phydev, MII_CTRL1000, adv);
+        if (err < 0)
+                return err;
+
         return changed;
 }
 
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 28407426fd6f..c8624a8235ab 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1648,7 +1648,7 @@ static netdev_tx_t team_xmit(struct sk_buff *skb, struct net_device *dev)
 }
 
 static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb,
-                             void *accel_priv)
+                             void *accel_priv, select_queue_fallback_t fallback)
 {
         /*
          * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 44c4db8450f0..8fe9cb7d0f72 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -366,7 +366,7 @@ static inline void tun_flow_save_rps_rxhash(struct tun_flow_entry *e, u32 hash)
  * hope the rxq no. may help here.
  */
 static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
-                            void *accel_priv)
+                            void *accel_priv, select_queue_fallback_t fallback)
 {
         struct tun_struct *tun = netdev_priv(dev);
         struct tun_flow_entry *e;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 6b638a066c1d..7e7269fd3707 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -292,6 +292,21 @@ config USB_NET_SR9700
           This option adds support for CoreChip-sz SR9700 based USB 1.1
           10/100 Ethernet adapters.
 
+config USB_NET_SR9800
+        tristate "CoreChip-sz SR9800 based USB 2.0 10/100 ethernet devices"
+        depends on USB_USBNET
+        select CRC32
+        ---help---
+          Say Y if you want to use one of the following 100Mbps USB Ethernet
+          device based on the CoreChip-sz SR9800 chip.
+
+          This driver makes the adapter appear as a normal Ethernet interface,
+          typically on eth0, if it is the only ethernet device, or perhaps on
+          eth1, if you have a PCI or ISA ethernet card installed.
+
+          To compile this driver as a module, choose M here: the
+          module will be called sr9800.
+
 config USB_NET_SMSC75XX
         tristate "SMSC LAN75XX based USB 2.0 gigabit ethernet devices"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index b17b5e88bbaf..433f0a00c683 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_USB_NET_CDCETHER)	+= cdc_ether.o r815x.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SR9700)    += sr9700.o
+obj-$(CONFIG_USB_NET_SR9800)    += sr9800.o
 obj-$(CONFIG_USB_NET_SMSC75XX)  += smsc75xx.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 9765a7d4766d..5d194093f3e1 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -917,7 +917,8 @@ static const struct driver_info ax88178_info = {
         .status = asix_status,
         .link_reset = ax88178_link_reset,
         .reset = ax88178_reset,
-        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+                 FLAG_MULTI_PACKET,
         .rx_fixup = asix_rx_fixup_common,
         .tx_fixup = asix_tx_fixup,
 };
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index d6f64dad05bc..955df81a4358 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1118,6 +1118,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         u16 hdr_off;
         u32 *pkt_hdr;
 
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         skb_trim(skb, skb->len - 4);
         memcpy(&rx_hdr, skb_tail_pointer(skb), 4);
         le32_to_cpus(&rx_hdr);
diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
index e4a8a93fbaf7..1cc24e6f23e2 100644
--- a/drivers/net/usb/gl620a.c
+++ b/drivers/net/usb/gl620a.c
@@ -84,6 +84,10 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         u32                     size;
         u32                     count;
 
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         header = (struct gl_header *) skb->data;
 
         // get the packet count of the received skb
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 1a482344b3f5..660bd5ea9fc0 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1201,16 +1201,18 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
         struct hso_serial *serial = urb->context;
         int status = urb->status;
 
+        D4("\n--- Got serial_read_bulk callback %02x ---", status);
+
         /* sanity check */
         if (!serial) {
                 D1("serial == NULL");
                 return;
-        } else if (status) {
+        }
+        if (status) {
                 handle_usb_error(status, __func__, serial->parent);
                 return;
         }
 
-        D4("\n--- Got serial_read_bulk callback %02x ---", status);
         D1("Actual length = %d\n", urb->actual_length);
         DUMP1(urb->transfer_buffer, urb->actual_length);
 
@@ -1218,25 +1220,13 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
         if (serial->port.count == 0)
                 return;
 
-        if (status == 0) {
-                if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
-                        fix_crc_bug(urb, serial->in_endp->wMaxPacketSize);
-                /* Valid data, handle RX data */
-                spin_lock(&serial->serial_lock);
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 1;
-                put_rxbuf_data_and_resubmit_bulk_urb(serial);
-                spin_unlock(&serial->serial_lock);
-        } else if (status == -ENOENT || status == -ECONNRESET) {
-                /* Unlinked - check for throttled port. */
-                D2("Port %d, successfully unlinked urb", serial->minor);
-                spin_lock(&serial->serial_lock);
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 0;
-                hso_resubmit_rx_bulk_urb(serial, urb);
-                spin_unlock(&serial->serial_lock);
-        } else {
-                D2("Port %d, status = %d for read urb", serial->minor, status);
-                return;
-        }
+        if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
+                fix_crc_bug(urb, serial->in_endp->wMaxPacketSize);
+        /* Valid data, handle RX data */
+        spin_lock(&serial->serial_lock);
+        serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 1;
+        put_rxbuf_data_and_resubmit_bulk_urb(serial);
+        spin_unlock(&serial->serial_lock);
 }
 
 /*
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index a305a7b2dae6..82d844a8ebd0 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -526,8 +526,9 @@ static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
         u8 status;
 
-        if (skb->len == 0) {
-                dev_err(&dev->udev->dev, "unexpected empty rx frame\n");
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len) {
+                dev_err(&dev->udev->dev, "unexpected tiny rx frame\n");
                 return 0;
         }
 
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index 0a85d9227775..4cbdb1307f3e 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -364,6 +364,10 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         struct nc_trailer       *trailer;
         u16                     hdr_len, packet_len;
 
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         if (!(skb->len & 0x01)) {
                 netdev_dbg(dev->net, "rx framesize %d range %d..%d mtu %d\n",
                            skb->len, dev->net->hard_header_len, dev->hard_mtu,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 23bdd5b9274d..313cb6cd4848 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -80,10 +80,10 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
         __be16 proto;
 
-        /* usbnet rx_complete guarantees that skb->len is at least
-         * hard_header_len, so we can inspect the dest address without
-         * checking skb->len
-         */
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         switch (skb->data[0] & 0xf0) {
         case 0x40:
                 proto = htons(ETH_P_IP);
@@ -712,6 +712,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x1255, 3)},
         {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
         {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1270, 5)},    /* ZTE MF667 */
         {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
         {QMI_FIXED_INTF(0x19d2, 0x1402, 2)},    /* ZTE MF60 */
         {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
@@ -723,6 +724,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
         {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
+        {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
@@ -730,6 +732,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
         {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
+        {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},    /* Cinterion PHxx,PXxx */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index e8fac732c6f1..d89dbe395ad2 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -2273,22 +2273,21 @@ static int rtl8152_open(struct net_device *netdev)
         struct r8152 *tp = netdev_priv(netdev);
         int res = 0;
 
+        rtl8152_set_speed(tp, AUTONEG_ENABLE,
+                          tp->mii.supports_gmii ? SPEED_1000 : SPEED_100,
+                          DUPLEX_FULL);
+        tp->speed = 0;
+        netif_carrier_off(netdev);
+        netif_start_queue(netdev);
+        set_bit(WORK_ENABLE, &tp->flags);
         res = usb_submit_urb(tp->intr_urb, GFP_KERNEL);
         if (res) {
                 if (res == -ENODEV)
                         netif_device_detach(tp->netdev);
                 netif_warn(tp, ifup, netdev, "intr_urb submit failed: %d\n",
                            res);
-                return res;
         }
 
-        rtl8152_set_speed(tp, AUTONEG_ENABLE,
-                          tp->mii.supports_gmii ? SPEED_1000 : SPEED_100,
-                          DUPLEX_FULL);
-        tp->speed = 0;
-        netif_carrier_off(netdev);
-        netif_start_queue(netdev);
-        set_bit(WORK_ENABLE, &tp->flags);
 
         return res;
 }
@@ -2298,8 +2297,8 @@ static int rtl8152_close(struct net_device *netdev)
         struct r8152 *tp = netdev_priv(netdev);
         int res = 0;
 
-        usb_kill_urb(tp->intr_urb);
         clear_bit(WORK_ENABLE, &tp->flags);
+        usb_kill_urb(tp->intr_urb);
         cancel_delayed_work_sync(&tp->schedule);
         netif_stop_queue(netdev);
         tasklet_disable(&tp->tl);
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index a48bc0f20c1a..524a47a28120 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -492,6 +492,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind);
  */
 int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         /* peripheral may have batched packets to us... */
         while (likely(skb->len)) {
                 struct rndis_data_hdr   *hdr = (void *)skb->data;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index f17b9e02dd34..d9e7892262fa 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2106,6 +2106,10 @@ static void smsc75xx_rx_csum_offload(struct usbnet *dev, struct sk_buff *skb,
 
 static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         while (skb->len > 0) {
                 u32 rx_cmd_a, rx_cmd_b, align_count, size;
                 struct sk_buff *ax_skb;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 8dd54a0f7b29..424db65e4396 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1723,6 +1723,10 @@ static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
 
 static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         while (skb->len > 0) {
                 u32 header, align_count;
                 struct sk_buff *ax_skb;
diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
new file mode 100644
index 000000000000..b94a0fbb8b3b
--- /dev/null
+++ b/drivers/net/usb/sr9800.c
@@ -0,0 +1,874 @@
+/* CoreChip-sz SR9800 one chip USB 2.0 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * Based on asix_common.c, asix_devices.c
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.*
+ */
+
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+#include <linux/slab.h>
+#include <linux/if_vlan.h>
+
+#include "sr9800.h"
+
+static int sr_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                            u16 size, void *data)
+{
+        int err;
+
+        err = usbnet_read_cmd(dev, cmd, SR_REQ_RD_REG, value, index,
+                              data, size);
+        if ((err != size) && (err >= 0))
+                err = -EINVAL;
+
+        return err;
+}
+
+static int sr_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                             u16 size, void *data)
+{
+        int err;
+
+        err = usbnet_write_cmd(dev, cmd, SR_REQ_WR_REG, value, index,
+                              data, size);
+        if ((err != size) && (err >= 0))
+                err = -EINVAL;
+
+        return err;
+}
+
+static void
+sr_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                   u16 size, void *data)
+{
+        usbnet_write_cmd_async(dev, cmd, SR_REQ_WR_REG, value, index, data,
+                               size);
+}
+
+static int sr_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int offset = 0;
+
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
+        while (offset + sizeof(u32) < skb->len) {
+                struct sk_buff *sr_skb;
+                u16 size;
+                u32 header = get_unaligned_le32(skb->data + offset);
+
+                offset += sizeof(u32);
+                /* get the packet length */
+                size = (u16) (header & 0x7ff);
+                if (size != ((~header >> 16) & 0x07ff)) {
+                        netdev_err(dev->net, "%s : Bad Header Length\n",
+                                   __func__);
+                        return 0;
+                }
+
+                if ((size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) ||
+                    (size + offset > skb->len)) {
+                        netdev_err(dev->net, "%s : Bad RX Length %d\n",
+                                   __func__, size);
+                        return 0;
+                }
+                sr_skb = netdev_alloc_skb_ip_align(dev->net, size);
+                if (!sr_skb)
+                        return 0;
+
+                skb_put(sr_skb, size);
+                memcpy(sr_skb->data, skb->data + offset, size);
+                usbnet_skb_return(dev, sr_skb);
+
+                offset += (size + 1) & 0xfffe;
+        }
+
+        if (skb->len != offset) {
+                netdev_err(dev->net, "%s : Bad SKB Length %d\n", __func__,
+                           skb->len);
+                return 0;
+        }
+
+        return 1;
+}
+
+static struct sk_buff *sr_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                        gfp_t flags)
+{
+        int headroom = skb_headroom(skb);
+        int tailroom = skb_tailroom(skb);
+        u32 padbytes = 0xffff0000;
+        u32 packet_len;
+        int padlen;
+
+        padlen = ((skb->len + 4) % (dev->maxpacket - 1)) ? 0 : 4;
+
+        if ((!skb_cloned(skb)) && ((headroom + tailroom) >= (4 + padlen))) {
+                if ((headroom < 4) || (tailroom < padlen)) {
+                        skb->data = memmove(skb->head + 4, skb->data,
+                                            skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                }
+        } else {
+                struct sk_buff *skb2;
+                skb2 = skb_copy_expand(skb, 4, padlen, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+
+        skb_push(skb, 4);
+        packet_len = (((skb->len - 4) ^ 0x0000ffff) << 16) + (skb->len - 4);
+        cpu_to_le32s(&packet_len);
+        skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
+
+        if (padlen) {
+                cpu_to_le32s(&padbytes);
+                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
+                skb_put(skb, sizeof(padbytes));
+        }
+
+        return skb;
+}
+
+static void sr_status(struct usbnet *dev, struct urb *urb)
+{
+        struct sr9800_int_data *event;
+        int link;
+
+        if (urb->actual_length < 8)
+                return;
+
+        event = urb->transfer_buffer;
+        link = event->link & 0x01;
+        if (netif_carrier_ok(dev->net) != link) {
+                usbnet_link_change(dev, link, 1);
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
+        }
+
+        return;
+}
+
+static inline int sr_set_sw_mii(struct usbnet *dev)
+{
+        int ret;
+
+        ret = sr_write_cmd(dev, SR_CMD_SET_SW_MII, 0x0000, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to enable software MII access\n");
+        return ret;
+}
+
+static inline int sr_set_hw_mii(struct usbnet *dev)
+{
+        int ret;
+
+        ret = sr_write_cmd(dev, SR_CMD_SET_HW_MII, 0x0000, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to enable hardware MII access\n");
+        return ret;
+}
+
+static inline int sr_get_phy_addr(struct usbnet *dev)
+{
+        u8 buf[2];
+        int ret;
+
+        ret = sr_read_cmd(dev, SR_CMD_READ_PHY_ID, 0, 0, 2, buf);
+        if (ret < 0) {
+                netdev_err(dev->net, "%s : Error reading PHYID register:%02x\n",
+                           __func__, ret);
+                goto out;
+        }
+        netdev_dbg(dev->net, "%s : returning 0x%04x\n", __func__,
+                   *((__le16 *)buf));
+
+        ret = buf[1];
+
+out:
+        return ret;
+}
+
+static int sr_sw_reset(struct usbnet *dev, u8 flags)
+{
+        int ret;
+
+        ret = sr_write_cmd(dev, SR_CMD_SW_RESET, flags, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to send software reset:%02x\n",
+                           ret);
+
+        return ret;
+}
+
+static u16 sr_read_rx_ctl(struct usbnet *dev)
+{
+        __le16 v;
+        int ret;
+
+        ret = sr_read_cmd(dev, SR_CMD_READ_RX_CTL, 0, 0, 2, &v);
+        if (ret < 0) {
+                netdev_err(dev->net, "Error reading RX_CTL register:%02x\n",
+                           ret);
+                goto out;
+        }
+
+        ret = le16_to_cpu(v);
+out:
+        return ret;
+}
+
+static int sr_write_rx_ctl(struct usbnet *dev, u16 mode)
+{
+        int ret;
+
+        netdev_dbg(dev->net, "%s : mode = 0x%04x\n", __func__, mode);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_RX_CTL, mode, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net,
+                           "Failed to write RX_CTL mode to 0x%04x:%02x\n",
+                           mode, ret);
+
+        return ret;
+}
+
+static u16 sr_read_medium_status(struct usbnet *dev)
+{
+        __le16 v;
+        int ret;
+
+        ret = sr_read_cmd(dev, SR_CMD_READ_MEDIUM_STATUS, 0, 0, 2, &v);
+        if (ret < 0) {
+                netdev_err(dev->net,
+                           "Error reading Medium Status register:%02x\n", ret);
+                return ret;     /* TODO: callers not checking for error ret */
+        }
+
+        return le16_to_cpu(v);
+}
+
+static int sr_write_medium_mode(struct usbnet *dev, u16 mode)
+{
+        int ret;
+
+        netdev_dbg(dev->net, "%s : mode = 0x%04x\n", __func__, mode);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_MEDIUM_MODE, mode, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net,
+                           "Failed to write Medium Mode mode to 0x%04x:%02x\n",
+                           mode, ret);
+        return ret;
+}
+
+static int sr_write_gpio(struct usbnet *dev, u16 value, int sleep)
+{
+        int ret;
+
+        netdev_dbg(dev->net, "%s : value = 0x%04x\n", __func__, value);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_GPIOS, value, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to write GPIO value 0x%04x:%02x\n",
+                           value, ret);
+        if (sleep)
+                msleep(sleep);
+
+        return ret;
+}
+
+/* SR9800 have a 16-bit RX_CTL value */
+static void sr_set_multicast(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        u16 rx_ctl = SR_DEFAULT_RX_CTL;
+
+        if (net->flags & IFF_PROMISC) {
+                rx_ctl |= SR_RX_CTL_PRO;
+        } else if (net->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(net) > SR_MAX_MCAST) {
+                rx_ctl |= SR_RX_CTL_AMALL;
+        } else if (netdev_mc_empty(net)) {
+                /* just broadcast and directed */
+        } else {
+                /* We use the 20 byte dev->data
+                 * for our 8 byte filter buffer
+                 * to avoid allocating memory that
+                 * is tricky to free later
+                 */
+                struct netdev_hw_addr *ha;
+                u32 crc_bits;
+
+                memset(data->multi_filter, 0, SR_MCAST_FILTER_SIZE);
+
+                /* Build the multicast hash filter. */
+                netdev_for_each_mc_addr(ha, net) {
+                        crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
+                        data->multi_filter[crc_bits >> 3] |=
+                            1 << (crc_bits & 7);
+                }
+
+                sr_write_cmd_async(dev, SR_CMD_WRITE_MULTI_FILTER, 0, 0,
+                                   SR_MCAST_FILTER_SIZE, data->multi_filter);
+
+                rx_ctl |= SR_RX_CTL_AM;
+        }
+
+        sr_write_cmd_async(dev, SR_CMD_WRITE_RX_CTL, rx_ctl, 0, 0, NULL);
+}
+
+static int sr_mdio_read(struct net_device *net, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 res;
+
+        mutex_lock(&dev->phy_mutex);
+        sr_set_sw_mii(dev);
+        sr_read_cmd(dev, SR_CMD_READ_MII_REG, phy_id, (__u16)loc, 2, &res);
+        sr_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
+
+        netdev_dbg(dev->net,
+                   "%s : phy_id=0x%02x, loc=0x%02x, returns=0x%04x\n", __func__,
+                   phy_id, loc, le16_to_cpu(res));
+
+        return le16_to_cpu(res);
+}
+
+static void
+sr_mdio_write(struct net_device *net, int phy_id, int loc, int val)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 res = cpu_to_le16(val);
+
+        netdev_dbg(dev->net,
+                   "%s : phy_id=0x%02x, loc=0x%02x, val=0x%04x\n", __func__,
+                   phy_id, loc, val);
+        mutex_lock(&dev->phy_mutex);
+        sr_set_sw_mii(dev);
+        sr_write_cmd(dev, SR_CMD_WRITE_MII_REG, phy_id, (__u16)loc, 2, &res);
+        sr_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
+}
+
+/* Get the PHY Identifier from the PHYSID1 & PHYSID2 MII registers */
+static u32 sr_get_phyid(struct usbnet *dev)
+{
+        int phy_reg;
+        u32 phy_id;
+        int i;
+
+        /* Poll for the rare case the FW or phy isn't ready yet.  */
+        for (i = 0; i < 100; i++) {
+                phy_reg = sr_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID1);
+                if (phy_reg != 0 && phy_reg != 0xFFFF)
+                        break;
+                mdelay(1);
+        }
+
+        if (phy_reg <= 0 || phy_reg == 0xFFFF)
+                return 0;
+
+        phy_id = (phy_reg & 0xffff) << 16;
+
+        phy_reg = sr_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID2);
+        if (phy_reg < 0)
+                return 0;
+
+        phy_id |= (phy_reg & 0xffff);
+
+        return phy_id;
+}
+
+static void
+sr_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt;
+
+        if (sr_read_cmd(dev, SR_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+                wolinfo->supported = 0;
+                wolinfo->wolopts = 0;
+                return;
+        }
+        wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
+        wolinfo->wolopts = 0;
+        if (opt & SR_MONITOR_LINK)
+                wolinfo->wolopts |= WAKE_PHY;
+        if (opt & SR_MONITOR_MAGIC)
+                wolinfo->wolopts |= WAKE_MAGIC;
+}
+
+static int
+sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt = 0;
+
+        if (wolinfo->wolopts & WAKE_PHY)
+                opt |= SR_MONITOR_LINK;
+        if (wolinfo->wolopts & WAKE_MAGIC)
+                opt |= SR_MONITOR_MAGIC;
+
+        if (sr_write_cmd(dev, SR_CMD_WRITE_MONITOR_MODE,
+                         opt, 0, 0, NULL) < 0)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int sr_get_eeprom_len(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+
+        return data->eeprom_len;
+}
+
+static int sr_get_eeprom(struct net_device *net,
+                              struct ethtool_eeprom *eeprom, u8 *data)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 *ebuf = (__le16 *)data;
+        int ret;
+        int i;
+
+        /* Crude hack to ensure that we don't overwrite memory
+         * if an odd length is supplied
+         */
+        if (eeprom->len % 2)
+                return -EINVAL;
+
+        eeprom->magic = SR_EEPROM_MAGIC;
+
+        /* sr9800 returns 2 bytes from eeprom on read */
+        for (i = 0; i < eeprom->len / 2; i++) {
+                ret = sr_read_cmd(dev, SR_CMD_READ_EEPROM, eeprom->offset + i,
+                                  0, 2, &ebuf[i]);
+                if (ret < 0)
+                        return -EINVAL;
+        }
+        return 0;
+}
+
+static void sr_get_drvinfo(struct net_device *net,
+                                 struct ethtool_drvinfo *info)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, DRIVER_NAME, sizeof(info->driver));
+        strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
+        info->eedump_len = data->eeprom_len;
+}
+
+static u32 sr_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+
+        return mii_link_ok(&dev->mii);
+}
+
+static int sr_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+
+static int sr_set_mac_address(struct net_device *net, void *p)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        struct sockaddr *addr = p;
+
+        if (netif_running(net))
+                return -EBUSY;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
+
+        /* We use the 20 byte dev->data
+         * for our 6 byte mac buffer
+         * to avoid allocating memory that
+         * is tricky to free later
+         */
+        memcpy(data->mac_addr, addr->sa_data, ETH_ALEN);
+        sr_write_cmd_async(dev, SR_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
+                           data->mac_addr);
+
+        return 0;
+}
+
+static const struct ethtool_ops sr9800_ethtool_ops = {
+        .get_drvinfo    = sr_get_drvinfo,
+        .get_link       = sr_get_link,
+        .get_msglevel   = usbnet_get_msglevel,
+        .set_msglevel   = usbnet_set_msglevel,
+        .get_wol        = sr_get_wol,
+        .set_wol        = sr_set_wol,
+        .get_eeprom_len = sr_get_eeprom_len,
+        .get_eeprom     = sr_get_eeprom,
+        .get_settings   = usbnet_get_settings,
+        .set_settings   = usbnet_set_settings,
+        .nway_reset     = usbnet_nway_reset,
+};
+
+static int sr9800_link_reset(struct usbnet *dev)
+{
+        struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET };
+        u16 mode;
+
+        mii_check_media(&dev->mii, 1, 1);
+        mii_ethtool_gset(&dev->mii, &ecmd);
+        mode = SR9800_MEDIUM_DEFAULT;
+
+        if (ethtool_cmd_speed(&ecmd) != SPEED_100)
+                mode &= ~SR_MEDIUM_PS;
+
+        if (ecmd.duplex != DUPLEX_FULL)
+                mode &= ~SR_MEDIUM_FD;
+
+        netdev_dbg(dev->net, "%s : speed: %u duplex: %d mode: 0x%04x\n",
+                   __func__, ethtool_cmd_speed(&ecmd), ecmd.duplex, mode);
+
+        sr_write_medium_mode(dev, mode);
+
+        return 0;
+}
+
+
+static int sr9800_set_default_mode(struct usbnet *dev)
+{
+        u16 rx_ctl;
+        int ret;
+
+        sr_mdio_write(dev->net, dev->mii.phy_id, MII_BMCR, BMCR_RESET);
+        sr_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
+                      ADVERTISE_ALL | ADVERTISE_CSMA);
+        mii_nway_restart(&dev->mii);
+
+        ret = sr_write_medium_mode(dev, SR9800_MEDIUM_DEFAULT);
+        if (ret < 0)
+                goto out;
+
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_IPG012,
+                                SR9800_IPG0_DEFAULT | SR9800_IPG1_DEFAULT,
+                                SR9800_IPG2_DEFAULT, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Write IPG,IPG1,IPG2 failed: %d\n", ret);
+                goto out;
+        }
+
+        /* Set RX_CTL to default values with 2k buffer, and enable cactus */
+        ret = sr_write_rx_ctl(dev, SR_DEFAULT_RX_CTL);
+        if (ret < 0)
+                goto out;
+
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after all initializations\n",
+                   rx_ctl);
+
+        rx_ctl = sr_read_medium_status(dev);
+        netdev_dbg(dev->net, "Medium Status:0x%04x after all initializations\n",
+                   rx_ctl);
+
+        return 0;
+out:
+        return ret;
+}
+
+static int sr9800_reset(struct usbnet *dev)
+{
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        int ret, embd_phy;
+        u16 rx_ctl;
+
+        ret = sr_write_gpio(dev,
+                        SR_GPIO_RSE | SR_GPIO_GPO_2 | SR_GPIO_GPO2EN, 5);
+        if (ret < 0)
+                goto out;
+
+        embd_phy = ((sr_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
+
+        ret = sr_write_cmd(dev, SR_CMD_SW_PHY_SELECT, embd_phy, 0, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
+                goto out;
+        }
+
+        ret = sr_sw_reset(dev, SR_SWRESET_IPPD | SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+
+        msleep(150);
+
+        ret = sr_sw_reset(dev, SR_SWRESET_CLEAR);
+        if (ret < 0)
+                goto out;
+
+        msleep(150);
+
+        if (embd_phy) {
+                ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+                if (ret < 0)
+                        goto out;
+        } else {
+                ret = sr_sw_reset(dev, SR_SWRESET_PRTE);
+                if (ret < 0)
+                        goto out;
+        }
+
+        msleep(150);
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after software reset\n", rx_ctl);
+        ret = sr_write_rx_ctl(dev, 0x0000);
+        if (ret < 0)
+                goto out;
+
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x setting to 0x0000\n", rx_ctl);
+
+        ret = sr_sw_reset(dev, SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+
+        msleep(150);
+
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL | SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+
+        msleep(150);
+
+        ret = sr9800_set_default_mode(dev);
+        if (ret < 0)
+                goto out;
+
+        /* Rewrite MAC address */
+        memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
+                                                        data->mac_addr);
+        if (ret < 0)
+                goto out;
+
+        return 0;
+
+out:
+        return ret;
+}
+
+static const struct net_device_ops sr9800_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = usbnet_change_mtu,
+        .ndo_set_mac_address    = sr_set_mac_address,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = sr_ioctl,
+        .ndo_set_rx_mode        = sr_set_multicast,
+};
+
+static int sr9800_phy_powerup(struct usbnet *dev)
+{
+        int ret;
+
+        /* set the embedded Ethernet PHY in power-down state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPPD | SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to power down PHY : %d\n", ret);
+                return ret;
+        }
+        msleep(20);
+
+        /* set the embedded Ethernet PHY in power-up state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to reset PHY: %d\n", ret);
+                return ret;
+        }
+        msleep(600);
+
+        /* set the embedded Ethernet PHY in reset state */
+        ret = sr_sw_reset(dev, SR_SWRESET_CLEAR);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to power up PHY: %d\n", ret);
+                return ret;
+        }
+        msleep(20);
+
+        /* set the embedded Ethernet PHY in power-up state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to reset PHY: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        u16 led01_mux, led23_mux;
+        int ret, embd_phy;
+        u32 phyid;
+        u16 rx_ctl;
+
+        data->eeprom_len = SR9800_EEPROM_LEN;
+
+        usbnet_get_endpoints(dev, intf);
+
+        /* LED Setting Rule :
+         * AABB:CCDD
+         * AA : MFA0(LED0)
+         * BB : MFA1(LED1)
+         * CC : MFA2(LED2), Reserved for SR9800
+         * DD : MFA3(LED3), Reserved for SR9800
+         */
+        led01_mux = (SR_LED_MUX_LINK_ACTIVE << 8) | SR_LED_MUX_LINK;
+        led23_mux = (SR_LED_MUX_LINK_ACTIVE << 8) | SR_LED_MUX_TX_ACTIVE;
+        ret = sr_write_cmd(dev, SR_CMD_LED_MUX, led01_mux, led23_mux, 0, NULL);
+        if (ret < 0) {
+                        netdev_err(dev->net, "set LINK LED failed : %d\n", ret);
+                        goto out;
+        }
+
+        /* Get the MAC address */
+        ret = sr_read_cmd(dev, SR_CMD_READ_NODE_ID, 0, 0, ETH_ALEN,
+                          dev->net->dev_addr);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Failed to read MAC address: %d\n", ret);
+                return ret;
+        }
+        netdev_dbg(dev->net, "mac addr : %pM\n", dev->net->dev_addr);
+
+        /* Initialize MII structure */
+        dev->mii.dev = dev->net;
+        dev->mii.mdio_read = sr_mdio_read;
+        dev->mii.mdio_write = sr_mdio_write;
+        dev->mii.phy_id_mask = 0x1f;
+        dev->mii.reg_num_mask = 0x1f;
+        dev->mii.phy_id = sr_get_phy_addr(dev);
+
+        dev->net->netdev_ops = &sr9800_netdev_ops;
+        dev->net->ethtool_ops = &sr9800_ethtool_ops;
+
+        embd_phy = ((dev->mii.phy_id & 0x1f) == 0x10 ? 1 : 0);
+        /* Reset the PHY to normal operation mode */
+        ret = sr_write_cmd(dev, SR_CMD_SW_PHY_SELECT, embd_phy, 0, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
+                return ret;
+        }
+
+        /* Init PHY routine */
+        ret = sr9800_phy_powerup(dev);
+        if (ret < 0)
+                goto out;
+
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after software reset\n", rx_ctl);
+        ret = sr_write_rx_ctl(dev, 0x0000);
+        if (ret < 0)
+                goto out;
+
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x setting to 0x0000\n", rx_ctl);
+
+        /* Read PHYID register *AFTER* the PHY was reset properly */
+        phyid = sr_get_phyid(dev);
+        netdev_dbg(dev->net, "PHYID=0x%08x\n", phyid);
+
+        /* medium mode setting */
+        ret = sr9800_set_default_mode(dev);
+        if (ret < 0)
+                goto out;
+
+        if (dev->udev->speed == USB_SPEED_HIGH) {
+                ret = sr_write_cmd(dev, SR_CMD_BULKIN_SIZE,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].byte_cnt,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].threshold,
+                        0, NULL);
+                if (ret < 0) {
+                        netdev_err(dev->net, "Reset RX_CTL failed: %d\n", ret);
+                        goto out;
+                }
+                dev->rx_urb_size =
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].size;
+        } else {
+                ret = sr_write_cmd(dev, SR_CMD_BULKIN_SIZE,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].byte_cnt,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].threshold,
+                        0, NULL);
+                if (ret < 0) {
+                        netdev_err(dev->net, "Reset RX_CTL failed: %d\n", ret);
+                        goto out;
+                }
+                dev->rx_urb_size =
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].size;
+        }
+        netdev_dbg(dev->net, "%s : setting rx_urb_size with : %zu\n", __func__,
+                   dev->rx_urb_size);
+        return 0;
+
+out:
+        return ret;
+}
+
+static const struct driver_info sr9800_driver_info = {
+        .description    = "CoreChip SR9800 USB 2.0 Ethernet",
+        .bind           = sr9800_bind,
+        .status         = sr_status,
+        .link_reset     = sr9800_link_reset,
+        .reset          = sr9800_reset,
+        .flags          = DRIVER_FLAG,
+        .rx_fixup       = sr_rx_fixup,
+        .tx_fixup       = sr_tx_fixup,
+};
+
+static const struct usb_device_id       products[] = {
+        {
+                USB_DEVICE(0x0fe6, 0x9800),     /* SR9800 Device  */
+                .driver_info = (unsigned long) &sr9800_driver_info,
+        },
+        {},             /* END */
+};
+
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver sr_driver = {
+        .name           = DRIVER_NAME,
+        .id_table       = products,
+        .probe          = usbnet_probe,
+        .suspend        = usbnet_suspend,
+        .resume         = usbnet_resume,
+        .disconnect     = usbnet_disconnect,
+        .supports_autosuspend = 1,
+};
+
+module_usb_driver(sr_driver);
+
+MODULE_AUTHOR("Liu Junliang <liujunliang_ljl@163.com");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_DESCRIPTION("SR9800 USB 2.0 USB2NET Dev : http://www.corechip-sz.com");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/sr9800.h b/drivers/net/usb/sr9800.h
new file mode 100644
index 000000000000..18f670251275
--- /dev/null
+++ b/drivers/net/usb/sr9800.h
@@ -0,0 +1,202 @@
+/* CoreChip-sz SR9800 one chip USB 2.0 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#ifndef _SR9800_H
+#define _SR9800_H
+
+/* SR9800 spec. command table on Linux Platform */
+
+/* command : Software Station Management Control Reg */
+#define SR_CMD_SET_SW_MII               0x06
+/* command : PHY Read Reg */
+#define SR_CMD_READ_MII_REG             0x07
+/* command : PHY Write Reg */
+#define SR_CMD_WRITE_MII_REG            0x08
+/* command : Hardware Station Management Control Reg */
+#define SR_CMD_SET_HW_MII               0x0a
+/* command : SROM Read Reg */
+#define SR_CMD_READ_EEPROM              0x0b
+/* command : SROM Write Reg */
+#define SR_CMD_WRITE_EEPROM             0x0c
+/* command : SROM Write Enable Reg */
+#define SR_CMD_WRITE_ENABLE             0x0d
+/* command : SROM Write Disable Reg */
+#define SR_CMD_WRITE_DISABLE            0x0e
+/* command : RX Control Read Reg */
+#define SR_CMD_READ_RX_CTL              0x0f
+#define         SR_RX_CTL_PRO                   (1 << 0)
+#define         SR_RX_CTL_AMALL                 (1 << 1)
+#define         SR_RX_CTL_SEP                   (1 << 2)
+#define         SR_RX_CTL_AB                    (1 << 3)
+#define         SR_RX_CTL_AM                    (1 << 4)
+#define         SR_RX_CTL_AP                    (1 << 5)
+#define         SR_RX_CTL_ARP                   (1 << 6)
+#define         SR_RX_CTL_SO                    (1 << 7)
+#define         SR_RX_CTL_RH1M                  (1 << 8)
+#define         SR_RX_CTL_RH2M                  (1 << 9)
+#define         SR_RX_CTL_RH3M                  (1 << 10)
+/* command : RX Control Write Reg */
+#define SR_CMD_WRITE_RX_CTL             0x10
+/* command : IPG0/IPG1/IPG2 Control Read Reg */
+#define SR_CMD_READ_IPG012              0x11
+/* command : IPG0/IPG1/IPG2 Control Write Reg */
+#define SR_CMD_WRITE_IPG012             0x12
+/* command : Node ID Read Reg */
+#define SR_CMD_READ_NODE_ID             0x13
+/* command : Node ID Write Reg */
+#define SR_CMD_WRITE_NODE_ID            0x14
+/* command : Multicast Filter Array Read Reg */
+#define SR_CMD_READ_MULTI_FILTER        0x15
+/* command : Multicast Filter Array Write Reg */
+#define SR_CMD_WRITE_MULTI_FILTER       0x16
+/* command : Eth/HomePNA PHY Address Reg */
+#define SR_CMD_READ_PHY_ID              0x19
+/* command : Medium Status Read Reg */
+#define SR_CMD_READ_MEDIUM_STATUS       0x1a
+#define         SR_MONITOR_LINK                 (1 << 1)
+#define         SR_MONITOR_MAGIC                (1 << 2)
+#define         SR_MONITOR_HSFS                 (1 << 4)
+/* command : Medium Status Write Reg */
+#define SR_CMD_WRITE_MEDIUM_MODE        0x1b
+#define         SR_MEDIUM_GM                    (1 << 0)
+#define         SR_MEDIUM_FD                    (1 << 1)
+#define         SR_MEDIUM_AC                    (1 << 2)
+#define         SR_MEDIUM_ENCK                  (1 << 3)
+#define         SR_MEDIUM_RFC                   (1 << 4)
+#define         SR_MEDIUM_TFC                   (1 << 5)
+#define         SR_MEDIUM_JFE                   (1 << 6)
+#define         SR_MEDIUM_PF                    (1 << 7)
+#define         SR_MEDIUM_RE                    (1 << 8)
+#define         SR_MEDIUM_PS                    (1 << 9)
+#define         SR_MEDIUM_RSV                   (1 << 10)
+#define         SR_MEDIUM_SBP                   (1 << 11)
+#define         SR_MEDIUM_SM                    (1 << 12)
+/* command : Monitor Mode Status Read Reg */
+#define SR_CMD_READ_MONITOR_MODE        0x1c
+/* command : Monitor Mode Status Write Reg */
+#define SR_CMD_WRITE_MONITOR_MODE       0x1d
+/* command : GPIO Status Read Reg */
+#define SR_CMD_READ_GPIOS               0x1e
+#define         SR_GPIO_GPO0EN          (1 << 0) /* GPIO0 Output enable */
+#define         SR_GPIO_GPO_0           (1 << 1) /* GPIO0 Output value */
+#define         SR_GPIO_GPO1EN          (1 << 2) /* GPIO1 Output enable */
+#define         SR_GPIO_GPO_1           (1 << 3) /* GPIO1 Output value */
+#define         SR_GPIO_GPO2EN          (1 << 4) /* GPIO2 Output enable */
+#define         SR_GPIO_GPO_2           (1 << 5) /* GPIO2 Output value */
+#define         SR_GPIO_RESERVED        (1 << 6) /* Reserved */
+#define         SR_GPIO_RSE             (1 << 7) /* Reload serial EEPROM */
+/* command : GPIO Status Write Reg */
+#define SR_CMD_WRITE_GPIOS              0x1f
+/* command : Eth PHY Power and Reset Control Reg */
+#define SR_CMD_SW_RESET                 0x20
+#define         SR_SWRESET_CLEAR                0x00
+#define         SR_SWRESET_RR                   (1 << 0)
+#define         SR_SWRESET_RT                   (1 << 1)
+#define         SR_SWRESET_PRTE                 (1 << 2)
+#define         SR_SWRESET_PRL                  (1 << 3)
+#define         SR_SWRESET_BZ                   (1 << 4)
+#define         SR_SWRESET_IPRL                 (1 << 5)
+#define         SR_SWRESET_IPPD                 (1 << 6)
+/* command : Software Interface Selection Status Read Reg */
+#define SR_CMD_SW_PHY_STATUS            0x21
+/* command : Software Interface Selection Status Write Reg */
+#define SR_CMD_SW_PHY_SELECT            0x22
+/* command : BULK in Buffer Size Reg */
+#define SR_CMD_BULKIN_SIZE              0x2A
+/* command : LED_MUX Control Reg */
+#define SR_CMD_LED_MUX                  0x70
+#define         SR_LED_MUX_TX_ACTIVE            (1 << 0)
+#define         SR_LED_MUX_RX_ACTIVE            (1 << 1)
+#define         SR_LED_MUX_COLLISION            (1 << 2)
+#define         SR_LED_MUX_DUP_COL              (1 << 3)
+#define         SR_LED_MUX_DUP                  (1 << 4)
+#define         SR_LED_MUX_SPEED                (1 << 5)
+#define         SR_LED_MUX_LINK_ACTIVE          (1 << 6)
+#define         SR_LED_MUX_LINK                 (1 << 7)
+
+/* Register Access Flags */
+#define SR_REQ_RD_REG   (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+#define SR_REQ_WR_REG   (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+
+/* Multicast Filter Array size & Max Number */
+#define SR_MCAST_FILTER_SIZE            8
+#define SR_MAX_MCAST                    64
+
+/* IPG0/1/2 Default Value */
+#define SR9800_IPG0_DEFAULT             0x15
+#define SR9800_IPG1_DEFAULT             0x0c
+#define SR9800_IPG2_DEFAULT             0x12
+
+/* Medium Status Default Mode */
+#define SR9800_MEDIUM_DEFAULT   \
+        (SR_MEDIUM_FD | SR_MEDIUM_RFC | \
+         SR_MEDIUM_TFC | SR_MEDIUM_PS | \
+         SR_MEDIUM_AC | SR_MEDIUM_RE)
+
+/* RX Control Default Setting */
+#define SR_DEFAULT_RX_CTL       \
+        (SR_RX_CTL_SO | SR_RX_CTL_AB | SR_RX_CTL_RH1M)
+
+/* EEPROM Magic Number & EEPROM Size */
+#define SR_EEPROM_MAGIC                 0xdeadbeef
+#define SR9800_EEPROM_LEN               0xff
+
+/* SR9800 Driver Version and Driver Name */
+#define DRIVER_VERSION                  "11-Nov-2013"
+#define DRIVER_NAME                     "CoreChips"
+#define DRIVER_FLAG             \
+        (FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |  FLAG_MULTI_PACKET)
+
+/* SR9800 BULKIN Buffer Size */
+#define SR9800_MAX_BULKIN_2K            0
+#define SR9800_MAX_BULKIN_4K            1
+#define SR9800_MAX_BULKIN_6K            2
+#define SR9800_MAX_BULKIN_8K            3
+#define SR9800_MAX_BULKIN_16K           4
+#define SR9800_MAX_BULKIN_20K           5
+#define SR9800_MAX_BULKIN_24K           6
+#define SR9800_MAX_BULKIN_32K           7
+
+struct {unsigned short size, byte_cnt, threshold; } SR9800_BULKIN_SIZE[] = {
+        /* 2k */
+        {2048, 0x8000, 0x8001},
+        /* 4k */
+        {4096, 0x8100, 0x8147},
+        /* 6k */
+        {6144, 0x8200, 0x81EB},
+        /* 8k */
+        {8192, 0x8300, 0x83D7},
+        /* 16 */
+        {16384, 0x8400, 0x851E},
+        /* 20k */
+        {20480, 0x8500, 0x8666},
+        /* 24k */
+        {24576, 0x8600, 0x87AE},
+        /* 32k */
+        {32768, 0x8700, 0x8A3D},
+};
+
+/* This structure cannot exceed sizeof(unsigned long [5]) AKA 20 bytes */
+struct sr_data {
+        u8 multi_filter[SR_MCAST_FILTER_SIZE];
+        u8 mac_addr[ETH_ALEN];
+        u8 phymode;
+        u8 ledmode;
+        u8 eeprom_len;
+};
+
+struct sr9800_int_data {
+        __le16 res1;
+        u8 link;
+        __le16 res2;
+        u8 status;
+        __le16 res3;
+} __packed;
+
+#endif  /* _SR9800_H */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 4671da755e7b..dd10d5817d2a 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -542,17 +542,19 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
         }
         // else network stack removes extra byte if we forced a short packet
 
-        if (skb->len) {
-                /* all data was already cloned from skb inside the driver */
-                if (dev->driver_info->flags & FLAG_MULTI_PACKET)
-                        dev_kfree_skb_any(skb);
-                else
-                        usbnet_skb_return(dev, skb);
+        /* all data was already cloned from skb inside the driver */
+        if (dev->driver_info->flags & FLAG_MULTI_PACKET)
+                goto done;
+
+        if (skb->len < ETH_HLEN) {
+                dev->net->stats.rx_errors++;
+                dev->net->stats.rx_length_errors++;
+                netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len);
+        } else {
+                usbnet_skb_return(dev, skb);
                 return;
         }
 
-        netif_dbg(dev, rx_err, dev->net, "drop\n");
-        dev->net->stats.rx_errors++;
 done:
         skb_queue_tail(&dev->done, skb);
 }
@@ -574,13 +576,6 @@ static void rx_complete (struct urb *urb)
         switch (urb_status) {
         /* success */
         case 0:
-                if (skb->len < dev->net->hard_header_len) {
-                        state = rx_cleanup;
-                        dev->net->stats.rx_errors++;
-                        dev->net->stats.rx_length_errors++;
-                        netif_dbg(dev, rx_err, dev->net,
-                                  "rx length %d\n", skb->len);
-                }
                 break;
 
         /* stalls need manual reset. this is rare ... except that
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 026a313c2d2d..b0f705c2378f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -469,7 +469,6 @@ static inline struct hlist_head *vxlan_fdb_head(struct vxlan_dev *vxlan,
 /* Look up Ethernet address in forwarding table */
 static struct vxlan_fdb *__vxlan_find_mac(struct vxlan_dev *vxlan,
                                         const u8 *mac)
-
 {
         struct hlist_head *head = vxlan_fdb_head(vxlan, mac);
         struct vxlan_fdb *f;
@@ -596,10 +595,8 @@ static struct sk_buff **vxlan_gro_receive(struct sk_buff **head, struct sk_buff
                         NAPI_GRO_CB(p)->same_flow = 0;
                         continue;
                 }
-                goto found;
         }
 
-found:
         type = eh->h_proto;
 
         rcu_read_lock();
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 0d1c7592efa0..19f7cb2cdef3 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -71,12 +71,9 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
                        const void *saddr, unsigned len)
 {
         struct frhdr            hdr;
-        struct dlci_local       *dlp;
         unsigned int            hlen;
         char                    *dest;
 
-        dlp = netdev_priv(dev);
-
         hdr.control = FRAD_I_UI;
         switch (type)
         {
@@ -107,11 +104,9 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
 
 static void dlci_receive(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dlci_local *dlp;
         struct frhdr            *hdr;
         int                                     process, header;
 
-        dlp = netdev_priv(dev);
         if (!pskb_may_pull(skb, sizeof(*hdr))) {
                 netdev_notice(dev, "invalid data no header\n");
                 dev->stats.rx_errors++;
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 8aa20df55e50..507d9a9ee69a 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1764,7 +1764,7 @@ static struct usb_device_id ar5523_id_table[] = {
         AR5523_DEVICE_UG(0x07d1, 0x3a07),       /* D-Link / WUA-2340 rev A1 */
         AR5523_DEVICE_UG(0x1690, 0x0712),       /* Gigaset / AR5523 */
         AR5523_DEVICE_UG(0x1690, 0x0710),       /* Gigaset / SMCWUSBTG */
-        AR5523_DEVICE_UG(0x129b, 0x160c),       /* Gigaset / USB stick 108
+        AR5523_DEVICE_UG(0x129b, 0x160b),       /* Gigaset / USB stick 108
                                                    (CyberTAN Technology) */
         AR5523_DEVICE_UG(0x16ab, 0x7801),       /* Globalsun / AR5523_1 */
         AR5523_DEVICE_UX(0x16ab, 0x7811),       /* Globalsun / AR5523_2 */
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index d6bc7cb61bfb..1a2973b7acf2 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -110,7 +110,7 @@ ath5k_hw_radio_revision(struct ath5k_hw *ah, enum ieee80211_band band)
                 ath5k_hw_reg_write(ah, 0x00010000, AR5K_PHY(0x20));
 
         if (ah->ah_version == AR5K_AR5210) {
-                srev = ath5k_hw_reg_read(ah, AR5K_PHY(256) >> 28) & 0xf;
+                srev = (ath5k_hw_reg_read(ah, AR5K_PHY(256)) >> 28) & 0xf;
                 ret = (u16)ath5k_hw_bitswap(srev, 4) + 1;
         } else {
                 srev = (ath5k_hw_reg_read(ah, AR5K_PHY(0x100)) >> 24) & 0xff;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 25243cbc07f0..b8daff78b9d1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -5065,6 +5065,10 @@ static u16 ar9003_hw_get_max_edge_power(struct ar9300_eeprom *eep,
                         break;
                 }
         }
+
+        if (is2GHz && !twiceMaxEdgePower)
+                twiceMaxEdgePower = 60;
+
         return twiceMaxEdgePower;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 58da3468d1f0..99a203174f45 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -262,6 +262,8 @@ enum tid_aggr_state {
 struct ath9k_htc_sta {
         u8 index;
         enum tid_aggr_state tid_state[ATH9K_HTC_MAX_TID];
+        struct work_struct rc_update_work;
+        struct ath9k_htc_priv *htc_priv;
 };
 
 #define ATH9K_HTC_RXBUF 256
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index f4e1de20d99c..c57d6b859c04 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -34,6 +34,10 @@ static int ath9k_htc_btcoex_enable;
 module_param_named(btcoex_enable, ath9k_htc_btcoex_enable, int, 0444);
 MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
 
+static int ath9k_ps_enable;
+module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
+MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
+
 #define CHAN2G(_freq, _idx)  { \
         .center_freq = (_freq), \
         .hw_value = (_idx), \
@@ -725,12 +729,14 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_HAS_RATE_CONTROL |
                 IEEE80211_HW_RX_INCLUDES_FCS |
-                IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_PS_NULLFUNC_STACK |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_MFP_CAPABLE |
                 IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING;
 
+        if (ath9k_ps_enable)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS;
+
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC) |
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 608d739d1378..c9254a61ca52 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1270,18 +1270,50 @@ static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
         mutex_unlock(&priv->mutex);
 }
 
+static void ath9k_htc_sta_rc_update_work(struct work_struct *work)
+{
+        struct ath9k_htc_sta *ista =
+            container_of(work, struct ath9k_htc_sta, rc_update_work);
+        struct ieee80211_sta *sta =
+            container_of((void *)ista, struct ieee80211_sta, drv_priv);
+        struct ath9k_htc_priv *priv = ista->htc_priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_rate trate;
+
+        mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
+
+        memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+        ath9k_htc_setup_rate(priv, sta, &trate);
+        if (!ath9k_htc_send_rate_cmd(priv, &trate))
+                ath_dbg(common, CONFIG,
+                        "Supported rates for sta: %pM updated, rate caps: 0x%X\n",
+                        sta->addr, be32_to_cpu(trate.capflags));
+        else
+                ath_dbg(common, CONFIG,
+                        "Unable to update supported rates for sta: %pM\n",
+                        sta->addr);
+
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+}
+
 static int ath9k_htc_sta_add(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif,
                              struct ieee80211_sta *sta)
 {
         struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
         int ret;
 
         mutex_lock(&priv->mutex);
         ath9k_htc_ps_wakeup(priv);
         ret = ath9k_htc_add_station(priv, vif, sta);
-        if (!ret)
+        if (!ret) {
+                INIT_WORK(&ista->rc_update_work, ath9k_htc_sta_rc_update_work);
+                ista->htc_priv = priv;
                 ath9k_htc_init_rate(priv, sta);
+        }
         ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 
@@ -1293,12 +1325,13 @@ static int ath9k_htc_sta_remove(struct ieee80211_hw *hw,
                                 struct ieee80211_sta *sta)
 {
         struct ath9k_htc_priv *priv = hw->priv;
-        struct ath9k_htc_sta *ista;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
         int ret;
 
+        cancel_work_sync(&ista->rc_update_work);
+
         mutex_lock(&priv->mutex);
         ath9k_htc_ps_wakeup(priv);
-        ista = (struct ath9k_htc_sta *) sta->drv_priv;
         htc_sta_drain(priv->htc, ista->index);
         ret = ath9k_htc_remove_station(priv, vif, sta);
         ath9k_htc_ps_restore(priv);
@@ -1311,28 +1344,12 @@ static void ath9k_htc_sta_rc_update(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     struct ieee80211_sta *sta, u32 changed)
 {
-        struct ath9k_htc_priv *priv = hw->priv;
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct ath9k_htc_target_rate trate;
-
-        mutex_lock(&priv->mutex);
-        ath9k_htc_ps_wakeup(priv);
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
 
-        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
-                memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
-                ath9k_htc_setup_rate(priv, sta, &trate);
-                if (!ath9k_htc_send_rate_cmd(priv, &trate))
-                        ath_dbg(common, CONFIG,
-                                "Supported rates for sta: %pM updated, rate caps: 0x%X\n",
-                                sta->addr, be32_to_cpu(trate.capflags));
-                else
-                        ath_dbg(common, CONFIG,
-                                "Unable to update supported rates for sta: %pM\n",
-                                sta->addr);
-        }
+        if (!(changed & IEEE80211_RC_SUPP_RATES_CHANGED))
+                return;
 
-        ath9k_htc_ps_restore(priv);
-        mutex_unlock(&priv->mutex);
+        schedule_work(&ista->rc_update_work);
 }
 
 static int ath9k_htc_conf_tx(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index fbf43c05713f..11eab9f01fd8 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1316,7 +1316,7 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
         if (AR_SREV_9300_20_OR_LATER(ah))
                 udelay(50);
         else if (AR_SREV_9100(ah))
-                udelay(10000);
+                mdelay(10);
         else
                 udelay(100);
 
@@ -2051,9 +2051,8 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah)
 
         REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
                     AR_RTC_FORCE_WAKE_EN);
-
         if (AR_SREV_9100(ah))
-                udelay(10000);
+                mdelay(10);
         else
                 udelay(50);
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index c36de303c8f3..1fc2e5a26b52 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -57,6 +57,10 @@ static int ath9k_bt_ant_diversity;
 module_param_named(bt_ant_diversity, ath9k_bt_ant_diversity, int, 0444);
 MODULE_PARM_DESC(bt_ant_diversity, "Enable WLAN/BT RX antenna diversity");
 
+static int ath9k_ps_enable;
+module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
+MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
+
 bool is_ath9k_unloaded;
 /* We use the hw_value as an index into our private channel structure */
 
@@ -903,13 +907,15 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
                 IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                 IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_PS_NULLFUNC_STACK |
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_SUPPORTS_RC_TABLE |
                 IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
+        if (ath9k_ps_enable)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS;
+
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
 
diff --git a/drivers/net/wireless/hostap/hostap_proc.c b/drivers/net/wireless/hostap/hostap_proc.c
index aa7ad3a7a69b..4e5c0f8c9496 100644
--- a/drivers/net/wireless/hostap/hostap_proc.c
+++ b/drivers/net/wireless/hostap/hostap_proc.c
@@ -496,7 +496,7 @@ void hostap_init_proc(local_info_t *local)
 
 void hostap_remove_proc(local_info_t *local)
 {
-        remove_proc_subtree(local->ddev->name, hostap_proc);
+        proc_remove(local->proc);
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index c24d1d3d55f6..73086c1629ca 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -696,6 +696,24 @@ static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         return ret;
 }
 
+static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                return false;
+        return true;
+}
+
+static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                return false;
+        if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
+                return true;
+
+        /* disabled by default */
+        return false;
+}
+
 static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif,
                                    enum ieee80211_ampdu_mlme_action action,
@@ -717,7 +735,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
 
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                if (!iwl_enable_rx_ampdu(priv->cfg))
                         break;
                 IWL_DEBUG_HT(priv, "start Rx\n");
                 ret = iwl_sta_rx_agg_start(priv, sta, tid, *ssn);
@@ -729,7 +747,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_TX_START:
                 if (!priv->trans->ops->txq_enable)
                         break;
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                if (!iwl_enable_tx_ampdu(priv->cfg))
                         break;
                 IWL_DEBUG_HT(priv, "start Tx\n");
                 ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index c3728163be46..75103554cd63 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1286,7 +1286,7 @@ module_param_named(swcrypto, iwlwifi_mod_params.sw_crypto, int, S_IRUGO);
 MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
 module_param_named(11n_disable, iwlwifi_mod_params.disable_11n, uint, S_IRUGO);
 MODULE_PARM_DESC(11n_disable,
-        "disable 11n functionality, bitmap: 1: full, 2: agg TX, 4: agg RX");
+        "disable 11n functionality, bitmap: 1: full, 2: disable agg TX, 4: disable agg RX, 8 enable agg TX");
 module_param_named(amsdu_size_8K, iwlwifi_mod_params.amsdu_size_8K,
                    int, S_IRUGO);
 MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0)");
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index 0a84ade7edac..b29075c3da8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -79,9 +79,12 @@ enum iwl_power_level {
         IWL_POWER_NUM
 };
 
-#define IWL_DISABLE_HT_ALL      BIT(0)
-#define IWL_DISABLE_HT_TXAGG    BIT(1)
-#define IWL_DISABLE_HT_RXAGG    BIT(2)
+enum iwl_disable_11n {
+        IWL_DISABLE_HT_ALL       = BIT(0),
+        IWL_DISABLE_HT_TXAGG     = BIT(1),
+        IWL_DISABLE_HT_RXAGG     = BIT(2),
+        IWL_ENABLE_HT_TXAGG      = BIT(3),
+};
 
 /**
  * struct iwl_mod_params
@@ -90,7 +93,7 @@ enum iwl_power_level {
  *
  * @sw_crypto: using hardware encryption, default = 0
  * @disable_11n: disable 11n capabilities, default = 0,
- *      use IWL_DISABLE_HT_* constants
+ *      use IWL_[DIS,EN]ABLE_HT_* constants
  * @amsdu_size_8K: enable 8K amsdu size, default = 0
  * @restart_fw: restart firmware, default = 1
  * @wd_disable: enable stuck queue check, default = 0
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index f06f4cbe1317..725e954d8475 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -182,6 +182,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
 
         for (ch_idx = 0; ch_idx < IWL_NUM_CHANNELS; ch_idx++) {
                 ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx);
+
+                if (ch_idx >= NUM_2GHZ_CHANNELS &&
+                    !data->sku_cap_band_52GHz_enable)
+                        ch_flags &= ~NVM_CHANNEL_VALID;
+
                 if (!(ch_flags & NVM_CHANNEL_VALID)) {
                         IWL_DEBUG_EEPROM(dev,
                                          "Ch. %d Flags %x [%sGHz] - No traffic\n",
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 73cbba7424f2..9426905de6b2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -504,6 +504,7 @@ struct iwl_scan_offload_profile {
  * @match_notify:       clients waiting for match found notification
  * @pass_match:         clients waiting for the results
  * @active_clients:     active clients bitmap - enum scan_framework_client
+ * @any_beacon_notify:  clients waiting for match notification without match
  */
 struct iwl_scan_offload_profile_cfg {
         struct iwl_scan_offload_profile profiles[IWL_SCAN_MAX_PROFILES];
@@ -512,7 +513,8 @@ struct iwl_scan_offload_profile_cfg {
         u8 match_notify;
         u8 pass_match;
         u8 active_clients;
-        u8 reserved[3];
+        u8 any_beacon_notify;
+        u8 reserved[2];
 } __packed;
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c49b5073c251..c35b8661b395 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -246,7 +246,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         else
                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
+        if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
                 hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
                 hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
@@ -328,6 +328,24 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
         ieee80211_free_txskb(hw, skb);
 }
 
+static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                return false;
+        return true;
+}
+
+static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                return false;
+        if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
+                return true;
+
+        /* enabled by default */
+        return true;
+}
+
 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     enum ieee80211_ampdu_mlme_action action,
@@ -347,7 +365,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) {
+                if (!iwl_enable_rx_ampdu(mvm->cfg)) {
                         ret = -EINVAL;
                         break;
                 }
@@ -357,7 +375,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false);
                 break;
         case IEEE80211_AMPDU_TX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) {
+                if (!iwl_enable_tx_ampdu(mvm->cfg)) {
                         ret = -EINVAL;
                         break;
                 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 0e0007960612..742afc429c94 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -344,7 +344,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
 
         iwl_mvm_scan_fill_ssids(cmd, req, basic_ssid ? 1 : 0);
 
-        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL);
+        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
+                                           TX_CMD_FLG_BT_DIS);
         cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
         cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
         cmd->tx_cmd.rate_n_flags =
@@ -807,6 +808,8 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
         profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
         profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
         profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
+        if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
+                profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 
         for (i = 0; i < req->n_match_sets; i++) {
                 profile = &profile_cfg->profiles[i];
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index ec1812133235..3397f59cd4e4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -652,7 +652,7 @@ int iwl_mvm_send_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         static const u8 _baddr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
-        static const u8 *baddr = _baddr;
+        const u8 *baddr = _baddr;
 
         lockdep_assert_held(&mvm->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 90378c217bc7..4df12fa9d336 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -659,8 +659,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         rcu_read_lock();
 
         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+        /*
+         * sta can't be NULL otherwise it'd mean that the sta has been freed in
+         * the firmware while we still have packets for it in the Tx queues.
+         */
+        if (WARN_ON_ONCE(!sta))
+                goto out;
 
-        if (!IS_ERR_OR_NULL(sta)) {
+        if (!IS_ERR(sta)) {
                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
                 if (tid != IWL_TID_NON_QOS) {
@@ -675,7 +681,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         spin_unlock_bh(&mvmsta->lock);
                 }
         } else {
-                sta = NULL;
                 mvmsta = NULL;
         }
 
@@ -683,42 +688,38 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
          * If the txq is not an AMPDU queue, there is no chance we freed
          * several skbs. Check that out...
          */
-        if (txq_id < mvm->first_agg_queue && !WARN_ON(skb_freed > 1) &&
-            atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id])) {
-                if (mvmsta) {
-                        /*
-                         * If there are no pending frames for this STA, notify
-                         * mac80211 that this station can go to sleep in its
-                         * STA table.
-                         */
-                        if (mvmsta->vif->type == NL80211_IFTYPE_AP)
-                                ieee80211_sta_block_awake(mvm->hw, sta, false);
-                        /*
-                         * We might very well have taken mvmsta pointer while
-                         * the station was being removed. The remove flow might
-                         * have seen a pending_frame (because we didn't take
-                         * the lock) even if now the queues are drained. So make
-                         * really sure now that this the station is not being
-                         * removed. If it is, run the drain worker to remove it.
-                         */
-                        spin_lock_bh(&mvmsta->lock);
-                        sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
-                        if (!sta || PTR_ERR(sta) == -EBUSY) {
-                                /*
-                                 * Station disappeared in the meantime:
-                                 * so we are draining.
-                                 */
-                                set_bit(sta_id, mvm->sta_drained);
-                                schedule_work(&mvm->sta_drained_wk);
-                        }
-                        spin_unlock_bh(&mvmsta->lock);
-                } else if (!mvmsta && PTR_ERR(sta) == -EBUSY) {
-                        /* Tx response without STA, so we are draining */
-                        set_bit(sta_id, mvm->sta_drained);
-                        schedule_work(&mvm->sta_drained_wk);
-                }
+        if (txq_id >= mvm->first_agg_queue)
+                goto out;
+
+        /* We can't free more than one frame at once on a shared queue */
+        WARN_ON(skb_freed > 1);
+
+        /* If we have still frames from this STA nothing to do here */
+        if (!atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id]))
+                goto out;
+
+        if (mvmsta && mvmsta->vif->type == NL80211_IFTYPE_AP) {
+                /*
+                 * If there are no pending frames for this STA, notify
+                 * mac80211 that this station can go to sleep in its
+                 * STA table.
+                 * If mvmsta is not NULL, sta is valid.
+                 */
+                ieee80211_sta_block_awake(mvm->hw, sta, false);
+        }
+
+        if (PTR_ERR(sta) == -EBUSY || PTR_ERR(sta) == -ENOENT) {
+                /*
+                 * We are draining and this was the last packet - pre_rcu_remove
+                 * has been called already. We might be after the
+                 * synchronize_net already.
+                 * Don't rely on iwl_mvm_rm_sta to see the empty Tx queues.
+                 */
+                set_bit(sta_id, mvm->sta_drained);
+                schedule_work(&mvm->sta_drained_wk);
         }
 
+out:
         rcu_read_unlock();
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index a4a5e25623c3..86989df69356 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -411,6 +411,8 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                         mvm->status, table.valid);
         }
 
+        IWL_ERR(mvm, "Loaded firmware version: %s\n", mvm->fw->fw_version);
+
         trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low,
                                       table.data1, table.data2, table.data3,
                                       table.blink1, table.blink2, table.ilink1,
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 3040924f5f3c..f47bcbe2945a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -359,20 +359,25 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5112, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5100, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x510A, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2n_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 4d79761b9c87..9d3d2758ec35 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -748,7 +748,7 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 
 static u16
 mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
-                                void *accel_priv)
+                                void *accel_priv, select_queue_fallback_t fallback)
 {
         skb->priority = cfg80211_classify8021d(skb, NULL);
         return mwifiex_1d_to_wmm_queue[skb->priority];
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index abc5f56f29fe..2f1cd929c6f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1877,6 +1877,11 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                                                    EEPROM_MAC_ADDR_0));
 
         /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
          * Initialize hw_mode information.
          */
         spec->supported_bands = SUPPORT_BAND_2GHZ;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 9f16824cd1bc..d849d590de25 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1706,6 +1706,11 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK;
 
+        /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
         SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
                                 rt2x00_eeprom_addr(rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index b8f5b06006c4..7f8b5d156c8c 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -7458,10 +7458,9 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         u32 reg;
 
         /*
-         * Disable powersaving as default on PCI devices.
+         * Disable powersaving as default.
          */
-        if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
-                rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         /*
          * Initialize all hw fields.
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 8ec17aad0e52..3867d1470b36 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -107,6 +107,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
         struct rtl8180_priv *priv = dev->priv;
         unsigned int count = 32;
         u8 signal, agc, sq;
+        dma_addr_t mapping;
 
         while (count--) {
                 struct rtl8180_rx_desc *entry = &priv->rx_ring[priv->rx_idx];
@@ -128,6 +129,17 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                         if (unlikely(!new_skb))
                                 goto done;
 
+                        mapping = pci_map_single(priv->pdev,
+                                               skb_tail_pointer(new_skb),
+                                               MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
+
+                        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                                kfree_skb(new_skb);
+                                dev_err(&priv->pdev->dev, "RX DMA map error\n");
+
+                                goto done;
+                        }
+
                         pci_unmap_single(priv->pdev,
                                          *((dma_addr_t *)skb->cb),
                                          MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
@@ -158,9 +170,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 
                         skb = new_skb;
                         priv->rx_buf[priv->rx_idx] = skb;
-                        *((dma_addr_t *) skb->cb) =
-                                pci_map_single(priv->pdev, skb_tail_pointer(skb),
-                                               MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
+                        *((dma_addr_t *) skb->cb) = mapping;
                 }
 
         done:
@@ -266,6 +276,13 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
         mapping = pci_map_single(priv->pdev, skb->data,
                                  skb->len, PCI_DMA_TODEVICE);
 
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                kfree_skb(skb);
+                dev_err(&priv->pdev->dev, "TX DMA mapping error\n");
+                return;
+
+        }
+
         tx_flags = RTL818X_TX_DESC_FLAG_OWN | RTL818X_TX_DESC_FLAG_FS |
                    RTL818X_TX_DESC_FLAG_LS |
                    (ieee80211_get_tx_rate(dev, info)->hw_value << 24) |
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
index 56aee067f324..a6ad79f61bf9 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
@@ -15,6 +15,8 @@
 #ifndef RTL8187_H
 #define RTL8187_H
 
+#include <linux/cache.h>
+
 #include "rtl818x.h"
 #include "leds.h"
 
@@ -139,7 +141,10 @@ struct rtl8187_priv {
         u8 aifsn[4];
         u8 rfkill_mask;
         struct {
-                __le64 buf;
+                union {
+                        __le64 buf;
+                        u8 dummy1[L1_CACHE_BYTES];
+                } ____cacheline_aligned;
                 struct sk_buff_head queue;
         } b_tx_status; /* This queue is used by both -b and non-b devices */
         struct mutex io_mutex;
@@ -147,7 +152,8 @@ struct rtl8187_priv {
                 u8 bits8;
                 __le16 bits16;
                 __le32 bits32;
-        } *io_dmabuf;
+                u8 dummy2[L1_CACHE_BYTES];
+        } *io_dmabuf ____cacheline_aligned;
         bool rfkill_off;
         u16 seqno;
 };
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index deedae3c5449..d1c0191a195b 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -48,7 +48,7 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw)
 
         /*<2> Enable Adapter */
         if (rtlpriv->cfg->ops->hw_init(hw))
-                return 1;
+                return false;
         RT_CLEAR_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
 
         /*<3> Enable Interrupt */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index a82b30a1996c..2eb0b38384dd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -937,14 +937,26 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
         bool is92c;
         int err;
         u8 tmp_u1b;
+        unsigned long flags;
 
         rtlpci->being_init_adapter = true;
+
+        /* Since this function can take a very long time (up to 350 ms)
+         * and can be called with irqs disabled, reenable the irqs
+         * to let the other devices continue being serviced.
+         *
+         * It is safe doing so since our own interrupts will only be enabled
+         * in a subsequent step.
+         */
+        local_save_flags(flags);
+        local_irq_enable();
+
         rtlpriv->intf_ops->disable_aspm(hw);
         rtstatus = _rtl92ce_init_mac(hw);
         if (!rtstatus) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n");
                 err = 1;
-                return err;
+                goto exit;
         }
 
         err = rtl92c_download_fw(hw);
@@ -952,7 +964,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
                          "Failed to download FW. Init HW without FW now..\n");
                 err = 1;
-                return err;
+                goto exit;
         }
 
         rtlhal->last_hmeboxnum = 0;
@@ -1032,6 +1044,8 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "under 1.5V\n");
         }
         rtl92c_dm_init(hw);
+exit:
+        local_irq_restore(flags);
         rtlpci->being_init_adapter = false;
         return err;
 }
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4c76bcb9a879..ae413a2cbee7 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -143,11 +143,7 @@ struct xenvif {
         char rx_irq_name[IFNAMSIZ+4]; /* DEVNAME-rx */
         struct xen_netif_rx_back_ring rx;
         struct sk_buff_head rx_queue;
-        bool rx_queue_stopped;
-        /* Set when the RX interrupt is triggered by the frontend.
-         * The worker thread may need to wake the queue.
-         */
-        bool rx_event;
+        RING_IDX rx_last_skb_slots;
 
         /* This array is allocated seperately as it is large */
         struct gnttab_copy *grant_copy_op;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b9de31ea7fc4..7669d49a67e2 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -100,7 +100,6 @@ static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
 {
         struct xenvif *vif = dev_id;
 
-        vif->rx_event = true;
         xenvif_kick_thread(vif);
 
         return IRQ_HANDLED;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 6b62c3eb8e18..e5284bca2d90 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -476,7 +476,6 @@ static void xenvif_rx_action(struct xenvif *vif)
         unsigned long offset;
         struct skb_cb_overlay *sco;
         bool need_to_notify = false;
-        bool ring_full = false;
 
         struct netrx_pending_operations npo = {
                 .copy  = vif->grant_copy_op,
@@ -486,7 +485,7 @@ static void xenvif_rx_action(struct xenvif *vif)
         skb_queue_head_init(&rxq);
 
         while ((skb = skb_dequeue(&vif->rx_queue)) != NULL) {
-                int max_slots_needed;
+                RING_IDX max_slots_needed;
                 int i;
 
                 /* We need a cheap worse case estimate for the number of
@@ -509,9 +508,10 @@ static void xenvif_rx_action(struct xenvif *vif)
                 if (!xenvif_rx_ring_slots_available(vif, max_slots_needed)) {
                         skb_queue_head(&vif->rx_queue, skb);
                         need_to_notify = true;
-                        ring_full = true;
+                        vif->rx_last_skb_slots = max_slots_needed;
                         break;
-                }
+                } else
+                        vif->rx_last_skb_slots = 0;
 
                 sco = (struct skb_cb_overlay *)skb->cb;
                 sco->meta_slots_used = xenvif_gop_skb(skb, &npo);
@@ -522,8 +522,6 @@ static void xenvif_rx_action(struct xenvif *vif)
 
         BUG_ON(npo.meta_prod > ARRAY_SIZE(vif->meta));
 
-        vif->rx_queue_stopped = !npo.copy_prod && ring_full;
-
         if (!npo.copy_prod)
                 goto done;
 
@@ -1473,8 +1471,8 @@ static struct xen_netif_rx_response *make_rx_response(struct xenvif *vif,
 
 static inline int rx_work_todo(struct xenvif *vif)
 {
-        return (!skb_queue_empty(&vif->rx_queue) && !vif->rx_queue_stopped) ||
-                vif->rx_event;
+        return !skb_queue_empty(&vif->rx_queue) &&
+               xenvif_rx_ring_slots_available(vif, vif->rx_last_skb_slots);
 }
 
 static inline int tx_work_todo(struct xenvif *vif)
@@ -1560,8 +1558,6 @@ int xenvif_kthread(void *data)
                 if (!skb_queue_empty(&vif->rx_queue))
                         xenvif_rx_action(vif);
 
-                vif->rx_event = false;
-
                 if (skb_queue_empty(&vif->rx_queue) &&
                     netif_queue_stopped(vif->dev))
                         xenvif_start_queue(vif);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index ff04d4f95baa..f9daa9e183f2 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1832,7 +1832,6 @@ static void netback_changed(struct xenbus_device *dev,
         case XenbusStateReconfiguring:
         case XenbusStateReconfigured:
         case XenbusStateUnknown:
-        case XenbusStateClosed:
                 break;
 
         case XenbusStateInitWait:
@@ -1847,6 +1846,10 @@ static void netback_changed(struct xenbus_device *dev,
                 netdev_notify_peers(netdev);
                 break;
 
+        case XenbusStateClosed:
+                if (dev->state == XenbusStateClosed)
+                        break;
+                /* Missed the backend's CLOSING state -- fallthrough */
         case XenbusStateClosing:
                 xenbus_frontend_closed(dev);
                 break;
diff --git a/drivers/of/address.c b/drivers/of/address.c
index d3dd41c840f1..1a54f1ffaadb 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -99,11 +99,12 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr)
 static int of_bus_pci_match(struct device_node *np)
 {
         /*
+         * "pciex" is PCI Express
          * "vci" is for the /chaos bridge on 1st-gen PCI powermacs
          * "ht" is hypertransport
          */
-        return !strcmp(np->type, "pci") || !strcmp(np->type, "vci") ||
-                !strcmp(np->type, "ht");
+        return !strcmp(np->type, "pci") || !strcmp(np->type, "pciex") ||
+                !strcmp(np->type, "vci") || !strcmp(np->type, "ht");
 }
 
 static void of_bus_pci_count_cells(struct device_node *np,
diff --git a/drivers/of/base.c b/drivers/of/base.c
index ff85450d5683..89e888a78899 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -342,27 +342,72 @@ struct device_node *of_get_cpu_node(int cpu, unsigned int *thread)
 }
 EXPORT_SYMBOL(of_get_cpu_node);
 
-/** Checks if the given "compat" string matches one of the strings in
- * the device's "compatible" property
+/**
+ * __of_device_is_compatible() - Check if the node matches given constraints
+ * @device: pointer to node
+ * @compat: required compatible string, NULL or "" for any match
+ * @type: required device_type value, NULL or "" for any match
+ * @name: required node name, NULL or "" for any match
+ *
+ * Checks if the given @compat, @type and @name strings match the
+ * properties of the given @device. A constraints can be skipped by
+ * passing NULL or an empty string as the constraint.
+ *
+ * Returns 0 for no match, and a positive integer on match. The return
+ * value is a relative score with larger values indicating better
+ * matches. The score is weighted for the most specific compatible value
+ * to get the highest score. Matching type is next, followed by matching
+ * name. Practically speaking, this results in the following priority
+ * order for matches:
+ *
+ * 1. specific compatible && type && name
+ * 2. specific compatible && type
+ * 3. specific compatible && name
+ * 4. specific compatible
+ * 5. general compatible && type && name
+ * 6. general compatible && type
+ * 7. general compatible && name
+ * 8. general compatible
+ * 9. type && name
+ * 10. type
+ * 11. name
  */
 static int __of_device_is_compatible(const struct device_node *device,
-                                     const char *compat)
+                                     const char *compat, const char *type, const char *name)
 {
-        const char* cp;
-        int cplen, l;
+        struct property *prop;
+        const char *cp;
+        int index = 0, score = 0;
+
+        /* Compatible match has highest priority */
+        if (compat && compat[0]) {
+                prop = __of_find_property(device, "compatible", NULL);
+                for (cp = of_prop_next_string(prop, NULL); cp;
+                     cp = of_prop_next_string(prop, cp), index++) {
+                        if (of_compat_cmp(cp, compat, strlen(compat)) == 0) {
+                                score = INT_MAX/2 - (index << 2);
+                                break;
+                        }
+                }
+                if (!score)
+                        return 0;
+        }
 
-        cp = __of_get_property(device, "compatible", &cplen);
-        if (cp == NULL)
-                return 0;
-        while (cplen > 0) {
-                if (of_compat_cmp(cp, compat, strlen(compat)) == 0)
-                        return 1;
-                l = strlen(cp) + 1;
-                cp += l;
-                cplen -= l;
+        /* Matching type is better than matching name */
+        if (type && type[0]) {
+                if (!device->type || of_node_cmp(type, device->type))
+                        return 0;
+                score += 2;
         }
 
-        return 0;
+        /* Matching name is a bit better than not */
+        if (name && name[0]) {
+                if (!device->name || of_node_cmp(name, device->name))
+                        return 0;
+                score++;
+        }
+
+        return score;
 }
 
 /** Checks if the given "compat" string matches one of the strings in
@@ -375,7 +420,7 @@ int of_device_is_compatible(const struct device_node *device,
         int res;
 
         raw_spin_lock_irqsave(&devtree_lock, flags);
-        res = __of_device_is_compatible(device, compat);
+        res = __of_device_is_compatible(device, compat, NULL, NULL);
         raw_spin_unlock_irqrestore(&devtree_lock, flags);
         return res;
 }
@@ -681,10 +726,7 @@ struct device_node *of_find_compatible_node(struct device_node *from,
         raw_spin_lock_irqsave(&devtree_lock, flags);
         np = from ? from->allnext : of_allnodes;
         for (; np; np = np->allnext) {
-                if (type
-                    && !(np->type && (of_node_cmp(np->type, type) == 0)))
-                        continue;
-                if (__of_device_is_compatible(np, compatible) &&
+                if (__of_device_is_compatible(np, compatible, type, NULL) &&
                     of_node_get(np))
                         break;
         }
@@ -734,43 +776,22 @@ static
 const struct of_device_id *__of_match_node(const struct of_device_id *matches,
                                            const struct device_node *node)
 {
-        const char *cp;
-        int cplen, l;
+        const struct of_device_id *best_match = NULL;
+        int score, best_score = 0;
 
         if (!matches)
                 return NULL;
 
-        cp = __of_get_property(node, "compatible", &cplen);
-        do {
-                const struct of_device_id *m = matches;
-
-                /* Check against matches with current compatible string */
-                while (m->name[0] || m->type[0] || m->compatible[0]) {
-                        int match = 1;
-                        if (m->name[0])
-                                match &= node->name
-                                        && !strcmp(m->name, node->name);
-                        if (m->type[0])
-                                match &= node->type
-                                        && !strcmp(m->type, node->type);
-                        if (m->compatible[0])
-                                match &= cp
-                                        && !of_compat_cmp(m->compatible, cp,
-                                                        strlen(m->compatible));
-                        if (match)
-                                return m;
-                        m++;
-                }
-
-                /* Get node's next compatible string */ 
-                if (cp) {
-                        l = strlen(cp) + 1;
-                        cp += l;
-                        cplen -= l;
+        for (; matches->name[0] || matches->type[0] || matches->compatible[0]; matches++) {
+                score = __of_device_is_compatible(node, matches->compatible,
+                                                  matches->type, matches->name);
+                if (score > best_score) {
+                        best_match = matches;
+                        best_score = score;
                 }
-        } while (cp && (cplen > 0));
+        }
 
-        return NULL;
+        return best_match;
 }
 
 /**
@@ -778,10 +799,7 @@ const struct of_device_id *__of_match_node(const struct of_device_id *matches,
  *      @matches:       array of of device match structures to search in
  *      @node:          the of device structure to match against
  *
- *      Low level utility function used by device matching. Matching order
- *      is to compare each of the node's compatibles with all given matches
- *      first. This implies node's compatible is sorted from specific to
- *      generic while matches can be in any order.
+ *      Low level utility function used by device matching.
  */
 const struct of_device_id *of_match_node(const struct of_device_id *matches,
                                          const struct device_node *node)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 875b7b6f0d2a..5b3c24f3cde5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -24,7 +24,11 @@ MODULE_LICENSE("GPL");
 
 static void of_set_phy_supported(struct phy_device *phydev, u32 max_speed)
 {
-        phydev->supported |= PHY_DEFAULT_FEATURES;
+        /* The default values for phydev->supported are provided by the PHY
+         * driver "features" member, we want to reset to sane defaults fist
+         * before supporting higher speeds.
+         */
+        phydev->supported &= PHY_DEFAULT_FEATURES;
 
         switch (max_speed) {
         default:
@@ -44,7 +48,7 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio, struct device_node *chi
 {
         struct phy_device *phy;
         bool is_c45;
-        int rc, prev_irq;
+        int rc;
         u32 max_speed = 0;
 
         is_c45 = of_device_is_compatible(child,
@@ -54,12 +58,14 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio, struct device_node *chi
         if (!phy || IS_ERR(phy))
                 return 1;
 
-        if (mdio->irq) {
-                prev_irq = mdio->irq[addr];
-                mdio->irq[addr] =
-                        irq_of_parse_and_map(child, 0);
-                if (!mdio->irq[addr])
-                        mdio->irq[addr] = prev_irq;
+        rc = irq_of_parse_and_map(child, 0);
+        if (rc > 0) {
+                phy->irq = rc;
+                if (mdio->irq)
+                        mdio->irq[addr] = rc;
+        } else {
+                if (mdio->irq)
+                        phy->irq = mdio->irq[addr];
         }
 
         /* Associate the OF node with the device structure so it
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index e21012bde639..6643d1920985 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -300,6 +300,72 @@ static void __init of_selftest_parse_interrupts_extended(void)
         of_node_put(np);
 }
 
+static struct of_device_id match_node_table[] = {
+        { .data = "A", .name = "name0", }, /* Name alone is lowest priority */
+        { .data = "B", .type = "type1", }, /* followed by type alone */
+
+        { .data = "Ca", .name = "name2", .type = "type1", }, /* followed by both together */
+        { .data = "Cb", .name = "name2", }, /* Only match when type doesn't match */
+        { .data = "Cc", .name = "name2", .type = "type2", },
+
+        { .data = "E", .compatible = "compat3" },
+        { .data = "G", .compatible = "compat2", },
+        { .data = "H", .compatible = "compat2", .name = "name5", },
+        { .data = "I", .compatible = "compat2", .type = "type1", },
+        { .data = "J", .compatible = "compat2", .type = "type1", .name = "name8", },
+        { .data = "K", .compatible = "compat2", .name = "name9", },
+        {}
+};
+
+static struct {
+        const char *path;
+        const char *data;
+} match_node_tests[] = {
+        { .path = "/testcase-data/match-node/name0", .data = "A", },
+        { .path = "/testcase-data/match-node/name1", .data = "B", },
+        { .path = "/testcase-data/match-node/a/name2", .data = "Ca", },
+        { .path = "/testcase-data/match-node/b/name2", .data = "Cb", },
+        { .path = "/testcase-data/match-node/c/name2", .data = "Cc", },
+        { .path = "/testcase-data/match-node/name3", .data = "E", },
+        { .path = "/testcase-data/match-node/name4", .data = "G", },
+        { .path = "/testcase-data/match-node/name5", .data = "H", },
+        { .path = "/testcase-data/match-node/name6", .data = "G", },
+        { .path = "/testcase-data/match-node/name7", .data = "I", },
+        { .path = "/testcase-data/match-node/name8", .data = "J", },
+        { .path = "/testcase-data/match-node/name9", .data = "K", },
+};
+
+static void __init of_selftest_match_node(void)
+{
+        struct device_node *np;
+        const struct of_device_id *match;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(match_node_tests); i++) {
+                np = of_find_node_by_path(match_node_tests[i].path);
+                if (!np) {
+                        selftest(0, "missing testcase node %s\n",
+                                match_node_tests[i].path);
+                        continue;
+                }
+
+                match = of_match_node(match_node_table, np);
+                if (!match) {
+                        selftest(0, "%s didn't match anything\n",
+                                match_node_tests[i].path);
+                        continue;
+                }
+
+                if (strcmp(match->data, match_node_tests[i].data) != 0) {
+                        selftest(0, "%s got wrong match. expected %s, got %s\n",
+                                match_node_tests[i].path, match_node_tests[i].data,
+                                (const char *)match->data);
+                        continue;
+                }
+                selftest(1, "passed");
+        }
+}
+
 static int __init of_selftest(void)
 {
         struct device_node *np;
@@ -316,6 +382,7 @@ static int __init of_selftest(void)
         of_selftest_property_match_string();
         of_selftest_parse_interrupts();
         of_selftest_parse_interrupts_extended();
+        of_selftest_match_node();
         pr_info("end of selftest - %i passed, %i failed\n",
                 selftest_results.passed, selftest_results.failed);
         return 0;
diff --git a/drivers/of/testcase-data/testcases.dtsi b/drivers/of/testcase-data/testcases.dtsi
new file mode 100644
index 000000000000..3a5b75a8e4d7
--- /dev/null
+++ b/drivers/of/testcase-data/testcases.dtsi
@@ -0,0 +1,3 @@
+#include "tests-phandle.dtsi"
+#include "tests-interrupts.dtsi"
+#include "tests-match.dtsi"
diff --git a/arch/arm/boot/dts/testcases/tests-interrupts.dtsi b/drivers/of/testcase-data/tests-interrupts.dtsi
index c843720bd3e5..c843720bd3e5 100644
--- a/arch/arm/boot/dts/testcases/tests-interrupts.dtsi
+++ b/drivers/of/testcase-data/tests-interrupts.dtsi
diff --git a/drivers/of/testcase-data/tests-match.dtsi b/drivers/of/testcase-data/tests-match.dtsi
new file mode 100644
index 000000000000..c9e541129534
--- /dev/null
+++ b/drivers/of/testcase-data/tests-match.dtsi
@@ -0,0 +1,19 @@
+
+/ {
+        testcase-data {
+                match-node {
+                        name0 { };
+                        name1 { device_type = "type1"; };
+                        a { name2 { device_type = "type1"; }; };
+                        b { name2 { }; };
+                        c { name2 { device_type = "type2"; }; };
+                        name3 { compatible = "compat3"; };
+                        name4 { compatible = "compat2", "compat3"; };
+                        name5 { compatible = "compat2", "compat3"; };
+                        name6 { compatible = "compat1", "compat2", "compat3"; };
+                        name7 { compatible = "compat2"; device_type = "type1"; };
+                        name8 { compatible = "compat2"; device_type = "type1"; };
+                        name9 { compatible = "compat2"; };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/testcases/tests-phandle.dtsi b/drivers/of/testcase-data/tests-phandle.dtsi
index 0007d3cd7dc2..0007d3cd7dc2 100644
--- a/arch/arm/boot/dts/testcases/tests-phandle.dtsi
+++ b/drivers/of/testcase-data/tests-phandle.dtsi
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 13478ecd4113..0e79665afd44 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -60,14 +60,6 @@
 #define PCIE_DEBUG_CTRL         0x1a60
 #define  PCIE_DEBUG_SOFT_RESET          BIT(20)
 
-/*
- * This product ID is registered by Marvell, and used when the Marvell
- * SoC is not the root complex, but an endpoint on the PCIe bus. It is
- * therefore safe to re-use this PCI ID for our emulated PCI-to-PCI
- * bridge.
- */
-#define MARVELL_EMULATED_PCI_PCI_BRIDGE_ID 0x7846
-
 /* PCI configuration space of a PCI-to-PCI bridge */
 struct mvebu_sw_pci_bridge {
         u16 vendor;
@@ -388,7 +380,8 @@ static void mvebu_sw_pci_bridge_init(struct mvebu_pcie_port *port)
 
         bridge->class = PCI_CLASS_BRIDGE_PCI;
         bridge->vendor = PCI_VENDOR_ID_MARVELL;
-        bridge->device = MARVELL_EMULATED_PCI_PCI_BRIDGE_ID;
+        bridge->device = mvebu_readl(port, PCIE_DEV_ID_OFF) >> 16;
+        bridge->revision = mvebu_readl(port, PCIE_DEV_REV_OFF) & 0xff;
         bridge->header_type = PCI_HEADER_TYPE_BRIDGE;
         bridge->cache_line_size = 0x10;
 
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index e2a783fdb98f..7c7a388c85ab 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -730,6 +730,17 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot)
         return (unsigned int)sta;
 }
 
+static inline bool device_status_valid(unsigned int sta)
+{
+        /*
+         * ACPI spec says that _STA may return bit 0 clear with bit 3 set
+         * if the device is valid but does not require a device driver to be
+         * loaded (Section 6.3.7 of ACPI 5.0A).
+         */
+        unsigned int mask = ACPI_STA_DEVICE_ENABLED | ACPI_STA_DEVICE_FUNCTIONING;
+        return (sta & mask) == mask;
+}
+
 /**
  * trim_stale_devices - remove PCI devices that are not responding.
  * @dev: PCI device to start walking the hierarchy from.
@@ -745,7 +756,7 @@ static void trim_stale_devices(struct pci_dev *dev)
                 unsigned long long sta;
 
                 status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
-                alive = (ACPI_SUCCESS(status) && sta == ACPI_STA_ALL)
+                alive = (ACPI_SUCCESS(status) && device_status_valid(sta))
                         || acpiphp_no_hotplug(handle);
         }
         if (!alive) {
@@ -792,7 +803,7 @@ static void acpiphp_check_bridge(struct acpiphp_bridge *bridge)
                 mutex_lock(&slot->crit_sect);
                 if (slot_no_hotplug(slot)) {
                         ; /* do nothing */
-                } else if (get_slot_status(slot) == ACPI_STA_ALL) {
+                } else if (device_status_valid(get_slot_status(slot))) {
                         /* remove stale devices if any */
                         list_for_each_entry_safe_reverse(dev, tmp,
                                                          &bus->devices, bus_list)
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 7a0fec6ce571..955ab7990c5b 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -545,9 +545,15 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
                 return -ENOMEM;
         list_for_each_entry(entry, &pdev->msi_list, list) {
                 char *name = kmalloc(20, GFP_KERNEL);
+                if (!name)
+                        goto error_attrs;
+
                 msi_dev_attr = kzalloc(sizeof(*msi_dev_attr), GFP_KERNEL);
-                if (!msi_dev_attr)
+                if (!msi_dev_attr) {
+                        kfree(name);
                         goto error_attrs;
+                }
+
                 sprintf(name, "%d", entry->irq);
                 sysfs_attr_init(&msi_dev_attr->attr);
                 msi_dev_attr->attr.name = name;
@@ -589,6 +595,7 @@ error_attrs:
                 ++count;
                 msi_attr = msi_attrs[count];
         }
+        kfree(msi_attrs);
         return ret;
 }
 
@@ -959,7 +966,6 @@ EXPORT_SYMBOL(pci_disable_msi);
 /**
  * pci_msix_vec_count - return the number of device's MSI-X table entries
  * @dev: pointer to the pci_dev data structure of MSI-X device function
-
  * This function returns the number of device's MSI-X table entries and
  * therefore the number of MSI-X vectors device is capable of sending.
  * It returns a negative errno if the device is not capable of sending MSI-X
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 1febe90831b4..6b05f6134b68 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1181,6 +1181,8 @@ EXPORT_SYMBOL_GPL(pci_load_and_free_saved_state);
 static int do_pci_enable_device(struct pci_dev *dev, int bars)
 {
         int err;
+        u16 cmd;
+        u8 pin;
 
         err = pci_set_power_state(dev, PCI_D0);
         if (err < 0 && err != -EIO)
@@ -1190,6 +1192,14 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
                 return err;
         pci_fixup_device(pci_fixup_enable, dev);
 
+        pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
+        if (pin) {
+                pci_read_config_word(dev, PCI_COMMAND, &cmd);
+                if (cmd & PCI_COMMAND_INTX_DISABLE)
+                        pci_write_config_word(dev, PCI_COMMAND,
+                                              cmd & ~PCI_COMMAND_INTX_DISABLE);
+        }
+
         return 0;
 }
 
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index afa2354f6600..c7a551c2d5f1 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -5,7 +5,7 @@
 menu "PHY Subsystem"
 
 config GENERIC_PHY
-        tristate "PHY Core"
+        bool "PHY Core"
         help
           Generic PHY support.
 
@@ -61,6 +61,7 @@ config PHY_EXYNOS_DP_VIDEO
 config BCM_KONA_USB2_PHY
         tristate "Broadcom Kona USB2 PHY Driver"
         depends on GENERIC_PHY
+        depends on HAS_IOMEM
         help
           Enable this to support the Broadcom Kona USB 2.0 PHY.
 
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 645c867c1257..6c738376daff 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -162,6 +162,9 @@ int phy_init(struct phy *phy)
 {
         int ret;
 
+        if (!phy)
+                return 0;
+
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
                 return ret;
@@ -173,6 +176,8 @@ int phy_init(struct phy *phy)
                         dev_err(&phy->dev, "phy init failed --> %d\n", ret);
                         goto out;
                 }
+        } else {
+                ret = 0; /* Override possible ret == -ENOTSUPP */
         }
         ++phy->init_count;
 
@@ -187,6 +192,9 @@ int phy_exit(struct phy *phy)
 {
         int ret;
 
+        if (!phy)
+                return 0;
+
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
                 return ret;
@@ -212,6 +220,9 @@ int phy_power_on(struct phy *phy)
 {
         int ret;
 
+        if (!phy)
+                return 0;
+
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
                 return ret;
@@ -223,6 +234,8 @@ int phy_power_on(struct phy *phy)
                         dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
                         goto out;
                 }
+        } else {
+                ret = 0; /* Override possible ret == -ENOTSUPP */
         }
         ++phy->power_count;
         mutex_unlock(&phy->mutex);
@@ -240,6 +253,9 @@ int phy_power_off(struct phy *phy)
 {
         int ret;
 
+        if (!phy)
+                return 0;
+
         mutex_lock(&phy->mutex);
         if (phy->power_count == 1 && phy->ops->power_off) {
                 ret =  phy->ops->power_off(phy);
@@ -308,7 +324,7 @@ err0:
  */
 void phy_put(struct phy *phy)
 {
-        if (IS_ERR(phy))
+        if (!phy || IS_ERR(phy))
                 return;
 
         module_put(phy->ops->owner);
@@ -328,6 +344,9 @@ void devm_phy_put(struct device *dev, struct phy *phy)
 {
         int r;
 
+        if (!phy)
+                return;
+
         r = devres_destroy(dev, devm_phy_release, devm_phy_match, phy);
         dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n");
 }
@@ -389,17 +408,11 @@ struct phy *phy_get(struct device *dev, const char *string)
                 index = of_property_match_string(dev->of_node, "phy-names",
                         string);
                 phy = of_phy_get(dev, index);
-                if (IS_ERR(phy)) {
-                        dev_err(dev, "unable to find phy\n");
-                        return phy;
-                }
         } else {
                 phy = phy_lookup(dev, string);
-                if (IS_ERR(phy)) {
-                        dev_err(dev, "unable to find phy\n");
-                        return phy;
-                }
         }
+        if (IS_ERR(phy))
+                return phy;
 
         if (!try_module_get(phy->ops->owner))
                 return ERR_PTR(-EPROBE_DEFER);
@@ -411,6 +424,27 @@ struct phy *phy_get(struct device *dev, const char *string)
 EXPORT_SYMBOL_GPL(phy_get);
 
 /**
+ * phy_optional_get() - lookup and obtain a reference to an optional phy.
+ * @dev: device that requests this phy
+ * @string: the phy name as given in the dt data or the name of the controller
+ * port for non-dt case
+ *
+ * Returns the phy driver, after getting a refcount to it; or
+ * NULL if there is no such phy.  The caller is responsible for
+ * calling phy_put() to release that count.
+ */
+struct phy *phy_optional_get(struct device *dev, const char *string)
+{
+        struct phy *phy = phy_get(dev, string);
+
+        if (PTR_ERR(phy) == -ENODEV)
+                phy = NULL;
+
+        return phy;
+}
+EXPORT_SYMBOL_GPL(phy_optional_get);
+
+/**
  * devm_phy_get() - lookup and obtain a reference to a phy.
  * @dev: device that requests this phy
  * @string: the phy name as given in the dt data or phy device name
@@ -441,6 +475,30 @@ struct phy *devm_phy_get(struct device *dev, const char *string)
 EXPORT_SYMBOL_GPL(devm_phy_get);
 
 /**
+ * devm_phy_optional_get() - lookup and obtain a reference to an optional phy.
+ * @dev: device that requests this phy
+ * @string: the phy name as given in the dt data or phy device name
+ * for non-dt case
+ *
+ * Gets the phy using phy_get(), and associates a device with it using
+ * devres. On driver detach, release function is invoked on the devres
+ * data, then, devres data is freed. This differs to devm_phy_get() in
+ * that if the phy does not exist, it is not considered an error and
+ * -ENODEV will not be returned. Instead the NULL phy is returned,
+ * which can be passed to all other phy consumer calls.
+ */
+struct phy *devm_phy_optional_get(struct device *dev, const char *string)
+{
+        struct phy *phy = devm_phy_get(dev, string);
+
+        if (PTR_ERR(phy) == -ENODEV)
+                phy = NULL;
+
+        return phy;
+}
+EXPORT_SYMBOL_GPL(devm_phy_optional_get);
+
+/**
  * phy_create() - create a new phy
  * @dev: device that is creating the new phy
  * @ops: function pointers for performing phy operations
diff --git a/drivers/phy/phy-exynos-dp-video.c b/drivers/phy/phy-exynos-dp-video.c
index 1dbe6ce7b2ce..0786fef842e7 100644
--- a/drivers/phy/phy-exynos-dp-video.c
+++ b/drivers/phy/phy-exynos-dp-video.c
@@ -76,10 +76,6 @@ static int exynos_dp_video_phy_probe(struct platform_device *pdev)
         if (IS_ERR(state->regs))
                 return PTR_ERR(state->regs);
 
-        phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         phy = devm_phy_create(dev, &exynos_dp_video_phy_ops, NULL);
         if (IS_ERR(phy)) {
                 dev_err(dev, "failed to create Display Port PHY\n");
@@ -87,6 +83,10 @@ static int exynos_dp_video_phy_probe(struct platform_device *pdev)
         }
         phy_set_drvdata(phy, state);
 
+        phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         return 0;
 }
 
diff --git a/drivers/phy/phy-exynos-mipi-video.c b/drivers/phy/phy-exynos-mipi-video.c
index 0c5efab11af1..7f139326a642 100644
--- a/drivers/phy/phy-exynos-mipi-video.c
+++ b/drivers/phy/phy-exynos-mipi-video.c
@@ -134,11 +134,6 @@ static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
         dev_set_drvdata(dev, state);
         spin_lock_init(&state->slock);
 
-        phy_provider = devm_of_phy_provider_register(dev,
-                                        exynos_mipi_video_phy_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         for (i = 0; i < EXYNOS_MIPI_PHYS_NUM; i++) {
                 struct phy *phy = devm_phy_create(dev,
                                         &exynos_mipi_video_phy_ops, NULL);
@@ -152,6 +147,11 @@ static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
                 phy_set_drvdata(phy, &state->phys[i]);
         }
 
+        phy_provider = devm_of_phy_provider_register(dev,
+                                        exynos_mipi_video_phy_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         return 0;
 }
 
diff --git a/drivers/phy/phy-mvebu-sata.c b/drivers/phy/phy-mvebu-sata.c
index d43786f62437..d70ecd6a1b3f 100644
--- a/drivers/phy/phy-mvebu-sata.c
+++ b/drivers/phy/phy-mvebu-sata.c
@@ -99,17 +99,17 @@ static int phy_mvebu_sata_probe(struct platform_device *pdev)
         if (IS_ERR(priv->clk))
                 return PTR_ERR(priv->clk);
 
-        phy_provider = devm_of_phy_provider_register(&pdev->dev,
-                                                     of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         phy = devm_phy_create(&pdev->dev, &phy_mvebu_sata_ops, NULL);
         if (IS_ERR(phy))
                 return PTR_ERR(phy);
 
         phy_set_drvdata(phy, priv);
 
+        phy_provider = devm_of_phy_provider_register(&pdev->dev,
+                                                     of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         /* The boot loader may of left it on. Turn it off. */
         phy_mvebu_sata_power_off(phy);
 
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index bfc5c337f99a..7699752fba11 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -177,11 +177,6 @@ static int omap_usb2_probe(struct platform_device *pdev)
         phy->phy.otg            = otg;
         phy->phy.type           = USB_PHY_TYPE_USB2;
 
-        phy_provider = devm_of_phy_provider_register(phy->dev,
-                        of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         control_node = of_parse_phandle(node, "ctrl-module", 0);
         if (!control_node) {
                 dev_err(&pdev->dev, "Failed to get control device phandle\n");
@@ -214,6 +209,11 @@ static int omap_usb2_probe(struct platform_device *pdev)
 
         phy_set_drvdata(generic_phy, phy);
 
+        phy_provider = devm_of_phy_provider_register(phy->dev,
+                        of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         phy->wkupclk = devm_clk_get(phy->dev, "usb_phy_cm_clk32k");
         if (IS_ERR(phy->wkupclk)) {
                 dev_err(&pdev->dev, "unable to get usb_phy_cm_clk32k\n");
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index daf65e68aaab..c3ace1db8136 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -695,11 +695,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
         otg->set_host           = twl4030_set_host;
         otg->set_peripheral     = twl4030_set_peripheral;
 
-        phy_provider = devm_of_phy_provider_register(twl->dev,
-                of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         phy = devm_phy_create(twl->dev, &ops, init_data);
         if (IS_ERR(phy)) {
                 dev_dbg(&pdev->dev, "Failed to create PHY\n");
@@ -708,6 +703,11 @@ static int twl4030_usb_probe(struct platform_device *pdev)
 
         phy_set_drvdata(phy, twl);
 
+        phy_provider = devm_of_phy_provider_register(twl->dev,
+                of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         /* init spinlock for workqueue */
         spin_lock_init(&twl->lock);
 
diff --git a/drivers/power/ds2782_battery.c b/drivers/power/ds2782_battery.c
index 563174891c90..041f9b638d28 100644
--- a/drivers/power/ds2782_battery.c
+++ b/drivers/power/ds2782_battery.c
@@ -192,7 +192,7 @@ static int ds2786_get_voltage(struct ds278x_info *info, int *voltage_uV)
 
         /*
          * Voltage is measured in units of 1.22mV. The voltage is stored as
-         * a 10-bit number plus sign, in the upper bits of a 16-bit register
+         * a 12-bit number plus sign, in the upper bits of a 16-bit register
          */
         err = ds278x_read_reg16(info, DS278x_REG_VOLT_MSB, &raw);
         if (err)
diff --git a/drivers/power/isp1704_charger.c b/drivers/power/isp1704_charger.c
index 80edb7d8cb54..0b4cf9d63291 100644
--- a/drivers/power/isp1704_charger.c
+++ b/drivers/power/isp1704_charger.c
@@ -444,8 +444,6 @@ static int isp1704_charger_probe(struct platform_device *pdev)
                 ret = PTR_ERR(isp->phy);
                 goto fail0;
         }
-        if (!isp->phy)
-                goto fail0;
 
         isp->dev = &pdev->dev;
         platform_set_drvdata(pdev, isp);
diff --git a/drivers/power/max17040_battery.c b/drivers/power/max17040_battery.c
index c7ff6d67f158..0fbac861080d 100644
--- a/drivers/power/max17040_battery.c
+++ b/drivers/power/max17040_battery.c
@@ -148,7 +148,7 @@ static void max17040_get_online(struct i2c_client *client)
 {
         struct max17040_chip *chip = i2c_get_clientdata(client);
 
-        if (chip->pdata->battery_online)
+        if (chip->pdata && chip->pdata->battery_online)
                 chip->online = chip->pdata->battery_online();
         else
                 chip->online = 1;
@@ -158,7 +158,8 @@ static void max17040_get_status(struct i2c_client *client)
 {
         struct max17040_chip *chip = i2c_get_clientdata(client);
 
-        if (!chip->pdata->charger_online || !chip->pdata->charger_enable) {
+        if (!chip->pdata || !chip->pdata->charger_online
+                        || !chip->pdata->charger_enable) {
                 chip->status = POWER_SUPPLY_STATUS_UNKNOWN;
                 return;
         }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 16a309e5c024..d1ac4caaf1b0 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1359,7 +1359,7 @@ static struct regulator *_regulator_get(struct device *dev, const char *id,
                 goto found;
         /* Don't log an error when called from regulator_get_optional() */
         } else if (!have_full_constraints() || exclusive) {
-                dev_err(dev, "dummy supplies not allowed\n");
+                dev_warn(dev, "dummy supplies not allowed\n");
         }
 
         mutex_unlock(&regulator_list_mutex);
diff --git a/drivers/regulator/da9055-regulator.c b/drivers/regulator/da9055-regulator.c
index 7f340206d329..b14ebdad5dd2 100644
--- a/drivers/regulator/da9055-regulator.c
+++ b/drivers/regulator/da9055-regulator.c
@@ -576,7 +576,9 @@ static int da9055_regulator_probe(struct platform_device *pdev)
         /* Only LDO 5 and 6 has got the over current interrupt */
         if (pdev->id == DA9055_ID_LDO5 || pdev->id ==  DA9055_ID_LDO6) {
                 irq = platform_get_irq_byname(pdev, "REGULATOR");
-                irq = regmap_irq_get_virq(da9055->irq_data, irq);
+                if (irq < 0)
+                        return irq;
+
                 ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                                 da9055_ldo5_6_oc_irq,
                                                 IRQF_TRIGGER_HIGH |
diff --git a/drivers/regulator/da9063-regulator.c b/drivers/regulator/da9063-regulator.c
index 56727eb745df..91e99a2c8dc1 100644
--- a/drivers/regulator/da9063-regulator.c
+++ b/drivers/regulator/da9063-regulator.c
@@ -1,3 +1,4 @@
+
 /*
  * Regulator driver for DA9063 PMIC series
  *
@@ -60,7 +61,8 @@ struct da9063_regulator_info {
         .desc.ops = &da9063_ldo_ops, \
         .desc.min_uV = (min_mV) * 1000, \
         .desc.uV_step = (step_mV) * 1000, \
-        .desc.n_voltages = (((max_mV) - (min_mV))/(step_mV) + 1), \
+        .desc.n_voltages = (((max_mV) - (min_mV))/(step_mV) + 1 \
+                + (DA9063_V##regl_name##_BIAS)), \
         .desc.enable_reg = DA9063_REG_##regl_name##_CONT, \
         .desc.enable_mask = DA9063_LDO_EN, \
         .desc.vsel_reg = DA9063_REG_V##regl_name##_A, \
diff --git a/drivers/regulator/max14577.c b/drivers/regulator/max14577.c
index b1078ba3f393..e0619526708c 100644
--- a/drivers/regulator/max14577.c
+++ b/drivers/regulator/max14577.c
@@ -166,12 +166,14 @@ static int max14577_regulator_dt_parse_pdata(struct platform_device *pdev)
 
         ret = of_regulator_match(&pdev->dev, np, max14577_regulator_matches,
                         MAX14577_REG_MAX);
-        if (ret < 0) {
+        if (ret < 0)
                 dev_err(&pdev->dev, "Error parsing regulator init data: %d\n", ret);
-                return ret;
-        }
+        else
+                ret = 0;
 
-        return 0;
+        of_node_put(np);
+
+        return ret;
 }
 
 static inline struct regulator_init_data *match_init_data(int index)
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index d7164bb75d3e..d958dfa05125 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -535,7 +535,7 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
                 return -ENODEV;
         }
 
-        regulators_np = of_find_node_by_name(pmic_np, "regulators");
+        regulators_np = of_get_child_by_name(pmic_np, "regulators");
         if (!regulators_np) {
                 dev_err(iodev->dev, "could not find regulators sub-node\n");
                 return -EINVAL;
@@ -591,6 +591,8 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
                 rmode++;
         }
 
+        of_node_put(regulators_np);
+
         if (of_get_property(pmic_np, "s5m8767,pmic-buck2-uses-gpio-dvs", NULL)) {
                 pdata->buck2_gpiodvs = true;
 
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index f6b9188c5af5..9f0ea6cb6922 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -610,6 +610,7 @@ void chsc_chp_online(struct chp_id chpid)
                 css_wait_for_slow_path();
                 for_each_subchannel_staged(__s390_process_res_acc, NULL,
                                            &link);
+                css_schedule_reprobe();
         }
 }
 
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 88e35d85d205..8ee88c4ebd83 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -342,8 +342,9 @@ static int cio_check_config(struct subchannel *sch, struct schib *schib)
  */
 int cio_commit_config(struct subchannel *sch)
 {
-        struct schib schib;
         int ccode, retry, ret = 0;
+        struct schib schib;
+        struct irb irb;
 
         if (stsch_err(sch->schid, &schib) || !css_sch_is_valid(&schib))
                 return -ENODEV;
@@ -367,7 +368,10 @@ int cio_commit_config(struct subchannel *sch)
                         ret = -EAGAIN;
                         break;
                 case 1: /* status pending */
-                        return -EBUSY;
+                        ret = -EBUSY;
+                        if (tsch(sch->schid, &irb))
+                                return ret;
+                        break;
                 case 2: /* busy */
                         udelay(100); /* allow for recovery */
                         ret = -EBUSY;
@@ -403,7 +407,6 @@ EXPORT_SYMBOL_GPL(cio_update_schib);
  */
 int cio_enable_subchannel(struct subchannel *sch, u32 intparm)
 {
-        int retry;
         int ret;
 
         CIO_TRACE_EVENT(2, "ensch");
@@ -418,20 +421,14 @@ int cio_enable_subchannel(struct subchannel *sch, u32 intparm)
         sch->config.isc = sch->isc;
         sch->config.intparm = intparm;
 
-        for (retry = 0; retry < 3; retry++) {
+        ret = cio_commit_config(sch);
+        if (ret == -EIO) {
+                /*
+                 * Got a program check in msch. Try without
+                 * the concurrent sense bit the next time.
+                 */
+                sch->config.csense = 0;
                 ret = cio_commit_config(sch);
-                if (ret == -EIO) {
-                        /*
-                         * Got a program check in msch. Try without
-                         * the concurrent sense bit the next time.
-                         */
-                        sch->config.csense = 0;
-                } else if (ret == -EBUSY) {
-                        struct irb irb;
-                        if (tsch(sch->schid, &irb) != 0)
-                                break;
-                } else
-                        break;
         }
         CIO_HEX_EVENT(2, &ret, sizeof(ret));
         return ret;
@@ -444,7 +441,6 @@ EXPORT_SYMBOL_GPL(cio_enable_subchannel);
  */
 int cio_disable_subchannel(struct subchannel *sch)
 {
-        int retry;
         int ret;
 
         CIO_TRACE_EVENT(2, "dissch");
@@ -456,16 +452,8 @@ int cio_disable_subchannel(struct subchannel *sch)
                 return -ENODEV;
 
         sch->config.ena = 0;
+        ret = cio_commit_config(sch);
 
-        for (retry = 0; retry < 3; retry++) {
-                ret = cio_commit_config(sch);
-                if (ret == -EBUSY) {
-                        struct irb irb;
-                        if (tsch(sch->schid, &irb) != 0)
-                                break;
-                } else
-                        break;
-        }
         CIO_HEX_EVENT(2, &ret, sizeof(ret));
         return ret;
 }
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index 8acaae18bd11..a563e4c00590 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -359,14 +359,12 @@ static inline int multicast_outbound(struct qdio_q *q)
 #define need_siga_sync_out_after_pci(q) \
         (unlikely(q->irq_ptr->siga_flag.sync_out_after_pci))
 
-#define for_each_input_queue(irq_ptr, q, i)     \
-        for (i = 0, q = irq_ptr->input_qs[0];   \
-                i < irq_ptr->nr_input_qs;       \
-                q = irq_ptr->input_qs[++i])
-#define for_each_output_queue(irq_ptr, q, i)    \
-        for (i = 0, q = irq_ptr->output_qs[0];  \
-                i < irq_ptr->nr_output_qs;      \
-                q = irq_ptr->output_qs[++i])
+#define for_each_input_queue(irq_ptr, q, i)             \
+        for (i = 0; i < irq_ptr->nr_input_qs &&         \
+                ({ q = irq_ptr->input_qs[i]; 1; }); i++)
+#define for_each_output_queue(irq_ptr, q, i)            \
+        for (i = 0; i < irq_ptr->nr_output_qs &&        \
+                ({ q = irq_ptr->output_qs[i]; 1; }); i++)
 
 #define prev_buf(bufnr) \
         ((bufnr + QDIO_MAX_BUFFERS_MASK) & QDIO_MAX_BUFFERS_MASK)
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index c883a085c059..77466c4faabb 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -996,7 +996,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
                 }
         }
 
-        if (!pci_out_supported(q))
+        if (!(irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED))
                 return;
 
         for_each_output_queue(irq_ptr, q, i) {
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index dc542e0a3055..0bc91e46395a 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -311,7 +311,7 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
         } __packed * msg = ap_msg->message;
 
         int rcblen = CEIL4(xcRB->request_control_blk_length);
-        int replylen;
+        int replylen, req_sumlen, resp_sumlen;
         char *req_data = ap_msg->message + sizeof(struct type6_hdr) + rcblen;
         char *function_code;
 
@@ -321,12 +321,34 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
                 xcRB->request_data_length;
         if (ap_msg->length > MSGTYPE06_MAX_MSG_SIZE)
                 return -EINVAL;
+
+        /* Overflow check
+           sum must be greater (or equal) than the largest operand */
+        req_sumlen = CEIL4(xcRB->request_control_blk_length) +
+                        xcRB->request_data_length;
+        if ((CEIL4(xcRB->request_control_blk_length) <=
+                                                xcRB->request_data_length) ?
+                (req_sumlen < xcRB->request_data_length) :
+                (req_sumlen < CEIL4(xcRB->request_control_blk_length))) {
+                return -EINVAL;
+        }
+
         replylen = sizeof(struct type86_fmt2_msg) +
                 CEIL4(xcRB->reply_control_blk_length) +
                 xcRB->reply_data_length;
         if (replylen > MSGTYPE06_MAX_MSG_SIZE)
                 return -EINVAL;
 
+        /* Overflow check
+           sum must be greater (or equal) than the largest operand */
+        resp_sumlen = CEIL4(xcRB->reply_control_blk_length) +
+                        xcRB->reply_data_length;
+        if ((CEIL4(xcRB->reply_control_blk_length) <= xcRB->reply_data_length) ?
+                (resp_sumlen < xcRB->reply_data_length) :
+                (resp_sumlen < CEIL4(xcRB->reply_control_blk_length))) {
+                return -EINVAL;
+        }
+
         /* prepare type6 header */
         msg->hdr = static_type6_hdrX;
         memcpy(msg->hdr.agent_id , &(xcRB->agent_ID), sizeof(xcRB->agent_ID));
diff --git a/drivers/sbus/char/jsflash.c b/drivers/sbus/char/jsflash.c
index 6b4678a7900a..4ccb5d869389 100644
--- a/drivers/sbus/char/jsflash.c
+++ b/drivers/sbus/char/jsflash.c
@@ -507,7 +507,6 @@ static int jsflash_init(void)
         }
 
         /* Let us be really paranoid for modifications to probing code. */
-        /* extern enum sparc_cpu sparc_cpu_model; */ /* in <asm/system.h> */
         if (sparc_cpu_model != sun4m) {
                 /* We must be on sun4m because we use MMU Bypass ASI. */
                 return -ENXIO;
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 9e80d61e5a3a..2eb97d7e8d12 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2595,8 +2595,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
                 return -ENOMEM;
         }
 
-        INIT_LIST_HEAD(&cmd->cmd_list);
-
         memcpy(&cmd->atio, atio, sizeof(*atio));
         cmd->state = QLA_TGT_STATE_NEW;
         cmd->tgt = vha->vha_tgt.qla_tgt;
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 1d10eecad499..66e755cdde57 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -855,7 +855,6 @@ struct qla_tgt_cmd {
         uint16_t loop_id;       /* to save extra sess dereferences */
         struct qla_tgt *tgt;    /* to save extra sess dereferences */
         struct scsi_qla_host *vha;
-        struct list_head cmd_list;
 
         struct atio_from_isp atio;
 };
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 7bd7f0d5f050..62ec84b42e31 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1684,7 +1684,7 @@ u64 scsi_calculate_bounce_limit(struct Scsi_Host *shost)
 
         host_dev = scsi_get_device(shost);
         if (host_dev && host_dev->dma_mask)
-                bounce_limit = dma_max_pfn(host_dev) << PAGE_SHIFT;
+                bounce_limit = (u64)dma_max_pfn(host_dev) << PAGE_SHIFT;
 
         return bounce_limit;
 }
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index ba9310bc9acb..581ee2a8856b 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -376,10 +376,10 @@ config SPI_PXA2XX_PCI
         def_tristate SPI_PXA2XX && PCI
 
 config SPI_RSPI
-        tristate "Renesas RSPI controller"
+        tristate "Renesas RSPI/QSPI controller"
         depends on (SUPERH && SH_DMAE_BASE) || ARCH_SHMOBILE
         help
-          SPI driver for Renesas RSPI blocks.
+          SPI driver for Renesas RSPI and QSPI blocks.
 
 config SPI_S3C24XX
         tristate "Samsung S3C24XX series SPI"
diff --git a/drivers/spi/spi-nuc900.c b/drivers/spi/spi-nuc900.c
index 50406306bc20..bae97ffec4b9 100644
--- a/drivers/spi/spi-nuc900.c
+++ b/drivers/spi/spi-nuc900.c
@@ -361,6 +361,8 @@ static int nuc900_spi_probe(struct platform_device *pdev)
         init_completion(&hw->done);
 
         master->mode_bits          = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
+        if (hw->pdata->lsb)
+                master->mode_bits |= SPI_LSB_FIRST;
         master->num_chipselect     = hw->pdata->num_cs;
         master->bus_num            = hw->pdata->bus_num;
         hw->bitbang.master         = hw->master;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 23756b0f9036..d0b28bba38be 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -755,9 +755,7 @@ static void spi_pump_messages(struct kthread_work *work)
         ret = master->transfer_one_message(master, master->cur_msg);
         if (ret) {
                 dev_err(&master->dev,
-                        "failed to transfer one message from queue: %d\n", ret);
-                master->cur_msg->status = ret;
-                spi_finalize_current_message(master);
+                        "failed to transfer one message from queue\n");
                 return;
         }
 }
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 23948f167012..713a97226787 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -295,21 +295,29 @@ static ssize_t ashmem_read(struct file *file, char __user *buf,
 
         /* If size is not set, or set to 0, always return EOF. */
         if (asma->size == 0)
-                goto out;
+                goto out_unlock;
 
         if (!asma->file) {
                 ret = -EBADF;
-                goto out;
+                goto out_unlock;
         }
 
-        ret = asma->file->f_op->read(asma->file, buf, len, pos);
-        if (ret < 0)
-                goto out;
+        mutex_unlock(&ashmem_mutex);
 
-        /** Update backing file pos, since f_ops->read() doesn't */
-        asma->file->f_pos = *pos;
+        /*
+         * asma and asma->file are used outside the lock here.  We assume
+         * once asma->file is set it will never be changed, and will not
+         * be destroyed until all references to the file are dropped and
+         * ashmem_release is called.
+         */
+        ret = asma->file->f_op->read(asma->file, buf, len, pos);
+        if (ret >= 0) {
+                /** Update backing file pos, since f_ops->read() doesn't */
+                asma->file->f_pos = *pos;
+        }
+        return ret;
 
-out:
+out_unlock:
         mutex_unlock(&ashmem_mutex);
         return ret;
 }
@@ -498,6 +506,7 @@ out:
 
 static int set_name(struct ashmem_area *asma, void __user *name)
 {
+        int len;
         int ret = 0;
         char local_name[ASHMEM_NAME_LEN];
 
@@ -510,21 +519,19 @@ static int set_name(struct ashmem_area *asma, void __user *name)
          * variable that does not need protection and later copy the local
          * variable to the structure member with lock held.
          */
-        if (copy_from_user(local_name, name, ASHMEM_NAME_LEN))
-                return -EFAULT;
-
+        len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN);
+        if (len < 0)
+                return len;
+        if (len == ASHMEM_NAME_LEN)
+                local_name[ASHMEM_NAME_LEN - 1] = '\0';
         mutex_lock(&ashmem_mutex);
         /* cannot change an existing mapping's name */
-        if (unlikely(asma->file)) {
+        if (unlikely(asma->file))
                 ret = -EINVAL;
-                goto out;
-        }
-        memcpy(asma->name + ASHMEM_NAME_PREFIX_LEN,
-                local_name, ASHMEM_NAME_LEN);
-        asma->name[ASHMEM_FULL_NAME_LEN-1] = '\0';
-out:
-        mutex_unlock(&ashmem_mutex);
+        else
+                strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name);
 
+        mutex_unlock(&ashmem_mutex);
         return ret;
 }
 
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index eaec1dab7fe4..1432d956769c 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -2904,7 +2904,7 @@ static int binder_node_release(struct binder_node *node, int refs)
                 refs++;
 
                 if (!ref->death)
-                        goto out;
+                        continue;
 
                 death++;
 
@@ -2917,7 +2917,6 @@ static int binder_node_release(struct binder_node *node, int refs)
                         BUG();
         }
 
-out:
         binder_debug(BINDER_DEBUG_DEAD_BINDER,
                      "node %d now dead, refs %d, death %d\n",
                      node->debug_id, refs, death);
diff --git a/drivers/staging/android/ion/compat_ion.c b/drivers/staging/android/ion/compat_ion.c
index af6cd370b30f..ee3a7380e53b 100644
--- a/drivers/staging/android/ion/compat_ion.c
+++ b/drivers/staging/android/ion/compat_ion.c
@@ -35,9 +35,14 @@ struct compat_ion_custom_data {
         compat_ulong_t arg;
 };
 
+struct compat_ion_handle_data {
+        compat_int_t handle;
+};
+
 #define COMPAT_ION_IOC_ALLOC    _IOWR(ION_IOC_MAGIC, 0, \
                                       struct compat_ion_allocation_data)
-#define COMPAT_ION_IOC_FREE     _IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+#define COMPAT_ION_IOC_FREE     _IOWR(ION_IOC_MAGIC, 1, \
+                                      struct compat_ion_handle_data)
 #define COMPAT_ION_IOC_CUSTOM   _IOWR(ION_IOC_MAGIC, 6, \
                                       struct compat_ion_custom_data)
 
@@ -64,6 +69,19 @@ static int compat_get_ion_allocation_data(
         return err;
 }
 
+static int compat_get_ion_handle_data(
+                        struct compat_ion_handle_data __user *data32,
+                        struct ion_handle_data __user *data)
+{
+        compat_int_t i;
+        int err;
+
+        err = get_user(i, &data32->handle);
+        err |= put_user(i, &data->handle);
+
+        return err;
+}
+
 static int compat_put_ion_allocation_data(
                         struct compat_ion_allocation_data __user *data32,
                         struct ion_allocation_data __user *data)
@@ -132,8 +150,8 @@ long compat_ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         }
         case COMPAT_ION_IOC_FREE:
         {
-                struct compat_ion_allocation_data __user *data32;
-                struct ion_allocation_data __user *data;
+                struct compat_ion_handle_data __user *data32;
+                struct ion_handle_data __user *data;
                 int err;
 
                 data32 = compat_ptr(arg);
@@ -141,7 +159,7 @@ long compat_ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 if (data == NULL)
                         return -EFAULT;
 
-                err = compat_get_ion_allocation_data(data32, data);
+                err = compat_get_ion_handle_data(data32, data);
                 if (err)
                         return err;
 
diff --git a/drivers/staging/android/ion/ion_dummy_driver.c b/drivers/staging/android/ion/ion_dummy_driver.c
index 55b2002753f2..01cdc8aee898 100644
--- a/drivers/staging/android/ion/ion_dummy_driver.c
+++ b/drivers/staging/android/ion/ion_dummy_driver.c
@@ -17,9 +17,11 @@
 #include <linux/err.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
+#include <linux/init.h>
 #include <linux/bootmem.h>
 #include <linux/memblock.h>
 #include <linux/sizes.h>
+#include <linux/io.h>
 #include "ion.h"
 #include "ion_priv.h"
 
@@ -57,7 +59,7 @@ struct ion_platform_heap dummy_heaps[] = {
 };
 
 struct ion_platform_data dummy_ion_pdata = {
-        .nr = 4,
+        .nr = ARRAY_SIZE(dummy_heaps),
         .heaps = dummy_heaps,
 };
 
@@ -69,7 +71,7 @@ static int __init ion_dummy_init(void)
         heaps = kzalloc(sizeof(struct ion_heap *) * dummy_ion_pdata.nr,
                         GFP_KERNEL);
         if (!heaps)
-                return PTR_ERR(heaps);
+                return -ENOMEM;
 
 
         /* Allocate a dummy carveout heap */
@@ -128,6 +130,7 @@ err:
         }
         return err;
 }
+device_initcall(ion_dummy_init);
 
 static void __exit ion_dummy_exit(void)
 {
@@ -152,7 +155,4 @@ static void __exit ion_dummy_exit(void)
 
         return;
 }
-
-module_init(ion_dummy_init);
-module_exit(ion_dummy_exit);
-
+__exitcall(ion_dummy_exit);
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
index 296c74f98dc0..37e64d51394c 100644
--- a/drivers/staging/android/ion/ion_heap.c
+++ b/drivers/staging/android/ion/ion_heap.c
@@ -243,12 +243,12 @@ int ion_heap_init_deferred_free(struct ion_heap *heap)
         init_waitqueue_head(&heap->waitqueue);
         heap->task = kthread_run(ion_heap_deferred_free, heap,
                                  "%s", heap->name);
-        sched_setscheduler(heap->task, SCHED_IDLE, &param);
         if (IS_ERR(heap->task)) {
                 pr_err("%s: creating thread for deferred free failed\n",
                        __func__);
                 return PTR_RET(heap->task);
         }
+        sched_setscheduler(heap->task, SCHED_IDLE, &param);
         return 0;
 }
 
diff --git a/drivers/staging/android/ion/ion_priv.h b/drivers/staging/android/ion/ion_priv.h
index d98673981cc4..fc2e4fccf69d 100644
--- a/drivers/staging/android/ion/ion_priv.h
+++ b/drivers/staging/android/ion/ion_priv.h
@@ -17,6 +17,7 @@
 #ifndef _ION_PRIV_H
 #define _ION_PRIV_H
 
+#include <linux/device.h>
 #include <linux/dma-direction.h>
 #include <linux/kref.h>
 #include <linux/mm_types.h>
diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c
index 7f0729130d65..9849f3963e75 100644
--- a/drivers/staging/android/ion/ion_system_heap.c
+++ b/drivers/staging/android/ion/ion_system_heap.c
@@ -124,6 +124,7 @@ static struct page_info *alloc_largest_available(struct ion_system_heap *heap,
 
                 info->page = page;
                 info->order = orders[i];
+                INIT_LIST_HEAD(&info->list);
                 return info;
         }
         kfree(info);
@@ -145,12 +146,15 @@ static int ion_system_heap_allocate(struct ion_heap *heap,
         struct list_head pages;
         struct page_info *info, *tmp_info;
         int i = 0;
-        long size_remaining = PAGE_ALIGN(size);
+        unsigned long size_remaining = PAGE_ALIGN(size);
         unsigned int max_order = orders[0];
 
         if (align > PAGE_SIZE)
                 return -EINVAL;
 
+        if (size / PAGE_SIZE > totalram_pages / 2)
+                return -ENOMEM;
+
         INIT_LIST_HEAD(&pages);
         while (size_remaining > 0) {
                 info = alloc_largest_available(sys_heap, buffer, size_remaining,
diff --git a/drivers/staging/android/sw_sync.h b/drivers/staging/android/sw_sync.h
index 585040be5f18..5aaf71d6974b 100644
--- a/drivers/staging/android/sw_sync.h
+++ b/drivers/staging/android/sw_sync.h
@@ -35,10 +35,27 @@ struct sw_sync_pt {
         u32                     value;
 };
 
+#if IS_ENABLED(CONFIG_SW_SYNC)
 struct sw_sync_timeline *sw_sync_timeline_create(const char *name);
 void sw_sync_timeline_inc(struct sw_sync_timeline *obj, u32 inc);
 
 struct sync_pt *sw_sync_pt_create(struct sw_sync_timeline *obj, u32 value);
+#else
+static inline struct sw_sync_timeline *sw_sync_timeline_create(const char *name)
+{
+        return NULL;
+}
+
+static inline void sw_sync_timeline_inc(struct sw_sync_timeline *obj, u32 inc)
+{
+}
+
+static inline struct sync_pt *sw_sync_pt_create(struct sw_sync_timeline *obj,
+                u32 value)
+{
+        return NULL;
+}
+#endif /* IS_ENABLED(CONFIG_SW_SYNC) */
 
 #endif /* __KERNEL __ */
 
diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c
index 38e5d3b5ed9b..3d05f662110b 100644
--- a/drivers/staging/android/sync.c
+++ b/drivers/staging/android/sync.c
@@ -79,27 +79,27 @@ static void sync_timeline_free(struct kref *kref)
                 container_of(kref, struct sync_timeline, kref);
         unsigned long flags;
 
-        if (obj->ops->release_obj)
-                obj->ops->release_obj(obj);
-
         spin_lock_irqsave(&sync_timeline_list_lock, flags);
         list_del(&obj->sync_timeline_list);
         spin_unlock_irqrestore(&sync_timeline_list_lock, flags);
 
+        if (obj->ops->release_obj)
+                obj->ops->release_obj(obj);
+
         kfree(obj);
 }
 
 void sync_timeline_destroy(struct sync_timeline *obj)
 {
         obj->destroyed = true;
+        smp_wmb();
 
         /*
-         * If this is not the last reference, signal any children
-         * that their parent is going away.
+         * signal any children that their parent is going away.
          */
+        sync_timeline_signal(obj);
 
-        if (!kref_put(&obj->kref, sync_timeline_free))
-                sync_timeline_signal(obj);
+        kref_put(&obj->kref, sync_timeline_free);
 }
 EXPORT_SYMBOL(sync_timeline_destroy);
 
diff --git a/drivers/staging/bcm/Bcmnet.c b/drivers/staging/bcm/Bcmnet.c
index 8dfdd2732bdc..95a2358267ba 100644
--- a/drivers/staging/bcm/Bcmnet.c
+++ b/drivers/staging/bcm/Bcmnet.c
@@ -40,7 +40,7 @@ static INT bcm_close(struct net_device *dev)
 }
 
 static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb,
-                            void *accel_priv)
+                            void *accel_priv, select_queue_fallback_t fallback)
 {
         return ClassifyPacket(netdev_priv(dev), skb);
 }
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index 246080316c90..5b15033a94bf 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -616,8 +616,6 @@ int comedi_auto_config(struct device *hardware_device,
         ret = driver->auto_attach(dev, context);
         if (ret >= 0)
                 ret = comedi_device_postconfig(dev);
-        if (ret < 0)
-                comedi_device_detach(dev);
         mutex_unlock(&dev->mutex);
 
         if (ret < 0) {
diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index 593676cf706a..d9ad2c0fdda2 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -494,6 +494,7 @@ static int pci171x_insn_write_ao(struct comedi_device *dev,
                                  struct comedi_insn *insn, unsigned int *data)
 {
         struct pci1710_private *devpriv = dev->private;
+        unsigned int val;
         int n, chan, range, ofs;
 
         chan = CR_CHAN(insn->chanspec);
@@ -509,11 +510,14 @@ static int pci171x_insn_write_ao(struct comedi_device *dev,
                 outw(devpriv->da_ranges, dev->iobase + PCI171x_DAREF);
                 ofs = PCI171x_DA1;
         }
+        val = devpriv->ao_data[chan];
 
-        for (n = 0; n < insn->n; n++)
-                outw(data[n], dev->iobase + ofs);
+        for (n = 0; n < insn->n; n++) {
+                val = data[n];
+                outw(val, dev->iobase + ofs);
+        }
 
-        devpriv->ao_data[chan] = data[n];
+        devpriv->ao_data[chan] = val;
 
         return n;
 
@@ -679,6 +683,7 @@ static int pci1720_insn_write_ao(struct comedi_device *dev,
                                  struct comedi_insn *insn, unsigned int *data)
 {
         struct pci1710_private *devpriv = dev->private;
+        unsigned int val;
         int n, rangereg, chan;
 
         chan = CR_CHAN(insn->chanspec);
@@ -688,13 +693,15 @@ static int pci1720_insn_write_ao(struct comedi_device *dev,
                 outb(rangereg, dev->iobase + PCI1720_RANGE);
                 devpriv->da_ranges = rangereg;
         }
+        val = devpriv->ao_data[chan];
 
         for (n = 0; n < insn->n; n++) {
-                outw(data[n], dev->iobase + PCI1720_DA0 + (chan << 1));
+                val = data[n];
+                outw(val, dev->iobase + PCI1720_DA0 + (chan << 1));
                 outb(0, dev->iobase + PCI1720_SYNCOUT); /*  update outputs */
         }
 
-        devpriv->ao_data[chan] = data[n];
+        devpriv->ao_data[chan] = val;
 
         return n;
 }
diff --git a/drivers/staging/comedi/drivers/usbduxsigma.c b/drivers/staging/comedi/drivers/usbduxsigma.c
index 3beeb1254152..88c60b6020c4 100644
--- a/drivers/staging/comedi/drivers/usbduxsigma.c
+++ b/drivers/staging/comedi/drivers/usbduxsigma.c
@@ -48,6 +48,7 @@
 #include <linux/usb.h>
 #include <linux/fcntl.h>
 #include <linux/compiler.h>
+#include <asm/unaligned.h>
 
 #include "comedi_fc.h"
 #include "../comedidev.h"
@@ -792,7 +793,8 @@ static int usbduxsigma_ai_insn_read(struct comedi_device *dev,
                 }
 
                 /* 32 bits big endian from the A/D converter */
-                val = be32_to_cpu(*((uint32_t *)((devpriv->insn_buf) + 1)));
+                val = be32_to_cpu(get_unaligned((uint32_t
+                                                 *)(devpriv->insn_buf + 1)));
                 val &= 0x00ffffff;      /* strip status byte */
                 val ^= 0x00800000;      /* convert to unsigned */
 
@@ -1357,7 +1359,7 @@ static int usbduxsigma_getstatusinfo(struct comedi_device *dev, int chan)
                 return ret;
 
         /* 32 bits big endian from the A/D converter */
-        val = be32_to_cpu(*((uint32_t *)((devpriv->insn_buf)+1)));
+        val = be32_to_cpu(get_unaligned((uint32_t *)(devpriv->insn_buf + 1)));
         val &= 0x00ffffff;      /* strip status byte */
         val ^= 0x00800000;      /* convert to unsigned */
 
diff --git a/drivers/staging/dgrp/dgrp_net_ops.c b/drivers/staging/dgrp/dgrp_net_ops.c
index 1f61b89eca44..33ac7fb88cbd 100644
--- a/drivers/staging/dgrp/dgrp_net_ops.c
+++ b/drivers/staging/dgrp/dgrp_net_ops.c
@@ -2232,177 +2232,6 @@ done:
         return rtn;
 }
 
-/*
- * Common Packet Handling code
- */
-
-static void handle_data_in_packet(struct nd_struct *nd, struct ch_struct *ch,
-                                  long dlen, long plen, int n1, u8 *dbuf)
-{
-        char *error;
-        long n;
-        long remain;
-        u8 *buf;
-        u8 *b;
-
-        remain = nd->nd_remain;
-        nd->nd_tx_work = 1;
-
-        /*
-         *  Otherwise data should appear only when we are
-         *  in the CS_READY state.
-         */
-
-        if (ch->ch_state < CS_READY) {
-                error = "Data received before RWIN established";
-                nd->nd_remain = 0;
-                nd->nd_state = NS_SEND_ERROR;
-                nd->nd_error = error;
-        }
-
-        /*
-         *  Assure that the data received is within the
-         *  allowable window.
-         */
-
-        n = (ch->ch_s_rwin - ch->ch_s_rin) & 0xffff;
-
-        if (dlen > n) {
-                error = "Receive data overrun";
-                nd->nd_remain = 0;
-                nd->nd_state = NS_SEND_ERROR;
-                nd->nd_error = error;
-        }
-
-        /*
-         *  If we received 3 or less characters,
-         *  assume it is a human typing, and set RTIME
-         *  to 10 milliseconds.
-         *
-         *  If we receive 10 or more characters,
-         *  assume its not a human typing, and set RTIME
-         *  to 100 milliseconds.
-         */
-
-        if (ch->ch_edelay != DGRP_RTIME) {
-                if (ch->ch_rtime != ch->ch_edelay) {
-                        ch->ch_rtime = ch->ch_edelay;
-                        ch->ch_flag |= CH_PARAM;
-                }
-        } else if (dlen <= 3) {
-                if (ch->ch_rtime != 10) {
-                        ch->ch_rtime = 10;
-                        ch->ch_flag |= CH_PARAM;
-                }
-        } else {
-                if (ch->ch_rtime != DGRP_RTIME) {
-                        ch->ch_rtime = DGRP_RTIME;
-                        ch->ch_flag |= CH_PARAM;
-                }
-        }
-
-        /*
-         *  If a portion of the packet is outside the
-         *  buffer, shorten the effective length of the
-         *  data packet to be the amount of data received.
-         */
-
-        if (remain < plen)
-                dlen -= plen - remain;
-
-        /*
-         *  Detect if receive flush is now complete.
-         */
-
-        if ((ch->ch_flag & CH_RX_FLUSH) != 0 &&
-                        ((ch->ch_flush_seq - nd->nd_seq_out) & SEQ_MASK) >=
-                        ((nd->nd_seq_in    - nd->nd_seq_out) & SEQ_MASK)) {
-                ch->ch_flag &= ~CH_RX_FLUSH;
-        }
-
-        /*
-         *  If we are ready to receive, move the data into
-         *  the receive buffer.
-         */
-
-        ch->ch_s_rin = (ch->ch_s_rin + dlen) & 0xffff;
-
-        if (ch->ch_state == CS_READY &&
-                        (ch->ch_tun.un_open_count != 0) &&
-                        (ch->ch_tun.un_flag & UN_CLOSING) == 0 &&
-                        (ch->ch_cflag & CF_CREAD) != 0 &&
-                        (ch->ch_flag & (CH_BAUD0 | CH_RX_FLUSH)) == 0 &&
-                        (ch->ch_send & RR_RX_FLUSH) == 0) {
-
-                if (ch->ch_rin + dlen >= RBUF_MAX) {
-                        n = RBUF_MAX - ch->ch_rin;
-
-                        memcpy(ch->ch_rbuf + ch->ch_rin, dbuf, n);
-
-                        ch->ch_rin = 0;
-                        dbuf += n;
-                        dlen -= n;
-                }
-
-                memcpy(ch->ch_rbuf + ch->ch_rin, dbuf, dlen);
-
-                ch->ch_rin += dlen;
-
-
-                /*
-                 *  If we are not in fastcook mode, or
-                 *  if there is a fastcook thread
-                 *  waiting for data, send the data to
-                 *  the line discipline.
-                 */
-
-                if ((ch->ch_flag & CH_FAST_READ) == 0 ||
-                                ch->ch_inwait != 0) {
-                        dgrp_input(ch);
-                }
-
-                /*
-                 *  If there is a read thread waiting
-                 *  in select, and we are in fastcook
-                 *  mode, wake him up.
-                 */
-
-                if (waitqueue_active(&ch->ch_tun.un_tty->read_wait) &&
-                                (ch->ch_flag & CH_FAST_READ) != 0)
-                        wake_up_interruptible(&ch->ch_tun.un_tty->read_wait);
-
-                /*
-                 * Wake any thread waiting in the
-                 * fastcook loop.
-                 */
-
-                if ((ch->ch_flag & CH_INPUT) != 0) {
-                        ch->ch_flag &= ~CH_INPUT;
-                        wake_up_interruptible(&ch->ch_flag_wait);
-                }
-        }
-
-        /*
-         *  Fabricate and insert a data packet header to
-         *  preced the remaining data when it comes in.
-         */
-
-        if (remain < plen) {
-                dlen = plen - remain;
-                b = buf;
-
-                b[0] = 0x90 + n1;
-                put_unaligned_be16(dlen, b + 1);
-
-                remain = 3;
-                if (remain > 0 && b != buf)
-                        memcpy(buf, b, remain);
-
-                nd->nd_remain = remain;
-                return;
-        }
-}
-
 /**
  * dgrp_receive() -- decode data packets received from the remote PortServer.
  * @nd: pointer to a node structure
@@ -2477,8 +2306,7 @@ static void dgrp_receive(struct nd_struct *nd)
                         plen = dlen + 1;
 
                         dbuf = b + 1;
-                        handle_data_in_packet(nd, ch, dlen, plen, n1, dbuf);
-                        break;
+                        goto data;
 
                 /*
                  *  Process 2-byte header data packet.
@@ -2492,8 +2320,7 @@ static void dgrp_receive(struct nd_struct *nd)
                         plen = dlen + 2;
 
                         dbuf = b + 2;
-                        handle_data_in_packet(nd, ch, dlen, plen, n1, dbuf);
-                        break;
+                        goto data;
 
                 /*
                  *  Process 3-byte header data packet.
@@ -2508,6 +2335,159 @@ static void dgrp_receive(struct nd_struct *nd)
 
                         dbuf = b + 3;
 
+                /*
+                 *  Common packet handling code.
+                 */
+
+data:
+                        nd->nd_tx_work = 1;
+
+                        /*
+                         *  Otherwise data should appear only when we are
+                         *  in the CS_READY state.
+                         */
+
+                        if (ch->ch_state < CS_READY) {
+                                error = "Data received before RWIN established";
+                                goto prot_error;
+                        }
+
+                        /*
+                         *  Assure that the data received is within the
+                         *  allowable window.
+                         */
+
+                        n = (ch->ch_s_rwin - ch->ch_s_rin) & 0xffff;
+
+                        if (dlen > n) {
+                                error = "Receive data overrun";
+                                goto prot_error;
+                        }
+
+                        /*
+                         *  If we received 3 or less characters,
+                         *  assume it is a human typing, and set RTIME
+                         *  to 10 milliseconds.
+                         *
+                         *  If we receive 10 or more characters,
+                         *  assume its not a human typing, and set RTIME
+                         *  to 100 milliseconds.
+                         */
+
+                        if (ch->ch_edelay != DGRP_RTIME) {
+                                if (ch->ch_rtime != ch->ch_edelay) {
+                                        ch->ch_rtime = ch->ch_edelay;
+                                        ch->ch_flag |= CH_PARAM;
+                                }
+                        } else if (dlen <= 3) {
+                                if (ch->ch_rtime != 10) {
+                                        ch->ch_rtime = 10;
+                                        ch->ch_flag |= CH_PARAM;
+                                }
+                        } else {
+                                if (ch->ch_rtime != DGRP_RTIME) {
+                                        ch->ch_rtime = DGRP_RTIME;
+                                        ch->ch_flag |= CH_PARAM;
+                                }
+                        }
+
+                        /*
+                         *  If a portion of the packet is outside the
+                         *  buffer, shorten the effective length of the
+                         *  data packet to be the amount of data received.
+                         */
+
+                        if (remain < plen)
+                                dlen -= plen - remain;
+
+                        /*
+                         *  Detect if receive flush is now complete.
+                         */
+
+                        if ((ch->ch_flag & CH_RX_FLUSH) != 0 &&
+                            ((ch->ch_flush_seq - nd->nd_seq_out) & SEQ_MASK) >=
+                            ((nd->nd_seq_in    - nd->nd_seq_out) & SEQ_MASK)) {
+                                ch->ch_flag &= ~CH_RX_FLUSH;
+                        }
+
+                        /*
+                         *  If we are ready to receive, move the data into
+                         *  the receive buffer.
+                         */
+
+                        ch->ch_s_rin = (ch->ch_s_rin + dlen) & 0xffff;
+
+                        if (ch->ch_state == CS_READY &&
+                            (ch->ch_tun.un_open_count != 0) &&
+                            (ch->ch_tun.un_flag & UN_CLOSING) == 0 &&
+                            (ch->ch_cflag & CF_CREAD) != 0 &&
+                            (ch->ch_flag & (CH_BAUD0 | CH_RX_FLUSH)) == 0 &&
+                            (ch->ch_send & RR_RX_FLUSH) == 0) {
+
+                                if (ch->ch_rin + dlen >= RBUF_MAX) {
+                                        n = RBUF_MAX - ch->ch_rin;
+
+                                        memcpy(ch->ch_rbuf + ch->ch_rin, dbuf, n);
+
+                                        ch->ch_rin = 0;
+                                        dbuf += n;
+                                        dlen -= n;
+                                }
+
+                                memcpy(ch->ch_rbuf + ch->ch_rin, dbuf, dlen);
+
+                                ch->ch_rin += dlen;
+
+
+                                /*
+                                 *  If we are not in fastcook mode, or
+                                 *  if there is a fastcook thread
+                                 *  waiting for data, send the data to
+                                 *  the line discipline.
+                                 */
+
+                                if ((ch->ch_flag & CH_FAST_READ) == 0 ||
+                                    ch->ch_inwait != 0) {
+                                        dgrp_input(ch);
+                                }
+
+                                /*
+                                 *  If there is a read thread waiting
+                                 *  in select, and we are in fastcook
+                                 *  mode, wake him up.
+                                 */
+
+                                if (waitqueue_active(&ch->ch_tun.un_tty->read_wait) &&
+                                    (ch->ch_flag & CH_FAST_READ) != 0)
+                                        wake_up_interruptible(&ch->ch_tun.un_tty->read_wait);
+
+                                /*
+                                 * Wake any thread waiting in the
+                                 * fastcook loop.
+                                 */
+
+                                if ((ch->ch_flag & CH_INPUT) != 0) {
+                                        ch->ch_flag &= ~CH_INPUT;
+
+                                        wake_up_interruptible(&ch->ch_flag_wait);
+                                }
+                        }
+
+                        /*
+                         *  Fabricate and insert a data packet header to
+                         *  preced the remaining data when it comes in.
+                         */
+
+                        if (remain < plen) {
+                                dlen = plen - remain;
+                                b = buf;
+
+                                b[0] = 0x90 + n1;
+                                put_unaligned_be16(dlen, b + 1);
+
+                                remain = 3;
+                                goto done;
+                        }
                         break;
 
                 /*
diff --git a/drivers/staging/gdm72xx/gdm_usb.c b/drivers/staging/gdm72xx/gdm_usb.c
index f8788bf0a7d3..cdeffe75496b 100644
--- a/drivers/staging/gdm72xx/gdm_usb.c
+++ b/drivers/staging/gdm72xx/gdm_usb.c
@@ -635,11 +635,14 @@ static int gdm_usb_probe(struct usb_interface *intf,
 #endif /* CONFIG_WIMAX_GDM72XX_USB_PM */
 
         ret = register_wimax_device(phy_dev, &intf->dev);
+        if (ret)
+                release_usb(udev);
 
 out:
         if (ret) {
                 kfree(phy_dev);
                 kfree(udev);
+                usb_put_dev(usbdev);
         } else {
                 usb_set_intfdata(intf, phy_dev);
         }
diff --git a/drivers/staging/iio/Documentation/iio_utils.h b/drivers/staging/iio/Documentation/iio_utils.h
index 35154d60faf6..c9fedb79e3a2 100644
--- a/drivers/staging/iio/Documentation/iio_utils.h
+++ b/drivers/staging/iio/Documentation/iio_utils.h
@@ -77,7 +77,6 @@ struct iio_channel_info {
         uint64_t mask;
         unsigned be;
         unsigned is_signed;
-        unsigned enabled;
         unsigned location;
 };
 
@@ -335,6 +334,7 @@ inline int build_channel_array(const char *device_dir,
         while (ent = readdir(dp), ent != NULL) {
                 if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"),
                            "_en") == 0) {
+                        int current_enabled = 0;
                         current = &(*ci_array)[count++];
                         ret = asprintf(&filename,
                                        "%s/%s", scan_el_dir, ent->d_name);
@@ -350,10 +350,10 @@ inline int build_channel_array(const char *device_dir,
                                 ret = -errno;
                                 goto error_cleanup_array;
                         }
-                        fscanf(sysfsfp, "%u", &current->enabled);
+                        fscanf(sysfsfp, "%u", &current_enabled);
                         fclose(sysfsfp);
 
-                        if (!current->enabled) {
+                        if (!current_enabled) {
                                 free(filename);
                                 count--;
                                 continue;
diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c
index 5ea36410f716..5708ffc62aec 100644
--- a/drivers/staging/iio/adc/ad799x_core.c
+++ b/drivers/staging/iio/adc/ad799x_core.c
@@ -393,7 +393,7 @@ static const struct iio_event_spec ad799x_events[] = {
         }, {
                 .type = IIO_EV_TYPE_THRESH,
                 .dir = IIO_EV_DIR_FALLING,
-                .mask_separate = BIT(IIO_EV_INFO_VALUE),
+                .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                         BIT(IIO_EV_INFO_ENABLE),
         }, {
                 .type = IIO_EV_TYPE_THRESH,
@@ -409,7 +409,13 @@ static const struct iio_event_spec ad799x_events[] = {
         .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \
         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), \
         .scan_index = (_index), \
-        .scan_type = IIO_ST('u', _realbits, 16, 12 - (_realbits)), \
+        .scan_type = { \
+                .sign = 'u', \
+                .realbits = (_realbits), \
+                .storagebits = 16, \
+                .shift = 12 - (_realbits), \
+                .endianness = IIO_BE, \
+        }, \
         .event_spec = _ev_spec, \
         .num_event_specs = _num_ev_spec, \
 }
@@ -588,7 +594,8 @@ static int ad799x_probe(struct i2c_client *client,
         return 0;
 
 error_free_irq:
-        free_irq(client->irq, indio_dev);
+        if (client->irq > 0)
+                free_irq(client->irq, indio_dev);
 error_cleanup_ring:
         ad799x_ring_cleanup(indio_dev);
 error_disable_reg:
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index df71669bb60e..7fc66a6a6e36 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -1035,8 +1035,6 @@ SHOW_SCALE_AVAILABLE_ATTR(4);
 SHOW_SCALE_AVAILABLE_ATTR(5);
 SHOW_SCALE_AVAILABLE_ATTR(6);
 SHOW_SCALE_AVAILABLE_ATTR(7);
-SHOW_SCALE_AVAILABLE_ATTR(8);
-SHOW_SCALE_AVAILABLE_ATTR(9);
 SHOW_SCALE_AVAILABLE_ATTR(10);
 SHOW_SCALE_AVAILABLE_ATTR(11);
 SHOW_SCALE_AVAILABLE_ATTR(12);
@@ -1053,8 +1051,6 @@ static struct attribute *mxs_lradc_attributes[] = {
         &iio_dev_attr_in_voltage5_scale_available.dev_attr.attr,
         &iio_dev_attr_in_voltage6_scale_available.dev_attr.attr,
         &iio_dev_attr_in_voltage7_scale_available.dev_attr.attr,
-        &iio_dev_attr_in_voltage8_scale_available.dev_attr.attr,
-        &iio_dev_attr_in_voltage9_scale_available.dev_attr.attr,
         &iio_dev_attr_in_voltage10_scale_available.dev_attr.attr,
         &iio_dev_attr_in_voltage11_scale_available.dev_attr.attr,
         &iio_dev_attr_in_voltage12_scale_available.dev_attr.attr,
@@ -1613,7 +1609,7 @@ static int mxs_lradc_probe(struct platform_device *pdev)
                          * of the array.
                          */
                         scale_uv = ((u64)lradc->vref_mv[i] * 100000000) >>
-                                   (iio->channels[i].scan_type.realbits - s);
+                                   (LRADC_RESOLUTION - s);
                         lradc->scale_avail[i][s].nano =
                                         do_div(scale_uv, 100000000) * 10;
                         lradc->scale_avail[i][s].integer = scale_uv;
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 0a4298b744e6..2b96665da8a2 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -629,7 +629,7 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev)
         struct iio_buffer *buffer;
 
         buffer = iio_kfifo_allocate(indio_dev);
-        if (buffer)
+        if (!buffer)
                 return -ENOMEM;
 
         iio_device_attach_buffer(indio_dev, buffer);
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 09ef5fb8bae6..236ed66f116a 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -88,9 +88,9 @@ static int imx_drm_driver_unload(struct drm_device *drm)
 
         imx_drm_device_put();
 
-        drm_vblank_cleanup(imxdrm->drm);
-        drm_kms_helper_poll_fini(imxdrm->drm);
-        drm_mode_config_cleanup(imxdrm->drm);
+        drm_vblank_cleanup(drm);
+        drm_kms_helper_poll_fini(drm);
+        drm_mode_config_cleanup(drm);
 
         return 0;
 }
@@ -142,19 +142,19 @@ EXPORT_SYMBOL_GPL(imx_drm_crtc_panel_format);
 
 int imx_drm_crtc_vblank_get(struct imx_drm_crtc *imx_drm_crtc)
 {
-        return drm_vblank_get(imx_drm_crtc->imxdrm->drm, imx_drm_crtc->pipe);
+        return drm_vblank_get(imx_drm_crtc->crtc->dev, imx_drm_crtc->pipe);
 }
 EXPORT_SYMBOL_GPL(imx_drm_crtc_vblank_get);
 
 void imx_drm_crtc_vblank_put(struct imx_drm_crtc *imx_drm_crtc)
 {
-        drm_vblank_put(imx_drm_crtc->imxdrm->drm, imx_drm_crtc->pipe);
+        drm_vblank_put(imx_drm_crtc->crtc->dev, imx_drm_crtc->pipe);
 }
 EXPORT_SYMBOL_GPL(imx_drm_crtc_vblank_put);
 
 void imx_drm_handle_vblank(struct imx_drm_crtc *imx_drm_crtc)
 {
-        drm_handle_vblank(imx_drm_crtc->imxdrm->drm, imx_drm_crtc->pipe);
+        drm_handle_vblank(imx_drm_crtc->crtc->dev, imx_drm_crtc->pipe);
 }
 EXPORT_SYMBOL_GPL(imx_drm_handle_vblank);
 
@@ -370,29 +370,6 @@ static void imx_drm_connector_unregister(
 }
 
 /*
- * register a crtc to the drm core
- */
-static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
-{
-        struct imx_drm_device *imxdrm = __imx_drm_device();
-        int ret;
-
-        ret = drm_mode_crtc_set_gamma_size(imx_drm_crtc->crtc, 256);
-        if (ret)
-                return ret;
-
-        drm_crtc_helper_add(imx_drm_crtc->crtc,
-                        imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
-
-        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
-                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
-
-        drm_mode_group_reinit(imxdrm->drm);
-
-        return 0;
-}
-
-/*
  * Called by the CRTC driver when all CRTCs are registered. This
  * puts all the pieces together and initializes the driver.
  * Once this is called no more CRTCs can be registered since
@@ -424,15 +401,15 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
 
         mutex_lock(&imxdrm->mutex);
 
-        drm_kms_helper_poll_init(imxdrm->drm);
+        drm_kms_helper_poll_init(drm);
 
         /* setup the grouping for the legacy output */
-        ret = drm_mode_group_init_legacy_group(imxdrm->drm,
-                        &imxdrm->drm->primary->mode_group);
+        ret = drm_mode_group_init_legacy_group(drm,
+                        &drm->primary->mode_group);
         if (ret)
                 goto err_kms;
 
-        ret = drm_vblank_init(imxdrm->drm, MAX_CRTC);
+        ret = drm_vblank_init(drm, MAX_CRTC);
         if (ret)
                 goto err_kms;
 
@@ -441,7 +418,7 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
          * by drm timer once a current process gives up ownership of
          * vblank event.(after drm_vblank_put function is called)
          */
-        imxdrm->drm->vblank_disable_allowed = true;
+        drm->vblank_disable_allowed = true;
 
         if (!imx_drm_device_get()) {
                 ret = -EINVAL;
@@ -536,10 +513,18 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
 
         *new_crtc = imx_drm_crtc;
 
-        ret = imx_drm_crtc_register(imx_drm_crtc);
+        ret = drm_mode_crtc_set_gamma_size(imx_drm_crtc->crtc, 256);
         if (ret)
                 goto err_register;
 
+        drm_crtc_helper_add(crtc,
+                        imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
+
+        drm_crtc_init(imxdrm->drm, crtc,
+                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
+
+        drm_mode_group_reinit(imxdrm->drm);
+
         imx_drm_update_possible_crtcs();
 
         mutex_unlock(&imxdrm->mutex);
diff --git a/drivers/staging/imx-drm/imx-hdmi.c b/drivers/staging/imx-drm/imx-hdmi.c
index f3a1f5e2e492..62ce0e86f14b 100644
--- a/drivers/staging/imx-drm/imx-hdmi.c
+++ b/drivers/staging/imx-drm/imx-hdmi.c
@@ -16,6 +16,7 @@
 #include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/clk.h>
+#include <linux/hdmi.h>
 #include <linux/regmap.h>
 #include <linux/mfd/syscon.h>
 #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
@@ -52,11 +53,6 @@ enum hdmi_datamap {
         YCbCr422_12B = 0x12,
 };
 
-enum hdmi_colorimetry {
-        ITU601,
-        ITU709,
-};
-
 enum imx_hdmi_devtype {
         IMX6Q_HDMI,
         IMX6DL_HDMI,
@@ -489,12 +485,12 @@ static void imx_hdmi_update_csc_coeffs(struct imx_hdmi *hdmi)
 
         if (is_color_space_conversion(hdmi)) {
                 if (hdmi->hdmi_data.enc_out_format == RGB) {
-                        if (hdmi->hdmi_data.colorimetry == ITU601)
+                        if (hdmi->hdmi_data.colorimetry == HDMI_COLORIMETRY_ITU_601)
                                 csc_coeff = &csc_coeff_rgb_out_eitu601;
                         else
                                 csc_coeff = &csc_coeff_rgb_out_eitu709;
                 } else if (hdmi->hdmi_data.enc_in_format == RGB) {
-                        if (hdmi->hdmi_data.colorimetry == ITU601)
+                        if (hdmi->hdmi_data.colorimetry == HDMI_COLORIMETRY_ITU_601)
                                 csc_coeff = &csc_coeff_rgb_in_eitu601;
                         else
                                 csc_coeff = &csc_coeff_rgb_in_eitu709;
@@ -1140,16 +1136,16 @@ static void hdmi_config_AVI(struct imx_hdmi *hdmi)
         /* Set up colorimetry */
         if (hdmi->hdmi_data.enc_out_format == XVYCC444) {
                 colorimetry = HDMI_FC_AVICONF1_COLORIMETRY_EXTENDED_INFO;
-                if (hdmi->hdmi_data.colorimetry == ITU601)
+                if (hdmi->hdmi_data.colorimetry == HDMI_COLORIMETRY_ITU_601)
                         ext_colorimetry =
                                 HDMI_FC_AVICONF2_EXT_COLORIMETRY_XVYCC601;
-                else /* hdmi->hdmi_data.colorimetry == ITU709 */
+                else /*hdmi->hdmi_data.colorimetry == HDMI_COLORIMETRY_ITU_709*/
                         ext_colorimetry =
                                 HDMI_FC_AVICONF2_EXT_COLORIMETRY_XVYCC709;
         } else if (hdmi->hdmi_data.enc_out_format != RGB) {
-                if (hdmi->hdmi_data.colorimetry == ITU601)
+                if (hdmi->hdmi_data.colorimetry == HDMI_COLORIMETRY_ITU_601)
                         colorimetry = HDMI_FC_AVICONF1_COLORIMETRY_SMPTE;
-                else /* hdmi->hdmi_data.colorimetry == ITU709 */
+                else /*hdmi->hdmi_data.colorimetry == HDMI_COLORIMETRY_ITU_709*/
                         colorimetry = HDMI_FC_AVICONF1_COLORIMETRY_ITUR;
                 ext_colorimetry = HDMI_FC_AVICONF2_EXT_COLORIMETRY_XVYCC601;
         } else { /* Carries no data */
@@ -1379,9 +1375,9 @@ static int imx_hdmi_setup(struct imx_hdmi *hdmi, struct drm_display_mode *mode)
                 (hdmi->vic == 21) || (hdmi->vic == 22) ||
                 (hdmi->vic == 2) || (hdmi->vic == 3) ||
                 (hdmi->vic == 17) || (hdmi->vic == 18))
-                hdmi->hdmi_data.colorimetry = ITU601;
+                hdmi->hdmi_data.colorimetry = HDMI_COLORIMETRY_ITU_601;
         else
-                hdmi->hdmi_data.colorimetry = ITU709;
+                hdmi->hdmi_data.colorimetry = HDMI_COLORIMETRY_ITU_709;
 
         if ((hdmi->vic == 10) || (hdmi->vic == 11) ||
                 (hdmi->vic == 12) || (hdmi->vic == 13) ||
diff --git a/drivers/staging/lustre/TODO b/drivers/staging/lustre/TODO
index 22742d6d62a8..0a2b6cb3775e 100644
--- a/drivers/staging/lustre/TODO
+++ b/drivers/staging/lustre/TODO
@@ -9,5 +9,6 @@
 * Other minor misc cleanups...
 
 Please send any patches to Greg Kroah-Hartman <greg@kroah.com>, Andreas Dilger
-<andreas.dilger@intel.com> and Peng Tao <tao.peng@emc.com>. CCing
-hpdd-discuss <hpdd-discuss@lists.01.org> would be great too.
+<andreas.dilger@intel.com>, Oleg Drokin <oleg.drokin@intel.com> and
+Peng Tao <tao.peng@emc.com>. CCing hpdd-discuss <hpdd-discuss@lists.01.org>
+would be great too.
diff --git a/drivers/staging/lustre/include/linux/libcfs/libcfs_kernelcomm.h b/drivers/staging/lustre/include/linux/libcfs/libcfs_kernelcomm.h
index 596a15fc8996..037ae8a6d531 100644
--- a/drivers/staging/lustre/include/linux/libcfs/libcfs_kernelcomm.h
+++ b/drivers/staging/lustre/include/linux/libcfs/libcfs_kernelcomm.h
@@ -61,6 +61,8 @@ struct kuc_hdr {
         __u16 kuc_msglen;     /* Including header */
 } __attribute__((aligned(sizeof(__u64))));
 
+#define KUC_CHANGELOG_MSG_MAXSIZE (sizeof(struct kuc_hdr)+CR_MAXSIZE)
+
 #define KUC_MAGIC  0x191C /*Lustre9etLinC */
 #define KUC_FL_BLOCK 0x01   /* Wait for send */
 
diff --git a/drivers/staging/lustre/include/linux/libcfs/libcfs_private.h b/drivers/staging/lustre/include/linux/libcfs/libcfs_private.h
index d0d942ced01a..dddccca120c9 100644
--- a/drivers/staging/lustre/include/linux/libcfs/libcfs_private.h
+++ b/drivers/staging/lustre/include/linux/libcfs/libcfs_private.h
@@ -120,7 +120,7 @@ do {						\
 do {                                                                        \
         LASSERT(!in_interrupt() ||                                          \
                 ((size) <= LIBCFS_VMALLOC_SIZE &&                           \
-                 ((mask) & GFP_ATOMIC)) != 0);                      \
+                 ((mask) & __GFP_WAIT) == 0));                              \
 } while (0)
 
 #define LIBCFS_ALLOC_POST(ptr, size)                                        \
diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
index 93648632ba26..6f58ead20393 100644
--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
@@ -529,7 +529,7 @@ kiblnd_kvaddr_to_page (unsigned long vaddr)
 {
         struct page *page;
 
-        if (is_vmalloc_addr(vaddr)) {
+        if (is_vmalloc_addr((void *)vaddr)) {
                 page = vmalloc_to_page ((void *)vaddr);
                 LASSERT (page != NULL);
                 return page;
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
index 68a4f52ec998..b7b53b579c85 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
@@ -924,7 +924,7 @@ ksocknal_launch_packet (lnet_ni_t *ni, ksock_tx_t *tx, lnet_process_id_t id)
 int
 ksocknal_send(lnet_ni_t *ni, void *private, lnet_msg_t *lntmsg)
 {
-        int            mpflag = 0;
+        int            mpflag = 1;
         int            type = lntmsg->msg_type;
         lnet_process_id_t target = lntmsg->msg_target;
         unsigned int      payload_niov = lntmsg->msg_niov;
@@ -993,8 +993,9 @@ ksocknal_send(lnet_ni_t *ni, void *private, lnet_msg_t *lntmsg)
 
         /* The first fragment will be set later in pro_pack */
         rc = ksocknal_launch_packet(ni, tx, target);
-        if (lntmsg->msg_vmflush)
+        if (!mpflag)
                 cfs_memory_pressure_restore(mpflag);
+
         if (rc == 0)
                 return (0);
 
diff --git a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
index 6b6c0240e824..7893d83e131f 100644
--- a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
+++ b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
@@ -760,7 +760,8 @@ static inline void hsm_set_cl_error(int *flags, int error)
         *flags |= (error << CLF_HSM_ERR_L);
 }
 
-#define CR_MAXSIZE cfs_size_round(2*NAME_MAX + 1 + sizeof(struct changelog_rec))
+#define CR_MAXSIZE cfs_size_round(2*NAME_MAX + 1 + \
+                                  sizeof(struct changelog_ext_rec))
 
 struct changelog_rec {
         __u16            cr_namelen;
diff --git a/drivers/staging/lustre/lustre/llite/dir.c b/drivers/staging/lustre/lustre/llite/dir.c
index 22d0acc95bc5..52b7731bcc38 100644
--- a/drivers/staging/lustre/lustre/llite/dir.c
+++ b/drivers/staging/lustre/lustre/llite/dir.c
@@ -1086,7 +1086,7 @@ static int quotactl_ioctl(struct ll_sb_info *sbi, struct if_quotactl *qctl)
                 break;
         case Q_GETQUOTA:
                 if (((type == USRQUOTA &&
-                      uid_eq(current_euid(), make_kuid(&init_user_ns, id))) ||
+                      !uid_eq(current_euid(), make_kuid(&init_user_ns, id))) ||
                      (type == GRPQUOTA &&
                       !in_egroup_p(make_kgid(&init_user_ns, id)))) &&
                     (!cfs_capable(CFS_CAP_SYS_ADMIN) ||
diff --git a/drivers/staging/lustre/lustre/mdc/mdc_request.c b/drivers/staging/lustre/lustre/mdc/mdc_request.c
index d1ad91c34ddc..83013927e131 100644
--- a/drivers/staging/lustre/lustre/mdc/mdc_request.c
+++ b/drivers/staging/lustre/lustre/mdc/mdc_request.c
@@ -1430,7 +1430,7 @@ static struct kuc_hdr *changelog_kuc_hdr(char *buf, int len, int flags)
 {
         struct kuc_hdr *lh = (struct kuc_hdr *)buf;
 
-        LASSERT(len <= CR_MAXSIZE);
+        LASSERT(len <= KUC_CHANGELOG_MSG_MAXSIZE);
 
         lh->kuc_magic = KUC_MAGIC;
         lh->kuc_transport = KUC_TRANSPORT_CHANGELOG;
@@ -1503,7 +1503,7 @@ static int mdc_changelog_send_thread(void *csdata)
         CDEBUG(D_CHANGELOG, "changelog to fp=%p start "LPU64"\n",
                cs->cs_fp, cs->cs_startrec);
 
-        OBD_ALLOC(cs->cs_buf, CR_MAXSIZE);
+        OBD_ALLOC(cs->cs_buf, KUC_CHANGELOG_MSG_MAXSIZE);
         if (cs->cs_buf == NULL)
                 GOTO(out, rc = -ENOMEM);
 
@@ -1540,7 +1540,7 @@ out:
         if (ctxt)
                 llog_ctxt_put(ctxt);
         if (cs->cs_buf)
-                OBD_FREE(cs->cs_buf, CR_MAXSIZE);
+                OBD_FREE(cs->cs_buf, KUC_CHANGELOG_MSG_MAXSIZE);
         OBD_FREE_PTR(cs);
         return rc;
 }
diff --git a/drivers/staging/netlogic/xlr_net.c b/drivers/staging/netlogic/xlr_net.c
index eedffed17e39..31b269a5fff7 100644
--- a/drivers/staging/netlogic/xlr_net.c
+++ b/drivers/staging/netlogic/xlr_net.c
@@ -307,7 +307,7 @@ static netdev_tx_t xlr_net_start_xmit(struct sk_buff *skb,
 }
 
 static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb,
-                                void *accel_priv)
+                                void *accel_priv, select_queue_fallback_t fallback)
 {
         return (u16)smp_processor_id();
 }
@@ -892,6 +892,11 @@ static int xlr_setup_mdio(struct xlr_net_priv *priv,
         priv->mii_bus->write = xlr_mii_write;
         priv->mii_bus->parent = &pdev->dev;
         priv->mii_bus->irq = kmalloc(sizeof(int)*PHY_MAX_ADDR, GFP_KERNEL);
+        if (priv->mii_bus->irq == NULL) {
+                pr_err("irq alloc failed\n");
+                mdiobus_free(priv->mii_bus);
+                return -ENOMEM;
+        }
         priv->mii_bus->irq[priv->phy_addr] = priv->ndev->irq;
 
         /* Scan only the enabled address */
diff --git a/drivers/staging/octeon-usb/octeon-hcd.c b/drivers/staging/octeon-usb/octeon-hcd.c
index 47e0a91238a1..5a001d9b4252 100644
--- a/drivers/staging/octeon-usb/octeon-hcd.c
+++ b/drivers/staging/octeon-usb/octeon-hcd.c
@@ -275,13 +275,6 @@ enum cvmx_usb_pipe_flags {
  */
 #define MAX_TRANSFER_PACKETS    ((1<<10)-1)
 
-enum {
-        USB_CLOCK_TYPE_REF_12,
-        USB_CLOCK_TYPE_REF_24,
-        USB_CLOCK_TYPE_REF_48,
-        USB_CLOCK_TYPE_CRYSTAL_12,
-};
-
 /**
  * Logical transactions may take numerous low level
  * transactions, especially when splits are concerned. This
@@ -471,19 +464,6 @@ struct octeon_hcd {
 /* Returns the IO address to push/pop stuff data from the FIFOs */
 #define USB_FIFO_ADDRESS(channel, usb_index) (CVMX_USBCX_GOTGCTL(usb_index) + ((channel)+1)*0x1000)
 
-static int octeon_usb_get_clock_type(void)
-{
-        switch (cvmx_sysinfo_get()->board_type) {
-        case CVMX_BOARD_TYPE_BBGW_REF:
-        case CVMX_BOARD_TYPE_LANAI2_A:
-        case CVMX_BOARD_TYPE_LANAI2_U:
-        case CVMX_BOARD_TYPE_LANAI2_G:
-        case CVMX_BOARD_TYPE_UBNT_E100:
-                return USB_CLOCK_TYPE_CRYSTAL_12;
-        }
-        return USB_CLOCK_TYPE_REF_48;
-}
-
 /**
  * Read a USB 32bit CSR. It performs the necessary address swizzle
  * for 32bit CSRs and logs the value in a readable format if
@@ -582,37 +562,6 @@ static inline int __cvmx_usb_get_data_pid(struct cvmx_usb_pipe *pipe)
                 return 0; /* Data0 */
 }
 
-
-/**
- * Return the number of USB ports supported by this Octeon
- * chip. If the chip doesn't support USB, or is not supported
- * by this API, a zero will be returned. Most Octeon chips
- * support one usb port, but some support two ports.
- * cvmx_usb_initialize() must be called on independent
- * struct cvmx_usb_state.
- *
- * Returns: Number of port, zero if usb isn't supported
- */
-static int cvmx_usb_get_num_ports(void)
-{
-        int arch_ports = 0;
-
-        if (OCTEON_IS_MODEL(OCTEON_CN56XX))
-                arch_ports = 1;
-        else if (OCTEON_IS_MODEL(OCTEON_CN52XX))
-                arch_ports = 2;
-        else if (OCTEON_IS_MODEL(OCTEON_CN50XX))
-                arch_ports = 1;
-        else if (OCTEON_IS_MODEL(OCTEON_CN31XX))
-                arch_ports = 1;
-        else if (OCTEON_IS_MODEL(OCTEON_CN30XX))
-                arch_ports = 1;
-        else
-                arch_ports = 0;
-
-        return arch_ports;
-}
-
 /**
  * Initialize a USB port for use. This must be called before any
  * other access to the Octeon USB port is made. The port starts
@@ -628,41 +577,16 @@ static int cvmx_usb_get_num_ports(void)
  * Returns: 0 or a negative error code.
  */
 static int cvmx_usb_initialize(struct cvmx_usb_state *usb,
-                               int usb_port_number)
+                               int usb_port_number,
+                               enum cvmx_usb_initialize_flags flags)
 {
         union cvmx_usbnx_clk_ctl usbn_clk_ctl;
         union cvmx_usbnx_usbp_ctl_status usbn_usbp_ctl_status;
-        enum cvmx_usb_initialize_flags flags = 0;
         int i;
 
         /* At first allow 0-1 for the usb port number */
         if ((usb_port_number < 0) || (usb_port_number > 1))
                 return -EINVAL;
-        /* For all chips except 52XX there is only one port */
-        if (!OCTEON_IS_MODEL(OCTEON_CN52XX) && (usb_port_number > 0))
-                return -EINVAL;
-        /* Try to determine clock type automatically */
-        if (octeon_usb_get_clock_type() == USB_CLOCK_TYPE_CRYSTAL_12) {
-                /* Only 12 MHZ crystals are supported */
-                flags |= CVMX_USB_INITIALIZE_FLAGS_CLOCK_XO_XI;
-        } else {
-                flags |= CVMX_USB_INITIALIZE_FLAGS_CLOCK_XO_GND;
-
-                switch (octeon_usb_get_clock_type()) {
-                case USB_CLOCK_TYPE_REF_12:
-                        flags |= CVMX_USB_INITIALIZE_FLAGS_CLOCK_12MHZ;
-                        break;
-                case USB_CLOCK_TYPE_REF_24:
-                        flags |= CVMX_USB_INITIALIZE_FLAGS_CLOCK_24MHZ;
-                        break;
-                case USB_CLOCK_TYPE_REF_48:
-                        flags |= CVMX_USB_INITIALIZE_FLAGS_CLOCK_48MHZ;
-                        break;
-                default:
-                        return -EINVAL;
-                        break;
-                }
-        }
 
         memset(usb, 0, sizeof(*usb));
         usb->init_flags = flags;
@@ -3431,7 +3355,6 @@ static int octeon_usb_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
         return 0;
 }
 
-
 static const struct hc_driver octeon_hc_driver = {
         .description            = "Octeon USB",
         .product_desc           = "Octeon Host Controller",
@@ -3448,15 +3371,74 @@ static const struct hc_driver octeon_hc_driver = {
         .hub_control            = octeon_usb_hub_control,
 };
 
-
-static int octeon_usb_driver_probe(struct device *dev)
+static int octeon_usb_probe(struct platform_device *pdev)
 {
         int status;
-        int usb_num = to_platform_device(dev)->id;
-        int irq = platform_get_irq(to_platform_device(dev), 0);
+        int initialize_flags;
+        int usb_num;
+        struct resource *res_mem;
+        struct device_node *usbn_node;
+        int irq = platform_get_irq(pdev, 0);
+        struct device *dev = &pdev->dev;
         struct octeon_hcd *priv;
         struct usb_hcd *hcd;
         unsigned long flags;
+        u32 clock_rate = 48000000;
+        bool is_crystal_clock = false;
+        const char *clock_type;
+        int i;
+
+        if (dev->of_node == NULL) {
+                dev_err(dev, "Error: empty of_node\n");
+                return -ENXIO;
+        }
+        usbn_node = dev->of_node->parent;
+
+        i = of_property_read_u32(usbn_node,
+                                 "refclk-frequency", &clock_rate);
+        if (i) {
+                dev_err(dev, "No USBN \"refclk-frequency\"\n");
+                return -ENXIO;
+        }
+        switch (clock_rate) {
+        case 12000000:
+                initialize_flags = CVMX_USB_INITIALIZE_FLAGS_CLOCK_12MHZ;
+                break;
+        case 24000000:
+                initialize_flags = CVMX_USB_INITIALIZE_FLAGS_CLOCK_24MHZ;
+                break;
+        case 48000000:
+                initialize_flags = CVMX_USB_INITIALIZE_FLAGS_CLOCK_48MHZ;
+                break;
+        default:
+                dev_err(dev, "Illebal USBN \"refclk-frequency\" %u\n", clock_rate);
+                return -ENXIO;
+
+        }
+
+        i = of_property_read_string(usbn_node,
+                                    "refclk-type", &clock_type);
+
+        if (!i && strcmp("crystal", clock_type) == 0)
+                is_crystal_clock = true;
+
+        if (is_crystal_clock)
+                initialize_flags |= CVMX_USB_INITIALIZE_FLAGS_CLOCK_XO_XI;
+        else
+                initialize_flags |= CVMX_USB_INITIALIZE_FLAGS_CLOCK_XO_GND;
+
+        res_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res_mem == NULL) {
+                dev_err(dev, "found no memory resource\n");
+                return -ENXIO;
+        }
+        usb_num = (res_mem->start >> 44) & 1;
+
+        if (irq < 0) {
+                /* Defective device tree, but we know how to fix it. */
+                irq_hw_number_t hwirq = usb_num ? (1 << 6) + 17 : 56;
+                irq = irq_create_mapping(NULL, hwirq);
+        }
 
         /*
          * Set the DMA mask to 64bits so we get buffers already translated for
@@ -3465,6 +3447,26 @@ static int octeon_usb_driver_probe(struct device *dev)
         dev->coherent_dma_mask = ~0;
         dev->dma_mask = &dev->coherent_dma_mask;
 
+        /*
+         * Only cn52XX and cn56XX have DWC_OTG USB hardware and the
+         * IOB priority registers.  Under heavy network load USB
+         * hardware can be starved by the IOB causing a crash.  Give
+         * it a priority boost if it has been waiting more than 400
+         * cycles to avoid this situation.
+         *
+         * Testing indicates that a cnt_val of 8192 is not sufficient,
+         * but no failures are seen with 4096.  We choose a value of
+         * 400 to give a safety factor of 10.
+         */
+        if (OCTEON_IS_MODEL(OCTEON_CN52XX) || OCTEON_IS_MODEL(OCTEON_CN56XX)) {
+                union cvmx_iob_n2c_l2c_pri_cnt pri_cnt;
+
+                pri_cnt.u64 = 0;
+                pri_cnt.s.cnt_enb = 1;
+                pri_cnt.s.cnt_val = 400;
+                cvmx_write_csr(CVMX_IOB_N2C_L2C_PRI_CNT, pri_cnt.u64);
+        }
+
         hcd = usb_create_hcd(&octeon_hc_driver, dev, dev_name(dev));
         if (!hcd) {
                 dev_dbg(dev, "Failed to allocate memory for HCD\n");
@@ -3478,7 +3480,7 @@ static int octeon_usb_driver_probe(struct device *dev)
         tasklet_init(&priv->dequeue_tasklet, octeon_usb_urb_dequeue_work, (unsigned long)priv);
         INIT_LIST_HEAD(&priv->dequeue_list);
 
-        status = cvmx_usb_initialize(&priv->usb, usb_num);
+        status = cvmx_usb_initialize(&priv->usb, usb_num, initialize_flags);
         if (status) {
                 dev_dbg(dev, "USB initialization failed with %d\n", status);
                 kfree(hcd);
@@ -3492,7 +3494,7 @@ static int octeon_usb_driver_probe(struct device *dev)
         cvmx_usb_poll(&priv->usb);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        status = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        status = usb_add_hcd(hcd, irq, 0);
         if (status) {
                 dev_dbg(dev, "USB add HCD failed with %d\n", status);
                 kfree(hcd);
@@ -3500,14 +3502,15 @@ static int octeon_usb_driver_probe(struct device *dev)
         }
         device_wakeup_enable(hcd->self.controller);
 
-        dev_dbg(dev, "Registered HCD for port %d on irq %d\n", usb_num, irq);
+        dev_info(dev, "Registered HCD for port %d on irq %d\n", usb_num, irq);
 
         return 0;
 }
 
-static int octeon_usb_driver_remove(struct device *dev)
+static int octeon_usb_remove(struct platform_device *pdev)
 {
         int status;
+        struct device *dev = &pdev->dev;
         struct usb_hcd *hcd = dev_get_drvdata(dev);
         struct octeon_hcd *priv = hcd_to_octeon(hcd);
         unsigned long flags;
@@ -3525,85 +3528,41 @@ static int octeon_usb_driver_remove(struct device *dev)
         return 0;
 }
 
-static struct device_driver octeon_usb_driver = {
-        .name   = "OcteonUSB",
-        .bus    = &platform_bus_type,
-        .probe  = octeon_usb_driver_probe,
-        .remove = octeon_usb_driver_remove,
+static struct of_device_id octeon_usb_match[] = {
+        {
+                .compatible = "cavium,octeon-5750-usbc",
+        },
+        {},
 };
 
+static struct platform_driver octeon_usb_driver = {
+        .driver = {
+                .name       = "OcteonUSB",
+                .owner          = THIS_MODULE,
+                .of_match_table = octeon_usb_match,
+        },
+        .probe      = octeon_usb_probe,
+        .remove     = octeon_usb_remove,
+};
 
-#define MAX_USB_PORTS   10
-static struct platform_device *pdev_glob[MAX_USB_PORTS];
-static int octeon_usb_registered;
-static int __init octeon_usb_module_init(void)
+static int __init octeon_usb_driver_init(void)
 {
-        int num_devices = cvmx_usb_get_num_ports();
-        int device;
-
-        if (usb_disabled() || num_devices == 0)
-                return -ENODEV;
-
-        if (driver_register(&octeon_usb_driver))
-                return -ENOMEM;
-
-        octeon_usb_registered = 1;
-
-        /*
-         * Only cn52XX and cn56XX have DWC_OTG USB hardware and the
-         * IOB priority registers.  Under heavy network load USB
-         * hardware can be starved by the IOB causing a crash.  Give
-         * it a priority boost if it has been waiting more than 400
-         * cycles to avoid this situation.
-         *
-         * Testing indicates that a cnt_val of 8192 is not sufficient,
-         * but no failures are seen with 4096.  We choose a value of
-         * 400 to give a safety factor of 10.
-         */
-        if (OCTEON_IS_MODEL(OCTEON_CN52XX) || OCTEON_IS_MODEL(OCTEON_CN56XX)) {
-                union cvmx_iob_n2c_l2c_pri_cnt pri_cnt;
-
-                pri_cnt.u64 = 0;
-                pri_cnt.s.cnt_enb = 1;
-                pri_cnt.s.cnt_val = 400;
-                cvmx_write_csr(CVMX_IOB_N2C_L2C_PRI_CNT, pri_cnt.u64);
-        }
-
-        for (device = 0; device < num_devices; device++) {
-                struct resource irq_resource;
-                struct platform_device *pdev;
-                memset(&irq_resource, 0, sizeof(irq_resource));
-                irq_resource.start = (device == 0) ? OCTEON_IRQ_USB0 : OCTEON_IRQ_USB1;
-                irq_resource.end = irq_resource.start;
-                irq_resource.flags = IORESOURCE_IRQ;
-                pdev = platform_device_register_simple((char *)octeon_usb_driver.  name, device, &irq_resource, 1);
-                if (IS_ERR(pdev)) {
-                        driver_unregister(&octeon_usb_driver);
-                        octeon_usb_registered = 0;
-                        return PTR_ERR(pdev);
-                }
-                if (device < MAX_USB_PORTS)
-                        pdev_glob[device] = pdev;
+        if (usb_disabled())
+                return 0;
 
-        }
-        return 0;
+        return platform_driver_register(&octeon_usb_driver);
 }
+module_init(octeon_usb_driver_init);
 
-static void __exit octeon_usb_module_cleanup(void)
+static void __exit octeon_usb_driver_exit(void)
 {
-        int i;
+        if (usb_disabled())
+                return;
 
-        for (i = 0; i < MAX_USB_PORTS; i++)
-                if (pdev_glob[i]) {
-                        platform_device_unregister(pdev_glob[i]);
-                        pdev_glob[i] = NULL;
-                }
-        if (octeon_usb_registered)
-                driver_unregister(&octeon_usb_driver);
+        platform_driver_unregister(&octeon_usb_driver);
 }
+module_exit(octeon_usb_driver_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Cavium Networks <support@caviumnetworks.com>");
-MODULE_DESCRIPTION("Cavium Networks Octeon USB Host driver.");
-module_init(octeon_usb_module_init);
-module_exit(octeon_usb_module_cleanup);
+MODULE_AUTHOR("Cavium, Inc. <support@cavium.com>");
+MODULE_DESCRIPTION("Cavium Inc. OCTEON USB Host driver.");
diff --git a/drivers/staging/ozwpan/ozproto.c b/drivers/staging/ozwpan/ozproto.c
index cb060364dfe7..5d965cf06d59 100644
--- a/drivers/staging/ozwpan/ozproto.c
+++ b/drivers/staging/ozwpan/ozproto.c
@@ -668,8 +668,8 @@ void oz_binding_add(const char *net_dev)
         if (binding) {
                 binding->ptype.type = __constant_htons(OZ_ETHERTYPE);
                 binding->ptype.func = oz_pkt_recv;
-                memcpy(binding->name, net_dev, OZ_MAX_BINDING_LEN);
                 if (net_dev && *net_dev) {
+                        memcpy(binding->name, net_dev, OZ_MAX_BINDING_LEN);
                         oz_dbg(ON, "Adding binding: %s\n", net_dev);
                         binding->ptype.dev =
                                 dev_get_by_name(&init_net, net_dev);
@@ -680,6 +680,7 @@ void oz_binding_add(const char *net_dev)
                         }
                 } else {
                         oz_dbg(ON, "Binding to all netcards\n");
+                        memset(binding->name, 0, OZ_MAX_BINDING_LEN);
                         binding->ptype.dev = NULL;
                 }
                 if (binding) {
diff --git a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
index 153ec61493ab..96df62f95b6b 100644
--- a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
@@ -912,12 +912,12 @@ int rtw_check_bcn_info(struct adapter  *Adapter, u8 *pframe, u32 packet_len)
         unsigned char *pbuf;
         u32 wpa_ielen = 0;
         u8 *pbssid = GetAddr3Ptr(pframe);
-        u32 hidden_ssid = 0;
         struct HT_info_element *pht_info = NULL;
         struct rtw_ieee80211_ht_cap *pht_cap = NULL;
         u32 bcn_channel;
         unsigned short  ht_cap_info;
         unsigned char   ht_info_infos_0;
+        int ssid_len;
 
         if (is_client_associated_to_ap(Adapter) == false)
                 return true;
@@ -999,21 +999,15 @@ int rtw_check_bcn_info(struct adapter  *Adapter, u8 *pframe, u32 packet_len)
         }
 
         /* checking SSID */
+        ssid_len = 0;
         p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _SSID_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
-        if (p == NULL) {
-                DBG_88E("%s marc: cannot find SSID for survey event\n", __func__);
-                hidden_ssid = true;
-        } else {
-                hidden_ssid = false;
-        }
-
-        if ((NULL != p) && (false == hidden_ssid && (*(p + 1)))) {
-                memcpy(bssid->Ssid.Ssid, (p + 2), *(p + 1));
-                bssid->Ssid.SsidLength = *(p + 1);
-        } else {
-                bssid->Ssid.SsidLength = 0;
-                bssid->Ssid.Ssid[0] = '\0';
+        if (p) {
+                ssid_len = *(p + 1);
+                if (ssid_len > NDIS_802_11_LENGTH_SSID)
+                        ssid_len = 0;
         }
+        memcpy(bssid->Ssid.Ssid, (p + 2), ssid_len);
+        bssid->Ssid.SsidLength = ssid_len;
 
         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("%s bssid.Ssid.Ssid:%s bssid.Ssid.SsidLength:%d "
                                 "cur_network->network.Ssid.Ssid:%s len:%d\n", __func__, bssid->Ssid.Ssid,
diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index dec992569476..4ad80ae1067f 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -2500,7 +2500,7 @@ static int rtw_mp_ioctl_hdl(struct net_device *dev, struct iw_request_info *info
                  ("rtw_mp_ioctl_hdl: subcode [%d], len[%d], buffer_len[%d]\r\n",
                   poidparam->subcode, poidparam->len, len));
 
-        if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
+        if (poidparam->subcode >= ARRAY_SIZE(mp_ioctl_hdl)) {
                 RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_err_, ("no matching drvext subcodes\r\n"));
                 ret = -EINVAL;
                 goto _rtw_mp_ioctl_hdl_exit;
@@ -3164,9 +3164,7 @@ static int rtw_p2p_get_go_device_address(struct net_device *dev,
         u8 *p2pie;
         uint p2pielen = 0, attr_contentlen = 0;
         u8 attr_content[100] = {0x00};
-
-        u8 go_devadd_str[17 + 10] = {0x00};
-        /*  +10 is for the str "go_devadd =", we have to clear it at wrqu->data.pointer */
+        u8 go_devadd_str[17 + 12] = {};
 
         /*      Commented by Albert 20121209 */
         /*      The input data is the GO's interface address which the application wants to know its device address. */
@@ -3223,12 +3221,12 @@ static int rtw_p2p_get_go_device_address(struct net_device *dev,
         spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
 
         if (!blnMatch)
-                sprintf(go_devadd_str, "\n\ndev_add = NULL");
+                snprintf(go_devadd_str, sizeof(go_devadd_str), "\n\ndev_add = NULL");
         else
-                sprintf(go_devadd_str, "\n\ndev_add =%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+                snprintf(go_devadd_str, sizeof(go_devadd_str), "\n\ndev_add =%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
                         attr_content[0], attr_content[1], attr_content[2], attr_content[3], attr_content[4], attr_content[5]);
 
-        if (copy_to_user(wrqu->data.pointer, go_devadd_str, 10 + 17))
+        if (copy_to_user(wrqu->data.pointer, go_devadd_str, sizeof(go_devadd_str)))
                 return -EFAULT;
         return ret;
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/os_intfs.c b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
index 68f98fa114d2..7c9ee58f47bb 100644
--- a/drivers/staging/rtl8188eu/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
@@ -653,7 +653,7 @@ static unsigned int rtw_classify8021d(struct sk_buff *skb)
 }
 
 static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
-                            void *accel_priv)
+                            void *accel_priv, select_queue_fallback_t fallback)
 {
         struct adapter  *padapter = rtw_netdev_priv(dev);
         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 0a341d6ec51f..a70dcef1419e 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -53,7 +53,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */
         /*=== Customer ID ===*/
         /****** 8188EUS ********/
-        {USB_DEVICE(0x8179, 0x07B8)}, /* Abocom - Abocom */
+        {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {}      /* Terminating entry */
 };
diff --git a/drivers/staging/rtl8821ae/Kconfig b/drivers/staging/rtl8821ae/Kconfig
index 2aa5dac2f1df..abccc9dabd65 100644
--- a/drivers/staging/rtl8821ae/Kconfig
+++ b/drivers/staging/rtl8821ae/Kconfig
@@ -1,6 +1,6 @@
 config R8821AE
         tristate "RealTek RTL8821AE Wireless LAN NIC driver"
-        depends on PCI && WLAN
+        depends on PCI && WLAN && MAC80211
         depends on m
         select WIRELESS_EXT
         select WEXT_PRIV
diff --git a/drivers/staging/rtl8821ae/wifi.h b/drivers/staging/rtl8821ae/wifi.h
index cfe88a1efd55..76bef93ad70a 100644
--- a/drivers/staging/rtl8821ae/wifi.h
+++ b/drivers/staging/rtl8821ae/wifi.h
@@ -1414,7 +1414,7 @@ struct rtl_dm {
 
 
         /*88e tx power tracking*/
-        u8 bb_swing_idx_ofdm[2];
+        u8 bb_swing_idx_ofdm[MAX_RF_PATH];
         u8 bb_swing_idx_ofdm_current;
         u8 bb_swing_idx_ofdm_base[MAX_RF_PATH];
         bool bb_swing_flag_Ofdm;
diff --git a/drivers/staging/usbip/userspace/libsrc/names.c b/drivers/staging/usbip/userspace/libsrc/names.c
index 3c8d28b771e0..81ff8522405c 100644
--- a/drivers/staging/usbip/userspace/libsrc/names.c
+++ b/drivers/staging/usbip/userspace/libsrc/names.c
@@ -169,14 +169,14 @@ static void *my_malloc(size_t size)
         struct pool *p;
 
         p = calloc(1, sizeof(struct pool));
-        if (!p) {
-                free(p);
+        if (!p)
                 return NULL;
-        }
 
         p->mem = calloc(1, size);
-        if (!p->mem)
+        if (!p->mem) {
+                free(p);
                 return NULL;
+        }
 
         p->next = pool_head;
         pool_head = p;
diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/staging/usbip/vhci_sysfs.c
index 9b51586d11d9..0141bc34d5cc 100644
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/staging/usbip/vhci_sysfs.c
@@ -149,7 +149,8 @@ static int valid_args(__u32 rhport, enum usb_device_speed speed)
         case USB_SPEED_WIRELESS:
                 break;
         default:
-                pr_err("speed %d\n", speed);
+                pr_err("Failed attach request for unsupported USB speed: %s\n",
+                        usb_speed_string(speed));
                 return -EINVAL;
         }
 
diff --git a/drivers/staging/wlags49_h2/wl_wext.c b/drivers/staging/wlags49_h2/wl_wext.c
index 4a1ddaf5e00f..187fc060de26 100644
--- a/drivers/staging/wlags49_h2/wl_wext.c
+++ b/drivers/staging/wlags49_h2/wl_wext.c
@@ -1061,7 +1061,7 @@ static int wireless_set_essid(struct net_device *dev, struct iw_request_info *in
                 goto out;
         }
 
-        if (data->flags != 0 && data->length > HCF_MAX_NAME_LEN + 1) {
+        if (data->flags != 0 && data->length > HCF_MAX_NAME_LEN) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
index e048d6439f4a..cda4d80cfaef 100644
--- a/drivers/target/iscsi/iscsi_target_erl1.c
+++ b/drivers/target/iscsi/iscsi_target_erl1.c
@@ -507,7 +507,9 @@ int iscsit_handle_status_snack(
         u32 last_statsn;
         int found_cmd;
 
-        if (conn->exp_statsn > begrun) {
+        if (!begrun) {
+                begrun = conn->exp_statsn;
+        } else if (conn->exp_statsn > begrun) {
                 pr_err("Got Status SNACK Begrun: 0x%08x, RunLength:"
                         " 0x%08x but already got ExpStatSN: 0x%08x on CID:"
                         " %hu.\n", begrun, runlength, conn->exp_statsn,
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 12da9b386169..c3d9df6aaf5f 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -500,7 +500,7 @@ static inline int core_alua_state_lba_dependent(
 
                         if (segment_mult) {
                                 u64 tmp = lba;
-                                start_lba = sector_div(tmp, segment_size * segment_mult);
+                                start_lba = do_div(tmp, segment_size * segment_mult);
 
                                 last_lba = first_lba + segment_size - 1;
                                 if (start_lba >= first_lba &&
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 2f5d77932c80..3013287a2aaa 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -2009,7 +2009,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
         struct t10_reservation *pr_tmpl = &dev->t10_pr;
         unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL;
         sense_reason_t ret = TCM_NO_SENSE;
-        int pr_holder = 0;
+        int pr_holder = 0, type;
 
         if (!se_sess || !se_lun) {
                 pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
@@ -2131,6 +2131,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
                         ret = TCM_RESERVATION_CONFLICT;
                         goto out;
                 }
+                type = pr_reg->pr_res_type;
 
                 spin_lock(&pr_tmpl->registration_lock);
                 /*
@@ -2161,6 +2162,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
                  * Release the calling I_T Nexus registration now..
                  */
                 __core_scsi3_free_registration(cmd->se_dev, pr_reg, NULL, 1);
+                pr_reg = NULL;
 
                 /*
                  * From spc4r17, section 5.7.11.3 Unregistering
@@ -2174,8 +2176,8 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
                  * RESERVATIONS RELEASED.
                  */
                 if (pr_holder &&
-                    (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY ||
-                     pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) {
+                    (type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY ||
+                     type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) {
                         list_for_each_entry(pr_reg_p,
                                         &pr_tmpl->registration_list,
                                         pr_reg_list) {
@@ -2194,7 +2196,8 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
         ret = core_scsi3_update_and_write_aptpl(dev, aptpl);
 
 out:
-        core_scsi3_put_pr_reg(pr_reg);
+        if (pr_reg)
+                core_scsi3_put_pr_reg(pr_reg);
         return ret;
 }
 
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index fa3cae393e13..a4489444ffbc 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1074,12 +1074,19 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
         struct scatterlist *psg;
         void *paddr, *addr;
         unsigned int i, len, left;
+        unsigned int offset = 0;
 
         left = sectors * dev->prot_length;
 
         for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
 
                 len = min(psg->length, left);
+                if (offset >= sg->length) {
+                        sg = sg_next(sg);
+                        offset = 0;
+                        sg_off = sg->offset;
+                }
+
                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
                 addr = kmap_atomic(sg_page(sg)) + sg_off;
 
@@ -1089,6 +1096,7 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
                         memcpy(addr, paddr, len);
 
                 left -= len;
+                offset += len;
                 kunmap_atomic(paddr);
                 kunmap_atomic(addr);
         }
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 43c5ca9878bc..3bebc71ea033 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -440,8 +440,8 @@ check_scsi_name:
                 padding = ((-scsi_target_len) & 3);
                 if (padding)
                         scsi_target_len += padding;
-                if (scsi_name_len > 256)
-                        scsi_name_len = 256;
+                if (scsi_target_len > 256)
+                        scsi_target_len = 256;
 
                 buf[off-1] = scsi_target_len;
                 off += scsi_target_len;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index c50fd9f11aab..24b4f65d8777 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -669,9 +669,6 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
                 return;
         }
 
-        if (!success)
-                cmd->transport_state |= CMD_T_FAILED;
-
         /*
          * Check for case where an explicit ABORT_TASK has been received
          * and transport_wait_for_tasks() will be waiting for completion..
@@ -681,7 +678,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                 complete(&cmd->t_transport_stop_comp);
                 return;
-        } else if (cmd->transport_state & CMD_T_FAILED) {
+        } else if (!success) {
                 INIT_WORK(&cmd->work, target_complete_failure_work);
         } else {
                 INIT_WORK(&cmd->work, target_complete_ok_work);
diff --git a/drivers/tty/hvc/hvc_opal.c b/drivers/tty/hvc/hvc_opal.c
index 6496872e2e47..b01659bd4f7c 100644
--- a/drivers/tty/hvc/hvc_opal.c
+++ b/drivers/tty/hvc/hvc_opal.c
@@ -255,13 +255,7 @@ static int __init hvc_opal_init(void)
         /* Register as a vio device to receive callbacks */
         return platform_driver_register(&hvc_opal_driver);
 }
-module_init(hvc_opal_init);
-
-static void __exit hvc_opal_exit(void)
-{
-        platform_driver_unregister(&hvc_opal_driver);
-}
-module_exit(hvc_opal_exit);
+device_initcall(hvc_opal_init);
 
 static void udbg_opal_putc(char c)
 {
diff --git a/drivers/tty/hvc/hvc_rtas.c b/drivers/tty/hvc/hvc_rtas.c
index 0069bb86ba49..08c87920b74a 100644
--- a/drivers/tty/hvc/hvc_rtas.c
+++ b/drivers/tty/hvc/hvc_rtas.c
@@ -102,17 +102,7 @@ static int __init hvc_rtas_init(void)
 
         return 0;
 }
-module_init(hvc_rtas_init);
-
-/* This will tear down the tty portion of the driver */
-static void __exit hvc_rtas_exit(void)
-{
-        /* Really the fun isn't over until the worker thread breaks down and
-         * the tty cleans up */
-        if (hvc_rtas_dev)
-                hvc_remove(hvc_rtas_dev);
-}
-module_exit(hvc_rtas_exit);
+device_initcall(hvc_rtas_init);
 
 /* This will happen prior to module init.  There is no tty at this time? */
 static int __init hvc_rtas_console_init(void)
diff --git a/drivers/tty/hvc/hvc_udbg.c b/drivers/tty/hvc/hvc_udbg.c
index 72228276fe31..9cf573d06a29 100644
--- a/drivers/tty/hvc/hvc_udbg.c
+++ b/drivers/tty/hvc/hvc_udbg.c
@@ -80,14 +80,7 @@ static int __init hvc_udbg_init(void)
 
         return 0;
 }
-module_init(hvc_udbg_init);
-
-static void __exit hvc_udbg_exit(void)
-{
-        if (hvc_udbg_dev)
-                hvc_remove(hvc_udbg_dev);
-}
-module_exit(hvc_udbg_exit);
+device_initcall(hvc_udbg_init);
 
 static int __init hvc_udbg_console_init(void)
 {
diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index 636c9baad7a5..2dc2831840ca 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -561,18 +561,7 @@ static int __init xen_hvc_init(void)
 #endif
         return r;
 }
-
-static void __exit xen_hvc_fini(void)
-{
-        struct xencons_info *entry, *next;
-
-        if (list_empty(&xenconsoles))
-                        return;
-
-        list_for_each_entry_safe(entry, next, &xenconsoles, list) {
-                xen_console_remove(entry);
-        }
-}
+device_initcall(xen_hvc_init);
 
 static int xen_cons_init(void)
 {
@@ -598,10 +587,6 @@ static int xen_cons_init(void)
         hvc_instantiate(HVC_COOKIE, 0, ops);
         return 0;
 }
-
-
-module_init(xen_hvc_init);
-module_exit(xen_hvc_fini);
 console_initcall(xen_cons_init);
 
 #ifdef CONFIG_EARLY_PRINTK
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index f34461c5f14e..2ebe47b78a3e 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -1090,6 +1090,7 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen)
 {
         unsigned int addr = 0;
         unsigned int modem = 0;
+        unsigned int brk = 0;
         struct gsm_dlci *dlci;
         int len = clen;
         u8 *dp = data;
@@ -1116,6 +1117,16 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen)
                 if (len == 0)
                         return;
         }
+        len--;
+        if (len > 0) {
+                while (gsm_read_ea(&brk, *dp++) == 0) {
+                        len--;
+                        if (len == 0)
+                                return;
+                }
+                modem <<= 7;
+                modem |= (brk & 0x7f);
+        }
         tty = tty_port_tty_get(&dlci->port);
         gsm_process_modem(tty, dlci, modem, clen);
         if (tty) {
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index cb8017aa4434..d15624c1b751 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -817,8 +817,7 @@ static void process_echoes(struct tty_struct *tty)
         struct n_tty_data *ldata = tty->disc_data;
         size_t echoed;
 
-        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
-            ldata->echo_mark == ldata->echo_tail)
+        if (ldata->echo_mark == ldata->echo_tail)
                 return;
 
         mutex_lock(&ldata->output_lock);
@@ -1244,7 +1243,8 @@ n_tty_receive_signal_char(struct tty_struct *tty, int signal, unsigned char c)
         if (L_ECHO(tty)) {
                 echo_char(c, tty);
                 commit_echoes(tty);
-        }
+        } else
+                process_echoes(tty);
         isig(signal, tty);
         return;
 }
@@ -1274,7 +1274,7 @@ n_tty_receive_char_special(struct tty_struct *tty, unsigned char c)
         if (I_IXON(tty)) {
                 if (c == START_CHAR(tty)) {
                         start_tty(tty);
-                        commit_echoes(tty);
+                        process_echoes(tty);
                         return 0;
                 }
                 if (c == STOP_CHAR(tty)) {
@@ -1820,8 +1820,10 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
          * Fix tty hang when I_IXON(tty) is cleared, but the tty
          * been stopped by STOP_CHAR(tty) before it.
          */
-        if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped)
+        if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
                 start_tty(tty);
+                process_echoes(tty);
+        }
 
         /* The termios change make the tty ready for I/O */
         if (waitqueue_active(&tty->write_wait))
@@ -1896,7 +1898,7 @@ err:
 static inline int input_available_p(struct tty_struct *tty, int poll)
 {
         struct n_tty_data *ldata = tty->disc_data;
-        int amt = poll && !TIME_CHAR(tty) ? MIN_CHAR(tty) : 1;
+        int amt = poll && !TIME_CHAR(tty) && MIN_CHAR(tty) ? MIN_CHAR(tty) : 1;
 
         if (ldata->icanon && !L_EXTPROC(tty)) {
                 if (ldata->canon_head != ldata->read_tail)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 61ecd709a722..69932b7556cf 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -2433,6 +2433,24 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
         serial_dl_write(up, quot);
 
         /*
+         * XR17V35x UARTs have an extra fractional divisor register (DLD)
+         *
+         * We need to recalculate all of the registers, because DLM and DLL
+         * are already rounded to a whole integer.
+         *
+         * When recalculating we use a 32x clock instead of a 16x clock to
+         * allow 1-bit for rounding in the fractional part.
+         */
+        if (up->port.type == PORT_XR17V35X) {
+                unsigned int baud_x32 = (port->uartclk * 2) / baud;
+                u16 quot = baud_x32 / 32;
+                u8 quot_frac = DIV_ROUND_CLOSEST(baud_x32 % 32, 2);
+
+                serial_dl_write(up, quot);
+                serial_port_out(port, 0x2, quot_frac & 0xf);
+        }
+
+        /*
          * LCR DLAB must be set to enable 64-byte FIFO mode. If the FCR
          * is written without DLAB set, this mode will be disabled.
          */
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index faa64e646100..ed3113576740 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -391,7 +391,7 @@ static int dw8250_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int dw8250_suspend(struct device *dev)
 {
         struct dw8250_data *data = dev_get_drvdata(dev);
@@ -409,7 +409,7 @@ static int dw8250_resume(struct device *dev)
 
         return 0;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 #ifdef CONFIG_PM_RUNTIME
 static int dw8250_runtime_suspend(struct device *dev)
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 50228eed3b6f..0ff3e3624d4c 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -783,7 +783,8 @@ static int pci_netmos_9900_setup(struct serial_private *priv,
 {
         unsigned int bar;
 
-        if ((priv->dev->subsystem_device & 0xff00) == 0x3000) {
+        if ((priv->dev->device != PCI_DEVICE_ID_NETMOS_9865) &&
+            (priv->dev->subsystem_device & 0xff00) == 0x3000) {
                 /* netmos apparently orders BARs by datasheet layout, so serial
                  * ports get BARs 0 and 3 (or 1 and 4 for memmapped)
                  */
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index fa511ebab67c..77f035158d6c 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -738,9 +738,6 @@ static int serial_omap_startup(struct uart_port *port)
                         return retval;
                 }
                 disable_irq(up->wakeirq);
-        } else {
-                dev_info(up->port.dev, "no wakeirq for uart%d\n",
-                         up->port.line);
         }
 
         dev_dbg(up->port.dev, "serial_omap_startup+%d\n", up->port.line);
@@ -1604,8 +1601,11 @@ static int serial_omap_probe_rs485(struct uart_omap_port *up,
                                             flags & SER_RS485_RTS_AFTER_SEND);
                 if (ret < 0)
                         return ret;
-        } else
+        } else if (up->rts_gpio == -EPROBE_DEFER) {
+                return -EPROBE_DEFER;
+        } else {
                 up->rts_gpio = -EINVAL;
+        }
 
         if (of_property_read_u32_array(np, "rs485-rts-delay",
                                     rs485_delay, 2) == 0) {
@@ -1687,6 +1687,9 @@ static int serial_omap_probe(struct platform_device *pdev)
         up->port.iotype = UPIO_MEM;
         up->port.irq = uartirq;
         up->wakeirq = wakeirq;
+        if (!up->wakeirq)
+                dev_info(up->port.dev, "no wakeirq for uart%d\n",
+                         up->port.line);
 
         up->port.regshift = 2;
         up->port.fifosize = 64;
diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c
index 49a2ffd101a7..b7bfe24d4ebc 100644
--- a/drivers/tty/serial/sirfsoc_uart.c
+++ b/drivers/tty/serial/sirfsoc_uart.c
@@ -542,8 +542,10 @@ static void sirfsoc_rx_tmo_process_tl(unsigned long param)
         wr_regl(port, ureg->sirfsoc_rx_dma_io_ctrl,
                         rd_regl(port, ureg->sirfsoc_rx_dma_io_ctrl) |
                         SIRFUART_IO_MODE);
-        sirfsoc_uart_pio_rx_chars(port, 4 - sirfport->rx_io_count);
         spin_unlock_irqrestore(&sirfport->rx_lock, flags);
+        spin_lock(&port->lock);
+        sirfsoc_uart_pio_rx_chars(port, 4 - sirfport->rx_io_count);
+        spin_unlock(&port->lock);
         if (sirfport->rx_io_count == 4) {
                 spin_lock_irqsave(&sirfport->rx_lock, flags);
                 sirfport->rx_io_count = 0;
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 61b1137d7e56..23b5d32954bf 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1164,6 +1164,8 @@ static void csi_J(struct vc_data *vc, int vpar)
                         scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
                                     vc->vc_screenbuf_size >> 1);
                         set_origin(vc);
+                        if (CON_IS_VISIBLE(vc))
+                                update_screen(vc);
                         /* fall through */
                 case 2: /* erase whole display */
                         count = vc->vc_cols * vc->vc_rows;
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 80de2f88ed2c..4ab2cb62dfce 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -105,7 +105,7 @@ static int hw_ep_flush(struct ci_hdrc *ci, int num, int dir)
 
         do {
                 /* flush any pending transfer */
-                hw_write(ci, OP_ENDPTFLUSH, BIT(n), BIT(n));
+                hw_write(ci, OP_ENDPTFLUSH, ~0, BIT(n));
                 while (hw_read(ci, OP_ENDPTFLUSH, BIT(n)))
                         cpu_relax();
         } while (hw_read(ci, OP_ENDPTSTAT, BIT(n)));
@@ -205,7 +205,7 @@ static int hw_ep_prime(struct ci_hdrc *ci, int num, int dir, int is_ctrl)
         if (is_ctrl && dir == RX && hw_read(ci, OP_ENDPTSETUPSTAT, BIT(num)))
                 return -EAGAIN;
 
-        hw_write(ci, OP_ENDPTPRIME, BIT(n), BIT(n));
+        hw_write(ci, OP_ENDPTPRIME, ~0, BIT(n));
 
         while (hw_read(ci, OP_ENDPTPRIME, BIT(n)))
                 cpu_relax();
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 5d01558cef66..ab90a0156828 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -63,8 +63,10 @@ ssize_t usb_store_new_id(struct usb_dynids *dynids,
         dynid->id.idProduct = idProduct;
         dynid->id.match_flags = USB_DEVICE_ID_MATCH_DEVICE;
         if (fields > 2 && bInterfaceClass) {
-                if (bInterfaceClass > 255)
-                        return -EINVAL;
+                if (bInterfaceClass > 255) {
+                        retval = -EINVAL;
+                        goto fail;
+                }
 
                 dynid->id.bInterfaceClass = (u8)bInterfaceClass;
                 dynid->id.match_flags |= USB_DEVICE_ID_MATCH_INT_CLASS;
@@ -73,17 +75,21 @@ ssize_t usb_store_new_id(struct usb_dynids *dynids,
         if (fields > 4) {
                 const struct usb_device_id *id = id_table;
 
-                if (!id)
-                        return -ENODEV;
+                if (!id) {
+                        retval = -ENODEV;
+                        goto fail;
+                }
 
                 for (; id->match_flags; id++)
                         if (id->idVendor == refVendor && id->idProduct == refProduct)
                                 break;
 
-                if (id->match_flags)
+                if (id->match_flags) {
                         dynid->id.driver_info = id->driver_info;
-                else
-                        return -ENODEV;
+                } else {
+                        retval = -ENODEV;
+                        goto fail;
+                }
         }
 
         spin_lock(&dynids->lock);
@@ -95,6 +101,10 @@ ssize_t usb_store_new_id(struct usb_dynids *dynids,
         if (retval)
                 return retval;
         return count;
+
+fail:
+        kfree(dynid);
+        return retval;
 }
 EXPORT_SYMBOL_GPL(usb_store_new_id);
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 199aaea6bfe0..2518c3250750 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1032,7 +1032,6 @@ static int register_root_hub(struct usb_hcd *hcd)
                                         dev_name(&usb_dev->dev), retval);
                         return retval;
                 }
-                usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
         }
 
         retval = usb_new_device (usb_dev);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index babba885978d..64ea21971be2 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -128,7 +128,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
         return usb_get_intfdata(hdev->actconfig->interface[0]);
 }
 
-int usb_device_supports_lpm(struct usb_device *udev)
+static int usb_device_supports_lpm(struct usb_device *udev)
 {
         /* USB 2.1 (and greater) devices indicate LPM support through
          * their USB 2.0 Extended Capabilities BOS descriptor.
@@ -149,11 +149,6 @@ int usb_device_supports_lpm(struct usb_device *udev)
                                 "Power management will be impacted.\n");
                 return 0;
         }
-
-        /* udev is root hub */
-        if (!udev->parent)
-                return 1;
-
         if (udev->parent->lpm_capable)
                 return 1;
 
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index c49383669cd8..823857767a16 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -35,7 +35,6 @@ extern int usb_get_device_descriptor(struct usb_device *dev,
                 unsigned int size);
 extern int usb_get_bos_descriptor(struct usb_device *dev);
 extern void usb_release_bos_descriptor(struct usb_device *dev);
-extern int usb_device_supports_lpm(struct usb_device *udev);
 extern char *usb_cache_string(struct usb_device *udev, int index);
 extern int usb_set_configuration(struct usb_device *dev, int configuration);
 extern int usb_choose_configuration(struct usb_device *udev);
diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
index 8565d87f94b4..1d129884cc39 100644
--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -216,7 +216,7 @@ static int dwc2_hs_phy_init(struct dwc2_hsotg *hsotg, bool select_phy)
         int retval = 0;
 
         if (!select_phy)
-                return -ENODEV;
+                return 0;
 
         usbcfg = readl(hsotg->regs + GUSBCFG);
 
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index f59484d43b35..4d918ed8d343 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2565,25 +2565,14 @@ static void _dwc2_hcd_endpoint_reset(struct usb_hcd *hcd,
                                      struct usb_host_endpoint *ep)
 {
         struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
-        int is_control = usb_endpoint_xfer_control(&ep->desc);
-        int is_out = usb_endpoint_dir_out(&ep->desc);
-        int epnum = usb_endpoint_num(&ep->desc);
-        struct usb_device *udev;
         unsigned long flags;
 
         dev_dbg(hsotg->dev,
                 "DWC OTG HCD EP RESET: bEndpointAddress=0x%02x\n",
                 ep->desc.bEndpointAddress);
 
-        udev = to_usb_device(hsotg->dev);
-
         spin_lock_irqsave(&hsotg->lock, flags);
-
-        usb_settoggle(udev, epnum, is_out, 0);
-        if (is_control)
-                usb_settoggle(udev, epnum, !is_out, 0);
         dwc2_hcd_endpoint_reset(hsotg, ep);
-
         spin_unlock_irqrestore(&hsotg->lock, flags);
 }
 
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index d01d0d3f2cf0..eaba547ce26b 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -124,6 +124,9 @@ static int dwc2_driver_probe(struct platform_device *dev)
         int retval;
         int irq;
 
+        if (usb_disabled())
+                return -ENODEV;
+
         match = of_match_device(dwc2_of_match_table, &dev->dev);
         if (match && match->data) {
                 params = match->data;
diff --git a/drivers/usb/gadget/bcm63xx_udc.c b/drivers/usb/gadget/bcm63xx_udc.c
index 888fbb43b338..e969eb809a85 100644
--- a/drivers/usb/gadget/bcm63xx_udc.c
+++ b/drivers/usb/gadget/bcm63xx_udc.c
@@ -360,24 +360,30 @@ static inline void usb_dma_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
         bcm_writel(val, udc->iudma_regs + off);
 }
 
-static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off)
+static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off, int chan)
 {
-        return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
+        return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
-static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
+static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
+                                        int chan)
 {
-        bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
+        bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
-static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off)
+static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off, int chan)
 {
-        return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
+        return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
-static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
+static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
+                                        int chan)
 {
-        bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
+        bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
 static inline void set_clocks(struct bcm63xx_udc *udc, bool is_enabled)
@@ -638,7 +644,7 @@ static void iudma_write(struct bcm63xx_udc *udc, struct iudma_ch *iudma,
         } while (!last_bd);
 
         usb_dmac_writel(udc, ENETDMAC_CHANCFG_EN_MASK,
-                        ENETDMAC_CHANCFG_REG(iudma->ch_idx));
+                        ENETDMAC_CHANCFG_REG, iudma->ch_idx);
 }
 
 /**
@@ -694,9 +700,9 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma)
                 bcm63xx_fifo_reset_ep(udc, max(0, iudma->ep_num));
 
         /* stop DMA, then wait for the hardware to wrap up */
-        usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG(ch_idx));
+        usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG, ch_idx);
 
-        while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)) &
+        while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx) &
                                    ENETDMAC_CHANCFG_EN_MASK) {
                 udelay(1);
 
@@ -713,10 +719,10 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma)
                         dev_warn(udc->dev, "forcibly halting IUDMA channel %d\n",
                                  ch_idx);
                         usb_dmac_writel(udc, ENETDMAC_CHANCFG_BUFHALT_MASK,
-                                        ENETDMAC_CHANCFG_REG(ch_idx));
+                                        ENETDMAC_CHANCFG_REG, ch_idx);
                 }
         }
-        usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG(ch_idx));
+        usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG, ch_idx);
 
         /* don't leave "live" HW-owned entries for the next guy to step on */
         for (d = iudma->bd_ring; d <= iudma->end_bd; d++)
@@ -728,11 +734,11 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma)
 
         /* set up IRQs, UBUS burst size, and BD base for this channel */
         usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
-                        ENETDMAC_IRMASK_REG(ch_idx));
-        usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG(ch_idx));
+                        ENETDMAC_IRMASK_REG, ch_idx);
+        usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG, ch_idx);
 
-        usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG(ch_idx));
-        usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG(ch_idx));
+        usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG, ch_idx);
+        usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG, ch_idx);
 }
 
 /**
@@ -2035,7 +2041,7 @@ static irqreturn_t bcm63xx_udc_data_isr(int irq, void *dev_id)
         spin_lock(&udc->lock);
 
         usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
-                        ENETDMAC_IR_REG(iudma->ch_idx));
+                        ENETDMAC_IR_REG, iudma->ch_idx);
         bep = iudma->bep;
         rc = iudma_read(udc, iudma);
 
@@ -2175,18 +2181,18 @@ static int bcm63xx_iudma_dbg_show(struct seq_file *s, void *p)
                 seq_printf(s, " [ep%d]:\n",
                            max_t(int, iudma_defaults[ch_idx].ep_num, 0));
                 seq_printf(s, "  cfg: %08x; irqstat: %08x; irqmask: %08x; maxburst: %08x\n",
-                           usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)),
-                           usb_dmac_readl(udc, ENETDMAC_IR_REG(ch_idx)),
-                           usb_dmac_readl(udc, ENETDMAC_IRMASK_REG(ch_idx)),
-                           usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG(ch_idx)));
+                           usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx),
+                           usb_dmac_readl(udc, ENETDMAC_IR_REG, ch_idx),
+                           usb_dmac_readl(udc, ENETDMAC_IRMASK_REG, ch_idx),
+                           usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG, ch_idx));
 
-                sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG(ch_idx));
-                sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG(ch_idx));
+                sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG, ch_idx);
+                sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG, ch_idx);
                 seq_printf(s, "  base: %08x; index: %04x_%04x; desc: %04x_%04x %08x\n",
-                           usb_dmas_readl(udc, ENETDMAS_RSTART_REG(ch_idx)),
+                           usb_dmas_readl(udc, ENETDMAS_RSTART_REG, ch_idx),
                            sram2 >> 16, sram2 & 0xffff,
                            sram3 >> 16, sram3 & 0xffff,
-                           usb_dmas_readl(udc, ENETDMAS_SRAM4_REG(ch_idx)));
+                           usb_dmas_readl(udc, ENETDMAS_SRAM4_REG, ch_idx));
                 seq_printf(s, "  desc: %d/%d used", iudma->n_bds_used,
                            iudma->n_bds);
 
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 306a2b52125c..2b4334394076 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -585,7 +585,6 @@ static ssize_t ffs_epfile_io(struct file *file,
                              char __user *buf, size_t len, int read)
 {
         struct ffs_epfile *epfile = file->private_data;
-        struct usb_gadget *gadget = epfile->ffs->gadget;
         struct ffs_ep *ep;
         char *data = NULL;
         ssize_t ret, data_len;
@@ -622,6 +621,12 @@ static ssize_t ffs_epfile_io(struct file *file,
         /* Allocate & copy */
         if (!halt) {
                 /*
+                 * if we _do_ wait above, the epfile->ffs->gadget might be NULL
+                 * before the waiting completes, so do not assign to 'gadget' earlier
+                 */
+                struct usb_gadget *gadget = epfile->ffs->gadget;
+
+                /*
                  * Controller may require buffer size to be aligned to
                  * maxpacketsize of an out endpoint.
                  */
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index bf7a56b6d48a..69b76efd11e9 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -1157,7 +1157,7 @@ static int __init printer_bind_config(struct usb_configuration *c)
 
         usb_gadget_set_selfpowered(gadget);
 
-        if (gadget->is_otg) {
+        if (gadget_is_otg(gadget)) {
                 otg_descriptor.bmAttributes |= USB_OTG_HNP;
                 printer_cfg_driver.descriptors = otg_desc;
                 printer_cfg_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index f04b2c3154de..dd9678f85c58 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1629,7 +1629,7 @@ static void s3c2410_udc_reinit(struct s3c2410_udc *dev)
                 ep->ep.desc = NULL;
                 ep->halted = 0;
                 INIT_LIST_HEAD(&ep->queue);
-                usb_ep_set_maxpacket_limit(&ep->ep, &ep->ep.maxpacket);
+                usb_ep_set_maxpacket_limit(&ep->ep, ep->ep.maxpacket);
         }
 }
 
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 47b858fc50b2..7ae0c4d51741 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -238,6 +238,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
         int                     port;
         int                     mask;
         int                     changed;
+        bool                    fs_idle_delay;
 
         ehci_dbg(ehci, "suspend root hub\n");
 
@@ -272,6 +273,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
         ehci->bus_suspended = 0;
         ehci->owned_ports = 0;
         changed = 0;
+        fs_idle_delay = false;
         port = HCS_N_PORTS(ehci->hcs_params);
         while (port--) {
                 u32 __iomem     *reg = &ehci->regs->port_status [port];
@@ -300,16 +302,32 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                 }
 
                 if (t1 != t2) {
+                        /*
+                         * On some controllers, Wake-On-Disconnect will
+                         * generate false wakeup signals until the bus
+                         * switches over to full-speed idle.  For their
+                         * sake, add a delay if we need one.
+                         */
+                        if ((t2 & PORT_WKDISC_E) &&
+                                        ehci_port_speed(ehci, t2) ==
+                                                USB_PORT_STAT_HIGH_SPEED)
+                                fs_idle_delay = true;
                         ehci_writel(ehci, t2, reg);
                         changed = 1;
                 }
         }
+        spin_unlock_irq(&ehci->lock);
+
+        if ((changed && ehci->has_tdi_phy_lpm) || fs_idle_delay) {
+                /*
+                 * Wait for HCD to enter low-power mode or for the bus
+                 * to switch to full-speed idle.
+                 */
+                usleep_range(5000, 5500);
+        }
 
         if (changed && ehci->has_tdi_phy_lpm) {
-                spin_unlock_irq(&ehci->lock);
-                msleep(5);      /* 5 ms for HCD to enter low-power mode */
                 spin_lock_irq(&ehci->lock);
-
                 port = HCS_N_PORTS(ehci->hcs_params);
                 while (port--) {
                         u32 __iomem     *hostpc_reg = &ehci->regs->hostpc[port];
@@ -322,8 +340,8 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                                         port, (t3 & HOSTPC_PHCD) ?
                                         "succeeded" : "failed");
                 }
+                spin_unlock_irq(&ehci->lock);
         }
-        spin_unlock_irq(&ehci->lock);
 
         /* Apparently some devices need a >= 1-uframe delay here */
         if (ehci->bus_suspended)
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index b016d38199f2..eb009a457fb5 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -203,12 +203,12 @@ void xhci_print_ir_set(struct xhci_hcd *xhci, int set_num)
                                 addr, (unsigned int)temp);
 
         addr = &ir_set->erst_base;
-        temp_64 = readq(addr);
+        temp_64 = xhci_read_64(xhci, addr);
         xhci_dbg(xhci, "  %p: ir_set.erst_base = @%08llx\n",
                         addr, temp_64);
 
         addr = &ir_set->erst_dequeue;
-        temp_64 = readq(addr);
+        temp_64 = xhci_read_64(xhci, addr);
         xhci_dbg(xhci, "  %p: ir_set.erst_dequeue = @%08llx\n",
                         addr, temp_64);
 }
@@ -412,7 +412,7 @@ void xhci_dbg_cmd_ptrs(struct xhci_hcd *xhci)
 {
         u64 val;
 
-        val = readq(&xhci->op_regs->cmd_ring);
+        val = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
         xhci_dbg(xhci, "// xHC command ring deq ptr low bits + flags = @%08x\n",
                         lower_32_bits(val));
         xhci_dbg(xhci, "// xHC command ring deq ptr high bits = @%08x\n",
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 873c272b3ef5..bce4391a0e7d 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1958,7 +1958,7 @@ static void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
                 xhci_warn(xhci, "WARN something wrong with SW event ring "
                                 "dequeue ptr.\n");
         /* Update HC event ring dequeue pointer */
-        temp = readq(&xhci->ir_set->erst_dequeue);
+        temp = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
         temp &= ERST_PTR_MASK;
         /* Don't clear the EHB bit (which is RW1C) because
          * there might be more events to service.
@@ -1967,7 +1967,7 @@ static void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "// Write event ring dequeue pointer, "
                         "preserving EHB bit");
-        writeq(((u64) deq & (u64) ~ERST_PTR_MASK) | temp,
+        xhci_write_64(xhci, ((u64) deq & (u64) ~ERST_PTR_MASK) | temp,
                         &xhci->ir_set->erst_dequeue);
 }
 
@@ -2269,7 +2269,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "// Device context base array address = 0x%llx (DMA), %p (virt)",
                         (unsigned long long)xhci->dcbaa->dma, xhci->dcbaa);
-        writeq(dma, &xhci->op_regs->dcbaa_ptr);
+        xhci_write_64(xhci, dma, &xhci->op_regs->dcbaa_ptr);
 
         /*
          * Initialize the ring segment pool.  The ring must be a contiguous
@@ -2312,13 +2312,13 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
                         (unsigned long long)xhci->cmd_ring->first_seg->dma);
 
         /* Set the address in the Command Ring Control register */
-        val_64 = readq(&xhci->op_regs->cmd_ring);
+        val_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
         val_64 = (val_64 & (u64) CMD_RING_RSVD_BITS) |
                 (xhci->cmd_ring->first_seg->dma & (u64) ~CMD_RING_RSVD_BITS) |
                 xhci->cmd_ring->cycle_state;
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "// Setting command ring address to 0x%x", val);
-        writeq(val_64, &xhci->op_regs->cmd_ring);
+        xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring);
         xhci_dbg_cmd_ptrs(xhci);
 
         xhci->lpm_command = xhci_alloc_command(xhci, true, true, flags);
@@ -2396,10 +2396,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "// Set ERST base address for ir_set 0 = 0x%llx",
                         (unsigned long long)xhci->erst.erst_dma_addr);
-        val_64 = readq(&xhci->ir_set->erst_base);
+        val_64 = xhci_read_64(xhci, &xhci->ir_set->erst_base);
         val_64 &= ERST_PTR_MASK;
         val_64 |= (xhci->erst.erst_dma_addr & (u64) ~ERST_PTR_MASK);
-        writeq(val_64, &xhci->ir_set->erst_base);
+        xhci_write_64(xhci, val_64, &xhci->ir_set->erst_base);
 
         /* Set the event ring dequeue address */
         xhci_set_hc_event_deq(xhci);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 3c898c12a06b..04f986d9234f 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -142,6 +142,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                                 "QUIRK: Resetting on resume");
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
         }
+        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
+                        pdev->device == 0x0015 &&
+                        pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
+                        pdev->subsystem_device == 0xc0cd)
+                xhci->quirks |= XHCI_RESET_ON_RESUME;
         if (pdev->vendor == PCI_VENDOR_ID_VIA)
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
 }
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a0b248c34526..0ed64eb68e48 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -307,13 +307,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
                 return 0;
         }
 
-        temp_64 = readq(&xhci->op_regs->cmd_ring);
+        temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
         if (!(temp_64 & CMD_RING_RUNNING)) {
                 xhci_dbg(xhci, "Command ring had been stopped\n");
                 return 0;
         }
         xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
-        writeq(temp_64 | CMD_RING_ABORT, &xhci->op_regs->cmd_ring);
+        xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
+                        &xhci->op_regs->cmd_ring);
 
         /* Section 4.6.1.2 of xHCI 1.0 spec says software should
          * time the completion od all xHCI commands, including
@@ -2864,8 +2865,9 @@ hw_died:
                 /* Clear the event handler busy flag (RW1C);
                  * the event ring should be empty.
                  */
-                temp_64 = readq(&xhci->ir_set->erst_dequeue);
-                writeq(temp_64 | ERST_EHB, &xhci->ir_set->erst_dequeue);
+                temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+                xhci_write_64(xhci, temp_64 | ERST_EHB,
+                                &xhci->ir_set->erst_dequeue);
                 spin_unlock(&xhci->lock);
 
                 return IRQ_HANDLED;
@@ -2877,7 +2879,7 @@ hw_died:
          */
         while (xhci_handle_event(xhci) > 0) {}
 
-        temp_64 = readq(&xhci->ir_set->erst_dequeue);
+        temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
         /* If necessary, update the HW's version of the event ring deq ptr. */
         if (event_ring_deq != xhci->event_ring->dequeue) {
                 deq = xhci_trb_virt_to_dma(xhci->event_ring->deq_seg,
@@ -2892,7 +2894,7 @@ hw_died:
 
         /* Clear the event handler busy flag (RW1C); event ring is empty. */
         temp_64 |= ERST_EHB;
-        writeq(temp_64, &xhci->ir_set->erst_dequeue);
+        xhci_write_64(xhci, temp_64, &xhci->ir_set->erst_dequeue);
 
         spin_unlock(&xhci->lock);
 
@@ -2965,58 +2967,8 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
         }
 
         while (1) {
-                if (room_on_ring(xhci, ep_ring, num_trbs)) {
-                        union xhci_trb *trb = ep_ring->enqueue;
-                        unsigned int usable = ep_ring->enq_seg->trbs +
-                                        TRBS_PER_SEGMENT - 1 - trb;
-                        u32 nop_cmd;
-
-                        /*
-                         * Section 4.11.7.1 TD Fragments states that a link
-                         * TRB must only occur at the boundary between
-                         * data bursts (eg 512 bytes for 480M).
-                         * While it is possible to split a large fragment
-                         * we don't know the size yet.
-                         * Simplest solution is to fill the trb before the
-                         * LINK with nop commands.
-                         */
-                        if (num_trbs == 1 || num_trbs <= usable || usable == 0)
-                                break;
-
-                        if (ep_ring->type != TYPE_BULK)
-                                /*
-                                 * While isoc transfers might have a buffer that
-                                 * crosses a 64k boundary it is unlikely.
-                                 * Since we can't add NOPs without generating
-                                 * gaps in the traffic just hope it never
-                                 * happens at the end of the ring.
-                                 * This could be fixed by writing a LINK TRB
-                                 * instead of the first NOP - however the
-                                 * TRB_TYPE_LINK_LE32() calls would all need
-                                 * changing to check the ring length.
-                                 */
-                                break;
-
-                        if (num_trbs >= TRBS_PER_SEGMENT) {
-                                xhci_err(xhci, "Too many fragments %d, max %d\n",
-                                                num_trbs, TRBS_PER_SEGMENT - 1);
-                                return -EINVAL;
-                        }
-
-                        nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
-                                        ep_ring->cycle_state);
-                        ep_ring->num_trbs_free -= usable;
-                        do {
-                                trb->generic.field[0] = 0;
-                                trb->generic.field[1] = 0;
-                                trb->generic.field[2] = 0;
-                                trb->generic.field[3] = nop_cmd;
-                                trb++;
-                        } while (--usable);
-                        ep_ring->enqueue = trb;
-                        if (room_on_ring(xhci, ep_ring, num_trbs))
-                                break;
-                }
+                if (room_on_ring(xhci, ep_ring, num_trbs))
+                        break;
 
                 if (ep_ring == xhci->cmd_ring) {
                         xhci_err(xhci, "Do not support expand command ring\n");
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index ad364394885a..6fe577d46fa2 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -611,7 +611,7 @@ int xhci_run(struct usb_hcd *hcd)
         xhci_dbg(xhci, "Event ring:\n");
         xhci_debug_ring(xhci, xhci->event_ring);
         xhci_dbg_ring_ptrs(xhci, xhci->event_ring);
-        temp_64 = readq(&xhci->ir_set->erst_dequeue);
+        temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
         temp_64 &= ~ERST_PTR_MASK;
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "ERST deq = 64'h%0lx", (long unsigned int) temp_64);
@@ -756,11 +756,11 @@ static void xhci_save_registers(struct xhci_hcd *xhci)
 {
         xhci->s3.command = readl(&xhci->op_regs->command);
         xhci->s3.dev_nt = readl(&xhci->op_regs->dev_notification);
-        xhci->s3.dcbaa_ptr = readq(&xhci->op_regs->dcbaa_ptr);
+        xhci->s3.dcbaa_ptr = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr);
         xhci->s3.config_reg = readl(&xhci->op_regs->config_reg);
         xhci->s3.erst_size = readl(&xhci->ir_set->erst_size);
-        xhci->s3.erst_base = readq(&xhci->ir_set->erst_base);
-        xhci->s3.erst_dequeue = readq(&xhci->ir_set->erst_dequeue);
+        xhci->s3.erst_base = xhci_read_64(xhci, &xhci->ir_set->erst_base);
+        xhci->s3.erst_dequeue = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
         xhci->s3.irq_pending = readl(&xhci->ir_set->irq_pending);
         xhci->s3.irq_control = readl(&xhci->ir_set->irq_control);
 }
@@ -769,11 +769,11 @@ static void xhci_restore_registers(struct xhci_hcd *xhci)
 {
         writel(xhci->s3.command, &xhci->op_regs->command);
         writel(xhci->s3.dev_nt, &xhci->op_regs->dev_notification);
-        writeq(xhci->s3.dcbaa_ptr, &xhci->op_regs->dcbaa_ptr);
+        xhci_write_64(xhci, xhci->s3.dcbaa_ptr, &xhci->op_regs->dcbaa_ptr);
         writel(xhci->s3.config_reg, &xhci->op_regs->config_reg);
         writel(xhci->s3.erst_size, &xhci->ir_set->erst_size);
-        writeq(xhci->s3.erst_base, &xhci->ir_set->erst_base);
-        writeq(xhci->s3.erst_dequeue, &xhci->ir_set->erst_dequeue);
+        xhci_write_64(xhci, xhci->s3.erst_base, &xhci->ir_set->erst_base);
+        xhci_write_64(xhci, xhci->s3.erst_dequeue, &xhci->ir_set->erst_dequeue);
         writel(xhci->s3.irq_pending, &xhci->ir_set->irq_pending);
         writel(xhci->s3.irq_control, &xhci->ir_set->irq_control);
 }
@@ -783,7 +783,7 @@ static void xhci_set_cmd_ring_deq(struct xhci_hcd *xhci)
         u64     val_64;
 
         /* step 2: initialize command ring buffer */
-        val_64 = readq(&xhci->op_regs->cmd_ring);
+        val_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
         val_64 = (val_64 & (u64) CMD_RING_RSVD_BITS) |
                 (xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
                                       xhci->cmd_ring->dequeue) &
@@ -792,7 +792,7 @@ static void xhci_set_cmd_ring_deq(struct xhci_hcd *xhci)
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "// Setting command ring address to 0x%llx",
                         (long unsigned long) val_64);
-        writeq(val_64, &xhci->op_regs->cmd_ring);
+        xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring);
 }
 
 /*
@@ -3842,7 +3842,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
         if (ret) {
                 return ret;
         }
-        temp_64 = readq(&xhci->op_regs->dcbaa_ptr);
+        temp_64 = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr);
         xhci_dbg_trace(xhci, trace_xhci_dbg_address,
                         "Op regs DCBAA ptr = %#016llx", temp_64);
         xhci_dbg_trace(xhci, trace_xhci_dbg_address,
@@ -4730,11 +4730,8 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
         struct device           *dev = hcd->self.controller;
         int                     retval;
 
-        /* Limit the block layer scatter-gather lists to half a segment. */
-        hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2;
-
-        /* support to build packet from discontinuous buffers */
-        hcd->self.no_sg_constraint = 1;
+        /* Accept arbitrarily long scatter-gather lists */
+        hcd->self.sg_tablesize = ~0;
 
         /* XHCI controllers don't stop the ep queue on short packets :| */
         hcd->self.no_stop_on_short = 1;
@@ -4760,6 +4757,14 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
                 /* xHCI private pointer was set in xhci_pci_probe for the second
                  * registered roothub.
                  */
+                xhci = hcd_to_xhci(hcd);
+                /*
+                 * Support arbitrarily aligned sg-list entries on hosts without
+                 * TD fragment rules (which are currently unsupported).
+                 */
+                if (xhci->hci_version < 0x100)
+                        hcd->self.no_sg_constraint = 1;
+
                 return 0;
         }
 
@@ -4788,6 +4793,9 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
         if (xhci->hci_version > 0x96)
                 xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
 
+        if (xhci->hci_version < 0x100)
+                hcd->self.no_sg_constraint = 1;
+
         /* Make sure the HC is halted. */
         retval = xhci_halt(xhci);
         if (retval)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index f8416639bf31..58ed9d088e63 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -28,17 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/usb/hcd.h>
 
-/*
- * Registers should always be accessed with double word or quad word accesses.
- *
- * Some xHCI implementations may support 64-bit address pointers.  Registers
- * with 64-bit address pointers should be written to with dword accesses by
- * writing the low dword first (ptr[0]), then the high dword (ptr[1]) second.
- * xHCI implementations that do not support 64-bit address pointers will ignore
- * the high dword, and write order is irrelevant.
- */
-#include <asm-generic/io-64-nonatomic-lo-hi.h>
-
 /* Code sharing between pci-quirks and xhci hcd */
 #include        "xhci-ext-caps.h"
 #include "pci-quirks.h"
@@ -1279,7 +1268,7 @@ union xhci_trb {
  * since the command ring is 64-byte aligned.
  * It must also be greater than 16.
  */
-#define TRBS_PER_SEGMENT        256
+#define TRBS_PER_SEGMENT        64
 /* Allow two commands + a link TRB, along with any reserved command TRBs */
 #define MAX_RSVD_CMD_TRBS       (TRBS_PER_SEGMENT - 3)
 #define TRB_SEGMENT_SIZE        (TRBS_PER_SEGMENT*16)
@@ -1614,6 +1603,34 @@ static inline struct usb_hcd *xhci_to_hcd(struct xhci_hcd *xhci)
 #define xhci_warn_ratelimited(xhci, fmt, args...) \
         dev_warn_ratelimited(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
 
+/*
+ * Registers should always be accessed with double word or quad word accesses.
+ *
+ * Some xHCI implementations may support 64-bit address pointers.  Registers
+ * with 64-bit address pointers should be written to with dword accesses by
+ * writing the low dword first (ptr[0]), then the high dword (ptr[1]) second.
+ * xHCI implementations that do not support 64-bit address pointers will ignore
+ * the high dword, and write order is irrelevant.
+ */
+static inline u64 xhci_read_64(const struct xhci_hcd *xhci,
+                __le64 __iomem *regs)
+{
+        __u32 __iomem *ptr = (__u32 __iomem *) regs;
+        u64 val_lo = readl(ptr);
+        u64 val_hi = readl(ptr + 1);
+        return val_lo + (val_hi << 32);
+}
+static inline void xhci_write_64(struct xhci_hcd *xhci,
+                                 const u64 val, __le64 __iomem *regs)
+{
+        __u32 __iomem *ptr = (__u32 __iomem *) regs;
+        u32 val_lo = lower_32_bits(val);
+        u32 val_hi = upper_32_bits(val);
+
+        writel(val_lo, ptr);
+        writel(val_hi, ptr + 1);
+}
+
 static inline int xhci_link_trb_quirk(struct xhci_hcd *xhci)
 {
         return xhci->quirks & XHCI_LINK_TRB_QUIRK;
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fc192ad9cc6a..239ad0b1ceb6 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -477,8 +477,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                 musb->port1_status |=
                                                 (USB_PORT_STAT_C_SUSPEND << 16)
                                                 | MUSB_PORT_STAT_RESUME;
+                                musb->rh_timer = jiffies
+                                                 + msecs_to_jiffies(20);
                                 schedule_delayed_work(
-                                        &musb->finish_resume_work, 20);
+                                        &musb->finish_resume_work,
+                                        msecs_to_jiffies(20));
 
                                 musb->xceiv->state = OTG_STATE_A_HOST;
                                 musb->is_active = 1;
@@ -2157,11 +2160,19 @@ static void musb_restore_context(struct musb *musb)
         void __iomem *musb_base = musb->mregs;
         void __iomem *ep_target_regs;
         void __iomem *epio;
+        u8 power;
 
         musb_writew(musb_base, MUSB_FRAME, musb->context.frame);
         musb_writeb(musb_base, MUSB_TESTMODE, musb->context.testmode);
         musb_write_ulpi_buscontrol(musb->mregs, musb->context.busctl);
-        musb_writeb(musb_base, MUSB_POWER, musb->context.power);
+
+        /* Don't affect SUSPENDM/RESUME bits in POWER reg */
+        power = musb_readb(musb_base, MUSB_POWER);
+        power &= MUSB_POWER_SUSPENDM | MUSB_POWER_RESUME;
+        musb->context.power &= ~(MUSB_POWER_SUSPENDM | MUSB_POWER_RESUME);
+        power |= musb->context.power;
+        musb_writeb(musb_base, MUSB_POWER, power);
+
         musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe);
         musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe);
         musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index ed455724017b..abb38c3833ef 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1183,6 +1183,9 @@ irqreturn_t musb_h_ep0_irq(struct musb *musb)
                                 csr = MUSB_CSR0_H_STATUSPKT
                                         | MUSB_CSR0_TXPKTRDY;
 
+                        /* disable ping token in status phase */
+                        csr |= MUSB_CSR0_H_DIS_PING;
+
                         /* flag status stage */
                         musb->ep0_stage = MUSB_EP0_STATUS;
 
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index eb634433ef09..e2d2d8c9891b 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -135,7 +135,8 @@ void musb_port_suspend(struct musb *musb, bool do_suspend)
 
                 /* later, GetPortStatus will stop RESUME signaling */
                 musb->port1_status |= MUSB_PORT_STAT_RESUME;
-                schedule_delayed_work(&musb->finish_resume_work, 20);
+                schedule_delayed_work(&musb->finish_resume_work,
+                                      msecs_to_jiffies(20));
         }
 }
 
@@ -158,7 +159,6 @@ void musb_port_reset(struct musb *musb, bool do_reset)
          */
         power = musb_readb(mbase, MUSB_POWER);
         if (do_reset) {
-
                 /*
                  * If RESUME is set, we must make sure it stays minimum 20 ms.
                  * Then we must clear RESUME and wait a bit to let musb start
@@ -167,11 +167,22 @@ void musb_port_reset(struct musb *musb, bool do_reset)
                  * detected".
                  */
                 if (power &  MUSB_POWER_RESUME) {
-                        while (time_before(jiffies, musb->rh_timer))
-                                msleep(1);
+                        long remain = (unsigned long) musb->rh_timer - jiffies;
+
+                        if (musb->rh_timer > 0 && remain > 0) {
+                                /* take into account the minimum delay after resume */
+                                schedule_delayed_work(
+                                        &musb->deassert_reset_work, remain);
+                                return;
+                        }
+
                         musb_writeb(mbase, MUSB_POWER,
-                                power & ~MUSB_POWER_RESUME);
-                        msleep(1);
+                                    power & ~MUSB_POWER_RESUME);
+
+                        /* Give the core 1 ms to clear MUSB_POWER_RESUME */
+                        schedule_delayed_work(&musb->deassert_reset_work,
+                                              msecs_to_jiffies(1));
+                        return;
                 }
 
                 power &= 0xf0;
@@ -180,7 +191,8 @@ void musb_port_reset(struct musb *musb, bool do_reset)
 
                 musb->port1_status |= USB_PORT_STAT_RESET;
                 musb->port1_status &= ~USB_PORT_STAT_ENABLE;
-                schedule_delayed_work(&musb->deassert_reset_work, 50);
+                schedule_delayed_work(&musb->deassert_reset_work,
+                                      msecs_to_jiffies(50));
         } else {
                 dev_dbg(musb->controller, "root port reset stopped\n");
                 musb_writeb(mbase, MUSB_POWER,
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 2a408cdaf7b2..8aa59a2c5eb2 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -659,7 +659,6 @@ static int omap2430_runtime_suspend(struct device *dev)
                                 OTG_INTERFSEL);
 
                 omap2430_low_level_exit(musb);
-                phy_power_off(musb->phy);
         }
 
         return 0;
@@ -674,7 +673,6 @@ static int omap2430_runtime_resume(struct device *dev)
                 omap2430_low_level_init(musb);
                 musb_writel(musb->mregs, OTG_INTERFSEL,
                                 musb->context.otg_interfsel);
-                phy_power_on(musb->phy);
         }
 
         return 0;
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 8546c8dccd51..d204f745ed05 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -159,32 +159,6 @@ put_3p3:
         return rc;
 }
 
-#ifdef CONFIG_PM_SLEEP
-#define USB_PHY_SUSP_DIG_VOL  500000
-static int msm_hsusb_config_vddcx(int high)
-{
-        int max_vol = USB_PHY_VDD_DIG_VOL_MAX;
-        int min_vol;
-        int ret;
-
-        if (high)
-                min_vol = USB_PHY_VDD_DIG_VOL_MIN;
-        else
-                min_vol = USB_PHY_SUSP_DIG_VOL;
-
-        ret = regulator_set_voltage(hsusb_vddcx, min_vol, max_vol);
-        if (ret) {
-                pr_err("%s: unable to set the voltage for regulator "
-                        "HSUSB_VDDCX\n", __func__);
-                return ret;
-        }
-
-        pr_debug("%s: min_vol:%d max_vol:%d\n", __func__, min_vol, max_vol);
-
-        return ret;
-}
-#endif
-
 static int msm_hsusb_ldo_set_mode(int on)
 {
         int ret = 0;
@@ -440,7 +414,32 @@ static int msm_otg_reset(struct usb_phy *phy)
 #define PHY_SUSPEND_TIMEOUT_USEC        (500 * 1000)
 #define PHY_RESUME_TIMEOUT_USEC (100 * 1000)
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
+
+#define USB_PHY_SUSP_DIG_VOL  500000
+static int msm_hsusb_config_vddcx(int high)
+{
+        int max_vol = USB_PHY_VDD_DIG_VOL_MAX;
+        int min_vol;
+        int ret;
+
+        if (high)
+                min_vol = USB_PHY_VDD_DIG_VOL_MIN;
+        else
+                min_vol = USB_PHY_SUSP_DIG_VOL;
+
+        ret = regulator_set_voltage(hsusb_vddcx, min_vol, max_vol);
+        if (ret) {
+                pr_err("%s: unable to set the voltage for regulator "
+                        "HSUSB_VDDCX\n", __func__);
+                return ret;
+        }
+
+        pr_debug("%s: min_vol:%d max_vol:%d\n", __func__, min_vol, max_vol);
+
+        return ret;
+}
+
 static int msm_otg_suspend(struct msm_otg *motg)
 {
         struct usb_phy *phy = &motg->phy;
@@ -1733,22 +1732,18 @@ static int msm_otg_pm_resume(struct device *dev)
 }
 #endif
 
-#ifdef CONFIG_PM
 static const struct dev_pm_ops msm_otg_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(msm_otg_pm_suspend, msm_otg_pm_resume)
         SET_RUNTIME_PM_OPS(msm_otg_runtime_suspend, msm_otg_runtime_resume,
                                 msm_otg_runtime_idle)
 };
-#endif
 
 static struct platform_driver msm_otg_driver = {
         .remove = msm_otg_remove,
         .driver = {
                 .name = DRIVER_NAME,
                 .owner = THIS_MODULE,
-#ifdef CONFIG_PM
                 .pm = &msm_otg_dev_pm_ops,
-#endif
         },
 };
 
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index e6f61e4361df..8afa813d690b 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -130,7 +130,7 @@ struct usb_phy *usb_get_phy(enum usb_phy_type type)
 
         phy = __usb_find_phy(&phy_list, type);
         if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
-                pr_err("unable to find transceiver of type %s\n",
+                pr_debug("PHY: unable to find transceiver of type %s\n",
                         usb_phy_type_string(type));
                 goto err0;
         }
@@ -228,7 +228,7 @@ struct usb_phy *usb_get_phy_dev(struct device *dev, u8 index)
 
         phy = __usb_find_phy_dev(dev, &phy_bind_list, index);
         if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
-                pr_err("unable to find transceiver\n");
+                dev_dbg(dev, "unable to find transceiver\n");
                 goto err0;
         }
 
@@ -424,10 +424,8 @@ int usb_bind_phy(const char *dev_name, u8 index,
         unsigned long flags;
 
         phy_bind = kzalloc(sizeof(*phy_bind), GFP_KERNEL);
-        if (!phy_bind) {
-                pr_err("phy_bind(): No memory for phy_bind");
+        if (!phy_bind)
                 return -ENOMEM;
-        }
 
         phy_bind->dev_name = dev_name;
         phy_bind->phy_dev_name = phy_dev_name;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ce0d7b0db012..ee1f00f03c43 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -152,6 +152,7 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) },
@@ -191,6 +192,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
+        { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_LP101_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_P200X_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_LENZ_LIUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_XF_632_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_XF_634_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index a7019d1e3058..1e2d369df86e 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -50,6 +50,7 @@
 #define TI_XDS100V2_PID         0xa6d0
 
 #define FTDI_NXTCAM_PID         0xABB8 /* NXTCam for Mindstorms NXT */
+#define FTDI_EV3CON_PID         0xABB9 /* Mindstorms EV3 Console Adapter */
 
 /* US Interface Navigator (http://www.usinterface.com/) */
 #define FTDI_USINT_CAT_PID      0xb810  /* Navigator CAT and 2nd PTT lines */
@@ -363,6 +364,12 @@
 /* Sprog II (Andrew Crosland's SprogII DCC interface) */
 #define FTDI_SPROG_II           0xF0C8
 
+/*
+ * Two of the Tagsys RFID Readers
+ */
+#define FTDI_TAGSYS_LP101_PID   0xF0E9  /* Tagsys L-P101 RFID*/
+#define FTDI_TAGSYS_P200X_PID   0xF0EE  /* Tagsys Medio P200x RFID*/
+
 /* an infrared receiver for user access control with IR tags */
 #define FTDI_PIEGROUP_PID       0xF208  /* Product Id */
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5c86f57e4afa..68fc9fe65936 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1362,7 +1362,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
@@ -1525,7 +1526,8 @@ static const struct usb_device_id option_ids[] = {
         /* Cinterion */
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
-        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
                 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index c65437cfd4a2..968a40201e5f 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -139,6 +139,9 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)},       /* Sierra Wireless EM7700 Device Management */
         {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)},       /* Sierra Wireless EM7700 NMEA */
         {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)},       /* Sierra Wireless EM7700 Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)},       /* Netgear AirCard 340U Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)},       /* Netgear AirCard 340U NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)},       /* Netgear AirCard 340U Modem */
 
         { }                             /* Terminating entry */
 };
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index f112b079ddfc..fb79775447b0 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -71,7 +71,8 @@ DEVICE(hp4x, HP4X_IDS);
 
 /* Suunto ANT+ USB Driver */
 #define SUUNTO_IDS()                    \
-        { USB_DEVICE(0x0fcf, 0x1008) }
+        { USB_DEVICE(0x0fcf, 0x1008) }, \
+        { USB_DEVICE(0x0fcf, 0x1009) } /* Dynastream ANT USB-m Stick */
 DEVICE(suunto, SUUNTO_IDS);
 
 /* Siemens USB/MPI adapter */
diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
index 8470e1b114f2..1dd0604d1911 100644
--- a/drivers/usb/storage/Kconfig
+++ b/drivers/usb/storage/Kconfig
@@ -18,7 +18,9 @@ config USB_STORAGE
 
           This option depends on 'SCSI' support being enabled, but you
           probably also need 'SCSI device support: SCSI disk support'
-          (BLK_DEV_SD) for most USB storage devices.
+          (BLK_DEV_SD) for most USB storage devices.  Some devices also
+          will require 'Probe all LUNs on each SCSI device'
+          (SCSI_MULTI_LUN).
 
           To compile this driver as a module, choose M here: the
           module will be called usb-storage.
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 18509e6c21ab..9d38ddc8da49 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -78,6 +78,8 @@ static const char* host_info(struct Scsi_Host *host)
 
 static int slave_alloc (struct scsi_device *sdev)
 {
+        struct us_data *us = host_to_us(sdev->host);
+
         /*
          * Set the INQUIRY transfer length to 36.  We don't use any of
          * the extra data and many devices choke if asked for more or
@@ -102,6 +104,10 @@ static int slave_alloc (struct scsi_device *sdev)
          */
         blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
 
+        /* Tell the SCSI layer if we know there is more than one LUN */
+        if (us->protocol == USB_PR_BULK && us->max_lun > 0)
+                sdev->sdev_bflags |= BLIST_FORCELUN;
+
         return 0;
 }
 
diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
index 65a6a75066a8..82e8ed0324e3 100644
--- a/drivers/usb/storage/unusual_cypress.h
+++ b/drivers/usb/storage/unusual_cypress.h
@@ -31,7 +31,7 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
                 "Cypress ISD-300LP",
                 USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
 
-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219,
+UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160,
                 "Super Top",
                 "USB 2.0  SATA BRIDGE",
                 USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ad06255c2ade..adbeb255616a 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1455,6 +1455,13 @@ UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
+/* Reported by Moritz Moeller-Herrmann <moritz-kernel@moeller-herrmann.de> */
+UNUSUAL_DEV(  0x0fca, 0x8004, 0x0201, 0x0201,
+                "Research In Motion",
+                "BlackBerry Bold 9000",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64 ),
+
 /* Reported by Michael Stattmann <michael@stattmann.com> */
 UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
                 "Sony Ericsson",
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 9a68409580d5..a0fa5de210cf 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -70,7 +70,12 @@ enum {
 };
 
 struct vhost_net_ubuf_ref {
-        struct kref kref;
+        /* refcount follows semantics similar to kref:
+         *  0: object is released
+         *  1: no outstanding ubufs
+         * >1: outstanding ubufs
+         */
+        atomic_t refcount;
         wait_queue_head_t wait;
         struct vhost_virtqueue *vq;
 };
@@ -116,14 +121,6 @@ static void vhost_net_enable_zcopy(int vq)
         vhost_net_zcopy_mask |= 0x1 << vq;
 }
 
-static void vhost_net_zerocopy_done_signal(struct kref *kref)
-{
-        struct vhost_net_ubuf_ref *ubufs;
-
-        ubufs = container_of(kref, struct vhost_net_ubuf_ref, kref);
-        wake_up(&ubufs->wait);
-}
-
 static struct vhost_net_ubuf_ref *
 vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy)
 {
@@ -134,21 +131,24 @@ vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy)
         ubufs = kmalloc(sizeof(*ubufs), GFP_KERNEL);
         if (!ubufs)
                 return ERR_PTR(-ENOMEM);
-        kref_init(&ubufs->kref);
+        atomic_set(&ubufs->refcount, 1);
         init_waitqueue_head(&ubufs->wait);
         ubufs->vq = vq;
         return ubufs;
 }
 
-static void vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)
+static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)
 {
-        kref_put(&ubufs->kref, vhost_net_zerocopy_done_signal);
+        int r = atomic_sub_return(1, &ubufs->refcount);
+        if (unlikely(!r))
+                wake_up(&ubufs->wait);
+        return r;
 }
 
 static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
 {
-        kref_put(&ubufs->kref, vhost_net_zerocopy_done_signal);
-        wait_event(ubufs->wait, !atomic_read(&ubufs->kref.refcount));
+        vhost_net_ubuf_put(ubufs);
+        wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
 }
 
 static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
@@ -306,23 +306,26 @@ static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success)
 {
         struct vhost_net_ubuf_ref *ubufs = ubuf->ctx;
         struct vhost_virtqueue *vq = ubufs->vq;
-        int cnt = atomic_read(&ubufs->kref.refcount);
+        int cnt;
+
+        rcu_read_lock_bh();
 
         /* set len to mark this desc buffers done DMA */
         vq->heads[ubuf->desc].len = success ?
                 VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN;
-        vhost_net_ubuf_put(ubufs);
+        cnt = vhost_net_ubuf_put(ubufs);
 
         /*
          * Trigger polling thread if guest stopped submitting new buffers:
-         * in this case, the refcount after decrement will eventually reach 1
-         * so here it is 2.
+         * in this case, the refcount after decrement will eventually reach 1.
          * We also trigger polling periodically after each 16 packets
          * (the value 16 here is more or less arbitrary, it's tuned to trigger
          * less than 10% of times).
          */
-        if (cnt <= 2 || !(cnt % 16))
+        if (cnt <= 1 || !(cnt % 16))
                 vhost_poll_queue(&vq->poll);
+
+        rcu_read_unlock_bh();
 }
 
 /* Expects to be always run from workqueue - which acts as
@@ -420,7 +423,7 @@ static void handle_tx(struct vhost_net *net)
                         msg.msg_control = ubuf;
                         msg.msg_controllen = sizeof(ubuf);
                         ubufs = nvq->ubufs;
-                        kref_get(&ubufs->kref);
+                        atomic_inc(&ubufs->refcount);
                         nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV;
                 } else {
                         msg.msg_control = NULL;
@@ -780,7 +783,7 @@ static void vhost_net_flush(struct vhost_net *n)
                 vhost_net_ubuf_put_and_wait(n->vqs[VHOST_NET_VQ_TX].ubufs);
                 mutex_lock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
                 n->tx_flush = false;
-                kref_init(&n->vqs[VHOST_NET_VQ_TX].ubufs->kref);
+                atomic_set(&n->vqs[VHOST_NET_VQ_TX].ubufs->refcount, 1);
                 mutex_unlock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
         }
 }
@@ -800,6 +803,8 @@ static int vhost_net_release(struct inode *inode, struct file *f)
                 fput(tx_sock->file);
         if (rx_sock)
                 fput(rx_sock->file);
+        /* Make sure no callbacks are outstanding */
+        synchronize_rcu_bh();
         /* We do an extra flush before freeing memory,
          * since jobs can re-queue themselves. */
         vhost_net_flush(n);
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 22262a3a0e2d..dade5b7699bc 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -364,7 +364,7 @@ config FB_SA1100
 
 config FB_IMX
         tristate "Freescale i.MX1/21/25/27 LCD support"
-        depends on FB && IMX_HAVE_PLATFORM_IMX_FB
+        depends on FB && ARCH_MXC
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/exynos/Kconfig b/drivers/video/exynos/Kconfig
index 1129d0e9e640..75c8a8e7efc0 100644
--- a/drivers/video/exynos/Kconfig
+++ b/drivers/video/exynos/Kconfig
@@ -22,7 +22,8 @@ config EXYNOS_MIPI_DSI
 
 config EXYNOS_LCD_S6E8AX0
         bool "S6E8AX0 MIPI AMOLED LCD Driver"
-        depends on (EXYNOS_MIPI_DSI && BACKLIGHT_CLASS_DEVICE && LCD_CLASS_DEVICE)
+        depends on EXYNOS_MIPI_DSI && BACKLIGHT_CLASS_DEVICE
+        depends on (LCD_CLASS_DEVICE = y)
         default n
         help
           If you have an S6E8AX0 MIPI AMOLED LCD Panel, say Y to enable its
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/omap2/dss/dispc.c
index bbeb8dd7f108..77d6221618f4 100644
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/omap2/dss/dispc.c
@@ -2160,8 +2160,8 @@ static int dispc_ovl_calc_scaling_24xx(unsigned long pclk, unsigned long lclk,
         *five_taps = false;
 
         do {
-                in_height = DIV_ROUND_UP(height, *decim_y);
-                in_width = DIV_ROUND_UP(width, *decim_x);
+                in_height = height / *decim_y;
+                in_width = width / *decim_x;
                 *core_clk = dispc.feat->calc_core_clk(pclk, in_width,
                                 in_height, out_width, out_height, mem_to_mem);
                 error = (in_width > maxsinglelinewidth || !*core_clk ||
@@ -2199,8 +2199,8 @@ static int dispc_ovl_calc_scaling_34xx(unsigned long pclk, unsigned long lclk,
                         dss_feat_get_param_max(FEAT_PARAM_LINEWIDTH);
 
         do {
-                in_height = DIV_ROUND_UP(height, *decim_y);
-                in_width = DIV_ROUND_UP(width, *decim_x);
+                in_height = height / *decim_y;
+                in_width = width / *decim_x;
                 *five_taps = in_height > out_height;
 
                 if (in_width > maxsinglelinewidth)
@@ -2268,7 +2268,7 @@ static int dispc_ovl_calc_scaling_44xx(unsigned long pclk, unsigned long lclk,
 {
         u16 in_width, in_width_max;
         int decim_x_min = *decim_x;
-        u16 in_height = DIV_ROUND_UP(height, *decim_y);
+        u16 in_height = height / *decim_y;
         const int maxsinglelinewidth =
                                 dss_feat_get_param_max(FEAT_PARAM_LINEWIDTH);
         const int maxdownscale = dss_feat_get_param_max(FEAT_PARAM_DOWNSCALE);
@@ -2287,7 +2287,7 @@ static int dispc_ovl_calc_scaling_44xx(unsigned long pclk, unsigned long lclk,
                 return -EINVAL;
 
         do {
-                in_width = DIV_ROUND_UP(width, *decim_x);
+                in_width = width / *decim_x;
         } while (*decim_x <= *x_predecim &&
                         in_width > maxsinglelinewidth && ++*decim_x);
 
@@ -2466,8 +2466,8 @@ static int dispc_ovl_setup_common(enum omap_plane plane,
         if (r)
                 return r;
 
-        in_width = DIV_ROUND_UP(in_width, x_predecim);
-        in_height = DIV_ROUND_UP(in_height, y_predecim);
+        in_width = in_width / x_predecim;
+        in_height = in_height / y_predecim;
 
         if (color_mode == OMAP_DSS_COLOR_YUV2 ||
                         color_mode == OMAP_DSS_COLOR_UYVY ||
diff --git a/drivers/video/omap2/dss/dpi.c b/drivers/video/omap2/dss/dpi.c
index 7411f2674e16..23ef21ffc2c4 100644
--- a/drivers/video/omap2/dss/dpi.c
+++ b/drivers/video/omap2/dss/dpi.c
@@ -117,7 +117,7 @@ struct dpi_clk_calc_ctx {
         /* outputs */
 
         struct dsi_clock_info dsi_cinfo;
-        unsigned long long fck;
+        unsigned long fck;
         struct dispc_clock_info dispc_cinfo;
 };
 
diff --git a/drivers/video/omap2/dss/sdi.c b/drivers/video/omap2/dss/sdi.c
index efb9ee9e3c96..ba806c9e7f54 100644
--- a/drivers/video/omap2/dss/sdi.c
+++ b/drivers/video/omap2/dss/sdi.c
@@ -46,7 +46,7 @@ static struct {
 struct sdi_clk_calc_ctx {
         unsigned long pck_min, pck_max;
 
-        unsigned long long fck;
+        unsigned long fck;
         struct dispc_clock_info dispc_cinfo;
 };
 
diff --git a/drivers/vme/bridges/vme_ca91cx42.c b/drivers/vme/bridges/vme_ca91cx42.c
index a06edbfa95ca..1b5d48c578e1 100644
--- a/drivers/vme/bridges/vme_ca91cx42.c
+++ b/drivers/vme/bridges/vme_ca91cx42.c
@@ -884,7 +884,7 @@ static ssize_t ca91cx42_master_read(struct vme_master_resource *image,
                 if (done == count)
                         goto out;
         }
-        if ((uintptr_t)addr & 0x2) {
+        if ((uintptr_t)(addr + done) & 0x2) {
                 if ((count - done) < 2) {
                         *(u8 *)(buf + done) = ioread8(addr + done);
                         done += 1;
@@ -938,7 +938,7 @@ static ssize_t ca91cx42_master_write(struct vme_master_resource *image,
                 if (done == count)
                         goto out;
         }
-        if ((uintptr_t)addr & 0x2) {
+        if ((uintptr_t)(addr + done) & 0x2) {
                 if ((count - done) < 2) {
                         iowrite8(*(u8 *)(buf + done), addr + done);
                         done += 1;
diff --git a/drivers/vme/bridges/vme_tsi148.c b/drivers/vme/bridges/vme_tsi148.c
index 16830d8b777c..9911cd5fddb5 100644
--- a/drivers/vme/bridges/vme_tsi148.c
+++ b/drivers/vme/bridges/vme_tsi148.c
@@ -1289,7 +1289,7 @@ static ssize_t tsi148_master_read(struct vme_master_resource *image, void *buf,
                 if (done == count)
                         goto out;
         }
-        if ((uintptr_t)addr & 0x2) {
+        if ((uintptr_t)(addr + done) & 0x2) {
                 if ((count - done) < 2) {
                         *(u8 *)(buf + done) = ioread8(addr + done);
                         done += 1;
@@ -1371,7 +1371,7 @@ static ssize_t tsi148_master_write(struct vme_master_resource *image, void *buf,
                 if (done == count)
                         goto out;
         }
-        if ((uintptr_t)addr & 0x2) {
+        if ((uintptr_t)(addr + done) & 0x2) {
                 if ((count - done) < 2) {
                         iowrite8(*(u8 *)(buf + done), addr + done);
                         done += 1;
diff --git a/drivers/watchdog/w83697hf_wdt.c b/drivers/watchdog/w83697hf_wdt.c
index aaf2995d37f4..68b45fc9ba6a 100644
--- a/drivers/watchdog/w83697hf_wdt.c
+++ b/drivers/watchdog/w83697hf_wdt.c
@@ -402,7 +402,7 @@ static int __init wdt_init(void)
 
         if (!found) {
                 pr_err("No W83697HF/HG could be found\n");
-                ret = -EIO;
+                ret = -ENODEV;
                 goto out;
         }
 
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index d75c811bfa56..45e00afa7f2d 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -16,7 +16,6 @@ xen-pad-$(CONFIG_X86) += xen-acpi-pad.o
 dom0-$(CONFIG_X86) += pcpu.o
 obj-$(CONFIG_XEN_DOM0)                  += $(dom0-y)
 obj-$(CONFIG_BLOCK)                     += biomerge.o
-obj-$(CONFIG_XEN_XENCOMM)               += xencomm.o
 obj-$(CONFIG_XEN_BALLOON)               += xen-balloon.o
 obj-$(CONFIG_XEN_SELFBALLOONING)        += xen-selfballoon.o
 obj-$(CONFIG_XEN_DEV_EVTCHN)            += xen-evtchn.o
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 4672e003c0ad..f4a9e3311297 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -862,6 +862,8 @@ int bind_evtchn_to_irq(unsigned int evtchn)
                         irq = ret;
                         goto out;
                 }
+                /* New interdomain events are bound to VCPU 0. */
+                bind_evtchn_to_cpu(evtchn, 0);
         } else {
                 struct irq_info *info = info_for_irq(irq);
                 WARN_ON(info == NULL || info->type != IRQT_EVTCHN);
diff --git a/drivers/xen/xencomm.c b/drivers/xen/xencomm.c
deleted file mode 100644
index 4793fc594549..000000000000
--- a/drivers/xen/xencomm.c
+++ /dev/null
@@ -1,219 +0,0 @@
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
- *
- * Copyright (C) IBM Corp. 2006
- *
- * Authors: Hollis Blanchard <hollisb@us.ibm.com>
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/mm.h>
-#include <linux/slab.h>
-#include <asm/page.h>
-#include <xen/xencomm.h>
-#include <xen/interface/xen.h>
-#include <asm/xen/xencomm.h>    /* for xencomm_is_phys_contiguous() */
-
-static int xencomm_init(struct xencomm_desc *desc,
-                        void *buffer, unsigned long bytes)
-{
-        unsigned long recorded = 0;
-        int i = 0;
-
-        while ((recorded < bytes) && (i < desc->nr_addrs)) {
-                unsigned long vaddr = (unsigned long)buffer + recorded;
-                unsigned long paddr;
-                int offset;
-                int chunksz;
-
-                offset = vaddr % PAGE_SIZE; /* handle partial pages */
-                chunksz = min(PAGE_SIZE - offset, bytes - recorded);
-
-                paddr = xencomm_vtop(vaddr);
-                if (paddr == ~0UL) {
-                        printk(KERN_DEBUG "%s: couldn't translate vaddr %lx\n",
-                               __func__, vaddr);
-                        return -EINVAL;
-                }
-
-                desc->address[i++] = paddr;
-                recorded += chunksz;
-        }
-
-        if (recorded < bytes) {
-                printk(KERN_DEBUG
-                       "%s: could only translate %ld of %ld bytes\n",
-                       __func__, recorded, bytes);
-                return -ENOSPC;
-        }
-
-        /* mark remaining addresses invalid (just for safety) */
-        while (i < desc->nr_addrs)
-                desc->address[i++] = XENCOMM_INVALID;
-
-        desc->magic = XENCOMM_MAGIC;
-
-        return 0;
-}
-
-static struct xencomm_desc *xencomm_alloc(gfp_t gfp_mask,
-                                          void *buffer, unsigned long bytes)
-{
-        struct xencomm_desc *desc;
-        unsigned long buffer_ulong = (unsigned long)buffer;
-        unsigned long start = buffer_ulong & PAGE_MASK;
-        unsigned long end = (buffer_ulong + bytes) | ~PAGE_MASK;
-        unsigned long nr_addrs = (end - start + 1) >> PAGE_SHIFT;
-        unsigned long size = sizeof(*desc) +
-                sizeof(desc->address[0]) * nr_addrs;
-
-        /*
-         * slab allocator returns at least sizeof(void*) aligned pointer.
-         * When sizeof(*desc) > sizeof(void*), struct xencomm_desc might
-         * cross page boundary.
-         */
-        if (sizeof(*desc) > sizeof(void *)) {
-                unsigned long order = get_order(size);
-                desc = (struct xencomm_desc *)__get_free_pages(gfp_mask,
-                                                               order);
-                if (desc == NULL)
-                        return NULL;
-
-                desc->nr_addrs =
-                        ((PAGE_SIZE << order) - sizeof(struct xencomm_desc)) /
-                        sizeof(*desc->address);
-        } else {
-                desc = kmalloc(size, gfp_mask);
-                if (desc == NULL)
-                        return NULL;
-
-                desc->nr_addrs = nr_addrs;
-        }
-        return desc;
-}
-
-void xencomm_free(struct xencomm_handle *desc)
-{
-        if (desc && !((ulong)desc & XENCOMM_INLINE_FLAG)) {
-                struct xencomm_desc *desc__ = (struct xencomm_desc *)desc;
-                if (sizeof(*desc__) > sizeof(void *)) {
-                        unsigned long size = sizeof(*desc__) +
-                                sizeof(desc__->address[0]) * desc__->nr_addrs;
-                        unsigned long order = get_order(size);
-                        free_pages((unsigned long)__va(desc), order);
-                } else
-                        kfree(__va(desc));
-        }
-}
-
-static int xencomm_create(void *buffer, unsigned long bytes,
-                          struct xencomm_desc **ret, gfp_t gfp_mask)
-{
-        struct xencomm_desc *desc;
-        int rc;
-
-        pr_debug("%s: %p[%ld]\n", __func__, buffer, bytes);
-
-        if (bytes == 0) {
-                /* don't create a descriptor; Xen recognizes NULL. */
-                BUG_ON(buffer != NULL);
-                *ret = NULL;
-                return 0;
-        }
-
-        BUG_ON(buffer == NULL); /* 'bytes' is non-zero */
-
-        desc = xencomm_alloc(gfp_mask, buffer, bytes);
-        if (!desc) {
-                printk(KERN_DEBUG "%s failure\n", "xencomm_alloc");
-                return -ENOMEM;
-        }
-
-        rc = xencomm_init(desc, buffer, bytes);
-        if (rc) {
-                printk(KERN_DEBUG "%s failure: %d\n", "xencomm_init", rc);
-                xencomm_free((struct xencomm_handle *)__pa(desc));
-                return rc;
-        }
-
-        *ret = desc;
-        return 0;
-}
-
-static struct xencomm_handle *xencomm_create_inline(void *ptr)
-{
-        unsigned long paddr;
-
-        BUG_ON(!xencomm_is_phys_contiguous((unsigned long)ptr));
-
-        paddr = (unsigned long)xencomm_pa(ptr);
-        BUG_ON(paddr & XENCOMM_INLINE_FLAG);
-        return (struct xencomm_handle *)(paddr | XENCOMM_INLINE_FLAG);
-}
-
-/* "mini" routine, for stack-based communications: */
-static int xencomm_create_mini(void *buffer,
-        unsigned long bytes, struct xencomm_mini *xc_desc,
-        struct xencomm_desc **ret)
-{
-        int rc = 0;
-        struct xencomm_desc *desc;
-        BUG_ON(((unsigned long)xc_desc) % sizeof(*xc_desc) != 0);
-
-        desc = (void *)xc_desc;
-
-        desc->nr_addrs = XENCOMM_MINI_ADDRS;
-
-        rc = xencomm_init(desc, buffer, bytes);
-        if (!rc)
-                *ret = desc;
-
-        return rc;
-}
-
-struct xencomm_handle *xencomm_map(void *ptr, unsigned long bytes)
-{
-        int rc;
-        struct xencomm_desc *desc;
-
-        if (xencomm_is_phys_contiguous((unsigned long)ptr))
-                return xencomm_create_inline(ptr);
-
-        rc = xencomm_create(ptr, bytes, &desc, GFP_KERNEL);
-
-        if (rc || desc == NULL)
-                return NULL;
-
-        return xencomm_pa(desc);
-}
-
-struct xencomm_handle *__xencomm_map_no_alloc(void *ptr, unsigned long bytes,
-                        struct xencomm_mini *xc_desc)
-{
-        int rc;
-        struct xencomm_desc *desc = NULL;
-
-        if (xencomm_is_phys_contiguous((unsigned long)ptr))
-                return xencomm_create_inline(ptr);
-
-        rc = xencomm_create_mini(ptr, bytes, xc_desc,
-                                &desc);
-
-        if (rc)
-                return NULL;
-
-        return xencomm_pa(desc);
-}
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 0bad24ddc2e7..0129b78a6908 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -114,6 +114,14 @@ void bio_integrity_free(struct bio *bio)
 }
 EXPORT_SYMBOL(bio_integrity_free);
 
+static inline unsigned int bip_integrity_vecs(struct bio_integrity_payload *bip)
+{
+        if (bip->bip_slab == BIO_POOL_NONE)
+                return BIP_INLINE_VECS;
+
+        return bvec_nr_vecs(bip->bip_slab);
+}
+
 /**
  * bio_integrity_add_page - Attach integrity metadata
  * @bio:        bio to update
@@ -129,7 +137,7 @@ int bio_integrity_add_page(struct bio *bio, struct page *page,
         struct bio_integrity_payload *bip = bio->bi_integrity;
         struct bio_vec *iv;
 
-        if (bip->bip_vcnt >= bvec_nr_vecs(bip->bip_slab)) {
+        if (bip->bip_vcnt >= bip_integrity_vecs(bip)) {
                 printk(KERN_ERR "%s: bip_vec full\n", __func__);
                 return 0;
         }
@@ -226,7 +234,8 @@ unsigned int bio_integrity_tag_size(struct bio *bio)
 }
 EXPORT_SYMBOL(bio_integrity_tag_size);
 
-int bio_integrity_tag(struct bio *bio, void *tag_buf, unsigned int len, int set)
+static int bio_integrity_tag(struct bio *bio, void *tag_buf, unsigned int len,
+                             int set)
 {
         struct bio_integrity_payload *bip = bio->bi_integrity;
         struct blk_integrity *bi = bdev_get_integrity(bio->bi_bdev);
diff --git a/fs/bio.c b/fs/bio.c
index 75c49a382239..8754e7b6eb49 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -611,7 +611,6 @@ EXPORT_SYMBOL(bio_clone_fast);
 struct bio *bio_clone_bioset(struct bio *bio_src, gfp_t gfp_mask,
                              struct bio_set *bs)
 {
-        unsigned nr_iovecs = 0;
         struct bvec_iter iter;
         struct bio_vec bv;
         struct bio *bio;
@@ -638,10 +637,7 @@ struct bio *bio_clone_bioset(struct bio *bio_src, gfp_t gfp_mask,
          *    __bio_clone_fast() anyways.
          */
 
-        bio_for_each_segment(bv, bio_src, iter)
-                nr_iovecs++;
-
-        bio = bio_alloc_bioset(gfp_mask, nr_iovecs, bs);
+        bio = bio_alloc_bioset(gfp_mask, bio_segments(bio_src), bs);
         if (!bio)
                 return NULL;
 
@@ -650,9 +646,18 @@ struct bio *bio_clone_bioset(struct bio *bio_src, gfp_t gfp_mask,
         bio->bi_iter.bi_sector  = bio_src->bi_iter.bi_sector;
         bio->bi_iter.bi_size    = bio_src->bi_iter.bi_size;
 
+        if (bio->bi_rw & REQ_DISCARD)
+                goto integrity_clone;
+
+        if (bio->bi_rw & REQ_WRITE_SAME) {
+                bio->bi_io_vec[bio->bi_vcnt++] = bio_src->bi_io_vec[0];
+                goto integrity_clone;
+        }
+
         bio_for_each_segment(bv, bio_src, iter)
                 bio->bi_io_vec[bio->bi_vcnt++] = bv;
 
+integrity_clone:
         if (bio_integrity(bio_src)) {
                 int ret;
 
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index e2600cdb6c25..b01fb6c527e3 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -1010,6 +1010,8 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start,
                 bytes = min(bytes, working_bytes);
                 kaddr = kmap_atomic(page_out);
                 memcpy(kaddr + *pg_offset, buf + buf_offset, bytes);
+                if (*pg_index == (vcnt - 1) && *pg_offset == 0)
+                        memset(kaddr + bytes, 0, PAGE_CACHE_SIZE - bytes);
                 kunmap_atomic(kaddr);
                 flush_dcache_page(page_out);
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 5215f04260b2..81ea55314b1f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3839,7 +3839,6 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
                         rb_erase(&ref->rb_node, &head->ref_root);
                         atomic_dec(&delayed_refs->num_entries);
                         btrfs_put_delayed_ref(ref);
-                        cond_resched_lock(&head->lock);
                 }
                 if (head->must_insert_reserved)
                         pin_bytes = true;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 9c9ecc93ae2c..32312e09f0f5 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2385,6 +2385,7 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
                         spin_unlock(&delayed_refs->lock);
                         locked_ref = NULL;
                         cond_resched();
+                        count++;
                         continue;
                 }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 184e9cb39647..d3d44486290b 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5154,7 +5154,7 @@ static struct dentry *btrfs_lookup(struct inode *dir, struct dentry *dentry,
                         return ERR_CAST(inode);
         }
 
-        return d_splice_alias(inode, dentry);
+        return d_materialise_unique(dentry, inode);
 }
 
 unsigned char btrfs_filetype_table[] = {
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index b0134892dc70..a6d8efa46bfe 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3537,20 +3537,6 @@ out:
         return ret;
 }
 
-static long btrfs_ioctl_global_rsv(struct btrfs_root *root, void __user *arg)
-{
-        struct btrfs_block_rsv *block_rsv = &root->fs_info->global_block_rsv;
-        u64 reserved;
-
-        spin_lock(&block_rsv->lock);
-        reserved = block_rsv->reserved;
-        spin_unlock(&block_rsv->lock);
-
-        if (arg && copy_to_user(arg, &reserved, sizeof(reserved)))
-                return -EFAULT;
-        return 0;
-}
-
 /*
  * there are many ways the trans_start and trans_end ioctls can lead
  * to deadlocks.  They should only be used by applications that
@@ -4525,7 +4511,7 @@ static int btrfs_ioctl_set_fslabel(struct file *file, void __user *arg)
         spin_lock(&root->fs_info->super_lock);
         strcpy(super_block->label, label);
         spin_unlock(&root->fs_info->super_lock);
-        ret = btrfs_end_transaction(trans, root);
+        ret = btrfs_commit_transaction(trans, root);
 
 out_unlock:
         mnt_drop_write_file(file);
@@ -4668,7 +4654,7 @@ static int btrfs_ioctl_set_features(struct file *file, void __user *arg)
         if (ret)
                 return ret;
 
-        trans = btrfs_start_transaction(root, 1);
+        trans = btrfs_start_transaction(root, 0);
         if (IS_ERR(trans))
                 return PTR_ERR(trans);
 
@@ -4689,7 +4675,7 @@ static int btrfs_ioctl_set_features(struct file *file, void __user *arg)
         btrfs_set_super_incompat_flags(super_block, newflags);
         spin_unlock(&root->fs_info->super_lock);
 
-        return btrfs_end_transaction(trans, root);
+        return btrfs_commit_transaction(trans, root);
 }
 
 long btrfs_ioctl(struct file *file, unsigned int
@@ -4757,8 +4743,6 @@ long btrfs_ioctl(struct file *file, unsigned int
                 return btrfs_ioctl_logical_to_ino(root, argp);
         case BTRFS_IOC_SPACE_INFO:
                 return btrfs_ioctl_space_info(root, argp);
-        case BTRFS_IOC_GLOBAL_RSV:
-                return btrfs_ioctl_global_rsv(root, argp);
         case BTRFS_IOC_SYNC: {
                 int ret;
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index cf9107a64204..9dde9717c1b9 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -1332,6 +1332,16 @@ verbose_printk(KERN_DEBUG "btrfs: find_extent_clone: data_offset=%llu, "
         }
 
         if (cur_clone_root) {
+                if (compressed != BTRFS_COMPRESS_NONE) {
+                        /*
+                         * Offsets given by iterate_extent_inodes() are relative
+                         * to the start of the extent, we need to add logical
+                         * offset from the file extent item.
+                         * (See why at backref.c:check_extent_in_eb())
+                         */
+                        cur_clone_root->offset += btrfs_file_extent_offset(eb,
+                                                                           fi);
+                }
                 *found = cur_clone_root;
                 ret = 0;
         } else {
@@ -2774,8 +2784,6 @@ static int add_waiting_dir_move(struct send_ctx *sctx, u64 ino)
         return 0;
 }
 
-#ifdef CONFIG_BTRFS_ASSERT
-
 static int del_waiting_dir_move(struct send_ctx *sctx, u64 ino)
 {
         struct rb_node *n = sctx->waiting_dir_moves.rb_node;
@@ -2796,8 +2804,6 @@ static int del_waiting_dir_move(struct send_ctx *sctx, u64 ino)
         return -ENOENT;
 }
 
-#endif
-
 static int add_pending_dir_move(struct send_ctx *sctx, u64 parent_ino)
 {
         struct rb_node **p = &sctx->pending_dir_moves.rb_node;
@@ -2902,7 +2908,9 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
         }
 
         sctx->send_progress = sctx->cur_ino + 1;
-        ASSERT(del_waiting_dir_move(sctx, pm->ino) == 0);
+        ret = del_waiting_dir_move(sctx, pm->ino);
+        ASSERT(ret == 0);
+
         ret = get_cur_path(sctx, pm->ino, pm->gen, to_path);
         if (ret < 0)
                 goto out;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 97cc24198554..d04db817be5c 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -566,7 +566,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                                 kfree(num);
 
                                 if (info->max_inline) {
-                                        info->max_inline = max_t(u64,
+                                        info->max_inline = min_t(u64,
                                                 info->max_inline,
                                                 root->sectorsize);
                                 }
@@ -855,6 +855,7 @@ static struct dentry *get_default_root(struct super_block *sb,
         struct btrfs_path *path;
         struct btrfs_key location;
         struct inode *inode;
+        struct dentry *dentry;
         u64 dir_id;
         int new = 0;
 
@@ -925,7 +926,13 @@ setup_root:
                 return dget(sb->s_root);
         }
 
-        return d_obtain_alias(inode);
+        dentry = d_obtain_alias(inode);
+        if (!IS_ERR(dentry)) {
+                spin_lock(&dentry->d_lock);
+                dentry->d_flags &= ~DCACHE_DISCONNECTED;
+                spin_unlock(&dentry->d_lock);
+        }
+        return dentry;
 }
 
 static int btrfs_fill_super(struct super_block *sb,
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index 782374d8fd19..865f4cf9a769 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -578,8 +578,14 @@ static int add_device_membership(struct btrfs_fs_info *fs_info)
                 return -ENOMEM;
 
         list_for_each_entry(dev, &fs_devices->devices, dev_list) {
-                struct hd_struct *disk = dev->bdev->bd_part;
-                struct kobject *disk_kobj = &part_to_dev(disk)->kobj;
+                struct hd_struct *disk;
+                struct kobject *disk_kobj;
+
+                if (!dev->bdev)
+                        continue;
+
+                disk = dev->bdev->bd_part;
+                disk_kobj = &part_to_dev(disk)->kobj;
 
                 error = sysfs_create_link(fs_info->device_dir_kobj,
                                           disk_kobj, disk_kobj->name);
diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c
index 4c2d452c4bfc..21887d63dad5 100644
--- a/fs/ceph/acl.c
+++ b/fs/ceph/acl.c
@@ -54,11 +54,6 @@ static inline struct posix_acl *ceph_get_cached_acl(struct inode *inode,
         return acl;
 }
 
-void ceph_forget_all_cached_acls(struct inode *inode)
-{
-        forget_all_cached_acls(inode);
-}
-
 struct posix_acl *ceph_get_acl(struct inode *inode, int type)
 {
         int size;
@@ -160,11 +155,7 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type)
                         goto out_dput;
         }
 
-        if (value)
-                ret = __ceph_setxattr(dentry, name, value, size, 0);
-        else
-                ret = __ceph_removexattr(dentry, name);
-
+        ret = __ceph_setxattr(dentry, name, value, size, 0);
         if (ret) {
                 if (new_mode != old_mode) {
                         newattrs.ia_mode = old_mode;
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 6da4df84ba30..45eda6d7a40c 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -100,6 +100,14 @@ static unsigned fpos_off(loff_t p)
         return p & 0xffffffff;
 }
 
+static int fpos_cmp(loff_t l, loff_t r)
+{
+        int v = ceph_frag_compare(fpos_frag(l), fpos_frag(r));
+        if (v)
+                return v;
+        return (int)(fpos_off(l) - fpos_off(r));
+}
+
 /*
  * When possible, we try to satisfy a readdir by peeking at the
  * dcache.  We make this work by carefully ordering dentries on
@@ -156,7 +164,7 @@ more:
                 if (!d_unhashed(dentry) && dentry->d_inode &&
                     ceph_snap(dentry->d_inode) != CEPH_SNAPDIR &&
                     ceph_ino(dentry->d_inode) != CEPH_INO_CEPH &&
-                    ctx->pos <= di->offset)
+                    fpos_cmp(ctx->pos, di->offset) <= 0)
                         break;
                 dout(" skipping %p %.*s at %llu (%llu)%s%s\n", dentry,
                      dentry->d_name.len, dentry->d_name.name, di->offset,
@@ -695,9 +703,8 @@ static int ceph_mknod(struct inode *dir, struct dentry *dentry,
         ceph_mdsc_put_request(req);
 
         if (!err)
-                err = ceph_init_acl(dentry, dentry->d_inode, dir);
-
-        if (err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                 d_drop(dentry);
         return err;
 }
@@ -735,7 +742,9 @@ static int ceph_symlink(struct inode *dir, struct dentry *dentry,
         if (!err && !req->r_reply_info.head->is_dentry)
                 err = ceph_handle_notrace_create(dir, dentry);
         ceph_mdsc_put_request(req);
-        if (err)
+        if (!err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                 d_drop(dentry);
         return err;
 }
@@ -776,7 +785,9 @@ static int ceph_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
                 err = ceph_handle_notrace_create(dir, dentry);
         ceph_mdsc_put_request(req);
 out:
-        if (err < 0)
+        if (!err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                 d_drop(dentry);
         return err;
 }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index dfd2ce3419f8..09c7afe32e49 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -286,6 +286,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
         } else {
                 dout("atomic_open finish_open on dn %p\n", dn);
                 if (req->r_op == CEPH_MDS_OP_CREATE && req->r_reply_info.has_create_ino) {
+                        ceph_init_acl(dentry, dentry->d_inode, dir);
                         *opened |= FILE_CREATED;
                 }
                 err = finish_open(file, dentry, ceph_open, opened);
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 2df963f1cf5a..10a4ccbf38da 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -144,7 +144,11 @@ enum {
         Opt_ino32,
         Opt_noino32,
         Opt_fscache,
-        Opt_nofscache
+        Opt_nofscache,
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        Opt_acl,
+#endif
+        Opt_noacl
 };
 
 static match_table_t fsopt_tokens = {
@@ -172,6 +176,10 @@ static match_table_t fsopt_tokens = {
         {Opt_noino32, "noino32"},
         {Opt_fscache, "fsc"},
         {Opt_nofscache, "nofsc"},
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        {Opt_acl, "acl"},
+#endif
+        {Opt_noacl, "noacl"},
         {-1, NULL}
 };
 
@@ -271,6 +279,14 @@ static int parse_fsopt_token(char *c, void *private)
         case Opt_nofscache:
                 fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
                 break;
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        case Opt_acl:
+                fsopt->sb_flags |= MS_POSIXACL;
+                break;
+#endif
+        case Opt_noacl:
+                fsopt->sb_flags &= ~MS_POSIXACL;
+                break;
         default:
                 BUG_ON(token);
         }
@@ -438,6 +454,13 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
         else
                 seq_puts(m, ",nofsc");
 
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        if (fsopt->sb_flags & MS_POSIXACL)
+                seq_puts(m, ",acl");
+        else
+                seq_puts(m, ",noacl");
+#endif
+
         if (fsopt->wsize)
                 seq_printf(m, ",wsize=%d", fsopt->wsize);
         if (fsopt->rsize != CEPH_RSIZE_DEFAULT)
@@ -819,9 +842,6 @@ static int ceph_set_super(struct super_block *s, void *data)
 
         s->s_flags = fsc->mount_options->sb_flags;
         s->s_maxbytes = 1ULL << 40;  /* temp value until we get mdsmap */
-#ifdef CONFIG_CEPH_FS_POSIX_ACL
-        s->s_flags |= MS_POSIXACL;
-#endif
 
         s->s_xattr = ceph_xattr_handlers;
         s->s_fs_info = fsc;
@@ -911,6 +931,10 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
         struct ceph_options *opt = NULL;
 
         dout("ceph_mount\n");
+
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        flags |= MS_POSIXACL;
+#endif
         err = parse_mount_options(&fsopt, &opt, flags, data, dev_name, &path);
         if (err < 0) {
                 res = ERR_PTR(err);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 19793b56d0a7..d8801a95b685 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -13,6 +13,7 @@
 #include <linux/wait.h>
 #include <linux/writeback.h>
 #include <linux/slab.h>
+#include <linux/posix_acl.h>
 
 #include <linux/ceph/libceph.h>
 
@@ -743,7 +744,11 @@ extern const struct xattr_handler *ceph_xattr_handlers[];
 struct posix_acl *ceph_get_acl(struct inode *, int);
 int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type);
 int ceph_init_acl(struct dentry *, struct inode *, struct inode *);
-void ceph_forget_all_cached_acls(struct inode *inode);
+
+static inline void ceph_forget_all_cached_acls(struct inode *inode)
+{
+       forget_all_cached_acls(inode);
+}
 
 #else
 
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 898b6565ad3e..a55ec37378c6 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -12,6 +12,9 @@
 #define XATTR_CEPH_PREFIX "ceph."
 #define XATTR_CEPH_PREFIX_LEN (sizeof (XATTR_CEPH_PREFIX) - 1)
 
+static int __remove_xattr(struct ceph_inode_info *ci,
+                          struct ceph_inode_xattr *xattr);
+
 /*
  * List of handlers for synthetic system.* attributes. Other
  * attributes are handled directly.
@@ -319,8 +322,7 @@ static struct ceph_vxattr *ceph_match_vxattr(struct inode *inode,
 static int __set_xattr(struct ceph_inode_info *ci,
                            const char *name, int name_len,
                            const char *val, int val_len,
-                           int dirty,
-                           int should_free_name, int should_free_val,
+                           int flags, int update_xattr,
                            struct ceph_inode_xattr **newxattr)
 {
         struct rb_node **p;
@@ -349,12 +351,31 @@ static int __set_xattr(struct ceph_inode_info *ci,
                 xattr = NULL;
         }
 
+        if (update_xattr) {
+                int err = 0;
+                if (xattr && (flags & XATTR_CREATE))
+                        err = -EEXIST;
+                else if (!xattr && (flags & XATTR_REPLACE))
+                        err = -ENODATA;
+                if (err) {
+                        kfree(name);
+                        kfree(val);
+                        return err;
+                }
+                if (update_xattr < 0) {
+                        if (xattr)
+                                __remove_xattr(ci, xattr);
+                        kfree(name);
+                        return 0;
+                }
+        }
+
         if (!xattr) {
                 new = 1;
                 xattr = *newxattr;
                 xattr->name = name;
                 xattr->name_len = name_len;
-                xattr->should_free_name = should_free_name;
+                xattr->should_free_name = update_xattr;
 
                 ci->i_xattrs.count++;
                 dout("__set_xattr count=%d\n", ci->i_xattrs.count);
@@ -364,7 +385,7 @@ static int __set_xattr(struct ceph_inode_info *ci,
                 if (xattr->should_free_val)
                         kfree((void *)xattr->val);
 
-                if (should_free_name) {
+                if (update_xattr) {
                         kfree((void *)name);
                         name = xattr->name;
                 }
@@ -379,8 +400,8 @@ static int __set_xattr(struct ceph_inode_info *ci,
                 xattr->val = "";
 
         xattr->val_len = val_len;
-        xattr->dirty = dirty;
-        xattr->should_free_val = (val && should_free_val);
+        xattr->dirty = update_xattr;
+        xattr->should_free_val = (val && update_xattr);
 
         if (new) {
                 rb_link_node(&xattr->node, parent, p);
@@ -442,7 +463,7 @@ static int __remove_xattr(struct ceph_inode_info *ci,
                           struct ceph_inode_xattr *xattr)
 {
         if (!xattr)
-                return -EOPNOTSUPP;
+                return -ENODATA;
 
         rb_erase(&xattr->node, &ci->i_xattrs.index);
 
@@ -588,7 +609,7 @@ start:
                         p += len;
 
                         err = __set_xattr(ci, name, namelen, val, len,
-                                          0, 0, 0, &xattrs[numattr]);
+                                          0, 0, &xattrs[numattr]);
 
                         if (err < 0)
                                 goto bad;
@@ -850,6 +871,9 @@ static int ceph_sync_setxattr(struct dentry *dentry, const char *name,
 
         dout("setxattr value=%.*s\n", (int)size, value);
 
+        if (!value)
+                flags |= CEPH_XATTR_REMOVE;
+
         /* do request */
         req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_SETXATTR,
                                        USE_AUTH_MDS);
@@ -892,7 +916,7 @@ int __ceph_setxattr(struct dentry *dentry, const char *name,
         struct ceph_inode_info *ci = ceph_inode(inode);
         int issued;
         int err;
-        int dirty;
+        int dirty = 0;
         int name_len = strlen(name);
         int val_len = size;
         char *newname = NULL;
@@ -953,12 +977,14 @@ retry:
                 goto retry;
         }
 
-        err = __set_xattr(ci, newname, name_len, newval,
-                          val_len, 1, 1, 1, &xattr);
+        err = __set_xattr(ci, newname, name_len, newval, val_len,
+                          flags, value ? 1 : -1, &xattr);
 
-        dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
-        ci->i_xattrs.dirty = true;
-        inode->i_ctime = CURRENT_TIME;
+        if (!err) {
+                dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
+                ci->i_xattrs.dirty = true;
+                inode->i_ctime = CURRENT_TIME;
+        }
 
         spin_unlock(&ci->i_ceph_lock);
         if (dirty)
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 8f9b4f710d4a..7ff866dbb89e 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -865,8 +865,8 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
         return rc;
 }
 
-static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
-                __u16 fid, u32 *pacllen)
+struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
+                const struct cifs_fid *cifsfid, u32 *pacllen)
 {
         struct cifs_ntsd *pntsd = NULL;
         unsigned int xid;
@@ -877,7 +877,8 @@ static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
                 return ERR_CAST(tlink);
 
         xid = get_xid();
-        rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), fid, &pntsd, pacllen);
+        rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), cifsfid->netfid, &pntsd,
+                                pacllen);
         free_xid(xid);
 
         cifs_put_tlink(tlink);
@@ -946,7 +947,7 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
         if (!open_file)
                 return get_cifs_acl_by_path(cifs_sb, path, pacllen);
 
-        pntsd = get_cifs_acl_by_fid(cifs_sb, open_file->fid.netfid, pacllen);
+        pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen);
         cifsFileInfo_put(open_file);
         return pntsd;
 }
@@ -1006,19 +1007,31 @@ out:
 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
 int
 cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
-                  struct inode *inode, const char *path, const __u16 *pfid)
+                  struct inode *inode, const char *path,
+                  const struct cifs_fid *pfid)
 {
         struct cifs_ntsd *pntsd = NULL;
         u32 acllen = 0;
         int rc = 0;
+        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
+        struct cifs_tcon *tcon;
 
         cifs_dbg(NOISY, "converting ACL to mode for %s\n", path);
 
-        if (pfid)
-                pntsd = get_cifs_acl_by_fid(cifs_sb, *pfid, &acllen);
-        else
-                pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
+        if (IS_ERR(tlink))
+                return PTR_ERR(tlink);
+        tcon = tlink_tcon(tlink);
 
+        if (pfid && (tcon->ses->server->ops->get_acl_by_fid))
+                pntsd = tcon->ses->server->ops->get_acl_by_fid(cifs_sb, pfid,
+                                                          &acllen);
+        else if (tcon->ses->server->ops->get_acl)
+                pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
+                                                        &acllen);
+        else {
+                cifs_put_tlink(tlink);
+                return -EOPNOTSUPP;
+        }
         /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
         if (IS_ERR(pntsd)) {
                 rc = PTR_ERR(pntsd);
@@ -1030,6 +1043,8 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
                         cifs_dbg(VFS, "parse sec desc failed rc = %d\n", rc);
         }
 
+        cifs_put_tlink(tlink);
+
         return rc;
 }
 
@@ -1043,15 +1058,30 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
         __u32 secdesclen = 0;
         struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
         struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
+        struct cifs_tcon *tcon;
+
+        if (IS_ERR(tlink))
+                return PTR_ERR(tlink);
+        tcon = tlink_tcon(tlink);
 
         cifs_dbg(NOISY, "set ACL from mode for %s\n", path);
 
         /* Get the security descriptor */
-        pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen);
+
+        if (tcon->ses->server->ops->get_acl == NULL) {
+                cifs_put_tlink(tlink);
+                return -EOPNOTSUPP;
+        }
+
+        pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
+                                                &secdesclen);
         if (IS_ERR(pntsd)) {
                 rc = PTR_ERR(pntsd);
                 cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
-                goto out;
+                cifs_put_tlink(tlink);
+                return rc;
         }
 
         /*
@@ -1064,6 +1094,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
         pnntsd = kmalloc(secdesclen, GFP_KERNEL);
         if (!pnntsd) {
                 kfree(pntsd);
+                cifs_put_tlink(tlink);
                 return -ENOMEM;
         }
 
@@ -1072,14 +1103,18 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
 
         cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc);
 
+        if (tcon->ses->server->ops->set_acl == NULL)
+                rc = -EOPNOTSUPP;
+
         if (!rc) {
                 /* Set the security descriptor */
-                rc = set_cifs_acl(pnntsd, secdesclen, inode, path, aclflag);
+                rc = tcon->ses->server->ops->set_acl(pnntsd, secdesclen, inode,
+                                                     path, aclflag);
                 cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc);
         }
+        cifs_put_tlink(tlink);
 
         kfree(pnntsd);
         kfree(pntsd);
-out:
         return rc;
 }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index a245d1809ed8..cf32f0393369 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -323,7 +323,8 @@ struct smb_version_operations {
         /* async read from the server */
         int (*async_readv)(struct cifs_readdata *);
         /* async write to the server */
-        int (*async_writev)(struct cifs_writedata *);
+        int (*async_writev)(struct cifs_writedata *,
+                            void (*release)(struct kref *));
         /* sync read from the server */
         int (*sync_read)(const unsigned int, struct cifsFileInfo *,
                          struct cifs_io_parms *, unsigned int *, char **,
@@ -395,6 +396,12 @@ struct smb_version_operations {
         int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *,
                         const char *, const void *, const __u16,
                         const struct nls_table *, int);
+        struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *,
+                        const char *, u32 *);
+        struct cifs_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *,
+                        const struct cifs_fid *, u32 *);
+        int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
+                        int);
 };
 
 struct smb_version_values {
@@ -1064,7 +1071,7 @@ struct cifs_writedata {
         unsigned int                    pagesz;
         unsigned int                    tailsz;
         unsigned int                    nr_pages;
-        struct page                     *pages[1];
+        struct page                     *pages[];
 };
 
 /*
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 79e6e9a93a8c..acc4ee8ed075 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -151,7 +151,7 @@ extern struct inode *cifs_iget(struct super_block *sb,
 
 extern int cifs_get_inode_info(struct inode **inode, const char *full_path,
                                FILE_ALL_INFO *data, struct super_block *sb,
-                               int xid, const __u16 *fid);
+                               int xid, const struct cifs_fid *fid);
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                         const unsigned char *search_path,
                         struct super_block *sb, unsigned int xid);
@@ -162,11 +162,13 @@ extern int cifs_rename_pending_delete(const char *full_path,
                                       const unsigned int xid);
 extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb,
                               struct cifs_fattr *fattr, struct inode *inode,
-                              const char *path, const __u16 *pfid);
+                              const char *path, const struct cifs_fid *pfid);
 extern int id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64,
                                         kuid_t, kgid_t);
 extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *,
                                         const char *, u32 *);
+extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *,
+                                                const struct cifs_fid *, u32 *);
 extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
                                 const char *, int);
 
@@ -488,7 +490,8 @@ void cifs_readdata_release(struct kref *refcount);
 int cifs_async_readv(struct cifs_readdata *rdata);
 int cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid);
 
-int cifs_async_writev(struct cifs_writedata *wdata);
+int cifs_async_writev(struct cifs_writedata *wdata,
+                      void (*release)(struct kref *kref));
 void cifs_writev_complete(struct work_struct *work);
 struct cifs_writedata *cifs_writedata_alloc(unsigned int nr_pages,
                                                 work_func_t complete);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 4d881c35eeca..f3264bd7a83d 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1910,7 +1910,7 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
 
         do {
                 server = tlink_tcon(wdata->cfile->tlink)->ses->server;
-                rc = server->ops->async_writev(wdata);
+                rc = server->ops->async_writev(wdata, cifs_writedata_release);
         } while (rc == -EAGAIN);
 
         for (i = 0; i < wdata->nr_pages; i++) {
@@ -1962,15 +1962,9 @@ cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete)
 {
         struct cifs_writedata *wdata;
 
-        /* this would overflow */
-        if (nr_pages == 0) {
-                cifs_dbg(VFS, "%s: called with nr_pages == 0!\n", __func__);
-                return NULL;
-        }
-
         /* writedata + number of page pointers */
         wdata = kzalloc(sizeof(*wdata) +
-                        sizeof(struct page *) * (nr_pages - 1), GFP_NOFS);
+                        sizeof(struct page *) * nr_pages, GFP_NOFS);
         if (wdata != NULL) {
                 kref_init(&wdata->refcount);
                 INIT_LIST_HEAD(&wdata->list);
@@ -2031,7 +2025,8 @@ cifs_writev_callback(struct mid_q_entry *mid)
 
 /* cifs_async_writev - send an async write, and set up mid to handle result */
 int
-cifs_async_writev(struct cifs_writedata *wdata)
+cifs_async_writev(struct cifs_writedata *wdata,
+                  void (*release)(struct kref *kref))
 {
         int rc = -EACCES;
         WRITE_REQ *smb = NULL;
@@ -2105,7 +2100,7 @@ cifs_async_writev(struct cifs_writedata *wdata)
         if (rc == 0)
                 cifs_stats_inc(&tcon->stats.cifs_stats.num_writes);
         else
-                kref_put(&wdata->refcount, cifs_writedata_release);
+                kref_put(&wdata->refcount, release);
 
 async_writev_out:
         cifs_small_buf_release(smb);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index d3a6796caa5a..3db0c5fd9a11 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -378,7 +378,7 @@ cifs_create_get_file_info:
                                               xid);
         else {
                 rc = cifs_get_inode_info(&newinode, full_path, buf, inode->i_sb,
-                                         xid, &fid->netfid);
+                                         xid, fid);
                 if (newinode) {
                         if (server->ops->set_lease_key)
                                 server->ops->set_lease_key(newinode, fid);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 853d6d1cc822..53c15074bb36 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -244,7 +244,7 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
                                               xid);
         else
                 rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
-                                         xid, &fid->netfid);
+                                         xid, fid);
 
 out:
         kfree(buf);
@@ -2043,7 +2043,8 @@ retry:
                         }
                         wdata->pid = wdata->cfile->pid;
                         server = tlink_tcon(wdata->cfile->tlink)->ses->server;
-                        rc = server->ops->async_writev(wdata);
+                        rc = server->ops->async_writev(wdata,
+                                                        cifs_writedata_release);
                 } while (wbc->sync_mode == WB_SYNC_ALL && rc == -EAGAIN);
 
                 for (i = 0; i < nr_pages; ++i)
@@ -2331,9 +2332,20 @@ size_t get_numpages(const size_t wsize, const size_t len, size_t *cur_len)
 }
 
 static void
-cifs_uncached_writev_complete(struct work_struct *work)
+cifs_uncached_writedata_release(struct kref *refcount)
 {
         int i;
+        struct cifs_writedata *wdata = container_of(refcount,
+                                        struct cifs_writedata, refcount);
+
+        for (i = 0; i < wdata->nr_pages; i++)
+                put_page(wdata->pages[i]);
+        cifs_writedata_release(refcount);
+}
+
+static void
+cifs_uncached_writev_complete(struct work_struct *work)
+{
         struct cifs_writedata *wdata = container_of(work,
                                         struct cifs_writedata, work);
         struct inode *inode = wdata->cfile->dentry->d_inode;
@@ -2347,12 +2359,7 @@ cifs_uncached_writev_complete(struct work_struct *work)
 
         complete(&wdata->done);
 
-        if (wdata->result != -EAGAIN) {
-                for (i = 0; i < wdata->nr_pages; i++)
-                        put_page(wdata->pages[i]);
-        }
-
-        kref_put(&wdata->refcount, cifs_writedata_release);
+        kref_put(&wdata->refcount, cifs_uncached_writedata_release);
 }
 
 /* attempt to send write to server, retry on any -EAGAIN errors */
@@ -2370,7 +2377,8 @@ cifs_uncached_retry_writev(struct cifs_writedata *wdata)
                         if (rc != 0)
                                 continue;
                 }
-                rc = server->ops->async_writev(wdata);
+                rc = server->ops->async_writev(wdata,
+                                               cifs_uncached_writedata_release);
         } while (rc == -EAGAIN);
 
         return rc;
@@ -2381,7 +2389,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                  unsigned long nr_segs, loff_t *poffset)
 {
         unsigned long nr_pages, i;
-        size_t copied, len, cur_len;
+        size_t bytes, copied, len, cur_len;
         ssize_t total_written = 0;
         loff_t offset;
         struct iov_iter it;
@@ -2436,14 +2444,45 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
 
                 save_len = cur_len;
                 for (i = 0; i < nr_pages; i++) {
-                        copied = min_t(const size_t, cur_len, PAGE_SIZE);
+                        bytes = min_t(const size_t, cur_len, PAGE_SIZE);
                         copied = iov_iter_copy_from_user(wdata->pages[i], &it,
-                                                         0, copied);
+                                                         0, bytes);
                         cur_len -= copied;
                         iov_iter_advance(&it, copied);
+                        /*
+                         * If we didn't copy as much as we expected, then that
+                         * may mean we trod into an unmapped area. Stop copying
+                         * at that point. On the next pass through the big
+                         * loop, we'll likely end up getting a zero-length
+                         * write and bailing out of it.
+                         */
+                        if (copied < bytes)
+                                break;
                 }
                 cur_len = save_len - cur_len;
 
+                /*
+                 * If we have no data to send, then that probably means that
+                 * the copy above failed altogether. That's most likely because
+                 * the address in the iovec was bogus. Set the rc to -EFAULT,
+                 * free anything we allocated and bail out.
+                 */
+                if (!cur_len) {
+                        for (i = 0; i < nr_pages; i++)
+                                put_page(wdata->pages[i]);
+                        kfree(wdata);
+                        rc = -EFAULT;
+                        break;
+                }
+
+                /*
+                 * i + 1 now represents the number of pages we actually used in
+                 * the copy phase above. Bring nr_pages down to that, and free
+                 * any pages that we didn't use.
+                 */
+                for ( ; nr_pages > i + 1; nr_pages--)
+                        put_page(wdata->pages[nr_pages - 1]);
+
                 wdata->sync_mode = WB_SYNC_ALL;
                 wdata->nr_pages = nr_pages;
                 wdata->offset = (__u64)offset;
@@ -2454,7 +2493,8 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                 wdata->tailsz = cur_len - ((nr_pages - 1) * PAGE_SIZE);
                 rc = cifs_uncached_retry_writev(wdata);
                 if (rc) {
-                        kref_put(&wdata->refcount, cifs_writedata_release);
+                        kref_put(&wdata->refcount,
+                                 cifs_uncached_writedata_release);
                         break;
                 }
 
@@ -2496,7 +2536,7 @@ restart_loop:
                         }
                 }
                 list_del_init(&wdata->list);
-                kref_put(&wdata->refcount, cifs_writedata_release);
+                kref_put(&wdata->refcount, cifs_uncached_writedata_release);
         }
 
         if (total_written > 0)
@@ -2559,8 +2599,8 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
         if (rc > 0) {
                 ssize_t err;
 
-                err = generic_write_sync(file, pos, rc);
-                if (err < 0 && rc > 0)
+                err = generic_write_sync(file, iocb->ki_pos - rc, rc);
+                if (err < 0)
                         rc = err;
         }
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 9cb9679d7357..aadc2b68678b 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -527,10 +527,15 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
                 return PTR_ERR(tlink);
         tcon = tlink_tcon(tlink);
 
-        rc = CIFSSMBQAllEAs(xid, tcon, path, "SETFILEBITS",
-                            ea_value, 4 /* size of buf */, cifs_sb->local_nls,
-                            cifs_sb->mnt_cifs_flags &
-                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+        if (tcon->ses->server->ops->query_all_EAs == NULL) {
+                cifs_put_tlink(tlink);
+                return -EOPNOTSUPP;
+        }
+
+        rc = tcon->ses->server->ops->query_all_EAs(xid, tcon, path,
+                        "SETFILEBITS", ea_value, 4 /* size of buf */,
+                        cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         cifs_put_tlink(tlink);
         if (rc < 0)
                 return (int)rc;
@@ -672,7 +677,7 @@ cgfi_exit:
 int
 cifs_get_inode_info(struct inode **inode, const char *full_path,
                     FILE_ALL_INFO *data, struct super_block *sb, int xid,
-                    const __u16 *fid)
+                    const struct cifs_fid *fid)
 {
         bool validinum = false;
         __u16 srchflgs;
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index 9ac5bfc9cc56..526fb89f9230 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1067,6 +1067,15 @@ struct smb_version_operations smb1_operations = {
         .query_mf_symlink = cifs_query_mf_symlink,
         .create_mf_symlink = cifs_create_mf_symlink,
         .is_read_op = cifs_is_read_op,
+#ifdef CONFIG_CIFS_XATTR
+        .query_all_EAs = CIFSSMBQAllEAs,
+        .set_EA = CIFSSMBSetEA,
+#endif /* CIFS_XATTR */
+#ifdef CONFIG_CIFS_ACL
+        .get_acl = get_cifs_acl,
+        .get_acl_by_fid = get_cifs_acl_by_fid,
+        .set_acl = set_cifs_acl,
+#endif /* CIFS_ACL */
 };
 
 struct smb_version_values smb1_values = {
diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h
index c38350851b08..bc0bb9c34f72 100644
--- a/fs/cifs/smb2glob.h
+++ b/fs/cifs/smb2glob.h
@@ -57,4 +57,7 @@
 #define SMB2_CMACAES_SIZE (16)
 #define SMB3_SIGNKEY_SIZE (16)
 
+/* Maximum buffer size value we can send with 1 credit */
+#define SMB2_MAX_BUFFER_SIZE 65536
+
 #endif  /* _SMB2_GLOB_H */
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 757da3e54d3d..192f51a12cf1 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -182,11 +182,8 @@ smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         /* start with specified wsize, or default */
         wsize = volume_info->wsize ? volume_info->wsize : CIFS_DEFAULT_IOSIZE;
         wsize = min_t(unsigned int, wsize, server->max_write);
-        /*
-         * limit write size to 2 ** 16, because we don't support multicredit
-         * requests now.
-         */
-        wsize = min_t(unsigned int, wsize, 2 << 15);
+        /* set it to the maximum buffer size value we can send with 1 credit */
+        wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE);
 
         return wsize;
 }
@@ -200,11 +197,8 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         /* start with specified rsize, or default */
         rsize = volume_info->rsize ? volume_info->rsize : CIFS_DEFAULT_IOSIZE;
         rsize = min_t(unsigned int, rsize, server->max_read);
-        /*
-         * limit write size to 2 ** 16, because we don't support multicredit
-         * requests now.
-         */
-        rsize = min_t(unsigned int, rsize, 2 << 15);
+        /* set it to the maximum buffer size value we can send with 1 credit */
+        rsize = min_t(unsigned int, rsize, SMB2_MAX_BUFFER_SIZE);
 
         return rsize;
 }
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 2013234b73ad..860344701067 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -413,7 +413,9 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
 
         /* SMB2 only has an extended negflavor */
         server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
-        server->maxBuf = le32_to_cpu(rsp->MaxTransactSize);
+        /* set it to the maximum buffer size value we can send with 1 credit */
+        server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
+                               SMB2_MAX_BUFFER_SIZE);
         server->max_read = le32_to_cpu(rsp->MaxReadSize);
         server->max_write = le32_to_cpu(rsp->MaxWriteSize);
         /* BB Do we need to validate the SecurityMode? */
@@ -1890,7 +1892,8 @@ smb2_writev_callback(struct mid_q_entry *mid)
 
 /* smb2_async_writev - send an async write, and set up mid to handle result */
 int
-smb2_async_writev(struct cifs_writedata *wdata)
+smb2_async_writev(struct cifs_writedata *wdata,
+                  void (*release)(struct kref *kref))
 {
         int rc = -EACCES;
         struct smb2_write_req *req = NULL;
@@ -1938,7 +1941,7 @@ smb2_async_writev(struct cifs_writedata *wdata)
                                 smb2_writev_callback, wdata, 0);
 
         if (rc) {
-                kref_put(&wdata->refcount, cifs_writedata_release);
+                kref_put(&wdata->refcount, release);
                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
         }
 
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 93adc64666f3..0ce48db20a65 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -123,7 +123,8 @@ extern int SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
 extern int smb2_async_readv(struct cifs_readdata *rdata);
 extern int SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
                      unsigned int *nbytes, char **buf, int *buf_type);
-extern int smb2_async_writev(struct cifs_writedata *wdata);
+extern int smb2_async_writev(struct cifs_writedata *wdata,
+                             void (*release)(struct kref *kref));
 extern int SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
                       unsigned int *nbytes, struct kvec *iov, int n_vec);
 extern int SMB2_echo(struct TCP_Server_Info *server);
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 95c43bb20335..5ac836a86b18 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -176,8 +176,12 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name,
                         rc = -ENOMEM;
                 } else {
                         memcpy(pacl, ea_value, value_size);
-                        rc = set_cifs_acl(pacl, value_size,
-                                direntry->d_inode, full_path, CIFS_ACL_DACL);
+                        if (pTcon->ses->server->ops->set_acl)
+                                rc = pTcon->ses->server->ops->set_acl(pacl,
+                                                value_size, direntry->d_inode,
+                                                full_path, CIFS_ACL_DACL);
+                        else
+                                rc = -EOPNOTSUPP;
                         if (rc == 0) /* force revalidate of the inode */
                                 CIFS_I(direntry->d_inode)->time = 0;
                         kfree(pacl);
@@ -323,8 +327,11 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                         u32 acllen;
                         struct cifs_ntsd *pacl;
 
-                        pacl = get_cifs_acl(cifs_sb, direntry->d_inode,
-                                                full_path, &acllen);
+                        if (pTcon->ses->server->ops->get_acl == NULL)
+                                goto get_ea_exit; /* rc already EOPNOTSUPP */
+
+                        pacl = pTcon->ses->server->ops->get_acl(cifs_sb,
+                                        direntry->d_inode, full_path, &acllen);
                         if (IS_ERR(pacl)) {
                                 rc = PTR_ERR(pacl);
                                 cifs_dbg(VFS, "%s: error %zd getting sec desc\n",
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index ece55565b9cd..d3a534fdc5ff 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -771,6 +771,8 @@ do {									       \
         if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime))                      \
                 (einode)->xtime.tv_sec =                                       \
                         (signed)le32_to_cpu((raw_inode)->xtime);               \
+        else                                                                   \
+                (einode)->xtime.tv_sec = 0;                                    \
         if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime ## _extra))            \
                 ext4_decode_extra_time(&(einode)->xtime,                       \
                                        raw_inode->xtime ## _extra);            \
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 10cff4736b11..74bc2d549c58 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3906,6 +3906,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                 } else
                         err = ret;
                 map->m_flags |= EXT4_MAP_MAPPED;
+                map->m_pblk = newblock;
                 if (allocated > map->m_len)
                         allocated = map->m_len;
                 map->m_len = allocated;
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 43e64f6022eb..1a5073959f32 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -152,7 +152,7 @@ ext4_file_dio_write(struct kiocb *iocb, const struct iovec *iov,
         if (ret > 0) {
                 ssize_t err;
 
-                err = generic_write_sync(file, pos, ret);
+                err = generic_write_sync(file, iocb->ki_pos - ret, ret);
                 if (err < 0 && ret > 0)
                         ret = err;
         }
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 6bea80614d77..a2a837f00407 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -140,7 +140,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
         handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
         if (IS_ERR(handle)) {
                 err = -EINVAL;
-                goto swap_boot_out;
+                goto journal_err_out;
         }
 
         /* Protect extent tree against block allocations via delalloc */
@@ -198,6 +198,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
 
         ext4_double_up_write_data_sem(inode, inode_bl);
 
+journal_err_out:
         ext4_inode_resume_unlocked_dio(inode);
         ext4_inode_resume_unlocked_dio(inode_bl);
 
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index c5adbb318a90..f3b84cd9de56 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -243,6 +243,7 @@ static int ext4_alloc_group_tables(struct super_block *sb,
         ext4_group_t group;
         ext4_group_t last_group;
         unsigned overhead;
+        __u16 uninit_mask = (flexbg_size > 1) ? ~EXT4_BG_BLOCK_UNINIT : ~0;
 
         BUG_ON(flex_gd->count == 0 || group_data == NULL);
 
@@ -266,7 +267,7 @@ next_group:
         src_group++;
         for (; src_group <= last_group; src_group++) {
                 overhead = ext4_group_overhead_blocks(sb, src_group);
-                if (overhead != 0)
+                if (overhead == 0)
                         last_blk += group_data[src_group - group].blocks_count;
                 else
                         break;
@@ -280,8 +281,7 @@ next_group:
                 group = ext4_get_group_number(sb, start_blk - 1);
                 group -= group_data[0].group;
                 group_data[group].free_blocks_count--;
-                if (flexbg_size > 1)
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
+                flex_gd->bg_flags[group] &= uninit_mask;
         }
 
         /* Allocate inode bitmaps */
@@ -292,22 +292,30 @@ next_group:
                 group = ext4_get_group_number(sb, start_blk - 1);
                 group -= group_data[0].group;
                 group_data[group].free_blocks_count--;
-                if (flexbg_size > 1)
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
+                flex_gd->bg_flags[group] &= uninit_mask;
         }
 
         /* Allocate inode tables */
         for (; it_index < flex_gd->count; it_index++) {
-                if (start_blk + EXT4_SB(sb)->s_itb_per_group > last_blk)
+                unsigned int itb = EXT4_SB(sb)->s_itb_per_group;
+                ext4_fsblk_t next_group_start;
+
+                if (start_blk + itb > last_blk)
                         goto next_group;
                 group_data[it_index].inode_table = start_blk;
-                group = ext4_get_group_number(sb, start_blk - 1);
+                group = ext4_get_group_number(sb, start_blk);
+                next_group_start = ext4_group_first_block_no(sb, group + 1);
                 group -= group_data[0].group;
-                group_data[group].free_blocks_count -=
-                                        EXT4_SB(sb)->s_itb_per_group;
-                if (flexbg_size > 1)
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
 
+                if (start_blk + itb > next_group_start) {
+                        flex_gd->bg_flags[group + 1] &= uninit_mask;
+                        overhead = start_blk + itb - next_group_start;
+                        group_data[group + 1].free_blocks_count -= overhead;
+                        itb -= overhead;
+                }
+
+                group_data[group].free_blocks_count -= itb;
+                flex_gd->bg_flags[group] &= uninit_mask;
                 start_blk += EXT4_SB(sb)->s_itb_per_group;
         }
 
@@ -401,7 +409,7 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle,
                 start = ext4_group_first_block_no(sb, group);
                 group -= flex_gd->groups[0].group;
 
-                count2 = sb->s_blocksize * 8 - (block - start);
+                count2 = EXT4_BLOCKS_PER_GROUP(sb) - (block - start);
                 if (count2 > count)
                         count2 = count;
 
@@ -620,7 +628,7 @@ handle_ib:
                         if (err)
                                 goto out;
                         count = group_table_count[j];
-                        start = group_data[i].block_bitmap;
+                        start = (&group_data[i].block_bitmap)[j];
                         block = start;
                 }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1f7784de05b6..710fed2377d4 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3695,16 +3695,22 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         for (i = 0; i < 4; i++)
                 sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);
         sbi->s_def_hash_version = es->s_def_hash_version;
-        i = le32_to_cpu(es->s_flags);
-        if (i & EXT2_FLAGS_UNSIGNED_HASH)
-                sbi->s_hash_unsigned = 3;
-        else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) {
+        if (EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
+                i = le32_to_cpu(es->s_flags);
+                if (i & EXT2_FLAGS_UNSIGNED_HASH)
+                        sbi->s_hash_unsigned = 3;
+                else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) {
 #ifdef __CHAR_UNSIGNED__
-                es->s_flags |= cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH);
-                sbi->s_hash_unsigned = 3;
+                        if (!(sb->s_flags & MS_RDONLY))
+                                es->s_flags |=
+                                        cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH);
+                        sbi->s_hash_unsigned = 3;
 #else
-                es->s_flags |= cpu_to_le32(EXT2_FLAGS_SIGNED_HASH);
+                        if (!(sb->s_flags & MS_RDONLY))
+                                es->s_flags |=
+                                        cpu_to_le32(EXT2_FLAGS_SIGNED_HASH);
 #endif
+                }
         }
 
         /* Handle clustersize */
diff --git a/fs/file.c b/fs/file.c
index 771578b33fb6..db25c2bdfe46 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -34,7 +34,7 @@ static void *alloc_fdmem(size_t size)
          * vmalloc() if the allocation size will be considered "large" by the VM.
          */
         if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
-                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY);
                 if (data != NULL)
                         return data;
         }
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index e1959efad64f..b5ebc2d7d80d 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -50,6 +50,8 @@ void fscache_objlist_add(struct fscache_object *obj)
         struct fscache_object *xobj;
         struct rb_node **p = &fscache_object_list.rb_node, *parent = NULL;
 
+        ASSERT(RB_EMPTY_NODE(&obj->objlist_link));
+
         write_lock(&fscache_object_list_lock);
 
         while (*p) {
@@ -75,6 +77,9 @@ void fscache_objlist_add(struct fscache_object *obj)
  */
 void fscache_objlist_remove(struct fscache_object *obj)
 {
+        if (RB_EMPTY_NODE(&obj->objlist_link))
+                return;
+
         write_lock(&fscache_object_list_lock);
 
         BUG_ON(RB_EMPTY_ROOT(&fscache_object_list));
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 53d35c504240..d3b4539f1651 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -314,6 +314,9 @@ void fscache_object_init(struct fscache_object *object,
         object->cache = cache;
         object->cookie = cookie;
         object->parent = NULL;
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        RB_CLEAR_NODE(&object->objlist_link);
+#endif
 
         object->oob_event_mask = 0;
         for (t = object->oob_table; t->events; t++)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8360674c85bc..60bb365f54a5 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
          * similarly constrained call sites
          */
         ret = start_this_handle(journal, handle, GFP_NOFS);
-        if (ret < 0)
+        if (ret < 0) {
                 jbd2_journal_free_reserved(handle);
+                return ret;
+        }
         handle->h_type = type;
         handle->h_line_no = line_no;
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(jbd2_journal_start_reserved);
 
diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
index e973b85d6afd..5a8ea16eedbc 100644
--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -86,6 +86,8 @@ static int __jfs_set_acl(tid_t tid, struct inode *inode, int type,
                 rc = posix_acl_equiv_mode(acl, &inode->i_mode);
                 if (rc < 0)
                         return rc;
+                inode->i_ctime = CURRENT_TIME;
+                mark_inode_dirty(inode);
                 if (rc == 0)
                         acl = NULL;
                 break;
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index e066a3902973..ab798a88ec1d 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -779,6 +779,7 @@ nlmsvc_grant_blocked(struct nlm_block *block)
         struct nlm_file         *file = block->b_file;
         struct nlm_lock         *lock = &block->b_call->a_args.lock;
         int                     error;
+        loff_t                  fl_start, fl_end;
 
         dprintk("lockd: grant blocked lock %p\n", block);
 
@@ -796,9 +797,16 @@ nlmsvc_grant_blocked(struct nlm_block *block)
         }
 
         /* Try the lock operation again */
+        /* vfs_lock_file() can mangle fl_start and fl_end, but we need
+         * them unchanged for the GRANT_MSG
+         */
         lock->fl.fl_flags |= FL_SLEEP;
+        fl_start = lock->fl.fl_start;
+        fl_end = lock->fl.fl_end;
         error = vfs_lock_file(file->f_file, F_SETLK, &lock->fl, NULL);
         lock->fl.fl_flags &= ~FL_SLEEP;
+        lock->fl.fl_start = fl_start;
+        lock->fl.fl_end = fl_end;
 
         switch (error) {
         case 0:
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index be38b573495a..4a48fe4b84b6 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1846,6 +1846,11 @@ int nfs_symlink(struct inode *dir, struct dentry *dentry, const char *symname)
                                                         GFP_KERNEL)) {
                 SetPageUptodate(page);
                 unlock_page(page);
+                /*
+                 * add_to_page_cache_lru() grabs an extra page refcount.
+                 * Drop it here to avoid leaking this page later.
+                 */
+                page_cache_release(page);
         } else
                 __free_page(page);
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 28a0a3cbd3b7..360114ae8b82 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -164,17 +164,16 @@ static void nfs_zap_caches_locked(struct inode *inode)
         if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) {
                 nfs_fscache_invalidate(inode);
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                        | NFS_INO_INVALID_LABEL
                                         | NFS_INO_INVALID_DATA
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
                                         | NFS_INO_REVAL_PAGECACHE;
         } else
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                        | NFS_INO_INVALID_LABEL
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
                                         | NFS_INO_REVAL_PAGECACHE;
+        nfs_zap_label_cache_locked(nfsi);
 }
 
 void nfs_zap_caches(struct inode *inode)
@@ -266,6 +265,13 @@ nfs_init_locked(struct inode *inode, void *opaque)
 }
 
 #ifdef CONFIG_NFS_V4_SECURITY_LABEL
+static void nfs_clear_label_invalid(struct inode *inode)
+{
+        spin_lock(&inode->i_lock);
+        NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_LABEL;
+        spin_unlock(&inode->i_lock);
+}
+
 void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                         struct nfs4_label *label)
 {
@@ -283,6 +289,7 @@ void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                         __func__,
                                         (char *)label->label,
                                         label->len, error);
+                nfs_clear_label_invalid(inode);
         }
 }
 
@@ -1648,7 +1655,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 inode->i_blocks = fattr->du.nfs2.blocks;
 
         /* Update attrtimeo value if we're out of the unstable period */
-        if (invalid & (NFS_INO_INVALID_ATTR|NFS_INO_INVALID_LABEL)) {
+        if (invalid & NFS_INO_INVALID_ATTR) {
                 nfs_inc_stats(inode, NFSIOS_ATTRINVALIDATE);
                 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
                 nfsi->attrtimeo_timestamp = now;
@@ -1661,7 +1668,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 }
         }
         invalid &= ~NFS_INO_INVALID_ATTR;
-        invalid &= ~NFS_INO_INVALID_LABEL;
         /* Don't invalidate the data if we were to blame */
         if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
                                 || S_ISLNK(inode->i_mode)))
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 8b5cc04a8611..b46cf5a67329 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -176,7 +176,8 @@ extern struct nfs_server *nfs4_create_server(
 extern struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *,
                                                       struct nfs_fh *);
 extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
-                                        struct sockaddr *sap, size_t salen);
+                                        struct sockaddr *sap, size_t salen,
+                                        struct net *net);
 extern void nfs_free_server(struct nfs_server *server);
 extern struct nfs_server *nfs_clone_server(struct nfs_server *,
                                            struct nfs_fh *,
@@ -279,9 +280,18 @@ static inline void nfs4_label_free(struct nfs4_label *label)
         }
         return;
 }
+
+static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
+{
+        if (nfs_server_capable(&nfsi->vfs_inode, NFS_CAP_SECURITY_LABEL))
+                nfsi->cache_validity |= NFS_INO_INVALID_LABEL;
+}
 #else
 static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
 static inline void nfs4_label_free(void *label) {}
+static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
+{
+}
 #endif /* CONFIG_NFS_V4_SECURITY_LABEL */
 
 /* proc.c */
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index aa9bc973f36a..a462ef0fb5d6 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -18,6 +18,7 @@
 #include <linux/lockd/bind.h>
 #include <linux/nfs_mount.h>
 #include <linux/freezer.h>
+#include <linux/xattr.h>
 
 #include "iostat.h"
 #include "internal.h"
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 860ad26a5590..0e46d3d1b6cc 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1135,6 +1135,7 @@ static int nfs_probe_destination(struct nfs_server *server)
  * @hostname: new end-point's hostname
  * @sap: new end-point's socket address
  * @salen: size of "sap"
+ * @net: net namespace
  *
  * The nfs_server must be quiescent before this function is invoked.
  * Either its session is drained (NFSv4.1+), or its transport is
@@ -1143,13 +1144,13 @@ static int nfs_probe_destination(struct nfs_server *server)
  * Returns zero on success, or a negative errno value.
  */
 int nfs4_update_server(struct nfs_server *server, const char *hostname,
-                       struct sockaddr *sap, size_t salen)
+                       struct sockaddr *sap, size_t salen, struct net *net)
 {
         struct nfs_client *clp = server->nfs_client;
         struct rpc_clnt *clnt = server->client;
         struct xprt_create xargs = {
                 .ident          = clp->cl_proto,
-                .net            = &init_net,
+                .net            = net,
                 .dstaddr        = sap,
                 .addrlen        = salen,
                 .servername     = hostname,
@@ -1189,7 +1190,7 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
         error = nfs4_set_client(server, hostname, sap, salen, buf,
                                 clp->cl_rpcclient->cl_auth->au_flavor,
                                 clp->cl_proto, clnt->cl_timeout,
-                                clp->cl_minorversion, clp->cl_net);
+                                clp->cl_minorversion, net);
         nfs_put_client(clp);
         if (error != 0) {
                 nfs_server_insert_lists(server);
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 4e7f05d3e9db..3d5dbf80d46a 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -121,9 +121,8 @@ static int nfs4_validate_fspath(struct dentry *dentry,
 }
 
 static size_t nfs_parse_server_name(char *string, size_t len,
-                struct sockaddr *sa, size_t salen, struct nfs_server *server)
+                struct sockaddr *sa, size_t salen, struct net *net)
 {
-        struct net *net = rpc_net_ns(server->client);
         ssize_t ret;
 
         ret = rpc_pton(net, string, len, sa, salen);
@@ -223,6 +222,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                                      const struct nfs4_fs_location *location)
 {
         const size_t addr_bufsize = sizeof(struct sockaddr_storage);
+        struct net *net = rpc_net_ns(NFS_SB(mountdata->sb)->client);
         struct vfsmount *mnt = ERR_PTR(-ENOENT);
         char *mnt_path;
         unsigned int maxbuflen;
@@ -248,8 +248,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                         continue;
 
                 mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
-                                mountdata->addr, addr_bufsize,
-                                NFS_SB(mountdata->sb));
+                                mountdata->addr, addr_bufsize, net);
                 if (mountdata->addrlen == 0)
                         continue;
 
@@ -419,6 +418,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                 const struct nfs4_fs_location *location)
 {
         const size_t addr_bufsize = sizeof(struct sockaddr_storage);
+        struct net *net = rpc_net_ns(server->client);
         struct sockaddr *sap;
         unsigned int s;
         size_t salen;
@@ -440,7 +440,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                         continue;
 
                 salen = nfs_parse_server_name(buf->data, buf->len,
-                                                sap, addr_bufsize, server);
+                                                sap, addr_bufsize, net);
                 if (salen == 0)
                         continue;
                 rpc_set_port(sap, NFS_PORT);
@@ -450,7 +450,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                 if (hostname == NULL)
                         break;
 
-                error = nfs4_update_server(server, hostname, sap, salen);
+                error = nfs4_update_server(server, hostname, sap, salen, net);
                 kfree(hostname);
                 if (error == 0)
                         break;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e5be72518bd7..e1a47217c05e 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1015,8 +1015,11 @@ int nfs4_select_rw_stateid(nfs4_stateid *dst, struct nfs4_state *state,
         if (ret == -EIO)
                 /* A lost lock - don't even consider delegations */
                 goto out;
-        if (nfs4_copy_delegation_stateid(dst, state->inode, fmode))
+        /* returns true if delegation stateid found and copied */
+        if (nfs4_copy_delegation_stateid(dst, state->inode, fmode)) {
+                ret = 0;
                 goto out;
+        }
         if (ret != -ENOENT)
                 /* nfs4_copy_delegation_stateid() didn't over-write
                  * dst, so it still has the lock stateid which we now
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index d3a587144222..d190e33d0ec2 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -151,17 +151,15 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
                 pacl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);
                 if (IS_ERR(pacl))
                         return PTR_ERR(pacl);
-                /* allocate for worst case: one (deny, allow) pair each: */
-                size += 2 * pacl->a_count;
         }
+        /* allocate for worst case: one (deny, allow) pair each: */
+        size += 2 * pacl->a_count;
 
         if (S_ISDIR(inode->i_mode)) {
                 flags = NFS4_ACL_DIR;
                 dpacl = get_acl(inode, ACL_TYPE_DEFAULT);
                 if (dpacl)
                         size += 2 * dpacl->a_count;
-        } else {
-                dpacl = NULL;
         }
 
         *acl = nfs4_acl_new(size);
@@ -170,8 +168,7 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
                 goto out;
         }
 
-        if (pacl)
-                _posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT);
+        _posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT);
 
         if (dpacl)
                 _posix_to_nfsv4_one(dpacl, *acl, flags | NFS4_ACL_TYPE_DEFAULT);
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index ea4ba9daeb47..db9bd8a31725 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -2134,7 +2134,7 @@ static ssize_t ntfs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         ret = ntfs_file_aio_write_nolock(iocb, iov, nr_segs, &iocb->ki_pos);
         mutex_unlock(&inode->i_mutex);
         if (ret > 0) {
-                int err = generic_write_sync(file, pos, ret);
+                int err = generic_write_sync(file, iocb->ki_pos - ret, ret);
                 if (err < 0)
                         ret = err;
         }
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index aada5801567a..e2edff38be52 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -7158,7 +7158,7 @@ int ocfs2_truncate_inline(struct inode *inode, struct buffer_head *di_bh,
         if (end > i_size_read(inode))
                 end = i_size_read(inode);
 
-        BUG_ON(start >= end);
+        BUG_ON(start > end);
 
         if (!(OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) ||
             !(le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL) ||
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index d77d71ead8d1..8450262bcf2a 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -185,6 +185,9 @@ static int ocfs2_sync_file(struct file *file, loff_t start, loff_t end,
                               file->f_path.dentry->d_name.name,
                               (unsigned long long)datasync);
 
+        if (ocfs2_is_hard_readonly(osb) || ocfs2_is_soft_readonly(osb))
+                return -EROFS;
+
         err = filemap_write_and_wait_range(inode->i_mapping, start, end);
         if (err)
                 return err;
@@ -474,11 +477,6 @@ static int ocfs2_truncate_file(struct inode *inode,
                 goto bail;
         }
 
-        /* lets handle the simple truncate cases before doing any more
-         * cluster locking. */
-        if (new_i_size == le64_to_cpu(fe->i_size))
-                goto bail;
-
         down_write(&OCFS2_I(inode)->ip_alloc_sem);
 
         ocfs2_resv_discard(&osb->osb_la_resmap,
@@ -718,7 +716,8 @@ leave:
  * While a write will already be ordering the data, a truncate will not.
  * Thus, we need to explicitly order the zeroed pages.
  */
-static handle_t *ocfs2_zero_start_ordered_transaction(struct inode *inode)
+static handle_t *ocfs2_zero_start_ordered_transaction(struct inode *inode,
+                                                struct buffer_head *di_bh)
 {
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         handle_t *handle = NULL;
@@ -735,7 +734,14 @@ static handle_t *ocfs2_zero_start_ordered_transaction(struct inode *inode)
         }
 
         ret = ocfs2_jbd2_file_inode(handle, inode);
-        if (ret < 0)
+        if (ret < 0) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret)
                 mlog_errno(ret);
 
 out:
@@ -751,7 +757,7 @@ out:
  * to be too fragile to do exactly what we need without us having to
  * worry about recursive locking in ->write_begin() and ->write_end(). */
 static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
-                                 u64 abs_to)
+                                 u64 abs_to, struct buffer_head *di_bh)
 {
         struct address_space *mapping = inode->i_mapping;
         struct page *page;
@@ -759,6 +765,7 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
         handle_t *handle = NULL;
         int ret = 0;
         unsigned zero_from, zero_to, block_start, block_end;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
 
         BUG_ON(abs_from >= abs_to);
         BUG_ON(abs_to > (((u64)index + 1) << PAGE_CACHE_SHIFT));
@@ -801,7 +808,8 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
                 }
 
                 if (!handle) {
-                        handle = ocfs2_zero_start_ordered_transaction(inode);
+                        handle = ocfs2_zero_start_ordered_transaction(inode,
+                                                                      di_bh);
                         if (IS_ERR(handle)) {
                                 ret = PTR_ERR(handle);
                                 handle = NULL;
@@ -818,8 +826,22 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
                         ret = 0;
         }
 
-        if (handle)
+        if (handle) {
+                /*
+                 * fs-writeback will release the dirty pages without page lock
+                 * whose offset are over inode size, the release happens at
+                 * block_write_full_page_endio().
+                 */
+                i_size_write(inode, abs_to);
+                inode->i_blocks = ocfs2_inode_sector_count(inode);
+                di->i_size = cpu_to_le64((u64)i_size_read(inode));
+                inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                di->i_mtime = di->i_ctime = cpu_to_le64(inode->i_mtime.tv_sec);
+                di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec);
+                di->i_mtime_nsec = di->i_ctime_nsec;
+                ocfs2_journal_dirty(handle, di_bh);
                 ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle);
+        }
 
 out_unlock:
         unlock_page(page);
@@ -915,7 +937,7 @@ out:
  * has made sure that the entire range needs zeroing.
  */
 static int ocfs2_zero_extend_range(struct inode *inode, u64 range_start,
-                                   u64 range_end)
+                                   u64 range_end, struct buffer_head *di_bh)
 {
         int rc = 0;
         u64 next_pos;
@@ -931,7 +953,7 @@ static int ocfs2_zero_extend_range(struct inode *inode, u64 range_start,
                 next_pos = (zero_pos & PAGE_CACHE_MASK) + PAGE_CACHE_SIZE;
                 if (next_pos > range_end)
                         next_pos = range_end;
-                rc = ocfs2_write_zero_page(inode, zero_pos, next_pos);
+                rc = ocfs2_write_zero_page(inode, zero_pos, next_pos, di_bh);
                 if (rc < 0) {
                         mlog_errno(rc);
                         break;
@@ -977,7 +999,7 @@ int ocfs2_zero_extend(struct inode *inode, struct buffer_head *di_bh,
                         range_end = zero_to_size;
 
                 ret = ocfs2_zero_extend_range(inode, range_start,
-                                              range_end);
+                                              range_end, di_bh);
                 if (ret) {
                         mlog_errno(ret);
                         break;
@@ -1145,14 +1167,14 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
                 goto bail_unlock_rw;
         }
 
-        if (size_change && attr->ia_size != i_size_read(inode)) {
+        if (size_change) {
                 status = inode_newsize_ok(inode, attr->ia_size);
                 if (status)
                         goto bail_unlock;
 
                 inode_dio_wait(inode);
 
-                if (i_size_read(inode) > attr->ia_size) {
+                if (i_size_read(inode) >= attr->ia_size) {
                         if (ocfs2_should_order_data(inode)) {
                                 status = ocfs2_begin_ordered_truncate(inode,
                                                                       attr->ia_size);
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index f4d609be9400..3683643f3f0e 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -664,6 +664,7 @@ static int ocfs2_link(struct dentry *old_dentry,
         struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
         struct ocfs2_dir_lookup_result lookup = { NULL, };
         sigset_t oldset;
+        u64 old_de_ino;
 
         trace_ocfs2_link((unsigned long long)OCFS2_I(inode)->ip_blkno,
                          old_dentry->d_name.len, old_dentry->d_name.name,
@@ -686,6 +687,22 @@ static int ocfs2_link(struct dentry *old_dentry,
                 goto out;
         }
 
+        err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
+                        old_dentry->d_name.len, &old_de_ino);
+        if (err) {
+                err = -ENOENT;
+                goto out;
+        }
+
+        /*
+         * Check whether another node removed the source inode while we
+         * were in the vfs.
+         */
+        if (old_de_ino != OCFS2_I(inode)->ip_blkno) {
+                err = -ENOENT;
+                goto out;
+        }
+
         err = ocfs2_check_dir_for_entry(dir, dentry->d_name.name,
                                         dentry->d_name.len);
         if (err)
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index 2ca7ba047f04..88d4585b30f1 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -468,17 +468,24 @@ static int __init update_note_header_size_elf64(const Elf64_Ehdr *ehdr_ptr)
                         return rc;
                 }
                 nhdr_ptr = notes_section;
-                while (real_sz < max_sz) {
-                        if (nhdr_ptr->n_namesz == 0)
-                                break;
+                while (nhdr_ptr->n_namesz != 0) {
                         sz = sizeof(Elf64_Nhdr) +
                                 ((nhdr_ptr->n_namesz + 3) & ~3) +
                                 ((nhdr_ptr->n_descsz + 3) & ~3);
+                        if ((real_sz + sz) > max_sz) {
+                                pr_warn("Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x%x, n_descsz=0x%x\n",
+                                        nhdr_ptr->n_namesz, nhdr_ptr->n_descsz);
+                                break;
+                        }
                         real_sz += sz;
                         nhdr_ptr = (Elf64_Nhdr*)((char*)nhdr_ptr + sz);
                 }
                 kfree(notes_section);
                 phdr_ptr->p_memsz = real_sz;
+                if (real_sz == 0) {
+                        pr_warn("Warning: Zero PT_NOTE entries found\n");
+                        return -EINVAL;
+                }
         }
 
         return 0;
@@ -648,17 +655,24 @@ static int __init update_note_header_size_elf32(const Elf32_Ehdr *ehdr_ptr)
                         return rc;
                 }
                 nhdr_ptr = notes_section;
-                while (real_sz < max_sz) {
-                        if (nhdr_ptr->n_namesz == 0)
-                                break;
+                while (nhdr_ptr->n_namesz != 0) {
                         sz = sizeof(Elf32_Nhdr) +
                                 ((nhdr_ptr->n_namesz + 3) & ~3) +
                                 ((nhdr_ptr->n_descsz + 3) & ~3);
+                        if ((real_sz + sz) > max_sz) {
+                                pr_warn("Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x%x, n_descsz=0x%x\n",
+                                        nhdr_ptr->n_namesz, nhdr_ptr->n_descsz);
+                                break;
+                        }
                         real_sz += sz;
                         nhdr_ptr = (Elf32_Nhdr*)((char*)nhdr_ptr + sz);
                 }
                 kfree(notes_section);
                 phdr_ptr->p_memsz = real_sz;
+                if (real_sz == 0) {
+                        pr_warn("Warning: Zero PT_NOTE entries found\n");
+                        return -EINVAL;
+                }
         }
 
         return 0;
diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
index 2b7882b508db..9a3c68cf6026 100644
--- a/fs/reiserfs/do_balan.c
+++ b/fs/reiserfs/do_balan.c
@@ -324,23 +324,17 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                         switch (flag) {
                         case M_INSERT:  /* insert item into L[0] */
 
-                                if (item_pos == tb->lnum[0] - 1
-                                    && tb->lbytes != -1) {
+                                if (item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
                                         /* part of new item falls into L[0] */
                                         int new_item_len;
                                         int version;
 
-                                        ret_val =
-                                            leaf_shift_left(tb, tb->lnum[0] - 1,
-                                                            -1);
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0] - 1, -1);
 
                                         /* Calculate item length to insert to S[0] */
-                                        new_item_len =
-                                            ih_item_len(ih) - tb->lbytes;
+                                        new_item_len = ih_item_len(ih) - tb->lbytes;
                                         /* Calculate and check item length to insert to L[0] */
-                                        put_ih_item_len(ih,
-                                                        ih_item_len(ih) -
-                                                        new_item_len);
+                                        put_ih_item_len(ih, ih_item_len(ih) - new_item_len);
 
                                         RFALSE(ih_item_len(ih) <= 0,
                                                "PAP-12080: there is nothing to insert into L[0]: ih_item_len=%d",
@@ -349,30 +343,18 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         /* Insert new item into L[0] */
                                         buffer_info_init_left(tb, &bi);
                                         leaf_insert_into_buf(&bi,
-                                                             n + item_pos -
-                                                             ret_val, ih, body,
-                                                             zeros_num >
-                                                             ih_item_len(ih) ?
-                                                             ih_item_len(ih) :
-                                                             zeros_num);
+                                                        n + item_pos - ret_val, ih, body,
+                                                        zeros_num > ih_item_len(ih) ? ih_item_len(ih) : zeros_num);
 
                                         version = ih_version(ih);
 
                                         /* Calculate key component, item length and body to insert into S[0] */
-                                        set_le_ih_k_offset(ih,
-                                                           le_ih_k_offset(ih) +
-                                                           (tb->
-                                                            lbytes <<
-                                                            (is_indirect_le_ih
-                                                             (ih) ? tb->tb_sb->
-                                                             s_blocksize_bits -
-                                                             UNFM_P_SHIFT :
-                                                             0)));
+                                        set_le_ih_k_offset(ih, le_ih_k_offset(ih) +
+                                                        (tb-> lbytes << (is_indirect_le_ih(ih) ? tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT : 0)));
 
                                         put_ih_item_len(ih, new_item_len);
                                         if (tb->lbytes > zeros_num) {
-                                                body +=
-                                                    (tb->lbytes - zeros_num);
+                                                body += (tb->lbytes - zeros_num);
                                                 zeros_num = 0;
                                         } else
                                                 zeros_num -= tb->lbytes;
@@ -383,15 +365,10 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                 } else {
                                         /* new item in whole falls into L[0] */
                                         /* Shift lnum[0]-1 items to L[0] */
-                                        ret_val =
-                                            leaf_shift_left(tb, tb->lnum[0] - 1,
-                                                            tb->lbytes);
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0] - 1, tb->lbytes);
                                         /* Insert new item into L[0] */
                                         buffer_info_init_left(tb, &bi);
-                                        leaf_insert_into_buf(&bi,
-                                                             n + item_pos -
-                                                             ret_val, ih, body,
-                                                             zeros_num);
+                                        leaf_insert_into_buf(&bi, n + item_pos - ret_val, ih, body, zeros_num);
                                         tb->insert_size[0] = 0;
                                         zeros_num = 0;
                                 }
@@ -399,264 +376,117 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                         case M_PASTE:   /* append item in L[0] */
 
-                                if (item_pos == tb->lnum[0] - 1
-                                    && tb->lbytes != -1) {
+                                if (item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
                                         /* we must shift the part of the appended item */
-                                        if (is_direntry_le_ih
-                                            (B_N_PITEM_HEAD(tbS0, item_pos))) {
+                                        if (is_direntry_le_ih(B_N_PITEM_HEAD(tbS0, item_pos))) {
 
                                                 RFALSE(zeros_num,
                                                        "PAP-12090: invalid parameter in case of a directory");
                                                 /* directory item */
                                                 if (tb->lbytes > pos_in_item) {
                                                         /* new directory entry falls into L[0] */
-                                                        struct item_head
-                                                            *pasted;
-                                                        int l_pos_in_item =
-                                                            pos_in_item;
+                                                        struct item_head *pasted;
+                                                        int l_pos_in_item = pos_in_item;
 
                                                         /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 entries from given directory item */
-                                                        ret_val =
-                                                            leaf_shift_left(tb,
-                                                                            tb->
-                                                                            lnum
-                                                                            [0],
-                                                                            tb->
-                                                                            lbytes
-                                                                            -
-                                                                            1);
-                                                        if (ret_val
-                                                            && !item_pos) {
-                                                                pasted =
-                                                                    B_N_PITEM_HEAD
-                                                                    (tb->L[0],
-                                                                     B_NR_ITEMS
-                                                                     (tb->
-                                                                      L[0]) -
-                                                                     1);
-                                                                l_pos_in_item +=
-                                                                    I_ENTRY_COUNT
-                                                                    (pasted) -
-                                                                    (tb->
-                                                                     lbytes -
-                                                                     1);
+                                                        ret_val = leaf_shift_left(tb, tb->lnum[0], tb->lbytes-1);
+                                                        if (ret_val && !item_pos) {
+                                                                pasted = B_N_PITEM_HEAD(tb->L[0], B_NR_ITEMS(tb->L[0]) - 1);
+                                                                l_pos_in_item += I_ENTRY_COUNT(pasted) - (tb->lbytes -1);
                                                         }
 
                                                         /* Append given directory entry to directory item */
                                                         buffer_info_init_left(tb, &bi);
-                                                        leaf_paste_in_buffer
-                                                            (&bi,
-                                                             n + item_pos -
-                                                             ret_val,
-                                                             l_pos_in_item,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
+                                                        leaf_paste_in_buffer(&bi, n + item_pos - ret_val, l_pos_in_item, tb->insert_size[0], body, zeros_num);
 
                                                         /* previous string prepared space for pasting new entry, following string pastes this entry */
 
                                                         /* when we have merge directory item, pos_in_item has been changed too */
 
                                                         /* paste new directory entry. 1 is entry number */
-                                                        leaf_paste_entries(&bi,
-                                                                           n +
-                                                                           item_pos
-                                                                           -
-                                                                           ret_val,
-                                                                           l_pos_in_item,
-                                                                           1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
+                                                        leaf_paste_entries(&bi, n + item_pos - ret_val, l_pos_in_item,
+                                                                           1, (struct reiserfs_de_head *) body,
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
                                                         tb->insert_size[0] = 0;
                                                 } else {
                                                         /* new directory item doesn't fall into L[0] */
                                                         /* Shift lnum[0]-1 items in whole. Shift lbytes directory entries from directory item number lnum[0] */
-                                                        leaf_shift_left(tb,
-                                                                        tb->
-                                                                        lnum[0],
-                                                                        tb->
-                                                                        lbytes);
+                                                        leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
                                                 }
                                                 /* Calculate new position to append in item body */
                                                 pos_in_item -= tb->lbytes;
                                         } else {
                                                 /* regular object */
-                                                RFALSE(tb->lbytes <= 0,
-                                                       "PAP-12095: there is nothing to shift to L[0]. lbytes=%d",
-                                                       tb->lbytes);
-                                                RFALSE(pos_in_item !=
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
+                                                RFALSE(tb->lbytes <= 0, "PAP-12095: there is nothing to shift to L[0]. lbytes=%d", tb->lbytes);
+                                                RFALSE(pos_in_item != ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)),
                                                        "PAP-12100: incorrect position to paste: item_len=%d, pos_in_item=%d",
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
-                                                       pos_in_item);
+                                                       ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)),pos_in_item);
 
                                                 if (tb->lbytes >= pos_in_item) {
                                                         /* appended item will be in L[0] in whole */
                                                         int l_n;
 
                                                         /* this bytes number must be appended to the last item of L[h] */
-                                                        l_n =
-                                                            tb->lbytes -
-                                                            pos_in_item;
+                                                        l_n = tb->lbytes - pos_in_item;
 
                                                         /* Calculate new insert_size[0] */
-                                                        tb->insert_size[0] -=
-                                                            l_n;
+                                                        tb->insert_size[0] -= l_n;
 
-                                                        RFALSE(tb->
-                                                               insert_size[0] <=
-                                                               0,
+                                                        RFALSE(tb->insert_size[0] <= 0,
                                                                "PAP-12105: there is nothing to paste into L[0]. insert_size=%d",
-                                                               tb->
-                                                               insert_size[0]);
-                                                        ret_val =
-                                                            leaf_shift_left(tb,
-                                                                            tb->
-                                                                            lnum
-                                                                            [0],
-                                                                            ih_item_len
-                                                                            (B_N_PITEM_HEAD
-                                                                             (tbS0,
-                                                                              item_pos)));
+                                                               tb->insert_size[0]);
+                                                        ret_val = leaf_shift_left(tb, tb->lnum[0], ih_item_len
+                                                                            (B_N_PITEM_HEAD(tbS0, item_pos)));
                                                         /* Append to body of item in L[0] */
                                                         buffer_info_init_left(tb, &bi);
                                                         leaf_paste_in_buffer
-                                                            (&bi,
-                                                             n + item_pos -
-                                                             ret_val,
-                                                             ih_item_len
-                                                             (B_N_PITEM_HEAD
-                                                              (tb->L[0],
-                                                               n + item_pos -
-                                                               ret_val)), l_n,
-                                                             body,
-                                                             zeros_num >
-                                                             l_n ? l_n :
-                                                             zeros_num);
+                                                            (&bi, n + item_pos - ret_val, ih_item_len
+                                                             (B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val)),
+                                                             l_n, body,
+                                                             zeros_num > l_n ? l_n : zeros_num);
                                                         /* 0-th item in S0 can be only of DIRECT type when l_n != 0 */
                                                         {
                                                                 int version;
-                                                                int temp_l =
-                                                                    l_n;
-
-                                                                RFALSE
-                                                                    (ih_item_len
-                                                                     (B_N_PITEM_HEAD
-                                                                      (tbS0,
-                                                                       0)),
+                                                                int temp_l = l_n;
+
+                                                                RFALSE(ih_item_len(B_N_PITEM_HEAD(tbS0, 0)),
                                                                      "PAP-12106: item length must be 0");
-                                                                RFALSE
-                                                                    (comp_short_le_keys
-                                                                     (B_N_PKEY
-                                                                      (tbS0, 0),
-                                                                      B_N_PKEY
-                                                                      (tb->L[0],
-                                                                       n +
-                                                                       item_pos
-                                                                       -
-                                                                       ret_val)),
+                                                                RFALSE(comp_short_le_keys(B_N_PKEY(tbS0, 0), B_N_PKEY
+                                                                      (tb->L[0], n + item_pos - ret_val)),
                                                                      "PAP-12107: items must be of the same file");
                                                                 if (is_indirect_le_ih(B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val))) {
-                                                                        temp_l =
-                                                                            l_n
-                                                                            <<
-                                                                            (tb->
-                                                                             tb_sb->
-                                                                             s_blocksize_bits
-                                                                             -
-                                                                             UNFM_P_SHIFT);
+                                                                        temp_l = l_n << (tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT);
                                                                 }
                                                                 /* update key of first item in S0 */
-                                                                version =
-                                                                    ih_version
-                                                                    (B_N_PITEM_HEAD
-                                                                     (tbS0, 0));
-                                                                set_le_key_k_offset
-                                                                    (version,
-                                                                     B_N_PKEY
-                                                                     (tbS0, 0),
-                                                                     le_key_k_offset
-                                                                     (version,
-                                                                      B_N_PKEY
-                                                                      (tbS0,
-                                                                       0)) +
-                                                                     temp_l);
+                                                                version = ih_version(B_N_PITEM_HEAD(tbS0, 0));
+                                                                set_le_key_k_offset(version, B_N_PKEY(tbS0, 0),
+                                                                     le_key_k_offset(version,B_N_PKEY(tbS0, 0)) + temp_l);
                                                                 /* update left delimiting key */
-                                                                set_le_key_k_offset
-                                                                    (version,
-                                                                     B_N_PDELIM_KEY
-                                                                     (tb->
-                                                                      CFL[0],
-                                                                      tb->
-                                                                      lkey[0]),
-                                                                     le_key_k_offset
-                                                                     (version,
-                                                                      B_N_PDELIM_KEY
-                                                                      (tb->
-                                                                       CFL[0],
-                                                                       tb->
-                                                                       lkey[0]))
-                                                                     + temp_l);
+                                                                set_le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0]),
+                                                                     le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0])) + temp_l);
                                                         }
 
                                                         /* Calculate new body, position in item and insert_size[0] */
                                                         if (l_n > zeros_num) {
-                                                                body +=
-                                                                    (l_n -
-                                                                     zeros_num);
+                                                                body += (l_n - zeros_num);
                                                                 zeros_num = 0;
                                                         } else
-                                                                zeros_num -=
-                                                                    l_n;
+                                                                zeros_num -= l_n;
                                                         pos_in_item = 0;
 
-                                                        RFALSE
-                                                            (comp_short_le_keys
-                                                             (B_N_PKEY(tbS0, 0),
-                                                              B_N_PKEY(tb->L[0],
-                                                                       B_NR_ITEMS
-                                                                       (tb->
-                                                                        L[0]) -
-                                                                       1))
-                                                             ||
-                                                             !op_is_left_mergeable
-                                                             (B_N_PKEY(tbS0, 0),
-                                                              tbS0->b_size)
-                                                             ||
-                                                             !op_is_left_mergeable
-                                                             (B_N_PDELIM_KEY
-                                                              (tb->CFL[0],
-                                                               tb->lkey[0]),
-                                                              tbS0->b_size),
+                                                        RFALSE(comp_short_le_keys(B_N_PKEY(tbS0, 0), B_N_PKEY(tb->L[0], B_NR_ITEMS(tb->L[0]) - 1))
+                                                             || !op_is_left_mergeable(B_N_PKEY(tbS0, 0), tbS0->b_size)
+                                                             || !op_is_left_mergeable(B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0]), tbS0->b_size),
                                                              "PAP-12120: item must be merge-able with left neighboring item");
                                                 } else {        /* only part of the appended item will be in L[0] */
 
                                                         /* Calculate position in item for append in S[0] */
-                                                        pos_in_item -=
-                                                            tb->lbytes;
+                                                        pos_in_item -= tb->lbytes;
 
-                                                        RFALSE(pos_in_item <= 0,
-                                                               "PAP-12125: no place for paste. pos_in_item=%d",
-                                                               pos_in_item);
+                                                        RFALSE(pos_in_item <= 0, "PAP-12125: no place for paste. pos_in_item=%d", pos_in_item);
 
                                                         /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 byte from item number lnum[0] */
-                                                        leaf_shift_left(tb,
-                                                                        tb->
-                                                                        lnum[0],
-                                                                        tb->
-                                                                        lbytes);
+                                                        leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
                                                 }
                                         }
                                 } else {        /* appended item will be in L[0] in whole */
@@ -665,52 +495,30 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         if (!item_pos && op_is_left_mergeable(B_N_PKEY(tbS0, 0), tbS0->b_size)) {       /* if we paste into first item of S[0] and it is left mergable */
                                                 /* then increment pos_in_item by the size of the last item in L[0] */
-                                                pasted =
-                                                    B_N_PITEM_HEAD(tb->L[0],
-                                                                   n - 1);
+                                                pasted = B_N_PITEM_HEAD(tb->L[0], n - 1);
                                                 if (is_direntry_le_ih(pasted))
-                                                        pos_in_item +=
-                                                            ih_entry_count
-                                                            (pasted);
+                                                        pos_in_item += ih_entry_count(pasted);
                                                 else
-                                                        pos_in_item +=
-                                                            ih_item_len(pasted);
+                                                        pos_in_item += ih_item_len(pasted);
                                         }
 
                                         /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 byte from item number lnum[0] */
-                                        ret_val =
-                                            leaf_shift_left(tb, tb->lnum[0],
-                                                            tb->lbytes);
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
                                         /* Append to body of item in L[0] */
                                         buffer_info_init_left(tb, &bi);
-                                        leaf_paste_in_buffer(&bi,
-                                                             n + item_pos -
-                                                             ret_val,
+                                        leaf_paste_in_buffer(&bi, n + item_pos - ret_val,
                                                              pos_in_item,
                                                              tb->insert_size[0],
                                                              body, zeros_num);
 
                                         /* if appended item is directory, paste entry */
-                                        pasted =
-                                            B_N_PITEM_HEAD(tb->L[0],
-                                                           n + item_pos -
-                                                           ret_val);
+                                        pasted = B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val);
                                         if (is_direntry_le_ih(pasted))
-                                                leaf_paste_entries(&bi,
-                                                                   n +
-                                                                   item_pos -
-                                                                   ret_val,
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
+                                                leaf_paste_entries(&bi, n + item_pos - ret_val,
+                                                                   pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *) body,
+                                                                   body + DEH_SIZE,
+                                                                   tb->insert_size[0]);
                                         /* if appended item is indirect item, put unformatted node into un list */
                                         if (is_indirect_le_ih(pasted))
                                                 set_ih_free_space(pasted, 0);
@@ -722,13 +530,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                 reiserfs_panic(tb->tb_sb, "PAP-12130",
                                                "lnum > 0: unexpected mode: "
                                                " %s(%d)",
-                                               (flag ==
-                                                M_DELETE) ? "DELETE" : ((flag ==
-                                                                         M_CUT)
-                                                                        ? "CUT"
-                                                                        :
-                                                                        "UNKNOWN"),
-                                               flag);
+                                               (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
                         }
                 } else {
                         /* new item doesn't fall into L[0] */
@@ -748,14 +550,12 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                 case M_INSERT:  /* insert item */
                         if (n - tb->rnum[0] < item_pos) {       /* new item or its part falls to R[0] */
                                 if (item_pos == n - tb->rnum[0] + 1 && tb->rbytes != -1) {      /* part of new item falls into R[0] */
-                                        loff_t old_key_comp, old_len,
-                                            r_zeros_number;
+                                        loff_t old_key_comp, old_len, r_zeros_number;
                                         const char *r_body;
                                         int version;
                                         loff_t offset;
 
-                                        leaf_shift_right(tb, tb->rnum[0] - 1,
-                                                         -1);
+                                        leaf_shift_right(tb, tb->rnum[0] - 1, -1);
 
                                         version = ih_version(ih);
                                         /* Remember key component and item length */
@@ -763,29 +563,17 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         old_len = ih_item_len(ih);
 
                                         /* Calculate key component and item length to insert into R[0] */
-                                        offset =
-                                            le_ih_k_offset(ih) +
-                                            ((old_len -
-                                              tb->
-                                              rbytes) << (is_indirect_le_ih(ih)
-                                                          ? tb->tb_sb->
-                                                          s_blocksize_bits -
-                                                          UNFM_P_SHIFT : 0));
+                                        offset = le_ih_k_offset(ih) + ((old_len - tb->rbytes) << (is_indirect_le_ih(ih) ? tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT : 0));
                                         set_le_ih_k_offset(ih, offset);
                                         put_ih_item_len(ih, tb->rbytes);
                                         /* Insert part of the item into R[0] */
                                         buffer_info_init_right(tb, &bi);
                                         if ((old_len - tb->rbytes) > zeros_num) {
                                                 r_zeros_number = 0;
-                                                r_body =
-                                                    body + (old_len -
-                                                            tb->rbytes) -
-                                                    zeros_num;
+                                                r_body = body + (old_len - tb->rbytes) - zeros_num;
                                         } else {
                                                 r_body = body;
-                                                r_zeros_number =
-                                                    zeros_num - (old_len -
-                                                                 tb->rbytes);
+                                                r_zeros_number = zeros_num - (old_len - tb->rbytes);
                                                 zeros_num -= r_zeros_number;
                                         }
 
@@ -798,25 +586,18 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         /* Calculate key component and item length to insert into S[0] */
                                         set_le_ih_k_offset(ih, old_key_comp);
-                                        put_ih_item_len(ih,
-                                                        old_len - tb->rbytes);
+                                        put_ih_item_len(ih, old_len - tb->rbytes);
 
                                         tb->insert_size[0] -= tb->rbytes;
 
                                 } else {        /* whole new item falls into R[0] */
 
                                         /* Shift rnum[0]-1 items to R[0] */
-                                        ret_val =
-                                            leaf_shift_right(tb,
-                                                             tb->rnum[0] - 1,
-                                                             tb->rbytes);
+                                        ret_val = leaf_shift_right(tb, tb->rnum[0] - 1, tb->rbytes);
                                         /* Insert new item into R[0] */
                                         buffer_info_init_right(tb, &bi);
-                                        leaf_insert_into_buf(&bi,
-                                                             item_pos - n +
-                                                             tb->rnum[0] - 1,
-                                                             ih, body,
-                                                             zeros_num);
+                                        leaf_insert_into_buf(&bi, item_pos - n + tb->rnum[0] - 1,
+                                                             ih, body, zeros_num);
 
                                         if (item_pos - n + tb->rnum[0] - 1 == 0) {
                                                 replace_key(tb, tb->CFR[0],
@@ -841,200 +622,97 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                                 RFALSE(zeros_num,
                                                        "PAP-12145: invalid parameter in case of a directory");
-                                                entry_count =
-                                                    I_ENTRY_COUNT(B_N_PITEM_HEAD
-                                                                  (tbS0,
-                                                                   item_pos));
+                                                entry_count = I_ENTRY_COUNT(B_N_PITEM_HEAD
+                                                                  (tbS0, item_pos));
                                                 if (entry_count - tb->rbytes <
                                                     pos_in_item)
                                                         /* new directory entry falls into R[0] */
                                                 {
                                                         int paste_entry_position;
 
-                                                        RFALSE(tb->rbytes - 1 >=
-                                                               entry_count
-                                                               || !tb->
-                                                               insert_size[0],
+                                                        RFALSE(tb->rbytes - 1 >= entry_count || !tb-> insert_size[0],
                                                                "PAP-12150: no enough of entries to shift to R[0]: rbytes=%d, entry_count=%d",
-                                                               tb->rbytes,
-                                                               entry_count);
+                                                               tb->rbytes, entry_count);
                                                         /* Shift rnum[0]-1 items in whole. Shift rbytes-1 directory entries from directory item number rnum[0] */
-                                                        leaf_shift_right(tb,
-                                                                         tb->
-                                                                         rnum
-                                                                         [0],
-                                                                         tb->
-                                                                         rbytes
-                                                                         - 1);
+                                                        leaf_shift_right(tb, tb->rnum[0], tb->rbytes - 1);
                                                         /* Paste given directory entry to directory item */
-                                                        paste_entry_position =
-                                                            pos_in_item -
-                                                            entry_count +
-                                                            tb->rbytes - 1;
+                                                        paste_entry_position = pos_in_item - entry_count + tb->rbytes - 1;
                                                         buffer_info_init_right(tb, &bi);
-                                                        leaf_paste_in_buffer
-                                                            (&bi, 0,
-                                                             paste_entry_position,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
+                                                        leaf_paste_in_buffer(&bi, 0, paste_entry_position, tb->insert_size[0], body, zeros_num);
                                                         /* paste entry */
-                                                        leaf_paste_entries(&bi,
-                                                                           0,
-                                                                           paste_entry_position,
-                                                                           1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
-
-                                                        if (paste_entry_position
-                                                            == 0) {
+                                                        leaf_paste_entries(&bi, 0, paste_entry_position, 1,
+                                                                           (struct reiserfs_de_head *) body,
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
+
+                                                        if (paste_entry_position == 0) {
                                                                 /* change delimiting keys */
-                                                                replace_key(tb,
-                                                                            tb->
-                                                                            CFR
-                                                                            [0],
-                                                                            tb->
-                                                                            rkey
-                                                                            [0],
-                                                                            tb->
-                                                                            R
-                                                                            [0],
-                                                                            0);
+                                                                replace_key(tb, tb->CFR[0], tb->rkey[0], tb->R[0],0);
                                                         }
 
                                                         tb->insert_size[0] = 0;
                                                         pos_in_item++;
                                                 } else {        /* new directory entry doesn't fall into R[0] */
 
-                                                        leaf_shift_right(tb,
-                                                                         tb->
-                                                                         rnum
-                                                                         [0],
-                                                                         tb->
-                                                                         rbytes);
+                                                        leaf_shift_right(tb, tb->rnum[0], tb->rbytes);
                                                 }
                                         } else {        /* regular object */
 
-                                                int n_shift, n_rem,
-                                                    r_zeros_number;
+                                                int n_shift, n_rem, r_zeros_number;
                                                 const char *r_body;
 
                                                 /* Calculate number of bytes which must be shifted from appended item */
-                                                if ((n_shift =
-                                                     tb->rbytes -
-                                                     tb->insert_size[0]) < 0)
+                                                if ((n_shift = tb->rbytes - tb->insert_size[0]) < 0)
                                                         n_shift = 0;
 
-                                                RFALSE(pos_in_item !=
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
+                                                RFALSE(pos_in_item != ih_item_len
+                                                       (B_N_PITEM_HEAD(tbS0, item_pos)),
                                                        "PAP-12155: invalid position to paste. ih_item_len=%d, pos_in_item=%d",
-                                                       pos_in_item,
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)));
-
-                                                leaf_shift_right(tb,
-                                                                 tb->rnum[0],
-                                                                 n_shift);
+                                                       pos_in_item, ih_item_len
+                                                       (B_N_PITEM_HEAD(tbS0, item_pos)));
+
+                                                leaf_shift_right(tb, tb->rnum[0], n_shift);
                                                 /* Calculate number of bytes which must remain in body after appending to R[0] */
-                                                if ((n_rem =
-                                                     tb->insert_size[0] -
-                                                     tb->rbytes) < 0)
+                                                if ((n_rem = tb->insert_size[0] - tb->rbytes) < 0)
                                                         n_rem = 0;
 
                                                 {
                                                         int version;
-                                                        unsigned long temp_rem =
-                                                            n_rem;
-
-                                                        version =
-                                                            ih_version
-                                                            (B_N_PITEM_HEAD
-                                                             (tb->R[0], 0));
-                                                        if (is_indirect_le_key
-                                                            (version,
-                                                             B_N_PKEY(tb->R[0],
-                                                                      0))) {
-                                                                temp_rem =
-                                                                    n_rem <<
-                                                                    (tb->tb_sb->
-                                                                     s_blocksize_bits
-                                                                     -
-                                                                     UNFM_P_SHIFT);
+                                                        unsigned long temp_rem = n_rem;
+
+                                                        version = ih_version(B_N_PITEM_HEAD(tb->R[0], 0));
+                                                        if (is_indirect_le_key(version, B_N_PKEY(tb->R[0], 0))) {
+                                                                temp_rem = n_rem << (tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT);
                                                         }
-                                                        set_le_key_k_offset
-                                                            (version,
-                                                             B_N_PKEY(tb->R[0],
-                                                                      0),
-                                                             le_key_k_offset
-                                                             (version,
-                                                              B_N_PKEY(tb->R[0],
-                                                                       0)) +
-                                                             temp_rem);
-                                                        set_le_key_k_offset
-                                                            (version,
-                                                             B_N_PDELIM_KEY(tb->
-                                                                            CFR
-                                                                            [0],
-                                                                            tb->
-                                                                            rkey
-                                                                            [0]),
-                                                             le_key_k_offset
-                                                             (version,
-                                                              B_N_PDELIM_KEY
-                                                              (tb->CFR[0],
-                                                               tb->rkey[0])) +
-                                                             temp_rem);
+                                                        set_le_key_k_offset(version, B_N_PKEY(tb->R[0], 0),
+                                                             le_key_k_offset(version, B_N_PKEY(tb->R[0], 0)) + temp_rem);
+                                                        set_le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFR[0], tb->rkey[0]),
+                                                             le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFR[0], tb->rkey[0])) + temp_rem);
                                                 }
 /*                k_offset (B_N_PKEY(tb->R[0],0)) += n_rem;
                   k_offset (B_N_PDELIM_KEY(tb->CFR[0],tb->rkey[0])) += n_rem;*/
-                                                do_balance_mark_internal_dirty
-                                                    (tb, tb->CFR[0], 0);
+                                                do_balance_mark_internal_dirty(tb, tb->CFR[0], 0);
 
                                                 /* Append part of body into R[0] */
                                                 buffer_info_init_right(tb, &bi);
                                                 if (n_rem > zeros_num) {
                                                         r_zeros_number = 0;
-                                                        r_body =
-                                                            body + n_rem -
-                                                            zeros_num;
+                                                        r_body = body + n_rem - zeros_num;
                                                 } else {
                                                         r_body = body;
-                                                        r_zeros_number =
-                                                            zeros_num - n_rem;
-                                                        zeros_num -=
-                                                            r_zeros_number;
+                                                        r_zeros_number = zeros_num - n_rem;
+                                                        zeros_num -= r_zeros_number;
                                                 }
 
-                                                leaf_paste_in_buffer(&bi, 0,
-                                                                     n_shift,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0] -
-                                                                     n_rem,
-                                                                     r_body,
-                                                                     r_zeros_number);
-
-                                                if (is_indirect_le_ih
-                                                    (B_N_PITEM_HEAD
-                                                     (tb->R[0], 0))) {
+                                                leaf_paste_in_buffer(&bi, 0, n_shift,
+                                                                     tb->insert_size[0] - n_rem,
+                                                                     r_body, r_zeros_number);
+
+                                                if (is_indirect_le_ih(B_N_PITEM_HEAD(tb->R[0], 0))) {
 #if 0
                                                         RFALSE(n_rem,
                                                                "PAP-12160: paste more than one unformatted node pointer");
 #endif
-                                                        set_ih_free_space
-                                                            (B_N_PITEM_HEAD
-                                                             (tb->R[0], 0), 0);
+                                                        set_ih_free_space(B_N_PITEM_HEAD(tb->R[0], 0), 0);
                                                 }
                                                 tb->insert_size[0] = n_rem;
                                                 if (!n_rem)
@@ -1044,58 +722,28 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         struct item_head *pasted;
 
-                                        ret_val =
-                                            leaf_shift_right(tb, tb->rnum[0],
-                                                             tb->rbytes);
+                                        ret_val = leaf_shift_right(tb, tb->rnum[0], tb->rbytes);
                                         /* append item in R[0] */
                                         if (pos_in_item >= 0) {
                                                 buffer_info_init_right(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
-                                                                     item_pos -
-                                                                     n +
-                                                                     tb->
-                                                                     rnum[0],
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
-                                                                     zeros_num);
+                                                leaf_paste_in_buffer(&bi, item_pos - n + tb->rnum[0], pos_in_item,
+                                                                     tb->insert_size[0], body, zeros_num);
                                         }
 
                                         /* paste new entry, if item is directory item */
-                                        pasted =
-                                            B_N_PITEM_HEAD(tb->R[0],
-                                                           item_pos - n +
-                                                           tb->rnum[0]);
-                                        if (is_direntry_le_ih(pasted)
-                                            && pos_in_item >= 0) {
-                                                leaf_paste_entries(&bi,
-                                                                   item_pos -
-                                                                   n +
-                                                                   tb->rnum[0],
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
+                                        pasted = B_N_PITEM_HEAD(tb->R[0], item_pos - n + tb->rnum[0]);
+                                        if (is_direntry_le_ih(pasted) && pos_in_item >= 0) {
+                                                leaf_paste_entries(&bi, item_pos - n + tb->rnum[0],
+                                                                   pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *) body,
+                                                                   body + DEH_SIZE, tb->insert_size[0]);
                                                 if (!pos_in_item) {
 
-                                                        RFALSE(item_pos - n +
-                                                               tb->rnum[0],
+                                                        RFALSE(item_pos - n + tb->rnum[0],
                                                                "PAP-12165: directory item must be first item of node when pasting is in 0th position");
 
                                                         /* update delimiting keys */
-                                                        replace_key(tb,
-                                                                    tb->CFR[0],
-                                                                    tb->rkey[0],
-                                                                    tb->R[0],
-                                                                    0);
+                                                        replace_key(tb, tb->CFR[0], tb->rkey[0], tb->R[0], 0);
                                                 }
                                         }
 
@@ -1111,22 +759,16 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                 default:        /* cases d and t */
                         reiserfs_panic(tb->tb_sb, "PAP-12175",
                                        "rnum > 0: unexpected mode: %s(%d)",
-                                       (flag ==
-                                        M_DELETE) ? "DELETE" : ((flag ==
-                                                                 M_CUT) ? "CUT"
-                                                                : "UNKNOWN"),
-                                       flag);
+                                       (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
                 }
 
         }
 
         /* tb->rnum[0] > 0 */
         RFALSE(tb->blknum[0] > 3,
-               "PAP-12180: blknum can not be %d. It must be <= 3",
-               tb->blknum[0]);
+               "PAP-12180: blknum can not be %d. It must be <= 3", tb->blknum[0]);
         RFALSE(tb->blknum[0] < 0,
-               "PAP-12185: blknum can not be %d. It must be >= 0",
-               tb->blknum[0]);
+               "PAP-12185: blknum can not be %d. It must be >= 0", tb->blknum[0]);
 
         /* if while adding to a node we discover that it is possible to split
            it in two, and merge the left part into the left neighbor and the
@@ -1177,8 +819,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                         if (n - snum[i] < item_pos) {   /* new item or it's part falls to first new node S_new[i] */
                                 if (item_pos == n - snum[i] + 1 && sbytes[i] != -1) {   /* part of new item falls into S_new[i] */
-                                        int old_key_comp, old_len,
-                                            r_zeros_number;
+                                        int old_key_comp, old_len, r_zeros_number;
                                         const char *r_body;
                                         int version;
 
@@ -1192,15 +833,8 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         old_len = ih_item_len(ih);
 
                                         /* Calculate key component and item length to insert into S_new[i] */
-                                        set_le_ih_k_offset(ih,
-                                                           le_ih_k_offset(ih) +
-                                                           ((old_len -
-                                                             sbytes[i]) <<
-                                                            (is_indirect_le_ih
-                                                             (ih) ? tb->tb_sb->
-                                                             s_blocksize_bits -
-                                                             UNFM_P_SHIFT :
-                                                             0)));
+                                        set_le_ih_k_offset(ih, le_ih_k_offset(ih) +
+                                                           ((old_len - sbytes[i]) << (is_indirect_le_ih(ih) ? tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT : 0)));
 
                                         put_ih_item_len(ih, sbytes[i]);
 
@@ -1209,39 +843,29 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         if ((old_len - sbytes[i]) > zeros_num) {
                                                 r_zeros_number = 0;
-                                                r_body =
-                                                    body + (old_len -
-                                                            sbytes[i]) -
-                                                    zeros_num;
+                                                r_body = body + (old_len - sbytes[i]) - zeros_num;
                                         } else {
                                                 r_body = body;
-                                                r_zeros_number =
-                                                    zeros_num - (old_len -
-                                                                 sbytes[i]);
+                                                r_zeros_number = zeros_num - (old_len - sbytes[i]);
                                                 zeros_num -= r_zeros_number;
                                         }
 
-                                        leaf_insert_into_buf(&bi, 0, ih, r_body,
-                                                             r_zeros_number);
+                                        leaf_insert_into_buf(&bi, 0, ih, r_body, r_zeros_number);
 
                                         /* Calculate key component and item length to insert into S[i] */
                                         set_le_ih_k_offset(ih, old_key_comp);
-                                        put_ih_item_len(ih,
-                                                        old_len - sbytes[i]);
+                                        put_ih_item_len(ih, old_len - sbytes[i]);
                                         tb->insert_size[0] -= sbytes[i];
                                 } else {        /* whole new item falls into S_new[i] */
 
                                         /* Shift snum[0] - 1 items to S_new[i] (sbytes[i] of split item) */
                                         leaf_move_items(LEAF_FROM_S_TO_SNEW, tb,
-                                                        snum[i] - 1, sbytes[i],
-                                                        S_new[i]);
+                                                        snum[i] - 1, sbytes[i], S_new[i]);
 
                                         /* Insert new item into S_new[i] */
                                         buffer_info_init_bh(tb, &bi, S_new[i]);
-                                        leaf_insert_into_buf(&bi,
-                                                             item_pos - n +
-                                                             snum[i] - 1, ih,
-                                                             body, zeros_num);
+                                        leaf_insert_into_buf(&bi, item_pos - n + snum[i] - 1,
+                                                             ih, body, zeros_num);
 
                                         zeros_num = tb->insert_size[0] = 0;
                                 }
@@ -1268,150 +892,73 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                                 int entry_count;
 
-                                                entry_count =
-                                                    ih_entry_count(aux_ih);
+                                                entry_count = ih_entry_count(aux_ih);
 
-                                                if (entry_count - sbytes[i] <
-                                                    pos_in_item
-                                                    && pos_in_item <=
-                                                    entry_count) {
+                                                if (entry_count - sbytes[i] < pos_in_item && pos_in_item <= entry_count) {
                                                         /* new directory entry falls into S_new[i] */
 
-                                                        RFALSE(!tb->
-                                                               insert_size[0],
-                                                               "PAP-12215: insert_size is already 0");
-                                                        RFALSE(sbytes[i] - 1 >=
-                                                               entry_count,
+                                                        RFALSE(!tb->insert_size[0], "PAP-12215: insert_size is already 0");
+                                                        RFALSE(sbytes[i] - 1 >= entry_count,
                                                                "PAP-12220: there are no so much entries (%d), only %d",
-                                                               sbytes[i] - 1,
-                                                               entry_count);
+                                                               sbytes[i] - 1, entry_count);
 
                                                         /* Shift snum[i]-1 items in whole. Shift sbytes[i] directory entries from directory item number snum[i] */
-                                                        leaf_move_items
-                                                            (LEAF_FROM_S_TO_SNEW,
-                                                             tb, snum[i],
-                                                             sbytes[i] - 1,
-                                                             S_new[i]);
+                                                        leaf_move_items(LEAF_FROM_S_TO_SNEW, tb, snum[i], sbytes[i] - 1, S_new[i]);
                                                         /* Paste given directory entry to directory item */
                                                         buffer_info_init_bh(tb, &bi, S_new[i]);
-                                                        leaf_paste_in_buffer
-                                                            (&bi, 0,
-                                                             pos_in_item -
-                                                             entry_count +
-                                                             sbytes[i] - 1,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
+                                                        leaf_paste_in_buffer(&bi, 0, pos_in_item - entry_count + sbytes[i] - 1,
+                                                             tb->insert_size[0], body, zeros_num);
                                                         /* paste new directory entry */
-                                                        leaf_paste_entries(&bi,
-                                                                           0,
-                                                                           pos_in_item
-                                                                           -
-                                                                           entry_count
-                                                                           +
-                                                                           sbytes
-                                                                           [i] -
-                                                                           1, 1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
+                                                        leaf_paste_entries(&bi, 0, pos_in_item - entry_count + sbytes[i] - 1, 1,
+                                                                           (struct reiserfs_de_head *) body,
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
                                                         tb->insert_size[0] = 0;
                                                         pos_in_item++;
                                                 } else {        /* new directory entry doesn't fall into S_new[i] */
-                                                        leaf_move_items
-                                                            (LEAF_FROM_S_TO_SNEW,
-                                                             tb, snum[i],
-                                                             sbytes[i],
-                                                             S_new[i]);
+                                                        leaf_move_items(LEAF_FROM_S_TO_SNEW,tb, snum[i], sbytes[i], S_new[i]);
                                                 }
                                         } else {        /* regular object */
 
-                                                int n_shift, n_rem,
-                                                    r_zeros_number;
+                                                int n_shift, n_rem, r_zeros_number;
                                                 const char *r_body;
 
-                                                RFALSE(pos_in_item !=
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos))
-                                                       || tb->insert_size[0] <=
-                                                       0,
+                                                RFALSE(pos_in_item != ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)) || tb->insert_size[0] <= 0,
                                                        "PAP-12225: item too short or insert_size <= 0");
 
                                                 /* Calculate number of bytes which must be shifted from appended item */
-                                                n_shift =
-                                                    sbytes[i] -
-                                                    tb->insert_size[0];
+                                                n_shift = sbytes[i] - tb->insert_size[0];
                                                 if (n_shift < 0)
                                                         n_shift = 0;
-                                                leaf_move_items
-                                                    (LEAF_FROM_S_TO_SNEW, tb,
-                                                     snum[i], n_shift,
-                                                     S_new[i]);
+                                                leaf_move_items(LEAF_FROM_S_TO_SNEW, tb, snum[i], n_shift, S_new[i]);
 
                                                 /* Calculate number of bytes which must remain in body after append to S_new[i] */
-                                                n_rem =
-                                                    tb->insert_size[0] -
-                                                    sbytes[i];
+                                                n_rem = tb->insert_size[0] - sbytes[i];
                                                 if (n_rem < 0)
                                                         n_rem = 0;
                                                 /* Append part of body into S_new[0] */
                                                 buffer_info_init_bh(tb, &bi, S_new[i]);
                                                 if (n_rem > zeros_num) {
                                                         r_zeros_number = 0;
-                                                        r_body =
-                                                            body + n_rem -
-                                                            zeros_num;
+                                                        r_body = body + n_rem - zeros_num;
                                                 } else {
                                                         r_body = body;
-                                                        r_zeros_number =
-                                                            zeros_num - n_rem;
-                                                        zeros_num -=
-                                                            r_zeros_number;
+                                                        r_zeros_number = zeros_num - n_rem;
+                                                        zeros_num -= r_zeros_number;
                                                 }
 
-                                                leaf_paste_in_buffer(&bi, 0,
-                                                                     n_shift,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0] -
-                                                                     n_rem,
-                                                                     r_body,
-                                                                     r_zeros_number);
+                                                leaf_paste_in_buffer(&bi, 0, n_shift,
+                                                                     tb->insert_size[0] - n_rem,
+                                                                     r_body, r_zeros_number);
                                                 {
                                                         struct item_head *tmp;
 
-                                                        tmp =
-                                                            B_N_PITEM_HEAD(S_new
-                                                                           [i],
-                                                                           0);
+                                                        tmp = B_N_PITEM_HEAD(S_new[i], 0);
                                                         if (is_indirect_le_ih
                                                             (tmp)) {
-                                                                set_ih_free_space
-                                                                    (tmp, 0);
-                                                                set_le_ih_k_offset
-                                                                    (tmp,
-                                                                     le_ih_k_offset
-                                                                     (tmp) +
-                                                                     (n_rem <<
-                                                                      (tb->
-                                                                       tb_sb->
-                                                                       s_blocksize_bits
-                                                                       -
-                                                                       UNFM_P_SHIFT)));
+                                                                set_ih_free_space(tmp, 0);
+                                                                set_le_ih_k_offset(tmp, le_ih_k_offset(tmp) + (n_rem << (tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT)));
                                                         } else {
-                                                                set_le_ih_k_offset
-                                                                    (tmp,
-                                                                     le_ih_k_offset
-                                                                     (tmp) +
-                                                                     n_rem);
+                                                                set_le_ih_k_offset(tmp, le_ih_k_offset(tmp) + n_rem);
                                                         }
                                                 }
 
@@ -1426,8 +973,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         struct item_head *pasted;
 
 #ifdef CONFIG_REISERFS_CHECK
-                                        struct item_head *ih_check =
-                                            B_N_PITEM_HEAD(tbS0, item_pos);
+                                        struct item_head *ih_check = B_N_PITEM_HEAD(tbS0, item_pos);
 
                                         if (!is_direntry_le_ih(ih_check)
                                             && (pos_in_item != ih_item_len(ih_check)
@@ -1439,8 +985,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                              "to ih_item_len");
 #endif                          /* CONFIG_REISERFS_CHECK */
 
-                                        leaf_mi =
-                                            leaf_move_items(LEAF_FROM_S_TO_SNEW,
+                                        leaf_mi = leaf_move_items(LEAF_FROM_S_TO_SNEW,
                                                             tb, snum[i],
                                                             sbytes[i],
                                                             S_new[i]);
@@ -1452,30 +997,19 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         /* paste into item */
                                         buffer_info_init_bh(tb, &bi, S_new[i]);
                                         leaf_paste_in_buffer(&bi,
-                                                             item_pos - n +
-                                                             snum[i],
+                                                             item_pos - n + snum[i],
                                                              pos_in_item,
                                                              tb->insert_size[0],
                                                              body, zeros_num);
 
-                                        pasted =
-                                            B_N_PITEM_HEAD(S_new[i],
-                                                           item_pos - n +
-                                                           snum[i]);
+                                        pasted = B_N_PITEM_HEAD(S_new[i], item_pos - n + snum[i]);
                                         if (is_direntry_le_ih(pasted)) {
                                                 leaf_paste_entries(&bi,
-                                                                   item_pos -
-                                                                   n + snum[i],
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
+                                                                   item_pos - n + snum[i],
+                                                                   pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *)body,
+                                                                   body + DEH_SIZE,
+                                                                   tb->insert_size[0]
                                                     );
                                         }
 
@@ -1495,11 +1029,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                 default:        /* cases d and t */
                         reiserfs_panic(tb->tb_sb, "PAP-12245",
                                        "blknum > 2: unexpected mode: %s(%d)",
-                                       (flag ==
-                                        M_DELETE) ? "DELETE" : ((flag ==
-                                                                 M_CUT) ? "CUT"
-                                                                : "UNKNOWN"),
-                                       flag);
+                                       (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
                 }
 
                 memcpy(insert_key + i, B_N_PKEY(S_new[i], 0), KEY_SIZE);
@@ -1524,9 +1054,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                         /* If we insert the first key change the delimiting key */
                         if (item_pos == 0) {
                                 if (tb->CFL[0]) /* can be 0 in reiserfsck */
-                                        replace_key(tb, tb->CFL[0], tb->lkey[0],
-                                                    tbS0, 0);
-
+                                        replace_key(tb, tb->CFL[0], tb->lkey[0], tbS0, 0);
                         }
                         break;
 
@@ -1536,53 +1064,27 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                 pasted = B_N_PITEM_HEAD(tbS0, item_pos);
                                 /* when directory, may be new entry already pasted */
                                 if (is_direntry_le_ih(pasted)) {
-                                        if (pos_in_item >= 0 &&
-                                            pos_in_item <=
-                                            ih_entry_count(pasted)) {
+                                        if (pos_in_item >= 0 && pos_in_item <= ih_entry_count(pasted)) {
 
                                                 RFALSE(!tb->insert_size[0],
                                                        "PAP-12260: insert_size is 0 already");
 
                                                 /* prepare space */
                                                 buffer_info_init_tbS0(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
-                                                                     item_pos,
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
+                                                leaf_paste_in_buffer(&bi, item_pos, pos_in_item,
+                                                                     tb->insert_size[0], body,
                                                                      zeros_num);
 
                                                 /* paste entry */
-                                                leaf_paste_entries(&bi,
-                                                                   item_pos,
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
+                                                leaf_paste_entries(&bi, item_pos, pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *)body,
+                                                                   body + DEH_SIZE,
+                                                                   tb->insert_size[0]);
                                                 if (!item_pos && !pos_in_item) {
-                                                        RFALSE(!tb->CFL[0]
-                                                               || !tb->L[0],
+                                                        RFALSE(!tb->CFL[0] || !tb->L[0],
                                                                "PAP-12270: CFL[0]/L[0] must be specified");
-                                                        if (tb->CFL[0]) {
-                                                                replace_key(tb,
-                                                                            tb->
-                                                                            CFL
-                                                                            [0],
-                                                                            tb->
-                                                                            lkey
-                                                                            [0],
-                                                                            tbS0,
-                                                                            0);
-
-                                                        }
+                                                        if (tb->CFL[0])
+                                                                replace_key(tb, tb->CFL[0], tb->lkey[0], tbS0, 0);
                                                 }
                                                 tb->insert_size[0] = 0;
                                         }
@@ -1593,13 +1095,8 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                        "PAP-12275: insert size must not be %d",
                                                        tb->insert_size[0]);
                                                 buffer_info_init_tbS0(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
-                                                                     item_pos,
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
-                                                                     zeros_num);
+                                                leaf_paste_in_buffer(&bi, item_pos, pos_in_item,
+                                                                     tb->insert_size[0], body, zeros_num);
 
                                                 if (is_indirect_le_ih(pasted)) {
 #if 0
@@ -1611,8 +1108,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                                tb->
                                                                insert_size[0]);
 #endif
-                                                        set_ih_free_space
-                                                            (pasted, 0);
+                                                        set_ih_free_space(pasted, 0);
                                                 }
                                                 tb->insert_size[0] = 0;
                                         }
@@ -1620,8 +1116,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         else {
                                                 if (tb->insert_size[0]) {
                                                         print_cur_tb("12285");
-                                                        reiserfs_panic(tb->
-                                                                       tb_sb,
+                                                        reiserfs_panic(tb->tb_sb,
                                                             "PAP-12285",
                                                             "insert_size "
                                                             "must be 0 "
diff --git a/fs/sync.c b/fs/sync.c
index f15537452231..e8ba024a055b 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -222,23 +222,6 @@ SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
         return do_fsync(fd, 1);
 }
 
-/**
- * generic_write_sync - perform syncing after a write if file / inode is sync
- * @file:       file to which the write happened
- * @pos:        offset where the write started
- * @count:      length of the write
- *
- * This is just a simple wrapper about our general syncing function.
- */
-int generic_write_sync(struct file *file, loff_t pos, loff_t count)
-{
-        if (!(file->f_flags & O_DSYNC) && !IS_SYNC(file->f_mapping->host))
-                return 0;
-        return vfs_fsync_range(file, pos, pos + count - 1,
-                               (file->f_flags & __O_SYNC) ? 0 : 1);
-}
-EXPORT_SYMBOL(generic_write_sync);
-
 /*
  * sys_sync_file_range() permits finely controlled syncing over a segment of
  * a file in the range offset .. (offset+nbytes-1) inclusive.  If nbytes is
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 2e7989e3a2d6..64b48eade91d 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -799,7 +799,7 @@ xfs_file_aio_write(
                 XFS_STATS_ADD(xs_write_bytes, ret);
 
                 /* Handle various SYNC-type writes */
-                err = generic_write_sync(file, pos, ret);
+                err = generic_write_sync(file, iocb->ki_pos - ret, ret);
                 if (err < 0)
                         ret = err;
         }
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index f35d5c953ff9..9ddfb8190ca1 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -705,7 +705,6 @@ xfs_setattr_size(
 {
         struct xfs_mount        *mp = ip->i_mount;
         struct inode            *inode = VFS_I(ip);
-        int                     mask = iattr->ia_valid;
         xfs_off_t               oldsize, newsize;
         struct xfs_trans        *tp;
         int                     error;
@@ -726,8 +725,8 @@ xfs_setattr_size(
 
         ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
         ASSERT(S_ISREG(ip->i_d.di_mode));
-        ASSERT((mask & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
-                        ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
+        ASSERT((iattr->ia_valid & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
+                ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
 
         oldsize = inode->i_size;
         newsize = iattr->ia_size;
@@ -736,7 +735,7 @@ xfs_setattr_size(
          * Short circuit the truncate case for zero length files.
          */
         if (newsize == 0 && oldsize == 0 && ip->i_d.di_nextents == 0) {
-                if (!(mask & (ATTR_CTIME|ATTR_MTIME)))
+                if (!(iattr->ia_valid & (ATTR_CTIME|ATTR_MTIME)))
                         return 0;
 
                 /*
@@ -824,10 +823,11 @@ xfs_setattr_size(
          * these flags set.  For all other operations the VFS set these flags
          * explicitly if it wants a timestamp update.
          */
-        if (newsize != oldsize && (!(mask & (ATTR_CTIME | ATTR_MTIME)))) {
+        if (newsize != oldsize &&
+            !(iattr->ia_valid & (ATTR_CTIME | ATTR_MTIME))) {
                 iattr->ia_ctime = iattr->ia_mtime =
                         current_fs_time(inode->i_sb);
-                mask |= ATTR_CTIME | ATTR_MTIME;
+                iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME;
         }
 
         /*
@@ -863,9 +863,9 @@ xfs_setattr_size(
                 xfs_inode_clear_eofblocks_tag(ip);
         }
 
-        if (mask & ATTR_MODE)
+        if (iattr->ia_valid & ATTR_MODE)
                 xfs_setattr_mode(ip, iattr);
-        if (mask & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
+        if (iattr->ia_valid & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
                 xfs_setattr_time(ip, iattr);
 
         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index cdebd832c3db..4ef6fdbced78 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -205,16 +205,25 @@ xlog_cil_insert_format_items(
                 /*
                  * We 64-bit align the length of each iovec so that the start
                  * of the next one is naturally aligned.  We'll need to
-                 * account for that slack space here.
+                 * account for that slack space here. Then round nbytes up
+                 * to 64-bit alignment so that the initial buffer alignment is
+                 * easy to calculate and verify.
                  */
                 nbytes += niovecs * sizeof(uint64_t);
+                nbytes = round_up(nbytes, sizeof(uint64_t));
 
                 /* grab the old item if it exists for reservation accounting */
                 old_lv = lip->li_lv;
 
-                /* calc buffer size */
-                buf_size = sizeof(struct xfs_log_vec) + nbytes +
-                                niovecs * sizeof(struct xfs_log_iovec);
+                /*
+                 * The data buffer needs to start 64-bit aligned, so round up
+                 * that space to ensure we can align it appropriately and not
+                 * overrun the buffer.
+                 */
+                buf_size = nbytes +
+                           round_up((sizeof(struct xfs_log_vec) +
+                                     niovecs * sizeof(struct xfs_log_iovec)),
+                                    sizeof(uint64_t));
 
                 /* compare to existing item size */
                 if (lip->li_lv && buf_size <= lip->li_lv->lv_size) {
@@ -251,6 +260,8 @@ xlog_cil_insert_format_items(
                 /* The allocated data region lies beyond the iovec region */
                 lv->lv_buf_len = 0;
                 lv->lv_buf = (char *)lv + buf_size - nbytes;
+                ASSERT(IS_ALIGNED((unsigned long)lv->lv_buf, sizeof(uint64_t)));
+
                 lip->li_ops->iop_format(lip, lv);
 insert:
                 ASSERT(lv->lv_buf_len <= nbytes);
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 02df7b408a26..f96c05669a9e 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -282,22 +282,29 @@ xfs_readsb(
         struct xfs_sb   *sbp = &mp->m_sb;
         int             error;
         int             loud = !(flags & XFS_MFSI_QUIET);
+        const struct xfs_buf_ops *buf_ops;
 
         ASSERT(mp->m_sb_bp == NULL);
         ASSERT(mp->m_ddev_targp != NULL);
 
         /*
+         * For the initial read, we must guess at the sector
+         * size based on the block device.  It's enough to
+         * get the sb_sectsize out of the superblock and
+         * then reread with the proper length.
+         * We don't verify it yet, because it may not be complete.
+         */
+        sector_size = xfs_getsize_buftarg(mp->m_ddev_targp);
+        buf_ops = NULL;
+
+        /*
          * Allocate a (locked) buffer to hold the superblock.
          * This will be kept around at all times to optimize
          * access to the superblock.
          */
-        sector_size = xfs_getsize_buftarg(mp->m_ddev_targp);
-
 reread:
         bp = xfs_buf_read_uncached(mp->m_ddev_targp, XFS_SB_DADDR,
-                                   BTOBB(sector_size), 0,
-                                   loud ? &xfs_sb_buf_ops
-                                        : &xfs_sb_quiet_buf_ops);
+                                   BTOBB(sector_size), 0, buf_ops);
         if (!bp) {
                 if (loud)
                         xfs_warn(mp, "SB buffer read failed");
@@ -328,12 +335,13 @@ reread:
         }
 
         /*
-         * If device sector size is smaller than the superblock size,
-         * re-read the superblock so the buffer is correctly sized.
+         * Re-read the superblock so the buffer is correctly sized,
+         * and properly verified.
          */
-        if (sector_size < sbp->sb_sectsize) {
+        if (buf_ops == NULL) {
                 xfs_buf_relse(bp);
                 sector_size = sbp->sb_sectsize;
+                buf_ops = loud ? &xfs_sb_buf_ops : &xfs_sb_quiet_buf_ops;
                 goto reread;
         }
 
diff --git a/fs/xfs/xfs_sb.c b/fs/xfs/xfs_sb.c
index b7c9aea77f8f..1e116794bb66 100644
--- a/fs/xfs/xfs_sb.c
+++ b/fs/xfs/xfs_sb.c
@@ -295,8 +295,7 @@ xfs_mount_validate_sb(
             sbp->sb_dblocks == 0                                        ||
             sbp->sb_dblocks > XFS_MAX_DBLOCKS(sbp)                      ||
             sbp->sb_dblocks < XFS_MIN_DBLOCKS(sbp))) {
-                XFS_CORRUPTION_ERROR("SB sanity check failed",
-                                XFS_ERRLEVEL_LOW, mp, sbp);
+                xfs_notice(mp, "SB sanity check failed");
                 return XFS_ERROR(EFSCORRUPTED);
         }
 
@@ -611,10 +610,10 @@ xfs_sb_read_verify(
                                                 XFS_SB_VERSION_5) ||
              dsb->sb_crc != 0)) {
 
-                if (!xfs_verify_cksum(bp->b_addr, be16_to_cpu(dsb->sb_sectsize),
+                if (!xfs_verify_cksum(bp->b_addr, BBTOB(bp->b_length),
                                       offsetof(struct xfs_sb, sb_crc))) {
                         /* Only fail bad secondaries on a known V5 filesystem */
-                        if (bp->b_bn != XFS_SB_DADDR &&
+                        if (bp->b_bn == XFS_SB_DADDR ||
                             xfs_sb_version_hascrc(&mp->m_sb)) {
                                 error = EFSCORRUPTED;
                                 goto out_error;
@@ -625,7 +624,7 @@ xfs_sb_read_verify(
 
 out_error:
         if (error) {
-                if (error != EWRONGFS)
+                if (error == EFSCORRUPTED)
                         XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW,
                                              mp, bp->b_addr);
                 xfs_buf_ioerror(bp, error);
@@ -644,7 +643,6 @@ xfs_sb_quiet_read_verify(
 {
         struct xfs_dsb  *dsb = XFS_BUF_TO_SBP(bp);
 
-
         if (dsb->sb_magicnum == cpu_to_be32(XFS_SB_MAGIC)) {
                 /* XFS filesystem, verify noisily! */
                 xfs_sb_read_verify(bp);
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 8e4f41d9af4d..34c7bdc06014 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -701,6 +701,18 @@ static inline pte_t pte_mknuma(pte_t pte)
 }
 #endif
 
+#ifndef ptep_set_numa
+static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pte_t *ptep)
+{
+        pte_t ptent = *ptep;
+
+        ptent = pte_mknuma(ptent);
+        set_pte_at(mm, addr, ptep, ptent);
+        return;
+}
+#endif
+
 #ifndef pmd_mknuma
 static inline pmd_t pmd_mknuma(pmd_t pmd)
 {
@@ -708,6 +720,18 @@ static inline pmd_t pmd_mknuma(pmd_t pmd)
         return pmd_clear_flags(pmd, _PAGE_PRESENT);
 }
 #endif
+
+#ifndef pmdp_set_numa
+static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pmd_t *pmdp)
+{
+        pmd_t pmd = *pmdp;
+
+        pmd = pmd_mknuma(pmd);
+        set_pmd_at(mm, addr, pmdp, pmd);
+        return;
+}
+#endif
 #else
 extern int pte_numa(pte_t pte);
 extern int pmd_numa(pmd_t pmd);
@@ -715,6 +739,8 @@ extern pte_t pte_mknonnuma(pte_t pte);
 extern pmd_t pmd_mknonnuma(pmd_t pmd);
 extern pte_t pte_mknuma(pte_t pte);
 extern pmd_t pmd_mknuma(pmd_t pmd);
+extern void ptep_set_numa(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
+extern void pmdp_set_numa(struct mm_struct *mm, unsigned long addr, pmd_t *pmdp);
 #endif /* CONFIG_ARCH_USES_NUMA_PROT_NONE */
 #else
 static inline int pmd_numa(pmd_t pmd)
@@ -742,10 +768,23 @@ static inline pte_t pte_mknuma(pte_t pte)
         return pte;
 }
 
+static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pte_t *ptep)
+{
+        return;
+}
+
+
 static inline pmd_t pmd_mknuma(pmd_t pmd)
 {
         return pmd;
 }
+
+static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pmd_t *pmdp)
+{
+        return ;
+}
 #endif /* CONFIG_NUMA_BALANCING */
 
 #endif /* CONFIG_MMU */
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 04086c5be930..04a7f31301f8 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -199,6 +199,9 @@ int drm_err(const char *func, const char *format, ...);
 #define DRM_INFO(fmt, ...)                              \
         printk(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__)
 
+#define DRM_INFO_ONCE(fmt, ...)                         \
+        printk_once(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__)
+
 /**
  * Debug output.
  *
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 71727b6210ae..8f3dee097579 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -907,6 +907,9 @@ struct drm_mode_config {
 
         /* whether async page flip is supported or not */
         bool async_page_flip;
+
+        /* cursor size */
+        uint32_t cursor_width, cursor_height;
 };
 
 #define obj_to_crtc(x) container_of(x, struct drm_crtc, base)
diff --git a/include/drm/ttm/ttm_page_alloc.h b/include/drm/ttm/ttm_page_alloc.h
index d1f61bfe0ebe..49a828425fa2 100644
--- a/include/drm/ttm/ttm_page_alloc.h
+++ b/include/drm/ttm/ttm_page_alloc.h
@@ -29,6 +29,8 @@
 #include <drm/ttm/ttm_bo_driver.h>
 #include <drm/ttm/ttm_memory.h>
 
+struct device;
+
 /**
  * Initialize pool allocator.
  */
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 70654521dab6..5a4d39b4686b 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -250,6 +250,17 @@ static inline unsigned bio_segments(struct bio *bio)
         struct bio_vec bv;
         struct bvec_iter iter;
 
+        /*
+         * We special case discard/write same, because they interpret bi_size
+         * differently:
+         */
+
+        if (bio->bi_rw & REQ_DISCARD)
+                return 1;
+
+        if (bio->bi_rw & REQ_WRITE_SAME)
+                return 1;
+
         bio_for_each_segment(bv, bio, iter)
                 segs++;
 
@@ -332,6 +343,7 @@ extern struct bio *bio_clone_fast(struct bio *, gfp_t, struct bio_set *);
 extern struct bio *bio_clone_bioset(struct bio *, gfp_t, struct bio_set *bs);
 
 extern struct bio_set *fs_bio_set;
+unsigned int bio_integrity_tag_size(struct bio *bio);
 
 static inline struct bio *bio_alloc(gfp_t gfp_mask, unsigned int nr_iovecs)
 {
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index 161b23105b1e..18ba8a627f46 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -83,6 +83,8 @@ struct blk_mq_ops {
          */
         rq_timed_out_fn         *timeout;
 
+        softirq_done_fn         *complete;
+
         /*
          * Override for hctx allocations (should probably go)
          */
@@ -119,11 +121,12 @@ void blk_mq_init_commands(struct request_queue *, void (*init)(void *data, struc
 
 void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule);
 
-void blk_mq_insert_request(struct request_queue *, struct request *, bool);
+void blk_mq_insert_request(struct request_queue *, struct request *,
+                bool, bool);
 void blk_mq_run_queues(struct request_queue *q, bool async);
 void blk_mq_free_request(struct request *rq);
 bool blk_mq_can_queue(struct blk_mq_hw_ctx *);
-struct request *blk_mq_alloc_request(struct request_queue *q, int rw, gfp_t gfp, bool reserved);
+struct request *blk_mq_alloc_request(struct request_queue *q, int rw, gfp_t gfp);
 struct request *blk_mq_alloc_reserved_request(struct request_queue *q, int rw, gfp_t gfp);
 struct request *blk_mq_rq_from_tag(struct request_queue *q, unsigned int tag);
 
@@ -133,6 +136,8 @@ void blk_mq_free_single_hw_queue(struct blk_mq_hw_ctx *, unsigned int);
 
 void blk_mq_end_io(struct request *rq, int error);
 
+void blk_mq_complete_request(struct request *rq);
+
 void blk_mq_stop_hw_queue(struct blk_mq_hw_ctx *hctx);
 void blk_mq_start_hw_queue(struct blk_mq_hw_ctx *hctx);
 void blk_mq_stop_hw_queues(struct request_queue *q);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 8678c4322b44..4afa4f8f6090 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -98,7 +98,7 @@ struct request {
         struct list_head queuelist;
         union {
                 struct call_single_data csd;
-                struct work_struct mq_flush_data;
+                struct work_struct mq_flush_work;
         };
 
         struct request_queue *q;
@@ -448,13 +448,8 @@ struct request_queue {
         unsigned long           flush_pending_since;
         struct list_head        flush_queue[2];
         struct list_head        flush_data_in_flight;
-        union {
-                struct request  flush_rq;
-                struct {
-                        spinlock_t mq_flush_lock;
-                        struct work_struct mq_flush_work;
-                };
-        };
+        struct request          *flush_rq;
+        spinlock_t              mq_flush_lock;
 
         struct mutex            sysfs_lock;
 
diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
index 2f0543f7510c..f9bbbb472663 100644
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -11,7 +11,9 @@
 #define CAN_SKB_H
 
 #include <linux/types.h>
+#include <linux/skbuff.h>
 #include <linux/can.h>
+#include <net/sock.h>
 
 /*
  * The struct can_skb_priv is used to transport additional information along
@@ -42,4 +44,40 @@ static inline void can_skb_reserve(struct sk_buff *skb)
         skb_reserve(skb, sizeof(struct can_skb_priv));
 }
 
+static inline void can_skb_destructor(struct sk_buff *skb)
+{
+        sock_put(skb->sk);
+}
+
+static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
+{
+        if (sk) {
+                sock_hold(sk);
+                skb->destructor = can_skb_destructor;
+                skb->sk = sk;
+        }
+}
+
+/*
+ * returns an unshared skb owned by the original sock to be echo'ed back
+ */
+static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb)
+{
+        if (skb_shared(skb)) {
+                struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+
+                if (likely(nskb)) {
+                        can_skb_set_owner(nskb, skb->sk);
+                        consume_skb(skb);
+                        return nskb;
+                } else {
+                        kfree_skb(skb);
+                        return NULL;
+                }
+        }
+
+        /* we can assume to have an unshared skb with proper owner */
+        return skb;
+}
+
 #endif /* CAN_SKB_H */
diff --git a/include/linux/ceph/ceph_fs.h b/include/linux/ceph/ceph_fs.h
index 2623cffc73a1..25bfb0eff772 100644
--- a/include/linux/ceph/ceph_fs.h
+++ b/include/linux/ceph/ceph_fs.h
@@ -373,8 +373,9 @@ extern const char *ceph_mds_op_name(int op);
 /*
  * Ceph setxattr request flags.
  */
-#define CEPH_XATTR_CREATE  1
-#define CEPH_XATTR_REPLACE 2
+#define CEPH_XATTR_CREATE  (1 << 0)
+#define CEPH_XATTR_REPLACE (1 << 1)
+#define CEPH_XATTR_REMOVE  (1 << 31)
 
 union ceph_mds_request_args {
         struct {
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 5c097596104b..9450f025fe0c 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -166,6 +166,8 @@ struct cgroup {
          *
          * The ID of the root cgroup is always 0, and a new cgroup
          * will be assigned with a smallest available ID.
+         *
+         * Allocating/Removing ID must be protected by cgroup_mutex.
          */
         int id;
 
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index ded429966c1f..2507fd2a1eb4 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -75,11 +75,7 @@
  *
  * (asm goto is automatically volatile - the naming reflects this.)
  */
-#if GCC_VERSION <= 40801
-# define asm_volatile_goto(x...)        do { asm goto(x); asm (""); } while (0)
-#else
-# define asm_volatile_goto(x...)        do { asm goto(x); } while (0)
-#endif
+#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
 
 #ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
 #if GCC_VERSION >= 40400
diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h
index dfac5ed31120..f886985a28b2 100644
--- a/include/linux/dma-buf.h
+++ b/include/linux/dma-buf.h
@@ -171,7 +171,7 @@ struct dma_buf *dma_buf_export_named(void *priv, const struct dma_buf_ops *ops,
                                size_t size, int flags, const char *);
 
 #define dma_buf_export(priv, ops, size, flags)  \
-        dma_buf_export_named(priv, ops, size, flags, __FILE__)
+        dma_buf_export_named(priv, ops, size, flags, KBUILD_MODNAME)
 
 int dma_buf_fd(struct dma_buf *dmabuf, int flags);
 struct dma_buf *dma_buf_get(int fd);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index d79678c188ad..60829565e552 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2274,7 +2274,13 @@ extern int filemap_fdatawrite_range(struct address_space *mapping,
 extern int vfs_fsync_range(struct file *file, loff_t start, loff_t end,
                            int datasync);
 extern int vfs_fsync(struct file *file, int datasync);
-extern int generic_write_sync(struct file *file, loff_t pos, loff_t count);
+static inline int generic_write_sync(struct file *file, loff_t pos, loff_t count)
+{
+        if (!(file->f_flags & O_DSYNC) && !IS_SYNC(file->f_mapping->host))
+                return 0;
+        return vfs_fsync_range(file, pos, pos + count - 1,
+                               (file->f_flags & __O_SYNC) ? 0 : 1);
+}
 extern void emergency_sync(void);
 extern void emergency_remount(void);
 #ifdef CONFIG_BLOCK
diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
index 4d34dbbbad4d..7a8144fef406 100644
--- a/include/linux/gpio/consumer.h
+++ b/include/linux/gpio/consumer.h
@@ -4,8 +4,6 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 
-#ifdef CONFIG_GPIOLIB
-
 struct device;
 struct gpio_chip;
 
@@ -18,6 +16,8 @@ struct gpio_chip;
  */
 struct gpio_desc;
 
+#ifdef CONFIG_GPIOLIB
+
 /* Acquire and dispose GPIOs */
 struct gpio_desc *__must_check gpiod_get(struct device *dev,
                                          const char *con_id);
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 15da677478dd..344883dce584 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -875,7 +875,7 @@ struct vmbus_channel_relid_released {
 struct vmbus_channel_initiate_contact {
         struct vmbus_channel_message_header header;
         u32 vmbus_version_requested;
-        u32 padding2;
+        u32 target_vcpu; /* The VCPU the host should respond to */
         u64 interrupt_page;
         u64 monitor_page1;
         u64 monitor_page2;
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 0053adde0ed9..a2678d35b5a2 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -158,6 +158,11 @@ devm_request_irq(struct device *dev, unsigned int irq, irq_handler_t handler,
                                          devname, dev_id);
 }
 
+extern int __must_check
+devm_request_any_context_irq(struct device *dev, unsigned int irq,
+                 irq_handler_t handler, unsigned long irqflags,
+                 const char *devname, void *dev_id);
+
 extern void devm_free_irq(struct device *dev, unsigned int irq, void *dev_id);
 
 /*
diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
index e7831d203737..35e7eca4e33b 100644
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -118,9 +118,7 @@ extern int mq_init_ns(struct ipc_namespace *ns);
  *     the new maximum will handle anyone else.  I may have to revisit this
  *     in the future.
  */
-#define MIN_QUEUESMAX                   1
 #define DFLT_QUEUESMAX                256
-#define HARD_QUEUESMAX               1024
 #define MIN_MSGMAX                      1
 #define DFLT_MSG                       10U
 #define DFLT_MSGMAX                    10
diff --git a/include/linux/mfd/max8997-private.h b/include/linux/mfd/max8997-private.h
index ad1ae7f345ad..78c76cd4d37b 100644
--- a/include/linux/mfd/max8997-private.h
+++ b/include/linux/mfd/max8997-private.h
@@ -387,7 +387,7 @@ struct max8997_dev {
         struct i2c_client *muic; /* slave addr 0x4a */
         struct mutex iolock;
 
-        int type;
+        unsigned long type;
         struct platform_device *battery; /* battery control (not fuel gauge) */
 
         int irq;
diff --git a/include/linux/mfd/max8998-private.h b/include/linux/mfd/max8998-private.h
index 4ecb24b4b863..d68ada502ff3 100644
--- a/include/linux/mfd/max8998-private.h
+++ b/include/linux/mfd/max8998-private.h
@@ -163,7 +163,7 @@ struct max8998_dev {
         int ono;
         u8 irq_masks_cur[MAX8998_NUM_IRQ_REGS];
         u8 irq_masks_cache[MAX8998_NUM_IRQ_REGS];
-        int type;
+        unsigned long type;
         bool wakeup;
 };
 
diff --git a/include/linux/mfd/tps65217.h b/include/linux/mfd/tps65217.h
index a5a7f0130e96..54b5458ec084 100644
--- a/include/linux/mfd/tps65217.h
+++ b/include/linux/mfd/tps65217.h
@@ -252,7 +252,7 @@ struct tps65217_board {
 struct tps65217 {
         struct device *dev;
         struct tps65217_board *pdata;
-        unsigned int id;
+        unsigned long id;
         struct regulator_desc desc[TPS65217_NUM_REGULATOR];
         struct regulator_dev *rdev[TPS65217_NUM_REGULATOR];
         struct regmap *regmap;
@@ -263,7 +263,7 @@ static inline struct tps65217 *dev_to_tps65217(struct device *dev)
         return dev_get_drvdata(dev);
 }
 
-static inline int tps65217_chip_id(struct tps65217 *tps65217)
+static inline unsigned long tps65217_chip_id(struct tps65217 *tps65217)
 {
         return tps65217->id;
 }
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 554548cd3dd4..130bc8d77fa5 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -38,8 +38,10 @@
 #include <linux/pci.h>
 #include <linux/spinlock_types.h>
 #include <linux/semaphore.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/radix-tree.h>
+
 #include <linux/mlx5/device.h>
 #include <linux/mlx5/doorbell.h>
 
@@ -227,6 +229,7 @@ struct mlx5_uuar_info {
          * protect uuar allocation data structs
          */
         struct mutex            lock;
+        u32                     ver;
 };
 
 struct mlx5_bf {
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 440a02ee6f92..e8eeebd49a98 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -752,6 +752,9 @@ struct netdev_phys_port_id {
         unsigned char id_len;
 };
 
+typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
+                                       struct sk_buff *skb);
+
 /*
  * This structure defines the management hooks for network devices.
  * The following hooks can be defined; unless noted otherwise, they are
@@ -783,7 +786,7 @@ struct netdev_phys_port_id {
  *      Required can not be NULL.
  *
  * u16 (*ndo_select_queue)(struct net_device *dev, struct sk_buff *skb,
- *                         void *accel_priv);
+ *                         void *accel_priv, select_queue_fallback_t fallback);
  *      Called to decide which queue to when device supports multiple
  *      transmit queues.
  *
@@ -1005,7 +1008,8 @@ struct net_device_ops {
                                                    struct net_device *dev);
         u16                     (*ndo_select_queue)(struct net_device *dev,
                                                     struct sk_buff *skb,
-                                                    void *accel_priv);
+                                                    void *accel_priv,
+                                                    select_queue_fallback_t fallback);
         void                    (*ndo_change_rx_flags)(struct net_device *dev,
                                                        int flags);
         void                    (*ndo_set_rx_mode)(struct net_device *dev);
@@ -1551,7 +1555,6 @@ static inline void netdev_for_each_tx_queue(struct net_device *dev,
 struct netdev_queue *netdev_pick_tx(struct net_device *dev,
                                     struct sk_buff *skb,
                                     void *accel_priv);
-u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb);
 
 /*
  * Net namespace inlines
@@ -2276,6 +2279,26 @@ static inline void netdev_reset_queue(struct net_device *dev_queue)
 }
 
 /**
+ *      netdev_cap_txqueue - check if selected tx queue exceeds device queues
+ *      @dev: network device
+ *      @queue_index: given tx queue index
+ *
+ *      Returns 0 if given tx queue index >= number of device tx queues,
+ *      otherwise returns the originally passed tx queue index.
+ */
+static inline u16 netdev_cap_txqueue(struct net_device *dev, u16 queue_index)
+{
+        if (unlikely(queue_index >= dev->real_num_tx_queues)) {
+                net_warn_ratelimited("%s selects TX queue %d, but real number of TX queues is %d\n",
+                                     dev->name, queue_index,
+                                     dev->real_num_tx_queues);
+                return 0;
+        }
+
+        return queue_index;
+}
+
+/**
  *      netif_running - test if up
  *      @dev: network device
  *
@@ -3068,7 +3091,12 @@ void netdev_change_features(struct net_device *dev);
 void netif_stacked_transfer_operstate(const struct net_device *rootdev,
                                         struct net_device *dev);
 
-netdev_features_t netif_skb_features(struct sk_buff *skb);
+netdev_features_t netif_skb_dev_features(struct sk_buff *skb,
+                                         const struct net_device *dev);
+static inline netdev_features_t netif_skb_features(struct sk_buff *skb)
+{
+        return netif_skb_dev_features(skb, skb->dev);
+}
 
 static inline bool net_gso_ok(netdev_features_t features, int gso_type)
 {
diff --git a/include/linux/of.h b/include/linux/of.h
index 70c64ba17fa5..435cb995904d 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -169,35 +169,15 @@ static inline const char *of_node_full_name(const struct device_node *np)
 
 extern struct device_node *of_find_node_by_name(struct device_node *from,
         const char *name);
-#define for_each_node_by_name(dn, name) \
-        for (dn = of_find_node_by_name(NULL, name); dn; \
-             dn = of_find_node_by_name(dn, name))
 extern struct device_node *of_find_node_by_type(struct device_node *from,
         const char *type);
-#define for_each_node_by_type(dn, type) \
-        for (dn = of_find_node_by_type(NULL, type); dn; \
-             dn = of_find_node_by_type(dn, type))
 extern struct device_node *of_find_compatible_node(struct device_node *from,
         const char *type, const char *compat);
-#define for_each_compatible_node(dn, type, compatible) \
-        for (dn = of_find_compatible_node(NULL, type, compatible); dn; \
-             dn = of_find_compatible_node(dn, type, compatible))
 extern struct device_node *of_find_matching_node_and_match(
         struct device_node *from,
         const struct of_device_id *matches,
         const struct of_device_id **match);
-static inline struct device_node *of_find_matching_node(
-        struct device_node *from,
-        const struct of_device_id *matches)
-{
-        return of_find_matching_node_and_match(from, matches, NULL);
-}
-#define for_each_matching_node(dn, matches) \
-        for (dn = of_find_matching_node(NULL, matches); dn; \
-             dn = of_find_matching_node(dn, matches))
-#define for_each_matching_node_and_match(dn, matches, match) \
-        for (dn = of_find_matching_node_and_match(NULL, matches, match); \
-             dn; dn = of_find_matching_node_and_match(dn, matches, match))
+
 extern struct device_node *of_find_node_by_path(const char *path);
 extern struct device_node *of_find_node_by_phandle(phandle handle);
 extern struct device_node *of_get_parent(const struct device_node *node);
@@ -209,43 +189,11 @@ extern struct device_node *of_get_next_available_child(
 
 extern struct device_node *of_get_child_by_name(const struct device_node *node,
                                         const char *name);
-#define for_each_child_of_node(parent, child) \
-        for (child = of_get_next_child(parent, NULL); child != NULL; \
-             child = of_get_next_child(parent, child))
-
-#define for_each_available_child_of_node(parent, child) \
-        for (child = of_get_next_available_child(parent, NULL); child != NULL; \
-             child = of_get_next_available_child(parent, child))
-
-static inline int of_get_child_count(const struct device_node *np)
-{
-        struct device_node *child;
-        int num = 0;
-
-        for_each_child_of_node(np, child)
-                num++;
-
-        return num;
-}
-
-static inline int of_get_available_child_count(const struct device_node *np)
-{
-        struct device_node *child;
-        int num = 0;
-
-        for_each_available_child_of_node(np, child)
-                num++;
-
-        return num;
-}
 
 /* cache lookup */
 extern struct device_node *of_find_next_cache_node(const struct device_node *);
 extern struct device_node *of_find_node_with_property(
         struct device_node *from, const char *prop_name);
-#define for_each_node_with_property(dn, prop_name) \
-        for (dn = of_find_node_with_property(NULL, prop_name); dn; \
-             dn = of_find_node_with_property(dn, prop_name))
 
 extern struct property *of_find_property(const struct device_node *np,
                                          const char *name,
@@ -367,42 +315,53 @@ static inline struct device_node *of_find_node_by_name(struct device_node *from,
         return NULL;
 }
 
-static inline struct device_node *of_get_parent(const struct device_node *node)
+static inline struct device_node *of_find_node_by_type(struct device_node *from,
+        const char *type)
 {
         return NULL;
 }
 
-static inline bool of_have_populated_dt(void)
+static inline struct device_node *of_find_matching_node_and_match(
+        struct device_node *from,
+        const struct of_device_id *matches,
+        const struct of_device_id **match)
 {
-        return false;
+        return NULL;
 }
 
-/* Kill an unused variable warning on a device_node pointer */
-static inline void __of_use_dn(const struct device_node *np)
+static inline struct device_node *of_get_parent(const struct device_node *node)
 {
+        return NULL;
 }
 
-#define for_each_child_of_node(parent, child) \
-        while (__of_use_dn(parent), __of_use_dn(child), 0)
+static inline struct device_node *of_get_next_child(
+        const struct device_node *node, struct device_node *prev)
+{
+        return NULL;
+}
 
-#define for_each_available_child_of_node(parent, child) \
-        while (0)
+static inline struct device_node *of_get_next_available_child(
+        const struct device_node *node, struct device_node *prev)
+{
+        return NULL;
+}
 
-static inline struct device_node *of_get_child_by_name(
-                                        const struct device_node *node,
-                                        const char *name)
+static inline struct device_node *of_find_node_with_property(
+        struct device_node *from, const char *prop_name)
 {
         return NULL;
 }
 
-static inline int of_get_child_count(const struct device_node *np)
+static inline bool of_have_populated_dt(void)
 {
-        return 0;
+        return false;
 }
 
-static inline int of_get_available_child_count(const struct device_node *np)
+static inline struct device_node *of_get_child_by_name(
+                                        const struct device_node *node,
+                                        const char *name)
 {
-        return 0;
+        return NULL;
 }
 
 static inline int of_device_is_compatible(const struct device_node *device,
@@ -569,6 +528,13 @@ extern int of_node_to_nid(struct device_node *np);
 static inline int of_node_to_nid(struct device_node *device) { return 0; }
 #endif
 
+static inline struct device_node *of_find_matching_node(
+        struct device_node *from,
+        const struct of_device_id *matches)
+{
+        return of_find_matching_node_and_match(from, matches, NULL);
+}
+
 /**
  * of_property_read_bool - Findfrom a property
  * @np:         device node from which the property value is to be read.
@@ -618,6 +584,55 @@ static inline int of_property_read_u32(const struct device_node *np,
                 s;                                              \
                 s = of_prop_next_string(prop, s))
 
+#define for_each_node_by_name(dn, name) \
+        for (dn = of_find_node_by_name(NULL, name); dn; \
+             dn = of_find_node_by_name(dn, name))
+#define for_each_node_by_type(dn, type) \
+        for (dn = of_find_node_by_type(NULL, type); dn; \
+             dn = of_find_node_by_type(dn, type))
+#define for_each_compatible_node(dn, type, compatible) \
+        for (dn = of_find_compatible_node(NULL, type, compatible); dn; \
+             dn = of_find_compatible_node(dn, type, compatible))
+#define for_each_matching_node(dn, matches) \
+        for (dn = of_find_matching_node(NULL, matches); dn; \
+             dn = of_find_matching_node(dn, matches))
+#define for_each_matching_node_and_match(dn, matches, match) \
+        for (dn = of_find_matching_node_and_match(NULL, matches, match); \
+             dn; dn = of_find_matching_node_and_match(dn, matches, match))
+
+#define for_each_child_of_node(parent, child) \
+        for (child = of_get_next_child(parent, NULL); child != NULL; \
+             child = of_get_next_child(parent, child))
+#define for_each_available_child_of_node(parent, child) \
+        for (child = of_get_next_available_child(parent, NULL); child != NULL; \
+             child = of_get_next_available_child(parent, child))
+
+#define for_each_node_with_property(dn, prop_name) \
+        for (dn = of_find_node_with_property(NULL, prop_name); dn; \
+             dn = of_find_node_with_property(dn, prop_name))
+
+static inline int of_get_child_count(const struct device_node *np)
+{
+        struct device_node *child;
+        int num = 0;
+
+        for_each_child_of_node(np, child)
+                num++;
+
+        return num;
+}
+
+static inline int of_get_available_child_count(const struct device_node *np)
+{
+        struct device_node *child;
+        int num = 0;
+
+        for_each_available_child_of_node(np, child)
+                num++;
+
+        return num;
+}
+
 #if defined(CONFIG_PROC_FS) && defined(CONFIG_PROC_DEVICETREE)
 extern void proc_device_tree_add_node(struct device_node *, struct proc_dir_entry *);
 extern void proc_device_tree_add_prop(struct proc_dir_entry *pde, struct property *prop);
diff --git a/include/linux/of_device.h b/include/linux/of_device.h
index 8d7dd6768cb7..ef370210ffb2 100644
--- a/include/linux/of_device.h
+++ b/include/linux/of_device.h
@@ -78,11 +78,13 @@ static inline int of_device_uevent_modalias(struct device *dev,
 
 static inline void of_device_node_put(struct device *dev) { }
 
-static inline const struct of_device_id *of_match_device(
+static inline const struct of_device_id *__of_match_device(
                 const struct of_device_id *matches, const struct device *dev)
 {
         return NULL;
 }
+#define of_match_device(matches, dev)   \
+        __of_match_device(of_match_ptr(matches), (dev))
 
 static inline struct device_node *of_cpu_device_node_get(int cpu)
 {
diff --git a/include/linux/pci.h b/include/linux/pci.h
index fb57c892b214..33aa2caf0f0c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1169,8 +1169,23 @@ void msi_remove_pci_irq_vectors(struct pci_dev *dev);
 void pci_restore_msi_state(struct pci_dev *dev);
 int pci_msi_enabled(void);
 int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec);
+static inline int pci_enable_msi_exact(struct pci_dev *dev, int nvec)
+{
+        int rc = pci_enable_msi_range(dev, nvec, nvec);
+        if (rc < 0)
+                return rc;
+        return 0;
+}
 int pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries,
                           int minvec, int maxvec);
+static inline int pci_enable_msix_exact(struct pci_dev *dev,
+                                        struct msix_entry *entries, int nvec)
+{
+        int rc = pci_enable_msix_range(dev, entries, nvec, nvec);
+        if (rc < 0)
+                return rc;
+        return 0;
+}
 #else
 static inline int pci_msi_vec_count(struct pci_dev *dev) { return -ENOSYS; }
 static inline int pci_enable_msi_block(struct pci_dev *dev, int nvec)
@@ -1189,9 +1204,14 @@ static inline int pci_msi_enabled(void) { return 0; }
 static inline int pci_enable_msi_range(struct pci_dev *dev, int minvec,
                                        int maxvec)
 { return -ENOSYS; }
+static inline int pci_enable_msi_exact(struct pci_dev *dev, int nvec)
+{ return -ENOSYS; }
 static inline int pci_enable_msix_range(struct pci_dev *dev,
                       struct msix_entry *entries, int minvec, int maxvec)
 { return -ENOSYS; }
+static inline int pci_enable_msix_exact(struct pci_dev *dev,
+                      struct msix_entry *entries, int nvec)
+{ return -ENOSYS; }
 #endif
 
 #ifdef CONFIG_PCIEPORTBUS
diff --git a/include/linux/phy/phy.h b/include/linux/phy/phy.h
index e273e5ac19c9..3f83459dbb20 100644
--- a/include/linux/phy/phy.h
+++ b/include/linux/phy/phy.h
@@ -146,7 +146,9 @@ static inline void phy_set_bus_width(struct phy *phy, int bus_width)
         phy->attrs.bus_width = bus_width;
 }
 struct phy *phy_get(struct device *dev, const char *string);
+struct phy *phy_optional_get(struct device *dev, const char *string);
 struct phy *devm_phy_get(struct device *dev, const char *string);
+struct phy *devm_phy_optional_get(struct device *dev, const char *string);
 void phy_put(struct phy *phy);
 void devm_phy_put(struct device *dev, struct phy *phy);
 struct phy *of_phy_simple_xlate(struct device *dev,
@@ -232,11 +234,23 @@ static inline struct phy *phy_get(struct device *dev, const char *string)
         return ERR_PTR(-ENOSYS);
 }
 
+static inline struct phy *phy_optional_get(struct device *dev,
+                                           const char *string)
+{
+        return ERR_PTR(-ENOSYS);
+}
+
 static inline struct phy *devm_phy_get(struct device *dev, const char *string)
 {
         return ERR_PTR(-ENOSYS);
 }
 
+static inline struct phy *devm_phy_optional_get(struct device *dev,
+                                                const char *string)
+{
+        return ERR_PTR(-ENOSYS);
+}
+
 static inline void phy_put(struct phy *phy)
 {
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index f589c9af8cbf..3ebbbe7b6d05 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2916,5 +2916,22 @@ static inline bool skb_head_is_locked(const struct sk_buff *skb)
 {
         return !skb->head_frag || skb_cloned(skb);
 }
+
+/**
+ * skb_gso_network_seglen - Return length of individual segments of a gso packet
+ *
+ * @skb: GSO skb
+ *
+ * skb_gso_network_seglen is used to determine the real size of the
+ * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP).
+ *
+ * The MAC/L2 header is not accounted for.
+ */
+static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) -
+                               skb_network_header(skb);
+        return hdr_len + skb_gso_transport_seglen(skb);
+}
 #endif  /* __KERNEL__ */
 #endif  /* _LINUX_SKBUFF_H */
diff --git a/include/linux/smp.h b/include/linux/smp.h
index 3834f43f9993..6ae004e437ea 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -188,6 +188,9 @@ static inline void kick_all_cpus_sync(void) {  }
  */
 extern void arch_disable_smp_support(void);
 
+extern void arch_enable_nonboot_cpus_begin(void);
+extern void arch_enable_nonboot_cpus_end(void);
+
 void smp_setup_processor_id(void);
 
 #endif /* __LINUX_SMP_H */
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index a1d4ca290862..4203c66d8803 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -273,7 +273,7 @@ static inline void spi_unregister_driver(struct spi_driver *sdrv)
  *      message while queuing transfers that arrive in the meantime. When the
  *      driver is finished with this message, it must call
  *      spi_finalize_current_message() so the subsystem can issue the next
- *      transfer
+ *      message
  * @unprepare_transfer_hardware: there are currently no more messages on the
  *      queue so the subsystem notifies the driver that it may relax the
  *      hardware by issuing this call
@@ -287,7 +287,10 @@ static inline void spi_unregister_driver(struct spi_driver *sdrv)
  *                  - return 1 if the transfer is still in progress. When
  *                    the driver is finished with this transfer it must
  *                    call spi_finalize_current_transfer() so the subsystem
- *                    can issue the next transfer
+ *                    can issue the next transfer. Note: transfer_one and
+ *                    transfer_one_message are mutually exclusive; when both
+ *                    are set, the generic subsystem does not call your
+ *                    transfer_one callback.
  * @unprepare_message: undo any work done by prepare_message().
  * @cs_gpios: Array of GPIOs to use as chip select lines; one per CS
  *      number. Any individual value may be -ENOENT for CS lines that
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 40ed9e9a77e5..a747a77ea584 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -281,13 +281,15 @@ asmlinkage long sys_sched_setscheduler(pid_t pid, int policy,
 asmlinkage long sys_sched_setparam(pid_t pid,
                                         struct sched_param __user *param);
 asmlinkage long sys_sched_setattr(pid_t pid,
-                                        struct sched_attr __user *attr);
+                                        struct sched_attr __user *attr,
+                                        unsigned int flags);
 asmlinkage long sys_sched_getscheduler(pid_t pid);
 asmlinkage long sys_sched_getparam(pid_t pid,
                                         struct sched_param __user *param);
 asmlinkage long sys_sched_getattr(pid_t pid,
                                         struct sched_attr __user *attr,
-                                        unsigned int size);
+                                        unsigned int size,
+                                        unsigned int flags);
 asmlinkage long sys_sched_setaffinity(pid_t pid, unsigned int len,
                                         unsigned long __user *user_mask_ptr);
 asmlinkage long sys_sched_getaffinity(pid_t pid, unsigned int len,
diff --git a/include/linux/usb.h b/include/linux/usb.h
index c716da18c668..7f6eb859873e 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1265,8 +1265,6 @@ typedef void (*usb_complete_t)(struct urb *);
  * @sg: scatter gather buffer list, the buffer size of each element in
  *      the list (except the last) must be divisible by the endpoint's
  *      max packet size if no_sg_constraint isn't set in 'struct usb_bus'
- *      (FIXME: scatter-gather under xHCI is broken for periodic transfers.
- *      Do not use urb->sg for interrupt endpoints for now, only bulk.)
  * @num_mapped_sgs: (internal) number of mapped sg entries
  * @num_sgs: number of entries in the sg list
  * @transfer_buffer_length: How big is transfer_buffer.  The transfer may
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 594521ba0d43..704f4f652d0a 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -419,10 +419,7 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active,
         static struct lock_class_key __key;                             \
         const char *__lock_name;                                        \
                                                                         \
-        if (__builtin_constant_p(fmt))                                  \
-                __lock_name = (fmt);                                    \
-        else                                                            \
-                __lock_name = #fmt;                                     \
+        __lock_name = #fmt#args;                                        \
                                                                         \
         __alloc_workqueue_key((fmt), (flags), (max_active),             \
                               &__key, __lock_name, ##args);             \
diff --git a/include/net/datalink.h b/include/net/datalink.h
index deb7ca75db48..93cb18f729b5 100644
--- a/include/net/datalink.h
+++ b/include/net/datalink.h
@@ -15,4 +15,6 @@ struct datalink_proto {
         struct list_head node;
 };
 
+struct datalink_proto *make_EII_client(void);
+void destroy_EII_client(struct datalink_proto *dl);
 #endif
diff --git a/include/net/dn.h b/include/net/dn.h
index ccc15588d108..913b73d239f5 100644
--- a/include/net/dn.h
+++ b/include/net/dn.h
@@ -200,6 +200,8 @@ static inline void dn_sk_ports_copy(struct flowidn *fld, struct dn_scp *scp)
 }
 
 unsigned int dn_mss_from_pmtu(struct net_device *dev, int mtu);
+void dn_register_sysctl(void);
+void dn_unregister_sysctl(void);
 
 #define DN_MENUVER_ACC 0x01
 #define DN_MENUVER_USR 0x02
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index b409ad6b8d7a..55df9939bca2 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -20,6 +20,8 @@ int dn_route_output_sock(struct dst_entry __rcu **pprt, struct flowidn *,
                          struct sock *sk, int flags);
 int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb);
 void dn_rt_cache_flush(int delay);
+int dn_route_rcv(struct sk_buff *skb, struct net_device *dev,
+                 struct packet_type *pt, struct net_device *orig_dev);
 
 /* Masks for flags field */
 #define DN_RT_F_PID 0x07 /* Mask for packet type                      */
diff --git a/include/net/ethoc.h b/include/net/ethoc.h
index 96f3789b27bc..2a2d6bb34eb8 100644
--- a/include/net/ethoc.h
+++ b/include/net/ethoc.h
@@ -16,6 +16,7 @@
 struct ethoc_platform_data {
         u8 hwaddr[IFHWADDRLEN];
         s8 phy_id;
+        u32 eth_clkfreq;
 };
 
 #endif /* !LINUX_NET_ETHOC_H */
diff --git a/include/net/ipx.h b/include/net/ipx.h
index 9e9e35465baf..0143180fecc9 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -140,6 +140,17 @@ static __inline__ void ipxitf_hold(struct ipx_interface *intrfc)
 }
 
 void ipxitf_down(struct ipx_interface *intrfc);
+struct ipx_interface *ipxitf_find_using_net(__be32 net);
+int ipxitf_send(struct ipx_interface *intrfc, struct sk_buff *skb, char *node);
+__be16 ipx_cksum(struct ipxhdr *packet, int length);
+int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
+                     unsigned char *node);
+void ipxrtr_del_routes(struct ipx_interface *intrfc);
+int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
+                        struct iovec *iov, size_t len, int noblock);
+int ipxrtr_route_skb(struct sk_buff *skb);
+struct ipx_route *ipxrtr_lookup(__be32 net);
+int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
 
 static __inline__ void ipxitf_put(struct ipx_interface *intrfc)
 {
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index da68c9a90ac5..991dcd94cbbf 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -162,6 +162,14 @@ extern struct list_head net_namespace_list;
 struct net *get_net_ns_by_pid(pid_t pid);
 struct net *get_net_ns_by_fd(int pid);
 
+#ifdef CONFIG_SYSCTL
+void ipx_register_sysctl(void);
+void ipx_unregister_sysctl(void);
+#else
+#define ipx_register_sysctl()
+#define ipx_unregister_sysctl()
+#endif
+
 #ifdef CONFIG_NET_NS
 void __put_net(struct net *net);
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 01ea6eed1bb1..b2ac6246b7e0 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -284,6 +284,8 @@ extern unsigned int nf_conntrack_max;
 extern unsigned int nf_conntrack_hash_rnd;
 void init_nf_conntrack_hash_rnd(void);
 
+void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl);
+
 #define NF_CT_STAT_INC(net, count)        __this_cpu_inc((net)->ct.stat->count)
 #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)
 
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 57c8ff7955df..e7e14ffe0f6a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -252,6 +252,7 @@ void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
  *      @owner: module reference
  *      @policy: netlink attribute policy
  *      @maxattr: highest netlink attribute number
+ *      @family: address family for AF-specific types
  */
 struct nft_expr_type {
         const struct nft_expr_ops       *(*select_ops)(const struct nft_ctx *,
@@ -262,6 +263,7 @@ struct nft_expr_type {
         struct module                   *owner;
         const struct nla_policy         *policy;
         unsigned int                    maxattr;
+        u8                              family;
 };
 
 /**
@@ -320,7 +322,6 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
  *      struct nft_rule - nf_tables rule
  *
  *      @list: used internally
- *      @rcu_head: used internally for rcu
  *      @handle: rule handle
  *      @genmask: generation mask
  *      @dlen: length of expression data
@@ -328,7 +329,6 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
  */
 struct nft_rule {
         struct list_head                list;
-        struct rcu_head                 rcu_head;
         u64                             handle:46,
                                         genmask:2,
                                         dlen:16;
@@ -389,7 +389,6 @@ enum nft_chain_flags {
  *
  *      @rules: list of rules in the chain
  *      @list: used internally
- *      @rcu_head: used internally
  *      @net: net namespace that this chain belongs to
  *      @table: table that this chain belongs to
  *      @handle: chain handle
@@ -401,7 +400,6 @@ enum nft_chain_flags {
 struct nft_chain {
         struct list_head                rules;
         struct list_head                list;
-        struct rcu_head                 rcu_head;
         struct net                      *net;
         struct nft_table                *table;
         u64                             handle;
@@ -529,6 +527,9 @@ void nft_unregister_expr(struct nft_expr_type *);
 #define MODULE_ALIAS_NFT_CHAIN(family, name) \
         MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
 
+#define MODULE_ALIAS_NFT_AF_EXPR(family, name) \
+        MODULE_ALIAS("nft-expr-" __stringify(family) "-" name)
+
 #define MODULE_ALIAS_NFT_EXPR(name) \
         MODULE_ALIAS("nft-expr-" name)
 
diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h
new file mode 100644
index 000000000000..36b0da2d55bb
--- /dev/null
+++ b/include/net/netfilter/nft_reject.h
@@ -0,0 +1,25 @@
+#ifndef _NFT_REJECT_H_
+#define _NFT_REJECT_H_
+
+struct nft_reject {
+        enum nft_reject_types   type:8;
+        u8                      icmp_code;
+};
+
+extern const struct nla_policy nft_reject_policy[];
+
+int nft_reject_init(const struct nft_ctx *ctx,
+                    const struct nft_expr *expr,
+                    const struct nlattr * const tb[]);
+
+int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr);
+
+void nft_reject_ipv4_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt);
+
+void nft_reject_ipv6_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt);
+
+#endif
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index d992ca3145fe..6ee76c804893 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1653,17 +1653,6 @@ struct sctp_association {
         /* This is the last advertised value of rwnd over a SACK chunk. */
         __u32 a_rwnd;
 
-        /* Number of bytes by which the rwnd has slopped.  The rwnd is allowed
-         * to slop over a maximum of the association's frag_point.
-         */
-        __u32 rwnd_over;
-
-        /* Keeps treack of rwnd pressure.  This happens when we have
-         * a window, but not recevie buffer (i.e small packets).  This one
-         * is releases slowly (1 PMTU at a time ).
-         */
-        __u32 rwnd_press;
-
         /* This is the sndbuf size in use for the association.
          * This corresponds to the sndbuf size for the association,
          * as specified in the sk->sndbuf.
@@ -1892,8 +1881,7 @@ void sctp_assoc_update(struct sctp_association *old,
 __u32 sctp_association_get_next_tsn(struct sctp_association *);
 
 void sctp_assoc_sync_pmtu(struct sock *, struct sctp_association *);
-void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
-void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
+void sctp_assoc_rwnd_update(struct sctp_association *, bool);
 void sctp_assoc_set_primary(struct sctp_association *,
                             struct sctp_transport *);
 void sctp_assoc_del_nonprimary_peers(struct sctp_association *,
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 8d4a1c06f7e4..6793f32ccb58 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -226,7 +226,8 @@ enum ib_port_cap_flags {
         IB_PORT_CAP_MASK_NOTICE_SUP             = 1 << 22,
         IB_PORT_BOOT_MGMT_SUP                   = 1 << 23,
         IB_PORT_LINK_LATENCY_SUP                = 1 << 24,
-        IB_PORT_CLIENT_REG_SUP                  = 1 << 25
+        IB_PORT_CLIENT_REG_SUP                  = 1 << 25,
+        IB_PORT_IP_BASED_GIDS                   = 1 << 26
 };
 
 enum ib_port_width {
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index c9c791209cd1..1772fadcff62 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -525,7 +525,6 @@ struct se_cmd {
 #define CMD_T_COMPLETE          (1 << 2)
 #define CMD_T_SENT              (1 << 4)
 #define CMD_T_STOP              (1 << 5)
-#define CMD_T_FAILED            (1 << 6)
 #define CMD_T_DEV_ACTIVE        (1 << 7)
 #define CMD_T_REQUEST_STOP      (1 << 8)
 #define CMD_T_BUSY              (1 << 9)
diff --git a/include/trace/events/power.h b/include/trace/events/power.h
index 9e9475c85de5..e5bf9a76f169 100644
--- a/include/trace/events/power.h
+++ b/include/trace/events/power.h
@@ -42,7 +42,6 @@ TRACE_EVENT(pstate_sample,
                 u32 state,
                 u64 mperf,
                 u64 aperf,
-                u32 energy,
                 u32 freq
                 ),
 
@@ -51,7 +50,6 @@ TRACE_EVENT(pstate_sample,
                 state,
                 mperf,
                 aperf,
-                energy,
                 freq
                 ),
 
@@ -61,7 +59,6 @@ TRACE_EVENT(pstate_sample,
                 __field(u32, state)
                 __field(u64, mperf)
                 __field(u64, aperf)
-                __field(u32, energy)
                 __field(u32, freq)
 
         ),
@@ -72,17 +69,15 @@ TRACE_EVENT(pstate_sample,
                 __entry->state = state;
                 __entry->mperf = mperf;
                 __entry->aperf = aperf;
-                __entry->energy = energy;
                 __entry->freq = freq;
                 ),
 
-        TP_printk("core_busy=%lu scaled=%lu state=%lu mperf=%llu aperf=%llu energy=%lu freq=%lu ",
+        TP_printk("core_busy=%lu scaled=%lu state=%lu mperf=%llu aperf=%llu freq=%lu ",
                 (unsigned long)__entry->core_busy,
                 (unsigned long)__entry->scaled_busy,
                 (unsigned long)__entry->state,
                 (unsigned long long)__entry->mperf,
                 (unsigned long long)__entry->aperf,
-                (unsigned long)__entry->energy,
                 (unsigned long)__entry->freq
                 )
 
diff --git a/include/uapi/drm/drm.h b/include/uapi/drm/drm.h
index 3c9a833992e8..b06c8ed68707 100644
--- a/include/uapi/drm/drm.h
+++ b/include/uapi/drm/drm.h
@@ -619,6 +619,8 @@ struct drm_gem_open {
 #define  DRM_PRIME_CAP_EXPORT           0x2
 #define DRM_CAP_TIMESTAMP_MONOTONIC     0x6
 #define DRM_CAP_ASYNC_PAGE_FLIP         0x7
+#define DRM_CAP_CURSOR_WIDTH            0x8
+#define DRM_CAP_CURSOR_HEIGHT           0x9
 
 /** DRM_IOCTL_GET_CAP ioctl argument type */
 struct drm_get_cap {
diff --git a/include/uapi/drm/vmwgfx_drm.h b/include/uapi/drm/vmwgfx_drm.h
index 9971c560ed9a..87792a5fee3b 100644
--- a/include/uapi/drm/vmwgfx_drm.h
+++ b/include/uapi/drm/vmwgfx_drm.h
@@ -87,6 +87,7 @@
 #define DRM_VMW_PARAM_MAX_SURF_MEMORY  7
 #define DRM_VMW_PARAM_3D_CAPS_SIZE     8
 #define DRM_VMW_PARAM_MAX_MOB_MEMORY   9
+#define DRM_VMW_PARAM_MAX_MOB_SIZE     10
 
 /**
  * struct drm_vmw_getparam_arg
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index 1b8a0f4c9590..b4d69092fbdb 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -558,7 +558,6 @@ static inline char *btrfs_err_str(enum btrfs_err_code err_code)
 #define BTRFS_IOC_DEFAULT_SUBVOL _IOW(BTRFS_IOCTL_MAGIC, 19, __u64)
 #define BTRFS_IOC_SPACE_INFO _IOWR(BTRFS_IOCTL_MAGIC, 20, \
                                     struct btrfs_ioctl_space_args)
-#define BTRFS_IOC_GLOBAL_RSV _IOR(BTRFS_IOCTL_MAGIC, 20, __u64)
 #define BTRFS_IOC_START_SYNC _IOR(BTRFS_IOCTL_MAGIC, 24, __u64)
 #define BTRFS_IOC_WAIT_SYNC  _IOW(BTRFS_IOCTL_MAGIC, 22, __u64)
 #define BTRFS_IOC_SNAP_CREATE_V2 _IOW(BTRFS_IOCTL_MAGIC, 23, \
diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
index 633b93cac1ed..e9a1d2d973b6 100644
--- a/include/uapi/linux/in6.h
+++ b/include/uapi/linux/in6.h
@@ -128,22 +128,13 @@ struct in6_flowlabel_req {
  *      IPV6 extension headers
  */
 #if __UAPI_DEF_IPPROTO_V6
-enum {
-  IPPROTO_HOPOPTS = 0,          /* IPv6 hop-by-hop options      */
-#define IPPROTO_HOPOPTS         IPPROTO_HOPOPTS
-  IPPROTO_ROUTING = 43,         /* IPv6 routing header          */
-#define IPPROTO_ROUTING         IPPROTO_ROUTING
-  IPPROTO_FRAGMENT = 44,        /* IPv6 fragmentation header    */
-#define IPPROTO_FRAGMENT        IPPROTO_FRAGMENT
-  IPPROTO_ICMPV6 = 58,          /* ICMPv6                       */
-#define IPPROTO_ICMPV6          IPPROTO_ICMPV6
-  IPPROTO_NONE = 59,            /* IPv6 no next header          */
-#define IPPROTO_NONE            IPPROTO_NONE
-  IPPROTO_DSTOPTS = 60,         /* IPv6 destination options     */
-#define IPPROTO_DSTOPTS         IPPROTO_DSTOPTS
-  IPPROTO_MH = 135,             /* IPv6 mobility header         */
-#define IPPROTO_MH              IPPROTO_MH
-};
+#define IPPROTO_HOPOPTS         0       /* IPv6 hop-by-hop options      */
+#define IPPROTO_ROUTING         43      /* IPv6 routing header          */
+#define IPPROTO_FRAGMENT        44      /* IPv6 fragmentation header    */
+#define IPPROTO_ICMPV6          58      /* ICMPv6                       */
+#define IPPROTO_NONE            59      /* IPv6 no next header          */
+#define IPPROTO_DSTOPTS         60      /* IPv6 destination options     */
+#define IPPROTO_MH              135     /* IPv6 mobility header         */
 #endif /* __UAPI_DEF_IPPROTO_V6 */
 
 /*
diff --git a/include/uapi/linux/mic_ioctl.h b/include/uapi/linux/mic_ioctl.h
index 7fabba5059cf..feb0b4c0814c 100644
--- a/include/uapi/linux/mic_ioctl.h
+++ b/include/uapi/linux/mic_ioctl.h
@@ -39,7 +39,7 @@ struct mic_copy_desc {
 #else
         struct iovec *iov;
 #endif
-        int iovcnt;
+        __u32 iovcnt;
         __u8 vr_idx;
         __u8 update_used;
         __u32 out_len;
diff --git a/include/uapi/xen/Kbuild b/include/uapi/xen/Kbuild
index 61257cb14653..5c459628e8c7 100644
--- a/include/uapi/xen/Kbuild
+++ b/include/uapi/xen/Kbuild
@@ -1,3 +1,5 @@
 # UAPI Header export list
 header-y += evtchn.h
+header-y += gntalloc.h
+header-y += gntdev.h
 header-y += privcmd.h
diff --git a/include/xen/gntalloc.h b/include/uapi/xen/gntalloc.h
index 76bd58065f4f..76bd58065f4f 100644
--- a/include/xen/gntalloc.h
+++ b/include/uapi/xen/gntalloc.h
diff --git a/include/xen/gntdev.h b/include/uapi/xen/gntdev.h
index 5304bd3c84c5..5304bd3c84c5 100644
--- a/include/xen/gntdev.h
+++ b/include/uapi/xen/gntdev.h
diff --git a/include/xen/interface/io/blkif.h b/include/xen/interface/io/blkif.h
index ae665ac59c36..32ec05a6572f 100644
--- a/include/xen/interface/io/blkif.h
+++ b/include/xen/interface/io/blkif.h
@@ -113,13 +113,13 @@ typedef uint64_t blkif_sector_t;
  * it's less than the number provided by the backend. The indirect_grefs field
  * in blkif_request_indirect should be filled by the frontend with the
  * grant references of the pages that are holding the indirect segments.
- * This pages are filled with an array of blkif_request_segment_aligned
- * that hold the information about the segments. The number of indirect
- * pages to use is determined by the maximum number of segments
- * a indirect request contains. Every indirect page can contain a maximum
- * of 512 segments (PAGE_SIZE/sizeof(blkif_request_segment_aligned)),
- * so to calculate the number of indirect pages to use we have to do
- * ceil(indirect_segments/512).
+ * These pages are filled with an array of blkif_request_segment that hold the
+ * information about the segments. The number of indirect pages to use is
+ * determined by the number of segments an indirect request contains. Every
+ * indirect page can contain a maximum of
+ * (PAGE_SIZE / sizeof(struct blkif_request_segment)) segments, so to
+ * calculate the number of indirect pages to use we have to do
+ * ceil(indirect_segments / (PAGE_SIZE / sizeof(struct blkif_request_segment))).
  *
  * If a backend does not recognize BLKIF_OP_INDIRECT, it should *not*
  * create the "feature-max-indirect-segments" node!
@@ -135,13 +135,12 @@ typedef uint64_t blkif_sector_t;
 
 #define BLKIF_MAX_INDIRECT_PAGES_PER_REQUEST 8
 
-struct blkif_request_segment_aligned {
-        grant_ref_t gref;        /* reference to I/O buffer frame        */
-        /* @first_sect: first sector in frame to transfer (inclusive).   */
-        /* @last_sect: last sector in frame to transfer (inclusive).     */
-        uint8_t     first_sect, last_sect;
-        uint16_t    _pad; /* padding to make it 8 bytes, so it's cache-aligned */
-} __attribute__((__packed__));
+struct blkif_request_segment {
+                grant_ref_t gref;        /* reference to I/O buffer frame        */
+                /* @first_sect: first sector in frame to transfer (inclusive).   */
+                /* @last_sect: last sector in frame to transfer (inclusive).     */
+                uint8_t     first_sect, last_sect;
+};
 
 struct blkif_request_rw {
         uint8_t        nr_segments;  /* number of segments                   */
@@ -151,12 +150,7 @@ struct blkif_request_rw {
 #endif
         uint64_t       id;           /* private guest value, echoed in resp  */
         blkif_sector_t sector_number;/* start sector idx on disk (r/w only)  */
-        struct blkif_request_segment {
-                grant_ref_t gref;        /* reference to I/O buffer frame        */
-                /* @first_sect: first sector in frame to transfer (inclusive).   */
-                /* @last_sect: last sector in frame to transfer (inclusive).     */
-                uint8_t     first_sect, last_sect;
-        } seg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
+        struct blkif_request_segment seg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
 } __attribute__((__packed__));
 
 struct blkif_request_discard {
diff --git a/include/xen/interface/xencomm.h b/include/xen/interface/xencomm.h
deleted file mode 100644
index ac45e0712afa..000000000000
--- a/include/xen/interface/xencomm.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to
- * deal in the Software without restriction, including without limitation the
- * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
- * sell copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Copyright (C) IBM Corp. 2006
- */
-
-#ifndef _XEN_XENCOMM_H_
-#define _XEN_XENCOMM_H_
-
-/* A xencomm descriptor is a scatter/gather list containing physical
- * addresses corresponding to a virtually contiguous memory area. The
- * hypervisor translates these physical addresses to machine addresses to copy
- * to and from the virtually contiguous area.
- */
-
-#define XENCOMM_MAGIC 0x58434F4D /* 'XCOM' */
-#define XENCOMM_INVALID (~0UL)
-
-struct xencomm_desc {
-    uint32_t magic;
-    uint32_t nr_addrs; /* the number of entries in address[] */
-    uint64_t address[0];
-};
-
-#endif /* _XEN_XENCOMM_H_ */
diff --git a/include/xen/xencomm.h b/include/xen/xencomm.h
deleted file mode 100644
index e43b039be112..000000000000
--- a/include/xen/xencomm.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
- *
- * Copyright (C) IBM Corp. 2006
- *
- * Authors: Hollis Blanchard <hollisb@us.ibm.com>
- *          Jerone Young <jyoung5@us.ibm.com>
- */
-
-#ifndef _LINUX_XENCOMM_H_
-#define _LINUX_XENCOMM_H_
-
-#include <xen/interface/xencomm.h>
-
-#define XENCOMM_MINI_ADDRS 3
-struct xencomm_mini {
-        struct xencomm_desc _desc;
-        uint64_t address[XENCOMM_MINI_ADDRS];
-};
-
-/* To avoid additionnal virt to phys conversion, an opaque structure is
-   presented.  */
-struct xencomm_handle;
-
-extern void xencomm_free(struct xencomm_handle *desc);
-extern struct xencomm_handle *xencomm_map(void *ptr, unsigned long bytes);
-extern struct xencomm_handle *__xencomm_map_no_alloc(void *ptr,
-                        unsigned long bytes,  struct xencomm_mini *xc_area);
-
-#if 0
-#define XENCOMM_MINI_ALIGNED(xc_desc, n)                                \
-        struct xencomm_mini xc_desc ## _base[(n)]                       \
-        __attribute__((__aligned__(sizeof(struct xencomm_mini))));      \
-        struct xencomm_mini *xc_desc = &xc_desc ## _base[0];
-#else
-/*
- * gcc bug workaround:
- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=16660
- * gcc doesn't handle properly stack variable with
- * __attribute__((__align__(sizeof(struct xencomm_mini))))
- */
-#define XENCOMM_MINI_ALIGNED(xc_desc, n)                                \
-        unsigned char xc_desc ## _base[((n) + 1 ) *                     \
-                                       sizeof(struct xencomm_mini)];    \
-        struct xencomm_mini *xc_desc = (struct xencomm_mini *)          \
-                ((unsigned long)xc_desc ## _base +                      \
-                 (sizeof(struct xencomm_mini) -                         \
-                  ((unsigned long)xc_desc ## _base) %                   \
-                  sizeof(struct xencomm_mini)));
-#endif
-#define xencomm_map_no_alloc(ptr, bytes)                        \
-        ({ XENCOMM_MINI_ALIGNED(xc_desc, 1);                    \
-                __xencomm_map_no_alloc(ptr, bytes, xc_desc); })
-
-/* provided by architecture code: */
-extern unsigned long xencomm_vtop(unsigned long vaddr);
-
-static inline void *xencomm_pa(void *ptr)
-{
-        return (void *)xencomm_vtop((unsigned long)ptr);
-}
-
-#define xen_guest_handle(hnd)  ((hnd).p)
-
-#endif /* _LINUX_XENCOMM_H_ */
diff --git a/ipc/mq_sysctl.c b/ipc/mq_sysctl.c
index 383d638340b8..5bb8bfe67149 100644
--- a/ipc/mq_sysctl.c
+++ b/ipc/mq_sysctl.c
@@ -22,6 +22,16 @@ static void *get_mq(ctl_table *table)
         return which;
 }
 
+static int proc_mq_dointvec(ctl_table *table, int write,
+                            void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        struct ctl_table mq_table;
+        memcpy(&mq_table, table, sizeof(mq_table));
+        mq_table.data = get_mq(table);
+
+        return proc_dointvec(&mq_table, write, buffer, lenp, ppos);
+}
+
 static int proc_mq_dointvec_minmax(ctl_table *table, int write,
         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -33,12 +43,10 @@ static int proc_mq_dointvec_minmax(ctl_table *table, int write,
                                         lenp, ppos);
 }
 #else
+#define proc_mq_dointvec NULL
 #define proc_mq_dointvec_minmax NULL
 #endif
 
-static int msg_queues_limit_min = MIN_QUEUESMAX;
-static int msg_queues_limit_max = HARD_QUEUESMAX;
-
 static int msg_max_limit_min = MIN_MSGMAX;
 static int msg_max_limit_max = HARD_MSGMAX;
 
@@ -51,9 +59,7 @@ static ctl_table mq_sysctls[] = {
                 .data           = &init_ipc_ns.mq_queues_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_mq_dointvec_minmax,
-                .extra1         = &msg_queues_limit_min,
-                .extra2         = &msg_queues_limit_max,
+                .proc_handler   = proc_mq_dointvec,
         },
         {
                 .procname       = "msg_max",
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index ccf1f9fd263a..c3b31179122c 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -433,9 +433,9 @@ static int mqueue_create(struct inode *dir, struct dentry *dentry,
                 error = -EACCES;
                 goto out_unlock;
         }
-        if (ipc_ns->mq_queues_count >= HARD_QUEUESMAX ||
-            (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
-             !capable(CAP_SYS_RESOURCE))) {
+
+        if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
+            !capable(CAP_SYS_RESOURCE)) {
                 error = -ENOSPC;
                 goto out_unlock;
         }
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index e2f46ba37f72..105f273b6f86 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -886,7 +886,9 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                  * per-subsystem and moved to css->id so that lookups are
                  * successful until the target css is released.
                  */
+                mutex_lock(&cgroup_mutex);
                 idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+                mutex_unlock(&cgroup_mutex);
                 cgrp->id = -1;
 
                 call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
@@ -1566,10 +1568,10 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                 mutex_lock(&cgroup_mutex);
                 mutex_lock(&cgroup_root_mutex);
 
-                root_cgrp->id = idr_alloc(&root->cgroup_idr, root_cgrp,
-                                           0, 1, GFP_KERNEL);
-                if (root_cgrp->id < 0)
+                ret = idr_alloc(&root->cgroup_idr, root_cgrp, 0, 1, GFP_KERNEL);
+                if (ret < 0)
                         goto unlock_drop;
+                root_cgrp->id = ret;
 
                 /* Check for name clashes with existing mounts */
                 ret = -EBUSY;
@@ -2763,10 +2765,7 @@ static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
          */
         update_before = cgroup_serial_nr_next;
 
-        mutex_unlock(&cgroup_mutex);
-
         /* add/rm files for all cgroups created before */
-        rcu_read_lock();
         css_for_each_descendant_pre(css, cgroup_css(root, ss)) {
                 struct cgroup *cgrp = css->cgroup;
 
@@ -2775,23 +2774,19 @@ static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
 
                 inode = cgrp->dentry->d_inode;
                 dget(cgrp->dentry);
-                rcu_read_unlock();
-
                 dput(prev);
                 prev = cgrp->dentry;
 
+                mutex_unlock(&cgroup_mutex);
                 mutex_lock(&inode->i_mutex);
                 mutex_lock(&cgroup_mutex);
                 if (cgrp->serial_nr < update_before && !cgroup_is_dead(cgrp))
                         ret = cgroup_addrm_files(cgrp, cfts, is_add);
-                mutex_unlock(&cgroup_mutex);
                 mutex_unlock(&inode->i_mutex);
-
-                rcu_read_lock();
                 if (ret)
                         break;
         }
-        rcu_read_unlock();
+        mutex_unlock(&cgroup_mutex);
         dput(prev);
         deactivate_super(sb);
         return ret;
@@ -2910,9 +2905,14 @@ static void cgroup_enable_task_cg_lists(void)
                  * We should check if the process is exiting, otherwise
                  * it will race with cgroup_exit() in that the list
                  * entry won't be deleted though the process has exited.
+                 * Do it while holding siglock so that we don't end up
+                 * racing against cgroup_exit().
                  */
+                spin_lock_irq(&p->sighand->siglock);
                 if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
                         list_add(&p->cg_list, &task_css_set(p)->tasks);
+                spin_unlock_irq(&p->sighand->siglock);
+
                 task_unlock(p);
         } while_each_thread(g, p);
         read_unlock(&tasklist_lock);
@@ -4158,7 +4158,7 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         struct cgroup *cgrp;
         struct cgroup_name *name;
         struct cgroupfs_root *root = parent->root;
-        int ssid, err = 0;
+        int ssid, err;
         struct cgroup_subsys *ss;
         struct super_block *sb = root->sb;
 
@@ -4168,19 +4168,13 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                 return -ENOMEM;
 
         name = cgroup_alloc_name(dentry);
-        if (!name)
+        if (!name) {
+                err = -ENOMEM;
                 goto err_free_cgrp;
+        }
         rcu_assign_pointer(cgrp->name, name);
 
         /*
-         * Temporarily set the pointer to NULL, so idr_find() won't return
-         * a half-baked cgroup.
-         */
-        cgrp->id = idr_alloc(&root->cgroup_idr, NULL, 1, 0, GFP_KERNEL);
-        if (cgrp->id < 0)
-                goto err_free_name;
-
-        /*
          * Only live parents can have children.  Note that the liveliness
          * check isn't strictly necessary because cgroup_mkdir() and
          * cgroup_rmdir() are fully synchronized by i_mutex; however, do it
@@ -4189,7 +4183,17 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         if (!cgroup_lock_live_group(parent)) {
                 err = -ENODEV;
-                goto err_free_id;
+                goto err_free_name;
+        }
+
+        /*
+         * Temporarily set the pointer to NULL, so idr_find() won't return
+         * a half-baked cgroup.
+         */
+        cgrp->id = idr_alloc(&root->cgroup_idr, NULL, 1, 0, GFP_KERNEL);
+        if (cgrp->id < 0) {
+                err = -ENOMEM;
+                goto err_unlock;
         }
 
         /* Grab a reference on the superblock so the hierarchy doesn't
@@ -4221,7 +4225,7 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         err = cgroup_create_file(dentry, S_IFDIR | mode, sb);
         if (err < 0)
-                goto err_unlock;
+                goto err_free_id;
         lockdep_assert_held(&dentry->d_inode->i_mutex);
 
         cgrp->serial_nr = cgroup_serial_nr_next++;
@@ -4257,12 +4261,12 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
 
         return 0;
 
-err_unlock:
-        mutex_unlock(&cgroup_mutex);
-        /* Release the reference count that we took on the superblock */
-        deactivate_super(sb);
 err_free_id:
         idr_remove(&root->cgroup_idr, cgrp->id);
+        /* Release the reference count that we took on the superblock */
+        deactivate_super(sb);
+err_unlock:
+        mutex_unlock(&cgroup_mutex);
 err_free_name:
         kfree(rcu_dereference_raw(cgrp->name));
 err_free_cgrp:
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 45e5543e2a1e..fa990061aa6c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7875,14 +7875,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu)
 static void __perf_event_exit_context(void *__info)
 {
         struct perf_event_context *ctx = __info;
-        struct perf_event *event, *tmp;
+        struct perf_event *event;
 
         perf_pmu_rotate_stop(ctx->pmu);
 
-        list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry)
-                __perf_remove_from_context(event);
-        list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry)
+        rcu_read_lock();
+        list_for_each_entry_rcu(event, &ctx->event_list, event_entry)
                 __perf_remove_from_context(event);
+        rcu_read_unlock();
 }
 
 static void perf_event_exit_cpu_context(int cpu)
@@ -7906,11 +7906,11 @@ static void perf_event_exit_cpu(int cpu)
 {
         struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 
+        perf_event_exit_cpu_context(cpu);
+
         mutex_lock(&swhash->hlist_mutex);
         swevent_hlist_release(swhash);
         mutex_unlock(&swhash->hlist_mutex);
-
-        perf_event_exit_cpu_context(cpu);
 }
 #else
 static inline void perf_event_exit_cpu(int cpu) { }
diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
index bd8e788d71e0..1ef0606797c9 100644
--- a/kernel/irq/devres.c
+++ b/kernel/irq/devres.c
@@ -73,6 +73,51 @@ int devm_request_threaded_irq(struct device *dev, unsigned int irq,
 EXPORT_SYMBOL(devm_request_threaded_irq);
 
 /**
+ *      devm_request_any_context_irq - allocate an interrupt line for a managed device
+ *      @dev: device to request interrupt for
+ *      @irq: Interrupt line to allocate
+ *      @handler: Function to be called when the IRQ occurs
+ *      @thread_fn: function to be called in a threaded interrupt context. NULL
+ *                  for devices which handle everything in @handler
+ *      @irqflags: Interrupt type flags
+ *      @devname: An ascii name for the claiming device
+ *      @dev_id: A cookie passed back to the handler function
+ *
+ *      Except for the extra @dev argument, this function takes the
+ *      same arguments and performs the same function as
+ *      request_any_context_irq().  IRQs requested with this function will be
+ *      automatically freed on driver detach.
+ *
+ *      If an IRQ allocated with this function needs to be freed
+ *      separately, devm_free_irq() must be used.
+ */
+int devm_request_any_context_irq(struct device *dev, unsigned int irq,
+                              irq_handler_t handler, unsigned long irqflags,
+                              const char *devname, void *dev_id)
+{
+        struct irq_devres *dr;
+        int rc;
+
+        dr = devres_alloc(devm_irq_release, sizeof(struct irq_devres),
+                          GFP_KERNEL);
+        if (!dr)
+                return -ENOMEM;
+
+        rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
+        if (rc) {
+                devres_free(dr);
+                return rc;
+        }
+
+        dr->irq = irq;
+        dr->dev_id = dev_id;
+        devres_add(dev, dr);
+
+        return 0;
+}
+EXPORT_SYMBOL(devm_request_any_context_irq);
+
+/**
  *      devm_free_irq - free an interrupt
  *      @dev: device to free interrupt for
  *      @irq: Interrupt line to free
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 192a302d6cfd..8ab8e9390297 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -274,6 +274,7 @@ struct irq_desc *irq_to_desc(unsigned int irq)
 {
         return (irq < NR_IRQS) ? irq_desc + irq : NULL;
 }
+EXPORT_SYMBOL(irq_to_desc);
 
 static void free_desc(unsigned int irq)
 {
diff --git a/kernel/power/console.c b/kernel/power/console.c
index eacb8bd8cab4..aba9c545a0e3 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -9,6 +9,7 @@
 #include <linux/kbd_kern.h>
 #include <linux/vt.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include "power.h"
 
 #define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index b1d255f04135..4dae9cbe9259 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1076,7 +1076,6 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 next_seq = log_next_seq;
 
                 len = 0;
-                prev = 0;
                 while (len >= 0 && seq < next_seq) {
                         struct printk_log *msg = log_from_idx(idx);
                         int textlen;
@@ -2788,7 +2787,6 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         next_idx = idx;
 
         l = 0;
-        prev = 0;
         while (seq < dumper->next_seq) {
                 struct printk_log *msg = log_from_idx(idx);
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b46131ef6aab..6edbef296ece 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1952,7 +1952,7 @@ static int dl_overflow(struct task_struct *p, int policy,
 {
 
         struct dl_bw *dl_b = dl_bw_of(task_cpu(p));
-        u64 period = attr->sched_period;
+        u64 period = attr->sched_period ?: attr->sched_deadline;
         u64 runtime = attr->sched_runtime;
         u64 new_bw = dl_policy(policy) ? to_ratio(period, runtime) : 0;
         int cpus, err = -1;
@@ -3661,13 +3661,14 @@ SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
  * @pid: the pid in question.
  * @uattr: structure containing the extended parameters.
  */
-SYSCALL_DEFINE2(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr)
+SYSCALL_DEFINE3(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr,
+                               unsigned int, flags)
 {
         struct sched_attr attr;
         struct task_struct *p;
         int retval;
 
-        if (!uattr || pid < 0)
+        if (!uattr || pid < 0 || flags)
                 return -EINVAL;
 
         if (sched_copy_attr(uattr, &attr))
@@ -3786,7 +3787,7 @@ static int sched_read_attr(struct sched_attr __user *uattr,
                 attr->size = usize;
         }
 
-        ret = copy_to_user(uattr, attr, usize);
+        ret = copy_to_user(uattr, attr, attr->size);
         if (ret)
                 return -EFAULT;
 
@@ -3804,8 +3805,8 @@ err_size:
  * @uattr: structure containing the extended parameters.
  * @size: sizeof(attr) for fwd/bwd comp.
  */
-SYSCALL_DEFINE3(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
-                unsigned int, size)
+SYSCALL_DEFINE4(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
+                unsigned int, size, unsigned int, flags)
 {
         struct sched_attr attr = {
                 .size = sizeof(struct sched_attr),
@@ -3814,7 +3815,7 @@ SYSCALL_DEFINE3(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
         int retval;
 
         if (!uattr || pid < 0 || size > PAGE_SIZE ||
-            size < SCHED_ATTR_SIZE_VER0)
+            size < SCHED_ATTR_SIZE_VER0 || flags)
                 return -EINVAL;
 
         rcu_read_lock();
@@ -7422,6 +7423,7 @@ static int sched_dl_global_constraints(void)
         u64 period = global_rt_period();
         u64 new_bw = to_ratio(period, runtime);
         int cpu, ret = 0;
+        unsigned long flags;
 
         /*
          * Here we want to check the bandwidth not being set to some
@@ -7435,10 +7437,10 @@ static int sched_dl_global_constraints(void)
         for_each_possible_cpu(cpu) {
                 struct dl_bw *dl_b = dl_bw_of(cpu);
 
-                raw_spin_lock(&dl_b->lock);
+                raw_spin_lock_irqsave(&dl_b->lock, flags);
                 if (new_bw < dl_b->total_bw)
                         ret = -EBUSY;
-                raw_spin_unlock(&dl_b->lock);
+                raw_spin_unlock_irqrestore(&dl_b->lock, flags);
 
                 if (ret)
                         break;
@@ -7451,6 +7453,7 @@ static void sched_dl_do_global(void)
 {
         u64 new_bw = -1;
         int cpu;
+        unsigned long flags;
 
         def_dl_bandwidth.dl_period = global_rt_period();
         def_dl_bandwidth.dl_runtime = global_rt_runtime();
@@ -7464,9 +7467,9 @@ static void sched_dl_do_global(void)
         for_each_possible_cpu(cpu) {
                 struct dl_bw *dl_b = dl_bw_of(cpu);
 
-                raw_spin_lock(&dl_b->lock);
+                raw_spin_lock_irqsave(&dl_b->lock, flags);
                 dl_b->bw = new_bw;
-                raw_spin_unlock(&dl_b->lock);
+                raw_spin_unlock_irqrestore(&dl_b->lock, flags);
         }
 }
 
@@ -7475,7 +7478,8 @@ static int sched_rt_global_validate(void)
         if (sysctl_sched_rt_period <= 0)
                 return -EINVAL;
 
-        if (sysctl_sched_rt_runtime > sysctl_sched_rt_period)
+        if ((sysctl_sched_rt_runtime != RUNTIME_INF) &&
+                (sysctl_sched_rt_runtime > sysctl_sched_rt_period))
                 return -EINVAL;
 
         return 0;
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index 045fc74e3f09..5b8838b56d1c 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -70,7 +70,7 @@ static void cpudl_heapify(struct cpudl *cp, int idx)
 
 static void cpudl_change_key(struct cpudl *cp, int idx, u64 new_dl)
 {
-        WARN_ON(idx > num_present_cpus() || idx == IDX_INVALID);
+        WARN_ON(!cpu_present(idx) || idx == IDX_INVALID);
 
         if (dl_time_before(new_dl, cp->elements[idx].dl)) {
                 cp->elements[idx].dl = new_dl;
@@ -117,7 +117,7 @@ int cpudl_find(struct cpudl *cp, struct task_struct *p,
         }
 
 out:
-        WARN_ON(best_cpu > num_present_cpus() && best_cpu != -1);
+        WARN_ON(!cpu_present(best_cpu) && best_cpu != -1);
 
         return best_cpu;
 }
@@ -137,7 +137,7 @@ void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid)
         int old_idx, new_cpu;
         unsigned long flags;
 
-        WARN_ON(cpu > num_present_cpus());
+        WARN_ON(!cpu_present(cpu));
 
         raw_spin_lock_irqsave(&cp->lock, flags);
         old_idx = cp->cpu_to_idx[cpu];
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 0dd5e0971a07..15cbc17fbf84 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -121,7 +121,7 @@ static inline void dl_clear_overload(struct rq *rq)
 
 static void update_dl_migration(struct dl_rq *dl_rq)
 {
-        if (dl_rq->dl_nr_migratory && dl_rq->dl_nr_total > 1) {
+        if (dl_rq->dl_nr_migratory && dl_rq->dl_nr_running > 1) {
                 if (!dl_rq->overloaded) {
                         dl_set_overload(rq_of_dl_rq(dl_rq));
                         dl_rq->overloaded = 1;
@@ -137,7 +137,6 @@ static void inc_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
         struct task_struct *p = dl_task_of(dl_se);
         dl_rq = &rq_of_dl_rq(dl_rq)->dl;
 
-        dl_rq->dl_nr_total++;
         if (p->nr_cpus_allowed > 1)
                 dl_rq->dl_nr_migratory++;
 
@@ -149,7 +148,6 @@ static void dec_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
         struct task_struct *p = dl_task_of(dl_se);
         dl_rq = &rq_of_dl_rq(dl_rq)->dl;
 
-        dl_rq->dl_nr_total--;
         if (p->nr_cpus_allowed > 1)
                 dl_rq->dl_nr_migratory--;
 
@@ -717,6 +715,7 @@ void inc_dl_tasks(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 
         WARN_ON(!dl_prio(prio));
         dl_rq->dl_nr_running++;
+        inc_nr_running(rq_of_dl_rq(dl_rq));
 
         inc_dl_deadline(dl_rq, deadline);
         inc_dl_migration(dl_se, dl_rq);
@@ -730,6 +729,7 @@ void dec_dl_tasks(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
         WARN_ON(!dl_prio(prio));
         WARN_ON(!dl_rq->dl_nr_running);
         dl_rq->dl_nr_running--;
+        dec_nr_running(rq_of_dl_rq(dl_rq));
 
         dec_dl_deadline(dl_rq, dl_se->deadline);
         dec_dl_migration(dl_se, dl_rq);
@@ -836,8 +836,6 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
 
         if (!task_current(rq, p) && p->nr_cpus_allowed > 1)
                 enqueue_pushable_dl_task(rq, p);
-
-        inc_nr_running(rq);
 }
 
 static void __dequeue_task_dl(struct rq *rq, struct task_struct *p, int flags)
@@ -850,8 +848,6 @@ static void dequeue_task_dl(struct rq *rq, struct task_struct *p, int flags)
 {
         update_curr_dl(rq);
         __dequeue_task_dl(rq, p, flags);
-
-        dec_nr_running(rq);
 }
 
 /*
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 966cc2bfcb77..78157099b167 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1757,6 +1757,8 @@ void task_numa_work(struct callback_head *work)
                         start = end;
                         if (pages <= 0)
                                 goto out;
+
+                        cond_resched();
                 } while (end != vma->vm_end);
         }
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index c2119fd20f8b..f964add50f38 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -462,7 +462,6 @@ struct dl_rq {
         } earliest_dl;
 
         unsigned long dl_nr_migratory;
-        unsigned long dl_nr_total;
         int overloaded;
 
         /*
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index 7a925ba456fb..a6a5bf53e86d 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -51,7 +51,13 @@
  * HZ shrinks, so values greater than 8 overflow 32bits when
  * HZ=100.
  */
+#if HZ < 34
+#define JIFFIES_SHIFT   6
+#elif HZ < 67
+#define JIFFIES_SHIFT   7
+#else
 #define JIFFIES_SHIFT   8
+#endif
 
 static cycle_t jiffies_read(struct clocksource *cs)
 {
diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c
index 0abb36464281..4d23dc4d8139 100644
--- a/kernel/time/sched_clock.c
+++ b/kernel/time/sched_clock.c
@@ -116,20 +116,42 @@ static enum hrtimer_restart sched_clock_poll(struct hrtimer *hrt)
 void __init sched_clock_register(u64 (*read)(void), int bits,
                                  unsigned long rate)
 {
+        u64 res, wrap, new_mask, new_epoch, cyc, ns;
+        u32 new_mult, new_shift;
+        ktime_t new_wrap_kt;
         unsigned long r;
-        u64 res, wrap;
         char r_unit;
 
         if (cd.rate > rate)
                 return;
 
         WARN_ON(!irqs_disabled());
-        read_sched_clock = read;
-        sched_clock_mask = CLOCKSOURCE_MASK(bits);
-        cd.rate = rate;
 
         /* calculate the mult/shift to convert counter ticks to ns. */
-        clocks_calc_mult_shift(&cd.mult, &cd.shift, rate, NSEC_PER_SEC, 3600);
+        clocks_calc_mult_shift(&new_mult, &new_shift, rate, NSEC_PER_SEC, 3600);
+
+        new_mask = CLOCKSOURCE_MASK(bits);
+
+        /* calculate how many ns until we wrap */
+        wrap = clocks_calc_max_nsecs(new_mult, new_shift, 0, new_mask);
+        new_wrap_kt = ns_to_ktime(wrap - (wrap >> 3));
+
+        /* update epoch for new counter and update epoch_ns from old counter*/
+        new_epoch = read();
+        cyc = read_sched_clock();
+        ns = cd.epoch_ns + cyc_to_ns((cyc - cd.epoch_cyc) & sched_clock_mask,
+                          cd.mult, cd.shift);
+
+        raw_write_seqcount_begin(&cd.seq);
+        read_sched_clock = read;
+        sched_clock_mask = new_mask;
+        cd.rate = rate;
+        cd.wrap_kt = new_wrap_kt;
+        cd.mult = new_mult;
+        cd.shift = new_shift;
+        cd.epoch_cyc = new_epoch;
+        cd.epoch_ns = ns;
+        raw_write_seqcount_end(&cd.seq);
 
         r = rate;
         if (r >= 4000000) {
@@ -141,22 +163,12 @@ void __init sched_clock_register(u64 (*read)(void), int bits,
         } else
                 r_unit = ' ';
 
-        /* calculate how many ns until we wrap */
-        wrap = clocks_calc_max_nsecs(cd.mult, cd.shift, 0, sched_clock_mask);
-        cd.wrap_kt = ns_to_ktime(wrap - (wrap >> 3));
-
         /* calculate the ns resolution of this counter */
-        res = cyc_to_ns(1ULL, cd.mult, cd.shift);
+        res = cyc_to_ns(1ULL, new_mult, new_shift);
+
         pr_info("sched_clock: %u bits at %lu%cHz, resolution %lluns, wraps every %lluns\n",
                 bits, r, r_unit, res, wrap);
 
-        update_sched_clock();
-
-        /*
-         * Ensure that sched_clock() starts off at 0ns
-         */
-        cd.epoch_ns = 0;
-
         /* Enable IRQ time accounting if we have a fast enough sched_clock */
         if (irqtime > 0 || (irqtime == -1 && rate >= 1000000))
                 enable_sched_clock_irqtime();
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 43780ab5e279..98977a57ac72 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -756,6 +756,7 @@ out:
 static void tick_broadcast_clear_oneshot(int cpu)
 {
         cpumask_clear_cpu(cpu, tick_broadcast_oneshot_mask);
+        cpumask_clear_cpu(cpu, tick_broadcast_pending_mask);
 }
 
 static void tick_broadcast_init_next_event(struct cpumask *mask,
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 294b8a271a04..fc4da2d97f9b 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2397,6 +2397,13 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
         write &= RB_WRITE_MASK;
         tail = write - length;
 
+        /*
+         * If this is the first commit on the page, then it has the same
+         * timestamp as the page itself.
+         */
+        if (!tail)
+                delta = 0;
+
         /* See if we shot pass the end of this buffer page */
         if (unlikely(write > BUF_PAGE_SIZE))
                 return rb_move_tail(cpu_buffer, length, tail,
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 240fb62cf394..dd06439b9c84 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -225,7 +225,7 @@ static u32 map_id_up(struct uid_gid_map *map, u32 id)
  *
  *      When there is no mapping defined for the user-namespace uid
  *      pair INVALID_UID is returned.  Callers are expected to test
- *      for and handle handle INVALID_UID being returned.  INVALID_UID
+ *      for and handle INVALID_UID being returned.  INVALID_UID
  *      may be tested for using uid_valid().
  */
 kuid_t make_kuid(struct user_namespace *ns, uid_t uid)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 82ef9f3b7473..193e977a10ea 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1851,6 +1851,12 @@ static void destroy_worker(struct worker *worker)
         if (worker->flags & WORKER_IDLE)
                 pool->nr_idle--;
 
+        /*
+         * Once WORKER_DIE is set, the kworker may destroy itself at any
+         * point.  Pin to ensure the task stays until we're done with it.
+         */
+        get_task_struct(worker->task);
+
         list_del_init(&worker->entry);
         worker->flags |= WORKER_DIE;
 
@@ -1859,6 +1865,7 @@ static void destroy_worker(struct worker *worker)
         spin_unlock_irq(&pool->lock);
 
         kthread_stop(worker->task);
+        put_task_struct(worker->task);
         kfree(worker);
 
         spin_lock_irq(&pool->lock);
diff --git a/lib/percpu_ida.c b/lib/percpu_ida.c
index 7be235f1a70b..93d145e5539c 100644
--- a/lib/percpu_ida.c
+++ b/lib/percpu_ida.c
@@ -54,9 +54,7 @@ static inline void move_tags(unsigned *dst, unsigned *dst_nr,
 /*
  * Try to steal tags from a remote cpu's percpu freelist.
  *
- * We first check how many percpu freelists have tags - we don't steal tags
- * unless enough percpu freelists have tags on them that it's possible more than
- * half the total tags could be stuck on remote percpu freelists.
+ * We first check how many percpu freelists have tags
  *
  * Then we iterate through the cpus until we find some tags - we don't attempt
  * to find the "best" cpu to steal from, to keep cacheline bouncing to a
@@ -69,8 +67,7 @@ static inline void steal_tags(struct percpu_ida *pool,
         struct percpu_ida_cpu *remote;
 
         for (cpus_have_tags = cpumask_weight(&pool->cpus_have_tags);
-             cpus_have_tags * pool->percpu_max_size > pool->nr_tags / 2;
-             cpus_have_tags--) {
+             cpus_have_tags; cpus_have_tags--) {
                 cpu = cpumask_next(cpu, &pool->cpus_have_tags);
 
                 if (cpu >= nr_cpu_ids) {
diff --git a/mm/filemap.c b/mm/filemap.c
index d56d3c145b9f..7a13f6ac5421 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2553,8 +2553,8 @@ ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         if (ret > 0) {
                 ssize_t err;
 
-                err = generic_write_sync(file, pos, ret);
-                if (err < 0 && ret > 0)
+                err = generic_write_sync(file, iocb->ki_pos - ret, ret);
+                if (err < 0)
                         ret = err;
         }
         return ret;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 82166bf974e1..4df39b1bde91 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1166,8 +1166,10 @@ alloc:
                 } else {
                         ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
                                         pmd, orig_pmd, page, haddr);
-                        if (ret & VM_FAULT_OOM)
+                        if (ret & VM_FAULT_OOM) {
                                 split_huge_page(page);
+                                ret |= VM_FAULT_FALLBACK;
+                        }
                         put_page(page);
                 }
                 count_vm_event(THP_FAULT_FALLBACK);
@@ -1179,9 +1181,10 @@ alloc:
                 if (page) {
                         split_huge_page(page);
                         put_page(page);
-                }
+                } else
+                        split_huge_page_pmd(vma, address, pmd);
+                ret |= VM_FAULT_FALLBACK;
                 count_vm_event(THP_FAULT_FALLBACK);
-                ret |= VM_FAULT_OOM;
                 goto out;
         }
 
@@ -1545,6 +1548,7 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                                 entry = pmd_mknonnuma(entry);
                         entry = pmd_modify(entry, newprot);
                         ret = HPAGE_PMD_NR;
+                        set_pmd_at(mm, addr, pmd, entry);
                         BUG_ON(pmd_write(entry));
                 } else {
                         struct page *page = pmd_page(*pmd);
@@ -1557,16 +1561,10 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                          */
                         if (!is_huge_zero_page(page) &&
                             !pmd_numa(*pmd)) {
-                                entry = *pmd;
-                                entry = pmd_mknuma(entry);
+                                pmdp_set_numa(mm, addr, pmd);
                                 ret = HPAGE_PMD_NR;
                         }
                 }
-
-                /* Set PMD if cleared earlier */
-                if (ret == HPAGE_PMD_NR)
-                        set_pmd_at(mm, addr, pmd, entry);
-
                 spin_unlock(ptl);
         }
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 53385cd4e6f0..ce7a8cc7b404 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1687,7 +1687,7 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
          * protects memcg_name and makes sure that parallel ooms do not
          * interleave
          */
-        static DEFINE_SPINLOCK(oom_info_lock);
+        static DEFINE_MUTEX(oom_info_lock);
         struct cgroup *task_cgrp;
         struct cgroup *mem_cgrp;
         static char memcg_name[PATH_MAX];
@@ -1698,7 +1698,7 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
         if (!p)
                 return;
 
-        spin_lock(&oom_info_lock);
+        mutex_lock(&oom_info_lock);
         rcu_read_lock();
 
         mem_cgrp = memcg->css.cgroup;
@@ -1767,7 +1767,7 @@ done:
 
                 pr_cont("\n");
         }
-        spin_unlock(&oom_info_lock);
+        mutex_unlock(&oom_info_lock);
 }
 
 /*
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 4f08a2d61487..2f2f34a4e77d 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -945,8 +945,10 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
                          * to it. Similarly, page lock is shifted.
                          */
                         if (hpage != p) {
-                                put_page(hpage);
-                                get_page(p);
+                                if (!(flags & MF_COUNT_INCREASED)) {
+                                        put_page(hpage);
+                                        get_page(p);
+                                }
                                 lock_page(p);
                                 unlock_page(hpage);
                                 *hpagep = p;
diff --git a/mm/memory.c b/mm/memory.c
index be6a0c0d4ae0..22dfa617bddb 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3348,6 +3348,7 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                 if (ret & VM_FAULT_LOCKED)
                         unlock_page(vmf.page);
                 ret = VM_FAULT_HWPOISON;
+                page_cache_release(vmf.page);
                 goto uncharge_out;
         }
 
@@ -3703,7 +3704,6 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         if (unlikely(is_vm_hugetlb_page(vma)))
                 return hugetlb_fault(mm, vma, address, flags);
 
-retry:
         pgd = pgd_offset(mm, address);
         pud = pud_alloc(mm, pgd, address);
         if (!pud)
@@ -3741,20 +3741,13 @@ retry:
                         if (dirty && !pmd_write(orig_pmd)) {
                                 ret = do_huge_pmd_wp_page(mm, vma, address, pmd,
                                                           orig_pmd);
-                                /*
-                                 * If COW results in an oom, the huge pmd will
-                                 * have been split, so retry the fault on the
-                                 * pte for a smaller charge.
-                                 */
-                                if (unlikely(ret & VM_FAULT_OOM))
-                                        goto retry;
-                                return ret;
+                                if (!(ret & VM_FAULT_FALLBACK))
+                                        return ret;
                         } else {
                                 huge_pmd_set_accessed(mm, vma, address, pmd,
                                                       orig_pmd, dirty);
+                                return 0;
                         }
-
-                        return 0;
                 }
         }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 7332c1785744..769a67a15803 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -58,36 +58,27 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                                 if (pte_numa(ptent))
                                         ptent = pte_mknonnuma(ptent);
                                 ptent = pte_modify(ptent, newprot);
+                                /*
+                                 * Avoid taking write faults for pages we
+                                 * know to be dirty.
+                                 */
+                                if (dirty_accountable && pte_dirty(ptent))
+                                        ptent = pte_mkwrite(ptent);
+                                ptep_modify_prot_commit(mm, addr, pte, ptent);
                                 updated = true;
                         } else {
                                 struct page *page;
 
-                                ptent = *pte;
                                 page = vm_normal_page(vma, addr, oldpte);
                                 if (page && !PageKsm(page)) {
                                         if (!pte_numa(oldpte)) {
-                                                ptent = pte_mknuma(ptent);
-                                                set_pte_at(mm, addr, pte, ptent);
+                                                ptep_set_numa(mm, addr, pte);
                                                 updated = true;
                                         }
                                 }
                         }
-
-                        /*
-                         * Avoid taking write faults for pages we know to be
-                         * dirty.
-                         */
-                        if (dirty_accountable && pte_dirty(ptent)) {
-                                ptent = pte_mkwrite(ptent);
-                                updated = true;
-                        }
-
                         if (updated)
                                 pages++;
-
-                        /* Only !prot_numa always clears the pte */
-                        if (!prot_numa)
-                                ptep_modify_prot_commit(mm, addr, pte, ptent);
                 } else if (IS_ENABLED(CONFIG_MIGRATION) && !pte_file(oldpte)) {
                         swp_entry_t entry = pte_to_swp_entry(oldpte);
 
diff --git a/mm/slub.c b/mm/slub.c
index 7e3e0458bce4..25f14ad8f817 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1004,21 +1004,19 @@ static inline void slab_free_hook(struct kmem_cache *s, void *x)
 static void add_full(struct kmem_cache *s,
         struct kmem_cache_node *n, struct page *page)
 {
-        lockdep_assert_held(&n->list_lock);
-
         if (!(s->flags & SLAB_STORE_USER))
                 return;
 
+        lockdep_assert_held(&n->list_lock);
         list_add(&page->lru, &n->full);
 }
 
 static void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, struct page *page)
 {
-        lockdep_assert_held(&n->list_lock);
-
         if (!(s->flags & SLAB_STORE_USER))
                 return;
 
+        lockdep_assert_held(&n->list_lock);
         list_del(&page->lru);
 }
 
@@ -1520,11 +1518,9 @@ static void discard_slab(struct kmem_cache *s, struct page *page)
 /*
  * Management of partially allocated slabs.
  */
-static inline void add_partial(struct kmem_cache_node *n,
-                                struct page *page, int tail)
+static inline void
+__add_partial(struct kmem_cache_node *n, struct page *page, int tail)
 {
-        lockdep_assert_held(&n->list_lock);
-
         n->nr_partial++;
         if (tail == DEACTIVATE_TO_TAIL)
                 list_add_tail(&page->lru, &n->partial);
@@ -1532,15 +1528,27 @@ static inline void add_partial(struct kmem_cache_node *n,
                 list_add(&page->lru, &n->partial);
 }
 
-static inline void remove_partial(struct kmem_cache_node *n,
-                                        struct page *page)
+static inline void add_partial(struct kmem_cache_node *n,
+                                struct page *page, int tail)
 {
         lockdep_assert_held(&n->list_lock);
+        __add_partial(n, page, tail);
+}
 
+static inline void
+__remove_partial(struct kmem_cache_node *n, struct page *page)
+{
         list_del(&page->lru);
         n->nr_partial--;
 }
 
+static inline void remove_partial(struct kmem_cache_node *n,
+                                        struct page *page)
+{
+        lockdep_assert_held(&n->list_lock);
+        __remove_partial(n, page);
+}
+
 /*
  * Remove slab from the partial list, freeze it and
  * return the pointer to the freelist.
@@ -2906,12 +2914,10 @@ static void early_kmem_cache_node_alloc(int node)
         inc_slabs_node(kmem_cache_node, node, page->objects);
 
         /*
-         * the lock is for lockdep's sake, not for any actual
-         * race protection
+         * No locks need to be taken here as it has just been
+         * initialized and there is no concurrent access.
          */
-        spin_lock(&n->list_lock);
-        add_partial(n, page, DEACTIVATE_TO_HEAD);
-        spin_unlock(&n->list_lock);
+        __add_partial(n, page, DEACTIVATE_TO_HEAD);
 }
 
 static void free_kmem_cache_nodes(struct kmem_cache *s)
@@ -3197,7 +3203,7 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
 
         list_for_each_entry_safe(page, h, &n->partial, lru) {
                 if (!page->inuse) {
-                        remove_partial(n, page);
+                        __remove_partial(n, page);
                         discard_slab(s, page);
                 } else {
                         list_slab_objects(s, page,
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 196970a4541f..d4042e75f7c7 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -19,6 +19,7 @@
 #include <linux/mm.h>
 #include <linux/vmstat.h>
 #include <linux/eventfd.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/printk.h>
 #include <linux/vmpressure.h>
diff --git a/net/9p/client.c b/net/9p/client.c
index a5e4d2dcb03e..9186550d77a6 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -204,7 +204,7 @@ free_and_return:
         return ret;
 }
 
-struct p9_fcall *p9_fcall_alloc(int alloc_msize)
+static struct p9_fcall *p9_fcall_alloc(int alloc_msize)
 {
         struct p9_fcall *fc;
         fc = kmalloc(sizeof(struct p9_fcall) + alloc_msize, GFP_NOFS);
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index cd1e1ede73a4..ac2666c1d011 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -340,7 +340,10 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
                 int count = nr_pages;
                 while (nr_pages) {
                         s = rest_of_page(data);
-                        pages[index++] = kmap_to_page(data);
+                        if (is_vmalloc_addr(data))
+                                pages[index++] = vmalloc_to_page(data);
+                        else
+                                pages[index++] = kmap_to_page(data);
                         data += s;
                         nr_pages--;
                 }
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 512159bf607f..8323bced8e5b 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -241,19 +241,19 @@ batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const uint8_t *addr)
         size = bat_priv->num_ifaces * sizeof(uint8_t);
         orig_node->bat_iv.bcast_own_sum = kzalloc(size, GFP_ATOMIC);
         if (!orig_node->bat_iv.bcast_own_sum)
-                goto free_bcast_own;
+                goto free_orig_node;
 
         hash_added = batadv_hash_add(bat_priv->orig_hash, batadv_compare_orig,
                                      batadv_choose_orig, orig_node,
                                      &orig_node->hash_entry);
         if (hash_added != 0)
-                goto free_bcast_own;
+                goto free_orig_node;
 
         return orig_node;
 
-free_bcast_own:
-        kfree(orig_node->bat_iv.bcast_own);
 free_orig_node:
+        /* free twice, as batadv_orig_node_new sets refcount to 2 */
+        batadv_orig_node_free_ref(orig_node);
         batadv_orig_node_free_ref(orig_node);
 
         return NULL;
@@ -266,7 +266,7 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
                         struct batadv_orig_node *orig_neigh)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
-        struct batadv_neigh_node *neigh_node;
+        struct batadv_neigh_node *neigh_node, *tmp_neigh_node;
 
         neigh_node = batadv_neigh_node_new(hard_iface, neigh_addr, orig_node);
         if (!neigh_node)
@@ -281,14 +281,24 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
         neigh_node->orig_node = orig_neigh;
         neigh_node->if_incoming = hard_iface;
 
-        batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
-                   "Creating new neighbor %pM for orig_node %pM on interface %s\n",
-                   neigh_addr, orig_node->orig, hard_iface->net_dev->name);
-
         spin_lock_bh(&orig_node->neigh_list_lock);
-        hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
+        tmp_neigh_node = batadv_neigh_node_get(orig_node, hard_iface,
+                                               neigh_addr);
+        if (!tmp_neigh_node) {
+                hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
+        } else {
+                kfree(neigh_node);
+                batadv_hardif_free_ref(hard_iface);
+                neigh_node = tmp_neigh_node;
+        }
         spin_unlock_bh(&orig_node->neigh_list_lock);
 
+        if (!tmp_neigh_node)
+                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
+                           "Creating new neighbor %pM for orig_node %pM on interface %s\n",
+                           neigh_addr, orig_node->orig,
+                           hard_iface->net_dev->name);
+
 out:
         return neigh_node;
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 3d417d3641c6..b851cc580853 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -241,7 +241,7 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
 {
         struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         const struct batadv_hard_iface *hard_iface;
-        int min_mtu = ETH_DATA_LEN;
+        int min_mtu = INT_MAX;
 
         rcu_read_lock();
         list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
@@ -256,8 +256,6 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
         }
         rcu_read_unlock();
 
-        atomic_set(&bat_priv->packet_size_max, min_mtu);
-
         if (atomic_read(&bat_priv->fragmentation) == 0)
                 goto out;
 
@@ -268,13 +266,21 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
         min_mtu = min_t(int, min_mtu, BATADV_FRAG_MAX_FRAG_SIZE);
         min_mtu -= sizeof(struct batadv_frag_packet);
         min_mtu *= BATADV_FRAG_MAX_FRAGMENTS;
-        atomic_set(&bat_priv->packet_size_max, min_mtu);
-
-        /* with fragmentation enabled we can fragment external packets easily */
-        min_mtu = min_t(int, min_mtu, ETH_DATA_LEN);
 
 out:
-        return min_mtu - batadv_max_header_len();
+        /* report to the other components the maximum amount of bytes that
+         * batman-adv can send over the wire (without considering the payload
+         * overhead). For example, this value is used by TT to compute the
+         * maximum local table table size
+         */
+        atomic_set(&bat_priv->packet_size_max, min_mtu);
+
+        /* the real soft-interface MTU is computed by removing the payload
+         * overhead from the maximum amount of bytes that was just computed.
+         *
+         * However batman-adv does not support MTUs bigger than ETH_DATA_LEN
+         */
+        return min_t(int, min_mtu - batadv_max_header_len(), ETH_DATA_LEN);
 }
 
 /* adjusts the MTU if a new interface with a smaller MTU appeared. */
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 6df12a2e3605..853941629dc1 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -458,6 +458,42 @@ out:
 }
 
 /**
+ * batadv_neigh_node_get - retrieve a neighbour from the list
+ * @orig_node: originator which the neighbour belongs to
+ * @hard_iface: the interface where this neighbour is connected to
+ * @addr: the address of the neighbour
+ *
+ * Looks for and possibly returns a neighbour belonging to this originator list
+ * which is connected through the provided hard interface.
+ * Returns NULL if the neighbour is not found.
+ */
+struct batadv_neigh_node *
+batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
+                      const struct batadv_hard_iface *hard_iface,
+                      const uint8_t *addr)
+{
+        struct batadv_neigh_node *tmp_neigh_node, *res = NULL;
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(tmp_neigh_node, &orig_node->neigh_list, list) {
+                if (!batadv_compare_eth(tmp_neigh_node->addr, addr))
+                        continue;
+
+                if (tmp_neigh_node->if_incoming != hard_iface)
+                        continue;
+
+                if (!atomic_inc_not_zero(&tmp_neigh_node->refcount))
+                        continue;
+
+                res = tmp_neigh_node;
+                break;
+        }
+        rcu_read_unlock();
+
+        return res;
+}
+
+/**
  * batadv_orig_ifinfo_free_rcu - free the orig_ifinfo object
  * @rcu: rcu pointer of the orig_ifinfo object
  */
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 37be290f63f6..db3a9ed734cb 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -29,6 +29,10 @@ void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node);
 struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
                                               const uint8_t *addr);
 struct batadv_neigh_node *
+batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
+                      const struct batadv_hard_iface *hard_iface,
+                      const uint8_t *addr);
+struct batadv_neigh_node *
 batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,
                       const uint8_t *neigh_addr,
                       struct batadv_orig_node *orig_node);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 1ed9f7c9ecea..a953d5b196a3 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -688,7 +688,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         int is_old_ttvn;
 
         /* check if there is enough data before accessing it */
-        if (pskb_may_pull(skb, hdr_len + ETH_HLEN) < 0)
+        if (!pskb_may_pull(skb, hdr_len + ETH_HLEN))
                 return 0;
 
         /* create a copy of the skb (in case of for re-routing) to modify it. */
@@ -918,6 +918,8 @@ int batadv_recv_unicast_tvlv(struct sk_buff *skb,
 
         if (ret != NET_RX_SUCCESS)
                 ret = batadv_route_unicast_packet(skb, recv_if);
+        else
+                consume_skb(skb);
 
         return ret;
 }
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 579f5f00a385..843febd1e519 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -254,9 +254,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
                                    struct batadv_orig_node *orig_node,
                                    unsigned short vid)
 {
-        struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+        struct ethhdr *ethhdr;
         struct batadv_unicast_packet *unicast_packet;
-        int ret = NET_XMIT_DROP;
+        int ret = NET_XMIT_DROP, hdr_size;
 
         if (!orig_node)
                 goto out;
@@ -265,12 +265,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
         case BATADV_UNICAST:
                 if (!batadv_send_skb_prepare_unicast(skb, orig_node))
                         goto out;
+
+                hdr_size = sizeof(*unicast_packet);
                 break;
         case BATADV_UNICAST_4ADDR:
                 if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,
                                                            orig_node,
                                                            packet_subtype))
                         goto out;
+
+                hdr_size = sizeof(struct batadv_unicast_4addr_packet);
                 break;
         default:
                 /* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -279,6 +283,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
                 goto out;
         }
 
+        ethhdr = (struct ethhdr *)(skb->data + hdr_size);
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
 
         /* inform the destination node that we are still missing a correct route
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index b6071f675a3e..959dde721c46 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1975,6 +1975,7 @@ static uint32_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
         struct hlist_head *head;
         uint32_t i, crc_tmp, crc = 0;
         uint8_t flags;
+        __be16 tmp_vid;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -2011,8 +2012,11 @@ static uint32_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
                                                              orig_node))
                                 continue;
 
-                        crc_tmp = crc32c(0, &tt_common->vid,
-                                         sizeof(tt_common->vid));
+                        /* use network order to read the VID: this ensures that
+                         * every node reads the bytes in the same order.
+                         */
+                        tmp_vid = htons(tt_common->vid);
+                        crc_tmp = crc32c(0, &tmp_vid, sizeof(tmp_vid));
 
                         /* compute the CRC on flags that have to be kept in sync
                          * among nodes
@@ -2046,6 +2050,7 @@ static uint32_t batadv_tt_local_crc(struct batadv_priv *bat_priv,
         struct hlist_head *head;
         uint32_t i, crc_tmp, crc = 0;
         uint8_t flags;
+        __be16 tmp_vid;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -2064,8 +2069,11 @@ static uint32_t batadv_tt_local_crc(struct batadv_priv *bat_priv,
                         if (tt_common->flags & BATADV_TT_CLIENT_NEW)
                                 continue;
 
-                        crc_tmp = crc32c(0, &tt_common->vid,
-                                         sizeof(tt_common->vid));
+                        /* use network order to read the VID: this ensures that
+                         * every node reads the bytes in the same order.
+                         */
+                        tmp_vid = htons(tt_common->vid);
+                        crc_tmp = crc32c(0, &tmp_vid, sizeof(tmp_vid));
 
                         /* compute the CRC on flags that have to be kept in sync
                          * among nodes
@@ -2262,6 +2270,7 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
 {
         struct batadv_tvlv_tt_vlan_data *tt_vlan_tmp;
         struct batadv_orig_node_vlan *vlan;
+        uint32_t crc;
         int i;
 
         /* check if each received CRC matches the locally stored one */
@@ -2281,7 +2290,10 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
                 if (!vlan)
                         return false;
 
-                if (vlan->tt.crc != ntohl(tt_vlan_tmp->crc))
+                crc = vlan->tt.crc;
+                batadv_orig_node_vlan_free_ref(vlan);
+
+                if (crc != ntohl(tt_vlan_tmp->crc))
                         return false;
         }
 
@@ -3218,7 +3230,6 @@ static void batadv_tt_update_orig(struct batadv_priv *bat_priv,
 
                 spin_lock_bh(&orig_node->tt_lock);
 
-                tt_change = (struct batadv_tvlv_tt_change *)tt_buff;
                 batadv_tt_update_changes(bat_priv, orig_node, tt_num_changes,
                                          ttvn, tt_change);
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 292e619db896..d9fb93451442 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -430,6 +430,16 @@ static void hidp_del_timer(struct hidp_session *session)
                 del_timer(&session->timer);
 }
 
+static void hidp_process_report(struct hidp_session *session,
+                                int type, const u8 *data, int len, int intr)
+{
+        if (len > HID_MAX_BUFFER_SIZE)
+                len = HID_MAX_BUFFER_SIZE;
+
+        memcpy(session->input_buf, data, len);
+        hid_input_report(session->hid, type, session->input_buf, len, intr);
+}
+
 static void hidp_process_handshake(struct hidp_session *session,
                                         unsigned char param)
 {
@@ -502,7 +512,8 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
                         hidp_input_report(session, skb);
 
                 if (session->hid)
-                        hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
+                        hidp_process_report(session, HID_INPUT_REPORT,
+                                            skb->data, skb->len, 0);
                 break;
 
         case HIDP_DATA_RTYPE_OTHER:
@@ -584,7 +595,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
                         hidp_input_report(session, skb);
 
                 if (session->hid) {
-                        hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
+                        hidp_process_report(session, HID_INPUT_REPORT,
+                                            skb->data, skb->len, 1);
                         BT_DBG("report len %d", skb->len);
                 }
         } else {
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index ab5241400cf7..8798492a6e99 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -24,6 +24,7 @@
 #define __HIDP_H
 
 #include <linux/types.h>
+#include <linux/hid.h>
 #include <linux/kref.h>
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/l2cap.h>
@@ -179,6 +180,9 @@ struct hidp_session {
 
         /* Used in hidp_output_raw_report() */
         int output_report_success; /* boolean */
+
+        /* temporary input buffer */
+        u8 input_buf[HID_MAX_BUFFER_SIZE];
 };
 
 /* HIDP init defines */
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index e4401a531afb..63f0455c0bc3 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -187,8 +187,7 @@ static int br_set_mac_address(struct net_device *dev, void *p)
 
         spin_lock_bh(&br->lock);
         if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) {
-                memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
-                br_fdb_change_mac_address(br, addr->sa_data);
+                /* Mac address will be changed in br_stp_change_bridge_id(). */
                 br_stp_change_bridge_id(br, addr->sa_data);
         }
         spin_unlock_bh(&br->lock);
@@ -226,6 +225,33 @@ static void br_netpoll_cleanup(struct net_device *dev)
                 br_netpoll_disable(p);
 }
 
+static int __br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
+{
+        struct netpoll *np;
+        int err;
+
+        np = kzalloc(sizeof(*p->np), gfp);
+        if (!np)
+                return -ENOMEM;
+
+        err = __netpoll_setup(np, p->dev, gfp);
+        if (err) {
+                kfree(np);
+                return err;
+        }
+
+        p->np = np;
+        return err;
+}
+
+int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
+{
+        if (!p->br->dev->npinfo)
+                return 0;
+
+        return __br_netpoll_enable(p, gfp);
+}
+
 static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
                             gfp_t gfp)
 {
@@ -236,7 +262,7 @@ static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
         list_for_each_entry(p, &br->port_list, list) {
                 if (!p->dev)
                         continue;
-                err = br_netpoll_enable(p, gfp);
+                err = __br_netpoll_enable(p, gfp);
                 if (err)
                         goto fail;
         }
@@ -249,28 +275,6 @@ fail:
         goto out;
 }
 
-int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
-{
-        struct netpoll *np;
-        int err;
-
-        if (!p->br->dev->npinfo)
-                return 0;
-
-        np = kzalloc(sizeof(*p->np), gfp);
-        if (!np)
-                return -ENOMEM;
-
-        err = __netpoll_setup(np, p->dev, gfp);
-        if (err) {
-                kfree(np);
-                return err;
-        }
-
-        p->np = np;
-        return err;
-}
-
 void br_netpoll_disable(struct net_bridge_port *p)
 {
         struct netpoll *np = p->np;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index c5f5a4a933f4..9203d5a1943f 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -27,6 +27,9 @@
 #include "br_private.h"
 
 static struct kmem_cache *br_fdb_cache __read_mostly;
+static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
+                                             const unsigned char *addr,
+                                             __u16 vid);
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                       const unsigned char *addr, u16 vid);
 static void fdb_notify(struct net_bridge *br,
@@ -89,11 +92,57 @@ static void fdb_delete(struct net_bridge *br, struct net_bridge_fdb_entry *f)
         call_rcu(&f->rcu, fdb_rcu_free);
 }
 
+/* Delete a local entry if no other port had the same address. */
+static void fdb_delete_local(struct net_bridge *br,
+                             const struct net_bridge_port *p,
+                             struct net_bridge_fdb_entry *f)
+{
+        const unsigned char *addr = f->addr.addr;
+        u16 vid = f->vlan_id;
+        struct net_bridge_port *op;
+
+        /* Maybe another port has same hw addr? */
+        list_for_each_entry(op, &br->port_list, list) {
+                if (op != p && ether_addr_equal(op->dev->dev_addr, addr) &&
+                    (!vid || nbp_vlan_find(op, vid))) {
+                        f->dst = op;
+                        f->added_by_user = 0;
+                        return;
+                }
+        }
+
+        /* Maybe bridge device has same hw addr? */
+        if (p && ether_addr_equal(br->dev->dev_addr, addr) &&
+            (!vid || br_vlan_find(br, vid))) {
+                f->dst = NULL;
+                f->added_by_user = 0;
+                return;
+        }
+
+        fdb_delete(br, f);
+}
+
+void br_fdb_find_delete_local(struct net_bridge *br,
+                              const struct net_bridge_port *p,
+                              const unsigned char *addr, u16 vid)
+{
+        struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
+        struct net_bridge_fdb_entry *f;
+
+        spin_lock_bh(&br->hash_lock);
+        f = fdb_find(head, addr, vid);
+        if (f && f->is_local && !f->added_by_user && f->dst == p)
+                fdb_delete_local(br, p, f);
+        spin_unlock_bh(&br->hash_lock);
+}
+
 void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
 {
         struct net_bridge *br = p->br;
-        bool no_vlan = (nbp_get_vlan_info(p) == NULL) ? true : false;
+        struct net_port_vlans *pv = nbp_get_vlan_info(p);
+        bool no_vlan = !pv;
         int i;
+        u16 vid;
 
         spin_lock_bh(&br->hash_lock);
 
@@ -104,38 +153,34 @@ void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
                         struct net_bridge_fdb_entry *f;
 
                         f = hlist_entry(h, struct net_bridge_fdb_entry, hlist);
-                        if (f->dst == p && f->is_local) {
-                                /* maybe another port has same hw addr? */
-                                struct net_bridge_port *op;
-                                u16 vid = f->vlan_id;
-                                list_for_each_entry(op, &br->port_list, list) {
-                                        if (op != p &&
-                                            ether_addr_equal(op->dev->dev_addr,
-                                                             f->addr.addr) &&
-                                            nbp_vlan_find(op, vid)) {
-                                                f->dst = op;
-                                                goto insert;
-                                        }
-                                }
-
+                        if (f->dst == p && f->is_local && !f->added_by_user) {
                                 /* delete old one */
-                                fdb_delete(br, f);
-insert:
-                                /* insert new address,  may fail if invalid
-                                 * address or dup.
-                                 */
-                                fdb_insert(br, p, newaddr, vid);
+                                fdb_delete_local(br, p, f);
 
                                 /* if this port has no vlan information
                                  * configured, we can safely be done at
                                  * this point.
                                  */
                                 if (no_vlan)
-                                        goto done;
+                                        goto insert;
                         }
                 }
         }
 
+insert:
+        /* insert new address,  may fail if invalid address or dup. */
+        fdb_insert(br, p, newaddr, 0);
+
+        if (no_vlan)
+                goto done;
+
+        /* Now add entries for every VLAN configured on the port.
+         * This function runs under RTNL so the bitmap will not change
+         * from under us.
+         */
+        for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID)
+                fdb_insert(br, p, newaddr, vid);
+
 done:
         spin_unlock_bh(&br->hash_lock);
 }
@@ -146,10 +191,12 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
         struct net_port_vlans *pv;
         u16 vid = 0;
 
+        spin_lock_bh(&br->hash_lock);
+
         /* If old entry was unassociated with any port, then delete it. */
         f = __br_fdb_get(br, br->dev->dev_addr, 0);
         if (f && f->is_local && !f->dst)
-                fdb_delete(br, f);
+                fdb_delete_local(br, NULL, f);
 
         fdb_insert(br, NULL, newaddr, 0);
 
@@ -159,14 +206,16 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
          */
         pv = br_get_vlan_info(br);
         if (!pv)
-                return;
+                goto out;
 
         for_each_set_bit_from(vid, pv->vlan_bitmap, VLAN_N_VID) {
                 f = __br_fdb_get(br, br->dev->dev_addr, vid);
                 if (f && f->is_local && !f->dst)
-                        fdb_delete(br, f);
+                        fdb_delete_local(br, NULL, f);
                 fdb_insert(br, NULL, newaddr, vid);
         }
+out:
+        spin_unlock_bh(&br->hash_lock);
 }
 
 void br_fdb_cleanup(unsigned long _data)
@@ -235,25 +284,11 @@ void br_fdb_delete_by_port(struct net_bridge *br,
 
                         if (f->is_static && !do_all)
                                 continue;
-                        /*
-                         * if multiple ports all have the same device address
-                         * then when one port is deleted, assign
-                         * the local entry to other port
-                         */
-                        if (f->is_local) {
-                                struct net_bridge_port *op;
-                                list_for_each_entry(op, &br->port_list, list) {
-                                        if (op != p &&
-                                            ether_addr_equal(op->dev->dev_addr,
-                                                             f->addr.addr)) {
-                                                f->dst = op;
-                                                goto skip_delete;
-                                        }
-                                }
-                        }
 
-                        fdb_delete(br, f);
-                skip_delete: ;
+                        if (f->is_local)
+                                fdb_delete_local(br, p, f);
+                        else
+                                fdb_delete(br, f);
                 }
         }
         spin_unlock_bh(&br->hash_lock);
@@ -397,6 +432,7 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
                 fdb->vlan_id = vid;
                 fdb->is_local = 0;
                 fdb->is_static = 0;
+                fdb->added_by_user = 0;
                 fdb->updated = fdb->used = jiffies;
                 hlist_add_head_rcu(&fdb->hlist, head);
         }
@@ -447,7 +483,7 @@ int br_fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
 }
 
 void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
-                   const unsigned char *addr, u16 vid)
+                   const unsigned char *addr, u16 vid, bool added_by_user)
 {
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
@@ -473,13 +509,18 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                         /* fastpath: update of existing entry */
                         fdb->dst = source;
                         fdb->updated = jiffies;
+                        if (unlikely(added_by_user))
+                                fdb->added_by_user = 1;
                 }
         } else {
                 spin_lock(&br->hash_lock);
                 if (likely(!fdb_find(head, addr, vid))) {
                         fdb = fdb_create(head, source, addr, vid);
-                        if (fdb)
+                        if (fdb) {
+                                if (unlikely(added_by_user))
+                                        fdb->added_by_user = 1;
                                 fdb_notify(br, fdb, RTM_NEWNEIGH);
+                        }
                 }
                 /* else  we lose race and someone else inserts
                  * it first, don't bother updating
@@ -647,6 +688,7 @@ static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
 
                 modified = true;
         }
+        fdb->added_by_user = 1;
 
         fdb->used = jiffies;
         if (modified) {
@@ -664,7 +706,7 @@ static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
 
         if (ndm->ndm_flags & NTF_USE) {
                 rcu_read_lock();
-                br_fdb_update(p->br, p, addr, vid);
+                br_fdb_update(p->br, p, addr, vid, true);
                 rcu_read_unlock();
         } else {
                 spin_lock_bh(&p->br->hash_lock);
@@ -749,8 +791,7 @@ out:
         return err;
 }
 
-int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr,
-                       u16 vlan)
+static int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr, u16 vlan)
 {
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vlan)];
         struct net_bridge_fdb_entry *fdb;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index cffe1d666ba1..54d207d3a31c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -389,6 +389,9 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (br->dev->needed_headroom < dev->needed_headroom)
                 br->dev->needed_headroom = dev->needed_headroom;
 
+        if (br_fdb_insert(br, p, dev->dev_addr, 0))
+                netdev_err(dev, "failed insert local address bridge forwarding table\n");
+
         spin_lock_bh(&br->lock);
         changed_addr = br_stp_recalculate_bridge_id(br);
 
@@ -404,9 +407,6 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         dev_set_mtu(br->dev, br_min_mtu(br));
 
-        if (br_fdb_insert(br, p, dev->dev_addr, 0))
-                netdev_err(dev, "failed insert local address bridge forwarding table\n");
-
         kobject_uevent(&p->kobj, KOBJ_ADD);
 
         return 0;
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index bf8dc7d308d6..28d544627422 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -77,7 +77,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
         /* insert into forwarding database after filtering to avoid spoofing */
         br = p->br;
         if (p->flags & BR_LEARNING)
-                br_fdb_update(br, p, eth_hdr(skb)->h_source, vid);
+                br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
 
         if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
             br_multicast_rcv(br, p, skb, vid))
@@ -148,7 +148,7 @@ static int br_handle_local_finish(struct sk_buff *skb)
 
         br_vlan_get_tag(skb, &vid);
         if (p->flags & BR_LEARNING)
-                br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid);
+                br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
         return 0;        /* process further */
 }
 
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index fcd12333c59b..3ba11bc99b65 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -104,6 +104,7 @@ struct net_bridge_fdb_entry
         mac_addr                        addr;
         unsigned char                   is_local;
         unsigned char                   is_static;
+        unsigned char                   added_by_user;
         __u16                           vlan_id;
 };
 
@@ -370,6 +371,9 @@ static inline void br_netpoll_disable(struct net_bridge_port *p)
 int br_fdb_init(void);
 void br_fdb_fini(void);
 void br_fdb_flush(struct net_bridge *br);
+void br_fdb_find_delete_local(struct net_bridge *br,
+                              const struct net_bridge_port *p,
+                              const unsigned char *addr, u16 vid);
 void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr);
 void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr);
 void br_fdb_cleanup(unsigned long arg);
@@ -383,8 +387,7 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, unsigned long count,
 int br_fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                   const unsigned char *addr, u16 vid);
 void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
-                   const unsigned char *addr, u16 vid);
-int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr, u16 vid);
+                   const unsigned char *addr, u16 vid, bool added_by_user);
 
 int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                   struct net_device *dev, const unsigned char *addr);
@@ -584,6 +587,7 @@ struct sk_buff *br_handle_vlan(struct net_bridge *br,
 int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags);
 int br_vlan_delete(struct net_bridge *br, u16 vid);
 void br_vlan_flush(struct net_bridge *br);
+bool br_vlan_find(struct net_bridge *br, u16 vid);
 int br_vlan_filter_toggle(struct net_bridge *br, unsigned long val);
 int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags);
 int nbp_vlan_delete(struct net_bridge_port *port, u16 vid);
@@ -665,6 +669,11 @@ static inline void br_vlan_flush(struct net_bridge *br)
 {
 }
 
+static inline bool br_vlan_find(struct net_bridge *br, u16 vid)
+{
+        return false;
+}
+
 static inline int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
 {
         return -EOPNOTSUPP;
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 656a6f3e40de..189ba1e7d851 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -194,6 +194,8 @@ void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *addr)
 
         wasroot = br_is_root_bridge(br);
 
+        br_fdb_change_mac_address(br, addr);
+
         memcpy(oldaddr, br->bridge_id.addr, ETH_ALEN);
         memcpy(br->bridge_id.addr, addr, ETH_ALEN);
         memcpy(br->dev->dev_addr, addr, ETH_ALEN);
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 4ca4d0a0151c..8249ca764c79 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -275,9 +275,7 @@ int br_vlan_delete(struct net_bridge *br, u16 vid)
         if (!pv)
                 return -EINVAL;
 
-        spin_lock_bh(&br->hash_lock);
-        fdb_delete_by_addr(br, br->dev->dev_addr, vid);
-        spin_unlock_bh(&br->hash_lock);
+        br_fdb_find_delete_local(br, NULL, br->dev->dev_addr, vid);
 
         __vlan_del(pv, vid);
         return 0;
@@ -295,6 +293,25 @@ void br_vlan_flush(struct net_bridge *br)
         __vlan_flush(pv);
 }
 
+bool br_vlan_find(struct net_bridge *br, u16 vid)
+{
+        struct net_port_vlans *pv;
+        bool found = false;
+
+        rcu_read_lock();
+        pv = rcu_dereference(br->vlan_info);
+
+        if (!pv)
+                goto out;
+
+        if (test_bit(vid, pv->vlan_bitmap))
+                found = true;
+
+out:
+        rcu_read_unlock();
+        return found;
+}
+
 int br_vlan_filter_toggle(struct net_bridge *br, unsigned long val)
 {
         if (!rtnl_trylock())
@@ -359,9 +376,7 @@ int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
         if (!pv)
                 return -EINVAL;
 
-        spin_lock_bh(&port->br->hash_lock);
-        fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
-        spin_unlock_bh(&port->br->hash_lock);
+        br_fdb_find_delete_local(port->br, port, port->dev->dev_addr, vid);
 
         return __vlan_del(pv, vid);
 }
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 4dca159435cf..edbca468fa73 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -22,6 +22,7 @@
 #include <net/pkt_sched.h>
 #include <net/caif/caif_device.h>
 #include <net/caif/caif_layer.h>
+#include <net/caif/caif_dev.h>
 #include <net/caif/cfpkt.h>
 #include <net/caif/cfcnfg.h>
 #include <net/caif/cfserl.h>
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index 353f793d1b3b..a6e115463052 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -15,6 +15,7 @@
 #include <net/caif/caif_layer.h>
 #include <net/caif/cfsrvl.h>
 #include <net/caif/cfpkt.h>
+#include <net/caif/caif_dev.h>
 
 #define SRVL_CTRL_PKT_SIZE 1
 #define SRVL_FLOW_OFF 0x81
diff --git a/net/can/af_can.c b/net/can/af_can.c
index d249874a366d..a27f8aad9e99 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -57,6 +57,7 @@
 #include <linux/skbuff.h>
 #include <linux/can.h>
 #include <linux/can/core.h>
+#include <linux/can/skb.h>
 #include <linux/ratelimit.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -290,7 +291,7 @@ int can_send(struct sk_buff *skb, int loop)
                                 return -ENOMEM;
                         }
 
-                        newskb->sk = skb->sk;
+                        can_skb_set_owner(newskb, skb->sk);
                         newskb->ip_summed = CHECKSUM_UNNECESSARY;
                         newskb->pkt_type = PACKET_BROADCAST;
                 }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 3fc737b214c7..dcb75c0e66c1 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -268,7 +268,7 @@ static void bcm_can_tx(struct bcm_op *op)
 
         /* send with loopback */
         skb->dev = dev;
-        skb->sk = op->sk;
+        can_skb_set_owner(skb, op->sk);
         can_send(skb, 1);
 
         /* update statistics */
@@ -1223,7 +1223,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
 
         can_skb_prv(skb)->ifindex = dev->ifindex;
         skb->dev = dev;
-        skb->sk  = sk;
+        can_skb_set_owner(skb, sk);
         err = can_send(skb, 1); /* send with loopback */
         dev_put(dev);
 
diff --git a/net/can/raw.c b/net/can/raw.c
index 07d72d852324..8be757cca2ec 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -715,6 +715,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         skb->dev = dev;
         skb->sk  = sk;
+        skb->priority = sk->sk_priority;
 
         err = can_send(skb, ro->loopback);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 3721db716350..b1b0c8d4d7df 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2420,7 +2420,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault);
  * 2. No high memory really exists on this machine.
  */
 
-static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+static int illegal_highdma(const struct net_device *dev, struct sk_buff *skb)
 {
 #ifdef CONFIG_HIGHMEM
         int i;
@@ -2495,34 +2495,36 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features)
 }
 
 static netdev_features_t harmonize_features(struct sk_buff *skb,
-        netdev_features_t features)
+                                            const struct net_device *dev,
+                                            netdev_features_t features)
 {
         if (skb->ip_summed != CHECKSUM_NONE &&
             !can_checksum_protocol(features, skb_network_protocol(skb))) {
                 features &= ~NETIF_F_ALL_CSUM;
-        } else if (illegal_highdma(skb->dev, skb)) {
+        } else if (illegal_highdma(dev, skb)) {
                 features &= ~NETIF_F_SG;
         }
 
         return features;
 }
 
-netdev_features_t netif_skb_features(struct sk_buff *skb)
+netdev_features_t netif_skb_dev_features(struct sk_buff *skb,
+                                         const struct net_device *dev)
 {
         __be16 protocol = skb->protocol;
-        netdev_features_t features = skb->dev->features;
+        netdev_features_t features = dev->features;
 
-        if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
+        if (skb_shinfo(skb)->gso_segs > dev->gso_max_segs)
                 features &= ~NETIF_F_GSO_MASK;
 
         if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
                 struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
                 protocol = veh->h_vlan_encapsulated_proto;
         } else if (!vlan_tx_tag_present(skb)) {
-                return harmonize_features(skb, features);
+                return harmonize_features(skb, dev, features);
         }
 
-        features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
+        features &= (dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
                                                NETIF_F_HW_VLAN_STAG_TX);
 
         if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD))
@@ -2530,9 +2532,9 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
                                 NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_CTAG_TX |
                                 NETIF_F_HW_VLAN_STAG_TX;
 
-        return harmonize_features(skb, features);
+        return harmonize_features(skb, dev, features);
 }
-EXPORT_SYMBOL(netif_skb_features);
+EXPORT_SYMBOL(netif_skb_dev_features);
 
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                         struct netdev_queue *txq)
@@ -2803,7 +2805,7 @@ EXPORT_SYMBOL(dev_loopback_xmit);
  *      the BH enable code must have IRQs enabled so that it will not deadlock.
  *          --BLG
  */
-int __dev_queue_xmit(struct sk_buff *skb, void *accel_priv)
+static int __dev_queue_xmit(struct sk_buff *skb, void *accel_priv)
 {
         struct net_device *dev = skb->dev;
         struct netdev_queue *txq;
@@ -4637,7 +4639,7 @@ struct net_device *netdev_master_upper_dev_get_rcu(struct net_device *dev)
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_get_rcu);
 
-int netdev_adjacent_sysfs_add(struct net_device *dev,
+static int netdev_adjacent_sysfs_add(struct net_device *dev,
                               struct net_device *adj_dev,
                               struct list_head *dev_list)
 {
@@ -4647,7 +4649,7 @@ int netdev_adjacent_sysfs_add(struct net_device *dev,
         return sysfs_create_link(&(dev->dev.kobj), &(adj_dev->dev.kobj),
                                  linkname);
 }
-void netdev_adjacent_sysfs_del(struct net_device *dev,
+static void netdev_adjacent_sysfs_del(struct net_device *dev,
                                char *name,
                                struct list_head *dev_list)
 {
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index f409e0bd35c0..185c341fafbd 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -745,6 +745,13 @@ static int fib_rules_event(struct notifier_block *this, unsigned long event,
                         attach_rules(&ops->rules_list, dev);
                 break;
 
+        case NETDEV_CHANGENAME:
+                list_for_each_entry(ops, &net->rules_ops, list) {
+                        detach_rules(&ops->rules_list, dev);
+                        attach_rules(&ops->rules_list, dev);
+                }
+                break;
+
         case NETDEV_UNREGISTER:
                 list_for_each_entry(ops, &net->rules_ops, list)
                         detach_rules(&ops->rules_list, dev);
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 87577d447554..e29e810663d7 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -323,17 +323,6 @@ u32 __skb_get_poff(const struct sk_buff *skb)
         return poff;
 }
 
-static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
-{
-        if (unlikely(queue_index >= dev->real_num_tx_queues)) {
-                net_warn_ratelimited("%s selects TX queue %d, but real number of TX queues is %d\n",
-                                     dev->name, queue_index,
-                                     dev->real_num_tx_queues);
-                return 0;
-        }
-        return queue_index;
-}
-
 static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
 {
 #ifdef CONFIG_XPS
@@ -372,7 +361,7 @@ static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
 #endif
 }
 
-u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
+static u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         int queue_index = sk_tx_queue_get(sk);
@@ -392,7 +381,6 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
 
         return queue_index;
 }
-EXPORT_SYMBOL(__netdev_pick_tx);
 
 struct netdev_queue *netdev_pick_tx(struct net_device *dev,
                                     struct sk_buff *skb,
@@ -403,13 +391,13 @@ struct netdev_queue *netdev_pick_tx(struct net_device *dev,
         if (dev->real_num_tx_queues != 1) {
                 const struct net_device_ops *ops = dev->netdev_ops;
                 if (ops->ndo_select_queue)
-                        queue_index = ops->ndo_select_queue(dev, skb,
-                                                            accel_priv);
+                        queue_index = ops->ndo_select_queue(dev, skb, accel_priv,
+                                                            __netdev_pick_tx);
                 else
                         queue_index = __netdev_pick_tx(dev, skb);
 
                 if (!accel_priv)
-                        queue_index = dev_cap_txqueue(dev, queue_index);
+                        queue_index = netdev_cap_txqueue(dev, queue_index);
         }
 
         skb_set_queue_mapping(skb, queue_index);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index c03f3dec4763..a664f7829a6d 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -948,6 +948,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
 {
         char *cur=opt, *delim;
         int ipv6;
+        bool ipversion_set = false;
 
         if (*cur != '@') {
                 if ((delim = strchr(cur, '@')) == NULL)
@@ -960,6 +961,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
         cur++;
 
         if (*cur != '/') {
+                ipversion_set = true;
                 if ((delim = strchr(cur, '/')) == NULL)
                         goto parse_failed;
                 *delim = 0;
@@ -1002,7 +1004,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
         ipv6 = netpoll_parse_ip_addr(cur, &np->remote_ip);
         if (ipv6 < 0)
                 goto parse_failed;
-        else if (np->ipv6 != (bool)ipv6)
+        else if (ipversion_set && np->ipv6 != (bool)ipv6)
                 goto parse_failed;
         else
                 np->ipv6 = (bool)ipv6;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 393b1bc9a618..1a0dac2ef9ad 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -374,7 +374,7 @@ static size_t rtnl_link_get_slave_info_data_size(const struct net_device *dev)
         if (!master_dev)
                 return 0;
         ops = master_dev->rtnl_link_ops;
-        if (!ops->get_slave_size)
+        if (!ops || !ops->get_slave_size)
                 return 0;
         /* IFLA_INFO_SLAVE_DATA + nested data */
         return nla_total_size(sizeof(struct nlattr)) +
@@ -1963,16 +1963,21 @@ replay:
 
                 dev->ifindex = ifm->ifi_index;
 
-                if (ops->newlink)
+                if (ops->newlink) {
                         err = ops->newlink(net, dev, tb, data);
-                else
+                        /* Drivers should call free_netdev() in ->destructor
+                         * and unregister it on failure so that device could be
+                         * finally freed in rtnl_unlock.
+                         */
+                        if (err < 0)
+                                goto out;
+                } else {
                         err = register_netdevice(dev);
-
-                if (err < 0) {
-                        free_netdev(dev);
-                        goto out;
+                        if (err < 0) {
+                                free_netdev(dev);
+                                goto out;
+                        }
                 }
-
                 err = rtnl_configure_link(dev, ifm);
                 if (err < 0)
                         unregister_netdevice(dev);
diff --git a/net/core/sock.c b/net/core/sock.c
index 0c127dcdf6a8..5b6a9431b017 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1775,7 +1775,9 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                         while (order) {
                                 if (npages >= 1 << order) {
                                         page = alloc_pages(sk->sk_allocation |
-                                                           __GFP_COMP | __GFP_NOWARN,
+                                                           __GFP_COMP |
+                                                           __GFP_NOWARN |
+                                                           __GFP_NORETRY,
                                                            order);
                                         if (page)
                                                 goto fill_page;
@@ -1845,7 +1847,7 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
                 gfp_t gfp = prio;
 
                 if (order)
-                        gfp |= __GFP_COMP | __GFP_NOWARN;
+                        gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
                 pfrag->page = alloc_pages(gfp, order);
                 if (likely(pfrag->page)) {
                         pfrag->offset = 0;
diff --git a/net/dccp/ccids/lib/tfrc.c b/net/dccp/ccids/lib/tfrc.c
index c073b81a1f3e..62b5828acde0 100644
--- a/net/dccp/ccids/lib/tfrc.c
+++ b/net/dccp/ccids/lib/tfrc.c
@@ -8,7 +8,7 @@
 #include "tfrc.h"
 
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
-static bool tfrc_debug;
+bool tfrc_debug;
 module_param(tfrc_debug, bool, 0644);
 MODULE_PARM_DESC(tfrc_debug, "Enable TFRC debug messages");
 #endif
diff --git a/net/dccp/ccids/lib/tfrc.h b/net/dccp/ccids/lib/tfrc.h
index a3d8f7c76ae0..40ee7d62b652 100644
--- a/net/dccp/ccids/lib/tfrc.h
+++ b/net/dccp/ccids/lib/tfrc.h
@@ -21,6 +21,7 @@
 #include "packet_history.h"
 
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
+extern bool tfrc_debug;
 #define tfrc_pr_debug(format, a...)     DCCP_PR_DEBUG(tfrc_debug, format, ##a)
 #else
 #define tfrc_pr_debug(format, a...)
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 2954dcbca832..4c04848953bd 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -2104,8 +2104,6 @@ static struct notifier_block dn_dev_notifier = {
         .notifier_call = dn_device_event,
 };
 
-extern int dn_route_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
-
 static struct packet_type dn_dix_packet_type __read_mostly = {
         .type =         cpu_to_be16(ETH_P_DNA_RT),
         .func =         dn_route_rcv,
@@ -2353,9 +2351,6 @@ static const struct proto_ops dn_proto_ops = {
         .sendpage =     sock_no_sendpage,
 };
 
-void dn_register_sysctl(void);
-void dn_unregister_sysctl(void);
-
 MODULE_DESCRIPTION("The Linux DECnet Network Protocol");
 MODULE_AUTHOR("Linux DECnet Project Team");
 MODULE_LICENSE("GPL");
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 48b25c0af4d0..8edfea5da572 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -106,7 +106,6 @@ static int lowpan_header_create(struct sk_buff *skb,
                            unsigned short type, const void *_daddr,
                            const void *_saddr, unsigned int len)
 {
-        struct ipv6hdr *hdr;
         const u8 *saddr = _saddr;
         const u8 *daddr = _daddr;
         struct ieee802154_addr sa, da;
@@ -117,8 +116,6 @@ static int lowpan_header_create(struct sk_buff *skb,
         if (type != ETH_P_IPV6)
                 return 0;
 
-        hdr = ipv6_hdr(skb);
-
         if (!saddr)
                 saddr = dev->dev_addr;
 
@@ -533,7 +530,27 @@ static struct header_ops lowpan_header_ops = {
         .create = lowpan_header_create,
 };
 
+static struct lock_class_key lowpan_tx_busylock;
+static struct lock_class_key lowpan_netdev_xmit_lock_key;
+
+static void lowpan_set_lockdep_class_one(struct net_device *dev,
+                                         struct netdev_queue *txq,
+                                         void *_unused)
+{
+        lockdep_set_class(&txq->_xmit_lock,
+                          &lowpan_netdev_xmit_lock_key);
+}
+
+
+static int lowpan_dev_init(struct net_device *dev)
+{
+        netdev_for_each_tx_queue(dev, lowpan_set_lockdep_class_one, NULL);
+        dev->qdisc_tx_busylock = &lowpan_tx_busylock;
+        return 0;
+}
+
 static const struct net_device_ops lowpan_netdev_ops = {
+        .ndo_init               = lowpan_dev_init,
         .ndo_start_xmit         = lowpan_xmit,
         .ndo_set_mac_address    = lowpan_set_address,
 };
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ac2dff3c2c1c..bdbf68bb2e2d 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1443,7 +1443,8 @@ static size_t inet_nlmsg_size(void)
                + nla_total_size(4) /* IFA_LOCAL */
                + nla_total_size(4) /* IFA_BROADCAST */
                + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
-               + nla_total_size(4);  /* IFA_FLAGS */
+               + nla_total_size(4)  /* IFA_FLAGS */
+               + nla_total_size(sizeof(struct ifa_cacheinfo)); /* IFA_CACHEINFO */
 }
 
 static inline u32 cstamp_delta(unsigned long cstamp)
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index e9f1217a8afd..f3869c186d97 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -39,6 +39,71 @@
 #include <net/route.h>
 #include <net/xfrm.h>
 
+static bool ip_may_fragment(const struct sk_buff *skb)
+{
+        return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+               !skb->local_df;
+}
+
+static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+{
+        if (skb->len <= mtu || skb->local_df)
+                return false;
+
+        if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+                return false;
+
+        return true;
+}
+
+static bool ip_gso_exceeds_dst_mtu(const struct sk_buff *skb)
+{
+        unsigned int mtu;
+
+        if (skb->local_df || !skb_is_gso(skb))
+                return false;
+
+        mtu = ip_dst_mtu_maybe_forward(skb_dst(skb), true);
+
+        /* if seglen > mtu, do software segmentation for IP fragmentation on
+         * output.  DF bit cannot be set since ip_forward would have sent
+         * icmp error.
+         */
+        return skb_gso_network_seglen(skb) > mtu;
+}
+
+/* called if GSO skb needs to be fragmented on forward */
+static int ip_forward_finish_gso(struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        netdev_features_t features;
+        struct sk_buff *segs;
+        int ret = 0;
+
+        features = netif_skb_dev_features(skb, dst->dev);
+        segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+        if (IS_ERR(segs)) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        consume_skb(skb);
+
+        do {
+                struct sk_buff *nskb = segs->next;
+                int err;
+
+                segs->next = NULL;
+                err = dst_output(segs);
+
+                if (err && ret == 0)
+                        ret = err;
+                segs = nskb;
+        } while (segs);
+
+        return ret;
+}
+
 static int ip_forward_finish(struct sk_buff *skb)
 {
         struct ip_options *opt  = &(IPCB(skb)->opt);
@@ -49,6 +114,9 @@ static int ip_forward_finish(struct sk_buff *skb)
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
 
+        if (ip_gso_exceeds_dst_mtu(skb))
+                return ip_forward_finish_gso(skb);
+
         return dst_output(skb);
 }
 
@@ -91,8 +159,7 @@ int ip_forward(struct sk_buff *skb)
 
         IPCB(skb)->flags |= IPSKB_FORWARDED;
         mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
-        if (unlikely(skb->len > mtu && !skb_is_gso(skb) &&
-                     (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
+        if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, mtu)) {
                 IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                           htonl(mtu));
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index bd28f386bd02..50228be5c17b 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -101,28 +101,22 @@ static void tunnel_dst_reset_all(struct ip_tunnel *t)
                 __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);
 }
 
-static struct dst_entry *tunnel_dst_get(struct ip_tunnel *t)
+static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
 {
         struct dst_entry *dst;
 
         rcu_read_lock();
         dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
-        if (dst)
+        if (dst) {
+                if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
+                        rcu_read_unlock();
+                        tunnel_dst_reset(t);
+                        return NULL;
+                }
                 dst_hold(dst);
-        rcu_read_unlock();
-        return dst;
-}
-
-static struct dst_entry *tunnel_dst_check(struct ip_tunnel *t, u32 cookie)
-{
-        struct dst_entry *dst = tunnel_dst_get(t);
-
-        if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
-                tunnel_dst_reset(t);
-                return NULL;
         }
-
-        return dst;
+        rcu_read_unlock();
+        return (struct rtable *)dst;
 }
 
 /* Often modified stats are per cpu, other are shared (netdev->stats) */
@@ -584,7 +578,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
         struct flowi4 fl4;
         u8     tos, ttl;
         __be16 df;
-        struct rtable *rt = NULL;       /* Route to the other host */
+        struct rtable *rt;              /* Route to the other host */
         unsigned int max_headroom;      /* The extra header space needed */
         __be32 dst;
         int err;
@@ -657,8 +651,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
         init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
                          tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link);
 
-        if (connected)
-                rt = (struct rtable *)tunnel_dst_check(tunnel, 0);
+        rt = connected ? tunnel_rtable_get(tunnel, 0) : NULL;
 
         if (!rt) {
                 rt = ip_route_output_key(tunnel->net, &fl4);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index efa1138fa523..b3e86ea7b71b 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -273,7 +273,7 @@ static int __init ic_open_devs(void)
 
                 msleep(1);
 
-                if time_before(jiffies, next_msg)
+                if (time_before(jiffies, next_msg))
                         continue;
 
                 elapsed = jiffies_to_msecs(jiffies - start);
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 81c6910cfa92..a26ce035e3fa 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -61,6 +61,11 @@ config NFT_CHAIN_NAT_IPV4
           packet transformations such as the source, destination address and
           source and destination ports.
 
+config NFT_REJECT_IPV4
+        depends on NF_TABLES_IPV4
+        default NFT_REJECT
+        tristate
+
 config NF_TABLES_ARP
         depends on NF_TABLES
         tristate "ARP nf_tables support"
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index c16be9d58420..90b82405331e 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
 obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
+obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
 obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o
 
 # generic IP tables 
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index 9eea059dd621..574f7ebba0b6 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -229,7 +229,10 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                         ret = nf_ct_expect_related(rtcp_exp);
                         if (ret == 0)
                                 break;
-                        else if (ret != -EBUSY) {
+                        else if (ret == -EBUSY) {
+                                nf_ct_unexpect_related(rtp_exp);
+                                continue;
+                        } else if (ret < 0) {
                                 nf_ct_unexpect_related(rtp_exp);
                                 nated_port = 0;
                                 break;
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
new file mode 100644
index 000000000000..e79718a382f2
--- /dev/null
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
+ * Copyright (c) 2013 Eric Leblond <eric@regit.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/icmp.h>
+#include <net/netfilter/ipv4/nf_reject.h>
+#include <net/netfilter/nft_reject.h>
+
+void nft_reject_ipv4_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt)
+{
+        struct nft_reject *priv = nft_expr_priv(expr);
+
+        switch (priv->type) {
+        case NFT_REJECT_ICMP_UNREACH:
+                nf_send_unreach(pkt->skb, priv->icmp_code);
+                break;
+        case NFT_REJECT_TCP_RST:
+                nf_send_reset(pkt->skb, pkt->ops->hooknum);
+                break;
+        }
+
+        data[NFT_REG_VERDICT].verdict = NF_DROP;
+}
+EXPORT_SYMBOL_GPL(nft_reject_ipv4_eval);
+
+static struct nft_expr_type nft_reject_ipv4_type;
+static const struct nft_expr_ops nft_reject_ipv4_ops = {
+        .type           = &nft_reject_ipv4_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
+        .eval           = nft_reject_ipv4_eval,
+        .init           = nft_reject_init,
+        .dump           = nft_reject_dump,
+};
+
+static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
+        .family         = NFPROTO_IPV4,
+        .name           = "reject",
+        .ops            = &nft_reject_ipv4_ops,
+        .policy         = nft_reject_policy,
+        .maxattr        = NFTA_REJECT_MAX,
+        .owner          = THIS_MODULE,
+};
+
+static int __init nft_reject_ipv4_module_init(void)
+{
+        return nft_register_expr(&nft_reject_ipv4_type);
+}
+
+static void __exit nft_reject_ipv4_module_exit(void)
+{
+        nft_unregister_expr(&nft_reject_ipv4_type);
+}
+
+module_init(nft_reject_ipv4_module_init);
+module_exit(nft_reject_ipv4_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "reject");
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 25071b48921c..4c011ec69ed4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1597,6 +1597,7 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->rt_gateway = 0;
         rth->rt_uses_gateway = 0;
         INIT_LIST_HEAD(&rth->rt_uncached);
+        RT_CACHE_STAT_INC(in_slow_tot);
 
         rth->dst.input = ip_forward;
         rth->dst.output = ip_output;
@@ -1695,10 +1696,11 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         fl4.daddr = daddr;
         fl4.saddr = saddr;
         err = fib_lookup(net, &fl4, &res);
-        if (err != 0)
+        if (err != 0) {
+                if (!IN_DEV_FORWARD(in_dev))
+                        err = -EHOSTUNREACH;
                 goto no_route;
-
-        RT_CACHE_STAT_INC(in_slow_tot);
+        }
 
         if (res.type == RTN_BROADCAST)
                 goto brd_input;
@@ -1712,8 +1714,10 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 goto local_input;
         }
 
-        if (!IN_DEV_FORWARD(in_dev))
+        if (!IN_DEV_FORWARD(in_dev)) {
+                err = -EHOSTUNREACH;
                 goto no_route;
+        }
         if (res.type != RTN_UNICAST)
                 goto martian_destination;
 
@@ -1768,6 +1772,7 @@ local_input:
         rth->rt_gateway = 0;
         rth->rt_uses_gateway = 0;
         INIT_LIST_HEAD(&rth->rt_uncached);
+        RT_CACHE_STAT_INC(in_slow_tot);
         if (res.type == RTN_UNREACHABLE) {
                 rth->dst.input= ip_error;
                 rth->dst.error= -err;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 4475b3bb494d..9f3a2db9109e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2229,7 +2229,7 @@ adjudge_to_death:
         /*      This is a (useful) BSD violating of the RFC. There is a
          *      problem with TCP as specified in that the other end could
          *      keep a socket open forever with no application left this end.
-         *      We use a 3 minute timeout (about the same as BSD) then kill
+         *      We use a 1 minute timeout (about the same as BSD) then kill
          *      our end. If they send after that then tough - BUT: long enough
          *      that we won't make the old 4*rto = almost no time - whoops
          *      reset mistake.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 65cf90e063d5..227cba79fa6b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -671,6 +671,7 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         long m = mrtt; /* RTT */
+        u32 srtt = tp->srtt;
 
         /*      The following amusing code comes from Jacobson's
          *      article in SIGCOMM '88.  Note that rtt and mdev
@@ -688,11 +689,9 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
          * does not matter how to _calculate_ it. Seems, it was trap
          * that VJ failed to avoid. 8)
          */
-        if (m == 0)
-                m = 1;
-        if (tp->srtt != 0) {
-                m -= (tp->srtt >> 3);   /* m is now error in rtt est */
-                tp->srtt += m;          /* rtt = 7/8 rtt + 1/8 new */
+        if (srtt != 0) {
+                m -= (srtt >> 3);       /* m is now error in rtt est */
+                srtt += m;              /* rtt = 7/8 rtt + 1/8 new */
                 if (m < 0) {
                         m = -m;         /* m is now abs(error) */
                         m -= (tp->mdev >> 2);   /* similar update on mdev */
@@ -723,11 +722,12 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
                 }
         } else {
                 /* no previous measure. */
-                tp->srtt = m << 3;      /* take the measured time to be rtt */
+                srtt = m << 3;          /* take the measured time to be rtt */
                 tp->mdev = m << 1;      /* make sure rto = 3*rtt */
                 tp->mdev_max = tp->rttvar = max(tp->mdev, tcp_rto_min(sk));
                 tp->rtt_seq = tp->snd_nxt;
         }
+        tp->srtt = max(1U, srtt);
 }
 
 /* Set the sk_pacing_rate to allow proper sizing of TSO packets.
@@ -746,8 +746,10 @@ static void tcp_update_pacing_rate(struct sock *sk)
 
         rate *= max(tp->snd_cwnd, tp->packets_out);
 
-        /* Correction for small srtt : minimum srtt being 8 (1 jiffy << 3),
-         * be conservative and assume srtt = 1 (125 us instead of 1.25 ms)
+        /* Correction for small srtt and scheduling constraints.
+         * For small rtt, consider noise is too high, and use
+         * the minimal value (srtt = 1 -> 125 us for HZ=1000)
+         *
          * We probably need usec resolution in the future.
          * Note: This also takes care of possible srtt=0 case,
          * when tcp_rtt_estimator() was not yet called.
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 03d26b85eab8..3be16727f058 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -698,7 +698,8 @@ static void tcp_tsq_handler(struct sock *sk)
         if ((1 << sk->sk_state) &
             (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_CLOSING |
              TCPF_CLOSE_WAIT  | TCPF_LAST_ACK))
-                tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC);
+                tcp_write_xmit(sk, tcp_current_mss(sk), tcp_sk(sk)->nonagle,
+                               0, GFP_ATOMIC);
 }
 /*
  * One tasklet per cpu tries to send more skbs.
@@ -1904,7 +1905,15 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 
                 if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                         set_bit(TSQ_THROTTLED, &tp->tsq_flags);
-                        break;
+                        /* It is possible TX completion already happened
+                         * before we set TSQ_THROTTLED, so we must
+                         * test again the condition.
+                         * We abuse smp_mb__after_clear_bit() because
+                         * there is no smp_mb__after_set_bit() yet
+                         */
+                        smp_mb__after_clear_bit();
+                        if (atomic_read(&sk->sk_wmem_alloc) > limit)
+                                break;
                 }
 
                 limit = mss_now;
@@ -1977,7 +1986,7 @@ bool tcp_schedule_loss_probe(struct sock *sk)
         /* Schedule a loss probe in 2*RTT for SACK capable connections
          * in Open state, that are either limited by cwnd or application.
          */
-        if (sysctl_tcp_early_retrans < 3 || !rtt || !tp->packets_out ||
+        if (sysctl_tcp_early_retrans < 3 || !tp->srtt || !tp->packets_out ||
             !tcp_is_sack(tp) || inet_csk(sk)->icsk_ca_state != TCP_CA_Open)
                 return false;
 
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 25f5cee3a08a..88b4023ecfcf 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -17,6 +17,8 @@
 static DEFINE_SPINLOCK(udp_offload_lock);
 static struct udp_offload_priv __rcu *udp_offload_base __read_mostly;
 
+#define udp_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&udp_offload_lock))
+
 struct udp_offload_priv {
         struct udp_offload      *offload;
         struct rcu_head         rcu;
@@ -100,8 +102,7 @@ out:
 
 int udp_add_offload(struct udp_offload *uo)
 {
-        struct udp_offload_priv __rcu **head = &udp_offload_base;
-        struct udp_offload_priv *new_offload = kzalloc(sizeof(*new_offload), GFP_KERNEL);
+        struct udp_offload_priv *new_offload = kzalloc(sizeof(*new_offload), GFP_ATOMIC);
 
         if (!new_offload)
                 return -ENOMEM;
@@ -109,8 +110,8 @@ int udp_add_offload(struct udp_offload *uo)
         new_offload->offload = uo;
 
         spin_lock(&udp_offload_lock);
-        rcu_assign_pointer(new_offload->next, rcu_dereference(*head));
-        rcu_assign_pointer(*head, new_offload);
+        new_offload->next = udp_offload_base;
+        rcu_assign_pointer(udp_offload_base, new_offload);
         spin_unlock(&udp_offload_lock);
 
         return 0;
@@ -130,12 +131,12 @@ void udp_del_offload(struct udp_offload *uo)
 
         spin_lock(&udp_offload_lock);
 
-        uo_priv = rcu_dereference(*head);
+        uo_priv = udp_deref_protected(*head);
         for (; uo_priv != NULL;
-                uo_priv = rcu_dereference(*head)) {
-
+             uo_priv = udp_deref_protected(*head)) {
                 if (uo_priv->offload == uo) {
-                        rcu_assign_pointer(*head, rcu_dereference(uo_priv->next));
+                        rcu_assign_pointer(*head,
+                                           udp_deref_protected(uo_priv->next));
                         goto unlock;
                 }
                 head = &uo_priv->next;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ad235690684c..fdbfeca36d63 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2783,6 +2783,8 @@ static void addrconf_gre_config(struct net_device *dev)
         ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
         if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
                 addrconf_add_linklocal(idev, &addr);
+        else
+                addrconf_prefix_route(&addr, 64, dev, 0, 0);
 }
 #endif
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index f81f59686f21..f2610e157660 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -414,7 +414,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         addr_type = ipv6_addr_type(&hdr->daddr);
 
         if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
-            ipv6_anycast_destination(skb))
+            ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
                 saddr = &hdr->daddr;
 
         /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ef02b26ccf81..070a2fae2375 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -342,6 +342,20 @@ static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
         return mtu;
 }
 
+static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
+{
+        if (skb->len <= mtu || skb->local_df)
+                return false;
+
+        if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
+                return true;
+
+        if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+                return false;
+
+        return true;
+}
+
 int ip6_forward(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
@@ -466,8 +480,7 @@ int ip6_forward(struct sk_buff *skb)
         if (mtu < IPV6_MIN_MTU)
                 mtu = IPV6_MIN_MTU;
 
-        if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
-            (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
+        if (ip6_pkt_too_big(skb, mtu)) {
                 /* Again, force OUTPUT device used as source address */
                 skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 35750df744dc..4bff1f297e39 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -50,6 +50,11 @@ config NFT_CHAIN_NAT_IPV6
           packet transformations such as the source, destination address and
           source and destination ports.
 
+config NFT_REJECT_IPV6
+        depends on NF_TABLES_IPV6
+        default NFT_REJECT
+        tristate
+
 config IP6_NF_IPTABLES
         tristate "IP6 tables support (required for filtering)"
         depends on INET && IPV6
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index d1b4928f34f7..70d3dd66f2cd 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_NF_DEFRAG_IPV6) += nf_defrag_ipv6.o
 obj-$(CONFIG_NF_TABLES_IPV6) += nf_tables_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV6) += nft_chain_nat_ipv6.o
+obj-$(CONFIG_NFT_REJECT_IPV6) += nft_reject_ipv6.o
 
 # matches
 obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
new file mode 100644
index 000000000000..0bc19fa87821
--- /dev/null
+++ b/net/ipv6/netfilter/nft_reject_ipv6.c
@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
+ * Copyright (c) 2013 Eric Leblond <eric@regit.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_reject.h>
+#include <net/netfilter/ipv6/nf_reject.h>
+
+void nft_reject_ipv6_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt)
+{
+        struct nft_reject *priv = nft_expr_priv(expr);
+        struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
+
+        switch (priv->type) {
+        case NFT_REJECT_ICMP_UNREACH:
+                nf_send_unreach6(net, pkt->skb, priv->icmp_code,
+                                 pkt->ops->hooknum);
+                break;
+        case NFT_REJECT_TCP_RST:
+                nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
+                break;
+        }
+
+        data[NFT_REG_VERDICT].verdict = NF_DROP;
+}
+EXPORT_SYMBOL_GPL(nft_reject_ipv6_eval);
+
+static struct nft_expr_type nft_reject_ipv6_type;
+static const struct nft_expr_ops nft_reject_ipv6_ops = {
+        .type           = &nft_reject_ipv6_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
+        .eval           = nft_reject_ipv6_eval,
+        .init           = nft_reject_init,
+        .dump           = nft_reject_dump,
+};
+
+static struct nft_expr_type nft_reject_ipv6_type __read_mostly = {
+        .family         = NFPROTO_IPV6,
+        .name           = "reject",
+        .ops            = &nft_reject_ipv6_ops,
+        .policy         = nft_reject_policy,
+        .maxattr        = NFTA_REJECT_MAX,
+        .owner          = THIS_MODULE,
+};
+
+static int __init nft_reject_ipv6_module_init(void)
+{
+        return nft_register_expr(&nft_reject_ipv6_type);
+}
+
+static void __exit nft_reject_ipv6_module_exit(void)
+{
+        nft_unregister_expr(&nft_reject_ipv6_type);
+}
+
+module_init(nft_reject_ipv6_module_init);
+module_exit(nft_reject_ipv6_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET6, "reject");
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 994e28bfb32e..00b2a6d1c009 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -52,18 +52,12 @@
 #include <net/p8022.h>
 #include <net/psnap.h>
 #include <net/sock.h>
+#include <net/datalink.h>
 #include <net/tcp_states.h>
+#include <net/net_namespace.h>
 
 #include <asm/uaccess.h>
 
-#ifdef CONFIG_SYSCTL
-extern void ipx_register_sysctl(void);
-extern void ipx_unregister_sysctl(void);
-#else
-#define ipx_register_sysctl()
-#define ipx_unregister_sysctl()
-#endif
-
 /* Configuration Variables */
 static unsigned char ipxcfg_max_hops = 16;
 static char ipxcfg_auto_select_primary;
@@ -84,15 +78,6 @@ DEFINE_SPINLOCK(ipx_interfaces_lock);
 struct ipx_interface *ipx_primary_net;
 struct ipx_interface *ipx_internal_net;
 
-extern int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
-                            unsigned char *node);
-extern void ipxrtr_del_routes(struct ipx_interface *intrfc);
-extern int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
-                               struct iovec *iov, size_t len, int noblock);
-extern int ipxrtr_route_skb(struct sk_buff *skb);
-extern struct ipx_route *ipxrtr_lookup(__be32 net);
-extern int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
-
 struct ipx_interface *ipx_interfaces_head(void)
 {
         struct ipx_interface *rc = NULL;
@@ -1986,9 +1971,6 @@ static struct notifier_block ipx_dev_notifier = {
         .notifier_call  = ipxitf_device_event,
 };
 
-extern struct datalink_proto *make_EII_client(void);
-extern void destroy_EII_client(struct datalink_proto *);
-
 static const unsigned char ipx_8022_type = 0xE0;
 static const unsigned char ipx_snap_id[5] = { 0x0, 0x0, 0x0, 0x81, 0x37 };
 static const char ipx_EII_err_msg[] __initconst =
diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c
index 30f4519b092f..c1f03185c5e1 100644
--- a/net/ipx/ipx_route.c
+++ b/net/ipx/ipx_route.c
@@ -20,15 +20,11 @@ DEFINE_RWLOCK(ipx_routes_lock);
 
 extern struct ipx_interface *ipx_internal_net;
 
-extern __be16 ipx_cksum(struct ipxhdr *packet, int length);
 extern struct ipx_interface *ipxitf_find_using_net(__be32 net);
 extern int ipxitf_demux_socket(struct ipx_interface *intrfc,
                                struct sk_buff *skb, int copy);
 extern int ipxitf_demux_socket(struct ipx_interface *intrfc,
                                struct sk_buff *skb, int copy);
-extern int ipxitf_send(struct ipx_interface *intrfc, struct sk_buff *skb,
-                       char *node);
-extern struct ipx_interface *ipxitf_find_using_net(__be32 net);
 
 struct ipx_route *ipxrtr_lookup(__be32 net)
 {
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index f9ae9b85d4c1..453e974287d1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1021,8 +1021,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                                         IEEE80211_P2P_OPPPS_ENABLE_BIT;
 
         err = ieee80211_assign_beacon(sdata, &params->beacon);
-        if (err < 0)
+        if (err < 0) {
+                ieee80211_vif_release_channel(sdata);
                 return err;
+        }
         changed |= err;
 
         err = drv_start_ap(sdata->local, sdata);
@@ -1032,6 +1034,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                 if (old)
                         kfree_rcu(old, rcu_head);
                 RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
+                ieee80211_vif_release_channel(sdata);
                 return err;
         }
 
@@ -1090,8 +1093,6 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         kfree(sdata->u.ap.next_beacon);
         sdata->u.ap.next_beacon = NULL;
 
-        cancel_work_sync(&sdata->u.ap.request_smps_work);
-
         /* turn off carrier for this interface and dependent VLANs */
         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
                 netif_carrier_off(vlan->dev);
@@ -1103,6 +1104,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         kfree_rcu(old_beacon, rcu_head);
         if (old_probe_resp)
                 kfree_rcu(old_probe_resp, rcu_head);
+        sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
 
         __sta_info_flush(sdata, true);
         ieee80211_free_keys(sdata, true);
@@ -2638,6 +2640,24 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
         INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
         INIT_LIST_HEAD(&roc->dependents);
 
+        /*
+         * cookie is either the roc cookie (for normal roc)
+         * or the SKB (for mgmt TX)
+         */
+        if (!txskb) {
+                /* local->mtx protects this */
+                local->roc_cookie_counter++;
+                roc->cookie = local->roc_cookie_counter;
+                /* wow, you wrapped 64 bits ... more likely a bug */
+                if (WARN_ON(roc->cookie == 0)) {
+                        roc->cookie = 1;
+                        local->roc_cookie_counter++;
+                }
+                *cookie = roc->cookie;
+        } else {
+                *cookie = (unsigned long)txskb;
+        }
+
         /* if there's one pending or we're scanning, queue this one */
         if (!list_empty(&local->roc_list) ||
             local->scanning || local->radar_detect_enabled)
@@ -2772,24 +2792,6 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
         if (!queued)
                 list_add_tail(&roc->list, &local->roc_list);
 
-        /*
-         * cookie is either the roc cookie (for normal roc)
-         * or the SKB (for mgmt TX)
-         */
-        if (!txskb) {
-                /* local->mtx protects this */
-                local->roc_cookie_counter++;
-                roc->cookie = local->roc_cookie_counter;
-                /* wow, you wrapped 64 bits ... more likely a bug */
-                if (WARN_ON(roc->cookie == 0)) {
-                        roc->cookie = 1;
-                        local->roc_cookie_counter++;
-                }
-                *cookie = roc->cookie;
-        } else {
-                *cookie = (unsigned long)txskb;
-        }
-
         return 0;
 }
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index fab7b91923e0..70dd013de836 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -466,7 +466,9 @@ void ieee80211_request_smps_ap_work(struct work_struct *work)
                              u.ap.request_smps_work);
 
         sdata_lock(sdata);
-        __ieee80211_request_smps_ap(sdata, sdata->u.ap.driver_smps_mode);
+        if (sdata_dereference(sdata->u.ap.beacon, sdata))
+                __ieee80211_request_smps_ap(sdata,
+                                            sdata->u.ap.driver_smps_mode);
         sdata_unlock(sdata);
 }
 
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 771080ec7212..2796a198728f 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -695,12 +695,9 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
         struct cfg80211_bss *cbss;
         struct beacon_data *presp;
         struct sta_info *sta;
-        int active_ibss;
         u16 capability;
 
-        active_ibss = ieee80211_sta_active_ibss(sdata);
-
-        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
+        if (!is_zero_ether_addr(ifibss->bssid)) {
                 capability = WLAN_CAPABILITY_IBSS;
 
                 if (ifibss->privacy)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3dfd20a453ab..ce1c44370610 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -418,20 +418,24 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
                 return ret;
         }
 
+        mutex_lock(&local->iflist_mtx);
+        rcu_assign_pointer(local->monitor_sdata, sdata);
+        mutex_unlock(&local->iflist_mtx);
+
         mutex_lock(&local->mtx);
         ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
                                         IEEE80211_CHANCTX_EXCLUSIVE);
         mutex_unlock(&local->mtx);
         if (ret) {
+                mutex_lock(&local->iflist_mtx);
+                rcu_assign_pointer(local->monitor_sdata, NULL);
+                mutex_unlock(&local->iflist_mtx);
+                synchronize_net();
                 drv_remove_interface(local, sdata);
                 kfree(sdata);
                 return ret;
         }
 
-        mutex_lock(&local->iflist_mtx);
-        rcu_assign_pointer(local->monitor_sdata, sdata);
-        mutex_unlock(&local->iflist_mtx);
-
         return 0;
 }
 
@@ -770,12 +774,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_roc_purge(local, sdata);
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_STATION:
                 ieee80211_mgd_stop(sdata);
-
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                break;
+        case NL80211_IFTYPE_ADHOC:
                 ieee80211_ibss_stop(sdata);
-
+                break;
+        case NL80211_IFTYPE_AP:
+                cancel_work_sync(&sdata->u.ap.request_smps_work);
+                break;
+        default:
+                break;
+        }
 
         /*
          * Remove all stations associated with this interface.
@@ -1046,7 +1057,8 @@ static void ieee80211_uninit(struct net_device *dev)
 
 static u16 ieee80211_netdev_select_queue(struct net_device *dev,
                                          struct sk_buff *skb,
-                                         void *accel_priv)
+                                         void *accel_priv,
+                                         select_queue_fallback_t fallback)
 {
         return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
 }
@@ -1064,7 +1076,8 @@ static const struct net_device_ops ieee80211_dataif_ops = {
 
 static u16 ieee80211_monitor_select_queue(struct net_device *dev,
                                           struct sk_buff *skb,
-                                          void *accel_priv)
+                                          void *accel_priv,
+                                          select_queue_fallback_t fallback)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 27c990bf2320..97a02d3f7d87 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -878,7 +878,7 @@ static int ieee80211_fragment(struct ieee80211_tx_data *tx,
         }
 
         /* adjust first fragment's length */
-        skb->len = hdrlen + per_fragm;
+        skb_trim(skb, hdrlen + per_fragm);
         return 0;
 }
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index c37467562fd0..e9410d17619d 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -513,7 +513,6 @@ config NFT_QUEUE
 
 config NFT_REJECT
         depends on NF_TABLES
-        depends on NF_TABLES_IPV6 || !NF_TABLES_IPV6
         default m if NETFILTER_ADVANCED=n
         tristate "Netfilter nf_tables reject support"
         help
@@ -521,6 +520,11 @@ config NFT_REJECT
           explicitly deny and notify via TCP reset/ICMP informational errors
           unallowed traffic.
 
+config NFT_REJECT_INET
+        depends on NF_TABLES_INET
+        default NFT_REJECT
+        tristate
+
 config NFT_COMPAT
         depends on NF_TABLES
         depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index ee9c4de5f8ed..bffdad774da7 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -79,6 +79,7 @@ obj-$(CONFIG_NFT_LIMIT)		+= nft_limit.o
 obj-$(CONFIG_NFT_NAT)           += nft_nat.o
 obj-$(CONFIG_NFT_QUEUE)         += nft_queue.o
 obj-$(CONFIG_NFT_REJECT)        += nft_reject.o
+obj-$(CONFIG_NFT_REJECT_INET)   += nft_reject_inet.o
 obj-$(CONFIG_NFT_RBTREE)        += nft_rbtree.o
 obj-$(CONFIG_NFT_HASH)          += nft_hash.o
 obj-$(CONFIG_NFT_COUNTER)       += nft_counter.o
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 59a1a85bcb3e..a8eb0a89326a 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -871,11 +871,11 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
         cp->protocol       = p->protocol;
         ip_vs_addr_set(p->af, &cp->caddr, p->caddr);
         cp->cport          = p->cport;
-        ip_vs_addr_set(p->af, &cp->vaddr, p->vaddr);
-        cp->vport          = p->vport;
-        /* proto should only be IPPROTO_IP if d_addr is a fwmark */
+        /* proto should only be IPPROTO_IP if p->vaddr is a fwmark */
         ip_vs_addr_set(p->protocol == IPPROTO_IP ? AF_UNSPEC : p->af,
-                       &cp->daddr, daddr);
+                       &cp->vaddr, p->vaddr);
+        cp->vport          = p->vport;
+        ip_vs_addr_set(p->af, &cp->daddr, daddr);
         cp->dport          = dport;
         cp->flags          = flags;
         cp->fwmark         = fwmark;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 8824ed0ccc9c..356bef519fe5 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -312,6 +312,21 @@ static void death_by_timeout(unsigned long ul_conntrack)
         nf_ct_delete((struct nf_conn *)ul_conntrack, 0, 0);
 }
 
+static inline bool
+nf_ct_key_equal(struct nf_conntrack_tuple_hash *h,
+                        const struct nf_conntrack_tuple *tuple,
+                        u16 zone)
+{
+        struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
+
+        /* A conntrack can be recreated with the equal tuple,
+         * so we need to check that the conntrack is confirmed
+         */
+        return nf_ct_tuple_equal(tuple, &h->tuple) &&
+                nf_ct_zone(ct) == zone &&
+                nf_ct_is_confirmed(ct);
+}
+
 /*
  * Warning :
  * - Caller must take a reference on returned object
@@ -333,8 +348,7 @@ ____nf_conntrack_find(struct net *net, u16 zone,
         local_bh_disable();
 begin:
         hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[bucket], hnnode) {
-                if (nf_ct_tuple_equal(tuple, &h->tuple) &&
-                    nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)) == zone) {
+                if (nf_ct_key_equal(h, tuple, zone)) {
                         NF_CT_STAT_INC(net, found);
                         local_bh_enable();
                         return h;
@@ -372,8 +386,7 @@ begin:
                              !atomic_inc_not_zero(&ct->ct_general.use)))
                         h = NULL;
                 else {
-                        if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple) ||
-                                     nf_ct_zone(ct) != zone)) {
+                        if (unlikely(!nf_ct_key_equal(h, tuple, zone))) {
                                 nf_ct_put(ct);
                                 goto begin;
                         }
@@ -435,7 +448,9 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
                         goto out;
 
         add_timer(&ct->timeout);
-        nf_conntrack_get(&ct->ct_general);
+        smp_wmb();
+        /* The caller holds a reference to this object */
+        atomic_set(&ct->ct_general.use, 2);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
         NF_CT_STAT_INC(net, insert);
         spin_unlock_bh(&nf_conntrack_lock);
@@ -449,6 +464,21 @@ out:
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
+/* deletion from this larval template list happens via nf_ct_put() */
+void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl)
+{
+        __set_bit(IPS_TEMPLATE_BIT, &tmpl->status);
+        __set_bit(IPS_CONFIRMED_BIT, &tmpl->status);
+        nf_conntrack_get(&tmpl->ct_general);
+
+        spin_lock_bh(&nf_conntrack_lock);
+        /* Overload tuple linked list to put us in template list. */
+        hlist_nulls_add_head_rcu(&tmpl->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
+                                 &net->ct.tmpl);
+        spin_unlock_bh(&nf_conntrack_lock);
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_tmpl_insert);
+
 /* Confirm a connection given skb; places it in hash table */
 int
 __nf_conntrack_confirm(struct sk_buff *skb)
@@ -720,11 +750,10 @@ __nf_conntrack_alloc(struct net *net, u16 zone,
                 nf_ct_zone->id = zone;
         }
 #endif
-        /*
-         * changes to lookup keys must be done before setting refcnt to 1
+        /* Because we use RCU lookups, we set ct_general.use to zero before
+         * this is inserted in any list.
          */
-        smp_wmb();
-        atomic_set(&ct->ct_general.use, 1);
+        atomic_set(&ct->ct_general.use, 0);
         return ct;
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
@@ -748,6 +777,11 @@ void nf_conntrack_free(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
 
+        /* A freed object has refcnt == 0, that's
+         * the golden rule for SLAB_DESTROY_BY_RCU
+         */
+        NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 0);
+
         nf_ct_ext_destroy(ct);
         nf_ct_ext_free(ct);
         kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
@@ -843,6 +877,9 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
                 NF_CT_STAT_INC(net, new);
         }
 
+        /* Now it is inserted into the unconfirmed list, bump refcount */
+        nf_conntrack_get(&ct->ct_general);
+
         /* Overload tuple linked list to put us in unconfirmed list. */
         hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
                        &net->ct.unconfirmed);
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 9858e3e51a3a..52e20c9a46a5 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -363,9 +363,8 @@ static int __net_init synproxy_net_init(struct net *net)
                 goto err2;
         if (!nfct_synproxy_ext_add(ct))
                 goto err2;
-        __set_bit(IPS_TEMPLATE_BIT, &ct->status);
-        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
 
+        nf_conntrack_tmpl_insert(net, ct);
         snet->tmpl = ct;
 
         snet->stats = alloc_percpu(struct synproxy_stats);
@@ -390,7 +389,7 @@ static void __net_exit synproxy_net_exit(struct net *net)
 {
         struct synproxy_net *snet = synproxy_pernet(net);
 
-        nf_conntrack_free(snet->tmpl);
+        nf_ct_put(snet->tmpl);
         synproxy_proc_exit(net);
         free_percpu(snet->stats);
 }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 117bbaaddde6..adce01e8bb57 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1008,10 +1008,8 @@ notify:
         return 0;
 }
 
-static void nf_tables_rcu_chain_destroy(struct rcu_head *head)
+static void nf_tables_chain_destroy(struct nft_chain *chain)
 {
-        struct nft_chain *chain = container_of(head, struct nft_chain, rcu_head);
-
         BUG_ON(chain->use > 0);
 
         if (chain->flags & NFT_BASE_CHAIN) {
@@ -1045,7 +1043,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
         if (IS_ERR(chain))
                 return PTR_ERR(chain);
 
-        if (!list_empty(&chain->rules))
+        if (!list_empty(&chain->rules) || chain->use > 0)
                 return -EBUSY;
 
         list_del(&chain->list);
@@ -1059,7 +1057,9 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
                                family);
 
         /* Make sure all rule references are gone before this is released */
-        call_rcu(&chain->rcu_head, nf_tables_rcu_chain_destroy);
+        synchronize_rcu();
+
+        nf_tables_chain_destroy(chain);
         return 0;
 }
 
@@ -1114,35 +1114,45 @@ void nft_unregister_expr(struct nft_expr_type *type)
 }
 EXPORT_SYMBOL_GPL(nft_unregister_expr);
 
-static const struct nft_expr_type *__nft_expr_type_get(struct nlattr *nla)
+static const struct nft_expr_type *__nft_expr_type_get(u8 family,
+                                                       struct nlattr *nla)
 {
         const struct nft_expr_type *type;
 
         list_for_each_entry(type, &nf_tables_expressions, list) {
-                if (!nla_strcmp(nla, type->name))
+                if (!nla_strcmp(nla, type->name) &&
+                    (!type->family || type->family == family))
                         return type;
         }
         return NULL;
 }
 
-static const struct nft_expr_type *nft_expr_type_get(struct nlattr *nla)
+static const struct nft_expr_type *nft_expr_type_get(u8 family,
+                                                     struct nlattr *nla)
 {
         const struct nft_expr_type *type;
 
         if (nla == NULL)
                 return ERR_PTR(-EINVAL);
 
-        type = __nft_expr_type_get(nla);
+        type = __nft_expr_type_get(family, nla);
         if (type != NULL && try_module_get(type->owner))
                 return type;
 
 #ifdef CONFIG_MODULES
         if (type == NULL) {
                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
+                request_module("nft-expr-%u-%.*s", family,
+                               nla_len(nla), (char *)nla_data(nla));
+                nfnl_lock(NFNL_SUBSYS_NFTABLES);
+                if (__nft_expr_type_get(family, nla))
+                        return ERR_PTR(-EAGAIN);
+
+                nfnl_unlock(NFNL_SUBSYS_NFTABLES);
                 request_module("nft-expr-%.*s",
                                nla_len(nla), (char *)nla_data(nla));
                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
-                if (__nft_expr_type_get(nla))
+                if (__nft_expr_type_get(family, nla))
                         return ERR_PTR(-EAGAIN);
         }
 #endif
@@ -1193,7 +1203,7 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx,
         if (err < 0)
                 return err;
 
-        type = nft_expr_type_get(tb[NFTA_EXPR_NAME]);
+        type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
         if (IS_ERR(type))
                 return PTR_ERR(type);
 
@@ -1521,9 +1531,8 @@ err:
         return err;
 }
 
-static void nf_tables_rcu_rule_destroy(struct rcu_head *head)
+static void nf_tables_rule_destroy(struct nft_rule *rule)
 {
-        struct nft_rule *rule = container_of(head, struct nft_rule, rcu_head);
         struct nft_expr *expr;
 
         /*
@@ -1538,11 +1547,6 @@ static void nf_tables_rcu_rule_destroy(struct rcu_head *head)
         kfree(rule);
 }
 
-static void nf_tables_rule_destroy(struct nft_rule *rule)
-{
-        call_rcu(&rule->rcu_head, nf_tables_rcu_rule_destroy);
-}
-
 #define NFT_RULE_MAXEXPRS       128
 
 static struct nft_expr_info *info;
@@ -1809,9 +1813,6 @@ static int nf_tables_commit(struct sk_buff *skb)
         synchronize_rcu();
 
         list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
-                /* Delete this rule from the dirty list */
-                list_del(&rupd->list);
-
                 /* This rule was inactive in the past and just became active.
                  * Clear the next bit of the genmask since its meaning has
                  * changed, now it is the future.
@@ -1822,6 +1823,7 @@ static int nf_tables_commit(struct sk_buff *skb)
                                               rupd->chain, rupd->rule,
                                               NFT_MSG_NEWRULE, 0,
                                               rupd->family);
+                        list_del(&rupd->list);
                         kfree(rupd);
                         continue;
                 }
@@ -1831,7 +1833,15 @@ static int nf_tables_commit(struct sk_buff *skb)
                 nf_tables_rule_notify(skb, rupd->nlh, rupd->table, rupd->chain,
                                       rupd->rule, NFT_MSG_DELRULE, 0,
                                       rupd->family);
+        }
+
+        /* Make sure we don't see any packet traversing old rules */
+        synchronize_rcu();
+
+        /* Now we can safely release unused old rules */
+        list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
                 nf_tables_rule_destroy(rupd->rule);
+                list_del(&rupd->list);
                 kfree(rupd);
         }
 
@@ -1844,20 +1854,26 @@ static int nf_tables_abort(struct sk_buff *skb)
         struct nft_rule_trans *rupd, *tmp;
 
         list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
-                /* Delete all rules from the dirty list */
-                list_del(&rupd->list);
-
                 if (!nft_rule_is_active_next(net, rupd->rule)) {
                         nft_rule_clear(net, rupd->rule);
+                        list_del(&rupd->list);
                         kfree(rupd);
                         continue;
                 }
 
                 /* This rule is inactive, get rid of it */
                 list_del_rcu(&rupd->rule->list);
+        }
+
+        /* Make sure we don't see any packet accessing aborted rules */
+        synchronize_rcu();
+
+        list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
                 nf_tables_rule_destroy(rupd->rule);
+                list_del(&rupd->list);
                 kfree(rupd);
         }
+
         return 0;
 }
 
@@ -1943,6 +1959,9 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
         }
 
         if (nla[NFTA_SET_TABLE] != NULL) {
+                if (afi == NULL)
+                        return -EAFNOSUPPORT;
+
                 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
                 if (IS_ERR(table))
                         return PTR_ERR(table);
@@ -1989,13 +2008,13 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
 
                         if (!sscanf(i->name, name, &tmp))
                                 continue;
-                        if (tmp < 0 || tmp > BITS_PER_LONG * PAGE_SIZE)
+                        if (tmp < 0 || tmp >= BITS_PER_BYTE * PAGE_SIZE)
                                 continue;
 
                         set_bit(tmp, inuse);
                 }
 
-                n = find_first_zero_bit(inuse, BITS_PER_LONG * PAGE_SIZE);
+                n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
                 free_page((unsigned long)inuse);
         }
 
@@ -2428,6 +2447,8 @@ static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
         struct nft_ctx ctx;
         int err;
 
+        if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
+                return -EAFNOSUPPORT;
         if (nla[NFTA_SET_TABLE] == NULL)
                 return -EINVAL;
 
@@ -2435,9 +2456,6 @@ static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
-                return -EAFNOSUPPORT;
-
         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
         if (IS_ERR(set))
                 return PTR_ERR(set);
@@ -2723,6 +2741,9 @@ static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
                 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
                     !(elem.flags & NFT_SET_ELEM_INTERVAL_END))
                         return -EINVAL;
+                if (nla[NFTA_SET_ELEM_DATA] != NULL &&
+                    elem.flags & NFT_SET_ELEM_INTERVAL_END)
+                        return -EINVAL;
         } else {
                 if (nla[NFTA_SET_ELEM_DATA] != NULL)
                         return -EINVAL;
@@ -2977,6 +2998,9 @@ static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
                                         const struct nft_set_iter *iter,
                                         const struct nft_set_elem *elem)
 {
+        if (elem->flags & NFT_SET_ELEM_INTERVAL_END)
+                return 0;
+
         switch (elem->data.verdict) {
         case NFT_JUMP:
         case NFT_GOTO:
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 0d879fcb8763..90998a6ff8b9 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -103,9 +103,9 @@ static struct nf_loginfo trace_loginfo = {
         },
 };
 
-static inline void nft_trace_packet(const struct nft_pktinfo *pkt,
-                                    const struct nft_chain *chain,
-                                    int rulenum, enum nft_trace type)
+static void nft_trace_packet(const struct nft_pktinfo *pkt,
+                             const struct nft_chain *chain,
+                             int rulenum, enum nft_trace type)
 {
         struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 917052e20602..46e275403838 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -226,6 +226,7 @@ static int nft_ct_init_validate_get(const struct nft_expr *expr,
                 if (tb[NFTA_CT_DIRECTION] != NULL)
                         return -EINVAL;
                 break;
+        case NFT_CT_L3PROTOCOL:
         case NFT_CT_PROTOCOL:
         case NFT_CT_SRC:
         case NFT_CT_DST:
@@ -311,8 +312,19 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
                 goto nla_put_failure;
         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
                 goto nla_put_failure;
-        if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
-                goto nla_put_failure;
+
+        switch (priv->key) {
+        case NFT_CT_PROTOCOL:
+        case NFT_CT_SRC:
+        case NFT_CT_DST:
+        case NFT_CT_PROTO_SRC:
+        case NFT_CT_PROTO_DST:
+                if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
+                        goto nla_put_failure;
+        default:
+                break;
+        }
+
         return 0;
 
 nla_put_failure:
diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 5af790123ad8..26c5154e05f3 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -23,7 +23,6 @@ static const char *nft_log_null_prefix = "";
 struct nft_log {
         struct nf_loginfo       loginfo;
         char                    *prefix;
-        int                     family;
 };
 
 static void nft_log_eval(const struct nft_expr *expr,
@@ -33,7 +32,7 @@ static void nft_log_eval(const struct nft_expr *expr,
         const struct nft_log *priv = nft_expr_priv(expr);
         struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-        nf_log_packet(net, priv->family, pkt->ops->hooknum, pkt->skb, pkt->in,
+        nf_log_packet(net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in,
                       pkt->out, &priv->loginfo, "%s", priv->prefix);
 }
 
@@ -52,8 +51,6 @@ static int nft_log_init(const struct nft_ctx *ctx,
         struct nf_loginfo *li = &priv->loginfo;
         const struct nlattr *nla;
 
-        priv->family = ctx->afi->family;
-
         nla = tb[NFTA_LOG_PREFIX];
         if (nla != NULL) {
                 priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 8a6116b75b5a..bb4ef4cccb6e 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -16,6 +16,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables_core.h>
 
 struct nft_lookup {
         struct nft_set                  *set;
diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
index cbea473d69e9..e8ae2f6bf232 100644
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -25,7 +25,6 @@ struct nft_queue {
         u16     queuenum;
         u16     queues_total;
         u16     flags;
-        u8      family;
 };
 
 static void nft_queue_eval(const struct nft_expr *expr,
@@ -43,7 +42,7 @@ static void nft_queue_eval(const struct nft_expr *expr,
                         queue = priv->queuenum + cpu % priv->queues_total;
                 } else {
                         queue = nfqueue_hash(pkt->skb, queue,
-                                             priv->queues_total, priv->family,
+                                             priv->queues_total, pkt->ops->pf,
                                              jhash_initval);
                 }
         }
@@ -71,7 +70,6 @@ static int nft_queue_init(const struct nft_ctx *ctx,
                 return -EINVAL;
 
         init_hashrandom(&jhash_initval);
-        priv->family = ctx->afi->family;
         priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
 
         if (tb[NFTA_QUEUE_TOTAL] != NULL)
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index ca0c1b231bfe..e21d69d13506 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -69,8 +69,10 @@ static void nft_rbtree_elem_destroy(const struct nft_set *set,
                                     struct nft_rbtree_elem *rbe)
 {
         nft_data_uninit(&rbe->key, NFT_DATA_VALUE);
-        if (set->flags & NFT_SET_MAP)
+        if (set->flags & NFT_SET_MAP &&
+            !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                 nft_data_uninit(rbe->data, set->dtype);
+
         kfree(rbe);
 }
 
@@ -108,7 +110,8 @@ static int nft_rbtree_insert(const struct nft_set *set,
         int err;
 
         size = sizeof(*rbe);
-        if (set->flags & NFT_SET_MAP)
+        if (set->flags & NFT_SET_MAP &&
+            !(elem->flags & NFT_SET_ELEM_INTERVAL_END))
                 size += sizeof(rbe->data[0]);
 
         rbe = kzalloc(size, GFP_KERNEL);
@@ -117,7 +120,8 @@ static int nft_rbtree_insert(const struct nft_set *set,
 
         rbe->flags = elem->flags;
         nft_data_copy(&rbe->key, &elem->key);
-        if (set->flags & NFT_SET_MAP)
+        if (set->flags & NFT_SET_MAP &&
+            !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                 nft_data_copy(rbe->data, &elem->data);
 
         err = __nft_rbtree_insert(set, rbe);
@@ -153,7 +157,8 @@ static int nft_rbtree_get(const struct nft_set *set, struct nft_set_elem *elem)
                         parent = parent->rb_right;
                 else {
                         elem->cookie = rbe;
-                        if (set->flags & NFT_SET_MAP)
+                        if (set->flags & NFT_SET_MAP &&
+                            !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                                 nft_data_copy(&elem->data, rbe->data);
                         elem->flags = rbe->flags;
                         return 0;
@@ -177,7 +182,8 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
 
                 rbe = rb_entry(node, struct nft_rbtree_elem, node);
                 nft_data_copy(&elem.key, &rbe->key);
-                if (set->flags & NFT_SET_MAP)
+                if (set->flags & NFT_SET_MAP &&
+                    !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                         nft_data_copy(&elem.data, rbe->data);
                 elem.flags = rbe->flags;
 
diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index 5e204711d704..f3448c296446 100644
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -16,65 +16,23 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
-#include <net/icmp.h>
-#include <net/netfilter/ipv4/nf_reject.h>
+#include <net/netfilter/nft_reject.h>
 
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
-#include <net/netfilter/ipv6/nf_reject.h>
-#endif
-
-struct nft_reject {
-        enum nft_reject_types   type:8;
-        u8                      icmp_code;
-        u8                      family;
-};
-
-static void nft_reject_eval(const struct nft_expr *expr,
-                              struct nft_data data[NFT_REG_MAX + 1],
-                              const struct nft_pktinfo *pkt)
-{
-        struct nft_reject *priv = nft_expr_priv(expr);
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
-        struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
-#endif
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                if (priv->family == NFPROTO_IPV4)
-                        nf_send_unreach(pkt->skb, priv->icmp_code);
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
-                else if (priv->family == NFPROTO_IPV6)
-                        nf_send_unreach6(net, pkt->skb, priv->icmp_code,
-                                      pkt->ops->hooknum);
-#endif
-                break;
-        case NFT_REJECT_TCP_RST:
-                if (priv->family == NFPROTO_IPV4)
-                        nf_send_reset(pkt->skb, pkt->ops->hooknum);
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
-                else if (priv->family == NFPROTO_IPV6)
-                        nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
-#endif
-                break;
-        }
-
-        data[NFT_REG_VERDICT].verdict = NF_DROP;
-}
-
-static const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
+const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
         [NFTA_REJECT_TYPE]              = { .type = NLA_U32 },
         [NFTA_REJECT_ICMP_CODE]         = { .type = NLA_U8 },
 };
+EXPORT_SYMBOL_GPL(nft_reject_policy);
 
-static int nft_reject_init(const struct nft_ctx *ctx,
-                           const struct nft_expr *expr,
-                           const struct nlattr * const tb[])
+int nft_reject_init(const struct nft_ctx *ctx,
+                    const struct nft_expr *expr,
+                    const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
 
-        priv->family = ctx->afi->family;
         priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
         switch (priv->type) {
         case NFT_REJECT_ICMP_UNREACH:
@@ -89,8 +47,9 @@ static int nft_reject_init(const struct nft_ctx *ctx,
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(nft_reject_init);
 
-static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
+int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         const struct nft_reject *priv = nft_expr_priv(expr);
 
@@ -109,37 +68,7 @@ static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 nla_put_failure:
         return -1;
 }
-
-static struct nft_expr_type nft_reject_type;
-static const struct nft_expr_ops nft_reject_ops = {
-        .type           = &nft_reject_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
-        .eval           = nft_reject_eval,
-        .init           = nft_reject_init,
-        .dump           = nft_reject_dump,
-};
-
-static struct nft_expr_type nft_reject_type __read_mostly = {
-        .name           = "reject",
-        .ops            = &nft_reject_ops,
-        .policy         = nft_reject_policy,
-        .maxattr        = NFTA_REJECT_MAX,
-        .owner          = THIS_MODULE,
-};
-
-static int __init nft_reject_module_init(void)
-{
-        return nft_register_expr(&nft_reject_type);
-}
-
-static void __exit nft_reject_module_exit(void)
-{
-        nft_unregister_expr(&nft_reject_type);
-}
-
-module_init(nft_reject_module_init);
-module_exit(nft_reject_module_exit);
+EXPORT_SYMBOL_GPL(nft_reject_dump);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_EXPR("reject");
diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
new file mode 100644
index 000000000000..8a310f239c93
--- /dev/null
+++ b/net/netfilter/nft_reject_inet.c
@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2014 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_reject.h>
+
+static void nft_reject_inet_eval(const struct nft_expr *expr,
+                                 struct nft_data data[NFT_REG_MAX + 1],
+                                 const struct nft_pktinfo *pkt)
+{
+        switch (pkt->ops->pf) {
+        case NFPROTO_IPV4:
+                nft_reject_ipv4_eval(expr, data, pkt);
+        case NFPROTO_IPV6:
+                nft_reject_ipv6_eval(expr, data, pkt);
+        }
+}
+
+static struct nft_expr_type nft_reject_inet_type;
+static const struct nft_expr_ops nft_reject_inet_ops = {
+        .type           = &nft_reject_inet_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
+        .eval           = nft_reject_inet_eval,
+        .init           = nft_reject_init,
+        .dump           = nft_reject_dump,
+};
+
+static struct nft_expr_type nft_reject_inet_type __read_mostly = {
+        .family         = NFPROTO_INET,
+        .name           = "reject",
+        .ops            = &nft_reject_inet_ops,
+        .policy         = nft_reject_policy,
+        .maxattr        = NFTA_REJECT_MAX,
+        .owner          = THIS_MODULE,
+};
+
+static int __init nft_reject_inet_module_init(void)
+{
+        return nft_register_expr(&nft_reject_inet_type);
+}
+
+static void __exit nft_reject_inet_module_exit(void)
+{
+        nft_unregister_expr(&nft_reject_inet_type);
+}
+
+module_init(nft_reject_inet_module_init);
+module_exit(nft_reject_inet_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS_NFT_AF_EXPR(1, "reject");
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 5929be622c5c..75747aecdebe 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -228,12 +228,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
                         goto err3;
         }
 
-        __set_bit(IPS_TEMPLATE_BIT, &ct->status);
-        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
-
-        /* Overload tuple linked list to put us in template list. */
-        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                                 &par->net->ct.tmpl);
+        nf_conntrack_tmpl_insert(par->net, ct);
 out:
         info->ct = ct;
         return 0;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index df4692826ead..e9a48baf8551 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -55,6 +55,7 @@
 
 #include "datapath.h"
 #include "flow.h"
+#include "flow_table.h"
 #include "flow_netlink.h"
 #include "vport-internal_dev.h"
 #include "vport-netdev.h"
@@ -160,7 +161,6 @@ static void destroy_dp_rcu(struct rcu_head *rcu)
 {
         struct datapath *dp = container_of(rcu, struct datapath, rcu);
 
-        ovs_flow_tbl_destroy(&dp->table);
         free_percpu(dp->stats_percpu);
         release_net(ovs_dp_get_net(dp));
         kfree(dp->ports);
@@ -466,6 +466,14 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
 
         skb_zerocopy(user_skb, skb, skb->len, hlen);
 
+        /* Pad OVS_PACKET_ATTR_PACKET if linear copy was performed */
+        if (!(dp->user_features & OVS_DP_F_UNALIGNED)) {
+                size_t plen = NLA_ALIGN(user_skb->len) - user_skb->len;
+
+                if (plen > 0)
+                        memset(skb_put(user_skb, plen), 0, plen);
+        }
+
         ((struct nlmsghdr *) user_skb->data)->nlmsg_len = user_skb->len;
 
         err = genlmsg_unicast(ovs_dp_get_net(dp), user_skb, upcall_info->portid);
@@ -852,11 +860,8 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
                         goto err_unlock_ovs;
 
                 /* The unmasked key has to be the same for flow updates. */
-                error = -EINVAL;
-                if (!ovs_flow_cmp_unmasked_key(flow, &match)) {
-                        OVS_NLERR("Flow modification message rejected, unmasked key does not match.\n");
+                if (!ovs_flow_cmp_unmasked_key(flow, &match))
                         goto err_unlock_ovs;
-                }
 
                 /* Update actions. */
                 old_acts = ovsl_dereference(flow->sf_acts);
@@ -1079,6 +1084,7 @@ static size_t ovs_dp_cmd_msg_size(void)
         msgsize += nla_total_size(IFNAMSIZ);
         msgsize += nla_total_size(sizeof(struct ovs_dp_stats));
         msgsize += nla_total_size(sizeof(struct ovs_dp_megaflow_stats));
+        msgsize += nla_total_size(sizeof(u32)); /* OVS_DP_ATTR_USER_FEATURES */
 
         return msgsize;
 }
@@ -1279,7 +1285,7 @@ err_destroy_ports_array:
 err_destroy_percpu:
         free_percpu(dp->stats_percpu);
 err_destroy_table:
-        ovs_flow_tbl_destroy(&dp->table);
+        ovs_flow_tbl_destroy(&dp->table, false);
 err_free_dp:
         release_net(ovs_dp_get_net(dp));
         kfree(dp);
@@ -1306,10 +1312,13 @@ static void __dp_destroy(struct datapath *dp)
         list_del_rcu(&dp->list_node);
 
         /* OVSP_LOCAL is datapath internal port. We need to make sure that
-         * all port in datapath are destroyed first before freeing datapath.
+         * all ports in datapath are destroyed first before freeing datapath.
          */
         ovs_dp_detach_port(ovs_vport_ovsl(dp, OVSP_LOCAL));
 
+        /* RCU destroy the flow table */
+        ovs_flow_tbl_destroy(&dp->table, true);
+
         call_rcu(&dp->rcu, destroy_dp_rcu);
 }
 
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index c58a0fe3c889..3c268b3d71c3 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -153,29 +153,29 @@ static void rcu_free_flow_callback(struct rcu_head *rcu)
         flow_free(flow);
 }
 
-static void flow_mask_del_ref(struct sw_flow_mask *mask, bool deferred)
-{
-        if (!mask)
-                return;
-
-        BUG_ON(!mask->ref_count);
-        mask->ref_count--;
-
-        if (!mask->ref_count) {
-                list_del_rcu(&mask->list);
-                if (deferred)
-                        kfree_rcu(mask, rcu);
-                else
-                        kfree(mask);
-        }
-}
-
 void ovs_flow_free(struct sw_flow *flow, bool deferred)
 {
         if (!flow)
                 return;
 
-        flow_mask_del_ref(flow->mask, deferred);
+        if (flow->mask) {
+                struct sw_flow_mask *mask = flow->mask;
+
+                /* ovs-lock is required to protect mask-refcount and
+                 * mask list.
+                 */
+                ASSERT_OVSL();
+                BUG_ON(!mask->ref_count);
+                mask->ref_count--;
+
+                if (!mask->ref_count) {
+                        list_del_rcu(&mask->list);
+                        if (deferred)
+                                kfree_rcu(mask, rcu);
+                        else
+                                kfree(mask);
+                }
+        }
 
         if (deferred)
                 call_rcu(&flow->rcu, rcu_free_flow_callback);
@@ -188,26 +188,9 @@ static void free_buckets(struct flex_array *buckets)
         flex_array_free(buckets);
 }
 
+
 static void __table_instance_destroy(struct table_instance *ti)
 {
-        int i;
-
-        if (ti->keep_flows)
-                goto skip_flows;
-
-        for (i = 0; i < ti->n_buckets; i++) {
-                struct sw_flow *flow;
-                struct hlist_head *head = flex_array_get(ti->buckets, i);
-                struct hlist_node *n;
-                int ver = ti->node_ver;
-
-                hlist_for_each_entry_safe(flow, n, head, hash_node[ver]) {
-                        hlist_del(&flow->hash_node[ver]);
-                        ovs_flow_free(flow, false);
-                }
-        }
-
-skip_flows:
         free_buckets(ti->buckets);
         kfree(ti);
 }
@@ -258,20 +241,38 @@ static void flow_tbl_destroy_rcu_cb(struct rcu_head *rcu)
 
 static void table_instance_destroy(struct table_instance *ti, bool deferred)
 {
+        int i;
+
         if (!ti)
                 return;
 
+        if (ti->keep_flows)
+                goto skip_flows;
+
+        for (i = 0; i < ti->n_buckets; i++) {
+                struct sw_flow *flow;
+                struct hlist_head *head = flex_array_get(ti->buckets, i);
+                struct hlist_node *n;
+                int ver = ti->node_ver;
+
+                hlist_for_each_entry_safe(flow, n, head, hash_node[ver]) {
+                        hlist_del_rcu(&flow->hash_node[ver]);
+                        ovs_flow_free(flow, deferred);
+                }
+        }
+
+skip_flows:
         if (deferred)
                 call_rcu(&ti->rcu, flow_tbl_destroy_rcu_cb);
         else
                 __table_instance_destroy(ti);
 }
 
-void ovs_flow_tbl_destroy(struct flow_table *table)
+void ovs_flow_tbl_destroy(struct flow_table *table, bool deferred)
 {
         struct table_instance *ti = ovsl_dereference(table->ti);
 
-        table_instance_destroy(ti, false);
+        table_instance_destroy(ti, deferred);
 }
 
 struct sw_flow *ovs_flow_tbl_dump_next(struct table_instance *ti,
@@ -504,16 +505,11 @@ static struct sw_flow_mask *mask_alloc(void)
 
         mask = kmalloc(sizeof(*mask), GFP_KERNEL);
         if (mask)
-                mask->ref_count = 0;
+                mask->ref_count = 1;
 
         return mask;
 }
 
-static void mask_add_ref(struct sw_flow_mask *mask)
-{
-        mask->ref_count++;
-}
-
 static bool mask_equal(const struct sw_flow_mask *a,
                        const struct sw_flow_mask *b)
 {
@@ -554,9 +550,11 @@ static int flow_mask_insert(struct flow_table *tbl, struct sw_flow *flow,
                 mask->key = new->key;
                 mask->range = new->range;
                 list_add_rcu(&mask->list, &tbl->mask_list);
+        } else {
+                BUG_ON(!mask->ref_count);
+                mask->ref_count++;
         }
 
-        mask_add_ref(mask);
         flow->mask = mask;
         return 0;
 }
diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
index 1996e34c0fd8..baaeb101924d 100644
--- a/net/openvswitch/flow_table.h
+++ b/net/openvswitch/flow_table.h
@@ -60,7 +60,7 @@ void ovs_flow_free(struct sw_flow *, bool deferred);
 
 int ovs_flow_tbl_init(struct flow_table *);
 int ovs_flow_tbl_count(struct flow_table *table);
-void ovs_flow_tbl_destroy(struct flow_table *table);
+void ovs_flow_tbl_destroy(struct flow_table *table, bool deferred);
 int ovs_flow_tbl_flush(struct flow_table *flow_table);
 
 int ovs_flow_tbl_insert(struct flow_table *table, struct sw_flow *flow,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6a2bb37506c5..48a6a93db296 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -308,11 +308,27 @@ static bool packet_use_direct_xmit(const struct packet_sock *po)
         return po->xmit == packet_direct_xmit;
 }
 
-static u16 packet_pick_tx_queue(struct net_device *dev)
+static u16 __packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
 {
         return (u16) raw_smp_processor_id() % dev->real_num_tx_queues;
 }
 
+static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+        u16 queue_index;
+
+        if (ops->ndo_select_queue) {
+                queue_index = ops->ndo_select_queue(dev, skb, NULL,
+                                                    __packet_pick_tx_queue);
+                queue_index = netdev_cap_txqueue(dev, queue_index);
+        } else {
+                queue_index = __packet_pick_tx_queue(dev, skb);
+        }
+
+        skb_set_queue_mapping(skb, queue_index);
+}
+
 /* register_prot_hook must be invoked with the po->bind_lock held,
  * or from a context in which asynchronous accesses to the packet
  * socket is not possible (packet_create()).
@@ -2285,7 +2301,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                         }
                 }
 
-                skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
+                packet_pick_tx_queue(dev, skb);
+
                 skb->destructor = tpacket_destruct_skb;
                 __packet_set_status(po, ph, TP_STATUS_SENDING);
                 packet_inc_pending(&po->tx_ring);
@@ -2499,7 +2516,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         skb->dev = dev;
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
-        skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
+
+        packet_pick_tx_queue(dev, skb);
 
         if (po->has_vnet_hdr) {
                 if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
@@ -3786,7 +3804,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                  */
                         if (!tx_ring)
                                 init_prb_bdqc(po, rb, pg_vec, req_u, tx_ring);
-                                break;
+                        break;
                 default:
                         break;
                 }
diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
index a255d0200a59..fefeeb73f15f 100644
--- a/net/sched/sch_pie.c
+++ b/net/sched/sch_pie.c
@@ -15,6 +15,11 @@
  *
  * ECN support is added by Naeem Khademi <naeemk@ifi.uio.no>
  * University of Oslo, Norway.
+ *
+ * References:
+ * IETF draft submission: http://tools.ietf.org/html/draft-pan-aqm-pie-00
+ * IEEE  Conference on High Performance Switching and Routing 2013 :
+ * "PIE: A * Lightweight Control Scheme to Address the Bufferbloat Problem"
  */
 
 #include <linux/module.h>
@@ -36,7 +41,7 @@ struct pie_params {
         psched_time_t target;   /* user specified target delay in pschedtime */
         u32 tupdate;            /* timer frequency (in jiffies) */
         u32 limit;              /* number of packets that can be enqueued */
-        u32 alpha;              /* alpha and beta are between -4 and 4 */
+        u32 alpha;              /* alpha and beta are between 0 and 32 */
         u32 beta;               /* and are used for shift relative to 1 */
         bool ecn;               /* true if ecn is enabled */
         bool bytemode;          /* to scale drop early prob based on pkt size */
@@ -326,10 +331,16 @@ static void calculate_probability(struct Qdisc *sch)
         if (qdelay == 0 && qlen != 0)
                 update_prob = false;
 
-        /* Add ranges for alpha and beta, more aggressive for high dropping
-         * mode and gentle steps for light dropping mode
-         * In light dropping mode, take gentle steps; in medium dropping mode,
-         * take medium steps; in high dropping mode, take big steps.
+        /* In the algorithm, alpha and beta are between 0 and 2 with typical
+         * value for alpha as 0.125. In this implementation, we use values 0-32
+         * passed from user space to represent this. Also, alpha and beta have
+         * unit of HZ and need to be scaled before they can used to update
+         * probability. alpha/beta are updated locally below by 1) scaling them
+         * appropriately 2) scaling down by 16 to come to 0-2 range.
+         * Please see paper for details.
+         *
+         * We scale alpha and beta differently depending on whether we are in
+         * light, medium or high dropping mode.
          */
         if (q->vars.prob < MAX_PROB / 100) {
                 alpha =
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 5ae609200674..f558433537b8 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1367,44 +1367,35 @@ static inline bool sctp_peer_needs_update(struct sctp_association *asoc)
         return false;
 }
 
-/* Increase asoc's rwnd by len and send any window update SACK if needed. */
-void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
+/* Update asoc's rwnd for the approximated state in the buffer,
+ * and check whether SACK needs to be sent.
+ */
+void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
 {
+        int rx_count;
         struct sctp_chunk *sack;
         struct timer_list *timer;
 
-        if (asoc->rwnd_over) {
-                if (asoc->rwnd_over >= len) {
-                        asoc->rwnd_over -= len;
-                } else {
-                        asoc->rwnd += (len - asoc->rwnd_over);
-                        asoc->rwnd_over = 0;
-                }
-        } else {
-                asoc->rwnd += len;
-        }
+        if (asoc->ep->rcvbuf_policy)
+                rx_count = atomic_read(&asoc->rmem_alloc);
+        else
+                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
 
-        /* If we had window pressure, start recovering it
-         * once our rwnd had reached the accumulated pressure
-         * threshold.  The idea is to recover slowly, but up
-         * to the initial advertised window.
-         */
-        if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) {
-                int change = min(asoc->pathmtu, asoc->rwnd_press);
-                asoc->rwnd += change;
-                asoc->rwnd_press -= change;
-        }
+        if ((asoc->base.sk->sk_rcvbuf - rx_count) > 0)
+                asoc->rwnd = (asoc->base.sk->sk_rcvbuf - rx_count) >> 1;
+        else
+                asoc->rwnd = 0;
 
-        pr_debug("%s: asoc:%p rwnd increased by %d to (%u, %u) - %u\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
-                 asoc->a_rwnd);
+        pr_debug("%s: asoc:%p rwnd=%u, rx_count=%d, sk_rcvbuf=%d\n",
+                 __func__, asoc, asoc->rwnd, rx_count,
+                 asoc->base.sk->sk_rcvbuf);
 
         /* Send a window update SACK if the rwnd has increased by at least the
          * minimum of the association's PMTU and half of the receive buffer.
          * The algorithm used is similar to the one described in
          * Section 4.2.3.3 of RFC 1122.
          */
-        if (sctp_peer_needs_update(asoc)) {
+        if (update_peer && sctp_peer_needs_update(asoc)) {
                 asoc->a_rwnd = asoc->rwnd;
 
                 pr_debug("%s: sending window update SACK- asoc:%p rwnd:%u "
@@ -1426,45 +1417,6 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
         }
 }
 
-/* Decrease asoc's rwnd by len. */
-void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
-{
-        int rx_count;
-        int over = 0;
-
-        if (unlikely(!asoc->rwnd || asoc->rwnd_over))
-                pr_debug("%s: association:%p has asoc->rwnd:%u, "
-                         "asoc->rwnd_over:%u!\n", __func__, asoc,
-                         asoc->rwnd, asoc->rwnd_over);
-
-        if (asoc->ep->rcvbuf_policy)
-                rx_count = atomic_read(&asoc->rmem_alloc);
-        else
-                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
-
-        /* If we've reached or overflowed our receive buffer, announce
-         * a 0 rwnd if rwnd would still be positive.  Store the
-         * the potential pressure overflow so that the window can be restored
-         * back to original value.
-         */
-        if (rx_count >= asoc->base.sk->sk_rcvbuf)
-                over = 1;
-
-        if (asoc->rwnd >= len) {
-                asoc->rwnd -= len;
-                if (over) {
-                        asoc->rwnd_press += asoc->rwnd;
-                        asoc->rwnd = 0;
-                }
-        } else {
-                asoc->rwnd_over = len - asoc->rwnd;
-                asoc->rwnd = 0;
-        }
-
-        pr_debug("%s: asoc:%p rwnd decreased by %d to (%u, %u, %u)\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
-                 asoc->rwnd_press);
-}
 
 /* Build the bind address list for the association based on info from the
  * local endpoint and the remote peer.
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 0f6259a6a932..2b1738ef9394 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -662,6 +662,8 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
          */
         sctp_v6_to_sk_daddr(&asoc->peer.primary_addr, newsk);
 
+        newsk->sk_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+
         sk_refcnt_debug_inc(newsk);
 
         if (newsk->sk_prot->init(newsk)) {
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 483dcd71b3c5..591b44d3b7de 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -6176,7 +6176,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * PMTU.  In cases, such as loopback, this might be a rather
          * large spill over.
          */
-        if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
+        if ((!chunk->data_accepted) && (!asoc->rwnd ||
             (datalen > asoc->rwnd + asoc->frag_point))) {
 
                 /* If this is the next TSN, consider reneging to make
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e91d6e5df63..981aaf8b6ace 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -64,6 +64,7 @@
 #include <linux/crypto.h>
 #include <linux/slab.h>
 #include <linux/file.h>
+#include <linux/compat.h>
 
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -1368,11 +1369,19 @@ static int sctp_setsockopt_connectx(struct sock *sk,
 /*
  * New (hopefully final) interface for the API.
  * We use the sctp_getaddrs_old structure so that use-space library
- * can avoid any unnecessary allocations.   The only defferent part
+ * can avoid any unnecessary allocations. The only different part
  * is that we store the actual length of the address buffer into the
- * addrs_num structure member.  That way we can re-use the existing
+ * addrs_num structure member. That way we can re-use the existing
  * code.
  */
+#ifdef CONFIG_COMPAT
+struct compat_sctp_getaddrs_old {
+        sctp_assoc_t    assoc_id;
+        s32             addr_num;
+        compat_uptr_t   addrs;          /* struct sockaddr * */
+};
+#endif
+
 static int sctp_getsockopt_connectx3(struct sock *sk, int len,
                                      char __user *optval,
                                      int __user *optlen)
@@ -1381,16 +1390,30 @@ static int sctp_getsockopt_connectx3(struct sock *sk, int len,
         sctp_assoc_t assoc_id = 0;
         int err = 0;
 
-        if (len < sizeof(param))
-                return -EINVAL;
+#ifdef CONFIG_COMPAT
+        if (is_compat_task()) {
+                struct compat_sctp_getaddrs_old param32;
 
-        if (copy_from_user(&param, optval, sizeof(param)))
-                return -EFAULT;
+                if (len < sizeof(param32))
+                        return -EINVAL;
+                if (copy_from_user(&param32, optval, sizeof(param32)))
+                        return -EFAULT;
 
-        err = __sctp_setsockopt_connectx(sk,
-                        (struct sockaddr __user *)param.addrs,
-                        param.addr_num, &assoc_id);
+                param.assoc_id = param32.assoc_id;
+                param.addr_num = param32.addr_num;
+                param.addrs = compat_ptr(param32.addrs);
+        } else
+#endif
+        {
+                if (len < sizeof(param))
+                        return -EINVAL;
+                if (copy_from_user(&param, optval, sizeof(param)))
+                        return -EFAULT;
+        }
 
+        err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
+                                         param.addrs, param.addr_num,
+                                         &assoc_id);
         if (err == 0 || err == -EINPROGRESS) {
                 if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
                         return -EFAULT;
@@ -2092,12 +2115,6 @@ static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
                 sctp_skb_pull(skb, copied);
                 skb_queue_head(&sk->sk_receive_queue, skb);
 
-                /* When only partial message is copied to the user, increase
-                 * rwnd by that amount. If all the data in the skb is read,
-                 * rwnd is updated when the event is freed.
-                 */
-                if (!sctp_ulpevent_is_notification(event))
-                        sctp_assoc_rwnd_increase(event->asoc, copied);
                 goto out;
         } else if ((event->msg_flags & MSG_NOTIFICATION) ||
                    (event->msg_flags & MSG_EOR))
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 7135e617ab0f..35c8923b5554 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -151,6 +151,7 @@ static struct ctl_table sctp_net_table[] = {
         },
         {
                 .procname       = "cookie_hmac_alg",
+                .data           = &init_net.sctp.sctp_hmac_alg,
                 .maxlen         = 8,
                 .mode           = 0644,
                 .proc_handler   = proc_sctp_do_hmac_alg,
@@ -401,15 +402,18 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
 
 int sctp_sysctl_net_register(struct net *net)
 {
-        struct ctl_table *table;
-        int i;
+        struct ctl_table *table = sctp_net_table;
+
+        if (!net_eq(net, &init_net)) {
+                int i;
 
-        table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
-        if (!table)
-                return -ENOMEM;
+                table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
+                if (!table)
+                        return -ENOMEM;
 
-        for (i = 0; table[i].data; i++)
-                table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
+                for (i = 0; table[i].data; i++)
+                        table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
+        }
 
         net->sctp.sysctl_header = register_net_sysctl(net, "net/sctp", table);
         return 0;
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 85c64658bd0b..8d198ae03606 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -989,7 +989,7 @@ static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
         skb = sctp_event2skb(event);
         /* Set the owner and charge rwnd for bytes received.  */
         sctp_ulpevent_set_owner(event, asoc);
-        sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
+        sctp_assoc_rwnd_update(asoc, false);
 
         if (!skb->data_len)
                 return;
@@ -1011,6 +1011,7 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
         struct sk_buff *skb, *frag;
         unsigned int    len;
+        struct sctp_association *asoc;
 
         /* Current stack structures assume that the rcv buffer is
          * per socket.   For UDP style sockets this is not true as
@@ -1035,8 +1036,11 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
         }
 
 done:
-        sctp_assoc_rwnd_increase(event->asoc, len);
+        asoc = event->asoc;
+        sctp_association_hold(asoc);
         sctp_ulpevent_release_owner(event);
+        sctp_assoc_rwnd_update(asoc, true);
+        sctp_association_put(asoc);
 }
 
 static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 6c0513a7f992..36e431ee1c90 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -108,6 +108,7 @@ struct gss_auth {
 static DEFINE_SPINLOCK(pipe_version_lock);
 static struct rpc_wait_queue pipe_version_rpc_waitqueue;
 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
+static void gss_put_auth(struct gss_auth *gss_auth);
 
 static void gss_free_ctx(struct gss_cl_ctx *);
 static const struct rpc_pipe_ops gss_upcall_ops_v0;
@@ -320,6 +321,7 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
         if (gss_msg->ctx != NULL)
                 gss_put_ctx(gss_msg->ctx);
         rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
+        gss_put_auth(gss_msg->auth);
         kfree(gss_msg);
 }
 
@@ -498,9 +500,12 @@ gss_alloc_msg(struct gss_auth *gss_auth,
         default:
                 err = gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
                 if (err)
-                        goto err_free_msg;
+                        goto err_put_pipe_version;
         };
+        kref_get(&gss_auth->kref);
         return gss_msg;
+err_put_pipe_version:
+        put_pipe_version(gss_auth->net);
 err_free_msg:
         kfree(gss_msg);
 err:
@@ -991,6 +996,8 @@ gss_create_new(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
         gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
         if (gss_auth->service == 0)
                 goto err_put_mech;
+        if (!gssd_running(gss_auth->net))
+                goto err_put_mech;
         auth = &gss_auth->rpc_auth;
         auth->au_cslack = GSS_CRED_SLACK >> 2;
         auth->au_rslack = GSS_VERF_SLACK >> 2;
@@ -1062,6 +1069,12 @@ gss_free_callback(struct kref *kref)
 }
 
 static void
+gss_put_auth(struct gss_auth *gss_auth)
+{
+        kref_put(&gss_auth->kref, gss_free_callback);
+}
+
+static void
 gss_destroy(struct rpc_auth *auth)
 {
         struct gss_auth *gss_auth = container_of(auth,
@@ -1082,7 +1095,7 @@ gss_destroy(struct rpc_auth *auth)
         gss_auth->gss_pipe[1] = NULL;
         rpcauth_destroy_credcache(auth);
 
-        kref_put(&gss_auth->kref, gss_free_callback);
+        gss_put_auth(gss_auth);
 }
 
 /*
@@ -1253,7 +1266,7 @@ gss_destroy_nullcred(struct rpc_cred *cred)
         call_rcu(&cred->cr_rcu, gss_free_cred_callback);
         if (ctx)
                 gss_put_ctx(ctx);
-        kref_put(&gss_auth->kref, gss_free_callback);
+        gss_put_auth(gss_auth);
 }
 
 static void
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 890a29912d5a..e860d4f7ed2a 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -64,7 +64,6 @@ static void xprt_free_allocation(struct rpc_rqst *req)
         free_page((unsigned long)xbufp->head[0].iov_base);
         xbufp = &req->rq_snd_buf;
         free_page((unsigned long)xbufp->head[0].iov_base);
-        list_del(&req->rq_bc_pa_list);
         kfree(req);
 }
 
@@ -168,8 +167,10 @@ out_free:
         /*
          * Memory allocation failed, free the temporary list
          */
-        list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list)
+        list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list) {
+                list_del(&req->rq_bc_pa_list);
                 xprt_free_allocation(req);
+        }
 
         dprintk("RPC:       setup backchannel transport failed\n");
         return -ENOMEM;
@@ -198,6 +199,7 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs)
         xprt_dec_alloc_count(xprt, max_reqs);
         list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
                 dprintk("RPC:        req=%p\n", req);
+                list_del(&req->rq_bc_pa_list);
                 xprt_free_allocation(req);
                 if (--max_reqs == 0)
                         break;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 80a6640f329b..06c6ff0cb911 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -571,7 +571,7 @@ static void svc_check_conn_limits(struct svc_serv *serv)
         }
 }
 
-int svc_alloc_arg(struct svc_rqst *rqstp)
+static int svc_alloc_arg(struct svc_rqst *rqstp)
 {
         struct svc_serv *serv = rqstp->rq_server;
         struct xdr_buf *arg;
@@ -612,7 +612,7 @@ int svc_alloc_arg(struct svc_rqst *rqstp)
         return 0;
 }
 
-struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
+static struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
 {
         struct svc_xprt *xprt;
         struct svc_pool         *pool = rqstp->rq_pool;
@@ -691,7 +691,7 @@ struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
         return xprt;
 }
 
-void svc_add_new_temp_xprt(struct svc_serv *serv, struct svc_xprt *newxpt)
+static void svc_add_new_temp_xprt(struct svc_serv *serv, struct svc_xprt *newxpt)
 {
         spin_lock_bh(&serv->sv_lock);
         set_bit(XPT_TEMP, &newxpt->xpt_flags);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 817a1e523969..0addefca8e77 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -510,6 +510,7 @@ static int xs_nospace(struct rpc_task *task)
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+        struct sock *sk = transport->inet;
         int ret = -EAGAIN;
 
         dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
@@ -527,7 +528,7 @@ static int xs_nospace(struct rpc_task *task)
                          * window size
                          */
                         set_bit(SOCK_NOSPACE, &transport->sock->flags);
-                        transport->inet->sk_write_pending++;
+                        sk->sk_write_pending++;
                         /* ...and wait for more buffer space */
                         xprt_wait_for_buffer_space(task, xs_nospace_callback);
                 }
@@ -537,6 +538,9 @@ static int xs_nospace(struct rpc_task *task)
         }
 
         spin_unlock_bh(&xprt->transport_lock);
+
+        /* Race breaker in case memory is freed before above code is called */
+        sk->sk_write_space(sk);
         return ret;
 }
 
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 1ff477b0450d..5569d96b4da3 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -192,6 +192,7 @@ static inline void k_term_timer(struct timer_list *timer)
 
 struct tipc_skb_cb {
         void *handle;
+        bool deferred;
 };
 
 #define TIPC_SKB_CB(__skb) ((struct tipc_skb_cb *)&((__skb)->cb[0]))
diff --git a/net/tipc/link.c b/net/tipc/link.c
index d4b5de41b682..da6018beb6eb 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1391,6 +1391,12 @@ static int link_recv_buf_validate(struct sk_buff *buf)
         u32 hdr_size;
         u32 min_hdr_size;
 
+        /* If this packet comes from the defer queue, the skb has already
+         * been validated
+         */
+        if (unlikely(TIPC_SKB_CB(buf)->deferred))
+                return 1;
+
         if (unlikely(buf->len < MIN_H_SIZE))
                 return 0;
 
@@ -1703,6 +1709,7 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
                                 &l_ptr->newest_deferred_in, buf)) {
                 l_ptr->deferred_inqueue_sz++;
                 l_ptr->stats.deferred_recv++;
+                TIPC_SKB_CB(buf)->deferred = true;
                 if ((l_ptr->deferred_inqueue_sz % 16) == 1)
                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
         } else
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d89dee2259b5..010892b81a06 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -203,8 +203,11 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
 
         rdev->opencount--;
 
-        WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
-                !rdev->scan_req->notified);
+        if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                if (WARN_ON(!rdev->scan_req->notified))
+                        rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, false);
+        }
 }
 
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
@@ -440,9 +443,6 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
-        /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
-        wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
-
         /*
          * There are major locking problems in nl80211/mac80211 for CSA,
          * disable for all drivers until this has been reworked.
@@ -859,8 +859,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 break;
         case NETDEV_DOWN:
                 cfg80211_update_iface_num(rdev, wdev->iftype, -1);
-                WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
-                        !rdev->scan_req->notified);
+                if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                        if (WARN_ON(!rdev->scan_req->notified))
+                                rdev->scan_req->aborted = true;
+                        ___cfg80211_scan_done(rdev, false);
+                }
 
                 if (WARN_ON(rdev->sched_scan_req &&
                             rdev->sched_scan_req->dev == wdev->netdev)) {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 37ec16d7bb1a..f1d193b557b6 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -62,6 +62,7 @@ struct cfg80211_registered_device {
         struct rb_root bss_tree;
         u32 bss_generation;
         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
+        struct sk_buff *scan_msg;
         struct cfg80211_sched_scan_request *sched_scan_req;
         unsigned long suspend_at;
         struct work_struct scan_done_wk;
@@ -361,7 +362,8 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                                    struct key_params *params, int key_idx,
                                    bool pairwise, const u8 *mac_addr);
 void __cfg80211_scan_done(struct work_struct *wk);
-void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev);
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
+                           bool send_message);
 void __cfg80211_sched_scan_results(struct work_struct *wk);
 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
                                bool driver_initiated);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7a742594916e..4fe2e6e2bc76 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1719,9 +1719,10 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                                  * We can then retry with the larger buffer.
                                  */
                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
-                                    !skb->len &&
+                                    !skb->len && !state->split &&
                                     cb->min_dump_alloc < 4096) {
                                         cb->min_dump_alloc = 4096;
+                                        state->split_start = 0;
                                         rtnl_unlock();
                                         return 1;
                                 }
@@ -5244,7 +5245,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->scan)
                 return -EOPNOTSUPP;
 
-        if (rdev->scan_req) {
+        if (rdev->scan_req || rdev->scan_msg) {
                 err = -EBUSY;
                 goto unlock;
         }
@@ -10011,40 +10012,31 @@ void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 
-void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
-                            struct wireless_dev *wdev)
+struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
+                                       struct wireless_dev *wdev, bool aborted)
 {
         struct sk_buff *msg;
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
-                return;
+                return NULL;
 
         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
-                                  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
+                                  aborted ? NL80211_CMD_SCAN_ABORTED :
+                                            NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
                 nlmsg_free(msg);
-                return;
+                return NULL;
         }
 
-        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                NL80211_MCGRP_SCAN, GFP_KERNEL);
+        return msg;
 }
 
-void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
-                               struct wireless_dev *wdev)
+void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
+                              struct sk_buff *msg)
 {
-        struct sk_buff *msg;
-
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return;
 
-        if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
-                                  NL80211_CMD_SCAN_ABORTED) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
-
         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index b1b231324e10..75799746d845 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -8,10 +8,10 @@ void nl80211_exit(void);
 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
                              struct wireless_dev *wdev);
-void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
-                            struct wireless_dev *wdev);
-void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
-                               struct wireless_dev *wdev);
+struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
+                                       struct wireless_dev *wdev, bool aborted);
+void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
+                              struct sk_buff *msg);
 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev, u32 cmd);
 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index b528e31da2cf..d1ed4aebbbb7 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -161,18 +161,25 @@ static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
                 dev->bss_generation++;
 }
 
-void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
+                           bool send_message)
 {
         struct cfg80211_scan_request *request;
         struct wireless_dev *wdev;
+        struct sk_buff *msg;
 #ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
         ASSERT_RTNL();
 
-        request = rdev->scan_req;
+        if (rdev->scan_msg) {
+                nl80211_send_scan_result(rdev, rdev->scan_msg);
+                rdev->scan_msg = NULL;
+                return;
+        }
 
+        request = rdev->scan_req;
         if (!request)
                 return;
 
@@ -186,18 +193,16 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
         if (wdev->netdev)
                 cfg80211_sme_scan_done(wdev->netdev);
 
-        if (request->aborted) {
-                nl80211_send_scan_aborted(rdev, wdev);
-        } else {
-                if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
-                        /* flush entries from previous scans */
-                        spin_lock_bh(&rdev->bss_lock);
-                        __cfg80211_bss_expire(rdev, request->scan_start);
-                        spin_unlock_bh(&rdev->bss_lock);
-                }
-                nl80211_send_scan_done(rdev, wdev);
+        if (!request->aborted &&
+            request->flags & NL80211_SCAN_FLAG_FLUSH) {
+                /* flush entries from previous scans */
+                spin_lock_bh(&rdev->bss_lock);
+                __cfg80211_bss_expire(rdev, request->scan_start);
+                spin_unlock_bh(&rdev->bss_lock);
         }
 
+        msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);
+
 #ifdef CONFIG_CFG80211_WEXT
         if (wdev->netdev && !request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
@@ -211,6 +216,11 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
 
         rdev->scan_req = NULL;
         kfree(request);
+
+        if (!send_message)
+                rdev->scan_msg = msg;
+        else
+                nl80211_send_scan_result(rdev, msg);
 }
 
 void __cfg80211_scan_done(struct work_struct *wk)
@@ -221,7 +231,7 @@ void __cfg80211_scan_done(struct work_struct *wk)
                             scan_done_wk);
 
         rtnl_lock();
-        ___cfg80211_scan_done(rdev);
+        ___cfg80211_scan_done(rdev, true);
         rtnl_unlock();
 }
 
@@ -1079,7 +1089,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        if (rdev->scan_req) {
+        if (rdev->scan_req || rdev->scan_msg) {
                 err = -EBUSY;
                 goto out;
         }
@@ -1481,7 +1491,7 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        if (rdev->scan_req)
+        if (rdev->scan_req || rdev->scan_msg)
                 return -EAGAIN;
 
         res = ieee80211_scan_results(rdev, info, extra, data->length);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index a63509118508..f04d4c32e96e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -67,7 +67,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
 
-        if (rdev->scan_req)
+        if (rdev->scan_req || rdev->scan_msg)
                 return -EBUSY;
 
         if (wdev->conn->params.channel)
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 49392ecbef17..79c059e70860 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -152,6 +152,7 @@ ld_flags       = $(LDFLAGS) $(ldflags-y)
 dtc_cpp_flags  = -Wp,-MD,$(depfile).pre.tmp -nostdinc                    \
                  -I$(srctree)/arch/$(SRCARCH)/boot/dts                   \
                  -I$(srctree)/arch/$(SRCARCH)/boot/dts/include           \
+                 -I$(srctree)/drivers/of/testcase-data                   \
                  -undef -D__DTS__
 
 # Finds the multi-part object the current object will be linked into
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 0ea2a1e24ade..464dcef79b35 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -471,7 +471,7 @@ sub seed_camelcase_includes {
 
         $camelcase_seeded = 1;
 
-        if (-d ".git") {
+        if (-e ".git") {
                 my $git_last_include_commit = `git log --no-merges --pretty=format:"%h%n" -1 -- include`;
                 chomp $git_last_include_commit;
                 $camelcase_cache = ".checkpatch-camelcase.git.$git_last_include_commit";
@@ -499,7 +499,7 @@ sub seed_camelcase_includes {
                 return;
         }
 
-        if (-d ".git") {
+        if (-e ".git") {
                 $files = `git ls-files "include/*.h"`;
                 @include_files = split('\n', $files);
         }
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 9c3986f4140c..41987885bd31 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -95,7 +95,7 @@ my %VCS_cmds;
 
 my %VCS_cmds_git = (
     "execute_cmd" => \&git_execute_cmd,
-    "available" => '(which("git") ne "") && (-d ".git")',
+    "available" => '(which("git") ne "") && (-e ".git")',
     "find_signers_cmd" =>
         "git log --no-color --follow --since=\$email_git_since " .
             '--numstat --no-merges ' .
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 23708636b05c..25e5cb0aaef6 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -210,8 +210,8 @@ static void do_usb_entry(void *symval,
                                 range_lo < 0x9 ? "[%X-9" : "[%X",
                                 range_lo);
                         sprintf(alias + strlen(alias),
-                                range_hi > 0xA ? "a-%X]" : "%X]",
-                                range_lo);
+                                range_hi > 0xA ? "A-%X]" : "%X]",
+                                range_hi);
                 }
         }
         if (bcdDevice_initial_digits < (sizeof(bcdDevice_lo) * 2 - 1))
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 332ac8a80cf5..2df7b900e259 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -17,6 +17,7 @@
 #include <linux/inet_diag.h>
 #include <linux/xfrm.h>
 #include <linux/audit.h>
+#include <linux/sock_diag.h>
 
 #include "flask.h"
 #include "av_permissions.h"
@@ -78,6 +79,7 @@ static struct nlmsg_perm nlmsg_tcpdiag_perms[] =
 {
         { TCPDIAG_GETSOCK,      NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
         { DCCPDIAG_GETSOCK,     NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
+        { SOCK_DIAG_BY_FAMILY,  NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
 };
 
 static struct nlmsg_perm nlmsg_xfrm_perms[] =
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index c0f498842129..9c5cdc2caaef 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -3338,10 +3338,10 @@ static int filename_write_helper(void *key, void *data, void *ptr)
         if (rc)
                 return rc;
 
-        buf[0] = ft->stype;
-        buf[1] = ft->ttype;
-        buf[2] = ft->tclass;
-        buf[3] = otype->otype;
+        buf[0] = cpu_to_le32(ft->stype);
+        buf[1] = cpu_to_le32(ft->ttype);
+        buf[2] = cpu_to_le32(ft->tclass);
+        buf[3] = cpu_to_le32(otype->otype);
 
         rc = put_entry(buf, sizeof(u32), 4, fp);
         if (rc)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index c93c21127f0c..5d0144ee8ed6 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1232,6 +1232,10 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
         struct context context;
         int rc = 0;
 
+        /* An empty security context is never valid. */
+        if (!scontext_len)
+                return -EINVAL;
+
         if (!ss_initialized) {
                 int i;
 
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index ec4536c8d8d4..dafcf82139e2 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -932,7 +932,7 @@ int snd_hda_bus_new(struct snd_card *card,
 }
 EXPORT_SYMBOL_GPL(snd_hda_bus_new);
 
-#ifdef CONFIG_SND_HDA_GENERIC
+#if IS_ENABLED(CONFIG_SND_HDA_GENERIC)
 #define is_generic_config(codec) \
         (codec->modelname && !strcmp(codec->modelname, "generic"))
 #else
@@ -1339,23 +1339,15 @@ get_hda_cvt_setup(struct hda_codec *codec, hda_nid_t nid)
 /*
  * Dynamic symbol binding for the codec parsers
  */
-#ifdef MODULE
-#define load_parser_sym(sym)            ((int (*)(struct hda_codec *))symbol_request(sym))
-#define unload_parser_addr(addr)        symbol_put_addr(addr)
-#else
-#define load_parser_sym(sym)            (sym)
-#define unload_parser_addr(addr)        do {} while (0)
-#endif
 
 #define load_parser(codec, sym) \
-        ((codec)->parser = load_parser_sym(sym))
+        ((codec)->parser = (int (*)(struct hda_codec *))symbol_request(sym))
 
 static void unload_parser(struct hda_codec *codec)
 {
-        if (codec->parser) {
-                unload_parser_addr(codec->parser);
-                codec->parser = NULL;
-        }
+        if (codec->parser)
+                symbol_put_addr(codec->parser);
+        codec->parser = NULL;
 }
 
 /*
@@ -1570,7 +1562,7 @@ int snd_hda_codec_update_widgets(struct hda_codec *codec)
 EXPORT_SYMBOL_GPL(snd_hda_codec_update_widgets);
 
 
-#ifdef CONFIG_SND_HDA_CODEC_HDMI
+#if IS_ENABLED(CONFIG_SND_HDA_CODEC_HDMI)
 /* if all audio out widgets are digital, let's assume the codec as a HDMI/DP */
 static bool is_likely_hdmi_codec(struct hda_codec *codec)
 {
@@ -1620,12 +1612,20 @@ int snd_hda_codec_configure(struct hda_codec *codec)
                 patch = codec->preset->patch;
         if (!patch) {
                 unload_parser(codec); /* to be sure */
-                if (is_likely_hdmi_codec(codec))
+                if (is_likely_hdmi_codec(codec)) {
+#if IS_MODULE(CONFIG_SND_HDA_CODEC_HDMI)
                         patch = load_parser(codec, snd_hda_parse_hdmi_codec);
-#ifdef CONFIG_SND_HDA_GENERIC
-                if (!patch)
+#elif IS_BUILTIN(CONFIG_SND_HDA_CODEC_HDMI)
+                        patch = snd_hda_parse_hdmi_codec;
+#endif
+                }
+                if (!patch) {
+#if IS_MODULE(CONFIG_SND_HDA_GENERIC)
                         patch = load_parser(codec, snd_hda_parse_generic_codec);
+#elif IS_BUILTIN(CONFIG_SND_HDA_GENERIC)
+                        patch = snd_hda_parse_generic_codec;
 #endif
+                }
                 if (!patch) {
                         printk(KERN_ERR "hda-codec: No codec parser is available\n");
                         return -ENODEV;
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 8321a97d5c05..d9a09bdd09db 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -3269,7 +3269,7 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol,
         mutex_unlock(&codec->control_mutex);
         snd_hda_codec_flush_cache(codec); /* flush the updates */
         if (err >= 0 && spec->cap_sync_hook)
-                spec->cap_sync_hook(codec, ucontrol);
+                spec->cap_sync_hook(codec, kcontrol, ucontrol);
         return err;
 }
 
@@ -3390,7 +3390,7 @@ static int cap_single_sw_put(struct snd_kcontrol *kcontrol,
                 return ret;
 
         if (spec->cap_sync_hook)
-                spec->cap_sync_hook(codec, ucontrol);
+                spec->cap_sync_hook(codec, kcontrol, ucontrol);
 
         return ret;
 }
@@ -3795,7 +3795,7 @@ static int mux_select(struct hda_codec *codec, unsigned int adc_idx,
                 return 0;
         snd_hda_activate_path(codec, path, true, false);
         if (spec->cap_sync_hook)
-                spec->cap_sync_hook(codec, NULL);
+                spec->cap_sync_hook(codec, NULL, NULL);
         path_power_down_sync(codec, old_path);
         return 1;
 }
@@ -5270,7 +5270,7 @@ static void init_input_src(struct hda_codec *codec)
         }
 
         if (spec->cap_sync_hook)
-                spec->cap_sync_hook(codec, NULL);
+                spec->cap_sync_hook(codec, NULL, NULL);
 }
 
 /* set right pin controls for digital I/O */
diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
index 07f767231c9f..c908afbe4d94 100644
--- a/sound/pci/hda/hda_generic.h
+++ b/sound/pci/hda/hda_generic.h
@@ -274,6 +274,7 @@ struct hda_gen_spec {
         void (*init_hook)(struct hda_codec *codec);
         void (*automute_hook)(struct hda_codec *codec);
         void (*cap_sync_hook)(struct hda_codec *codec,
+                              struct snd_kcontrol *kcontrol,
                               struct snd_ctl_elem_value *ucontrol);
 
         /* PCM hooks */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index fa2879a21a50..e354ab1ec20f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -198,7 +198,7 @@ MODULE_DESCRIPTION("Intel HDA driver");
 #endif
 
 #if defined(CONFIG_PM) && defined(CONFIG_VGA_SWITCHEROO)
-#ifdef CONFIG_SND_HDA_CODEC_HDMI
+#if IS_ENABLED(CONFIG_SND_HDA_CODEC_HDMI)
 #define SUPPORT_VGA_SWITCHEROO
 #endif
 #endif
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 54d14793725a..46ecdbb9053f 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -2662,60 +2662,6 @@ static bool dspload_wait_loaded(struct hda_codec *codec)
 }
 
 /*
- * PCM stuffs
- */
-static void ca0132_setup_stream(struct hda_codec *codec, hda_nid_t nid,
-                                 u32 stream_tag,
-                                 int channel_id, int format)
-{
-        unsigned int oldval, newval;
-
-        if (!nid)
-                return;
-
-        snd_printdd(
-                   "ca0132_setup_stream: NID=0x%x, stream=0x%x, "
-                   "channel=%d, format=0x%x\n",
-                   nid, stream_tag, channel_id, format);
-
-        /* update the format-id if changed */
-        oldval = snd_hda_codec_read(codec, nid, 0,
-                                    AC_VERB_GET_STREAM_FORMAT,
-                                    0);
-        if (oldval != format) {
-                msleep(20);
-                snd_hda_codec_write(codec, nid, 0,
-                                    AC_VERB_SET_STREAM_FORMAT,
-                                    format);
-        }
-
-        oldval = snd_hda_codec_read(codec, nid, 0, AC_VERB_GET_CONV, 0);
-        newval = (stream_tag << 4) | channel_id;
-        if (oldval != newval) {
-                snd_hda_codec_write(codec, nid, 0,
-                                    AC_VERB_SET_CHANNEL_STREAMID,
-                                    newval);
-        }
-}
-
-static void ca0132_cleanup_stream(struct hda_codec *codec, hda_nid_t nid)
-{
-        unsigned int val;
-
-        if (!nid)
-                return;
-
-        snd_printdd(KERN_INFO "ca0132_cleanup_stream: NID=0x%x\n", nid);
-
-        val = snd_hda_codec_read(codec, nid, 0, AC_VERB_GET_CONV, 0);
-        if (!val)
-                return;
-
-        snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_STREAM_FORMAT, 0);
-        snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_CHANNEL_STREAMID, 0);
-}
-
-/*
  * PCM callbacks
  */
 static int ca0132_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
@@ -2726,7 +2672,7 @@ static int ca0132_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
 {
         struct ca0132_spec *spec = codec->spec;
 
-        ca0132_setup_stream(codec, spec->dacs[0], stream_tag, 0, format);
+        snd_hda_codec_setup_stream(codec, spec->dacs[0], stream_tag, 0, format);
 
         return 0;
 }
@@ -2745,7 +2691,7 @@ static int ca0132_playback_pcm_cleanup(struct hda_pcm_stream *hinfo,
         if (spec->effects_switch[PLAY_ENHANCEMENT - EFFECT_START_NID])
                 msleep(50);
 
-        ca0132_cleanup_stream(codec, spec->dacs[0]);
+        snd_hda_codec_cleanup_stream(codec, spec->dacs[0]);
 
         return 0;
 }
@@ -2822,10 +2768,8 @@ static int ca0132_capture_pcm_prepare(struct hda_pcm_stream *hinfo,
                                         unsigned int format,
                                         struct snd_pcm_substream *substream)
 {
-        struct ca0132_spec *spec = codec->spec;
-
-        ca0132_setup_stream(codec, spec->adcs[substream->number],
-                            stream_tag, 0, format);
+        snd_hda_codec_setup_stream(codec, hinfo->nid,
+                                   stream_tag, 0, format);
 
         return 0;
 }
@@ -2839,7 +2783,7 @@ static int ca0132_capture_pcm_cleanup(struct hda_pcm_stream *hinfo,
         if (spec->dsp_state == DSP_DOWNLOADING)
                 return 0;
 
-        ca0132_cleanup_stream(codec, hinfo->nid);
+        snd_hda_codec_cleanup_stream(codec, hinfo->nid);
         return 0;
 }
 
@@ -4742,6 +4686,8 @@ static int patch_ca0132(struct hda_codec *codec)
                 return err;
 
         codec->patch_ops = ca0132_patch_ops;
+        codec->pcm_format_first = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 4e0ec146553d..bcf91bea3317 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3291,7 +3291,8 @@ static void cxt_update_headset_mode(struct hda_codec *codec)
 }
 
 static void cxt_update_headset_mode_hook(struct hda_codec *codec,
-                             struct snd_ctl_elem_value *ucontrol)
+                                         struct snd_kcontrol *kcontrol,
+                                         struct snd_ctl_elem_value *ucontrol)
 {
         cxt_update_headset_mode(codec);
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d9693ca9546f..6eb903cc6237 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -708,7 +708,8 @@ static void alc_inv_dmic_sync(struct hda_codec *codec, bool force)
 }
 
 static void alc_inv_dmic_hook(struct hda_codec *codec,
-                             struct snd_ctl_elem_value *ucontrol)
+                              struct snd_kcontrol *kcontrol,
+                              struct snd_ctl_elem_value *ucontrol)
 {
         alc_inv_dmic_sync(codec, false);
 }
@@ -3218,7 +3219,8 @@ static void alc269_fixup_hp_gpio_mute_hook(void *private_data, int enabled)
 
 /* turn on/off mic-mute LED per capture hook */
 static void alc269_fixup_hp_gpio_mic_mute_hook(struct hda_codec *codec,
-                               struct snd_ctl_elem_value *ucontrol)
+                                               struct snd_kcontrol *kcontrol,
+                                               struct snd_ctl_elem_value *ucontrol)
 {
         struct alc_spec *spec = codec->spec;
         unsigned int oldval = spec->gpio_led;
@@ -3528,7 +3530,8 @@ static void alc_update_headset_mode(struct hda_codec *codec)
 }
 
 static void alc_update_headset_mode_hook(struct hda_codec *codec,
-                             struct snd_ctl_elem_value *ucontrol)
+                                         struct snd_kcontrol *kcontrol,
+                                         struct snd_ctl_elem_value *ucontrol)
 {
         alc_update_headset_mode(codec);
 }
@@ -4305,7 +4308,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0651, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0652, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0653, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0657, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0658, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x065f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0662, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
@@ -4329,6 +4334,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
+        SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
         SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
@@ -4434,9 +4440,6 @@ static void alc269_fill_coef(struct hda_codec *codec)
 
         if (spec->codec_variant != ALC269_TYPE_ALC269VB)
                 return;
-        /* ALC271X doesn't seem to support these COEFs (bko#52181) */
-        if (!strcmp(codec->chip_name, "ALC271X"))
-                return;
 
         if ((alc_get_coef0(codec) & 0x00ff) < 0x015) {
                 alc_write_coef_idx(codec, 0xf, 0x960b);
@@ -5106,6 +5109,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
         SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x060a, "Dell XPS 13", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0623, "Dell", ALC668_FIXUP_AUTO_MUTE),
         SND_PCI_QUIRK(0x1028, 0x0624, "Dell", ALC668_FIXUP_AUTO_MUTE),
         SND_PCI_QUIRK(0x1028, 0x0625, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6998cf29b9bc..a2f11bf8155c 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -83,6 +83,7 @@ enum {
         STAC_DELL_M6_BOTH,
         STAC_DELL_EQ,
         STAC_ALIENWARE_M17X,
+        STAC_92HD89XX_HP_FRONT_JACK,
         STAC_92HD73XX_MODELS
 };
 
@@ -194,7 +195,7 @@ struct sigmatel_spec {
         int default_polarity;
 
         unsigned int mic_mute_led_gpio; /* capture mute LED GPIO */
-        bool mic_mute_led_on; /* current mic mute state */
+        unsigned int mic_enabled; /* current mic mute state (bitmask) */
 
         /* stream */
         unsigned int stream_delay;
@@ -324,19 +325,26 @@ static void stac_gpio_set(struct hda_codec *codec, unsigned int mask,
 
 /* hook for controlling mic-mute LED GPIO */
 static void stac_capture_led_hook(struct hda_codec *codec,
-                               struct snd_ctl_elem_value *ucontrol)
+                                  struct snd_kcontrol *kcontrol,
+                                  struct snd_ctl_elem_value *ucontrol)
 {
         struct sigmatel_spec *spec = codec->spec;
-        bool mute;
+        unsigned int mask;
+        bool cur_mute, prev_mute;
 
-        if (!ucontrol)
+        if (!kcontrol || !ucontrol)
                 return;
 
-        mute = !(ucontrol->value.integer.value[0] ||
-                 ucontrol->value.integer.value[1]);
-        if (spec->mic_mute_led_on != mute) {
-                spec->mic_mute_led_on = mute;
-                if (mute)
+        mask = 1U << snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
+        prev_mute = !spec->mic_enabled;
+        if (ucontrol->value.integer.value[0] ||
+            ucontrol->value.integer.value[1])
+                spec->mic_enabled |= mask;
+        else
+                spec->mic_enabled &= ~mask;
+        cur_mute = !spec->mic_enabled;
+        if (cur_mute != prev_mute) {
+                if (cur_mute)
                         spec->gpio_data |= spec->mic_mute_led_gpio;
                 else
                         spec->gpio_data &= ~spec->mic_mute_led_gpio;
@@ -1788,6 +1796,12 @@ static const struct hda_pintbl intel_dg45id_pin_configs[] = {
         {}
 };
 
+static const struct hda_pintbl stac92hd89xx_hp_front_jack_pin_configs[] = {
+        { 0x0a, 0x02214030 },
+        { 0x0b, 0x02A19010 },
+        {}
+};
+
 static void stac92hd73xx_fixup_ref(struct hda_codec *codec,
                                    const struct hda_fixup *fix, int action)
 {
@@ -1906,6 +1920,10 @@ static const struct hda_fixup stac92hd73xx_fixups[] = {
         [STAC_92HD73XX_NO_JD] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = stac92hd73xx_fixup_no_jd,
+        },
+        [STAC_92HD89XX_HP_FRONT_JACK] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = stac92hd89xx_hp_front_jack_pin_configs,
         }
 };
 
@@ -1966,6 +1984,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
                       "Alienware M17x", STAC_ALIENWARE_M17X),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0490,
                       "Alienware M17x R3", STAC_DELL_EQ),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
+                                "unknown HP", STAC_92HD89XX_HP_FRONT_JACK),
         {} /* terminator */
 };
 
@@ -4462,7 +4482,7 @@ static void stac_setup_gpio(struct hda_codec *codec)
         if (spec->mic_mute_led_gpio) {
                 spec->gpio_mask |= spec->mic_mute_led_gpio;
                 spec->gpio_dir |= spec->mic_mute_led_gpio;
-                spec->mic_mute_led_on = true;
+                spec->mic_enabled = 0;
                 spec->gpio_data |= spec->mic_mute_led_gpio;
 
                 spec->gen.cap_sync_hook = stac_capture_led_hook;
diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
index 5799fbc24c28..8fe3b8c18ed4 100644
--- a/sound/pci/hda/thinkpad_helper.c
+++ b/sound/pci/hda/thinkpad_helper.c
@@ -39,6 +39,7 @@ static void update_tpacpi_mute_led(void *private_data, int enabled)
 }
 
 static void update_tpacpi_micmute_led(struct hda_codec *codec,
+                                      struct snd_kcontrol *kcontrol,
                                       struct snd_ctl_elem_value *ucontrol)
 {
         if (!ucontrol || !led_set_func)
diff --git a/sound/soc/blackfin/Kconfig b/sound/soc/blackfin/Kconfig
index 54f74f8cbb75..4544d8eb1452 100644
--- a/sound/soc/blackfin/Kconfig
+++ b/sound/soc/blackfin/Kconfig
@@ -11,7 +11,7 @@ config SND_BF5XX_I2S
 
 config SND_BF5XX_SOC_SSM2602
         tristate "SoC SSM2602 Audio Codec Add-On Card support"
-        depends on SND_BF5XX_I2S && (SPI_MASTER || I2C)
+        depends on SND_BF5XX_I2S && SND_SOC_I2C_AND_SPI
         select SND_BF5XX_SOC_I2S if !BF60x
         select SND_BF6XX_SOC_I2S if BF60x
         select SND_SOC_SSM2602
@@ -21,10 +21,9 @@ config SND_BF5XX_SOC_SSM2602
 
 config SND_SOC_BFIN_EVAL_ADAU1701
         tristate "Support for the EVAL-ADAU1701MINIZ board on Blackfin eval boards"
-        depends on SND_BF5XX_I2S
+        depends on SND_BF5XX_I2S && I2C
         select SND_BF5XX_SOC_I2S
         select SND_SOC_ADAU1701
-        select I2C
         help
           Say Y if you want to add support for the Analog Devices EVAL-ADAU1701MINIZ
           board connected to one of the Blackfin evaluation boards like the
@@ -45,7 +44,7 @@ config SND_SOC_BFIN_EVAL_ADAU1373
 
 config SND_SOC_BFIN_EVAL_ADAV80X
         tristate "Support for the EVAL-ADAV80X boards on Blackfin eval boards"
-        depends on SND_BF5XX_I2S && (SPI_MASTER || I2C)
+        depends on SND_BF5XX_I2S && SND_SOC_I2C_AND_SPI
         select SND_BF5XX_SOC_I2S
         select SND_SOC_ADAV80X
         help
@@ -58,7 +57,7 @@ config SND_SOC_BFIN_EVAL_ADAV80X
 
 config SND_BF5XX_SOC_AD1836
         tristate "SoC AD1836 Audio support for BF5xx"
-        depends on SND_BF5XX_I2S
+        depends on SND_BF5XX_I2S && SPI_MASTER
         select SND_BF5XX_SOC_I2S
         select SND_SOC_AD1836
         help
@@ -66,7 +65,7 @@ config SND_BF5XX_SOC_AD1836
 
 config SND_BF5XX_SOC_AD193X
         tristate "SoC AD193X Audio support for Blackfin"
-        depends on SND_BF5XX_I2S
+        depends on SND_BF5XX_I2S && SND_SOC_I2C_AND_SPI
         select SND_BF5XX_SOC_I2S
         select SND_SOC_AD193X
         help
diff --git a/sound/soc/codecs/da9055.c b/sound/soc/codecs/da9055.c
index 52b79a487ac7..422812613a28 100644
--- a/sound/soc/codecs/da9055.c
+++ b/sound/soc/codecs/da9055.c
@@ -1523,8 +1523,15 @@ static int da9055_remove(struct i2c_client *client)
         return 0;
 }
 
+/*
+ * DO NOT change the device Ids. The naming is intentionally specific as both
+ * the CODEC and PMIC parts of this chip are instantiated separately as I2C
+ * devices (both have configurable I2C addresses, and are to all intents and
+ * purposes separate). As a result there are specific DA9055 Ids for CODEC
+ * and PMIC, which must be different to operate together.
+ */
 static const struct i2c_device_id da9055_i2c_id[] = {
-        { "da9055", 0 },
+        { "da9055-codec", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
@@ -1532,7 +1539,7 @@ MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
 /* I2C codec control layer */
 static struct i2c_driver da9055_i2c_driver = {
         .driver = {
-                .name = "da9055",
+                .name = "da9055-codec",
                 .owner = THIS_MODULE,
         },
         .probe          = da9055_i2c_probe,
diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
index 51f9b3d16b41..9f714ea86613 100644
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -336,6 +336,7 @@ static bool max98090_readable_register(struct device *dev, unsigned int reg)
         case M98090_REG_RECORD_TDM_SLOT:
         case M98090_REG_SAMPLE_RATE:
         case M98090_REG_DMIC34_BIQUAD_BASE ... M98090_REG_DMIC34_BIQUAD_BASE + 0x0E:
+        case M98090_REG_REVISION_ID:
                 return true;
         default:
                 return false;
@@ -1769,16 +1770,6 @@ static int max98090_set_bias_level(struct snd_soc_codec *codec,
 
         switch (level) {
         case SND_SOC_BIAS_ON:
-                if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) {
-                        ret = regcache_sync(max98090->regmap);
-
-                        if (ret != 0) {
-                                dev_err(codec->dev,
-                                        "Failed to sync cache: %d\n", ret);
-                                return ret;
-                        }
-                }
-
                 if (max98090->jack_state == M98090_JACK_STATE_HEADSET) {
                         /*
                          * Set to normal bias level.
@@ -1792,6 +1783,16 @@ static int max98090_set_bias_level(struct snd_soc_codec *codec,
                 break;
 
         case SND_SOC_BIAS_STANDBY:
+                if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) {
+                        ret = regcache_sync(max98090->regmap);
+                        if (ret != 0) {
+                                dev_err(codec->dev,
+                                        "Failed to sync cache: %d\n", ret);
+                                return ret;
+                        }
+                }
+                break;
+
         case SND_SOC_BIAS_OFF:
                 /* Set internal pull-up to lowest power mode */
                 snd_soc_update_bits(codec, M98090_REG_JACK_DETECT,
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index a3fb41179636..886924934aa5 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -2093,6 +2093,7 @@ MODULE_DEVICE_TABLE(i2c, rt5640_i2c_id);
 #ifdef CONFIG_ACPI
 static struct acpi_device_id rt5640_acpi_match[] = {
         { "INT33CA", 0 },
+        { "10EC5640", 0 },
         { },
 };
 MODULE_DEVICE_TABLE(acpi, rt5640_acpi_match);
diff --git a/sound/soc/codecs/wm8993.c b/sound/soc/codecs/wm8993.c
index 433d59a0f3ef..2ee23a39622c 100644
--- a/sound/soc/codecs/wm8993.c
+++ b/sound/soc/codecs/wm8993.c
@@ -1562,7 +1562,6 @@ static int wm8993_remove(struct snd_soc_codec *codec)
         struct wm8993_priv *wm8993 = snd_soc_codec_get_drvdata(codec);
 
         wm8993_set_bias_level(codec, SND_SOC_BIAS_OFF);
-        regulator_bulk_free(ARRAY_SIZE(wm8993->supplies), wm8993->supplies);
         return 0;
 }
 
diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c
index 70ff3772079f..5e3bc3c6801a 100644
--- a/sound/soc/davinci/davinci-evm.c
+++ b/sound/soc/davinci/davinci-evm.c
@@ -399,6 +399,7 @@ static struct platform_driver davinci_evm_driver = {
         .driver         = {
                 .name   = "davinci_evm",
                 .owner  = THIS_MODULE,
+                .pm     = &snd_soc_pm_ops,
                 .of_match_table = of_match_ptr(davinci_evm_dt_ids),
         },
 };
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index b7858bfa0295..670afa29e30d 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -263,7 +263,9 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                                          unsigned int fmt)
 {
         struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret = 0;
 
+        pm_runtime_get_sync(mcasp->dev);
         switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
         case SND_SOC_DAIFMT_DSP_B:
         case SND_SOC_DAIFMT_AC97:
@@ -317,7 +319,8 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 break;
 
         default:
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
@@ -354,10 +357,12 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 break;
 
         default:
-                return -EINVAL;
+                ret = -EINVAL;
+                break;
         }
-
-        return 0;
+out:
+        pm_runtime_put_sync(mcasp->dev);
+        return ret;
 }
 
 static int davinci_mcasp_set_clkdiv(struct snd_soc_dai *dai, int div_id, int div)
@@ -448,7 +453,7 @@ static int davinci_config_channel_size(struct davinci_mcasp *mcasp,
         return 0;
 }
 
-static int davinci_hw_common_param(struct davinci_mcasp *mcasp, int stream,
+static int mcasp_common_hw_param(struct davinci_mcasp *mcasp, int stream,
                                     int channels)
 {
         int i;
@@ -524,12 +529,18 @@ static int davinci_hw_common_param(struct davinci_mcasp *mcasp, int stream,
         return 0;
 }
 
-static void davinci_hw_param(struct davinci_mcasp *mcasp, int stream)
+static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream)
 {
         int i, active_slots;
         u32 mask = 0;
         u32 busel = 0;
 
+        if ((mcasp->tdm_slots < 2) || (mcasp->tdm_slots > 32)) {
+                dev_err(mcasp->dev, "tdm slot %d not supported\n",
+                        mcasp->tdm_slots);
+                return -EINVAL;
+        }
+
         active_slots = (mcasp->tdm_slots > 31) ? 32 : mcasp->tdm_slots;
         for (i = 0; i < active_slots; i++)
                 mask |= (1 << i);
@@ -539,35 +550,21 @@ static void davinci_hw_param(struct davinci_mcasp *mcasp, int stream)
         if (!mcasp->dat_port)
                 busel = TXSEL;
 
-        if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                /* bit stream is MSB first  with no delay */
-                /* DSP_B mode */
-                mcasp_set_reg(mcasp, DAVINCI_MCASP_TXTDM_REG, mask);
-                mcasp_set_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, busel | TXORD);
-
-                if ((mcasp->tdm_slots >= 2) && (mcasp->tdm_slots <= 32))
-                        mcasp_mod_bits(mcasp, DAVINCI_MCASP_TXFMCTL_REG,
-                                       FSXMOD(mcasp->tdm_slots), FSXMOD(0x1FF));
-                else
-                        printk(KERN_ERR "playback tdm slot %d not supported\n",
-                                mcasp->tdm_slots);
-        } else {
-                /* bit stream is MSB first with no delay */
-                /* DSP_B mode */
-                mcasp_set_bits(mcasp, DAVINCI_MCASP_RXFMT_REG, busel | RXORD);
-                mcasp_set_reg(mcasp, DAVINCI_MCASP_RXTDM_REG, mask);
-
-                if ((mcasp->tdm_slots >= 2) && (mcasp->tdm_slots <= 32))
-                        mcasp_mod_bits(mcasp, DAVINCI_MCASP_RXFMCTL_REG,
-                                       FSRMOD(mcasp->tdm_slots), FSRMOD(0x1FF));
-                else
-                        printk(KERN_ERR "capture tdm slot %d not supported\n",
-                                mcasp->tdm_slots);
-        }
+        mcasp_set_reg(mcasp, DAVINCI_MCASP_TXTDM_REG, mask);
+        mcasp_set_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, busel | TXORD);
+        mcasp_mod_bits(mcasp, DAVINCI_MCASP_TXFMCTL_REG,
+                       FSXMOD(mcasp->tdm_slots), FSXMOD(0x1FF));
+
+        mcasp_set_reg(mcasp, DAVINCI_MCASP_RXTDM_REG, mask);
+        mcasp_set_bits(mcasp, DAVINCI_MCASP_RXFMT_REG, busel | RXORD);
+        mcasp_mod_bits(mcasp, DAVINCI_MCASP_RXFMCTL_REG,
+                       FSRMOD(mcasp->tdm_slots), FSRMOD(0x1FF));
+
+        return 0;
 }
 
 /* S/PDIF */
-static void davinci_hw_dit_param(struct davinci_mcasp *mcasp)
+static int mcasp_dit_hw_param(struct davinci_mcasp *mcasp)
 {
         /* Set the TX format : 24 bit right rotation, 32 bit slot, Pad 0
            and LSB first */
@@ -589,6 +586,8 @@ static void davinci_hw_dit_param(struct davinci_mcasp *mcasp)
 
         /* Enable the DIT */
         mcasp_set_bits(mcasp, DAVINCI_MCASP_TXDITCTL_REG, DITEN);
+
+        return 0;
 }
 
 static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
@@ -605,13 +604,14 @@ static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
         u8 slots = mcasp->tdm_slots;
         u8 active_serializers;
         int channels;
+        int ret;
         struct snd_interval *pcm_channels = hw_param_interval(params,
                                         SNDRV_PCM_HW_PARAM_CHANNELS);
         channels = pcm_channels->min;
 
         active_serializers = (channels + slots - 1) / slots;
 
-        if (davinci_hw_common_param(mcasp, substream->stream, channels) == -EINVAL)
+        if (mcasp_common_hw_param(mcasp, substream->stream, channels) == -EINVAL)
                 return -EINVAL;
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                 fifo_level = mcasp->txnumevt * active_serializers;
@@ -619,9 +619,12 @@ static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
                 fifo_level = mcasp->rxnumevt * active_serializers;
 
         if (mcasp->op_mode == DAVINCI_MCASP_DIT_MODE)
-                davinci_hw_dit_param(mcasp);
+                ret = mcasp_dit_hw_param(mcasp);
         else
-                davinci_hw_param(mcasp, substream->stream);
+                ret = mcasp_i2s_hw_param(mcasp, substream->stream);
+
+        if (ret)
+                return ret;
 
         switch (params_format(params)) {
         case SNDRV_PCM_FORMAT_U8:
@@ -678,19 +681,9 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream,
         case SNDRV_PCM_TRIGGER_RESUME:
         case SNDRV_PCM_TRIGGER_START:
         case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                ret = pm_runtime_get_sync(mcasp->dev);
-                if (IS_ERR_VALUE(ret))
-                        dev_err(mcasp->dev, "pm_runtime_get_sync() failed\n");
                 davinci_mcasp_start(mcasp, substream->stream);
                 break;
-
         case SNDRV_PCM_TRIGGER_SUSPEND:
-                davinci_mcasp_stop(mcasp, substream->stream);
-                ret = pm_runtime_put_sync(mcasp->dev);
-                if (IS_ERR_VALUE(ret))
-                        dev_err(mcasp->dev, "pm_runtime_put_sync() failed\n");
-                break;
-
         case SNDRV_PCM_TRIGGER_STOP:
         case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                 davinci_mcasp_stop(mcasp, substream->stream);
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index d0c72ed261e7..c84026c99134 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -326,7 +326,7 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask,
         regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA,
                            ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask));
         regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMB_xS(tx_mask));
+                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask));
 
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
                            ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
@@ -334,7 +334,7 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask,
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA,
                            ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask));
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMB_xS(rx_mask));
+                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask));
 
         esai_priv->slot_width = slot_width;
 
diff --git a/sound/soc/fsl/fsl_esai.h b/sound/soc/fsl/fsl_esai.h
index 9c9f957fcae1..75e14033e8d8 100644
--- a/sound/soc/fsl/fsl_esai.h
+++ b/sound/soc/fsl/fsl_esai.h
@@ -322,7 +322,7 @@
 #define ESAI_xSMB_xS_SHIFT      0
 #define ESAI_xSMB_xS_WIDTH      16
 #define ESAI_xSMB_xS_MASK       (((1 << ESAI_xSMB_xS_WIDTH) - 1) << ESAI_xSMB_xS_SHIFT)
-#define ESAI_xSMB_xS(v)         (((v) >> ESAI_xSMA_xS_WIDTH) & ESAI_xSMA_xS_MASK)
+#define ESAI_xSMB_xS(v)         (((v) >> ESAI_xSMA_xS_WIDTH) & ESAI_xSMB_xS_MASK)
 
 /* Port C Direction Register -- REG_ESAI_PRRC 0xF8 */
 #define ESAI_PRRC_PDC_SHIFT     0
diff --git a/sound/soc/fsl/imx-mc13783.c b/sound/soc/fsl/imx-mc13783.c
index 79cee782dbbf..a2fd7321b5a9 100644
--- a/sound/soc/fsl/imx-mc13783.c
+++ b/sound/soc/fsl/imx-mc13783.c
@@ -160,7 +160,6 @@ static struct platform_driver imx_mc13783_audio_driver = {
         .driver = {
                 .name = "imx_mc13783",
                 .owner = THIS_MODULE,
-                .pm = &snd_soc_pm_ops,
         },
         .probe = imx_mc13783_probe,
         .remove = imx_mc13783_remove
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index f2beae78969f..1cb22dd034eb 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -33,8 +33,7 @@ struct imx_sgtl5000_data {
 
 static int imx_sgtl5000_dai_init(struct snd_soc_pcm_runtime *rtd)
 {
-        struct imx_sgtl5000_data *data = container_of(rtd->card,
-                                        struct imx_sgtl5000_data, card);
+        struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(rtd->card);
         struct device *dev = rtd->card->dev;
         int ret;
 
@@ -159,13 +158,15 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
         data->card.dapm_widgets = imx_sgtl5000_dapm_widgets;
         data->card.num_dapm_widgets = ARRAY_SIZE(imx_sgtl5000_dapm_widgets);
 
+        platform_set_drvdata(pdev, &data->card);
+        snd_soc_card_set_drvdata(&data->card, data);
+
         ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
         if (ret) {
                 dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
                 goto fail;
         }
 
-        platform_set_drvdata(pdev, data);
         of_node_put(ssi_np);
         of_node_put(codec_np);
 
@@ -184,7 +185,8 @@ fail:
 
 static int imx_sgtl5000_remove(struct platform_device *pdev)
 {
-        struct imx_sgtl5000_data *data = platform_get_drvdata(pdev);
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+        struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(card);
 
         clk_put(data->codec_clk);
 
diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
index 3fd76bc391de..3a3d17ce6ba4 100644
--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -71,7 +71,7 @@ static int imx_wm8962_set_bias_level(struct snd_soc_card *card,
 {
         struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
         struct imx_priv *priv = &card_priv;
-        struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev);
+        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         unsigned int pll_out;
         int ret;
@@ -137,7 +137,7 @@ static int imx_wm8962_late_probe(struct snd_soc_card *card)
 {
         struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
         struct imx_priv *priv = &card_priv;
-        struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev);
+        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         int ret;
 
@@ -264,13 +264,15 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         data->card.late_probe = imx_wm8962_late_probe;
         data->card.set_bias_level = imx_wm8962_set_bias_level;
 
+        platform_set_drvdata(pdev, &data->card);
+        snd_soc_card_set_drvdata(&data->card, data);
+
         ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
         if (ret) {
                 dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
                 goto clk_fail;
         }
 
-        platform_set_drvdata(pdev, data);
         of_node_put(ssi_np);
         of_node_put(codec_np);
 
@@ -289,7 +291,8 @@ fail:
 
 static int imx_wm8962_remove(struct platform_device *pdev)
 {
-        struct imx_wm8962_data *data = platform_get_drvdata(pdev);
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
 
         if (!IS_ERR(data->codec_clk))
                 clk_disable_unprepare(data->codec_clk);
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index 454f41cfc828..350757400391 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -59,7 +59,7 @@ config SND_SOC_SAMSUNG_JIVE_WM8750
         select SND_SOC_WM8750
         select SND_S3C2412_SOC_I2S
         help
-          Sat Y if you want to add support for SoC audio on the Jive.
+          Say Y if you want to add support for SoC audio on the Jive.
 
 config SND_SOC_SAMSUNG_SMDK_WM8580
         tristate "SoC I2S Audio support for WM8580 on SMDK"
@@ -145,11 +145,11 @@ config SND_SOC_SAMSUNG_RX1950_UDA1380
 
 config SND_SOC_SAMSUNG_SMDK_WM9713
         tristate "SoC AC97 Audio support for SMDK with WM9713"
-        depends on SND_SOC_SAMSUNG && (MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110 || MACH_SMDKV310 || MACH_SMDKC210)
+        depends on SND_SOC_SAMSUNG && (MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110)
         select SND_SOC_WM9713
         select SND_SAMSUNG_AC97
         help
-          Sat Y if you want to add support for SoC audio on the SMDK.
+          Say Y if you want to add support for SoC audio on the SMDK.
 
 config SND_SOC_SMARTQ
         tristate "SoC I2S Audio support for SmartQ board"
diff --git a/sound/soc/txx9/txx9aclc-ac97.c b/sound/soc/txx9/txx9aclc-ac97.c
index e0305a148568..9edd68db9f48 100644
--- a/sound/soc/txx9/txx9aclc-ac97.c
+++ b/sound/soc/txx9/txx9aclc-ac97.c
@@ -183,14 +183,16 @@ static int txx9aclc_ac97_dev_probe(struct platform_device *pdev)
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
                 return irq;
+
+        drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL);
+        if (!drvdata)
+                return -ENOMEM;
+
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         drvdata->base = devm_ioremap_resource(&pdev->dev, r);
         if (IS_ERR(drvdata->base))
                 return PTR_ERR(drvdata->base);
 
-        drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL);
-        if (!drvdata)
-                return -ENOMEM;
         platform_set_drvdata(pdev, drvdata);
         drvdata->physbase = r->start;
         if (sizeof(drvdata->physbase) > sizeof(r->start) &&
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 32af6b741ef5..d1d72ff50347 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -328,6 +328,11 @@ static struct usbmix_name_map gamecom780_map[] = {
         {}
 };
 
+static const struct usbmix_name_map kef_x300a_map[] = {
+        { 10, NULL }, /* firmware locks up (?) when we try to access this FU */
+        { 0 }
+};
+
 /*
  * Control map entries
  */
@@ -419,6 +424,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
                 .id = USB_ID(0x200c, 0x1018),
                 .map = ebox44_map,
         },
+        {
+                .id = USB_ID(0x27ac, 0x1000),
+                .map = kef_x300a_map,
+        },
         { 0 } /* terminator */
 };
 
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index be456ce264d0..8ca405cd7c1a 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -24,6 +24,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
+#include <linux/uaccess.h>
 
 #include <linux/irqchip/arm-gic.h>
 
diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
index 88b2fe3ddf42..00d86427af0f 100644
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -154,17 +154,13 @@ int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
         list_add_tail(&dev->list, &kvm->coalesced_zones);
         mutex_unlock(&kvm->slots_lock);
 
-        return ret;
+        return 0;
 
 out_free_dev:
         mutex_unlock(&kvm->slots_lock);
-
         kfree(dev);
 
-        if (dev == NULL)
-                return -ENXIO;
-
-        return 0;
+        return ret;
 }
 
 int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,