Merge 3.12-rc6 into char-misc-next

We want the fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
author: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2013-10-19 16:02:47 -0400
committer: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2013-10-19 16:02:47 -0400
commit: dfc568e6bc08916f1035af456e4631c47166b5cf (patch)
tree: 3c96bdc26687e0f6958e790c8c93c0c6efb6b8d6
parent: fdf91dae6f024c6dfee425fe754df6b1957f6c53 (diff)
parent: 31d141e3a666269a3b6fcccddb0351caf7454240 (diff)
565 files changed, 4604 insertions, 3309 deletions
diff --git a/Documentation/ABI/stable/sysfs-bus-usb b/Documentation/ABI/stable/sysfs-bus-usb
index 2be603c52a24..a6b685724740 100644
--- a/Documentation/ABI/stable/sysfs-bus-usb
+++ b/Documentation/ABI/stable/sysfs-bus-usb
@@ -37,8 +37,8 @@ Description:
                that the USB device has been connected to the machine.  This
                file is read-only.
 Users:
-                PowerTOP <power@bughost.org>
+                PowerTOP <powertop@lists.01.org>
-                http://www.lesswatts.org/projects/powertop/
+                https://01.org/powertop/
 What:           /sys/bus/usb/device/.../power/active_duration
 Date:           January 2008
@@ -57,8 +57,8 @@ Description:
                will give an integer percentage.  Note that this does not
                account for counter wrap.
 Users:
-                PowerTOP <power@bughost.org>
+                PowerTOP <powertop@lists.01.org>
-                http://www.lesswatts.org/projects/powertop/
+                https://01.org/powertop/
 What:           /sys/bus/usb/devices/<busnum>-<port[.port]>...:<config num>-<interface num>/supports_autosuspend
 Date:           January 2008
diff --git a/Documentation/ABI/testing/sysfs-devices-power b/Documentation/ABI/testing/sysfs-devices-power
index 9d43e7670841..efe449bdf811 100644
--- a/Documentation/ABI/testing/sysfs-devices-power
+++ b/Documentation/ABI/testing/sysfs-devices-power
@@ -1,6 +1,6 @@
 What:           /sys/devices/.../power/
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../power directory contains attributes
                allowing the user space to check and modify some power
@@ -8,7 +8,7 @@ Description:
 What:           /sys/devices/.../power/wakeup
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../power/wakeup attribute allows the user
                space to check if the device is enabled to wake up the system
@@ -34,7 +34,7 @@ Description:
 What:           /sys/devices/.../power/control
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../power/control attribute allows the user
                space to control the run-time power management of the device.
@@ -53,7 +53,7 @@ Description:
 What:           /sys/devices/.../power/async
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../async attribute allows the user space to
                enable or diasble the device's suspend and resume callbacks to
@@ -79,7 +79,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_count
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_count attribute contains the number
                of signaled wakeup events associated with the device.  This
@@ -88,7 +88,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_active_count
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_active_count attribute contains the
                number of times the processing of wakeup events associated with
@@ -98,7 +98,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_abort_count
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_abort_count attribute contains the
                number of times the processing of a wakeup event associated with
@@ -109,7 +109,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_expire_count
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_expire_count attribute contains the
                number of times a wakeup event associated with the device has
@@ -119,7 +119,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_active
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_active attribute contains either 1,
                or 0, depending on whether or not a wakeup event associated with
@@ -129,7 +129,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_total_time_ms
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_total_time_ms attribute contains
                the total time of processing wakeup events associated with the
@@ -139,7 +139,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_max_time_ms
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_max_time_ms attribute contains
                the maximum time of processing a single wakeup event associated
@@ -149,7 +149,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_last_time_ms
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_last_time_ms attribute contains
                the value of the monotonic clock corresponding to the time of
@@ -160,7 +160,7 @@ Description:
 What:           /sys/devices/.../power/wakeup_prevent_sleep_time_ms
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../wakeup_prevent_sleep_time_ms attribute
                contains the total time the device has been preventing
@@ -189,7 +189,7 @@ Description:
 What:           /sys/devices/.../power/pm_qos_latency_us
 Date:           March 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../power/pm_qos_resume_latency_us attribute
                contains the PM QoS resume latency limit for the given device,
@@ -207,7 +207,7 @@ Description:
 What:           /sys/devices/.../power/pm_qos_no_power_off
 Date:           September 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../power/pm_qos_no_power_off attribute
                is used for manipulating the PM QoS "no power off" flag.  If
@@ -222,7 +222,7 @@ Description:
 What:           /sys/devices/.../power/pm_qos_remote_wakeup
 Date:           September 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/devices/.../power/pm_qos_remote_wakeup attribute
                is used for manipulating the PM QoS "remote wakeup required"
diff --git a/Documentation/ABI/testing/sysfs-power b/Documentation/ABI/testing/sysfs-power
index 217772615d02..205a73878441 100644
--- a/Documentation/ABI/testing/sysfs-power
+++ b/Documentation/ABI/testing/sysfs-power
@@ -1,6 +1,6 @@
 What:           /sys/power/
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power directory will contain files that will
                provide a unified interface to the power management
@@ -8,7 +8,7 @@ Description:
 What:           /sys/power/state
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/state file controls the system power state.
                Reading from this file returns what states are supported,
@@ -22,7 +22,7 @@ Description:
 What:           /sys/power/disk
 Date:           September 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/disk file controls the operating mode of the
                suspend-to-disk mechanism.  Reading from this file returns
@@ -67,7 +67,7 @@ Description:
 What:           /sys/power/image_size
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/image_size file controls the size of the image
                created by the suspend-to-disk mechanism.  It can be written a
@@ -84,7 +84,7 @@ Description:
 What:           /sys/power/pm_trace
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/pm_trace file controls the code which saves the
                last PM event point in the RTC across reboots, so that you can
@@ -133,7 +133,7 @@ Description:
 What:           /sys/power/pm_async
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/pm_async file controls the switch allowing the
                user space to enable or disable asynchronous suspend and resume
@@ -146,7 +146,7 @@ Description:
 What:           /sys/power/wakeup_count
 Date:           July 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/wakeup_count file allows user space to put the
                system into a sleep state while taking into account the
@@ -161,7 +161,7 @@ Description:
 What:           /sys/power/reserved_size
 Date:           May 2011
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/reserved_size file allows user space to control
                the amount of memory reserved for allocations made by device
@@ -175,7 +175,7 @@ Description:
 What:           /sys/power/autosleep
 Date:           April 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/autosleep file can be written one of the strings
                returned by reads from /sys/power/state.  If that happens, a
@@ -192,7 +192,7 @@ Description:
 What:           /sys/power/wake_lock
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/wake_lock file allows user space to create
                wakeup source objects and activate them on demand (if one of
@@ -219,7 +219,7 @@ Description:
 What:           /sys/power/wake_unlock
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                The /sys/power/wake_unlock file allows user space to deactivate
                wakeup sources created with the help of /sys/power/wake_lock.
diff --git a/Documentation/acpi/dsdt-override.txt b/Documentation/acpi/dsdt-override.txt
index febbb1ba4d23..784841caa6e6 100644
--- a/Documentation/acpi/dsdt-override.txt
+++ b/Documentation/acpi/dsdt-override.txt
@@ -4,4 +4,4 @@ CONFIG_ACPI_CUSTOM_DSDT builds the image into the kernel.
 When to use this method is described in detail on the
 Linux/ACPI home page:
-http://www.lesswatts.org/projects/acpi/overridingDSDT.php
+https://01.org/linux-acpi/documentation/overriding-dsdt
diff --git a/Documentation/block/00-INDEX b/Documentation/block/00-INDEX
index d18ecd827c40..929d9904f74b 100644
--- a/Documentation/block/00-INDEX
+++ b/Documentation/block/00-INDEX
@@ -6,6 +6,8 @@ capability.txt
        - Generic Block Device Capability (/sys/block/<device>/capability)
 cfq-iosched.txt
        - CFQ IO scheduler tunables
+cmdline-partition.txt
+        - how to specify block device partitions on kernel command line
 data-integrity.txt
        - Block data integrity
 deadline-iosched.txt
diff --git a/Documentation/block/cmdline-partition.txt b/Documentation/block/cmdline-partition.txt
index 2bbf4cc40c3f..525b9f6d7fb4 100644
--- a/Documentation/block/cmdline-partition.txt
+++ b/Documentation/block/cmdline-partition.txt
@@ -1,9 +1,9 @@
-Embedded device command line partition
+Embedded device command line partition parsing
 =====================================================================
-Read block device partition table from command line.
+Support for reading the block device partition table from the command line.
-The partition used for fixed block device (eMMC) embedded device.
+It is typically used for fixed block (eMMC) embedded devices.
-It is no MBR, save storage space. Bootloader can be easily accessed
+It has no MBR, so saves storage space. Bootloader can be easily accessed
 by absolute address of data on the block device.
 Users can easily change the partition.
diff --git a/Documentation/devicetree/bindings/memory.txt b/Documentation/devicetree/bindings/memory.txt
deleted file mode 100644
index eb2469365593..000000000000
--- a/Documentation/devicetree/bindings/memory.txt
+++ /dev/null
@@ -1,168 +0,0 @@
-*** Memory binding ***
-The /memory node provides basic information about the address and size
-of the physical memory. This node is usually filled or updated by the
-bootloader, depending on the actual memory configuration of the given
-hardware.
-The memory layout is described by the following node:
-/ {
-        #address-cells = <(n)>;
-        #size-cells = <(m)>;
-        memory {
-                device_type = "memory";
-                reg =  <(baseaddr1) (size1)
-                        (baseaddr2) (size2)
-                        ...
-                        (baseaddrN) (sizeN)>;
-        };
-        ...
-};
-A memory node follows the typical device tree rules for "reg" property:
-n:              number of cells used to store base address value
-m:              number of cells used to store size value
-baseaddrX:      defines a base address of the defined memory bank
-sizeX:          the size of the defined memory bank
-More than one memory bank can be defined.
-*** Reserved memory regions ***
-In /memory/reserved-memory node one can create child nodes describing
-particular reserved (excluded from normal use) memory regions. Such
-memory regions are usually designed for the special usage by various
-device drivers. A good example are contiguous memory allocations or
-memory sharing with other operating system on the same hardware board.
-Those special memory regions might depend on the board configuration and
-devices used on the target system.
-Parameters for each memory region can be encoded into the device tree
-with the following convention:
-[(label):] (name) {
-        compatible = "linux,contiguous-memory-region", "reserved-memory-region";
-        reg = <(address) (size)>;
-        (linux,default-contiguous-region);
-};
-compatible:     one or more of:
-        - "linux,contiguous-memory-region" - enables binding of this
-          region to Contiguous Memory Allocator (special region for
-          contiguous memory allocations, shared with movable system
-          memory, Linux kernel-specific).
-        - "reserved-memory-region" - compatibility is defined, given
-          region is assigned for exclusive usage for by the respective
-          devices.
-reg:    standard property defining the base address and size of
-        the memory region
-linux,default-contiguous-region: property indicating that the region
-        is the default region for all contiguous memory
-        allocations, Linux specific (optional)
-It is optional to specify the base address, so if one wants to use
-autoconfiguration of the base address, '0' can be specified as a base
-address in the 'reg' property.
-The /memory/reserved-memory node must contain the same #address-cells
-and #size-cells value as the root node.
-*** Device node's properties ***
-Once regions in the /memory/reserved-memory node have been defined, they
-may be referenced by other device nodes. Bindings that wish to reference
-memory regions should explicitly document their use of the following
-property:
-memory-region = <&phandle_to_defined_region>;
-This property indicates that the device driver should use the memory
-region pointed by the given phandle.
-*** Example ***
-This example defines a memory consisting of 4 memory banks. 3 contiguous
-regions are defined for Linux kernel, one default of all device drivers
-(named contig_mem, placed at 0x72000000, 64MiB), one dedicated to the
-framebuffer device (labelled display_mem, placed at 0x78000000, 8MiB)
-and one for multimedia processing (labelled multimedia_mem, placed at
-0x77000000, 64MiB). 'display_mem' region is then assigned to fb@12300000
-device for DMA memory allocations (Linux kernel drivers will use CMA is
-available or dma-exclusive usage otherwise). 'multimedia_mem' is
-assigned to scaler@12500000 and codec@12600000 devices for contiguous
-memory allocations when CMA driver is enabled.
-The reason for creating a separate region for framebuffer device is to
-match the framebuffer base address to the one configured by bootloader,
-so once Linux kernel drivers starts no glitches on the displayed boot
-logo appears. Scaller and codec drivers should share the memory
-allocations.
-/ {
-        #address-cells = <1>;
-        #size-cells = <1>;
-        /* ... */
-        memory {
-                reg =  <0x40000000 0x10000000
-                        0x50000000 0x10000000
-                        0x60000000 0x10000000
-                        0x70000000 0x10000000>;
-                reserved-memory {
-                        #address-cells = <1>;
-                        #size-cells = <1>;
-                        /*
-                         * global autoconfigured region for contiguous allocations
-                         * (used only with Contiguous Memory Allocator)
-                         */
-                        contig_region@0 {
-                                compatible = "linux,contiguous-memory-region";
-                                reg = <0x0 0x4000000>;
-                                linux,default-contiguous-region;
-                        };
-                        /*
-                         * special region for framebuffer
-                         */
-                        display_region: region@78000000 {
-                                compatible = "linux,contiguous-memory-region", "reserved-memory-region";
-                                reg = <0x78000000 0x800000>;
-                        };
-                        /*
-                         * special region for multimedia processing devices
-                         */
-                        multimedia_region: region@77000000 {
-                                compatible = "linux,contiguous-memory-region";
-                                reg = <0x77000000 0x4000000>;
-                        };
-                };
-        };
-        /* ... */
-        fb0: fb@12300000 {
-                status = "okay";
-                memory-region = <&display_region>;
-        };
-        scaler: scaler@12500000 {
-                status = "okay";
-                memory-region = <&multimedia_region>;
-        };
-        codec: codec@12600000 {
-                status = "okay";
-                memory-region = <&multimedia_region>;
-        };
-};
diff --git a/Documentation/devicetree/bindings/mmc/tmio_mmc.txt b/Documentation/devicetree/bindings/mmc/tmio_mmc.txt
index df204e18e030..6a2a1160a70d 100644
--- a/Documentation/devicetree/bindings/mmc/tmio_mmc.txt
+++ b/Documentation/devicetree/bindings/mmc/tmio_mmc.txt
@@ -9,12 +9,15 @@ compulsory and any optional properties, common to all SD/MMC drivers, as
 described in mmc.txt, can be used. Additionally the following tmio_mmc-specific
 optional bindings can be used.
+Required properties:
+- compatible:   "renesas,sdhi-shmobile" - a generic sh-mobile SDHI unit
+                "renesas,sdhi-sh7372" - SDHI IP on SH7372 SoC
+                "renesas,sdhi-sh73a0" - SDHI IP on SH73A0 SoC
+                "renesas,sdhi-r8a73a4" - SDHI IP on R8A73A4 SoC
+                "renesas,sdhi-r8a7740" - SDHI IP on R8A7740 SoC
+                "renesas,sdhi-r8a7778" - SDHI IP on R8A7778 SoC
+                "renesas,sdhi-r8a7779" - SDHI IP on R8A7779 SoC
+                "renesas,sdhi-r8a7790" - SDHI IP on R8A7790 SoC
 Optional properties:
 - toshiba,mmc-wrprotect-disable: write-protect detection is unavailable
-When used with Renesas SDHI hardware, the following compatibility strings
-configure various model-specific properties:
-"renesas,sh7372-sdhi":  (default) compatible with SH7372
-"renesas,r8a7740-sdhi": compatible with R8A7740: certain MMC/SD commands have to
-                        wait for the interface to become idle.
diff --git a/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt b/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
index 2c6be0377f55..d2ea4605d078 100644
--- a/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
+++ b/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
@@ -86,6 +86,7 @@ General Properties:
 Clock Properties:
+  - fsl,cksel        Timer reference clock source.
  - fsl,tclk-period  Timer reference clock period in nanoseconds.
  - fsl,tmr-prsc     Prescaler, divides the output clock.
  - fsl,tmr-add      Frequency compensation value.
@@ -97,7 +98,7 @@ Clock Properties:
  clock. You must choose these carefully for the clock to work right.
  Here is how to figure good values:
-  TimerOsc     = system clock               MHz
+  TimerOsc     = selected reference clock   MHz
  tclk_period  = desired clock period       nanoseconds
  NominalFreq  = 1000 / tclk_period         MHz
  FreqDivRatio = TimerOsc / NominalFreq     (must be greater that 1.0)
@@ -114,6 +115,20 @@ Clock Properties:
  Pulse Per Second (PPS) signal, since this will be offered to the PPS
  subsystem to synchronize the Linux clock.
+  Reference clock source is determined by the value, which is holded
+  in CKSEL bits in TMR_CTRL register. "fsl,cksel" property keeps the
+  value, which will be directly written in those bits, that is why,
+  according to reference manual, the next clock sources can be used:
+  <0> - external high precision timer reference clock (TSEC_TMR_CLK
+        input is used for this purpose);
+  <1> - eTSEC system clock;
+  <2> - eTSEC1 transmit clock;
+  <3> - RTC clock input.
+  When this attribute is not used, eTSEC system clock will serve as
+  IEEE 1588 timer reference clock.
 Example:
        ptp_clock@24E00 {
@@ -121,6 +136,7 @@ Example:
                reg = <0x24E00 0xB0>;
                interrupts = <12 0x8 13 0x8>;
                interrupt-parent = < &ipic >;
+                fsl,cksel       = <1>;
                fsl,tclk-period = <10>;
                fsl,tmr-prsc    = <100>;
                fsl,tmr-add     = <0x999999A4>;
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 539a23631990..fcbb736d55fe 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -480,6 +480,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        Format: <io>,<irq>,<mode>
                        See header of drivers/net/hamradio/baycom_ser_hdx.c.
+        blkdevparts=    Manual partition parsing of block device(s) for
+                        embedded devices based on command line input.
+                        See Documentation/block/cmdline-partition.txt
        boot_delay=     Milliseconds to delay each printk during boot.
                        Values larger than 10 seconds (10000) are changed to
                        no delay (0).
@@ -1357,7 +1361,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        pages. In the event, a node is too small to have both
                        kernelcore and Movable pages, kernelcore pages will
                        take priority and other nodes will have a larger number
-                        of kernelcore pages.  The Movable zone is used for the
+                        of Movable pages.  The Movable zone is used for the
                        allocation of pages that may be reclaimed or moved
                        by the page migration subsystem.  This means that
                        HugeTLB pages may not be allocated from this zone.
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index f911e3656209..85c362d8ea34 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -28,6 +28,7 @@ ALC269/270/275/276/28x/29x
  alc269-dmic           Enable ALC269(VA) digital mic workaround
  alc271-dmic           Enable ALC271X digital mic workaround
  inv-dmic              Inverted internal mic workaround
+  headset-mic           Indicates a combined headset (headphone+mic) jack
  lenovo-dock           Enables docking station I/O for some Lenovos
  dell-headset-multi    Headset jack, which can also be used as mic-in
  dell-headset-dock     Headset jack (without mic-in), and also dock I/O
diff --git a/MAINTAINERS b/MAINTAINERS
index 284969fa2896..a7c34ef3509d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -237,11 +237,11 @@ F:	drivers/platform/x86/acer-wmi.c
 ACPI
 M:      Len Brown <lenb@kernel.org>
-M:      Rafael J. Wysocki <rjw@sisk.pl>
+M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
-Q:      http://patchwork.kernel.org/project/linux-acpi/list/
+Q:      https://patchwork.kernel.org/project/linux-acpi/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
 S:      Supported
 F:      drivers/acpi/
 F:      drivers/pnp/pnpacpi/
@@ -256,21 +256,21 @@ F:	drivers/pci/*/*/*acpi*
 ACPI FAN DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/acpi/fan.c
 ACPI THERMAL DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/acpi/*thermal*
 ACPI VIDEO DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/acpi/video.c
@@ -824,15 +824,21 @@ S:	Maintained
 F:      arch/arm/mach-gemini/
 ARM/CSR SIRFPRIMA2 MACHINE SUPPORT
-M:      Barry Song <baohua.song@csr.com>
+M:      Barry Song <baohua@kernel.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/baohua/linux.git
 S:      Maintained
 F:      arch/arm/mach-prima2/
+F:      drivers/clk/clk-prima2.c
+F:      drivers/clocksource/timer-prima2.c
+F:      drivers/clocksource/timer-marco.c
 F:      drivers/dma/sirf-dma.c
 F:      drivers/i2c/busses/i2c-sirf.c
+F:      drivers/input/misc/sirfsoc-onkey.c
+F:      drivers/irqchip/irq-sirfsoc.c
 F:      drivers/mmc/host/sdhci-sirf.c
 F:      drivers/pinctrl/sirf/
+F:      drivers/rtc/rtc-sirfsoc.c
 F:      drivers/spi/spi-sirf.c
 ARM/EBSA110 MACHINE SUPPORT
@@ -2294,7 +2300,7 @@ S:	Maintained
 F:      drivers/net/ethernet/ti/cpmac.c
 CPU FREQUENCY DRIVERS
-M:      Rafael J. Wysocki <rjw@sisk.pl>
+M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 M:      Viresh Kumar <viresh.kumar@linaro.org>
 L:      cpufreq@vger.kernel.org
 L:      linux-pm@vger.kernel.org
@@ -2325,7 +2331,7 @@ S:      Maintained
 F:      drivers/cpuidle/cpuidle-big_little.c
 CPUIDLE DRIVERS
-M:      Rafael J. Wysocki <rjw@sisk.pl>
+M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 M:      Daniel Lezcano <daniel.lezcano@linaro.org>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
@@ -3547,7 +3553,7 @@ F:	fs/freevxfs/
 FREEZER
 M:      Pavel Machek <pavel@ucw.cz>
-M:      "Rafael J. Wysocki" <rjw@sisk.pl>
+M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      Documentation/power/freezing-of-tasks.txt
@@ -3618,6 +3624,12 @@ L:	linux-scsi@vger.kernel.org
 S:      Odd Fixes (e.g., new signatures)
 F:      drivers/scsi/fdomain.*
+GCOV BASED KERNEL PROFILING
+M:      Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
+S:      Maintained
+F:      kernel/gcov/
+F:      Documentation/gcov.txt
 GDT SCSI DISK ARRAY CONTROLLER DRIVER
 M:      Achim Leubner <achim_leubner@adaptec.com>
 L:      linux-scsi@vger.kernel.org
@@ -3883,7 +3895,7 @@ F:	drivers/video/hgafb.c
 HIBERNATION (aka Software Suspend, aka swsusp)
 M:      Pavel Machek <pavel@ucw.cz>
-M:      "Rafael J. Wysocki" <rjw@sisk.pl>
+M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      arch/x86/power/
@@ -4333,7 +4345,7 @@ F:	drivers/video/i810/
 INTEL MENLOW THERMAL DRIVER
 M:      Sujith Thomas <sujith.thomas@intel.com>
 L:      platform-driver-x86@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/platform/x86/intel_menlow.c
@@ -4470,6 +4482,13 @@ L:	linux-serial@vger.kernel.org
 S:      Maintained
 F:      drivers/tty/serial/ioc3_serial.c
+IOMMU DRIVERS
+M:      Joerg Roedel <joro@8bytes.org>
+L:      iommu@lists.linux-foundation.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git
+S:      Maintained
+F:      drivers/iommu/
 IP MASQUERADING
 M:      Juanjo Ciarlante <jjciarla@raiz.uncu.edu.ar>
 S:      Maintained
@@ -7271,9 +7290,9 @@ F:	include/linux/sched.h
 F:      include/uapi/linux/sched.h
 SCORE ARCHITECTURE
-M:      Chen Liqin <liqin.chen@sunplusct.com>
+M:      Chen Liqin <liqin.linux@gmail.com>
 M:      Lennox Wu <lennox.wu@gmail.com>
-W:      http://www.sunplusct.com
+W:      http://www.sunplus.com
 S:      Supported
 F:      arch/score/
@@ -8082,7 +8101,7 @@ F:	drivers/sh/
 SUSPEND TO RAM
 M:      Len Brown <len.brown@intel.com>
 M:      Pavel Machek <pavel@ucw.cz>
-M:      "Rafael J. Wysocki" <rjw@sisk.pl>
+M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      Documentation/power/
@@ -9378,6 +9397,7 @@ F:	arch/arm64/include/asm/xen/
 XEN NETWORK BACKEND DRIVER
 M:      Ian Campbell <ian.campbell@citrix.com>
+M:      Wei Liu <wei.liu2@citrix.com>
 L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
 L:      netdev@vger.kernel.org
 S:      Supported
diff --git a/Makefile b/Makefile
index 2ae108d4f2af..126321d2e6ad 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc6
 NAME = One Giant Leap for Frogkind
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/spinlock.h b/arch/arc/include/asm/spinlock.h
index f158197ac5b0..b6a8c2dfbe6e 100644
--- a/arch/arc/include/asm/spinlock.h
+++ b/arch/arc/include/asm/spinlock.h
@@ -45,7 +45,14 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
 static inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
-        lock->slock = __ARCH_SPIN_LOCK_UNLOCKED__;
+        unsigned int tmp = __ARCH_SPIN_LOCK_UNLOCKED__;
+        __asm__ __volatile__(
+        "       ex  %0, [%1]            \n"
+        : "+r" (tmp)
+        : "r"(&(lock->slock))
+        : "memory");
        smp_mb();
 }
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index 32420824375b..30c9baffa96f 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -43,7 +43,7 @@
 * Because it essentially checks if buffer end is within limit and @len is
 * non-ngeative, which implies that buffer start will be within limit too.
 *
- * The reason for rewriting being, for majorit yof cases, @len is generally
+ * The reason for rewriting being, for majority of cases, @len is generally
 * compile time constant, causing first sub-expression to be compile time
 * subsumed.
 *
@@ -53,7 +53,7 @@
 *
 */
 #define __user_ok(addr, sz)     (((sz) <= TASK_SIZE) && \
-                                 (((addr)+(sz)) <= get_fs()))
+                                 ((addr) <= (get_fs() - (sz))))
 #define __access_ok(addr, sz)   (unlikely(__kernel_ok) || \
                                 likely(__user_ok((addr), (sz))))
diff --git a/arch/arc/kernel/ptrace.c b/arch/arc/kernel/ptrace.c
index 333238564b67..5d76706139dd 100644
--- a/arch/arc/kernel/ptrace.c
+++ b/arch/arc/kernel/ptrace.c
@@ -102,7 +102,7 @@ static int genregs_set(struct task_struct *target,
        REG_IGNORE_ONE(pad2);
        REG_IN_CHUNK(callee, efa, cregs);       /* callee_regs[r25..r13] */
        REG_IGNORE_ONE(efa);                    /* efa update invalid */
-        REG_IN_ONE(stop_pc, &ptregs->ret);      /* stop_pc: PC update */
+        REG_IGNORE_ONE(stop_pc);                        /* PC updated via @ret */
        return ret;
 }
diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index ee6ef2f60a28..7e95e1a86510 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -101,7 +101,6 @@ SYSCALL_DEFINE0(rt_sigreturn)
 {
        struct rt_sigframe __user *sf;
        unsigned int magic;
-        int err;
        struct pt_regs *regs = current_pt_regs();
        /* Always make any pending restarted system calls return -EINTR */
@@ -119,15 +118,16 @@ SYSCALL_DEFINE0(rt_sigreturn)
        if (!access_ok(VERIFY_READ, sf, sizeof(*sf)))
                goto badframe;
-        err = restore_usr_regs(regs, sf);
+        if (__get_user(magic, &sf->sigret_magic))
-        err |= __get_user(magic, &sf->sigret_magic);
-        if (err)
                goto badframe;
        if (unlikely(is_do_ss_needed(magic)))
                if (restore_altstack(&sf->uc.uc_stack))
                        goto badframe;
+        if (restore_usr_regs(regs, sf))
+                goto badframe;
        /* Don't restart from sigreturn */
        syscall_wont_restart(regs);
@@ -191,6 +191,15 @@ setup_rt_frame(int signo, struct k_sigaction *ka, siginfo_t *info,
                return 1;
        /*
+         * w/o SA_SIGINFO, struct ucontext is partially populated (only
+         * uc_mcontext/uc_sigmask) for kernel's normal user state preservation
+         * during signal handler execution. This works for SA_SIGINFO as well
+         * although the semantics are now overloaded (the same reg state can be
+         * inspected by userland: but are they allowed to fiddle with it ?
+         */
+        err |= stash_usr_regs(sf, regs, set);
+        /*
         * SA_SIGINFO requires 3 args to signal handler:
         *  #1: sig-no (common to any handler)
         *  #2: struct siginfo
@@ -213,14 +222,6 @@ setup_rt_frame(int signo, struct k_sigaction *ka, siginfo_t *info,
                magic = MAGIC_SIGALTSTK;
        }
-        /*
-         * w/o SA_SIGINFO, struct ucontext is partially populated (only
-         * uc_mcontext/uc_sigmask) for kernel's normal user state preservation
-         * during signal handler execution. This works for SA_SIGINFO as well
-         * although the semantics are now overloaded (the same reg state can be
-         * inspected by userland: but are they allowed to fiddle with it ?
-         */
-        err |= stash_usr_regs(sf, regs, set);
        err |= __put_user(magic, &sf->sigret_magic);
        if (err)
                return err;
diff --git a/arch/arc/kernel/time.c b/arch/arc/kernel/time.c
index 0e51e69cf30d..3fde7de3ea67 100644
--- a/arch/arc/kernel/time.c
+++ b/arch/arc/kernel/time.c
@@ -227,12 +227,9 @@ void __attribute__((weak)) arc_local_timer_setup(unsigned int cpu)
 {
        struct clock_event_device *clk = &per_cpu(arc_clockevent_device, cpu);
-        clockevents_calc_mult_shift(clk, arc_get_core_freq(), 5);
-        clk->max_delta_ns = clockevent_delta2ns(ARC_TIMER_MAX, clk);
        clk->cpumask = cpumask_of(cpu);
+        clockevents_config_and_register(clk, arc_get_core_freq(),
-        clockevents_register_device(clk);
+                                        0, ARC_TIMER_MAX);
        /*
         * setup the per-cpu timer IRQ handler - for all cpus
diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
index 28d170060747..7ff5b5c183bb 100644
--- a/arch/arc/kernel/unaligned.c
+++ b/arch/arc/kernel/unaligned.c
@@ -245,6 +245,12 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
                regs->status32 &= ~STATUS_DE_MASK;
        } else {
                regs->ret += state.instr_len;
+                /* handle zero-overhead-loop */
+                if ((regs->ret == regs->lp_end) && (regs->lp_count)) {
+                        regs->ret = regs->lp_start;
+                        regs->lp_count--;
+                }
        }
        return 0;
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index a37a50f575a2..db50b626be98 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -296,10 +296,15 @@ archprepare:
 # Convert bzImage to zImage
 bzImage: zImage
-zImage Image xipImage bootpImage uImage: vmlinux
+BOOT_TARGETS    = zImage Image xipImage bootpImage uImage
+INSTALL_TARGETS = zinstall uinstall install
+PHONY += bzImage $(BOOT_TARGETS) $(INSTALL_TARGETS)
+$(BOOT_TARGETS): vmlinux
        $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
-zinstall uinstall install: vmlinux
+$(INSTALL_TARGETS):
        $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
 %.dtb: | scripts
diff --git a/arch/arm/boot/Makefile b/arch/arm/boot/Makefile
index 84aa2caf07ed..ec2f8065f955 100644
--- a/arch/arm/boot/Makefile
+++ b/arch/arm/boot/Makefile
@@ -95,24 +95,24 @@ initrd:
        @test "$(INITRD)" != "" || \
        (echo You must specify INITRD; exit -1)
-install: $(obj)/Image
+install:
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
        $(obj)/Image System.map "$(INSTALL_PATH)"
-zinstall: $(obj)/zImage
+zinstall:
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
        $(obj)/zImage System.map "$(INSTALL_PATH)"
-uinstall: $(obj)/uImage
+uinstall:
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
        $(obj)/uImage System.map "$(INSTALL_PATH)"
 zi:
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
        $(obj)/zImage System.map "$(INSTALL_PATH)"
 i:
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
        $(obj)/Image System.map "$(INSTALL_PATH)"
 subdir-     := bootp compressed dts
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index e95af3f5433b..802720e3e8fd 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -41,6 +41,8 @@ dtb-$(CONFIG_ARCH_AT91)	+= sama5d33ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += sama5d34ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += sama5d35ek.dtb
+dtb-$(CONFIG_ARCH_ATLAS6) += atlas6-evb.dtb
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2835-rpi-b.dtb
 dtb-$(CONFIG_ARCH_BCM) += bcm11351-brt.dtb \
        bcm28155-ap.dtb
diff --git a/arch/arm/boot/dts/armada-370-netgear-rn102.dts b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
index 05e4485a8225..8ac2ac1f69cc 100644
--- a/arch/arm/boot/dts/armada-370-netgear-rn102.dts
+++ b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
@@ -27,6 +27,25 @@
        };
        soc {
+                ranges = <MBUS_ID(0xf0, 0x01) 0 0xd0000000 0x100000
+                          MBUS_ID(0x01, 0xe0) 0 0xfff00000 0x100000>;
+                pcie-controller {
+                        status = "okay";
+                        /* Connected to Marvell SATA controller */
+                        pcie@1,0 {
+                                /* Port 0, Lane 0 */
+                                status = "okay";
+                        };
+                        /* Connected to FL1009 USB 3.0 controller */
+                        pcie@2,0 {
+                                /* Port 1, Lane 0 */
+                                status = "okay";
+                        };
+                };
                internal-regs {
                        serial@12000 {
                                clock-frequency = <200000000>;
@@ -57,6 +76,11 @@
                                        marvell,pins = "mpp56";
                                        marvell,function = "gpio";
                                };
+                                poweroff: poweroff {
+                                        marvell,pins = "mpp8";
+                                        marvell,function = "gpio";
+                                };
                        };
                        mdio {
@@ -89,22 +113,6 @@
                                        pwm_polarity = <0>;
                                };
                        };
-                        pcie-controller {
-                                status = "okay";
-                                /* Connected to Marvell SATA controller */
-                                pcie@1,0 {
-                                        /* Port 0, Lane 0 */
-                                        status = "okay";
-                                };
-                                /* Connected to FL1009 USB 3.0 controller */
-                                pcie@2,0 {
-                                        /* Port 1, Lane 0 */
-                                        status = "okay";
-                                };
-                        };
                };
        };
@@ -160,7 +168,7 @@
                button@1 {
                        label = "Power Button";
                        linux,code = <116>;     /* KEY_POWER */
-                        gpios = <&gpio1 30 1>;
+                        gpios = <&gpio1 30 0>;
                };
                button@2 {
@@ -176,4 +184,11 @@
                };
        };
+        gpio_poweroff {
+                compatible = "gpio-poweroff";
+                pinctrl-0 = <&poweroff>;
+                pinctrl-names = "default";
+                gpios = <&gpio0 8 1>;
+        };
 };
diff --git a/arch/arm/boot/dts/armada-xp.dtsi b/arch/arm/boot/dts/armada-xp.dtsi
index def125c0eeaa..3058522f5aad 100644
--- a/arch/arm/boot/dts/armada-xp.dtsi
+++ b/arch/arm/boot/dts/armada-xp.dtsi
@@ -70,6 +70,8 @@
                        timer@20300 {
                                compatible = "marvell,armada-xp-timer";
+                                clocks = <&coreclk 2>, <&refclk>;
+                                clock-names = "nbclk", "fixed";
                        };
                        coreclk: mvebu-sar@18230 {
@@ -169,4 +171,13 @@
                        };
                };
        };
+        clocks {
+                /* 25 MHz reference crystal */
+                refclk: oscillator {
+                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
+                        clock-frequency = <25000000>;
+                };
+        };
 };
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index cf78ac0b04b1..e74dc15efa9d 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -190,12 +190,12 @@
                                                         AT91_PIOA 8 AT91_PERIPH_A AT91_PINCTRL_NONE>;  /* PA8 periph A */
                                        };
-                                        pinctrl_uart2_rts: uart2_rts-0 {
+                                        pinctrl_usart2_rts: usart2_rts-0 {
                                                atmel,pins =
                                                        <AT91_PIOB 0 AT91_PERIPH_B AT91_PINCTRL_NONE>;  /* PB0 periph B */
                                        };
-                                        pinctrl_uart2_cts: uart2_cts-0 {
+                                        pinctrl_usart2_cts: usart2_cts-0 {
                                                atmel,pins =
                                                        <AT91_PIOB 1 AT91_PERIPH_B AT91_PINCTRL_NONE>;  /* PB1 periph B */
                                        };
@@ -556,6 +556,7 @@
                                interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>;
                                dmas = <&dma0 1 AT91_DMA_CFG_PER_ID(0)>;
                                dma-names = "rxtx";
+                                pinctrl-names = "default";
                                #address-cells = <1>;
                                #size-cells = <0>;
                                status = "disabled";
@@ -567,6 +568,7 @@
                                interrupts = <26 IRQ_TYPE_LEVEL_HIGH 0>;
                                dmas = <&dma1 1 AT91_DMA_CFG_PER_ID(0)>;
                                dma-names = "rxtx";
+                                pinctrl-names = "default";
                                #address-cells = <1>;
                                #size-cells = <0>;
                                status = "disabled";
diff --git a/arch/arm/boot/dts/atlas6.dtsi b/arch/arm/boot/dts/atlas6.dtsi
index 8678e0c11119..6db4f81d4795 100644
--- a/arch/arm/boot/dts/atlas6.dtsi
+++ b/arch/arm/boot/dts/atlas6.dtsi
@@ -181,6 +181,8 @@
                                interrupts = <17>;
                                fifosize = <128>;
                                clocks = <&clks 13>;
+                                sirf,uart-dma-rx-channel = <21>;
+                                sirf,uart-dma-tx-channel = <2>;
                        };
                        uart1: uart@b0060000 {
@@ -199,6 +201,8 @@
                                interrupts = <19>;
                                fifosize = <128>;
                                clocks = <&clks 15>;
+                                sirf,uart-dma-rx-channel = <6>;
+                                sirf,uart-dma-tx-channel = <7>;
                        };
                        usp0: usp@b0080000 {
@@ -206,7 +210,10 @@
                                compatible = "sirf,prima2-usp";
                                reg = <0xb0080000 0x10000>;
                                interrupts = <20>;
+                                fifosize = <128>;
                                clocks = <&clks 28>;
+                                sirf,usp-dma-rx-channel = <17>;
+                                sirf,usp-dma-tx-channel = <18>;
                        };
                        usp1: usp@b0090000 {
@@ -214,7 +221,10 @@
                                compatible = "sirf,prima2-usp";
                                reg = <0xb0090000 0x10000>;
                                interrupts = <21>;
+                                fifosize = <128>;
                                clocks = <&clks 29>;
+                                sirf,usp-dma-rx-channel = <14>;
+                                sirf,usp-dma-tx-channel = <15>;
                        };
                        dmac0: dma-controller@b00b0000 {
@@ -237,6 +247,8 @@
                                compatible = "sirf,prima2-vip";
                                reg = <0xb00C0000 0x10000>;
                                clocks = <&clks 31>;
+                                interrupts = <14>;
+                                sirf,vip-dma-rx-channel = <16>;
                        };
                        spi0: spi@b00d0000 {
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 7d7cc777ff7b..bbac42a78ce5 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -96,6 +96,11 @@
                             <1 14 0xf08>,
                             <1 11 0xf08>,
                             <1 10 0xf08>;
+                /* Unfortunately we need this since some versions of U-Boot
+                 * on Exynos don't set the CNTFRQ register, so we need the
+                 * value from DT.
+                 */
+                clock-frequency = <24000000>;
        };
        mct@101C0000 {
diff --git a/arch/arm/boot/dts/kirkwood.dtsi b/arch/arm/boot/dts/kirkwood.dtsi
index cf7aeaf89e9c..1335b2e1bed4 100644
--- a/arch/arm/boot/dts/kirkwood.dtsi
+++ b/arch/arm/boot/dts/kirkwood.dtsi
@@ -13,6 +13,7 @@
                cpu@0 {
                        device_type = "cpu";
                        compatible = "marvell,feroceon";
+                        reg = <0>;
                        clocks = <&core_clk 1>, <&core_clk 3>, <&gate_clk 11>;
                        clock-names = "cpu_clk", "ddrclk", "powersave";
                };
@@ -167,7 +168,7 @@
                xor@60900 {
                        compatible = "marvell,orion-xor";
                        reg = <0x60900 0x100
-                               0xd0B00 0x100>;
+                               0x60B00 0x100>;
                        status = "okay";
                        clocks = <&gate_clk 16>;
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index 0c514dc8460c..2816bf612672 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -11,7 +11,7 @@
 / {
        model = "TI OMAP3 BeagleBoard xM";
-        compatible = "ti,omap3-beagle-xm", "ti,omap3-beagle", "ti,omap3";
+        compatible = "ti,omap3-beagle-xm", "ti,omap36xx", "ti,omap3";
        cpus {
                cpu@0 {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 7d95cda1fae4..b41bd57f4328 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -108,7 +108,7 @@
                        #address-cells = <1>;
                        #size-cells = <0>;
                        pinctrl-single,register-width = <16>;
-                        pinctrl-single,function-mask = <0x7f1f>;
+                        pinctrl-single,function-mask = <0xff1f>;
                };
                omap3_pmx_wkup: pinmux@0x48002a00 {
@@ -117,7 +117,7 @@
                        #address-cells = <1>;
                        #size-cells = <0>;
                        pinctrl-single,register-width = <16>;
-                        pinctrl-single,function-mask = <0x7f1f>;
+                        pinctrl-single,function-mask = <0xff1f>;
                };
                gpio1: gpio@48310000 {
diff --git a/arch/arm/boot/dts/prima2.dtsi b/arch/arm/boot/dts/prima2.dtsi
index bbeb623fc2c6..27ed9f5144bc 100644
--- a/arch/arm/boot/dts/prima2.dtsi
+++ b/arch/arm/boot/dts/prima2.dtsi
@@ -171,7 +171,8 @@
                        compatible = "simple-bus";
                        #address-cells = <1>;
                        #size-cells = <1>;
-                        ranges = <0xb0000000 0xb0000000 0x180000>;
+                        ranges = <0xb0000000 0xb0000000 0x180000>,
+                               <0x56000000 0x56000000 0x1b00000>;
                        timer@b0020000 {
                                compatible = "sirf,prima2-tick";
@@ -196,25 +197,32 @@
                        uart0: uart@b0050000 {
                                cell-index = <0>;
                                compatible = "sirf,prima2-uart";
-                                reg = <0xb0050000 0x10000>;
+                                reg = <0xb0050000 0x1000>;
                                interrupts = <17>;
+                                fifosize = <128>;
                                clocks = <&clks 13>;
+                                sirf,uart-dma-rx-channel = <21>;
+                                sirf,uart-dma-tx-channel = <2>;
                        };
                        uart1: uart@b0060000 {
                                cell-index = <1>;
                                compatible = "sirf,prima2-uart";
-                                reg = <0xb0060000 0x10000>;
+                                reg = <0xb0060000 0x1000>;
                                interrupts = <18>;
+                                fifosize = <32>;
                                clocks = <&clks 14>;
                        };
                        uart2: uart@b0070000 {
                                cell-index = <2>;
                                compatible = "sirf,prima2-uart";
-                                reg = <0xb0070000 0x10000>;
+                                reg = <0xb0070000 0x1000>;
                                interrupts = <19>;
+                                fifosize = <128>;
                                clocks = <&clks 15>;
+                                sirf,uart-dma-rx-channel = <6>;
+                                sirf,uart-dma-tx-channel = <7>;
                        };
                        usp0: usp@b0080000 {
@@ -222,7 +230,10 @@
                                compatible = "sirf,prima2-usp";
                                reg = <0xb0080000 0x10000>;
                                interrupts = <20>;
+                                fifosize = <128>;
                                clocks = <&clks 28>;
+                                sirf,usp-dma-rx-channel = <17>;
+                                sirf,usp-dma-tx-channel = <18>;
                        };
                        usp1: usp@b0090000 {
@@ -230,7 +241,10 @@
                                compatible = "sirf,prima2-usp";
                                reg = <0xb0090000 0x10000>;
                                interrupts = <21>;
+                                fifosize = <128>;
                                clocks = <&clks 29>;
+                                sirf,usp-dma-rx-channel = <14>;
+                                sirf,usp-dma-tx-channel = <15>;
                        };
                        usp2: usp@b00a0000 {
@@ -238,7 +252,10 @@
                                compatible = "sirf,prima2-usp";
                                reg = <0xb00a0000 0x10000>;
                                interrupts = <22>;
+                                fifosize = <128>;
                                clocks = <&clks 30>;
+                                sirf,usp-dma-rx-channel = <10>;
+                                sirf,usp-dma-tx-channel = <11>;
                        };
                        dmac0: dma-controller@b00b0000 {
@@ -261,6 +278,8 @@
                                compatible = "sirf,prima2-vip";
                                reg = <0xb00C0000 0x10000>;
                                clocks = <&clks 31>;
+                                interrupts = <14>;
+                                sirf,vip-dma-rx-channel = <16>;
                        };
                        spi0: spi@b00d0000 {
diff --git a/arch/arm/boot/dts/r8a73a4.dtsi b/arch/arm/boot/dts/r8a73a4.dtsi
index 6c26caa880f2..658fcc537576 100644
--- a/arch/arm/boot/dts/r8a73a4.dtsi
+++ b/arch/arm/boot/dts/r8a73a4.dtsi
@@ -193,7 +193,7 @@
        };
        sdhi0: sdhi@ee100000 {
-                compatible = "renesas,r8a73a4-sdhi";
+                compatible = "renesas,sdhi-r8a73a4";
                reg = <0 0xee100000 0 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 165 4>;
@@ -202,7 +202,7 @@
        };
        sdhi1: sdhi@ee120000 {
-                compatible = "renesas,r8a73a4-sdhi";
+                compatible = "renesas,sdhi-r8a73a4";
                reg = <0 0xee120000 0 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 166 4>;
@@ -211,7 +211,7 @@
        };
        sdhi2: sdhi@ee140000 {
-                compatible = "renesas,r8a73a4-sdhi";
+                compatible = "renesas,sdhi-r8a73a4";
                reg = <0 0xee140000 0 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 167 4>;
diff --git a/arch/arm/boot/dts/r8a7778.dtsi b/arch/arm/boot/dts/r8a7778.dtsi
index 45ac404ab6d8..3577aba82583 100644
--- a/arch/arm/boot/dts/r8a7778.dtsi
+++ b/arch/arm/boot/dts/r8a7778.dtsi
@@ -96,6 +96,5 @@
        pfc: pfc@fffc0000 {
                compatible = "renesas,pfc-r8a7778";
                reg = <0xfffc000 0x118>;
-                #gpio-range-cells = <3>;
        };
 };
diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
index 23a62447359c..ebbe507fcbfa 100644
--- a/arch/arm/boot/dts/r8a7779.dtsi
+++ b/arch/arm/boot/dts/r8a7779.dtsi
@@ -188,7 +188,6 @@
        pfc: pfc@fffc0000 {
                compatible = "renesas,pfc-r8a7779";
                reg = <0xfffc0000 0x23c>;
-                #gpio-range-cells = <3>;
        };
        thermal@ffc48000 {
diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index 3b879e7c697c..413b4c29e782 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -148,11 +148,10 @@
        pfc: pfc@e6060000 {
                compatible = "renesas,pfc-r8a7790";
                reg = <0 0xe6060000 0 0x250>;
-                #gpio-range-cells = <3>;
        };
        sdhi0: sdhi@ee100000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                reg = <0 0xee100000 0 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 165 4>;
@@ -161,7 +160,7 @@
        };
        sdhi1: sdhi@ee120000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                reg = <0 0xee120000 0 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 166 4>;
@@ -170,7 +169,7 @@
        };
        sdhi2: sdhi@ee140000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                reg = <0 0xee140000 0 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 167 4>;
@@ -179,7 +178,7 @@
        };
        sdhi3: sdhi@ee160000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                reg = <0 0xee160000 0 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 168 4>;
diff --git a/arch/arm/boot/dts/sh73a0.dtsi b/arch/arm/boot/dts/sh73a0.dtsi
index ba59a5875a10..3955c7606a6f 100644
--- a/arch/arm/boot/dts/sh73a0.dtsi
+++ b/arch/arm/boot/dts/sh73a0.dtsi
@@ -196,7 +196,7 @@
        };
        sdhi0: sdhi@ee100000 {
-                compatible = "renesas,r8a7740-sdhi";
+                compatible = "renesas,sdhi-r8a7740";
                reg = <0xee100000 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 83 4
@@ -208,7 +208,7 @@
        /* SDHI1 and SDHI2 have no CD pins, no need for CD IRQ */
        sdhi1: sdhi@ee120000 {
-                compatible = "renesas,r8a7740-sdhi";
+                compatible = "renesas,sdhi-r8a7740";
                reg = <0xee120000 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 88 4
@@ -219,7 +219,7 @@
        };
        sdhi2: sdhi@ee140000 {
-                compatible = "renesas,r8a7740-sdhi";
+                compatible = "renesas,sdhi-r8a7740";
                reg = <0xee140000 0x100>;
                interrupt-parent = <&gic>;
                interrupts = <0 104 4
diff --git a/arch/arm/boot/install.sh b/arch/arm/boot/install.sh
index 06ea7d42ce8e..2a45092a40e3 100644
--- a/arch/arm/boot/install.sh
+++ b/arch/arm/boot/install.sh
@@ -20,6 +20,20 @@
 #   $4 - default install path (blank if root directory)
 #
+verify () {
+        if [ ! -f "$1" ]; then
+                echo ""                                                   1>&2
+                echo " *** Missing file: $1"                              1>&2
+                echo ' *** You need to run "make" before "make install".' 1>&2
+                echo ""                                                   1>&2
+                exit 1
+        fi
+}
+# Make sure the files actually exist
+verify "$2"
+verify "$3"
 # User may have a custom install script
 if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
 if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index 117f955a2a06..8e1a0245907f 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -269,6 +269,11 @@ static const struct edmacc_param dummy_paramset = {
        .ccnt = 1,
 };
+static const struct of_device_id edma_of_ids[] = {
+        { .compatible = "ti,edma3", },
+        {}
+};
 /*****************************************************************************/
 static void map_dmach_queue(unsigned ctlr, unsigned ch_no,
@@ -560,14 +565,38 @@ static int reserve_contiguous_slots(int ctlr, unsigned int id,
 static int prepare_unused_channel_list(struct device *dev, void *data)
 {
        struct platform_device *pdev = to_platform_device(dev);
-        int i, ctlr;
+        int i, count, ctlr;
+        struct of_phandle_args  dma_spec;
+        if (dev->of_node) {
+                count = of_property_count_strings(dev->of_node, "dma-names");
+                if (count < 0)
+                        return 0;
+                for (i = 0; i < count; i++) {
+                        if (of_parse_phandle_with_args(dev->of_node, "dmas",
+                                                       "#dma-cells", i,
+                                                       &dma_spec))
+                                continue;
+                        if (!of_match_node(edma_of_ids, dma_spec.np)) {
+                                of_node_put(dma_spec.np);
+                                continue;
+                        }
+                        clear_bit(EDMA_CHAN_SLOT(dma_spec.args[0]),
+                                  edma_cc[0]->edma_unused);
+                        of_node_put(dma_spec.np);
+                }
+                return 0;
+        }
+        /* For non-OF case */
        for (i = 0; i < pdev->num_resources; i++) {
                if ((pdev->resource[i].flags & IORESOURCE_DMA) &&
                                (int)pdev->resource[i].start >= 0) {
                        ctlr = EDMA_CTLR(pdev->resource[i].start);
                        clear_bit(EDMA_CHAN_SLOT(pdev->resource[i].start),
-                                        edma_cc[ctlr]->edma_unused);
+                                  edma_cc[ctlr]->edma_unused);
                }
        }
@@ -1762,11 +1791,6 @@ static int edma_probe(struct platform_device *pdev)
        return 0;
 }
-static const struct of_device_id edma_of_ids[] = {
-        { .compatible = "ti,edma3", },
-        {}
-};
 static struct platform_driver edma_driver = {
        .driver = {
                .name   = "edma",
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index 370236dd1a03..990250965f2c 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -51,7 +51,8 @@ void mcpm_cpu_power_down(void)
 {
        phys_reset_t phys_reset;
-        BUG_ON(!platform_ops);
+        if (WARN_ON_ONCE(!platform_ops || !platform_ops->power_down))
+                return;
        BUG_ON(!irqs_disabled());
        /*
@@ -93,7 +94,8 @@ void mcpm_cpu_suspend(u64 expected_residency)
 {
        phys_reset_t phys_reset;
-        BUG_ON(!platform_ops);
+        if (WARN_ON_ONCE(!platform_ops || !platform_ops->suspend))
+                return;
        BUG_ON(!irqs_disabled());
        /* Very similar to mcpm_cpu_power_down() */
diff --git a/arch/arm/common/sharpsl_param.c b/arch/arm/common/sharpsl_param.c
index d56c932580eb..025f6ce38596 100644
--- a/arch/arm/common/sharpsl_param.c
+++ b/arch/arm/common/sharpsl_param.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/string.h>
 #include <asm/mach/sharpsl_param.h>
+#include <asm/memory.h>
 /*
 * Certain hardware parameters determined at the time of device manufacture,
@@ -25,8 +26,10 @@
 */
 #ifdef CONFIG_ARCH_SA1100
 #define PARAM_BASE      0xe8ffc000
+#define param_start(x)  (void *)(x)
 #else
 #define PARAM_BASE      0xa0000a00
+#define param_start(x)  __va(x)
 #endif
 #define MAGIC_CHG(a,b,c,d) ( ( d << 24 ) | ( c << 16 )  | ( b << 8 ) | a )
@@ -41,7 +44,7 @@ EXPORT_SYMBOL(sharpsl_param);
 void sharpsl_save_param(void)
 {
-        memcpy(&sharpsl_param, (void *)PARAM_BASE, sizeof(struct sharpsl_param_info));
+        memcpy(&sharpsl_param, param_start(PARAM_BASE), sizeof(struct sharpsl_param_info));
        if (sharpsl_param.comadj_keyword != COMADJ_MAGIC)
                sharpsl_param.comadj=-1;
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index f3935b46df29..119fc378fc52 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -135,6 +135,7 @@ CONFIG_MMC=y
 CONFIG_MMC_ARMMMCI=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_ESDHC_IMX=y
 CONFIG_MMC_SDHCI_TEGRA=y
 CONFIG_MMC_SDHCI_SPEAR=y
 CONFIG_MMC_OMAP=y
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index d3db39860b9c..59ceae8f3c95 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -31,5 +31,4 @@ generic-y += termbits.h
 generic-y += termios.h
 generic-y += timex.h
 generic-y += trace_clock.h
-generic-y += types.h
 generic-y += unaligned.h
diff --git a/arch/arm/include/asm/jump_label.h b/arch/arm/include/asm/jump_label.h
index bfc198c75913..863c892b4aaa 100644
--- a/arch/arm/include/asm/jump_label.h
+++ b/arch/arm/include/asm/jump_label.h
@@ -16,7 +16,7 @@
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:\n\t"
+        asm_volatile_goto("1:\n\t"
                 JUMP_LABEL_NOP "\n\t"
                 ".pushsection __jump_table,  \"aw\"\n\t"
                 ".word 1b, %l[l_yes], %c0\n\t"
diff --git a/arch/arm/include/asm/mcpm.h b/arch/arm/include/asm/mcpm.h
index 0f7b7620e9a5..fc82a88f5b69 100644
--- a/arch/arm/include/asm/mcpm.h
+++ b/arch/arm/include/asm/mcpm.h
@@ -76,8 +76,11 @@ int mcpm_cpu_power_up(unsigned int cpu, unsigned int cluster);
 *
 * This must be called with interrupts disabled.
 *
- * This does not return.  Re-entry in the kernel is expected via
+ * On success this does not return.  Re-entry in the kernel is expected
- * mcpm_entry_point.
+ * via mcpm_entry_point.
+ *
+ * This will return if mcpm_platform_register() has not been called
+ * previously in which case the caller should take appropriate action.
 */
 void mcpm_cpu_power_down(void);
@@ -98,8 +101,11 @@ void mcpm_cpu_power_down(void);
 *
 * This must be called with interrupts disabled.
 *
- * This does not return.  Re-entry in the kernel is expected via
+ * On success this does not return.  Re-entry in the kernel is expected
- * mcpm_entry_point.
+ * via mcpm_entry_point.
+ *
+ * This will return if mcpm_platform_register() has not been called
+ * previously in which case the caller should take appropriate action.
 */
 void mcpm_cpu_suspend(u64 expected_residency);
diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h
index f1d96d4e8092..73ddd7239b33 100644
--- a/arch/arm/include/asm/syscall.h
+++ b/arch/arm/include/asm/syscall.h
@@ -57,6 +57,9 @@ static inline void syscall_get_arguments(struct task_struct *task,
                                         unsigned int i, unsigned int n,
                                         unsigned long *args)
 {
+        if (n == 0)
+                return;
        if (i + n > SYSCALL_MAX_ARGS) {
                unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
                unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
@@ -81,6 +84,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
                                         unsigned int i, unsigned int n,
                                         const unsigned long *args)
 {
+        if (n == 0)
+                return;
        if (i + n > SYSCALL_MAX_ARGS) {
                pr_warning("%s called with max args %d, handling only %d\n",
                           __func__, i + n, SYSCALL_MAX_ARGS);
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 2c7cc1e03473..476de57dcef2 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -487,7 +487,26 @@ __fixup_smp:
        mrc     p15, 0, r0, c0, c0, 5   @ read MPIDR
        and     r0, r0, #0xc0000000     @ multiprocessing extensions and
        teq     r0, #0x80000000         @ not part of a uniprocessor system?
-        moveq   pc, lr                  @ yes, assume SMP
+        bne    __fixup_smp_on_up        @ no, assume UP
+        @ Core indicates it is SMP. Check for Aegis SOC where a single
+        @ Cortex-A9 CPU is present but SMP operations fault.
+        mov     r4, #0x41000000
+        orr     r4, r4, #0x0000c000
+        orr     r4, r4, #0x00000090
+        teq     r3, r4                  @ Check for ARM Cortex-A9
+        movne   pc, lr                  @ Not ARM Cortex-A9,
+        @ If a future SoC *does* use 0x0 as the PERIPH_BASE, then the
+        @ below address check will need to be #ifdef'd or equivalent
+        @ for the Aegis platform.
+        mrc     p15, 4, r0, c15, c0     @ get SCU base address
+        teq     r0, #0x0                @ '0' on actual UP A9 hardware
+        beq     __fixup_smp_on_up       @ So its an A9 UP
+        ldr     r0, [r0, #4]            @ read SCU Config
+        and     r0, r0, #0x3            @ number of CPUs
+        teq     r0, #0x0                @ is 1?
+        movne   pc, lr
 __fixup_smp_on_up:
        adr     r0, 1f
diff --git a/arch/arm/kvm/reset.c b/arch/arm/kvm/reset.c
index 71e08baee209..c02ba4af599f 100644
--- a/arch/arm/kvm/reset.c
+++ b/arch/arm/kvm/reset.c
@@ -58,14 +58,14 @@ static const struct kvm_irq_level a15_vtimer_irq = {
 */
 int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
 {
-        struct kvm_regs *cpu_reset;
+        struct kvm_regs *reset_regs;
        const struct kvm_irq_level *cpu_vtimer_irq;
        switch (vcpu->arch.target) {
        case KVM_ARM_TARGET_CORTEX_A15:
                if (vcpu->vcpu_id > a15_max_cpu_idx)
                        return -EINVAL;
-                cpu_reset = &a15_regs_reset;
+                reset_regs = &a15_regs_reset;
                vcpu->arch.midr = read_cpuid_id();
                cpu_vtimer_irq = &a15_vtimer_irq;
                break;
@@ -74,7 +74,7 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
        }
        /* Reset core registers */
-        memcpy(&vcpu->arch.regs, cpu_reset, sizeof(vcpu->arch.regs));
+        memcpy(&vcpu->arch.regs, reset_regs, sizeof(vcpu->arch.regs));
        /* Reset CP15 registers */
        kvm_reset_coprocs(vcpu);
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index 180b3024bec3..f607deb40f4d 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -93,7 +93,7 @@ static irqreturn_t at91rm9200_timer_interrupt(int irq, void *dev_id)
 static struct irqaction at91rm9200_timer_irq = {
        .name           = "at91_tick",
-        .flags          = IRQF_SHARED | IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,
+        .flags          = IRQF_SHARED | IRQF_TIMER | IRQF_IRQPOLL,
        .handler        = at91rm9200_timer_interrupt,
        .irq            = NR_IRQS_LEGACY + AT91_ID_SYS,
 };
diff --git a/arch/arm/mach-at91/at91sam926x_time.c b/arch/arm/mach-at91/at91sam926x_time.c
index 3a4bc2e1a65e..bb392320a0dd 100644
--- a/arch/arm/mach-at91/at91sam926x_time.c
+++ b/arch/arm/mach-at91/at91sam926x_time.c
@@ -171,7 +171,7 @@ static irqreturn_t at91sam926x_pit_interrupt(int irq, void *dev_id)
 static struct irqaction at91sam926x_pit_irq = {
        .name           = "at91_tick",
-        .flags          = IRQF_SHARED | IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,
+        .flags          = IRQF_SHARED | IRQF_TIMER | IRQF_IRQPOLL,
        .handler        = at91sam926x_pit_interrupt,
        .irq            = NR_IRQS_LEGACY + AT91_ID_SYS,
 };
diff --git a/arch/arm/mach-at91/at91sam9g45_reset.S b/arch/arm/mach-at91/at91sam9g45_reset.S
index 721a1a34dd1d..c40c1e2ef80f 100644
--- a/arch/arm/mach-at91/at91sam9g45_reset.S
+++ b/arch/arm/mach-at91/at91sam9g45_reset.S
@@ -16,11 +16,17 @@
 #include "at91_rstc.h"
                        .arm
+/*
+ * at91_ramc_base is an array void*
+ * init at NULL if only one DDR controler is present in or DT
+ */
                        .globl  at91sam9g45_restart
 at91sam9g45_restart:
                        ldr     r5, =at91_ramc_base             @ preload constants
                        ldr     r0, [r5]
+                        ldr     r5, [r5, #4]                    @ ddr1
+                        cmp     r5, #0
                        ldr     r4, =at91_rstc_base
                        ldr     r1, [r4]
@@ -30,6 +36,8 @@ at91sam9g45_restart:
                        .balign 32                              @ align to cache line
+                        strne   r2, [r5, #AT91_DDRSDRC_RTR]     @ disable DDR1 access
+                        strne   r3, [r5, #AT91_DDRSDRC_LPR]     @ power down DDR1
                        str     r2, [r0, #AT91_DDRSDRC_RTR]     @ disable DDR0 access
                        str     r3, [r0, #AT91_DDRSDRC_LPR]     @ power down DDR0
                        str     r4, [r1, #AT91_RSTC_CR]         @ reset processor
diff --git a/arch/arm/mach-at91/at91x40_time.c b/arch/arm/mach-at91/at91x40_time.c
index 2919eba41ff4..c0e637adf65d 100644
--- a/arch/arm/mach-at91/at91x40_time.c
+++ b/arch/arm/mach-at91/at91x40_time.c
@@ -57,7 +57,7 @@ static irqreturn_t at91x40_timer_interrupt(int irq, void *dev_id)
 static struct irqaction at91x40_timer_irq = {
        .name           = "at91_tick",
-        .flags          = IRQF_DISABLED | IRQF_TIMER,
+        .flags          = IRQF_TIMER,
        .handler        = at91x40_timer_interrupt
 };
diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
index 92b7f770615a..4078ba93776b 100644
--- a/arch/arm/mach-davinci/board-dm365-evm.c
+++ b/arch/arm/mach-davinci/board-dm365-evm.c
@@ -176,7 +176,7 @@ static struct at24_platform_data eeprom_info = {
        .context        = (void *)0x7f00,
 };
-static struct snd_platform_data dm365_evm_snd_data = {
+static struct snd_platform_data dm365_evm_snd_data __maybe_unused = {
        .asp_chan_q = EVENTQ_3,
 };
diff --git a/arch/arm/mach-davinci/include/mach/serial.h b/arch/arm/mach-davinci/include/mach/serial.h
index 52b8571b2e70..ce402cd21fa0 100644
--- a/arch/arm/mach-davinci/include/mach/serial.h
+++ b/arch/arm/mach-davinci/include/mach/serial.h
@@ -15,8 +15,6 @@
 #include <mach/hardware.h>
-#include <linux/platform_device.h>
 #define DAVINCI_UART0_BASE      (IO_PHYS + 0x20000)
 #define DAVINCI_UART1_BASE      (IO_PHYS + 0x20400)
 #define DAVINCI_UART2_BASE      (IO_PHYS + 0x20800)
@@ -39,6 +37,8 @@
 #define UART_DM646X_SCR_TX_WATERMARK    0x08
 #ifndef __ASSEMBLY__
+#include <linux/platform_device.h>
 extern int davinci_serial_init(struct platform_device *);
 #endif
diff --git a/arch/arm/mach-integrator/pci_v3.h b/arch/arm/mach-integrator/pci_v3.h
index 755fd29fed4a..06a9e2e7d007 100644
--- a/arch/arm/mach-integrator/pci_v3.h
+++ b/arch/arm/mach-integrator/pci_v3.h
@@ -1,2 +1,9 @@
 /* Simple oneliner include to the PCIv3 early init */
+#ifdef CONFIG_PCI
 extern int pci_v3_early_init(void);
+#else
+static inline int pci_v3_early_init(void)
+{
+        return 0;
+}
+#endif
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index 4c24303ec481..58adf2fd9cfc 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -140,6 +140,7 @@ int __init coherency_init(void)
                coherency_base = of_iomap(np, 0);
                coherency_cpu_base = of_iomap(np, 1);
                set_cpu_coherent(cpu_logical_map(smp_processor_id()), 0);
+                of_node_put(np);
        }
        return 0;
@@ -147,9 +148,14 @@ int __init coherency_init(void)
 static int __init coherency_late_init(void)
 {
-        if (of_find_matching_node(NULL, of_coherency_table))
+        struct device_node *np;
+        np = of_find_matching_node(NULL, of_coherency_table);
+        if (np) {
                bus_register_notifier(&platform_bus_type,
                                      &mvebu_hwcc_platform_nb);
+                of_node_put(np);
+        }
        return 0;
 }
diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
index 3cc4bef6401c..27fc4f049474 100644
--- a/arch/arm/mach-mvebu/pmsu.c
+++ b/arch/arm/mach-mvebu/pmsu.c
@@ -67,6 +67,7 @@ int __init armada_370_xp_pmsu_init(void)
                pr_info("Initializing Power Management Service Unit\n");
                pmsu_mp_base = of_iomap(np, 0);
                pmsu_reset_base = of_iomap(np, 1);
+                of_node_put(np);
        }
        return 0;
diff --git a/arch/arm/mach-mvebu/system-controller.c b/arch/arm/mach-mvebu/system-controller.c
index f875124ff4f9..5175083cdb34 100644
--- a/arch/arm/mach-mvebu/system-controller.c
+++ b/arch/arm/mach-mvebu/system-controller.c
@@ -98,6 +98,7 @@ static int __init mvebu_system_controller_init(void)
                BUG_ON(!match);
                system_controller_base = of_iomap(np, 0);
                mvebu_sc = (struct mvebu_system_controller *)match->data;
+                of_node_put(np);
        }
        return 0;
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 39c78387ddec..87162e1b94a5 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -129,6 +129,24 @@ DT_MACHINE_START(OMAP3_DT, "Generic OMAP3 (Flattened Device Tree)")
        .restart        = omap3xxx_restart,
 MACHINE_END
+static const char *omap36xx_boards_compat[] __initdata = {
+        "ti,omap36xx",
+        NULL,
+};
+DT_MACHINE_START(OMAP36XX_DT, "Generic OMAP36xx (Flattened Device Tree)")
+        .reserve        = omap_reserve,
+        .map_io         = omap3_map_io,
+        .init_early     = omap3630_init_early,
+        .init_irq       = omap_intc_of_init,
+        .handle_irq     = omap3_intc_handle_irq,
+        .init_machine   = omap_generic_init,
+        .init_late      = omap3_init_late,
+        .init_time      = omap3_sync32k_timer_init,
+        .dt_compat      = omap36xx_boards_compat,
+        .restart        = omap3xxx_restart,
+MACHINE_END
 static const char *omap3_gp_boards_compat[] __initdata = {
        "ti,omap3-beagle",
        "timll,omap3-devkit8000",
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index c3270c0f1fce..f6fe388af989 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -167,38 +167,47 @@ static struct lp55xx_led_config rx51_lp5523_led_config[] = {
                .name           = "lp5523:kb1",
                .chan_nr        = 0,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:kb2",
                .chan_nr        = 1,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:kb3",
                .chan_nr        = 2,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:kb4",
                .chan_nr        = 3,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:b",
                .chan_nr        = 4,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:g",
                .chan_nr        = 5,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:r",
                .chan_nr        = 6,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:kb5",
                .chan_nr        = 7,
                .led_current    = 50,
+                .max_current    = 100,
        }, {
                .name           = "lp5523:kb6",
                .chan_nr        = 8,
                .led_current    = 50,
+                .max_current    = 100,
        }
 };
diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c
index 64b5a8346982..8b6876c98ce1 100644
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -272,9 +272,19 @@ static int omap2_onenand_setup_async(void __iomem *onenand_base)
        struct gpmc_timings t;
        int ret;
-        if (gpmc_onenand_data->of_node)
+        if (gpmc_onenand_data->of_node) {
                gpmc_read_settings_dt(gpmc_onenand_data->of_node,
                                      &onenand_async);
+                if (onenand_async.sync_read || onenand_async.sync_write) {
+                        if (onenand_async.sync_write)
+                                gpmc_onenand_data->flags |=
+                                        ONENAND_SYNC_READWRITE;
+                        else
+                                gpmc_onenand_data->flags |= ONENAND_SYNC_READ;
+                        onenand_async.sync_read = false;
+                        onenand_async.sync_write = false;
+                }
+        }
        omap2_onenand_set_async_mode(onenand_base);
diff --git a/arch/arm/mach-omap2/mux.h b/arch/arm/mach-omap2/mux.h
index 5d2080ef7923..16f78a990d04 100644
--- a/arch/arm/mach-omap2/mux.h
+++ b/arch/arm/mach-omap2/mux.h
@@ -28,7 +28,7 @@
 #define OMAP_PULL_UP                    (1 << 4)
 #define OMAP_ALTELECTRICALSEL           (1 << 5)
-/* 34xx specific mux bit defines */
+/* omap3/4/5 specific mux bit defines */
 #define OMAP_INPUT_EN                   (1 << 8)
 #define OMAP_OFF_EN                     (1 << 9)
 #define OMAP_OFFOUT_EN                  (1 << 10)
@@ -36,8 +36,6 @@
 #define OMAP_OFF_PULL_EN                (1 << 12)
 #define OMAP_OFF_PULL_UP                (1 << 13)
 #define OMAP_WAKEUP_EN                  (1 << 14)
-/* 44xx specific mux bit defines */
 #define OMAP_WAKEUP_EVENT               (1 << 15)
 /* Active pin states */
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index fa74a0625da1..ead48fa5715e 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -628,7 +628,7 @@ void __init omap4_local_timer_init(void)
 #endif /* CONFIG_HAVE_ARM_TWD */
 #endif /* CONFIG_ARCH_OMAP4 */
-#ifdef CONFIG_SOC_OMAP5
+#if defined(CONFIG_SOC_OMAP5) || defined(CONFIG_SOC_DRA7XX)
 void __init omap5_realtime_timer_init(void)
 {
        omap4_sync32k_timer_init();
@@ -636,7 +636,7 @@ void __init omap5_realtime_timer_init(void)
        clocksource_of_init();
 }
-#endif /* CONFIG_SOC_OMAP5 */
+#endif /* CONFIG_SOC_OMAP5 || CONFIG_SOC_DRA7XX */
 /**
 * omap_timer_init - build and register timer device with an
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 5bd1479d3deb..7f8f6076d360 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -1108,9 +1108,9 @@ static const struct pinctrl_map eva_pinctrl_map[] = {
        PIN_MAP_MUX_GROUP_DEFAULT("asoc-simple-card.1", "pfc-r8a7740",
                                  "fsib_mclk_in", "fsib"),
        /* GETHER */
-        PIN_MAP_MUX_GROUP_DEFAULT("sh-eth", "pfc-r8a7740",
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7740-gether", "pfc-r8a7740",
                                  "gether_mii", "gether"),
-        PIN_MAP_MUX_GROUP_DEFAULT("sh-eth", "pfc-r8a7740",
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7740-gether", "pfc-r8a7740",
                                  "gether_int", "gether"),
        /* HDMI */
        PIN_MAP_MUX_GROUP_DEFAULT("sh-mobile-hdmi", "pfc-r8a7740",
diff --git a/arch/arm/mach-shmobile/board-lager.c b/arch/arm/mach-shmobile/board-lager.c
index ffb6f0ac7606..5930af8d434f 100644
--- a/arch/arm/mach-shmobile/board-lager.c
+++ b/arch/arm/mach-shmobile/board-lager.c
@@ -29,6 +29,7 @@
 #include <linux/pinctrl/machine.h>
 #include <linux/platform_data/gpio-rcar.h>
 #include <linux/platform_device.h>
+#include <linux/phy.h>
 #include <linux/regulator/fixed.h>
 #include <linux/regulator/machine.h>
 #include <linux/sh_eth.h>
@@ -155,6 +156,30 @@ static void __init lager_add_standard_devices(void)
                                          &ether_pdata, sizeof(ether_pdata));
 }
+/*
+ * Ether LEDs on the Lager board are named LINK and ACTIVE which corresponds
+ * to non-default 01 setting of the Micrel KSZ8041 PHY control register 1 bits
+ * 14-15. We have to set them back to 01 from the default 00 value each time
+ * the PHY is reset. It's also important because the PHY's LED0 signal is
+ * connected to SoC's ETH_LINK signal and in the PHY's default mode it will
+ * bounce on and off after each packet, which we apparently want to avoid.
+ */
+static int lager_ksz8041_fixup(struct phy_device *phydev)
+{
+        u16 phyctrl1 = phy_read(phydev, 0x1e);
+        phyctrl1 &= ~0xc000;
+        phyctrl1 |= 0x4000;
+        return phy_write(phydev, 0x1e, phyctrl1);
+}
+static void __init lager_init(void)
+{
+        lager_add_standard_devices();
+        phy_register_fixup_for_id("r8a7790-ether-ff:01", lager_ksz8041_fixup);
+}
 static const char *lager_boards_compat_dt[] __initdata = {
        "renesas,lager",
        NULL,
@@ -163,6 +188,6 @@ static const char *lager_boards_compat_dt[] __initdata = {
 DT_MACHINE_START(LAGER_DT, "lager")
        .init_early     = r8a7790_init_delay,
        .init_time      = r8a7790_timer_init,
-        .init_machine   = lager_add_standard_devices,
+        .init_machine   = lager_init,
        .dt_compat      = lager_boards_compat_dt,
 MACHINE_END
diff --git a/arch/arm/mach-vexpress/tc2_pm.c b/arch/arm/mach-vexpress/tc2_pm.c
index 7aeb5d60e484..e6eb48192912 100644
--- a/arch/arm/mach-vexpress/tc2_pm.c
+++ b/arch/arm/mach-vexpress/tc2_pm.c
@@ -131,6 +131,16 @@ static void tc2_pm_down(u64 residency)
        } else
                BUG();
+        /*
+         * If the CPU is committed to power down, make sure
+         * the power controller will be in charge of waking it
+         * up upon IRQ, ie IRQ lines are cut from GIC CPU IF
+         * to the CPU by disabling the GIC CPU IF to prevent wfi
+         * from completing execution behind power controller back
+         */
+        if (!skip_wfi)
+                gic_cpu_if_down();
        if (last_man && __mcpm_outbound_enter_critical(cpu, cluster)) {
                arch_spin_unlock(&tc2_pm_lock);
@@ -231,7 +241,6 @@ static void tc2_pm_suspend(u64 residency)
        cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0);
        cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
        ve_spc_set_resume_addr(cluster, cpu, virt_to_phys(mcpm_entry_point));
-        gic_cpu_if_down();
        tc2_pm_down(residency);
 }
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f5e1a8471714..1272ed202dde 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1232,7 +1232,8 @@ __iommu_create_mapping(struct device *dev, struct page **pages, size_t size)
                                break;
                len = (j - i) << PAGE_SHIFT;
-                ret = iommu_map(mapping->domain, iova, phys, len, 0);
+                ret = iommu_map(mapping->domain, iova, phys, len,
+                                IOMMU_READ|IOMMU_WRITE);
                if (ret < 0)
                        goto fail;
                iova += len;
@@ -1431,6 +1432,27 @@ static int arm_iommu_get_sgtable(struct device *dev, struct sg_table *sgt,
                                         GFP_KERNEL);
 }
+static int __dma_direction_to_prot(enum dma_data_direction dir)
+{
+        int prot;
+        switch (dir) {
+        case DMA_BIDIRECTIONAL:
+                prot = IOMMU_READ | IOMMU_WRITE;
+                break;
+        case DMA_TO_DEVICE:
+                prot = IOMMU_READ;
+                break;
+        case DMA_FROM_DEVICE:
+                prot = IOMMU_WRITE;
+                break;
+        default:
+                prot = 0;
+        }
+        return prot;
+}
 /*
 * Map a part of the scatter-gather list into contiguous io address space
 */
@@ -1444,6 +1466,7 @@ static int __map_sg_chunk(struct device *dev, struct scatterlist *sg,
        int ret = 0;
        unsigned int count;
        struct scatterlist *s;
+        int prot;
        size = PAGE_ALIGN(size);
        *handle = DMA_ERROR_CODE;
@@ -1460,7 +1483,9 @@ static int __map_sg_chunk(struct device *dev, struct scatterlist *sg,
                        !dma_get_attr(DMA_ATTR_SKIP_CPU_SYNC, attrs))
                        __dma_page_cpu_to_dev(sg_page(s), s->offset, s->length, dir);
-                ret = iommu_map(mapping->domain, iova, phys, len, 0);
+                prot = __dma_direction_to_prot(dir);
+                ret = iommu_map(mapping->domain, iova, phys, len, prot);
                if (ret < 0)
                        goto fail;
                count += len >> PAGE_SHIFT;
@@ -1665,19 +1690,7 @@ static dma_addr_t arm_coherent_iommu_map_page(struct device *dev, struct page *p
        if (dma_addr == DMA_ERROR_CODE)
                return dma_addr;
-        switch (dir) {
+        prot = __dma_direction_to_prot(dir);
-        case DMA_BIDIRECTIONAL:
-                prot = IOMMU_READ | IOMMU_WRITE;
-                break;
-        case DMA_TO_DEVICE:
-                prot = IOMMU_READ;
-                break;
-        case DMA_FROM_DEVICE:
-                prot = IOMMU_WRITE;
-                break;
-        default:
-                prot = 0;
-        }
        ret = iommu_map(mapping->domain, dma_addr, page_to_phys(page), len, prot);
        if (ret < 0)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index febaee7ca57b..18ec4c504abf 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -17,7 +17,6 @@
 #include <linux/nodemask.h>
 #include <linux/initrd.h>
 #include <linux/of_fdt.h>
-#include <linux/of_reserved_mem.h>
 #include <linux/highmem.h>
 #include <linux/gfp.h>
 #include <linux/memblock.h>
@@ -379,8 +378,6 @@ void __init arm_memblock_init(struct meminfo *mi,
        if (mdesc->reserve)
                mdesc->reserve();
-        early_init_dt_scan_reserved_mem();
        /*
         * reserve memory for DMA contigouos allocations,
         * must come from DMA area inside low memory
diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug
index 1a6bfe954d49..835c559786bd 100644
--- a/arch/arm64/Kconfig.debug
+++ b/arch/arm64/Kconfig.debug
@@ -6,13 +6,6 @@ config FRAME_POINTER
        bool
        default y
-config DEBUG_STACK_USAGE
-        bool "Enable stack utilization instrumentation"
-        depends on DEBUG_KERNEL
-        help
-          Enables the display of the minimum amount of free stack which each
-          task has ever had available in the sysrq-T output.
 config EARLY_PRINTK
        bool "Early printk support"
        default y
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 5b3e83217b03..31c81e9b792e 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -42,7 +42,7 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_WIRELESS is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
-# CONFIG_BLK_DEV is not set
+CONFIG_BLK_DEV=y
 CONFIG_SCSI=y
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
@@ -72,6 +72,7 @@ CONFIG_LOGO=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
 # CONFIG_EXT3_FS_XATTR is not set
 CONFIG_FUSE_FS=y
@@ -90,3 +91,5 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_INFO=y
 # CONFIG_FTRACE is not set
 CONFIG_ATOMIC64_SELFTEST=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_BLK=y
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index edb3d5c73a32..7ecc2b23882e 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -166,9 +166,10 @@ do {									\
 #define get_user(x, ptr)                                                \
 ({                                                                      \
+        __typeof__(*(ptr)) __user *__p = (ptr);                         \
        might_fault();                                                  \
-        access_ok(VERIFY_READ, (ptr), sizeof(*(ptr))) ?                 \
+        access_ok(VERIFY_READ, __p, sizeof(*__p)) ?                     \
-                __get_user((x), (ptr)) :                                \
+                __get_user((x), __p) :                                  \
                ((x) = 0, -EFAULT);                                     \
 })
@@ -227,9 +228,10 @@ do {									\
 #define put_user(x, ptr)                                                \
 ({                                                                      \
+        __typeof__(*(ptr)) __user *__p = (ptr);                         \
        might_fault();                                                  \
-        access_ok(VERIFY_WRITE, (ptr), sizeof(*(ptr))) ?                \
+        access_ok(VERIFY_WRITE, __p, sizeof(*__p)) ?                    \
-                __put_user((x), (ptr)) :                                \
+                __put_user((x), __p) :                                  \
                -EFAULT;                                                \
 })
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 1f2e4d5a5c0f..bb785d23dbde 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -80,8 +80,10 @@ void fpsimd_thread_switch(struct task_struct *next)
 void fpsimd_flush_thread(void)
 {
+        preempt_disable();
        memset(&current->thread.fpsimd_state, 0, sizeof(struct fpsimd_state));
        fpsimd_load_state(&current->thread.fpsimd_state);
+        preempt_enable();
 }
 #ifdef CONFIG_KERNEL_MODE_NEON
diff --git a/arch/arm64/mm/tlb.S b/arch/arm64/mm/tlb.S
index 8ae80a18e8ec..19da91e0cd27 100644
--- a/arch/arm64/mm/tlb.S
+++ b/arch/arm64/mm/tlb.S
@@ -35,7 +35,7 @@
 */
 ENTRY(__cpu_flush_user_tlb_range)
        vma_vm_mm x3, x2                        // get vma->vm_mm
-        mmid    x3, x3                          // get vm_mm->context.id
+        mmid    w3, x3                          // get vm_mm->context.id
        dsb     sy
        lsr     x0, x0, #12                     // align address
        lsr     x1, x1, #12
diff --git a/arch/avr32/include/asm/Kbuild b/arch/avr32/include/asm/Kbuild
index d22af851f3f6..fd7980743890 100644
--- a/arch/avr32/include/asm/Kbuild
+++ b/arch/avr32/include/asm/Kbuild
@@ -1,5 +1,19 @@
 generic-y       += clkdev.h
+generic-y       += cputime.h
+generic-y       += delay.h
+generic-y       += device.h
+generic-y       += div64.h
+generic-y       += emergency-restart.h
 generic-y       += exec.h
-generic-y       += trace_clock.h
+generic-y       += futex.h
+generic-y       += irq_regs.h
 generic-y       += param.h
+generic-y       += local.h
+generic-y       += local64.h
+generic-y       += percpu.h
+generic-y       += scatterlist.h
+generic-y       += sections.h
+generic-y       += topology.h
+generic-y       += trace_clock.h
+generic-y       += xor.h
diff --git a/arch/avr32/include/asm/cputime.h b/arch/avr32/include/asm/cputime.h
deleted file mode 100644
index e87e0f81cbeb..000000000000
--- a/arch/avr32/include/asm/cputime.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_CPUTIME_H
-#define __ASM_AVR32_CPUTIME_H
-#include <asm-generic/cputime.h>
-#endif /* __ASM_AVR32_CPUTIME_H */
diff --git a/arch/avr32/include/asm/delay.h b/arch/avr32/include/asm/delay.h
deleted file mode 100644
index 9670e127b7b2..000000000000
--- a/arch/avr32/include/asm/delay.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/delay.h>
diff --git a/arch/avr32/include/asm/device.h b/arch/avr32/include/asm/device.h
deleted file mode 100644
index d8f9872b0e2d..000000000000
--- a/arch/avr32/include/asm/device.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Arch specific extensions to struct device
- *
- * This file is released under the GPLv2
- */
-#include <asm-generic/device.h>
diff --git a/arch/avr32/include/asm/div64.h b/arch/avr32/include/asm/div64.h
deleted file mode 100644
index d7ddd4fdeca6..000000000000
--- a/arch/avr32/include/asm/div64.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_DIV64_H
-#define __ASM_AVR32_DIV64_H
-#include <asm-generic/div64.h>
-#endif /* __ASM_AVR32_DIV64_H */
diff --git a/arch/avr32/include/asm/emergency-restart.h b/arch/avr32/include/asm/emergency-restart.h
deleted file mode 100644
index 3e7e014776ba..000000000000
--- a/arch/avr32/include/asm/emergency-restart.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_EMERGENCY_RESTART_H
-#define __ASM_AVR32_EMERGENCY_RESTART_H
-#include <asm-generic/emergency-restart.h>
-#endif /* __ASM_AVR32_EMERGENCY_RESTART_H */
diff --git a/arch/avr32/include/asm/futex.h b/arch/avr32/include/asm/futex.h
deleted file mode 100644
index 10419f14a68a..000000000000
--- a/arch/avr32/include/asm/futex.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_FUTEX_H
-#define __ASM_AVR32_FUTEX_H
-#include <asm-generic/futex.h>
-#endif /* __ASM_AVR32_FUTEX_H */
diff --git a/arch/avr32/include/asm/irq_regs.h b/arch/avr32/include/asm/irq_regs.h
deleted file mode 100644
index 3dd9c0b70270..000000000000
--- a/arch/avr32/include/asm/irq_regs.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/irq_regs.h>
diff --git a/arch/avr32/include/asm/local.h b/arch/avr32/include/asm/local.h
deleted file mode 100644
index 1c1619694da3..000000000000
--- a/arch/avr32/include/asm/local.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_LOCAL_H
-#define __ASM_AVR32_LOCAL_H
-#include <asm-generic/local.h>
-#endif /* __ASM_AVR32_LOCAL_H */
diff --git a/arch/avr32/include/asm/local64.h b/arch/avr32/include/asm/local64.h
deleted file mode 100644
index 36c93b5cc239..000000000000
--- a/arch/avr32/include/asm/local64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/local64.h>
diff --git a/arch/avr32/include/asm/percpu.h b/arch/avr32/include/asm/percpu.h
deleted file mode 100644
index 69227b4cd0d4..000000000000
--- a/arch/avr32/include/asm/percpu.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_PERCPU_H
-#define __ASM_AVR32_PERCPU_H
-#include <asm-generic/percpu.h>
-#endif /* __ASM_AVR32_PERCPU_H */
diff --git a/arch/avr32/include/asm/scatterlist.h b/arch/avr32/include/asm/scatterlist.h
deleted file mode 100644
index a5902d9834e8..000000000000
--- a/arch/avr32/include/asm/scatterlist.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_SCATTERLIST_H
-#define __ASM_AVR32_SCATTERLIST_H
-#include <asm-generic/scatterlist.h>
-#endif /* __ASM_AVR32_SCATTERLIST_H */
diff --git a/arch/avr32/include/asm/sections.h b/arch/avr32/include/asm/sections.h
deleted file mode 100644
index aa14252e4181..000000000000
--- a/arch/avr32/include/asm/sections.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_SECTIONS_H
-#define __ASM_AVR32_SECTIONS_H
-#include <asm-generic/sections.h>
-#endif /* __ASM_AVR32_SECTIONS_H */
diff --git a/arch/avr32/include/asm/topology.h b/arch/avr32/include/asm/topology.h
deleted file mode 100644
index 5b766cbb4806..000000000000
--- a/arch/avr32/include/asm/topology.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_TOPOLOGY_H
-#define __ASM_AVR32_TOPOLOGY_H
-#include <asm-generic/topology.h>
-#endif /* __ASM_AVR32_TOPOLOGY_H */
diff --git a/arch/avr32/include/asm/xor.h b/arch/avr32/include/asm/xor.h
deleted file mode 100644
index 99c87aa0af4f..000000000000
--- a/arch/avr32/include/asm/xor.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _ASM_XOR_H
-#define _ASM_XOR_H
-#include <asm-generic/xor.h>
-#endif
diff --git a/arch/avr32/kernel/process.c b/arch/avr32/kernel/process.c
index c2731003edef..42a53e740a7e 100644
--- a/arch/avr32/kernel/process.c
+++ b/arch/avr32/kernel/process.c
@@ -289,7 +289,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
                memset(childregs, 0, sizeof(struct pt_regs));
                p->thread.cpu_context.r0 = arg;
                p->thread.cpu_context.r1 = usp; /* fn */
-                p->thread.cpu_context.r2 = syscall_return;
+                p->thread.cpu_context.r2 = (unsigned long)syscall_return;
                p->thread.cpu_context.pc = (unsigned long)ret_from_kernel_thread;
                childregs->sr = MODE_SUPERVISOR;
        } else {
diff --git a/arch/avr32/kernel/time.c b/arch/avr32/kernel/time.c
index 869a1c6ffeee..12f828ad5058 100644
--- a/arch/avr32/kernel/time.c
+++ b/arch/avr32/kernel/time.c
@@ -98,7 +98,14 @@ static void comparator_mode(enum clock_event_mode mode,
        case CLOCK_EVT_MODE_SHUTDOWN:
                sysreg_write(COMPARE, 0);
                pr_debug("%s: stop\n", evdev->name);
-                cpu_idle_poll_ctrl(false);
+                if (evdev->mode == CLOCK_EVT_MODE_ONESHOT ||
+                    evdev->mode == CLOCK_EVT_MODE_RESUME) {
+                        /*
+                         * Only disable idle poll if we have forced that
+                         * in a previous call.
+                         */
+                        cpu_idle_poll_ctrl(false);
+                }
                break;
        default:
                BUG();
diff --git a/arch/mips/alchemy/board-mtx1.c b/arch/mips/alchemy/board-mtx1.c
index 4a9baa9f6330..9969dbab19e3 100644
--- a/arch/mips/alchemy/board-mtx1.c
+++ b/arch/mips/alchemy/board-mtx1.c
@@ -276,7 +276,7 @@ static struct platform_device mtx1_pci_host = {
        .resource       = alchemy_pci_host_res,
 };
-static struct __initdata platform_device * mtx1_devs[] = {
+static struct platform_device *mtx1_devs[] __initdata = {
        &mtx1_pci_host,
        &mtx1_gpio_leds,
        &mtx1_wdt,
diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h
index 4d6d77ed9b9d..e194f957ca8c 100644
--- a/arch/mips/include/asm/jump_label.h
+++ b/arch/mips/include/asm/jump_label.h
@@ -22,7 +22,7 @@
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:\tnop\n\t"
+        asm_volatile_goto("1:\tnop\n\t"
                "nop\n\t"
                ".pushsection __jump_table,  \"aw\"\n\t"
                WORD_INSN " 1b, %l[l_yes], %0\n\t"
diff --git a/arch/mips/kernel/octeon_switch.S b/arch/mips/kernel/octeon_switch.S
index 4204d76af854..029e002a4ea0 100644
--- a/arch/mips/kernel/octeon_switch.S
+++ b/arch/mips/kernel/octeon_switch.S
@@ -73,7 +73,7 @@
 3:
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
        LONG_L  t9, TASK_STACK_CANARY(a1)
        LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 38af83f84c4a..20b7b040e76f 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -67,7 +67,7 @@ LEAF(resume)
 1:
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
        LONG_L  t9, TASK_STACK_CANARY(a1)
        LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index 921238a6bd26..078de5eaca8f 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -69,7 +69,7 @@
 1:
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
        LONG_L  t9, TASK_STACK_CANARY(a1)
        LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 627883bc6d5f..bc6f96fcb529 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -609,6 +609,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
                        r4k_blast_scache();
                else
                        blast_scache_range(addr, addr + size);
+                preempt_enable();
                __sync();
                return;
        }
@@ -650,6 +651,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
                         */
                        blast_inv_scache_range(addr, addr + size);
                }
+                preempt_enable();
                __sync();
                return;
        }
diff --git a/arch/parisc/include/asm/traps.h b/arch/parisc/include/asm/traps.h
index 1945f995f2df..4736020ba5ea 100644
--- a/arch/parisc/include/asm/traps.h
+++ b/arch/parisc/include/asm/traps.h
@@ -6,7 +6,7 @@ struct pt_regs;
 /* traps.c */
 void parisc_terminate(char *msg, struct pt_regs *regs,
-                int code, unsigned long offset);
+                int code, unsigned long offset) __noreturn __cold;
 /* mm/fault.c */
 void do_page_fault(struct pt_regs *regs, unsigned long code,
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index c035673209f7..b521c0adf4ec 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -602,6 +602,7 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
        }
 }
+EXPORT_SYMBOL_GPL(flush_cache_page);
 #ifdef CONFIG_PARISC_TMPALIAS
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 8a252f2d6c08..2b96602e812f 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -72,7 +72,6 @@ enum ipi_message_type {
        IPI_NOP=0,
        IPI_RESCHEDULE=1,
        IPI_CALL_FUNC,
-        IPI_CALL_FUNC_SINGLE,
        IPI_CPU_START,
        IPI_CPU_STOP,
        IPI_CPU_TEST
@@ -164,11 +163,6 @@ ipi_interrupt(int irq, void *dev_id)
                                generic_smp_call_function_interrupt();
                                break;
-                        case IPI_CALL_FUNC_SINGLE:
-                                smp_debug(100, KERN_DEBUG "CPU%d IPI_CALL_FUNC_SINGLE\n", this_cpu);
-                                generic_smp_call_function_single_interrupt();
-                                break;
                        case IPI_CPU_START:
                                smp_debug(100, KERN_DEBUG "CPU%d IPI_CPU_START\n", this_cpu);
                                break;
@@ -260,7 +254,7 @@ void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 void arch_send_call_function_single_ipi(int cpu)
 {
-        send_IPI_single(cpu, IPI_CALL_FUNC_SINGLE);
+        send_IPI_single(cpu, IPI_CALL_FUNC);
 }
 /*
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 04e47c6a4562..1cd1d0c83b6d 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -291,11 +291,6 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)
        do_exit(SIGSEGV);
 }
-int syscall_ipi(int (*syscall) (struct pt_regs *), struct pt_regs *regs)
-{
-        return syscall(regs);
-}
 /* gdb uses break 4,8 */
 #define GDB_BREAK_INSN 0x10004
 static void handle_gdb_break(struct pt_regs *regs, int wot)
@@ -805,14 +800,14 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
        else {
            /*
-             * The kernel should never fault on its own address space.
+             * The kernel should never fault on its own address space,
+             * unless pagefault_disable() was called before.
             */
-            if (fault_space == 0) 
+            if (fault_space == 0 && !in_atomic())
            {
                pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
                parisc_terminate("Kernel Fault", regs, code, fault_address);
-        
            }
        }
diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
index ac4370b1ca40..b5507ec06b84 100644
--- a/arch/parisc/lib/memcpy.c
+++ b/arch/parisc/lib/memcpy.c
@@ -56,7 +56,7 @@
 #ifdef __KERNEL__
 #include <linux/module.h>
 #include <linux/compiler.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #define s_space "%%sr1"
 #define d_space "%%sr2"
 #else
@@ -524,4 +524,17 @@ EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(copy_from_user);
 EXPORT_SYMBOL(copy_in_user);
 EXPORT_SYMBOL(memcpy);
+long probe_kernel_read(void *dst, const void *src, size_t size)
+{
+        unsigned long addr = (unsigned long)src;
+        if (size < 0 || addr < PAGE_SIZE)
+                return -EFAULT;
+        /* check for I/O space F_EXTEND(0xfff00000) access as well? */
+        return __probe_kernel_read(dst, src, size);
+}
 #endif
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index d10d27a720c0..0293588d5b8c 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -171,17 +171,25 @@ void do_page_fault(struct pt_regs *regs, unsigned long code,
                              unsigned long address)
 {
        struct vm_area_struct *vma, *prev_vma;
-        struct task_struct *tsk = current;
+        struct task_struct *tsk;
-        struct mm_struct *mm = tsk->mm;
+        struct mm_struct *mm;
        unsigned long acc_type;
        int fault;
-        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+        unsigned int flags;
-        if (in_atomic() || !mm)
+        if (in_atomic())
                goto no_context;
+        tsk = current;
+        mm = tsk->mm;
+        if (!mm)
+                goto no_context;
+        flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
        if (user_mode(regs))
                flags |= FAULT_FLAG_USER;
+        acc_type = parisc_acctyp(code, regs->iir);
        if (acc_type & VM_WRITE)
                flags |= FAULT_FLAG_WRITE;
 retry:
@@ -196,8 +204,6 @@ retry:
 good_area:
-        acc_type = parisc_acctyp(code,regs->iir);
        if ((vma->vm_flags & acc_type) != acc_type)
                goto bad_area;
diff --git a/arch/powerpc/include/asm/jump_label.h b/arch/powerpc/include/asm/jump_label.h
index ae098c438f00..f016bb699b5f 100644
--- a/arch/powerpc/include/asm/jump_label.h
+++ b/arch/powerpc/include/asm/jump_label.h
@@ -19,7 +19,7 @@
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:\n\t"
+        asm_volatile_goto("1:\n\t"
                 "nop\n\t"
                 ".pushsection __jump_table,  \"aw\"\n\t"
                 JUMP_ENTRY_TYPE "1b, %l[l_yes], %c0\n\t"
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 0adab06ce5c0..572bb5b95f35 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -661,7 +661,7 @@ struct iommu_table *iommu_init_table(struct iommu_table *tbl, int nid)
        /* number of bytes needed for the bitmap */
        sz = BITS_TO_LONGS(tbl->it_size) * sizeof(unsigned long);
-        page = alloc_pages_node(nid, GFP_ATOMIC, get_order(sz));
+        page = alloc_pages_node(nid, GFP_KERNEL, get_order(sz));
        if (!page)
                panic("iommu_init_table: Can't allocate %ld bytes\n", sz);
        tbl->it_map = page_address(page);
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 57d286a78f86..c7cb8c232d2f 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -495,14 +495,15 @@ void __do_irq(struct pt_regs *regs)
 void do_IRQ(struct pt_regs *regs)
 {
        struct pt_regs *old_regs = set_irq_regs(regs);
-        struct thread_info *curtp, *irqtp;
+        struct thread_info *curtp, *irqtp, *sirqtp;
        /* Switch to the irq stack to handle this */
        curtp = current_thread_info();
        irqtp = hardirq_ctx[raw_smp_processor_id()];
+        sirqtp = softirq_ctx[raw_smp_processor_id()];
        /* Already there ? */
-        if (unlikely(curtp == irqtp)) {
+        if (unlikely(curtp == irqtp || curtp == sirqtp)) {
                __do_irq(regs);
                set_irq_regs(old_regs);
                return;
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 27a90b99ef67..b4e667663d9b 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -17,6 +17,7 @@
 #include <asm/machdep.h>
 #include <asm/smp.h>
 #include <asm/pmc.h>
+#include <asm/firmware.h>
 #include "cacheinfo.h"
@@ -179,15 +180,25 @@ SYSFS_PMCSETUP(spurr, SPRN_SPURR);
 SYSFS_PMCSETUP(dscr, SPRN_DSCR);
 SYSFS_PMCSETUP(pir, SPRN_PIR);
+/*
+  Lets only enable read for phyp resources and
+  enable write when needed with a separate function.
+  Lets be conservative and default to pseries.
+*/
 static DEVICE_ATTR(mmcra, 0600, show_mmcra, store_mmcra);
 static DEVICE_ATTR(spurr, 0400, show_spurr, NULL);
 static DEVICE_ATTR(dscr, 0600, show_dscr, store_dscr);
-static DEVICE_ATTR(purr, 0600, show_purr, store_purr);
+static DEVICE_ATTR(purr, 0400, show_purr, store_purr);
 static DEVICE_ATTR(pir, 0400, show_pir, NULL);
 unsigned long dscr_default = 0;
 EXPORT_SYMBOL(dscr_default);
+static void add_write_permission_dev_attr(struct device_attribute *attr)
+{
+        attr->attr.mode |= 0200;
+}
 static ssize_t show_dscr_default(struct device *dev,
                struct device_attribute *attr, char *buf)
 {
@@ -394,8 +405,11 @@ static void register_cpu_online(unsigned int cpu)
        if (cpu_has_feature(CPU_FTR_MMCRA))
                device_create_file(s, &dev_attr_mmcra);
-        if (cpu_has_feature(CPU_FTR_PURR))
+        if (cpu_has_feature(CPU_FTR_PURR)) {
+                if (!firmware_has_feature(FW_FEATURE_LPAR))
+                        add_write_permission_dev_attr(&dev_attr_purr);
                device_create_file(s, &dev_attr_purr);
+        }
        if (cpu_has_feature(CPU_FTR_SPURR))
                device_create_file(s, &dev_attr_spurr);
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index 7b60b9851469..cd809eaa8b5c 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -79,6 +79,11 @@ _GLOBAL(tm_abort)
        TABORT(R3)
        blr
+        .section        ".toc","aw"
+DSCR_DEFAULT:
+        .tc dscr_default[TC],dscr_default
+        .section        ".text"
 /* void tm_reclaim(struct thread_struct *thread,
 *                 unsigned long orig_msr,
@@ -123,6 +128,7 @@ _GLOBAL(tm_reclaim)
        mr      r15, r14
        ori     r15, r15, MSR_FP
        li      r16, MSR_RI
+        ori     r16, r16, MSR_EE /* IRQs hard off */
        andc    r15, r15, r16
        oris    r15, r15, MSR_VEC@h
 #ifdef CONFIG_VSX
@@ -187,11 +193,18 @@ dont_backup_fp:
        std     r1, PACATMSCRATCH(r13)
        ld      r1, PACAR1(r13)
+        /* Store the PPR in r11 and reset to decent value */
+        std     r11, GPR11(r1)                  /* Temporary stash */
+        mfspr   r11, SPRN_PPR
+        HMT_MEDIUM
        /* Now get some more GPRS free */
        std     r7, GPR7(r1)                    /* Temporary stash */
        std     r12, GPR12(r1)                  /* ''   ''    ''   */
        ld      r12, STACK_PARAM(0)(r1)         /* Param 0, thread_struct * */
+        std     r11, THREAD_TM_PPR(r12)         /* Store PPR and free r11 */
        addi    r7, r12, PT_CKPT_REGS           /* Thread's ckpt_regs */
        /* Make r7 look like an exception frame so that we
@@ -203,15 +216,19 @@ dont_backup_fp:
        SAVE_GPR(0, r7)                         /* user r0 */
        SAVE_GPR(2, r7)                 /* user r2 */
        SAVE_4GPRS(3, r7)                       /* user r3-r6 */
-        SAVE_4GPRS(8, r7)                       /* user r8-r11 */
+        SAVE_GPR(8, r7)                         /* user r8 */
+        SAVE_GPR(9, r7)                         /* user r9 */
+        SAVE_GPR(10, r7)                        /* user r10 */
        ld      r3, PACATMSCRATCH(r13)          /* user r1 */
        ld      r4, GPR7(r1)                    /* user r7 */
-        ld      r5, GPR12(r1)                   /* user r12 */
+        ld      r5, GPR11(r1)                   /* user r11 */
-        GET_SCRATCH0(6)                         /* user r13 */
+        ld      r6, GPR12(r1)                   /* user r12 */
+        GET_SCRATCH0(8)                         /* user r13 */
        std     r3, GPR1(r7)
        std     r4, GPR7(r7)
-        std     r5, GPR12(r7)
+        std     r5, GPR11(r7)
-        std     r6, GPR13(r7)
+        std     r6, GPR12(r7)
+        std     r8, GPR13(r7)
        SAVE_NVGPRS(r7)                         /* user r14-r31 */
@@ -234,14 +251,12 @@ dont_backup_fp:
        std     r6, _XER(r7)
-        /* ******************** TAR, PPR, DSCR ********** */
+        /* ******************** TAR, DSCR ********** */
        mfspr   r3, SPRN_TAR
-        mfspr   r4, SPRN_PPR
+        mfspr   r4, SPRN_DSCR
-        mfspr   r5, SPRN_DSCR
        std     r3, THREAD_TM_TAR(r12)
-        std     r4, THREAD_TM_PPR(r12)
+        std     r4, THREAD_TM_DSCR(r12)
-        std     r5, THREAD_TM_DSCR(r12)
        /* MSR and flags:  We don't change CRs, and we don't need to alter
         * MSR.
@@ -258,7 +273,7 @@ dont_backup_fp:
        std     r3, THREAD_TM_TFHAR(r12)
        std     r4, THREAD_TM_TFIAR(r12)
-        /* AMR and PPR are checkpointed too, but are unsupported by Linux. */
+        /* AMR is checkpointed too, but is unsupported by Linux. */
        /* Restore original MSR/IRQ state & clear TM mode */
        ld      r14, TM_FRAME_L0(r1)            /* Orig MSR */
@@ -274,6 +289,12 @@ dont_backup_fp:
        mtcr    r4
        mtlr    r0
        ld      r2, 40(r1)
+        /* Load system default DSCR */
+        ld      r4, DSCR_DEFAULT@toc(r2)
+        ld      r0, 0(r4)
+        mtspr   SPRN_DSCR, r0
        blr
@@ -358,25 +379,24 @@ dont_restore_fp:
 restore_gprs:
-        /* ******************** TAR, PPR, DSCR ********** */
+        /* ******************** CR,LR,CCR,MSR ********** */
-        ld      r4, THREAD_TM_TAR(r3)
+        ld      r4, _CTR(r7)
-        ld      r5, THREAD_TM_PPR(r3)
+        ld      r5, _LINK(r7)
-        ld      r6, THREAD_TM_DSCR(r3)
+        ld      r6, _CCR(r7)
+        ld      r8, _XER(r7)
-        mtspr   SPRN_TAR,       r4
+        mtctr   r4
-        mtspr   SPRN_PPR,       r5
+        mtlr    r5
-        mtspr   SPRN_DSCR,      r6
+        mtcr    r6
+        mtxer   r8
-        /* ******************** CR,LR,CCR,MSR ********** */
+        /* ******************** TAR ******************** */
-        ld      r3, _CTR(r7)
+        ld      r4, THREAD_TM_TAR(r3)
-        ld      r4, _LINK(r7)
+        mtspr   SPRN_TAR,       r4
-        ld      r5, _CCR(r7)
-        ld      r6, _XER(r7)
-        mtctr   r3
+        /* Load up the PPR and DSCR in GPRs only at this stage */
-        mtlr    r4
+        ld      r5, THREAD_TM_DSCR(r3)
-        mtcr    r5
+        ld      r6, THREAD_TM_PPR(r3)
-        mtxer   r6
        /* Clear the MSR RI since we are about to change R1.  EE is already off
         */
@@ -384,19 +404,26 @@ restore_gprs:
        mtmsrd  r4, 1
        REST_4GPRS(0, r7)                       /* GPR0-3 */
-        REST_GPR(4, r7)                         /* GPR4-6 */
+        REST_GPR(4, r7)                         /* GPR4 */
-        REST_GPR(5, r7)
-        REST_GPR(6, r7)
        REST_4GPRS(8, r7)                       /* GPR8-11 */
        REST_2GPRS(12, r7)                      /* GPR12-13 */
        REST_NVGPRS(r7)                         /* GPR14-31 */
-        ld      r7, GPR7(r7)                    /* GPR7 */
+        /* Load up PPR and DSCR here so we don't run with user values for long
+         */
+        mtspr   SPRN_DSCR, r5
+        mtspr   SPRN_PPR, r6
+        REST_GPR(5, r7)                         /* GPR5-7 */
+        REST_GPR(6, r7)
+        ld      r7, GPR7(r7)
        /* Commit register state as checkpointed state: */
        TRECHKPT
+        HMT_MEDIUM
        /* Our transactional state has now changed.
         *
         * Now just get out of here.  Transactional (current) state will be
@@ -419,6 +446,12 @@ restore_gprs:
        mtcr    r4
        mtlr    r0
        ld      r2, 40(r1)
+        /* Load system default DSCR */
+        ld      r4, DSCR_DEFAULT@toc(r2)
+        ld      r0, 0(r4)
+        mtspr   SPRN_DSCR, r0
        blr
        /* ****************************************************************** */
diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
index 78a350670de3..d38cc08b16c7 100644
--- a/arch/powerpc/kernel/vio.c
+++ b/arch/powerpc/kernel/vio.c
@@ -1530,11 +1530,15 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
        const char *cp;
        dn = dev->of_node;
-        if (!dn)
+        if (!dn) {
-                return -ENODEV;
+                strcat(buf, "\n");
+                return strlen(buf);
+        }
        cp = of_get_property(dn, "compatible", NULL);
-        if (!cp)
+        if (!cp) {
-                return -ENODEV;
+                strcat(buf, "\n");
+                return strlen(buf);
+        }
        return sprintf(buf, "vio:T%sS%s\n", vio_dev->type, cp);
 }
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 294b7af28cdd..c71103b8a748 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1066,7 +1066,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
 BEGIN_FTR_SECTION
        mfspr   r8, SPRN_DSCR
        ld      r7, HSTATE_DSCR(r13)
-        std     r8, VCPU_DSCR(r7)
+        std     r8, VCPU_DSCR(r9)
        mtspr   SPRN_DSCR, r7
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
index 1c6a9d729df4..c65593abae8e 100644
--- a/arch/powerpc/kvm/e500_mmu_host.c
+++ b/arch/powerpc/kvm/e500_mmu_host.c
@@ -332,6 +332,13 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
        unsigned long hva;
        int pfnmap = 0;
        int tsize = BOOK3E_PAGESZ_4K;
+        int ret = 0;
+        unsigned long mmu_seq;
+        struct kvm *kvm = vcpu_e500->vcpu.kvm;
+        /* used to check for invalidations in progress */
+        mmu_seq = kvm->mmu_notifier_seq;
+        smp_rmb();
        /*
         * Translate guest physical to true physical, acquiring
@@ -449,6 +456,12 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
                gvaddr &= ~((tsize_pages << PAGE_SHIFT) - 1);
        }
+        spin_lock(&kvm->mmu_lock);
+        if (mmu_notifier_retry(kvm, mmu_seq)) {
+                ret = -EAGAIN;
+                goto out;
+        }
        kvmppc_e500_ref_setup(ref, gtlbe, pfn);
        kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize,
@@ -457,10 +470,13 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
        /* Clear i-cache for new pages */
        kvmppc_mmu_flush_icache(pfn);
+out:
+        spin_unlock(&kvm->mmu_lock);
        /* Drop refcount on page, so that mmu notifiers can clear it */
        kvm_release_pfn_clean(pfn);
-        return 0;
+        return ret;
 }
 /* XXX only map the one-one case, for now use TLB0 */
diff --git a/arch/powerpc/lib/checksum_64.S b/arch/powerpc/lib/checksum_64.S
index 167f72555d60..57a072065057 100644
--- a/arch/powerpc/lib/checksum_64.S
+++ b/arch/powerpc/lib/checksum_64.S
@@ -226,19 +226,35 @@ _GLOBAL(csum_partial)
        blr
-        .macro source
+        .macro srcnr
 100:
        .section __ex_table,"a"
        .align 3
-        .llong 100b,.Lsrc_error
+        .llong 100b,.Lsrc_error_nr
        .previous
        .endm
-        .macro dest
+        .macro source
+150:
+        .section __ex_table,"a"
+        .align 3
+        .llong 150b,.Lsrc_error
+        .previous
+        .endm
+        .macro dstnr
 200:
        .section __ex_table,"a"
        .align 3
-        .llong 200b,.Ldest_error
+        .llong 200b,.Ldest_error_nr
+        .previous
+        .endm
+        .macro dest
+250:
+        .section __ex_table,"a"
+        .align 3
+        .llong 250b,.Ldest_error
        .previous
        .endm
@@ -269,16 +285,16 @@ _GLOBAL(csum_partial_copy_generic)
        rldicl. r6,r3,64-1,64-2         /* r6 = (r3 & 0x3) >> 1 */
        beq     .Lcopy_aligned
-        li      r7,4
+        li      r9,4
-        sub     r6,r7,r6
+        sub     r6,r9,r6
        mtctr   r6
 1:
-source; lhz     r6,0(r3)                /* align to doubleword */
+srcnr;  lhz     r6,0(r3)                /* align to doubleword */
        subi    r5,r5,2
        addi    r3,r3,2
        adde    r0,r0,r6
-dest;   sth     r6,0(r4)
+dstnr;  sth     r6,0(r4)
        addi    r4,r4,2
        bdnz    1b
@@ -392,10 +408,10 @@ dest;	std	r16,56(r4)
        mtctr   r6
 3:
-source; ld      r6,0(r3)
+srcnr;  ld      r6,0(r3)
        addi    r3,r3,8
        adde    r0,r0,r6
-dest;   std     r6,0(r4)
+dstnr;  std     r6,0(r4)
        addi    r4,r4,8
        bdnz    3b
@@ -405,10 +421,10 @@ dest;	std	r6,0(r4)
        srdi.   r6,r5,2
        beq     .Lcopy_tail_halfword
-source; lwz     r6,0(r3)
+srcnr;  lwz     r6,0(r3)
        addi    r3,r3,4
        adde    r0,r0,r6
-dest;   stw     r6,0(r4)
+dstnr;  stw     r6,0(r4)
        addi    r4,r4,4
        subi    r5,r5,4
@@ -416,10 +432,10 @@ dest;	stw	r6,0(r4)
        srdi.   r6,r5,1
        beq     .Lcopy_tail_byte
-source; lhz     r6,0(r3)
+srcnr;  lhz     r6,0(r3)
        addi    r3,r3,2
        adde    r0,r0,r6
-dest;   sth     r6,0(r4)
+dstnr;  sth     r6,0(r4)
        addi    r4,r4,2
        subi    r5,r5,2
@@ -427,10 +443,10 @@ dest;	sth	r6,0(r4)
        andi.   r6,r5,1
        beq     .Lcopy_finish
-source; lbz     r6,0(r3)
+srcnr;  lbz     r6,0(r3)
        sldi    r9,r6,8                 /* Pad the byte out to 16 bits */
        adde    r0,r0,r9
-dest;   stb     r6,0(r4)
+dstnr;  stb     r6,0(r4)
 .Lcopy_finish:
        addze   r0,r0                   /* add in final carry */
@@ -440,6 +456,11 @@ dest;	stb	r6,0(r4)
        blr
 .Lsrc_error:
+        ld      r14,STK_REG(R14)(r1)
+        ld      r15,STK_REG(R15)(r1)
+        ld      r16,STK_REG(R16)(r1)
+        addi    r1,r1,STACKFRAMESIZE
+.Lsrc_error_nr:
        cmpdi   0,r7,0
        beqlr
        li      r6,-EFAULT
@@ -447,6 +468,11 @@ dest;	stb	r6,0(r4)
        blr
 .Ldest_error:
+        ld      r14,STK_REG(R14)(r1)
+        ld      r15,STK_REG(R15)(r1)
+        ld      r16,STK_REG(R16)(r1)
+        addi    r1,r1,STACKFRAMESIZE
+.Ldest_error_nr:
        cmpdi   0,r8,0
        beqlr
        li      r6,-EFAULT
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index d0cd9e4c6837..8ed035d2edb5 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -300,5 +300,9 @@ void vmemmap_free(unsigned long start, unsigned long end)
 {
 }
+void register_page_bootmem_memmap(unsigned long section_nr,
+                                  struct page *start_page, unsigned long size)
+{
+}
 #endif /* CONFIG_SPARSEMEM_VMEMMAP */
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 1cf9c5b67f24..3fa93dc7fe75 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -297,12 +297,21 @@ void __init paging_init(void)
 }
 #endif /* ! CONFIG_NEED_MULTIPLE_NODES */
+static void __init register_page_bootmem_info(void)
+{
+        int i;
+        for_each_online_node(i)
+                register_page_bootmem_info_node(NODE_DATA(i));
+}
 void __init mem_init(void)
 {
 #ifdef CONFIG_SWIOTLB
        swiotlb_init(0);
 #endif
+        register_page_bootmem_info();
        high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
        set_max_mapnr(max_pfn);
        free_all_bootmem();
diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
index 2ee4a707f0df..a3f7abd2f13f 100644
--- a/arch/powerpc/perf/power8-pmu.c
+++ b/arch/powerpc/perf/power8-pmu.c
@@ -199,6 +199,7 @@
 #define MMCR1_UNIT_SHIFT(pmc)           (60 - (4 * ((pmc) - 1)))
 #define MMCR1_COMBINE_SHIFT(pmc)        (35 - ((pmc) - 1))
 #define MMCR1_PMCSEL_SHIFT(pmc)         (24 - (((pmc) - 1)) * 8)
+#define MMCR1_FAB_SHIFT                 36
 #define MMCR1_DC_QUAL_SHIFT             47
 #define MMCR1_IC_QUAL_SHIFT             46
@@ -388,8 +389,8 @@ static int power8_compute_mmcr(u64 event[], int n_ev,
                 * the threshold bits are used for the match value.
                 */
                if (event_is_fab_match(event[i])) {
-                        mmcr1 |= (event[i] >> EVENT_THR_CTL_SHIFT) &
+                        mmcr1 |= ((event[i] >> EVENT_THR_CTL_SHIFT) &
-                                  EVENT_THR_CTL_MASK;
+                                  EVENT_THR_CTL_MASK) << MMCR1_FAB_SHIFT;
                } else {
                        val = (event[i] >> EVENT_THR_CTL_SHIFT) & EVENT_THR_CTL_MASK;
                        mmcra |= val << MMCRA_THR_CTL_SHIFT;
diff --git a/arch/s390/include/asm/jump_label.h b/arch/s390/include/asm/jump_label.h
index 6c32190dc73e..346b1c85ffb4 100644
--- a/arch/s390/include/asm/jump_label.h
+++ b/arch/s390/include/asm/jump_label.h
@@ -15,7 +15,7 @@
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("0:    brcl 0,0\n"
+        asm_volatile_goto("0:   brcl 0,0\n"
                ".pushsection __jump_table, \"aw\"\n"
                ASM_ALIGN "\n"
                ASM_PTR " 0b, %l[label], %0\n"
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index c84f33d51f7b..7dd21720e5b0 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -40,28 +40,26 @@ static inline void *load_real_addr(void *addr)
 }
 /*
- * Copy up to one page to vmalloc or real memory
+ * Copy real to virtual or real memory
 */
-static ssize_t copy_page_real(void *buf, void *src, size_t csize)
+static int copy_from_realmem(void *dest, void *src, size_t count)
 {
-        size_t size;
+        unsigned long size;
+        int rc;
-        if (is_vmalloc_addr(buf)) {
+        if (!count)
-                BUG_ON(csize >= PAGE_SIZE);
+                return 0;
-                /* If buf is not page aligned, copy first part */
+        if (!is_vmalloc_or_module_addr(dest))
-                size = min(roundup(__pa(buf), PAGE_SIZE) - __pa(buf), csize);
+                return memcpy_real(dest, src, count);
-                if (size) {
+        do {
-                        if (memcpy_real(load_real_addr(buf), src, size))
+                size = min(count, PAGE_SIZE - (__pa(dest) & ~PAGE_MASK));
-                                return -EFAULT;
+                if (memcpy_real(load_real_addr(dest), src, size))
-                        buf += size;
+                        return -EFAULT;
-                        src += size;
+                count -= size;
-                }
+                dest += size;
-                /* Copy second part */
+                src += size;
-                size = csize - size;
+        } while (count);
-                return (size) ? memcpy_real(load_real_addr(buf), src, size) : 0;
+        return 0;
-        } else {
-                return memcpy_real(buf, src, csize);
-        }
 }
 /*
@@ -114,7 +112,7 @@ static ssize_t copy_oldmem_page_kdump(char *buf, size_t csize,
                rc = copy_to_user_real((void __force __user *) buf,
                                       (void *) src, csize);
        else
-                rc = copy_page_real(buf, (void *) src, csize);
+                rc = copy_from_realmem(buf, (void *) src, csize);
        return (rc == 0) ? rc : csize;
 }
@@ -210,7 +208,7 @@ int copy_from_oldmem(void *dest, void *src, size_t count)
        if (OLDMEM_BASE) {
                if ((unsigned long) src < OLDMEM_SIZE) {
                        copied = min(count, OLDMEM_SIZE - (unsigned long) src);
-                        rc = memcpy_real(dest, src + OLDMEM_BASE, copied);
+                        rc = copy_from_realmem(dest, src + OLDMEM_BASE, copied);
                        if (rc)
                                return rc;
                }
@@ -223,7 +221,7 @@ int copy_from_oldmem(void *dest, void *src, size_t count)
                                return rc;
                }
        }
-        return memcpy_real(dest + copied, src + copied, count - copied);
+        return copy_from_realmem(dest + copied, src + copied, count - copied);
 }
 /*
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index cc30d1fb000c..0dc2b6d0a1ec 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -266,6 +266,7 @@ sysc_sigpending:
        tm      __TI_flags+3(%r12),_TIF_SYSCALL
        jno     sysc_return
        lm      %r2,%r7,__PT_R2(%r11)   # load svc arguments
+        l       %r10,__TI_sysc_table(%r12)      # 31 bit system call table
        xr      %r8,%r8                 # svc 0 returns -ENOSYS
        clc     __PT_INT_CODE+2(2,%r11),BASED(.Lnr_syscalls+2)
        jnl     sysc_nr_ok              # invalid svc number -> do svc 0
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 2b2188b97c6a..e5b43c97a834 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -297,6 +297,7 @@ sysc_sigpending:
        tm      __TI_flags+7(%r12),_TIF_SYSCALL
        jno     sysc_return
        lmg     %r2,%r7,__PT_R2(%r11)   # load svc arguments
+        lg      %r10,__TI_sysc_table(%r12)      # address of system call table
        lghi    %r8,0                   # svc 0 returns -ENOSYS
        llgh    %r1,__PT_INT_CODE+2(%r11)       # load new svc number
        cghi    %r1,NR_syscalls
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index 0ce9fb245034..d86e64eddb42 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -67,6 +67,11 @@ static int __kprobes is_prohibited_opcode(kprobe_opcode_t *insn)
        case 0xac:      /* stnsm */
        case 0xad:      /* stosm */
                return -EINVAL;
+        case 0xc6:
+                switch (insn[0] & 0x0f) {
+                case 0x00: /* exrl   */
+                        return -EINVAL;
+                }
        }
        switch (insn[0]) {
        case 0x0101:    /* pr    */
@@ -180,7 +185,6 @@ static int __kprobes is_insn_relative_long(kprobe_opcode_t *insn)
                break;
        case 0xc6:
                switch (insn[0] & 0x0f) {
-                case 0x00: /* exrl   */
                case 0x02: /* pfdrl  */
                case 0x04: /* cghrl  */
                case 0x05: /* chrl   */
diff --git a/arch/score/Kconfig b/arch/score/Kconfig
index a1be70db75fe..305f7ee1f382 100644
--- a/arch/score/Kconfig
+++ b/arch/score/Kconfig
@@ -2,6 +2,7 @@ menu "Machine selection"
 config SCORE
       def_bool y
+       select HAVE_GENERIC_HARDIRQS
       select GENERIC_IRQ_SHOW
       select GENERIC_IOMAP
       select GENERIC_ATOMIC64
@@ -110,3 +111,6 @@ source "security/Kconfig"
 source "crypto/Kconfig"
 source "lib/Kconfig"
+config NO_IOMEM
+       def_bool y
diff --git a/arch/score/Makefile b/arch/score/Makefile
index 974aefe86123..9e3e060290e0 100644
--- a/arch/score/Makefile
+++ b/arch/score/Makefile
@@ -20,8 +20,8 @@ cflags-y += -G0 -pipe -mel -mnhwloop -D__SCOREEL__ \
 #
 KBUILD_AFLAGS += $(cflags-y)
 KBUILD_CFLAGS += $(cflags-y)
-KBUILD_AFLAGS_MODULE += -mlong-calls
+KBUILD_AFLAGS_MODULE +=
-KBUILD_CFLAGS_MODULE += -mlong-calls
+KBUILD_CFLAGS_MODULE +=
 LDFLAGS += --oformat elf32-littlescore
 LDFLAGS_vmlinux += -G0 -static -nostdlib
diff --git a/arch/score/include/asm/checksum.h b/arch/score/include/asm/checksum.h
index f909ac3144a4..961bd64015a8 100644
--- a/arch/score/include/asm/checksum.h
+++ b/arch/score/include/asm/checksum.h
@@ -184,48 +184,57 @@ static inline __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
                                __wsum sum)
 {
        __asm__ __volatile__(
-                ".set\tnoreorder\t\t\t# csum_ipv6_magic\n\t"
+                ".set\tvolatile\t\t\t# csum_ipv6_magic\n\t"
-                ".set\tnoat\n\t"
+                "add\t%0, %0, %5\t\t\t# proto (long in network byte order)\n\t"
-                "addu\t%0, %5\t\t\t# proto (long in network byte order)\n\t"
+                "cmp.c\t%5, %0\n\t"
-                "sltu\t$1, %0, %5\n\t"
+                "bleu 1f\n\t"
-                "addu\t%0, $1\n\t"
+                "addi\t%0, 0x1\n\t"
-                "addu\t%0, %6\t\t\t# csum\n\t"
+                "1:add\t%0, %0, %6\t\t\t# csum\n\t"
-                "sltu\t$1, %0, %6\n\t"
+                "cmp.c\t%6, %0\n\t"
-                "lw\t%1, 0(%2)\t\t\t# four words source address\n\t"
+                "lw\t%1, [%2, 0]\t\t\t# four words source address\n\t"
-                "addu\t%0, $1\n\t"
+                "bleu 1f\n\t"
-                "addu\t%0, %1\n\t"
+                "addi\t%0, 0x1\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "1:add\t%0, %0, %1\n\t"
-                "lw\t%1, 4(%2)\n\t"
+                "cmp.c\t%1, %0\n\t"
-                "addu\t%0, $1\n\t"
+                "1:lw\t%1, [%2, 4]\n\t"
-                "addu\t%0, %1\n\t"
+                "bleu 1f\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "addi\t%0, 0x1\n\t"
-                "lw\t%1, 8(%2)\n\t"
+                "1:add\t%0, %0, %1\n\t"
-                "addu\t%0, $1\n\t"
+                "cmp.c\t%1, %0\n\t"
-                "addu\t%0, %1\n\t"
+                "lw\t%1, [%2,8]\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "bleu 1f\n\t"
-                "lw\t%1, 12(%2)\n\t"
+                "addi\t%0, 0x1\n\t"
-                "addu\t%0, $1\n\t"
+                "1:add\t%0, %0, %1\n\t"
-                "addu\t%0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "lw\t%1, [%2, 12]\n\t"
-                "lw\t%1, 0(%3)\n\t"
+                "bleu 1f\n\t"
-                "addu\t%0, $1\n\t"
+                "addi\t%0, 0x1\n\t"
-                "addu\t%0, %1\n\t"
+                "1:add\t%0, %0,%1\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
-                "lw\t%1, 4(%3)\n\t"
+                "lw\t%1, [%3, 0]\n\t"
-                "addu\t%0, $1\n\t"
+                "bleu 1f\n\t"
-                "addu\t%0, %1\n\t"
+                "addi\t%0, 0x1\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "1:add\t%0, %0, %1\n\t"
-                "lw\t%1, 8(%3)\n\t"
+                "cmp.c\t%1, %0\n\t"
-                "addu\t%0, $1\n\t"
+                "lw\t%1, [%3, 4]\n\t"
-                "addu\t%0, %1\n\t"
+                "bleu 1f\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "addi\t%0, 0x1\n\t"
-                "lw\t%1, 12(%3)\n\t"
+                "1:add\t%0, %0, %1\n\t"
-                "addu\t%0, $1\n\t"
+                "cmp.c\t%1, %0\n\t"
-                "addu\t%0, %1\n\t"
+                "lw\t%1, [%3, 8]\n\t"
-                "sltu\t$1, %0, %1\n\t"
+                "bleu 1f\n\t"
-                "addu\t%0, $1\t\t\t# Add final carry\n\t"
+                "addi\t%0, 0x1\n\t"
-                ".set\tnoat\n\t"
+                "1:add\t%0, %0, %1\n\t"
-                ".set\tnoreorder"
+                "cmp.c\t%1, %0\n\t"
+                "lw\t%1, [%3, 12]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:\n\t"
+                ".set\toptimize"
                : "=r" (sum), "=r" (proto)
                : "r" (saddr), "r" (daddr),
                  "0" (htonl(len)), "1" (htonl(proto)), "r" (sum));
diff --git a/arch/score/include/asm/io.h b/arch/score/include/asm/io.h
index fbbfd7132e3b..574c8827abe2 100644
--- a/arch/score/include/asm/io.h
+++ b/arch/score/include/asm/io.h
@@ -5,5 +5,4 @@
 #define virt_to_bus     virt_to_phys
 #define bus_to_virt     phys_to_virt
 #endif /* _ASM_SCORE_IO_H */
diff --git a/arch/score/include/asm/pgalloc.h b/arch/score/include/asm/pgalloc.h
index 059a61b7071b..716b3fd1d863 100644
--- a/arch/score/include/asm/pgalloc.h
+++ b/arch/score/include/asm/pgalloc.h
@@ -2,7 +2,7 @@
 #define _ASM_SCORE_PGALLOC_H
 #include <linux/mm.h>
+#include <linux/highmem.h>
 static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
        pte_t *pte)
 {
diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
index 7234ed09b7b7..befb87d30a89 100644
--- a/arch/score/kernel/entry.S
+++ b/arch/score/kernel/entry.S
@@ -264,7 +264,7 @@ resume_kernel:
        disable_irq
        lw      r8, [r28, TI_PRE_COUNT]
        cmpz.c  r8
-        bne     r8, restore_all
+        bne     restore_all
 need_resched:
        lw      r8, [r28, TI_FLAGS]
        andri.c r9, r8, _TIF_NEED_RESCHED
@@ -415,7 +415,7 @@ ENTRY(handle_sys)
        sw      r9, [r0, PT_EPC]
        cmpi.c  r27, __NR_syscalls      # check syscall number
-        bgeu    illegal_syscall
+        bcs     illegal_syscall
        slli    r8, r27, 2              # get syscall routine
        la      r11, sys_call_table
diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
index f4c6d02421d3..a1519ad3d49d 100644
--- a/arch/score/kernel/process.c
+++ b/arch/score/kernel/process.c
@@ -78,8 +78,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
        p->thread.reg0 = (unsigned long) childregs;
        if (unlikely(p->flags & PF_KTHREAD)) {
                memset(childregs, 0, sizeof(struct pt_regs));
-                p->thread->reg12 = usp;
+                p->thread.reg12 = usp;
-                p->thread->reg13 = arg;
+                p->thread.reg13 = arg;
                p->thread.reg3 = (unsigned long) ret_from_kernel_thread;
        } else {
                *childregs = *current_pt_regs();
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 2137ad667438..78c4fdb91bc5 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -506,12 +506,17 @@ config SUN_OPENPROMFS
          Only choose N if you know in advance that you will not need to modify
          OpenPROM settings on the running system.
-# Makefile helper
+# Makefile helpers
 config SPARC64_PCI
        bool
        default y
        depends on SPARC64 && PCI
+config SPARC64_PCI_MSI
+        bool
+        default y
+        depends on SPARC64_PCI && PCI_MSI
 endmenu
 menu "Executable file formats"
diff --git a/arch/sparc/include/asm/floppy_64.h b/arch/sparc/include/asm/floppy_64.h
index e204f902e6c9..7c90c50c200d 100644
--- a/arch/sparc/include/asm/floppy_64.h
+++ b/arch/sparc/include/asm/floppy_64.h
@@ -254,7 +254,7 @@ static int sun_fd_request_irq(void)
                once = 1;
                error = request_irq(FLOPPY_IRQ, sparc_floppy_irq,
-                                    IRQF_DISABLED, "floppy", NULL);
+                                    0, "floppy", NULL);
                return ((error == 0) ? 0 : -1);
        }
diff --git a/arch/sparc/include/asm/jump_label.h b/arch/sparc/include/asm/jump_label.h
index 5080d16a832f..ec2e2e2aba7d 100644
--- a/arch/sparc/include/asm/jump_label.h
+++ b/arch/sparc/include/asm/jump_label.h
@@ -9,7 +9,7 @@
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-                asm goto("1:\n\t"
+                asm_volatile_goto("1:\n\t"
                         "nop\n\t"
                         "nop\n\t"
                         ".pushsection __jump_table,  \"aw\"\n\t"
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index d432fb20358e..d15cc1794b0e 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -1,3 +1,4 @@
 #
 # Makefile for the linux kernel.
 #
@@ -99,7 +100,7 @@ obj-$(CONFIG_STACKTRACE)     += stacktrace.o
 obj-$(CONFIG_SPARC64_PCI)    += pci.o pci_common.o psycho_common.o
 obj-$(CONFIG_SPARC64_PCI)    += pci_psycho.o pci_sabre.o pci_schizo.o
 obj-$(CONFIG_SPARC64_PCI)    += pci_sun4v.o pci_sun4v_asm.o pci_fire.o
-obj-$(CONFIG_PCI_MSI)        += pci_msi.o
+obj-$(CONFIG_SPARC64_PCI_MSI) += pci_msi.o
 obj-$(CONFIG_COMPAT)         += sys32.o sys_sparc32.o signal32.o
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 62d6b153ffa2..dff60abbea01 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -849,9 +849,8 @@ void ldom_reboot(const char *boot_command)
        if (boot_command && strlen(boot_command)) {
                unsigned long len;
-                strcpy(full_boot_str, "boot ");
+                snprintf(full_boot_str, sizeof(full_boot_str), "boot %s",
-                strlcpy(full_boot_str + strlen("boot "), boot_command,
+                         boot_command);
-                        sizeof(full_boot_str + strlen("boot ")));
                len = strlen(full_boot_str);
                if (reboot_data_supported) {
diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
index 54df554b82d9..e01d75d40329 100644
--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -1249,12 +1249,12 @@ int ldc_bind(struct ldc_channel *lp, const char *name)
        snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
        snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
-        err = request_irq(lp->cfg.rx_irq, ldc_rx, IRQF_DISABLED,
+        err = request_irq(lp->cfg.rx_irq, ldc_rx, 0,
                          lp->rx_irq_name, lp);
        if (err)
                return err;
-        err = request_irq(lp->cfg.tx_irq, ldc_tx, IRQF_DISABLED,
+        err = request_irq(lp->cfg.tx_irq, ldc_tx, 0,
                          lp->tx_irq_name, lp);
        if (err) {
                free_irq(lp->cfg.rx_irq, lp);
diff --git a/arch/tile/include/asm/atomic.h b/arch/tile/include/asm/atomic.h
index d385eaadece7..709798460763 100644
--- a/arch/tile/include/asm/atomic.h
+++ b/arch/tile/include/asm/atomic.h
@@ -166,7 +166,7 @@ static inline int atomic_cmpxchg(atomic_t *v, int o, int n)
 *
 * Atomically sets @v to @i and returns old @v
 */
-static inline u64 atomic64_xchg(atomic64_t *v, u64 n)
+static inline long long atomic64_xchg(atomic64_t *v, long long n)
 {
        return xchg64(&v->counter, n);
 }
@@ -180,7 +180,8 @@ static inline u64 atomic64_xchg(atomic64_t *v, u64 n)
 * Atomically checks if @v holds @o and replaces it with @n if so.
 * Returns the old value at @v.
 */
-static inline u64 atomic64_cmpxchg(atomic64_t *v, u64 o, u64 n)
+static inline long long atomic64_cmpxchg(atomic64_t *v, long long o,
+                                        long long n)
 {
        return cmpxchg64(&v->counter, o, n);
 }
diff --git a/arch/tile/include/asm/atomic_32.h b/arch/tile/include/asm/atomic_32.h
index 0d0395b1b152..1ad4a1f7d42b 100644
--- a/arch/tile/include/asm/atomic_32.h
+++ b/arch/tile/include/asm/atomic_32.h
@@ -80,7 +80,7 @@ static inline void atomic_set(atomic_t *v, int n)
 /* A 64bit atomic type */
 typedef struct {
-        u64 __aligned(8) counter;
+        long long counter;
 } atomic64_t;
 #define ATOMIC64_INIT(val) { (val) }
@@ -91,14 +91,14 @@ typedef struct {
 *
 * Atomically reads the value of @v.
 */
-static inline u64 atomic64_read(const atomic64_t *v)
+static inline long long atomic64_read(const atomic64_t *v)
 {
        /*
         * Requires an atomic op to read both 32-bit parts consistently.
         * Casting away const is safe since the atomic support routines
         * do not write to memory if the value has not been modified.
         */
-        return _atomic64_xchg_add((u64 *)&v->counter, 0);
+        return _atomic64_xchg_add((long long *)&v->counter, 0);
 }
 /**
@@ -108,7 +108,7 @@ static inline u64 atomic64_read(const atomic64_t *v)
 *
 * Atomically adds @i to @v.
 */
-static inline void atomic64_add(u64 i, atomic64_t *v)
+static inline void atomic64_add(long long i, atomic64_t *v)
 {
        _atomic64_xchg_add(&v->counter, i);
 }
@@ -120,7 +120,7 @@ static inline void atomic64_add(u64 i, atomic64_t *v)
 *
 * Atomically adds @i to @v and returns @i + @v
 */
-static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
+static inline long long atomic64_add_return(long long i, atomic64_t *v)
 {
        smp_mb();  /* barrier for proper semantics */
        return _atomic64_xchg_add(&v->counter, i) + i;
@@ -135,7 +135,8 @@ static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
 * Atomically adds @a to @v, so long as @v was not already @u.
 * Returns non-zero if @v was not @u, and zero otherwise.
 */
-static inline u64 atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
+static inline long long atomic64_add_unless(atomic64_t *v, long long a,
+                                        long long u)
 {
        smp_mb();  /* barrier for proper semantics */
        return _atomic64_xchg_add_unless(&v->counter, a, u) != u;
@@ -151,7 +152,7 @@ static inline u64 atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
 * atomic64_set() can't be just a raw store, since it would be lost if it
 * fell between the load and store of one of the other atomic ops.
 */
-static inline void atomic64_set(atomic64_t *v, u64 n)
+static inline void atomic64_set(atomic64_t *v, long long n)
 {
        _atomic64_xchg(&v->counter, n);
 }
@@ -236,11 +237,13 @@ extern struct __get_user __atomic_xchg_add_unless(volatile int *p,
 extern struct __get_user __atomic_or(volatile int *p, int *lock, int n);
 extern struct __get_user __atomic_andn(volatile int *p, int *lock, int n);
 extern struct __get_user __atomic_xor(volatile int *p, int *lock, int n);
-extern u64 __atomic64_cmpxchg(volatile u64 *p, int *lock, u64 o, u64 n);
+extern long long __atomic64_cmpxchg(volatile long long *p, int *lock,
-extern u64 __atomic64_xchg(volatile u64 *p, int *lock, u64 n);
+                                        long long o, long long n);
-extern u64 __atomic64_xchg_add(volatile u64 *p, int *lock, u64 n);
+extern long long __atomic64_xchg(volatile long long *p, int *lock, long long n);
-extern u64 __atomic64_xchg_add_unless(volatile u64 *p,
+extern long long __atomic64_xchg_add(volatile long long *p, int *lock,
-                                      int *lock, u64 o, u64 n);
+                                        long long n);
+extern long long __atomic64_xchg_add_unless(volatile long long *p,
+                                        int *lock, long long o, long long n);
 /* Return failure from the atomic wrappers. */
 struct __get_user __atomic_bad_address(int __user *addr);
diff --git a/arch/tile/include/asm/cmpxchg.h b/arch/tile/include/asm/cmpxchg.h
index 4001d5eab4bb..0ccda3c425be 100644
--- a/arch/tile/include/asm/cmpxchg.h
+++ b/arch/tile/include/asm/cmpxchg.h
@@ -35,10 +35,10 @@ int _atomic_xchg(int *ptr, int n);
 int _atomic_xchg_add(int *v, int i);
 int _atomic_xchg_add_unless(int *v, int a, int u);
 int _atomic_cmpxchg(int *ptr, int o, int n);
-u64 _atomic64_xchg(u64 *v, u64 n);
+long long _atomic64_xchg(long long *v, long long n);
-u64 _atomic64_xchg_add(u64 *v, u64 i);
+long long _atomic64_xchg_add(long long *v, long long i);
-u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u);
+long long _atomic64_xchg_add_unless(long long *v, long long a, long long u);
-u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
+long long _atomic64_cmpxchg(long long *v, long long o, long long n);
 #define xchg(ptr, n)                                                    \
        ({                                                              \
@@ -53,7 +53,8 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                if (sizeof(*(ptr)) != 4)                                \
                        __cmpxchg_called_with_bad_pointer();            \
                smp_mb();                                               \
-                (typeof(*(ptr)))_atomic_cmpxchg((int *)ptr, (int)o, (int)n); \
+                (typeof(*(ptr)))_atomic_cmpxchg((int *)ptr, (int)o,     \
+                                                (int)n);                \
        })
 #define xchg64(ptr, n)                                                  \
@@ -61,7 +62,8 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                if (sizeof(*(ptr)) != 8)                                \
                        __xchg_called_with_bad_pointer();               \
                smp_mb();                                               \
-                (typeof(*(ptr)))_atomic64_xchg((u64 *)(ptr), (u64)(n)); \
+                (typeof(*(ptr)))_atomic64_xchg((long long *)(ptr),      \
+                                                (long long)(n));        \
        })
 #define cmpxchg64(ptr, o, n)                                            \
@@ -69,7 +71,8 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                if (sizeof(*(ptr)) != 8)                                \
                        __cmpxchg_called_with_bad_pointer();            \
                smp_mb();                                               \
-                (typeof(*(ptr)))_atomic64_cmpxchg((u64 *)ptr, (u64)o, (u64)n); \
+                (typeof(*(ptr)))_atomic64_cmpxchg((long long *)ptr,     \
+                                        (long long)o, (long long)n);    \
        })
 #else
@@ -81,10 +84,11 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                switch (sizeof(*(ptr))) {                               \
                case 4:                                                 \
                        __x = (typeof(__x))(unsigned long)              \
-                                __insn_exch4((ptr), (u32)(unsigned long)(n)); \
+                                __insn_exch4((ptr),                     \
+                                        (u32)(unsigned long)(n));       \
                        break;                                          \
                case 8:                                                 \
-                        __x = (typeof(__x))                     \
+                        __x = (typeof(__x))                             \
                                __insn_exch((ptr), (unsigned long)(n)); \
                        break;                                          \
                default:                                                \
@@ -103,10 +107,12 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                switch (sizeof(*(ptr))) {                               \
                case 4:                                                 \
                        __x = (typeof(__x))(unsigned long)              \
-                                __insn_cmpexch4((ptr), (u32)(unsigned long)(n)); \
+                                __insn_cmpexch4((ptr),                  \
+                                        (u32)(unsigned long)(n));       \
                        break;                                          \
                case 8:                                                 \
-                        __x = (typeof(__x))__insn_cmpexch((ptr), (u64)(n)); \
+                        __x = (typeof(__x))__insn_cmpexch((ptr),        \
+                                                (long long)(n));        \
                        break;                                          \
                default:                                                \
                        __cmpxchg_called_with_bad_pointer();            \
diff --git a/arch/tile/include/asm/percpu.h b/arch/tile/include/asm/percpu.h
index 63294f5a8efb..4f7ae39fa202 100644
--- a/arch/tile/include/asm/percpu.h
+++ b/arch/tile/include/asm/percpu.h
@@ -15,9 +15,37 @@
 #ifndef _ASM_TILE_PERCPU_H
 #define _ASM_TILE_PERCPU_H
-register unsigned long __my_cpu_offset __asm__("tp");
+register unsigned long my_cpu_offset_reg asm("tp");
-#define __my_cpu_offset __my_cpu_offset
-#define set_my_cpu_offset(tp) (__my_cpu_offset = (tp))
+#ifdef CONFIG_PREEMPT
+/*
+ * For full preemption, we can't just use the register variable
+ * directly, since we need barrier() to hazard against it, causing the
+ * compiler to reload anything computed from a previous "tp" value.
+ * But we also don't want to use volatile asm, since we'd like the
+ * compiler to be able to cache the value across multiple percpu reads.
+ * So we use a fake stack read as a hazard against barrier().
+ * The 'U' constraint is like 'm' but disallows postincrement.
+ */
+static inline unsigned long __my_cpu_offset(void)
+{
+        unsigned long tp;
+        register unsigned long *sp asm("sp");
+        asm("move %0, tp" : "=r" (tp) : "U" (*sp));
+        return tp;
+}
+#define __my_cpu_offset __my_cpu_offset()
+#else
+/*
+ * We don't need to hazard against barrier() since "tp" doesn't ever
+ * change with PREEMPT_NONE, and with PREEMPT_VOLUNTARY it only
+ * changes at function call points, at which we are already re-reading
+ * the value of "tp" due to "my_cpu_offset_reg" being a global variable.
+ */
+#define __my_cpu_offset my_cpu_offset_reg
+#endif
+#define set_my_cpu_offset(tp) (my_cpu_offset_reg = (tp))
 #include <asm-generic/percpu.h>
diff --git a/arch/tile/kernel/hardwall.c b/arch/tile/kernel/hardwall.c
index df27a1fd94a3..531f4c365351 100644
--- a/arch/tile/kernel/hardwall.c
+++ b/arch/tile/kernel/hardwall.c
@@ -66,7 +66,7 @@ static struct hardwall_type hardwall_types[] = {
                0,
                "udn",
                LIST_HEAD_INIT(hardwall_types[HARDWALL_UDN].list),
-                __SPIN_LOCK_INITIALIZER(hardwall_types[HARDWALL_UDN].lock),
+                __SPIN_LOCK_UNLOCKED(hardwall_types[HARDWALL_UDN].lock),
                NULL
        },
 #ifndef __tilepro__
@@ -77,7 +77,7 @@ static struct hardwall_type hardwall_types[] = {
                1,  /* disabled pending hypervisor support */
                "idn",
                LIST_HEAD_INIT(hardwall_types[HARDWALL_IDN].list),
-                __SPIN_LOCK_INITIALIZER(hardwall_types[HARDWALL_IDN].lock),
+                __SPIN_LOCK_UNLOCKED(hardwall_types[HARDWALL_IDN].lock),
                NULL
        },
        {  /* access to user-space IPI */
@@ -87,7 +87,7 @@ static struct hardwall_type hardwall_types[] = {
                0,
                "ipi",
                LIST_HEAD_INIT(hardwall_types[HARDWALL_IPI].list),
-                __SPIN_LOCK_INITIALIZER(hardwall_types[HARDWALL_IPI].lock),
+                __SPIN_LOCK_UNLOCKED(hardwall_types[HARDWALL_IPI].lock),
                NULL
        },
 #endif
diff --git a/arch/tile/kernel/intvec_32.S b/arch/tile/kernel/intvec_32.S
index 088d5c141e68..2cbe6d5dd6b0 100644
--- a/arch/tile/kernel/intvec_32.S
+++ b/arch/tile/kernel/intvec_32.S
@@ -815,6 +815,9 @@ STD_ENTRY(interrupt_return)
        }
        bzt     r28, 1f
        bnz     r29, 1f
+        /* Disable interrupts explicitly for preemption. */
+        IRQ_DISABLE(r20,r21)
+        TRACE_IRQS_OFF
        jal     preempt_schedule_irq
        FEEDBACK_REENTER(interrupt_return)
 1:
diff --git a/arch/tile/kernel/intvec_64.S b/arch/tile/kernel/intvec_64.S
index ec755d3f3734..b8fc497f2437 100644
--- a/arch/tile/kernel/intvec_64.S
+++ b/arch/tile/kernel/intvec_64.S
@@ -841,6 +841,9 @@ STD_ENTRY(interrupt_return)
        }
        beqzt   r28, 1f
        bnez    r29, 1f
+        /* Disable interrupts explicitly for preemption. */
+        IRQ_DISABLE(r20,r21)
+        TRACE_IRQS_OFF
        jal     preempt_schedule_irq
        FEEDBACK_REENTER(interrupt_return)
 1:
diff --git a/arch/tile/kernel/stack.c b/arch/tile/kernel/stack.c
index 362284af3afd..c93977a62116 100644
--- a/arch/tile/kernel/stack.c
+++ b/arch/tile/kernel/stack.c
@@ -23,6 +23,7 @@
 #include <linux/mmzone.h>
 #include <linux/dcache.h>
 #include <linux/fs.h>
+#include <linux/string.h>
 #include <asm/backtrace.h>
 #include <asm/page.h>
 #include <asm/ucontext.h>
@@ -332,21 +333,18 @@ static void describe_addr(struct KBacktraceIterator *kbt,
        }
        if (vma->vm_file) {
-                char *s;
                p = d_path(&vma->vm_file->f_path, buf, bufsize);
                if (IS_ERR(p))
                        p = "?";
-                s = strrchr(p, '/');
+                name = kbasename(p);
-                if (s)
-                        p = s+1;
        } else {
-                p = "anon";
+                name = "anon";
        }
        /* Generate a string description of the vma info. */
-        namelen = strlen(p);
+        namelen = strlen(name);
        remaining = (bufsize - 1) - namelen;
-        memmove(buf, p, namelen);
+        memmove(buf, name, namelen);
        snprintf(buf + namelen, remaining, "[%lx+%lx] ",
                 vma->vm_start, vma->vm_end - vma->vm_start);
 }
diff --git a/arch/tile/lib/atomic_32.c b/arch/tile/lib/atomic_32.c
index 759efa337be8..c89b211fd9e7 100644
--- a/arch/tile/lib/atomic_32.c
+++ b/arch/tile/lib/atomic_32.c
@@ -107,19 +107,19 @@ unsigned long _atomic_xor(volatile unsigned long *p, unsigned long mask)
 EXPORT_SYMBOL(_atomic_xor);
-u64 _atomic64_xchg(u64 *v, u64 n)
+long long _atomic64_xchg(long long *v, long long n)
 {
        return __atomic64_xchg(v, __atomic_setup(v), n);
 }
 EXPORT_SYMBOL(_atomic64_xchg);
-u64 _atomic64_xchg_add(u64 *v, u64 i)
+long long _atomic64_xchg_add(long long *v, long long i)
 {
        return __atomic64_xchg_add(v, __atomic_setup(v), i);
 }
 EXPORT_SYMBOL(_atomic64_xchg_add);
-u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u)
+long long _atomic64_xchg_add_unless(long long *v, long long a, long long u)
 {
        /*
         * Note: argument order is switched here since it is easier
@@ -130,7 +130,7 @@ u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u)
 }
 EXPORT_SYMBOL(_atomic64_xchg_add_unless);
-u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n)
+long long _atomic64_cmpxchg(long long *v, long long o, long long n)
 {
        return __atomic64_cmpxchg(v, __atomic_setup(v), o, n);
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ee2fb9d37745..f67e839f06c8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -860,7 +860,7 @@ source "kernel/Kconfig.preempt"
 config X86_UP_APIC
        bool "Local APIC support on uniprocessors"
-        depends on X86_32 && !SMP && !X86_32_NON_STANDARD
+        depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI
        ---help---
          A local APIC (Advanced Programmable Interrupt Controller) is an
          integrated interrupt controller in the CPU. If you have a single-CPU
@@ -885,11 +885,11 @@ config X86_UP_IOAPIC
 config X86_LOCAL_APIC
        def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC || PCI_MSI
 config X86_IO_APIC
        def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC || PCI_MSI
 config X86_VISWS_APIC
        def_bool y
@@ -1033,6 +1033,7 @@ config X86_REBOOTFIXUPS
 config MICROCODE
        tristate "CPU microcode loading support"
+        depends on CPU_SUP_AMD || CPU_SUP_INTEL
        select FW_LOADER
        ---help---
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index d3f5c63078d8..89270b4318db 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -374,7 +374,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                 * Catch too early usage of this before alternatives
                 * have run.
                 */
-                asm goto("1: jmp %l[t_warn]\n"
+                asm_volatile_goto("1: jmp %l[t_warn]\n"
                         "2:\n"
                         ".section .altinstructions,\"a\"\n"
                         " .long 1b - .\n"
@@ -388,7 +388,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
 #endif
-                asm goto("1: jmp %l[t_no]\n"
+                asm_volatile_goto("1: jmp %l[t_no]\n"
                         "2:\n"
                         ".section .altinstructions,\"a\"\n"
                         " .long 1b - .\n"
@@ -453,7 +453,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
 * have. Thus, we force the jump to the widest, 4-byte, signed relative
 * offset even though the last would often fit in less bytes.
 */
-                asm goto("1: .byte 0xe9\n .long %l[t_dynamic] - 2f\n"
+                asm_volatile_goto("1: .byte 0xe9\n .long %l[t_dynamic] - 2f\n"
                         "2:\n"
                         ".section .altinstructions,\"a\"\n"
                         " .long 1b - .\n"              /* src offset */
diff --git a/arch/x86/include/asm/jump_label.h b/arch/x86/include/asm/jump_label.h
index 64507f35800c..6a2cefb4395a 100644
--- a/arch/x86/include/asm/jump_label.h
+++ b/arch/x86/include/asm/jump_label.h
@@ -18,7 +18,7 @@
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:"
+        asm_volatile_goto("1:"
                ".byte " __stringify(STATIC_KEY_INIT_NOP) "\n\t"
                ".pushsection __jump_table,  \"aw\" \n\t"
                _ASM_ALIGN "\n\t"
diff --git a/arch/x86/include/asm/mutex_64.h b/arch/x86/include/asm/mutex_64.h
index e7e6751648ed..07537a44216e 100644
--- a/arch/x86/include/asm/mutex_64.h
+++ b/arch/x86/include/asm/mutex_64.h
@@ -20,7 +20,7 @@
 static inline void __mutex_fastpath_lock(atomic_t *v,
                                         void (*fail_fn)(atomic_t *))
 {
-        asm volatile goto(LOCK_PREFIX "   decl %0\n"
+        asm_volatile_goto(LOCK_PREFIX "   decl %0\n"
                          "   jns %l[exit]\n"
                          : : "m" (v->counter)
                          : "memory", "cc"
@@ -75,7 +75,7 @@ static inline int __mutex_fastpath_lock_retval(atomic_t *count)
 static inline void __mutex_fastpath_unlock(atomic_t *v,
                                           void (*fail_fn)(atomic_t *))
 {
-        asm volatile goto(LOCK_PREFIX "   incl %0\n"
+        asm_volatile_goto(LOCK_PREFIX "   incl %0\n"
                          "   jg %l[exit]\n"
                          : : "m" (v->counter)
                          : "memory", "cc"
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 1191ac1c9d25..a419814cea57 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -113,7 +113,7 @@ static int __init early_get_pnodeid(void)
                break;
        case UV3_HUB_PART_NUMBER:
        case UV3_HUB_PART_NUMBER_X:
-                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
+                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
                break;
        }
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 897783b3302a..9d8449158cf9 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1888,10 +1888,7 @@ void arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
        userpg->cap_user_rdpmc = x86_pmu.attr_rdpmc;
        userpg->pmc_width = x86_pmu.cntval_bits;
-        if (!boot_cpu_has(X86_FEATURE_CONSTANT_TSC))
+        if (!sched_clock_stable)
-                return;
-        if (!boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
                return;
        userpg->cap_user_time = 1;
@@ -1899,10 +1896,8 @@ void arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
        userpg->time_shift = CYC2NS_SCALE_FACTOR;
        userpg->time_offset = this_cpu_read(cyc2ns_offset) - now;
-        if (sched_clock_stable && !check_tsc_disabled()) {
+        userpg->cap_user_time_zero = 1;
-                userpg->cap_user_time_zero = 1;
+        userpg->time_zero = this_cpu_read(cyc2ns_offset);
-                userpg->time_zero = this_cpu_read(cyc2ns_offset);
-        }
 }
 /*
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 697b93af02dd..a0e2a8a80c94 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -775,11 +775,22 @@ void __init kvm_spinlock_init(void)
        if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
                return;
-        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
+        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
+        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+}
+static __init int kvm_spinlock_init_jump(void)
+{
+        if (!kvm_para_available())
+                return 0;
+        if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
+                return 0;
        static_key_slow_inc(&paravirt_ticketlocks_enabled);
+        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
-        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
+        return 0;
-        pv_lock_ops.unlock_kick = kvm_unlock_kick;
 }
+early_initcall(kvm_spinlock_init_jump);
 #endif  /* CONFIG_PARAVIRT_SPINLOCKS */
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index e643e744e4d8..7e920bff99a3 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -326,6 +326,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6320"),
                },
        },
+        {       /* Handle problems with rebooting on the Latitude E5410. */
+                .callback = set_pci_reboot,
+                .ident = "Dell Latitude E5410",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5410"),
+                },
+        },
        {       /* Handle problems with rebooting on the Latitude E5420. */
                .callback = set_pci_reboot,
                .ident = "Dell Latitude E5420",
diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
index 22513e96b012..86179d409893 100644
--- a/arch/x86/kernel/sysfb_simplefb.c
+++ b/arch/x86/kernel/sysfb_simplefb.c
@@ -72,14 +72,14 @@ __init int create_simplefb(const struct screen_info *si,
         * the part that is occupied by the framebuffer */
        len = mode->height * mode->stride;
        len = PAGE_ALIGN(len);
-        if (len > si->lfb_size << 16) {
+        if (len > (u64)si->lfb_size << 16) {
                printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
                return -EINVAL;
        }
        /* setup IORESOURCE_MEM as framebuffer memory */
        memset(&res, 0, sizeof(res));
-        res.flags = IORESOURCE_MEM;
+        res.flags = IORESOURCE_MEM | IORESOURCE_BUSY;
        res.name = simplefb_resname;
        res.start = si->lfb_base;
        res.end = si->lfb_base + len - 1;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a1216de9ffda..2b2fce1b2009 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3255,25 +3255,29 @@ static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
 static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
 {
+        struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
        if (!test_bit(VCPU_EXREG_PDPTR,
                      (unsigned long *)&vcpu->arch.regs_dirty))
                return;
        if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
-                vmcs_write64(GUEST_PDPTR0, vcpu->arch.mmu.pdptrs[0]);
+                vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
-                vmcs_write64(GUEST_PDPTR1, vcpu->arch.mmu.pdptrs[1]);
+                vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
-                vmcs_write64(GUEST_PDPTR2, vcpu->arch.mmu.pdptrs[2]);
+                vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
-                vmcs_write64(GUEST_PDPTR3, vcpu->arch.mmu.pdptrs[3]);
+                vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]);
        }
 }
 static void ept_save_pdptrs(struct kvm_vcpu *vcpu)
 {
+        struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
        if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
-                vcpu->arch.mmu.pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
+                mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
-                vcpu->arch.mmu.pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
+                mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
-                vcpu->arch.mmu.pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
+                mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
-                vcpu->arch.mmu.pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
+                mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
        }
        __set_bit(VCPU_EXREG_PDPTR,
@@ -5345,7 +5349,9 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
         * There are errata that may cause this bit to not be set:
         * AAK134, BY25.
         */
-        if (exit_qualification & INTR_INFO_UNBLOCK_NMI)
+        if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
+                        cpu_has_virtual_nmis() &&
+                        (exit_qualification & INTR_INFO_UNBLOCK_NMI))
                vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
        gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
@@ -7775,10 +7781,6 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                vmcs_write64(GUEST_PDPTR1, vmcs12->guest_pdptr1);
                vmcs_write64(GUEST_PDPTR2, vmcs12->guest_pdptr2);
                vmcs_write64(GUEST_PDPTR3, vmcs12->guest_pdptr3);
-                __clear_bit(VCPU_EXREG_PDPTR,
-                                (unsigned long *)&vcpu->arch.regs_avail);
-                __clear_bit(VCPU_EXREG_PDPTR,
-                                (unsigned long *)&vcpu->arch.regs_dirty);
        }
        kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->guest_rsp);
diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
index 5596c7bdd327..082e88129712 100644
--- a/arch/x86/pci/mmconfig-shared.c
+++ b/arch/x86/pci/mmconfig-shared.c
@@ -700,7 +700,7 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
        if (!(pci_probe & PCI_PROBE_MMCONF) || pci_mmcfg_arch_init_failed)
                return -ENODEV;
-        if (start > end || !addr)
+        if (start > end)
                return -EINVAL;
        mutex_lock(&pci_mmcfg_lock);
@@ -716,6 +716,11 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
                return -EEXIST;
        }
+        if (!addr) {
+                mutex_unlock(&pci_mmcfg_lock);
+                return -EINVAL;
+        }
        rc = -EBUSY;
        cfg = pci_mmconfig_alloc(seg, start, end, addr);
        if (cfg == NULL) {
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index d1e4777b4e75..31d04758b76f 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -278,6 +278,15 @@ static void __init xen_smp_prepare_boot_cpu(void)
                   old memory can be recycled */
                make_lowmem_page_readwrite(xen_initial_gdt);
+#ifdef CONFIG_X86_32
+                /*
+                 * Xen starts us with XEN_FLAT_RING1_DS, but linux code
+                 * expects __USER_DS
+                 */
+                loadsegment(ds, __USER_DS);
+                loadsegment(es, __USER_DS);
+#endif
                xen_filter_cpu_maps();
                xen_setup_vcpu_info_placement();
        }
diff --git a/block/Kconfig b/block/Kconfig
index 7f38e40fee08..2429515c05c2 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -99,11 +99,16 @@ config BLK_DEV_THROTTLING
        See Documentation/cgroups/blkio-controller.txt for more information.
-config CMDLINE_PARSER
+config BLK_CMDLINE_PARSER
        bool "Block device command line partition parser"
        default n
        ---help---
-        Parsing command line, get the partitions information.
+        Enabling this option allows you to specify the partition layout from
+        the kernel boot args.  This is typically of use for embedded devices
+        which don't otherwise have any standardized method for listing the
+        partitions on a block device.
+        See Documentation/block/cmdline-partition.txt for more information.
 menu "Partition Types"
diff --git a/block/Makefile b/block/Makefile
index 4fa4be544ece..671a83d063a5 100644
--- a/block/Makefile
+++ b/block/Makefile
@@ -18,4 +18,4 @@ obj-$(CONFIG_IOSCHED_CFQ)	+= cfq-iosched.o
 obj-$(CONFIG_BLOCK_COMPAT)      += compat_ioctl.o
 obj-$(CONFIG_BLK_DEV_INTEGRITY) += blk-integrity.o
-obj-$(CONFIG_CMDLINE_PARSER)    += cmdline-parser.o
+obj-$(CONFIG_BLK_CMDLINE_PARSER)        += cmdline-parser.o
diff --git a/block/partitions/Kconfig b/block/partitions/Kconfig
index 87a32086535d..9b29a996c311 100644
--- a/block/partitions/Kconfig
+++ b/block/partitions/Kconfig
@@ -263,7 +263,7 @@ config SYSV68_PARTITION
 config CMDLINE_PARTITION
        bool "Command line partition support" if PARTITION_ADVANCED
-        select CMDLINE_PARSER
+        select BLK_CMDLINE_PARSER
        help
-          Say Y here if you would read the partitions table from bootargs.
+          Say Y here if you want to read the partition table from bootargs.
          The format for the command line is just like mtdparts.
diff --git a/block/partitions/cmdline.c b/block/partitions/cmdline.c
index 56cf4ffad51e..5141b563adf1 100644
--- a/block/partitions/cmdline.c
+++ b/block/partitions/cmdline.c
@@ -2,15 +2,15 @@
 * Copyright (C) 2013 HUAWEI
 * Author: Cai Zhiyong <caizhiyong@huawei.com>
 *
- * Read block device partition table from command line.
+ * Read block device partition table from the command line.
- * The partition used for fixed block device (eMMC) embedded device.
+ * Typically used for fixed block (eMMC) embedded devices.
- * It is no MBR, save storage space. Bootloader can be easily accessed
+ * It has no MBR, so saves storage space. Bootloader can be easily accessed
 * by absolute address of data on the block device.
 * Users can easily change the partition.
 *
 * The format for the command line is just like mtdparts.
 *
- * Verbose config please reference "Documentation/block/cmdline-partition.txt"
+ * For further information, see "Documentation/block/cmdline-partition.txt"
 *
 */
diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index 1eb09ee5311b..a8287b49d062 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -222,11 +222,16 @@ check_hybrid:
         * the disk size.
         *
         * Hybrid MBRs do not necessarily comply with this.
+         *
+         * Consider a bad value here to be a warning to support dd'ing
+         * an image from a smaller disk to a larger disk.
         */
        if (ret == GPT_MBR_PROTECTIVE) {
                sz = le32_to_cpu(mbr->partition_record[part].size_in_lba);
                if (sz != (uint32_t) total_sectors - 1 && sz != 0xFFFFFFFF)
-                        ret = 0;
+                        pr_debug("GPT: mbr size in lba (%u) different than whole disk (%u).\n",
+                                 sz, min_t(uint32_t,
+                                           total_sectors - 1, 0xFFFFFFFF));
        }
 done:
        return ret;
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 22327e6a7236..6efe2ac6902f 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -24,7 +24,7 @@ menuconfig ACPI
          are configured, ACPI is used.
          The project home page for the Linux ACPI subsystem is here:
-          <http://www.lesswatts.org/projects/acpi/>
+          <https://01.org/linux-acpi>
          Linux support for ACPI is based on Intel Corporation's ACPI
          Component Architecture (ACPI CA).  For more information on the
@@ -123,9 +123,9 @@ config ACPI_BUTTON
        default y
        help
          This driver handles events on the power, sleep, and lid buttons.
-          A daemon reads /proc/acpi/event and perform user-defined actions
+          A daemon reads events from input devices or via netlink and
-          such as shutting down the system.  This is necessary for
+          performs user-defined actions such as shutting down the system.
-          software-controlled poweroff.
+          This is necessary for software-controlled poweroff.
          To compile this driver as a module, choose M here:
          the module will be called button.
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 59d3202f6b36..a94383d1f350 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1025,60 +1025,4 @@ void acpi_dev_pm_detach(struct device *dev, bool power_off)
        }
 }
 EXPORT_SYMBOL_GPL(acpi_dev_pm_detach);
-/**
- * acpi_dev_pm_add_dependent - Add physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_add_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev)
-                        goto out;
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (dep) {
-                dep->dev = depdev;
-                list_add_tail(&dep->node, &adev->power_dependent);
-        }
- out:
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_add_dependent);
-/**
- * acpi_dev_pm_remove_dependent - Remove physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_remove_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev) {
-                        list_del(&dep->node);
-                        kfree(dep);
-                        break;
-                }
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_remove_dependent);
 #endif /* CONFIG_PM */
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 0dbe5cdf3396..c2ad391d8041 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -59,16 +59,9 @@ ACPI_MODULE_NAME("power");
 #define ACPI_POWER_RESOURCE_STATE_ON    0x01
 #define ACPI_POWER_RESOURCE_STATE_UNKNOWN 0xFF
-struct acpi_power_dependent_device {
-        struct list_head node;
-        struct acpi_device *adev;
-        struct work_struct work;
-};
 struct acpi_power_resource {
        struct acpi_device device;
        struct list_head list_node;
-        struct list_head dependent;
        char *name;
        u32 system_level;
        u32 order;
@@ -233,32 +226,6 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
        return 0;
 }
-static void acpi_power_resume_dependent(struct work_struct *work)
-{
-        struct acpi_power_dependent_device *dep;
-        struct acpi_device_physical_node *pn;
-        struct acpi_device *adev;
-        int state;
-        dep = container_of(work, struct acpi_power_dependent_device, work);
-        adev = dep->adev;
-        if (acpi_power_get_inferred_state(adev, &state))
-                return;
-        if (state > ACPI_STATE_D0)
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(pn, &adev->physical_node_list, node)
-                pm_request_resume(pn->dev);
-        list_for_each_entry(pn, &adev->power_dependent, node)
-                pm_request_resume(pn->dev);
-        mutex_unlock(&adev->physical_node_lock);
-}
 static int __acpi_power_on(struct acpi_power_resource *resource)
 {
        acpi_status status = AE_OK;
@@ -283,14 +250,8 @@ static int acpi_power_on_unlocked(struct acpi_power_resource *resource)
                                  resource->name));
        } else {
                result = __acpi_power_on(resource);
-                if (result) {
+                if (result)
                        resource->ref_count--;
-                } else {
-                        struct acpi_power_dependent_device *dep;
-                        list_for_each_entry(dep, &resource->dependent, node)
-                                schedule_work(&dep->work);
-                }
        }
        return result;
 }
@@ -390,52 +351,6 @@ static int acpi_power_on_list(struct list_head *list)
        return result;
 }
-static void acpi_power_add_dependent(struct acpi_power_resource *resource,
-                                     struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-        mutex_lock(&resource->resource_lock);
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev)
-                        goto out;
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (!dep)
-                goto out;
-        dep->adev = adev;
-        INIT_WORK(&dep->work, acpi_power_resume_dependent);
-        list_add_tail(&dep->node, &resource->dependent);
- out:
-        mutex_unlock(&resource->resource_lock);
-}
-static void acpi_power_remove_dependent(struct acpi_power_resource *resource,
-                                        struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-        struct work_struct *work = NULL;
-        mutex_lock(&resource->resource_lock);
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev) {
-                        list_del(&dep->node);
-                        work = &dep->work;
-                        break;
-                }
-        mutex_unlock(&resource->resource_lock);
-        if (work) {
-                cancel_work_sync(work);
-                kfree(dep);
-        }
-}
 static struct attribute *attrs[] = {
        NULL,
 };
@@ -524,8 +439,6 @@ static void acpi_power_expose_hide(struct acpi_device *adev,
 void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
 {
-        struct acpi_device_power_state *ps;
-        struct acpi_power_resource_entry *entry;
        int state;
        if (adev->wakeup.flags.valid)
@@ -535,16 +448,6 @@ void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
        if (!adev->power.flags.power_resources)
                return;
-        ps = &adev->power.states[ACPI_STATE_D0];
-        list_for_each_entry(entry, &ps->resources, node) {
-                struct acpi_power_resource *resource = entry->resource;
-                if (add)
-                        acpi_power_add_dependent(resource, adev);
-                else
-                        acpi_power_remove_dependent(resource, adev);
-        }
        for (state = ACPI_STATE_D0; state <= ACPI_STATE_D3_HOT; state++)
                acpi_power_expose_hide(adev,
                                       &adev->power.states[state].resources,
@@ -882,7 +785,6 @@ int acpi_add_power_resource(acpi_handle handle)
        acpi_init_device_object(device, handle, ACPI_BUS_TYPE_POWER,
                                ACPI_STA_DEFAULT);
        mutex_init(&resource->resource_lock);
-        INIT_LIST_HEAD(&resource->dependent);
        INIT_LIST_HEAD(&resource->list_node);
        resource->name = device->pnp.bus_id;
        strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
@@ -936,8 +838,10 @@ void acpi_resume_power_resources(void)
                mutex_lock(&resource->resource_lock);
                result = acpi_power_get_state(resource->device.handle, &state);
-                if (result)
+                if (result) {
+                        mutex_unlock(&resource->resource_lock);
                        continue;
+                }
                if (state == ACPI_POWER_RESOURCE_STATE_OFF
                    && resource->ref_count) {
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 611ce9061dc5..fee8a297c7d9 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -968,7 +968,7 @@ int acpi_bus_get_device(acpi_handle handle, struct acpi_device **device)
        }
        return 0;
 }
-EXPORT_SYMBOL_GPL(acpi_bus_get_device);
+EXPORT_SYMBOL(acpi_bus_get_device);
 int acpi_device_add(struct acpi_device *device,
                    void (*release)(struct device *))
@@ -999,7 +999,6 @@ int acpi_device_add(struct acpi_device *device,
        INIT_LIST_HEAD(&device->wakeup_list);
        INIT_LIST_HEAD(&device->physical_node_list);
        mutex_init(&device->physical_node_lock);
-        INIT_LIST_HEAD(&device->power_dependent);
        new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL);
        if (!new_bus_id) {
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 4ba8b0405572..ab714d2ad978 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1035,17 +1035,3 @@ void ata_acpi_on_disable(struct ata_device *dev)
 {
        ata_acpi_clear_gtf(dev);
 }
-void ata_scsi_acpi_bind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_add_dependent(handle, &dev->sdev->sdev_gendev);
-}
-void ata_scsi_acpi_unbind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_remove_dependent(handle, &dev->sdev->sdev_gendev);
-}
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 97a0cef12959..db6dfcfa3e2e 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3679,7 +3679,6 @@ void ata_scsi_scan_host(struct ata_port *ap, int sync)
                        if (!IS_ERR(sdev)) {
                                dev->sdev = sdev;
                                scsi_device_put(sdev);
-                                ata_scsi_acpi_bind(dev);
                        } else {
                                dev->sdev = NULL;
                        }
@@ -3767,8 +3766,6 @@ static void ata_scsi_remove_dev(struct ata_device *dev)
        struct scsi_device *sdev;
        unsigned long flags;
-        ata_scsi_acpi_unbind(dev);
        /* Alas, we need to grab scan_mutex to ensure SCSI device
         * state doesn't change underneath us and thus
         * scsi_device_get() always succeeds.  The mutex locking can
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index eeeb77845d48..45b5ab3a95d5 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -121,8 +121,6 @@ extern void ata_acpi_set_state(struct ata_port *ap, pm_message_t state);
 extern void ata_acpi_bind_port(struct ata_port *ap);
 extern void ata_acpi_bind_dev(struct ata_device *dev);
 extern acpi_handle ata_dev_acpi_handle(struct ata_device *dev);
-extern void ata_scsi_acpi_bind(struct ata_device *dev);
-extern void ata_scsi_acpi_unbind(struct ata_device *dev);
 #else
 static inline void ata_acpi_dissociate(struct ata_host *host) { }
 static inline int ata_acpi_on_suspend(struct ata_port *ap) { return 0; }
@@ -133,8 +131,6 @@ static inline void ata_acpi_set_state(struct ata_port *ap,
                                      pm_message_t state) { }
 static inline void ata_acpi_bind_port(struct ata_port *ap) {}
 static inline void ata_acpi_bind_dev(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_bind(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_unbind(struct ata_device *dev) {}
 #endif
 /* libata-scsi.c */
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 9e59f6535c44..bece691cb5d9 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -333,8 +333,10 @@ store_mem_state(struct device *dev,
                online_type = ONLINE_KEEP;
        else if (!strncmp(buf, "offline", min_t(int, count, 7)))
                online_type = -1;
-        else
+        else {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err;
+        }
        switch (online_type) {
        case ONLINE_KERNEL:
@@ -357,6 +359,7 @@ store_mem_state(struct device *dev,
                ret = -EINVAL; /* should never happen */
        }
+err:
        unlock_device_hotplug();
        if (ret)
diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index c9fd6943ce45..50329d1057ed 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -210,25 +210,6 @@ static void bcma_core_pci_config_fixup(struct bcma_drv_pci *pc)
        }
 }
-static void bcma_core_pci_power_save(struct bcma_drv_pci *pc, bool up)
-{
-        u16 data;
-        if (pc->core->id.rev >= 15 && pc->core->id.rev <= 20) {
-                data = up ? 0x74 : 0x7C;
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7F64);
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
-        } else if (pc->core->id.rev >= 21 && pc->core->id.rev <= 22) {
-                data = up ? 0x75 : 0x7D;
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7E65);
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
-        }
-}
 /**************************************************
 * Init.
 **************************************************/
@@ -255,6 +236,32 @@ void bcma_core_pci_init(struct bcma_drv_pci *pc)
                bcma_core_pci_clientmode_init(pc);
 }
+void bcma_core_pci_power_save(struct bcma_bus *bus, bool up)
+{
+        struct bcma_drv_pci *pc;
+        u16 data;
+        if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+                return;
+        pc = &bus->drv_pci[0];
+        if (pc->core->id.rev >= 15 && pc->core->id.rev <= 20) {
+                data = up ? 0x74 : 0x7C;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7F64);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        } else if (pc->core->id.rev >= 21 && pc->core->id.rev <= 22) {
+                data = up ? 0x75 : 0x7D;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7E65);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        }
+}
+EXPORT_SYMBOL_GPL(bcma_core_pci_power_save);
 int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
                          bool enable)
 {
@@ -310,8 +317,6 @@ void bcma_core_pci_up(struct bcma_bus *bus)
        pc = &bus->drv_pci[0];
-        bcma_core_pci_power_save(pc, true);
        bcma_core_pci_extend_L1timer(pc, true);
 }
 EXPORT_SYMBOL_GPL(bcma_core_pci_up);
@@ -326,7 +331,5 @@ void bcma_core_pci_down(struct bcma_bus *bus)
        pc = &bus->drv_pci[0];
        bcma_core_pci_extend_L1timer(pc, false);
-        bcma_core_pci_power_save(pc, false);
 }
 EXPORT_SYMBOL_GPL(bcma_core_pci_down);
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a12b923bbaca..0a327f4154a2 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -85,6 +85,7 @@ static struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x04CA, 0x3008) },
        { USB_DEVICE(0x13d3, 0x3362) },
        { USB_DEVICE(0x0CF3, 0xE004) },
+        { USB_DEVICE(0x0CF3, 0xE005) },
        { USB_DEVICE(0x0930, 0x0219) },
        { USB_DEVICE(0x0489, 0xe057) },
        { USB_DEVICE(0x13d3, 0x3393) },
@@ -126,6 +127,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8e16f0af6358..f3dfc0a88fdc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
        /* Broadcom BCM20702A0 */
        { USB_DEVICE(0x0b05, 0x17b5) },
+        { USB_DEVICE(0x0b05, 0x17cb) },
        { USB_DEVICE(0x04ca, 0x2003) },
        { USB_DEVICE(0x0489, 0xe042) },
        { USB_DEVICE(0x413c, 0x8197) },
@@ -112,6 +113,9 @@ static struct usb_device_id btusb_table[] = {
        /*Broadcom devices with vendor specific id */
        { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
+        /* Belkin F8065bf - Broadcom based */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
        { }     /* Terminating entry */
 };
@@ -148,6 +152,7 @@ static struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index 19ab6ff53d59..2394e9753ef5 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -700,6 +700,7 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus,
                                         phys_addr_t sdramwins_phys_base,
                                         size_t sdramwins_size)
 {
+        struct device_node *np;
        int win;
        mbus->mbuswins_base = ioremap(mbuswins_phys_base, mbuswins_size);
@@ -712,8 +713,11 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus,
                return -ENOMEM;
        }
-        if (of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric"))
+        np = of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric");
+        if (np) {
                mbus->hw_io_coherency = 1;
+                of_node_put(np);
+        }
        for (win = 0; win < mbus->soc->num_wins; win++)
                mvebu_mbus_disable_window(mbus, win);
@@ -861,11 +865,13 @@ static void __init mvebu_mbus_get_pcie_resources(struct device_node *np,
        int ret;
        /*
-         * These are optional, so we clear them and they'll
+         * These are optional, so we make sure that resource_size(x) will
-         * be zero if they are missing from the DT.
+         * return 0.
         */
        memset(mem, 0, sizeof(struct resource));
+        mem->end = -1;
        memset(io, 0, sizeof(struct resource));
+        io->end = -1;
        ret = of_property_read_u32_array(np, "pcie-mem-aperture", reg, ARRAY_SIZE(reg));
        if (!ret) {
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 7737b5bd26af..7a744d391756 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -640,7 +640,7 @@ struct timer_rand_state {
 */
 void add_device_randomness(const void *buf, unsigned int size)
 {
-        unsigned long time = get_cycles() ^ jiffies;
+        unsigned long time = random_get_entropy() ^ jiffies;
        mix_pool_bytes(&input_pool, buf, size, NULL);
        mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
@@ -677,7 +677,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
                goto out;
        sample.jiffies = jiffies;
-        sample.cycles = get_cycles();
+        sample.cycles = random_get_entropy();
        sample.num = num;
        mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
@@ -744,7 +744,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
        struct fast_pool        *fast_pool = &__get_cpu_var(irq_randomness);
        struct pt_regs          *regs = get_irq_regs();
        unsigned long           now = jiffies;
-        __u32                   input[4], cycles = get_cycles();
+        __u32                   input[4], cycles = random_get_entropy();
        input[0] = cycles ^ jiffies;
        input[1] = irq;
@@ -1459,12 +1459,11 @@ struct ctl_table random_table[] = {
 static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
-static int __init random_int_secret_init(void)
+int random_int_secret_init(void)
 {
        get_random_bytes(random_int_secret, sizeof(random_int_secret));
        return 0;
 }
-late_initcall(random_int_secret_init);
 /*
 * Get a random word for internal kernel use only. Similar to urandom but
@@ -1483,7 +1482,7 @@ unsigned int get_random_int(void)
        hash = get_cpu_var(get_random_int_hash);
-        hash[0] += current->pid + jiffies + get_cycles();
+        hash[0] += current->pid + jiffies + random_get_entropy();
        md5_transform(hash, random_int_secret);
        ret = hash[0];
        put_cpu_var(get_random_int_hash);
diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
index 06189e55b4e5..94c280d36e8b 100644
--- a/drivers/char/tpm/xen-tpmfront.c
+++ b/drivers/char/tpm/xen-tpmfront.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
+#include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/interface/io/tpmif.h>
 #include <xen/grant_table.h>
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 78c49d8e0f4a..c522a95c0e16 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -229,7 +229,7 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
        if (of_property_read_u32(np, "clock-latency", &transition_latency))
                transition_latency = CPUFREQ_ETERNAL;
-        if (cpu_reg) {
+        if (!IS_ERR(cpu_reg)) {
                struct opp *opp;
                unsigned long min_uV, max_uV;
                int i;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 9733f29ed148..badf6206b2b2 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -383,6 +383,7 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
 static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
 {
        int max_perf, min_perf;
+        u64 val;
        intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
@@ -394,8 +395,11 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
        trace_cpu_frequency(pstate * 100000, cpu->cpu);
        cpu->pstate.current_pstate = pstate;
-        wrmsrl(MSR_IA32_PERF_CTL, pstate << 8);
+        val = pstate << 8;
+        if (limits.no_turbo)
+                val |= (u64)1 << 32;
+        wrmsrl(MSR_IA32_PERF_CTL, val);
 }
 static inline void intel_pstate_pstate_increase(struct cpudata *cpu, int steps)
@@ -634,8 +638,8 @@ static int intel_pstate_cpu_exit(struct cpufreq_policy *policy)
 static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 {
-        int rc, min_pstate, max_pstate;
        struct cpudata *cpu;
+        int rc;
        rc = intel_pstate_init_cpu(policy->cpu);
        if (rc)
@@ -649,9 +653,8 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
        else
                policy->policy = CPUFREQ_POLICY_POWERSAVE;
-        intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+        policy->min = cpu->pstate.min_pstate * 100000;
-        policy->min = min_pstate * 100000;
+        policy->max = cpu->pstate.turbo_pstate * 100000;
-        policy->max = max_pstate * 100000;
        /* cpuinfo and default policy values */
        policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000;
diff --git a/drivers/cpufreq/s3c64xx-cpufreq.c b/drivers/cpufreq/s3c64xx-cpufreq.c
index 8a72b0c555f8..15631f92ab7d 100644
--- a/drivers/cpufreq/s3c64xx-cpufreq.c
+++ b/drivers/cpufreq/s3c64xx-cpufreq.c
@@ -166,7 +166,7 @@ static void __init s3c64xx_cpufreq_config_regulator(void)
                if (freq->frequency == CPUFREQ_ENTRY_INVALID)
                        continue;
-                dvfs = &s3c64xx_dvfs_table[freq->index];
+                dvfs = &s3c64xx_dvfs_table[freq->driver_data];
                found = 0;
                for (i = 0; i < count; i++) {
diff --git a/drivers/cpufreq/spear-cpufreq.c b/drivers/cpufreq/spear-cpufreq.c
index 19e364fa5955..3f418166ce02 100644
--- a/drivers/cpufreq/spear-cpufreq.c
+++ b/drivers/cpufreq/spear-cpufreq.c
@@ -113,7 +113,7 @@ static int spear_cpufreq_target(struct cpufreq_policy *policy,
                unsigned int target_freq, unsigned int relation)
 {
        struct cpufreq_freqs freqs;
-        unsigned long newfreq;
+        long newfreq;
        struct clk *srcclk;
        int index, ret, mult = 1;
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 526ec77c7ba0..f238cfd33847 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -198,6 +198,7 @@ config TI_EDMA
        depends on ARCH_DAVINCI || ARCH_OMAP
        select DMA_ENGINE
        select DMA_VIRTUAL_CHANNELS
+        select TI_PRIV_EDMA
        default n
        help
          Enable support for the TI EDMA controller. This DMA
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index ff50ff4c6a57..3519111c566b 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -306,6 +306,7 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                                                EDMA_SLOT_ANY);
                        if (echan->slot[i] < 0) {
                                dev_err(dev, "Failed to allocate slot\n");
+                                kfree(edesc);
                                return NULL;
                        }
                }
@@ -749,6 +750,6 @@ static void __exit edma_exit(void)
 }
 module_exit(edma_exit);
-MODULE_AUTHOR("Matt Porter <mporter@ti.com>");
+MODULE_AUTHOR("Matt Porter <matt.porter@linaro.org>");
 MODULE_DESCRIPTION("TI EDMA DMA engine driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index 78f8ca5fccee..55852c026791 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -437,17 +437,18 @@ static void dma_irq_handle_channel(struct imxdma_channel *imxdmac)
        struct imxdma_engine *imxdma = imxdmac->imxdma;
        int chno = imxdmac->channel;
        struct imxdma_desc *desc;
+        unsigned long flags;
-        spin_lock(&imxdma->lock);
+        spin_lock_irqsave(&imxdma->lock, flags);
        if (list_empty(&imxdmac->ld_active)) {
-                spin_unlock(&imxdma->lock);
+                spin_unlock_irqrestore(&imxdma->lock, flags);
                goto out;
        }
        desc = list_first_entry(&imxdmac->ld_active,
                                struct imxdma_desc,
                                node);
-        spin_unlock(&imxdma->lock);
+        spin_unlock_irqrestore(&imxdma->lock, flags);
        if (desc->sg) {
                u32 tmp;
@@ -519,7 +520,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
 {
        struct imxdma_channel *imxdmac = to_imxdma_chan(d->desc.chan);
        struct imxdma_engine *imxdma = imxdmac->imxdma;
-        unsigned long flags;
        int slot = -1;
        int i;
@@ -527,7 +527,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
        switch (d->type) {
        case IMXDMA_DESC_INTERLEAVED:
                /* Try to get a free 2D slot */
-                spin_lock_irqsave(&imxdma->lock, flags);
                for (i = 0; i < IMX_DMA_2D_SLOTS; i++) {
                        if ((imxdma->slots_2d[i].count > 0) &&
                        ((imxdma->slots_2d[i].xsr != d->x) ||
@@ -537,10 +536,8 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                        slot = i;
                        break;
                }
-                if (slot < 0) {
+                if (slot < 0)
-                        spin_unlock_irqrestore(&imxdma->lock, flags);
                        return -EBUSY;
-                }
                imxdma->slots_2d[slot].xsr = d->x;
                imxdma->slots_2d[slot].ysr = d->y;
@@ -549,7 +546,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                imxdmac->slot_2d = slot;
                imxdmac->enabled_2d = true;
-                spin_unlock_irqrestore(&imxdma->lock, flags);
                if (slot == IMX_DMA_2D_SLOT_A) {
                        d->config_mem &= ~CCR_MSEL_B;
@@ -625,18 +621,17 @@ static void imxdma_tasklet(unsigned long data)
        struct imxdma_channel *imxdmac = (void *)data;
        struct imxdma_engine *imxdma = imxdmac->imxdma;
        struct imxdma_desc *desc;
+        unsigned long flags;
-        spin_lock(&imxdma->lock);
+        spin_lock_irqsave(&imxdma->lock, flags);
        if (list_empty(&imxdmac->ld_active)) {
                /* Someone might have called terminate all */
-                goto out;
+                spin_unlock_irqrestore(&imxdma->lock, flags);
+                return;
        }
        desc = list_first_entry(&imxdmac->ld_active, struct imxdma_desc, node);
-        if (desc->desc.callback)
-                desc->desc.callback(desc->desc.callback_param);
        /* If we are dealing with a cyclic descriptor, keep it on ld_active
         * and dont mark the descriptor as complete.
         * Only in non-cyclic cases it would be marked as complete
@@ -663,7 +658,11 @@ static void imxdma_tasklet(unsigned long data)
                                 __func__, imxdmac->channel);
        }
 out:
-        spin_unlock(&imxdma->lock);
+        spin_unlock_irqrestore(&imxdma->lock, flags);
+        if (desc->desc.callback)
+                desc->desc.callback(desc->desc.callback_param);
 }
 static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
@@ -883,7 +882,7 @@ static struct dma_async_tx_descriptor *imxdma_prep_dma_cyclic(
        kfree(imxdmac->sg_list);
        imxdmac->sg_list = kcalloc(periods + 1,
-                        sizeof(struct scatterlist), GFP_KERNEL);
+                        sizeof(struct scatterlist), GFP_ATOMIC);
        if (!imxdmac->sg_list)
                return NULL;
diff --git a/drivers/dma/sh/rcar-hpbdma.c b/drivers/dma/sh/rcar-hpbdma.c
index 45a520281ce1..ebad84591a6e 100644
--- a/drivers/dma/sh/rcar-hpbdma.c
+++ b/drivers/dma/sh/rcar-hpbdma.c
@@ -93,6 +93,7 @@ struct hpb_dmae_chan {
        void __iomem *base;
        const struct hpb_dmae_slave_config *cfg;
        char dev_id[16];                /* unique name per DMAC of channel */
+        dma_addr_t slave_addr;
 };
 struct hpb_dmae_device {
@@ -432,7 +433,6 @@ hpb_dmae_alloc_chan_resources(struct hpb_dmae_chan *hpb_chan,
                hpb_chan->xfer_mode = XFER_DOUBLE;
        } else {
                dev_err(hpb_chan->shdma_chan.dev, "DCR setting error");
-                shdma_free_irq(&hpb_chan->shdma_chan);
                return -EINVAL;
        }
@@ -446,7 +446,8 @@ hpb_dmae_alloc_chan_resources(struct hpb_dmae_chan *hpb_chan,
        return 0;
 }
-static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id, bool try)
+static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id,
+                              dma_addr_t slave_addr, bool try)
 {
        struct hpb_dmae_chan *chan = to_chan(schan);
        const struct hpb_dmae_slave_config *sc =
@@ -457,6 +458,7 @@ static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id, bool try)
        if (try)
                return 0;
        chan->cfg = sc;
+        chan->slave_addr = slave_addr ? : sc->addr;
        return hpb_dmae_alloc_chan_resources(chan, sc);
 }
@@ -468,7 +470,7 @@ static dma_addr_t hpb_dmae_slave_addr(struct shdma_chan *schan)
 {
        struct hpb_dmae_chan *chan = to_chan(schan);
-        return chan->cfg->addr;
+        return chan->slave_addr;
 }
 static struct shdma_desc *hpb_dmae_embedded_desc(void *buf, int i)
@@ -614,7 +616,6 @@ static void hpb_dmae_chan_remove(struct hpb_dmae_device *hpbdev)
        shdma_for_each_chan(schan, &hpbdev->shdma_dev, i) {
                BUG_ON(!schan);
-                shdma_free_irq(schan);
                shdma_chan_remove(schan);
        }
        dma_dev->chancnt = 0;
diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c
index 2d9ca6055e5e..41b5913ddabe 100644
--- a/drivers/gpio/gpio-lynxpoint.c
+++ b/drivers/gpio/gpio-lynxpoint.c
@@ -248,14 +248,15 @@ static void lp_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
        struct lp_gpio *lg = irq_data_get_irq_handler_data(data);
        struct irq_chip *chip = irq_data_get_irq_chip(data);
        u32 base, pin, mask;
-        unsigned long reg, pending;
+        unsigned long reg, ena, pending;
        unsigned virq;
        /* check from GPIO controller which pin triggered the interrupt */
        for (base = 0; base < lg->chip.ngpio; base += 32) {
                reg = lp_gpio_reg(&lg->chip, base, LP_INT_STAT);
+                ena = lp_gpio_reg(&lg->chip, base, LP_INT_ENABLE);
-                while ((pending = inl(reg))) {
+                while ((pending = (inl(reg) & inl(ena)))) {
                        pin = __ffs(pending);
                        mask = BIT(pin);
                        /* Clear before handling so we don't lose an edge */
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 0ff43552d472..89675f862308 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -63,6 +63,7 @@ struct gpio_bank {
        struct gpio_chip chip;
        struct clk *dbck;
        u32 mod_usage;
+        u32 irq_usage;
        u32 dbck_enable_mask;
        bool dbck_enabled;
        struct device *dev;
@@ -86,6 +87,9 @@ struct gpio_bank {
 #define GPIO_BIT(bank, gpio) (1 << GPIO_INDEX(bank, gpio))
 #define GPIO_MOD_CTRL_BIT       BIT(0)
+#define BANK_USED(bank) (bank->mod_usage || bank->irq_usage)
+#define LINE_USED(line, offset) (line & (1 << offset))
 static int irq_to_gpio(struct gpio_bank *bank, unsigned int gpio_irq)
 {
        return bank->chip.base + gpio_irq;
@@ -420,15 +424,69 @@ static int _set_gpio_triggering(struct gpio_bank *bank, int gpio,
        return 0;
 }
+static void _enable_gpio_module(struct gpio_bank *bank, unsigned offset)
+{
+        if (bank->regs->pinctrl) {
+                void __iomem *reg = bank->base + bank->regs->pinctrl;
+                /* Claim the pin for MPU */
+                __raw_writel(__raw_readl(reg) | (1 << offset), reg);
+        }
+        if (bank->regs->ctrl && !BANK_USED(bank)) {
+                void __iomem *reg = bank->base + bank->regs->ctrl;
+                u32 ctrl;
+                ctrl = __raw_readl(reg);
+                /* Module is enabled, clocks are not gated */
+                ctrl &= ~GPIO_MOD_CTRL_BIT;
+                __raw_writel(ctrl, reg);
+                bank->context.ctrl = ctrl;
+        }
+}
+static void _disable_gpio_module(struct gpio_bank *bank, unsigned offset)
+{
+        void __iomem *base = bank->base;
+        if (bank->regs->wkup_en &&
+            !LINE_USED(bank->mod_usage, offset) &&
+            !LINE_USED(bank->irq_usage, offset)) {
+                /* Disable wake-up during idle for dynamic tick */
+                _gpio_rmw(base, bank->regs->wkup_en, 1 << offset, 0);
+                bank->context.wake_en =
+                        __raw_readl(bank->base + bank->regs->wkup_en);
+        }
+        if (bank->regs->ctrl && !BANK_USED(bank)) {
+                void __iomem *reg = bank->base + bank->regs->ctrl;
+                u32 ctrl;
+                ctrl = __raw_readl(reg);
+                /* Module is disabled, clocks are gated */
+                ctrl |= GPIO_MOD_CTRL_BIT;
+                __raw_writel(ctrl, reg);
+                bank->context.ctrl = ctrl;
+        }
+}
+static int gpio_is_input(struct gpio_bank *bank, int mask)
+{
+        void __iomem *reg = bank->base + bank->regs->direction;
+        return __raw_readl(reg) & mask;
+}
 static int gpio_irq_type(struct irq_data *d, unsigned type)
 {
        struct gpio_bank *bank = irq_data_get_irq_chip_data(d);
        unsigned gpio = 0;
        int retval;
        unsigned long flags;
+        unsigned offset;
-        if (WARN_ON(!bank->mod_usage))
+        if (!BANK_USED(bank))
-                return -EINVAL;
+                pm_runtime_get_sync(bank->dev);
 #ifdef CONFIG_ARCH_OMAP1
        if (d->irq > IH_MPUIO_BASE)
@@ -446,7 +504,17 @@ static int gpio_irq_type(struct irq_data *d, unsigned type)
                return -EINVAL;
        spin_lock_irqsave(&bank->lock, flags);
-        retval = _set_gpio_triggering(bank, GPIO_INDEX(bank, gpio), type);
+        offset = GPIO_INDEX(bank, gpio);
+        retval = _set_gpio_triggering(bank, offset, type);
+        if (!LINE_USED(bank->mod_usage, offset)) {
+                _enable_gpio_module(bank, offset);
+                _set_gpio_direction(bank, offset, 1);
+        } else if (!gpio_is_input(bank, 1 << offset)) {
+                spin_unlock_irqrestore(&bank->lock, flags);
+                return -EINVAL;
+        }
+        bank->irq_usage |= 1 << GPIO_INDEX(bank, gpio);
        spin_unlock_irqrestore(&bank->lock, flags);
        if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
@@ -603,35 +671,19 @@ static int omap_gpio_request(struct gpio_chip *chip, unsigned offset)
         * If this is the first gpio_request for the bank,
         * enable the bank module.
         */
-        if (!bank->mod_usage)
+        if (!BANK_USED(bank))
                pm_runtime_get_sync(bank->dev);
        spin_lock_irqsave(&bank->lock, flags);
        /* Set trigger to none. You need to enable the desired trigger with
-         * request_irq() or set_irq_type().
+         * request_irq() or set_irq_type(). Only do this if the IRQ line has
+         * not already been requested.
         */
-        _set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
+        if (!LINE_USED(bank->irq_usage, offset)) {
+                _set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
-        if (bank->regs->pinctrl) {
+                _enable_gpio_module(bank, offset);
-                void __iomem *reg = bank->base + bank->regs->pinctrl;
-                /* Claim the pin for MPU */
-                __raw_writel(__raw_readl(reg) | (1 << offset), reg);
-        }
-        if (bank->regs->ctrl && !bank->mod_usage) {
-                void __iomem *reg = bank->base + bank->regs->ctrl;
-                u32 ctrl;
-                ctrl = __raw_readl(reg);
-                /* Module is enabled, clocks are not gated */
-                ctrl &= ~GPIO_MOD_CTRL_BIT;
-                __raw_writel(ctrl, reg);
-                bank->context.ctrl = ctrl;
        }
        bank->mod_usage |= 1 << offset;
        spin_unlock_irqrestore(&bank->lock, flags);
        return 0;
@@ -640,31 +692,11 @@ static int omap_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
        struct gpio_bank *bank = container_of(chip, struct gpio_bank, chip);
-        void __iomem *base = bank->base;
        unsigned long flags;
        spin_lock_irqsave(&bank->lock, flags);
-        if (bank->regs->wkup_en) {
-                /* Disable wake-up during idle for dynamic tick */
-                _gpio_rmw(base, bank->regs->wkup_en, 1 << offset, 0);
-                bank->context.wake_en =
-                        __raw_readl(bank->base + bank->regs->wkup_en);
-        }
        bank->mod_usage &= ~(1 << offset);
+        _disable_gpio_module(bank, offset);
-        if (bank->regs->ctrl && !bank->mod_usage) {
-                void __iomem *reg = bank->base + bank->regs->ctrl;
-                u32 ctrl;
-                ctrl = __raw_readl(reg);
-                /* Module is disabled, clocks are gated */
-                ctrl |= GPIO_MOD_CTRL_BIT;
-                __raw_writel(ctrl, reg);
-                bank->context.ctrl = ctrl;
-        }
        _reset_gpio(bank, bank->chip.base + offset);
        spin_unlock_irqrestore(&bank->lock, flags);
@@ -672,7 +704,7 @@ static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
         * If this is the last gpio to be freed in the bank,
         * disable the bank module.
         */
-        if (!bank->mod_usage)
+        if (!BANK_USED(bank))
                pm_runtime_put(bank->dev);
 }
@@ -762,10 +794,20 @@ static void gpio_irq_shutdown(struct irq_data *d)
        struct gpio_bank *bank = irq_data_get_irq_chip_data(d);
        unsigned int gpio = irq_to_gpio(bank, d->hwirq);
        unsigned long flags;
+        unsigned offset = GPIO_INDEX(bank, gpio);
        spin_lock_irqsave(&bank->lock, flags);
+        bank->irq_usage &= ~(1 << offset);
+        _disable_gpio_module(bank, offset);
        _reset_gpio(bank, gpio);
        spin_unlock_irqrestore(&bank->lock, flags);
+        /*
+         * If this is the last IRQ to be freed in the bank,
+         * disable the bank module.
+         */
+        if (!BANK_USED(bank))
+                pm_runtime_put(bank->dev);
 }
 static void gpio_ack_irq(struct irq_data *d)
@@ -897,13 +939,6 @@ static int gpio_input(struct gpio_chip *chip, unsigned offset)
        return 0;
 }
-static int gpio_is_input(struct gpio_bank *bank, int mask)
-{
-        void __iomem *reg = bank->base + bank->regs->direction;
-        return __raw_readl(reg) & mask;
-}
 static int gpio_get(struct gpio_chip *chip, unsigned offset)
 {
        struct gpio_bank *bank;
@@ -922,13 +957,22 @@ static int gpio_output(struct gpio_chip *chip, unsigned offset, int value)
 {
        struct gpio_bank *bank;
        unsigned long flags;
+        int retval = 0;
        bank = container_of(chip, struct gpio_bank, chip);
        spin_lock_irqsave(&bank->lock, flags);
+        if (LINE_USED(bank->irq_usage, offset)) {
+                        retval = -EINVAL;
+                        goto exit;
+        }
        bank->set_dataout(bank, offset, value);
        _set_gpio_direction(bank, offset, 0);
+exit:
        spin_unlock_irqrestore(&bank->lock, flags);
-        return 0;
+        return retval;
 }
 static int gpio_debounce(struct gpio_chip *chip, unsigned offset,
@@ -1400,7 +1444,7 @@ void omap2_gpio_prepare_for_idle(int pwr_mode)
        struct gpio_bank *bank;
        list_for_each_entry(bank, &omap_gpio_list, node) {
-                if (!bank->mod_usage || !bank->loses_context)
+                if (!BANK_USED(bank) || !bank->loses_context)
                        continue;
                bank->power_mode = pwr_mode;
@@ -1414,7 +1458,7 @@ void omap2_gpio_resume_after_idle(void)
        struct gpio_bank *bank;
        list_for_each_entry(bank, &omap_gpio_list, node) {
-                if (!bank->mod_usage || !bank->loses_context)
+                if (!BANK_USED(bank) || !bank->loses_context)
                        continue;
                pm_runtime_get_sync(bank->dev);
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index e3745eb07570..6038966ab045 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -293,10 +293,9 @@ static void gpio_rcar_parse_pdata(struct gpio_rcar_priv *p)
        if (pdata) {
                p->config = *pdata;
        } else if (IS_ENABLED(CONFIG_OF) && np) {
-                ret = of_parse_phandle_with_args(np, "gpio-ranges",
+                ret = of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0,
-                                "#gpio-range-cells", 0, &args);
+                                                       &args);
-                p->config.number_of_pins = ret == 0 && args.args_count == 3
+                p->config.number_of_pins = ret == 0 ? args.args[2]
-                                         ? args.args[2]
                                         : RCAR_MAX_GPIO_PER_BANK;
                p->config.gpio_base = -1;
        }
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 86ef3461ec06..0dee0e0c247a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -136,7 +136,7 @@ static struct gpio_desc *gpio_to_desc(unsigned gpio)
 */
 static int desc_to_gpio(const struct gpio_desc *desc)
 {
-        return desc->chip->base + gpio_chip_hwgpio(desc);
+        return desc - &gpio_desc[0];
 }
@@ -1398,7 +1398,7 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
        int                     status = -EPROBE_DEFER;
        unsigned long           flags;
-        if (!desc || !desc->chip) {
+        if (!desc) {
                pr_warn("%s: invalid GPIO\n", __func__);
                return -EINVAL;
        }
@@ -1406,6 +1406,8 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
        spin_lock_irqsave(&gpio_lock, flags);
        chip = desc->chip;
+        if (chip == NULL)
+                goto done;
        if (!try_module_get(chip->owner))
                goto done;
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 1688ff500513..830f7501cb4d 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -2925,6 +2925,8 @@ int drm_edid_to_speaker_allocation(struct edid *edid, u8 **sadb)
                        /* Speaker Allocation Data Block */
                        if (dbl == 3) {
                                *sadb = kmalloc(dbl, GFP_KERNEL);
+                                if (!*sadb)
+                                        return -ENOMEM;
                                memcpy(*sadb, &db[1], dbl);
                                count = dbl;
                                break;
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index f6f6cc7fc133..3d13ca6e257f 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -416,14 +416,6 @@ static void drm_fb_helper_dpms(struct fb_info *info, int dpms_mode)
                return;
        /*
-         * fbdev->blank can be called from irq context in case of a panic.
-         * Since we already have our own special panic handler which will
-         * restore the fbdev console mode completely, just bail out early.
-         */
-        if (oops_in_progress)
-                return;
-        /*
         * For each CRTC in this fb, turn the connectors on/off.
         */
        drm_modeset_lock_all(dev);
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 92babac362ec..2db731f00930 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -204,6 +204,7 @@ static int psb_gtt_attach_pages(struct gtt_range *gt)
        if (IS_ERR(pages))
                return PTR_ERR(pages);
+        gt->npage = gt->gem.size / PAGE_SIZE;
        gt->pages = pages;
        return 0;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index c27a21034a5e..d5c784d48671 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1290,12 +1290,9 @@ static int i915_load_modeset_init(struct drm_device *dev)
         * then we do not take part in VGA arbitration and the
         * vga_client_register() fails with -ENODEV.
         */
-        if (!HAS_PCH_SPLIT(dev)) {
+        ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
-                ret = vga_client_register(dev->pdev, dev, NULL,
+        if (ret && ret != -ENODEV)
-                                          i915_vga_set_decode);
+                goto out;
-                if (ret && ret != -ENODEV)
-                        goto out;
-        }
        intel_register_dsm_handler();
@@ -1351,12 +1348,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
         */
        intel_fbdev_initial_config(dev);
-        /*
-         * Must do this after fbcon init so that
-         * vgacon_save_screen() works during the handover.
-         */
-        i915_disable_vga_mem(dev);
        /* Only enable hotplug handling once the fbdev is fully set up. */
        dev_priv->enable_hotplug_processing = true;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index c159e1a6810f..38f96f65d87a 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3881,6 +3881,9 @@
 #define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG          0x9030
 #define  GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB       (1<<11)
+#define HSW_SCRATCH1                            0xb038
+#define  HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE   (1<<27)
 #define HSW_FUSE_STRAP          0x42014
 #define  HSW_CDCLK_LIMIT        (1 << 24)
@@ -4728,6 +4731,9 @@
 #define GEN7_ROW_CHICKEN2_GT2           0xf4f4
 #define   DOP_CLOCK_GATING_DISABLE      (1<<0)
+#define HSW_ROW_CHICKEN3                0xe49c
+#define  HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE    (1 << 6)
 #define G4X_AUD_VID_DID                 (dev_priv->info->display_mmio_offset + 0x62020)
 #define INTEL_AUDIO_DEVCL               0x808629FB
 #define INTEL_AUDIO_DEVBLC              0x80862801
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e5822e79f912..581fb4b2f766 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3941,8 +3941,6 @@ static void intel_connector_check_state(struct intel_connector *connector)
 * consider. */
 void intel_connector_dpms(struct drm_connector *connector, int mode)
 {
-        struct intel_encoder *encoder = intel_attached_encoder(connector);
        /* All the simple cases only support two dpms states. */
        if (mode != DRM_MODE_DPMS_ON)
                mode = DRM_MODE_DPMS_OFF;
@@ -3953,10 +3951,8 @@ void intel_connector_dpms(struct drm_connector *connector, int mode)
        connector->dpms = mode;
        /* Only need to change hw state when actually enabled */
-        if (encoder->base.crtc)
+        if (connector->encoder)
-                intel_encoder_dpms(encoder, mode);
+                intel_encoder_dpms(to_intel_encoder(connector->encoder), mode);
-        else
-                WARN_ON(encoder->connectors_active != false);
        intel_modeset_check_state(connector->dev);
 }
@@ -10049,33 +10045,6 @@ static void i915_disable_vga(struct drm_device *dev)
        POSTING_READ(vga_reg);
 }
-static void i915_enable_vga_mem(struct drm_device *dev)
-{
-        /* Enable VGA memory on Intel HD */
-        if (HAS_PCH_SPLIT(dev)) {
-                vga_get_uninterruptible(dev->pdev, VGA_RSRC_LEGACY_IO);
-                outb(inb(VGA_MSR_READ) | VGA_MSR_MEM_EN, VGA_MSR_WRITE);
-                vga_set_legacy_decoding(dev->pdev, VGA_RSRC_LEGACY_IO |
-                                                   VGA_RSRC_LEGACY_MEM |
-                                                   VGA_RSRC_NORMAL_IO |
-                                                   VGA_RSRC_NORMAL_MEM);
-                vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
-        }
-}
-void i915_disable_vga_mem(struct drm_device *dev)
-{
-        /* Disable VGA memory on Intel HD */
-        if (HAS_PCH_SPLIT(dev)) {
-                vga_get_uninterruptible(dev->pdev, VGA_RSRC_LEGACY_IO);
-                outb(inb(VGA_MSR_READ) & ~VGA_MSR_MEM_EN, VGA_MSR_WRITE);
-                vga_set_legacy_decoding(dev->pdev, VGA_RSRC_LEGACY_IO |
-                                                   VGA_RSRC_NORMAL_IO |
-                                                   VGA_RSRC_NORMAL_MEM);
-                vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
-        }
-}
 void intel_modeset_init_hw(struct drm_device *dev)
 {
        intel_init_power_well(dev);
@@ -10354,7 +10323,6 @@ void i915_redisable_vga(struct drm_device *dev)
        if (I915_READ(vga_reg) != VGA_DISP_DISABLE) {
                DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n");
                i915_disable_vga(dev);
-                i915_disable_vga_mem(dev);
        }
 }
@@ -10568,8 +10536,6 @@ void intel_modeset_cleanup(struct drm_device *dev)
        intel_disable_fbc(dev);
-        i915_enable_vga_mem(dev);
        intel_disable_gt_powersave(dev);
        ironlake_teardown_rc6(dev);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 79c14e298ba6..2c555f91bfae 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1467,7 +1467,7 @@ static void intel_edp_psr_setup(struct intel_dp *intel_dp)
        /* Avoid continuous PSR exit by masking memup and hpd */
        I915_WRITE(EDP_PSR_DEBUG_CTL, EDP_PSR_DEBUG_MASK_MEMUP |
-                   EDP_PSR_DEBUG_MASK_HPD);
+                   EDP_PSR_DEBUG_MASK_HPD | EDP_PSR_DEBUG_MASK_LPSP);
        intel_dp->psr_setup_done = true;
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 28cae80495e2..9b7b68fd5d47 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -793,6 +793,5 @@ extern void hsw_pc8_disable_interrupts(struct drm_device *dev);
 extern void hsw_pc8_restore_interrupts(struct drm_device *dev);
 extern void intel_aux_display_runtime_get(struct drm_i915_private *dev_priv);
 extern void intel_aux_display_runtime_put(struct drm_i915_private *dev_priv);
-extern void i915_disable_vga_mem(struct drm_device *dev);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index dd176b7296c1..f4c5e95b2d6f 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3864,8 +3864,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
                                      dev_priv->rps.rpe_delay),
                         dev_priv->rps.rpe_delay);
-        INIT_DELAYED_WORK(&dev_priv->rps.vlv_work, vlv_rps_timer_work);
        valleyview_set_rps(dev_priv->dev, dev_priv->rps.rpe_delay);
        gen6_enable_rps_interrupts(dev);
@@ -4955,6 +4953,11 @@ static void haswell_init_clock_gating(struct drm_device *dev)
        I915_WRITE(GEN7_L3_CHICKEN_MODE_REGISTER,
                        GEN7_WA_L3_CHICKEN_MODE);
+        /* L3 caching of data atomics doesn't work -- disable it. */
+        I915_WRITE(HSW_SCRATCH1, HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE);
+        I915_WRITE(HSW_ROW_CHICKEN3,
+                   _MASKED_BIT_ENABLE(HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE));
        /* This is required by WaCatErrorRejectionIssue:hsw */
        I915_WRITE(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG,
                        I915_READ(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG) |
@@ -5681,5 +5684,7 @@ void intel_pm_init(struct drm_device *dev)
        INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                          intel_gen6_powersave_work);
+        INIT_DELAYED_WORK(&dev_priv->rps.vlv_work, vlv_rps_timer_work);
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
index 37712a6df923..e290cfa4acee 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
@@ -113,7 +113,7 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
                pmc->use_msi = false;
                break;
        default:
-                pmc->use_msi = nouveau_boolopt(device->cfgopt, "NvMSI", true);
+                pmc->use_msi = nouveau_boolopt(device->cfgopt, "NvMSI", false);
                if (pmc->use_msi) {
                        pmc->use_msi = pci_enable_msi(device->pdev) == 0;
                        if (pmc->use_msi) {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index b162e98a2953..9b6950d9b3c0 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -1930,7 +1930,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                        }
                        j++;
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        tmp = RREG32(MC_PMG_CMD_MRS);
@@ -1945,7 +1945,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                        }
                        j++;
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        break;
                case MC_SEQ_RESERVE_M >> 2:
@@ -1959,7 +1959,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                        }
                        j++;
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        break;
                default:
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index d02fd1c045d5..b874ccdf52f7 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -77,6 +77,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev);
 static void cik_program_aspm(struct radeon_device *rdev);
 static void cik_init_pg(struct radeon_device *rdev);
 static void cik_init_cg(struct radeon_device *rdev);
+static void cik_fini_pg(struct radeon_device *rdev);
+static void cik_fini_cg(struct radeon_device *rdev);
 static void cik_enable_gui_idle_interrupt(struct radeon_device *rdev,
                                          bool enable);
@@ -4185,6 +4187,10 @@ static void cik_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
        dev_info(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                 RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS));
+        /* disable CG/PG */
+        cik_fini_pg(rdev);
+        cik_fini_cg(rdev);
        /* stop the rlc */
        cik_rlc_stop(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 555164e270a7..b5c67a99dda9 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3131,7 +3131,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                rdev->config.evergreen.sx_max_export_size = 256;
                rdev->config.evergreen.sx_max_export_pos_size = 64;
                rdev->config.evergreen.sx_max_export_smx_size = 192;
-                rdev->config.evergreen.max_hw_contexts = 8;
+                rdev->config.evergreen.max_hw_contexts = 4;
                rdev->config.evergreen.sq_num_cf_insts = 2;
                rdev->config.evergreen.sc_prim_fifo_size = 0x40;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index f71ce390aebe..f815c20640bd 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -288,8 +288,7 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
        /* fglrx clears sth in AFMT_AUDIO_PACKET_CONTROL2 here */
        WREG32(HDMI_ACR_PACKET_CONTROL + offset,
-               HDMI_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
+               HDMI_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
-               HDMI_ACR_SOURCE); /* select SW CTS value */
        evergreen_hdmi_update_ACR(encoder, mode->clock);
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 8768fd6a1e27..4f6d2962767d 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -1501,7 +1501,7 @@
 * 6. COMMAND [29:22] | BYTE_COUNT [20:0]
 */
 #              define PACKET3_CP_DMA_DST_SEL(x)    ((x) << 20)
-                /* 0 - SRC_ADDR
+                /* 0 - DST_ADDR
                 * 1 - GDS
                 */
 #              define PACKET3_CP_DMA_ENGINE(x)     ((x) << 27)
@@ -1516,7 +1516,7 @@
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
 #              define PACKET3_CP_DMA_DIS_WC        (1 << 21)
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                /* 0 - none
                 * 1 - 8 in 16
                 * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index b0fa6002af3e..5b729319f27b 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -57,15 +57,15 @@ enum r600_hdmi_iec_status_bits {
 static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
    /*       32kHz        44.1kHz       48kHz    */
    /* Clock      N     CTS      N     CTS      N     CTS */
-    {  25174,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
+    {  25175,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
    {  25200,  4096,  25200,  6272,  28000,  6144,  25200 }, /*  25.20       MHz */
    {  27000,  4096,  27000,  6272,  30000,  6144,  27000 }, /*  27.00       MHz */
    {  27027,  4096,  27027,  6272,  30030,  6144,  27027 }, /*  27.00*1.001 MHz */
    {  54000,  4096,  54000,  6272,  60000,  6144,  54000 }, /*  54.00       MHz */
    {  54054,  4096,  54054,  6272,  60060,  6144,  54054 }, /*  54.00*1.001 MHz */
-    {  74175, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
+    {  74176, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
    {  74250,  4096,  74250,  6272,  82500,  6144,  74250 }, /*  74.25       MHz */
-    { 148351, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
+    { 148352, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
    { 148500,  4096, 148500,  6272, 165000,  6144, 148500 }, /* 148.50       MHz */
    {      0,  4096,      0,  6272,      0,  6144,      0 }  /* Other */
 };
@@ -75,8 +75,15 @@ static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
 */
 static void r600_hdmi_calc_cts(uint32_t clock, int *CTS, int N, int freq)
 {
-        if (*CTS == 0)
+        u64 n;
-                *CTS = clock * N / (128 * freq) * 1000;
+        u32 d;
+        if (*CTS == 0) {
+                n = (u64)clock * (u64)N * 1000ULL;
+                d = 128 * freq;
+                do_div(n, d);
+                *CTS = n;
+        }
        DRM_DEBUG("Using ACR timing N=%d CTS=%d for frequency %d\n",
                  N, *CTS, freq);
 }
@@ -444,8 +451,8 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
        }
        WREG32(HDMI0_ACR_PACKET_CONTROL + offset,
-               HDMI0_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
+               HDMI0_ACR_SOURCE | /* select SW CTS value - XXX verify that hw CTS works on all families */
-               HDMI0_ACR_SOURCE); /* select SW CTS value */
+               HDMI0_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
        WREG32(HDMI0_VBI_PACKET_CONTROL + offset,
               HDMI0_NULL_SEND | /* send null packets when required */
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index e673fe26ea84..7b3c7b5932c5 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -1523,7 +1523,7 @@
 */
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                /* 0 - none
                 * 1 - 8 in 16
                 * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index ac07ad1d4f8c..4f6b7fc7ad3c 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -945,6 +945,8 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                if (enable) {
                        mutex_lock(&rdev->pm.mutex);
                        rdev->pm.dpm.uvd_active = true;
+                        /* disable this for now */
+#if 0
                        if ((rdev->pm.dpm.sd == 1) && (rdev->pm.dpm.hd == 0))
                                dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_SD;
                        else if ((rdev->pm.dpm.sd == 2) && (rdev->pm.dpm.hd == 0))
@@ -954,6 +956,7 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                        else if ((rdev->pm.dpm.sd == 0) && (rdev->pm.dpm.hd == 2))
                                dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_HD2;
                        else
+#endif
                                dpm_state = POWER_STATE_TYPE_INTERNAL_UVD;
                        rdev->pm.dpm.state = dpm_state;
                        mutex_unlock(&rdev->pm.mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index f4d6bcee9006..12e8099a0823 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -36,8 +36,8 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
        struct radeon_bo *vram_obj = NULL;
        struct radeon_bo **gtt_obj = NULL;
        uint64_t gtt_addr, vram_addr;
-        unsigned i, n, size;
+        unsigned n, size;
-        int r, ring;
+        int i, r, ring;
        switch (flag) {
        case RADEON_TEST_COPY_DMA:
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index a0f11856ddde..4f2e73f79638 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -798,7 +798,8 @@ void radeon_uvd_note_usage(struct radeon_device *rdev)
                    (rdev->pm.dpm.hd != hd)) {
                        rdev->pm.dpm.sd = sd;
                        rdev->pm.dpm.hd = hd;
-                        streams_changed = true;
+                        /* disable this for now */
+                        /*streams_changed = true;*/
                }
        }
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index c354c1094967..d4652af425b8 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -85,6 +85,9 @@ extern void si_dma_vm_set_page(struct radeon_device *rdev,
                               uint32_t incr, uint32_t flags);
 static void si_enable_gui_idle_interrupt(struct radeon_device *rdev,
                                         bool enable);
+static void si_fini_pg(struct radeon_device *rdev);
+static void si_fini_cg(struct radeon_device *rdev);
+static void si_rlc_stop(struct radeon_device *rdev);
 static const u32 verde_rlc_save_restore_register_list[] =
 {
@@ -3608,6 +3611,13 @@ static void si_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
        dev_info(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                 RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS));
+        /* disable PG/CG */
+        si_fini_pg(rdev);
+        si_fini_cg(rdev);
+        /* stop the rlc */
+        si_rlc_stop(rdev);
        /* Disable CP parsing/prefetching */
        WREG32(CP_ME_CNTL, CP_ME_HALT | CP_PFP_HALT | CP_CE_HALT);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 9ace28702c76..2332aa1bf93c 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -5208,7 +5208,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                        table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
                        }
                        j++;
-                        if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        if (!pi->mem_gddr5) {
@@ -5218,7 +5218,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                        table->mc_reg_table_entry[k].mc_data[j] =
                                                (table->mc_reg_table_entry[k].mc_data[i] & 0xffff0000) >> 16;
                                j++;
-                                if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                                if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                        return -EINVAL;
                        }
                        break;
@@ -5231,7 +5231,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                        (temp_reg & 0xffff0000) |
                                        (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff);
                        j++;
-                        if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        break;
                default:
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 52d2ab6b67a0..7e2e0ea66a00 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -1553,7 +1553,7 @@
 * 6. COMMAND [30:21] | BYTE_COUNT [20:0]
 */
 #              define PACKET3_CP_DMA_DST_SEL(x)    ((x) << 20)
-                /* 0 - SRC_ADDR
+                /* 0 - DST_ADDR
                 * 1 - GDS
                 */
 #              define PACKET3_CP_DMA_ENGINE(x)     ((x) << 27)
@@ -1568,7 +1568,7 @@
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
 #              define PACKET3_CP_DMA_DIS_WC        (1 << 21)
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                /* 0 - none
                 * 1 - 8 in 16
                 * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 7f998bf1cc9d..9364129ba292 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1868,7 +1868,7 @@ int trinity_dpm_init(struct radeon_device *rdev)
        for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
                pi->at[i] = TRINITY_AT_DFLT;
-        pi->enable_bapm = true;
+        pi->enable_bapm = false;
        pi->enable_nbps_policy = true;
        pi->enable_sclk_ds = true;
        pi->enable_gfx_power_gating = true;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 71b70e3a7a71..c91d547191dd 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -241,6 +241,7 @@ config HID_HOLTEK
          - Sharkoon Drakonia / Perixx MX-2000 gaming mice
          - Tracer Sniper TRM-503 / NOVA Gaming Slider X200 /
            Zalman ZM-GM1
+          - SHARKOON DarkGlider Gaming mouse
 config HOLTEK_FF
        bool "Holtek On Line Grip force feedback support"
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index b8470b1a10fe..5a8c01112a23 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1715,6 +1715,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_580) },
        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
index 7e6db3cf46f9..e696566cde46 100644
--- a/drivers/hid/hid-holtek-mouse.c
+++ b/drivers/hid/hid-holtek-mouse.c
@@ -27,6 +27,7 @@
 * - USB ID 04d9:a067, sold as Sharkoon Drakonia and Perixx MX-2000
 * - USB ID 04d9:a04a, sold as Tracer Sniper TRM-503, NOVA Gaming Slider X200
 *   and Zalman ZM-GM1
+ * - USB ID 04d9:a081, sold as SHARKOON DarkGlider Gaming mouse
 */
 static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -46,6 +47,7 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                        }
                        break;
                case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A:
+                case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081:
                        if (*rsize >= 113 && rdesc[106] == 0xff && rdesc[107] == 0x7f
                                        && rdesc[111] == 0xff && rdesc[112] == 0x7f) {
                                hid_info(hdev, "Fixing up report descriptor\n");
@@ -63,6 +65,8 @@ static const struct hid_device_id holtek_mouse_devices[] = {
                        USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
                        USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
+                        USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, holtek_mouse_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index e60e8d530697..9cbc7ab07dfa 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -450,6 +450,7 @@
 #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD       0xa055
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067     0xa067
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A     0xa04a
+#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081     0xa081
 #define USB_VENDOR_ID_IMATION           0x0718
 #define USB_DEVICE_ID_DISC_STAKKA       0xd000
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 602c188e9d86..6101816a7ddd 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -382,7 +382,7 @@ static ssize_t kone_sysfs_write_profilex(struct file *fp,
 }
 #define PROFILE_ATTR(number)                                    \
 static struct bin_attribute bin_attr_profile##number = {        \
-        .attr = { .name = "profile##number", .mode = 0660 },    \
+        .attr = { .name = "profile" #number, .mode = 0660 },    \
        .size = sizeof(struct kone_profile),                    \
        .read = kone_sysfs_read_profilex,                       \
        .write = kone_sysfs_write_profilex,                     \
diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 5ddf605b6b89..5e99fcdc71b9 100644
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -229,13 +229,13 @@ static ssize_t koneplus_sysfs_read_profilex_buttons(struct file *fp,
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
        .size = KONEPLUS_SIZE_PROFILE_SETTINGS,                         \
        .read = koneplus_sysfs_read_profilex_settings,                  \
        .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
        .size = KONEPLUS_SIZE_PROFILE_BUTTONS,                          \
        .read = koneplus_sysfs_read_profilex_buttons,                   \
        .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
index 515bc03136c0..0c8e1ef0b67d 100644
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -257,13 +257,13 @@ static ssize_t kovaplus_sysfs_read_profilex_buttons(struct file *fp,
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
        .size = KOVAPLUS_SIZE_PROFILE_SETTINGS,                         \
        .read = kovaplus_sysfs_read_profilex_settings,                  \
        .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
        .size = KOVAPLUS_SIZE_PROFILE_BUTTONS,                          \
        .read = kovaplus_sysfs_read_profilex_buttons,                   \
        .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index 5a6dbbeee790..1a07e07d99a0 100644
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -225,13 +225,13 @@ static ssize_t pyra_sysfs_read_profilex_buttons(struct file *fp,
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
        .size = PYRA_SIZE_PROFILE_SETTINGS,                             \
        .read = pyra_sysfs_read_profilex_settings,                      \
        .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
        .size = PYRA_SIZE_PROFILE_BUTTONS,                              \
        .read = pyra_sysfs_read_profilex_buttons,                       \
        .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-wiimote-modules.c b/drivers/hid/hid-wiimote-modules.c
index 2e7d644dba18..71adf9e60b13 100644
--- a/drivers/hid/hid-wiimote-modules.c
+++ b/drivers/hid/hid-wiimote-modules.c
@@ -119,12 +119,22 @@ static const struct wiimod_ops wiimod_keys = {
 * the rumble motor, this flag shouldn't be set.
 */
+/* used by wiimod_rumble and wiipro_rumble */
+static void wiimod_rumble_worker(struct work_struct *work)
+{
+        struct wiimote_data *wdata = container_of(work, struct wiimote_data,
+                                                  rumble_worker);
+        spin_lock_irq(&wdata->state.lock);
+        wiiproto_req_rumble(wdata, wdata->state.cache_rumble);
+        spin_unlock_irq(&wdata->state.lock);
+}
 static int wiimod_rumble_play(struct input_dev *dev, void *data,
                              struct ff_effect *eff)
 {
        struct wiimote_data *wdata = input_get_drvdata(dev);
        __u8 value;
-        unsigned long flags;
        /*
         * The wiimote supports only a single rumble motor so if any magnitude
@@ -137,9 +147,10 @@ static int wiimod_rumble_play(struct input_dev *dev, void *data,
        else
                value = 0;
-        spin_lock_irqsave(&wdata->state.lock, flags);
+        /* Locking state.lock here might deadlock with input_event() calls.
-        wiiproto_req_rumble(wdata, value);
+         * schedule_work acts as barrier. Merging multiple changes is fine. */
-        spin_unlock_irqrestore(&wdata->state.lock, flags);
+        wdata->state.cache_rumble = value;
+        schedule_work(&wdata->rumble_worker);
        return 0;
 }
@@ -147,6 +158,8 @@ static int wiimod_rumble_play(struct input_dev *dev, void *data,
 static int wiimod_rumble_probe(const struct wiimod_ops *ops,
                               struct wiimote_data *wdata)
 {
+        INIT_WORK(&wdata->rumble_worker, wiimod_rumble_worker);
        set_bit(FF_RUMBLE, wdata->input->ffbit);
        if (input_ff_create_memless(wdata->input, NULL, wiimod_rumble_play))
                return -ENOMEM;
@@ -159,6 +172,8 @@ static void wiimod_rumble_remove(const struct wiimod_ops *ops,
 {
        unsigned long flags;
+        cancel_work_sync(&wdata->rumble_worker);
        spin_lock_irqsave(&wdata->state.lock, flags);
        wiiproto_req_rumble(wdata, 0);
        spin_unlock_irqrestore(&wdata->state.lock, flags);
@@ -1731,7 +1746,6 @@ static int wiimod_pro_play(struct input_dev *dev, void *data,
 {
        struct wiimote_data *wdata = input_get_drvdata(dev);
        __u8 value;
-        unsigned long flags;
        /*
         * The wiimote supports only a single rumble motor so if any magnitude
@@ -1744,9 +1758,10 @@ static int wiimod_pro_play(struct input_dev *dev, void *data,
        else
                value = 0;
-        spin_lock_irqsave(&wdata->state.lock, flags);
+        /* Locking state.lock here might deadlock with input_event() calls.
-        wiiproto_req_rumble(wdata, value);
+         * schedule_work acts as barrier. Merging multiple changes is fine. */
-        spin_unlock_irqrestore(&wdata->state.lock, flags);
+        wdata->state.cache_rumble = value;
+        schedule_work(&wdata->rumble_worker);
        return 0;
 }
@@ -1756,6 +1771,8 @@ static int wiimod_pro_probe(const struct wiimod_ops *ops,
 {
        int ret, i;
+        INIT_WORK(&wdata->rumble_worker, wiimod_rumble_worker);
        wdata->extension.input = input_allocate_device();
        if (!wdata->extension.input)
                return -ENOMEM;
@@ -1817,12 +1834,13 @@ static void wiimod_pro_remove(const struct wiimod_ops *ops,
        if (!wdata->extension.input)
                return;
+        input_unregister_device(wdata->extension.input);
+        wdata->extension.input = NULL;
+        cancel_work_sync(&wdata->rumble_worker);
        spin_lock_irqsave(&wdata->state.lock, flags);
        wiiproto_req_rumble(wdata, 0);
        spin_unlock_irqrestore(&wdata->state.lock, flags);
-        input_unregister_device(wdata->extension.input);
-        wdata->extension.input = NULL;
 }
 static const struct wiimod_ops wiimod_pro = {
diff --git a/drivers/hid/hid-wiimote.h b/drivers/hid/hid-wiimote.h
index f1474f372c0b..75db0c400037 100644
--- a/drivers/hid/hid-wiimote.h
+++ b/drivers/hid/hid-wiimote.h
@@ -133,13 +133,15 @@ struct wiimote_state {
        __u8 *cmd_read_buf;
        __u8 cmd_read_size;
-        /* calibration data */
+        /* calibration/cache data */
        __u16 calib_bboard[4][3];
+        __u8 cache_rumble;
 };
 struct wiimote_data {
        struct hid_device *hdev;
        struct input_dev *input;
+        struct work_struct rumble_worker;
        struct led_classdev *leds[4];
        struct input_dev *accel;
        struct input_dev *ir;
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 8918dd12bb69..6a6dd5cd7833 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -308,18 +308,25 @@ static int hidraw_fasync(int fd, struct file *file, int on)
 static void drop_ref(struct hidraw *hidraw, int exists_bit)
 {
        if (exists_bit) {
-                hid_hw_close(hidraw->hid);
                hidraw->exist = 0;
-                if (hidraw->open)
+                if (hidraw->open) {
+                        hid_hw_close(hidraw->hid);
                        wake_up_interruptible(&hidraw->wait);
+                }
        } else {
                --hidraw->open;
        }
+        if (!hidraw->open) {
-        if (!hidraw->open && !hidraw->exist) {
+                if (!hidraw->exist) {
-                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+                        device_destroy(hidraw_class,
-                hidraw_table[hidraw->minor] = NULL;
+                                        MKDEV(hidraw_major, hidraw->minor));
-                kfree(hidraw);
+                        hidraw_table[hidraw->minor] = NULL;
+                        kfree(hidraw);
+                } else {
+                        /* close device for last reader */
+                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
+                        hid_hw_close(hidraw->hid);
+                }
        }
 }
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 5bf2fb785844..93b00d76374c 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -615,7 +615,7 @@ static const struct file_operations uhid_fops = {
 static struct miscdevice uhid_misc = {
        .fops           = &uhid_fops,
-        .minor          = MISC_DYNAMIC_MINOR,
+        .minor          = UHID_MINOR,
        .name           = UHID_NAME,
 };
@@ -634,4 +634,5 @@ module_exit(uhid_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
+MODULE_ALIAS_MISCDEV(UHID_MINOR);
 MODULE_ALIAS("devname:" UHID_NAME);
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 98814d12a604..3288f13d2d87 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -230,6 +230,7 @@ static int send_argument(const char *key)
 static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
 {
+        u8 status, data = 0;
        int i;
        if (send_command(cmd) || send_argument(key)) {
@@ -237,6 +238,7 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
                return -EIO;
        }
+        /* This has no effect on newer (2012) SMCs */
        if (send_byte(len, APPLESMC_DATA_PORT)) {
                pr_warn("%.4s: read len fail\n", key);
                return -EIO;
@@ -250,6 +252,17 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
                buffer[i] = inb(APPLESMC_DATA_PORT);
        }
+        /* Read the data port until bit0 is cleared */
+        for (i = 0; i < 16; i++) {
+                udelay(APPLESMC_MIN_WAIT);
+                status = inb(APPLESMC_CMD_PORT);
+                if (!(status & 0x01))
+                        break;
+                data = inb(APPLESMC_DATA_PORT);
+        }
+        if (i)
+                pr_warn("flushed %d bytes, last value is: %d\n", i, data);
        return 0;
 }
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 4c1b60539a25..0aa01136f8d9 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -270,7 +270,8 @@ static SIMPLE_DEV_PM_OPS(dw_i2c_dev_pm_ops, dw_i2c_suspend, dw_i2c_resume);
 MODULE_ALIAS("platform:i2c_designware");
 static struct platform_driver dw_i2c_driver = {
-        .remove         = dw_i2c_remove,
+        .probe = dw_i2c_probe,
+        .remove = dw_i2c_remove,
        .driver         = {
                .name   = "i2c_designware",
                .owner  = THIS_MODULE,
@@ -282,7 +283,7 @@ static struct platform_driver dw_i2c_driver = {
 static int __init dw_i2c_init_driver(void)
 {
-        return platform_driver_probe(&dw_i2c_driver, dw_i2c_probe);
+        return platform_driver_register(&dw_i2c_driver);
 }
 subsys_initcall(dw_i2c_init_driver);
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index ccf46656bdad..1d7efa3169cd 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -365,7 +365,7 @@ static void i2c_imx_stop(struct imx_i2c_struct *i2c_imx)
        clk_disable_unprepare(i2c_imx->clk);
 }
-static void __init i2c_imx_set_clk(struct imx_i2c_struct *i2c_imx,
+static void i2c_imx_set_clk(struct imx_i2c_struct *i2c_imx,
                                                        unsigned int rate)
 {
        struct imx_i2c_clk_pair *i2c_clk_div = i2c_imx->hwdata->clk_div;
@@ -589,7 +589,7 @@ static struct i2c_algorithm i2c_imx_algo = {
        .functionality  = i2c_imx_func,
 };
-static int __init i2c_imx_probe(struct platform_device *pdev)
+static int i2c_imx_probe(struct platform_device *pdev)
 {
        const struct of_device_id *of_id = of_match_device(i2c_imx_dt_ids,
                                                           &pdev->dev);
@@ -697,7 +697,7 @@ static int __init i2c_imx_probe(struct platform_device *pdev)
        return 0;   /* Return OK */
 }
-static int __exit i2c_imx_remove(struct platform_device *pdev)
+static int i2c_imx_remove(struct platform_device *pdev)
 {
        struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev);
@@ -715,7 +715,8 @@ static int __exit i2c_imx_remove(struct platform_device *pdev)
 }
 static struct platform_driver i2c_imx_driver = {
-        .remove         = __exit_p(i2c_imx_remove),
+        .probe = i2c_imx_probe,
+        .remove = i2c_imx_remove,
        .driver = {
                .name   = DRIVER_NAME,
                .owner  = THIS_MODULE,
@@ -726,7 +727,7 @@ static struct platform_driver i2c_imx_driver = {
 static int __init i2c_adap_imx_init(void)
 {
-        return platform_driver_probe(&i2c_imx_driver, i2c_imx_probe);
+        return platform_driver_register(&i2c_imx_driver);
 }
 subsys_initcall(i2c_adap_imx_init);
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index f4a01675fa71..b7c857774708 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -780,12 +780,13 @@ static struct platform_driver mxs_i2c_driver = {
                   .owner = THIS_MODULE,
                   .of_match_table = mxs_i2c_dt_ids,
                   },
+        .probe = mxs_i2c_probe,
        .remove = mxs_i2c_remove,
 };
 static int __init mxs_i2c_init(void)
 {
-        return platform_driver_probe(&mxs_i2c_driver, mxs_i2c_probe);
+        return platform_driver_register(&mxs_i2c_driver);
 }
 subsys_initcall(mxs_i2c_init);
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 6d8308d5dc4e..9967a6f9c2ff 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -939,6 +939,9 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                /*
                 * ProDB0017052: Clear ARDY bit twice
                 */
+                if (stat & OMAP_I2C_STAT_ARDY)
+                        omap_i2c_ack_stat(dev, OMAP_I2C_STAT_ARDY);
                if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
                                        OMAP_I2C_STAT_AL)) {
                        omap_i2c_ack_stat(dev, (OMAP_I2C_STAT_RRDY |
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index f8f6f2e552db..04a17b9b38bb 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -859,8 +859,7 @@ static const struct i2c_algorithm stu300_algo = {
        .functionality  = stu300_func,
 };
-static int __init
+static int stu300_probe(struct platform_device *pdev)
-stu300_probe(struct platform_device *pdev)
 {
        struct stu300_dev *dev;
        struct i2c_adapter *adap;
@@ -966,8 +965,7 @@ static SIMPLE_DEV_PM_OPS(stu300_pm, stu300_suspend, stu300_resume);
 #define STU300_I2C_PM   NULL
 #endif
-static int __exit
+static int stu300_remove(struct platform_device *pdev)
-stu300_remove(struct platform_device *pdev)
 {
        struct stu300_dev *dev = platform_get_drvdata(pdev);
@@ -989,13 +987,14 @@ static struct platform_driver stu300_i2c_driver = {
                .pm     = STU300_I2C_PM,
                .of_match_table = stu300_dt_match,
        },
-        .remove         = __exit_p(stu300_remove),
+        .probe = stu300_probe,
+        .remove = stu300_remove,
 };
 static int __init stu300_init(void)
 {
-        return platform_driver_probe(&stu300_i2c_driver, stu300_probe);
+        return platform_driver_register(&stu300_i2c_driver);
 }
 static void __exit stu300_exit(void)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 29d3f045a2bf..3be58f89ac77 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1134,6 +1134,9 @@ static void acpi_i2c_register_devices(struct i2c_adapter *adap)
        acpi_handle handle;
        acpi_status status;
+        if (!adap->dev.parent)
+                return;
        handle = ACPI_HANDLE(adap->dev.parent);
        if (!handle)
                return;
diff --git a/drivers/i2c/muxes/i2c-arb-gpio-challenge.c b/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
index 74b41ae690f3..928656e241dd 100644
--- a/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
+++ b/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
@@ -200,7 +200,7 @@ static int i2c_arbitrator_probe(struct platform_device *pdev)
        arb->parent = of_find_i2c_adapter_by_node(parent_np);
        if (!arb->parent) {
                dev_err(dev, "Cannot find parent bus\n");
-                return -EINVAL;
+                return -EPROBE_DEFER;
        }
        /* Actually add the mux adapter */
diff --git a/drivers/i2c/muxes/i2c-mux-gpio.c b/drivers/i2c/muxes/i2c-mux-gpio.c
index 5d4a99ba743e..a764da777f08 100644
--- a/drivers/i2c/muxes/i2c-mux-gpio.c
+++ b/drivers/i2c/muxes/i2c-mux-gpio.c
@@ -66,7 +66,7 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
        struct device_node *adapter_np, *child;
        struct i2c_adapter *adapter;
        unsigned *values, *gpios;
-        int i = 0;
+        int i = 0, ret;
        if (!np)
                return -ENODEV;
@@ -79,7 +79,7 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
        adapter = of_find_i2c_adapter_by_node(adapter_np);
        if (!adapter) {
                dev_err(&pdev->dev, "Cannot find parent bus\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        mux->data.parent = i2c_adapter_id(adapter);
        put_device(&adapter->dev);
@@ -116,8 +116,12 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
                return -ENOMEM;
        }
-        for (i = 0; i < mux->data.n_gpios; i++)
+        for (i = 0; i < mux->data.n_gpios; i++) {
-                gpios[i] = of_get_named_gpio(np, "mux-gpios", i);
+                ret = of_get_named_gpio(np, "mux-gpios", i);
+                if (ret < 0)
+                        return ret;
+                gpios[i] = ret;
+        }
        mux->data.gpios = gpios;
@@ -177,7 +181,7 @@ static int i2c_mux_gpio_probe(struct platform_device *pdev)
        if (!parent) {
                dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
                        mux->data.parent);
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        mux->parent = parent;
diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
index 69a91732ae65..68a37157377d 100644
--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -113,7 +113,7 @@ static int i2c_mux_pinctrl_parse_dt(struct i2c_mux_pinctrl *mux,
        adapter = of_find_i2c_adapter_by_node(adapter_np);
        if (!adapter) {
                dev_err(mux->dev, "Cannot find parent bus\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        mux->pdata->parent_bus_num = i2c_adapter_id(adapter);
        put_device(&adapter->dev);
@@ -211,7 +211,7 @@ static int i2c_mux_pinctrl_probe(struct platform_device *pdev)
        if (!mux->parent) {
                dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
                        mux->pdata->parent_bus_num);
-                ret = -ENODEV;
+                ret = -EPROBE_DEFER;
                goto err;
        }
diff --git a/drivers/iio/amplifiers/ad8366.c b/drivers/iio/amplifiers/ad8366.c
index d0a79a4bce1c..ba6f6a91dfff 100644
--- a/drivers/iio/amplifiers/ad8366.c
+++ b/drivers/iio/amplifiers/ad8366.c
@@ -185,10 +185,8 @@ static int ad8366_remove(struct spi_device *spi)
        iio_device_unregister(indio_dev);
-        if (!IS_ERR(reg)) {
+        if (!IS_ERR(reg))
                regulator_disable(reg);
-                regulator_put(reg);
-        }
        return 0;
 }
diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c
index a7b30be86ae0..52605c0ea3a6 100644
--- a/drivers/iio/frequency/adf4350.c
+++ b/drivers/iio/frequency/adf4350.c
@@ -525,8 +525,10 @@ static int adf4350_probe(struct spi_device *spi)
        }
        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
-        if (indio_dev == NULL)
+        if (indio_dev == NULL) {
-                return -ENOMEM;
+                ret =  -ENOMEM;
+                goto error_disable_clk;
+        }
        st = iio_priv(indio_dev);
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 2710f7245c3b..2db7dcd826b9 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -477,6 +477,9 @@ void iio_disable_all_buffers(struct iio_dev *indio_dev)
        indio_dev->currentmode = INDIO_DIRECT_MODE;
        if (indio_dev->setup_ops->postdisable)
                indio_dev->setup_ops->postdisable(indio_dev);
+        if (indio_dev->available_scan_masks == NULL)
+                kfree(indio_dev->active_scan_mask);
 }
 int iio_update_buffers(struct iio_dev *indio_dev,
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 8e84cd522e49..f95c6979efd8 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -852,7 +852,6 @@ static void iio_dev_release(struct device *device)
                iio_device_unregister_trigger_consumer(indio_dev);
        iio_device_unregister_eventset(indio_dev);
        iio_device_unregister_sysfs(indio_dev);
-        iio_device_unregister_debugfs(indio_dev);
        ida_simple_remove(&iio_ida, indio_dev->id);
        kfree(indio_dev);
@@ -1087,6 +1086,7 @@ void iio_device_unregister(struct iio_dev *indio_dev)
        if (indio_dev->chrdev.dev)
                cdev_del(&indio_dev->chrdev);
+        iio_device_unregister_debugfs(indio_dev);
        iio_disable_all_buffers(indio_dev);
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index e8d2849cc81d..cab3bc7494a2 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -29,9 +29,9 @@
 #define ST_MAGN_NUMBER_DATA_CHANNELS            3
 /* DEFAULT VALUE FOR SENSORS */
-#define ST_MAGN_DEFAULT_OUT_X_L_ADDR            0X04
+#define ST_MAGN_DEFAULT_OUT_X_H_ADDR            0X03
-#define ST_MAGN_DEFAULT_OUT_Y_L_ADDR            0X08
+#define ST_MAGN_DEFAULT_OUT_Y_H_ADDR            0X07
-#define ST_MAGN_DEFAULT_OUT_Z_L_ADDR            0X06
+#define ST_MAGN_DEFAULT_OUT_Z_H_ADDR            0X05
 /* FULLSCALE */
 #define ST_MAGN_FS_AVL_1300MG                   1300
@@ -117,16 +117,16 @@
 static const struct iio_chan_spec st_magn_16bit_channels[] = {
        ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                        BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_X, 1, IIO_MOD_X, 's', IIO_LE, 16, 16,
+                        ST_SENSORS_SCAN_X, 1, IIO_MOD_X, 's', IIO_BE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_X_L_ADDR),
+                        ST_MAGN_DEFAULT_OUT_X_H_ADDR),
        ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                        BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_Y, 1, IIO_MOD_Y, 's', IIO_LE, 16, 16,
+                        ST_SENSORS_SCAN_Y, 1, IIO_MOD_Y, 's', IIO_BE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_Y_L_ADDR),
+                        ST_MAGN_DEFAULT_OUT_Y_H_ADDR),
        ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                        BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_Z, 1, IIO_MOD_Z, 's', IIO_LE, 16, 16,
+                        ST_SENSORS_SCAN_Z, 1, IIO_MOD_Z, 's', IIO_BE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_Z_L_ADDR),
+                        ST_MAGN_DEFAULT_OUT_Z_H_ADDR),
        IIO_CHAN_SOFT_TIMESTAMP(3)
 };
diff --git a/drivers/infiniband/hw/amso1100/c2_ae.c b/drivers/infiniband/hw/amso1100/c2_ae.c
index d5d1929753e4..cedda25232be 100644
--- a/drivers/infiniband/hw/amso1100/c2_ae.c
+++ b/drivers/infiniband/hw/amso1100/c2_ae.c
@@ -141,7 +141,7 @@ static const char *to_qp_state_str(int state)
                return "C2_QP_STATE_ERROR";
        default:
                return "<invalid QP state>";
-        };
+        }
 }
 void c2_ae_event(struct c2_dev *c2dev, u32 mq_index)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 3f831de9a4d8..b1a6cb3a2809 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -164,6 +164,7 @@ int mlx5_vector2eqn(struct mlx5_ib_dev *dev, int vector, int *eqn, int *irqn)
 static int alloc_comp_eqs(struct mlx5_ib_dev *dev)
 {
        struct mlx5_eq_table *table = &dev->mdev.priv.eq_table;
+        char name[MLX5_MAX_EQ_NAME];
        struct mlx5_eq *eq, *n;
        int ncomp_vec;
        int nent;
@@ -180,11 +181,10 @@ static int alloc_comp_eqs(struct mlx5_ib_dev *dev)
                        goto clean;
                }
-                snprintf(eq->name, MLX5_MAX_EQ_NAME, "mlx5_comp%d", i);
+                snprintf(name, MLX5_MAX_EQ_NAME, "mlx5_comp%d", i);
                err = mlx5_create_map_eq(&dev->mdev, eq,
                                         i + MLX5_EQ_VEC_COMP_BASE, nent, 0,
-                                         eq->name,
+                                         name, &dev->mdev.priv.uuari.uars[0]);
-                                         &dev->mdev.priv.uuari.uars[0]);
                if (err) {
                        kfree(eq);
                        goto clean;
@@ -301,9 +301,8 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
        props->max_srq_sge         = max_rq_sg - 1;
        props->max_fast_reg_page_list_len = (unsigned int)-1;
        props->local_ca_ack_delay  = dev->mdev.caps.local_ca_ack_delay;
-        props->atomic_cap          = dev->mdev.caps.flags & MLX5_DEV_CAP_FLAG_ATOMIC ?
+        props->atomic_cap          = IB_ATOMIC_NONE;
-                IB_ATOMIC_HCA : IB_ATOMIC_NONE;
+        props->masked_atomic_cap   = IB_ATOMIC_NONE;
-        props->masked_atomic_cap   = IB_ATOMIC_HCA;
        props->max_pkeys           = be16_to_cpup((__be16 *)(out_mad->data + 28));
        props->max_mcast_grp       = 1 << dev->mdev.caps.log_max_mcg;
        props->max_mcast_qp_attach = dev->mdev.caps.max_qp_mcg;
@@ -1006,6 +1005,11 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, enum mlx5_dev_event event,
        ibev.device           = &ibdev->ib_dev;
        ibev.element.port_num = port;
+        if (port < 1 || port > ibdev->num_ports) {
+                mlx5_ib_warn(ibdev, "warning: event on port %d\n", port);
+                return;
+        }
        if (ibdev->ib_active)
                ib_dispatch_event(&ibev);
 }
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index bd41df95b6f0..3453580b1eb2 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -42,6 +42,10 @@ enum {
        DEF_CACHE_SIZE  = 10,
 };
+enum {
+        MLX5_UMR_ALIGN  = 2048
+};
 static __be64 *mr_align(__be64 *ptr, int align)
 {
        unsigned long mask = align - 1;
@@ -61,13 +65,11 @@ static int order2idx(struct mlx5_ib_dev *dev, int order)
 static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
        struct mlx5_mr_cache *cache = &dev->cache;
        struct mlx5_cache_ent *ent = &cache->ent[c];
        struct mlx5_create_mkey_mbox_in *in;
        struct mlx5_ib_mr *mr;
        int npages = 1 << ent->order;
-        int size = sizeof(u64) * npages;
        int err = 0;
        int i;
@@ -83,21 +85,6 @@ static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
                }
                mr->order = ent->order;
                mr->umred = 1;
-                mr->pas = kmalloc(size + 0x3f, GFP_KERNEL);
-                if (!mr->pas) {
-                        kfree(mr);
-                        err = -ENOMEM;
-                        goto out;
-                }
-                mr->dma = dma_map_single(ddev, mr_align(mr->pas, 0x40), size,
-                                         DMA_TO_DEVICE);
-                if (dma_mapping_error(ddev, mr->dma)) {
-                        kfree(mr->pas);
-                        kfree(mr);
-                        err = -ENOMEM;
-                        goto out;
-                }
                in->seg.status = 1 << 6;
                in->seg.xlt_oct_size = cpu_to_be32((npages + 1) / 2);
                in->seg.qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
@@ -108,8 +95,6 @@ static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
                                            sizeof(*in));
                if (err) {
                        mlx5_ib_warn(dev, "create mkey failed %d\n", err);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
                        kfree(mr);
                        goto out;
                }
@@ -129,11 +114,9 @@ out:
 static void remove_keys(struct mlx5_ib_dev *dev, int c, int num)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
        struct mlx5_mr_cache *cache = &dev->cache;
        struct mlx5_cache_ent *ent = &cache->ent[c];
        struct mlx5_ib_mr *mr;
-        int size;
        int err;
        int i;
@@ -149,14 +132,10 @@ static void remove_keys(struct mlx5_ib_dev *dev, int c, int num)
                ent->size--;
                spin_unlock(&ent->lock);
                err = mlx5_core_destroy_mkey(&dev->mdev, &mr->mmr);
-                if (err) {
+                if (err)
                        mlx5_ib_warn(dev, "failed destroy mkey\n");
-                } else {
+                else
-                        size = ALIGN(sizeof(u64) * (1 << mr->order), 0x40);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
                        kfree(mr);
-                }
        }
 }
@@ -408,13 +387,12 @@ static void free_cached_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 static void clean_keys(struct mlx5_ib_dev *dev, int c)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
        struct mlx5_mr_cache *cache = &dev->cache;
        struct mlx5_cache_ent *ent = &cache->ent[c];
        struct mlx5_ib_mr *mr;
-        int size;
        int err;
+        cancel_delayed_work(&ent->dwork);
        while (1) {
                spin_lock(&ent->lock);
                if (list_empty(&ent->head)) {
@@ -427,14 +405,10 @@ static void clean_keys(struct mlx5_ib_dev *dev, int c)
                ent->size--;
                spin_unlock(&ent->lock);
                err = mlx5_core_destroy_mkey(&dev->mdev, &mr->mmr);
-                if (err) {
+                if (err)
                        mlx5_ib_warn(dev, "failed destroy mkey\n");
-                } else {
+                else
-                        size = ALIGN(sizeof(u64) * (1 << mr->order), 0x40);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
                        kfree(mr);
-                }
        }
 }
@@ -540,13 +514,15 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
        int i;
        dev->cache.stopped = 1;
-        destroy_workqueue(dev->cache.wq);
+        flush_workqueue(dev->cache.wq);
        mlx5_mr_cache_debugfs_cleanup(dev);
        for (i = 0; i < MAX_MR_CACHE_ENTRIES; i++)
                clean_keys(dev, i);
+        destroy_workqueue(dev->cache.wq);
        return 0;
 }
@@ -675,10 +651,12 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
                                  int page_shift, int order, int access_flags)
 {
        struct mlx5_ib_dev *dev = to_mdev(pd->device);
+        struct device *ddev = dev->ib_dev.dma_device;
        struct umr_common *umrc = &dev->umrc;
        struct ib_send_wr wr, *bad;
        struct mlx5_ib_mr *mr;
        struct ib_sge sg;
+        int size = sizeof(u64) * npages;
        int err;
        int i;
@@ -697,7 +675,22 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
        if (!mr)
                return ERR_PTR(-EAGAIN);
-        mlx5_ib_populate_pas(dev, umem, page_shift, mr_align(mr->pas, 0x40), 1);
+        mr->pas = kmalloc(size + MLX5_UMR_ALIGN - 1, GFP_KERNEL);
+        if (!mr->pas) {
+                err = -ENOMEM;
+                goto error;
+        }
+        mlx5_ib_populate_pas(dev, umem, page_shift,
+                             mr_align(mr->pas, MLX5_UMR_ALIGN), 1);
+        mr->dma = dma_map_single(ddev, mr_align(mr->pas, MLX5_UMR_ALIGN), size,
+                                 DMA_TO_DEVICE);
+        if (dma_mapping_error(ddev, mr->dma)) {
+                kfree(mr->pas);
+                err = -ENOMEM;
+                goto error;
+        }
        memset(&wr, 0, sizeof(wr));
        wr.wr_id = (u64)(unsigned long)mr;
@@ -718,6 +711,9 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
        wait_for_completion(&mr->done);
        up(&umrc->sem);
+        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
+        kfree(mr->pas);
        if (mr->status != IB_WC_SUCCESS) {
                mlx5_ib_warn(dev, "reg umr failed\n");
                err = -EFAULT;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 045f8cdbd303..5659ea880741 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -203,7 +203,7 @@ static int sq_overhead(enum ib_qp_type qp_type)
        switch (qp_type) {
        case IB_QPT_XRC_INI:
-                size = sizeof(struct mlx5_wqe_xrc_seg);
+                size += sizeof(struct mlx5_wqe_xrc_seg);
                /* fall through */
        case IB_QPT_RC:
                size += sizeof(struct mlx5_wqe_ctrl_seg) +
@@ -211,20 +211,23 @@ static int sq_overhead(enum ib_qp_type qp_type)
                        sizeof(struct mlx5_wqe_raddr_seg);
                break;
+        case IB_QPT_XRC_TGT:
+                return 0;
        case IB_QPT_UC:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                        sizeof(struct mlx5_wqe_raddr_seg);
                break;
        case IB_QPT_UD:
        case IB_QPT_SMI:
        case IB_QPT_GSI:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                        sizeof(struct mlx5_wqe_datagram_seg);
                break;
        case MLX5_IB_QPT_REG_UMR:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                        sizeof(struct mlx5_wqe_umr_ctrl_seg) +
                        sizeof(struct mlx5_mkey_seg);
                break;
@@ -270,7 +273,8 @@ static int calc_sq_size(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
                return wqe_size;
        if (wqe_size > dev->mdev.caps.max_sq_desc_sz) {
-                mlx5_ib_dbg(dev, "\n");
+                mlx5_ib_dbg(dev, "wqe_size(%d) > max_sq_desc_sz(%d)\n",
+                            wqe_size, dev->mdev.caps.max_sq_desc_sz);
                return -EINVAL;
        }
@@ -280,9 +284,15 @@ static int calc_sq_size(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
        wq_size = roundup_pow_of_two(attr->cap.max_send_wr * wqe_size);
        qp->sq.wqe_cnt = wq_size / MLX5_SEND_WQE_BB;
+        if (qp->sq.wqe_cnt > dev->mdev.caps.max_wqes) {
+                mlx5_ib_dbg(dev, "wqe count(%d) exceeds limits(%d)\n",
+                            qp->sq.wqe_cnt, dev->mdev.caps.max_wqes);
+                return -ENOMEM;
+        }
        qp->sq.wqe_shift = ilog2(MLX5_SEND_WQE_BB);
        qp->sq.max_gs = attr->cap.max_send_sge;
-        qp->sq.max_post = 1 << ilog2(wq_size / wqe_size);
+        qp->sq.max_post = wq_size / wqe_size;
+        attr->cap.max_send_wr = qp->sq.max_post;
        return wq_size;
 }
@@ -1280,6 +1290,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
                                          MLX5_QP_OPTPAR_Q_KEY,
                        [MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_PKEY_INDEX    |
                                           MLX5_QP_OPTPAR_Q_KEY,
+                        [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
+                                          MLX5_QP_OPTPAR_RRE            |
+                                          MLX5_QP_OPTPAR_RAE            |
+                                          MLX5_QP_OPTPAR_RWE            |
+                                          MLX5_QP_OPTPAR_PKEY_INDEX,
                },
        },
        [MLX5_QP_STATE_RTR] = {
@@ -1314,6 +1329,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
                [MLX5_QP_STATE_RTS] = {
                        [MLX5_QP_ST_UD]  = MLX5_QP_OPTPAR_Q_KEY,
                        [MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_Q_KEY,
+                        [MLX5_QP_ST_UC]  = MLX5_QP_OPTPAR_RWE,
+                        [MLX5_QP_ST_RC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT   |
+                                           MLX5_QP_OPTPAR_RWE           |
+                                           MLX5_QP_OPTPAR_RAE           |
+                                           MLX5_QP_OPTPAR_RRE,
                },
        },
 };
@@ -1651,29 +1671,6 @@ static __always_inline void set_raddr_seg(struct mlx5_wqe_raddr_seg *rseg,
        rseg->reserved = 0;
 }
-static void set_atomic_seg(struct mlx5_wqe_atomic_seg *aseg, struct ib_send_wr *wr)
-{
-        if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP) {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.swap);
-                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add);
-        } else if (wr->opcode == IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
-                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add_mask);
-        } else {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
-                aseg->compare  = 0;
-        }
-}
-static void set_masked_atomic_seg(struct mlx5_wqe_masked_atomic_seg *aseg,
-                                  struct ib_send_wr *wr)
-{
-        aseg->swap_add          = cpu_to_be64(wr->wr.atomic.swap);
-        aseg->swap_add_mask     = cpu_to_be64(wr->wr.atomic.swap_mask);
-        aseg->compare           = cpu_to_be64(wr->wr.atomic.compare_add);
-        aseg->compare_mask      = cpu_to_be64(wr->wr.atomic.compare_add_mask);
-}
 static void set_datagram_seg(struct mlx5_wqe_datagram_seg *dseg,
                             struct ib_send_wr *wr)
 {
@@ -2063,28 +2060,11 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                        case IB_WR_ATOMIC_CMP_AND_SWP:
                        case IB_WR_ATOMIC_FETCH_AND_ADD:
-                                set_raddr_seg(seg, wr->wr.atomic.remote_addr,
-                                              wr->wr.atomic.rkey);
-                                seg  += sizeof(struct mlx5_wqe_raddr_seg);
-                                set_atomic_seg(seg, wr);
-                                seg  += sizeof(struct mlx5_wqe_atomic_seg);
-                                size += (sizeof(struct mlx5_wqe_raddr_seg) +
-                                         sizeof(struct mlx5_wqe_atomic_seg)) / 16;
-                                break;
                        case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
-                                set_raddr_seg(seg, wr->wr.atomic.remote_addr,
+                                mlx5_ib_warn(dev, "Atomic operations are not supported yet\n");
-                                              wr->wr.atomic.rkey);
+                                err = -ENOSYS;
-                                seg  += sizeof(struct mlx5_wqe_raddr_seg);
+                                *bad_wr = wr;
+                                goto out;
-                                set_masked_atomic_seg(seg, wr);
-                                seg  += sizeof(struct mlx5_wqe_masked_atomic_seg);
-                                size += (sizeof(struct mlx5_wqe_raddr_seg) +
-                                         sizeof(struct mlx5_wqe_masked_atomic_seg)) / 16;
-                                break;
                        case IB_WR_LOCAL_INV:
                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 84d297afd6a9..0aa478bc291a 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -295,7 +295,7 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
        mlx5_vfree(in);
        if (err) {
                mlx5_ib_dbg(dev, "create SRQ failed, err %d\n", err);
-                goto err_srq;
+                goto err_usr_kern_srq;
        }
        mlx5_ib_dbg(dev, "create SRQ with srqn 0x%x\n", srq->msrq.srqn);
@@ -316,6 +316,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 err_core:
        mlx5_core_destroy_srq(&dev->mdev, &srq->msrq);
+err_usr_kern_srq:
        if (pd->uobject)
                destroy_srq_user(pd, srq);
        else
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 7c9d35f39d75..690201738993 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -357,7 +357,7 @@ static int mthca_eq_int(struct mthca_dev *dev, struct mthca_eq *eq)
                        mthca_warn(dev, "Unhandled event %02x(%02x) on EQ %d\n",
                                   eqe->type, eqe->subtype, eq->eqn);
                        break;
-                };
+                }
                set_eqe_hw(eqe);
                ++eq->cons_index;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 4ed8235d2d36..50219ab2279d 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -150,7 +150,7 @@ enum ib_qp_state get_ibqp_state(enum ocrdma_qp_state qps)
                return IB_QPS_SQE;
        case OCRDMA_QPS_ERR:
                return IB_QPS_ERR;
-        };
+        }
        return IB_QPS_ERR;
 }
@@ -171,7 +171,7 @@ static enum ocrdma_qp_state get_ocrdma_qp_state(enum ib_qp_state qps)
                return OCRDMA_QPS_SQE;
        case IB_QPS_ERR:
                return OCRDMA_QPS_ERR;
-        };
+        }
        return OCRDMA_QPS_ERR;
 }
@@ -1982,7 +1982,7 @@ int ocrdma_mbx_create_qp(struct ocrdma_qp *qp, struct ib_qp_init_attr *attrs,
                break;
        default:
                return -EINVAL;
-        };
+        }
        cmd = ocrdma_init_emb_mqe(OCRDMA_CMD_CREATE_QP, sizeof(*cmd));
        if (!cmd)
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 56e004940f18..0ce7674621ea 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -531,7 +531,7 @@ static void ocrdma_event_handler(struct ocrdma_dev *dev, u32 event)
        case BE_DEV_DOWN:
                ocrdma_close(dev);
                break;
-        };
+        }
 }
 static struct ocrdma_driver ocrdma_drv = {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 6e982bb43c31..69f1d1221a6b 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -141,7 +141,7 @@ static inline void get_link_speed_and_width(struct ocrdma_dev *dev,
                /* Unsupported */
                *ib_speed = IB_SPEED_SDR;
                *ib_width = IB_WIDTH_1X;
-        };
+        }
 }
@@ -2331,7 +2331,7 @@ static enum ib_wc_status ocrdma_to_ibwc_err(u16 status)
        default:
                ibwc_status = IB_WC_GENERAL_ERR;
                break;
-        };
+        }
        return ibwc_status;
 }
@@ -2370,7 +2370,7 @@ static void ocrdma_update_wc(struct ocrdma_qp *qp, struct ib_wc *ibwc,
                pr_err("%s() invalid opcode received = 0x%x\n",
                       __func__, hdr->cw & OCRDMA_WQE_OPCODE_MASK);
                break;
-        };
+        }
 }
 static void ocrdma_set_cqe_status_flushed(struct ocrdma_qp *qp,
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 653ac6bfc57a..6c923c7039a1 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1588,7 +1588,7 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
        int resp_data_len;
        int resp_len;
-        resp_data_len = (rsp_code == SRP_TSK_MGMT_SUCCESS) ? 0 : 4;
+        resp_data_len = 4;
        resp_len = sizeof(*srp_rsp) + resp_data_len;
        srp_rsp = ioctx->ioctx.buf;
@@ -1600,11 +1600,9 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
                                    + atomic_xchg(&ch->req_lim_delta, 0));
        srp_rsp->tag = tag;
-        if (rsp_code != SRP_TSK_MGMT_SUCCESS) {
+        srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
-                srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
+        srp_rsp->resp_data_len = cpu_to_be32(resp_data_len);
-                srp_rsp->resp_data_len = cpu_to_be32(resp_data_len);
+        srp_rsp->data[3] = rsp_code;
-                srp_rsp->data[3] = rsp_code;
-        }
        return resp_len;
 }
@@ -2358,6 +2356,8 @@ static void srpt_release_channel_work(struct work_struct *w)
        transport_deregister_session(se_sess);
        ch->sess = NULL;
+        ib_destroy_cm_id(ch->cm_id);
        srpt_destroy_ch_ib(ch);
        srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
@@ -2368,8 +2368,6 @@ static void srpt_release_channel_work(struct work_struct *w)
        list_del(&ch->list);
        spin_unlock_irq(&sdev->spinlock);
-        ib_destroy_cm_id(ch->cm_id);
        if (ch->release_done)
                complete(ch->release_done);
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index fe302e33f72e..c880ebaf1553 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -52,7 +52,7 @@ config AMD_IOMMU
        select PCI_PRI
        select PCI_PASID
        select IOMMU_API
-        depends on X86_64 && PCI && ACPI && X86_IO_APIC
+        depends on X86_64 && PCI && ACPI
        ---help---
          With this option you can enable support for AMD IOMMU hardware in
          your system. An IOMMU is a hardware component which provides
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index f417e89e1e7e..181c9ba929cd 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -377,6 +377,7 @@ struct arm_smmu_cfg {
        u32                             cbar;
        pgd_t                           *pgd;
 };
+#define INVALID_IRPTNDX                 0xff
 #define ARM_SMMU_CB_ASID(cfg)           ((cfg)->cbndx)
 #define ARM_SMMU_CB_VMID(cfg)           ((cfg)->cbndx + 1)
@@ -840,7 +841,7 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain,
        if (IS_ERR_VALUE(ret)) {
                dev_err(smmu->dev, "failed to request context IRQ %d (%u)\n",
                        root_cfg->irptndx, irq);
-                root_cfg->irptndx = -1;
+                root_cfg->irptndx = INVALID_IRPTNDX;
                goto out_free_context;
        }
@@ -869,7 +870,7 @@ static void arm_smmu_destroy_domain_context(struct iommu_domain *domain)
        writel_relaxed(0, cb_base + ARM_SMMU_CB_SCTLR);
        arm_smmu_tlb_inv_context(root_cfg);
-        if (root_cfg->irptndx != -1) {
+        if (root_cfg->irptndx != INVALID_IRPTNDX) {
                irq = smmu->irqs[smmu->num_global_irqs + root_cfg->irptndx];
                free_irq(irq, domain);
        }
@@ -1857,8 +1858,6 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
                goto out_put_parent;
        }
-        arm_smmu_device_reset(smmu);
        for (i = 0; i < smmu->num_global_irqs; ++i) {
                err = request_irq(smmu->irqs[i],
                                  arm_smmu_global_fault,
@@ -1876,6 +1875,8 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
        spin_lock(&arm_smmu_devices_lock);
        list_add(&smmu->list, &arm_smmu_devices);
        spin_unlock(&arm_smmu_devices_lock);
+        arm_smmu_device_reset(smmu);
        return 0;
 out_free_irqs:
@@ -1966,10 +1967,10 @@ static int __init arm_smmu_init(void)
                return ret;
        /* Oh, for a proper bus abstraction */
-        if (!iommu_present(&platform_bus_type));
+        if (!iommu_present(&platform_bus_type))
                bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
-        if (!iommu_present(&amba_bustype));
+        if (!iommu_present(&amba_bustype))
                bus_set_iommu(&amba_bustype, &arm_smmu_ops);
        return 0;
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 71eb233b9ace..b6a74bcbb08f 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -996,6 +996,7 @@ static void request_write(struct cached_dev *dc, struct search *s)
                closure_bio_submit(bio, cl, s->d);
        } else {
                bch_writeback_add(dc);
+                s->op.cache_bio = bio;
                if (bio->bi_rw & REQ_FLUSH) {
                        /* Also need to send a flush to the backing device */
@@ -1008,8 +1009,6 @@ static void request_write(struct cached_dev *dc, struct search *s)
                        flush->bi_private = cl;
                        closure_bio_submit(flush, cl, s->d);
-                } else {
-                        s->op.cache_bio = bio;
                }
        }
 out:
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 4caa8e6d59d7..2d2b1b7588d7 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -269,6 +269,14 @@ static chunk_t area_location(struct pstore *ps, chunk_t area)
        return NUM_SNAPSHOT_HDR_CHUNKS + ((ps->exceptions_per_area + 1) * area);
 }
+static void skip_metadata(struct pstore *ps)
+{
+        uint32_t stride = ps->exceptions_per_area + 1;
+        chunk_t next_free = ps->next_free;
+        if (sector_div(next_free, stride) == NUM_SNAPSHOT_HDR_CHUNKS)
+                ps->next_free++;
+}
 /*
 * Read or write a metadata area.  Remembering to skip the first
 * chunk which holds the header.
@@ -502,6 +510,8 @@ static int read_exceptions(struct pstore *ps,
        ps->current_area--;
+        skip_metadata(ps);
        return 0;
 }
@@ -616,8 +626,6 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
                                        struct dm_exception *e)
 {
        struct pstore *ps = get_info(store);
-        uint32_t stride;
-        chunk_t next_free;
        sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
        /* Is there enough room ? */
@@ -630,10 +638,8 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
         * Move onto the next free pending, making sure to take
         * into account the location of the metadata chunks.
         */
-        stride = (ps->exceptions_per_area + 1);
+        ps->next_free++;
-        next_free = ++ps->next_free;
+        skip_metadata(ps);
-        if (sector_div(next_free, stride) == 1)
-                ps->next_free++;
        atomic_inc(&ps->pending_count);
        return 0;
diff --git a/drivers/mmc/host/sh_mobile_sdhi.c b/drivers/mmc/host/sh_mobile_sdhi.c
index 87ed3fb5149a..f344659dceac 100644
--- a/drivers/mmc/host/sh_mobile_sdhi.c
+++ b/drivers/mmc/host/sh_mobile_sdhi.c
@@ -113,14 +113,14 @@ static const struct sh_mobile_sdhi_ops sdhi_ops = {
 };
 static const struct of_device_id sh_mobile_sdhi_of_match[] = {
-        { .compatible = "renesas,shmobile-sdhi" },
+        { .compatible = "renesas,sdhi-shmobile" },
-        { .compatible = "renesas,sh7372-sdhi" },
+        { .compatible = "renesas,sdhi-sh7372" },
-        { .compatible = "renesas,sh73a0-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-sh73a0", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a73a4-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a73a4", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7740-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7740", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7778-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7778", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7779-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7779", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7790-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7790", .data = &sh_mobile_sdhi_of_cfg[0], },
        {},
 };
 MODULE_DEVICE_TABLE(of, sh_mobile_sdhi_of_match);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 26b14f9fcac6..6bc9618af094 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -168,12 +168,25 @@ static inline int write_disable(struct m25p *flash)
 */
 static inline int set_4byte(struct m25p *flash, u32 jedec_id, int enable)
 {
+        int status;
+        bool need_wren = false;
        switch (JEDEC_MFR(jedec_id)) {
-        case CFI_MFR_MACRONIX:
        case CFI_MFR_ST: /* Micron, actually */
+                /* Some Micron need WREN command; all will accept it */
+                need_wren = true;
+        case CFI_MFR_MACRONIX:
        case 0xEF /* winbond */:
+                if (need_wren)
+                        write_enable(flash);
                flash->command[0] = enable ? OPCODE_EN4B : OPCODE_EX4B;
-                return spi_write(flash->spi, flash->command, 1);
+                status = spi_write(flash->spi, flash->command, 1);
+                if (need_wren)
+                        write_disable(flash);
+                return status;
        default:
                /* Spansion style */
                flash->command[0] = OPCODE_BRWR;
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 7ed4841327f2..d340b2f198c6 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2869,10 +2869,8 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
        len = le16_to_cpu(p->ext_param_page_length) * 16;
        ep = kmalloc(len, GFP_KERNEL);
-        if (!ep) {
+        if (!ep)
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto ext_out;
-        }
        /* Send our own NAND_CMD_PARAM. */
        chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
@@ -2920,7 +2918,7 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
        }
        pr_info("ONFI extended param page detected.\n");
-        return 0;
+        ret = 0;
 ext_out:
        kfree(ep);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 55bbb8b8200c..e883bfe2e727 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1724,6 +1724,7 @@ static int __bond_release_one(struct net_device *bond_dev,
        struct bonding *bond = netdev_priv(bond_dev);
        struct slave *slave, *oldcurrent;
        struct sockaddr addr;
+        int old_flags = bond_dev->flags;
        netdev_features_t old_features = bond_dev->features;
        /* slave is not a slave or master is not master of this slave */
@@ -1855,12 +1856,18 @@ static int __bond_release_one(struct net_device *bond_dev,
         * bond_change_active_slave(..., NULL)
         */
        if (!USES_PRIMARY(bond->params.mode)) {
-                /* unset promiscuity level from slave */
+                /* unset promiscuity level from slave
-                if (bond_dev->flags & IFF_PROMISC)
+                 * NOTE: The NETDEV_CHANGEADDR call above may change the value
+                 * of the IFF_PROMISC flag in the bond_dev, but we need the
+                 * value of that flag before that change, as that was the value
+                 * when this slave was attached, so we cache at the start of the
+                 * function and use it here. Same goes for ALLMULTI below
+                 */
+                if (old_flags & IFF_PROMISC)
                        dev_set_promiscuity(slave_dev, -1);
                /* unset allmulti level from slave */
-                if (bond_dev->flags & IFF_ALLMULTI)
+                if (old_flags & IFF_ALLMULTI)
                        dev_set_allmulti(slave_dev, -1);
                bond_hw_addr_flush(bond_dev, slave_dev);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 71c677e651d7..3f21142138b7 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -702,7 +702,6 @@ static int flexcan_chip_start(struct net_device *dev)
 {
        struct flexcan_priv *priv = netdev_priv(dev);
        struct flexcan_regs __iomem *regs = priv->base;
-        unsigned int i;
        int err;
        u32 reg_mcr, reg_ctrl;
@@ -772,17 +771,6 @@ static int flexcan_chip_start(struct net_device *dev)
        netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
        flexcan_write(reg_ctrl, &regs->ctrl);
-        for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) {
-                flexcan_write(0, &regs->cantxfg[i].can_ctrl);
-                flexcan_write(0, &regs->cantxfg[i].can_id);
-                flexcan_write(0, &regs->cantxfg[i].data[0]);
-                flexcan_write(0, &regs->cantxfg[i].data[1]);
-                /* put MB into rx queue */
-                flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
-                        &regs->cantxfg[i].can_ctrl);
-        }
        /* acceptance mask/acceptance code (accept everything) */
        flexcan_write(0x0, &regs->rxgmask);
        flexcan_write(0x0, &regs->rx14mask);
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index 874188ba06f7..25377e547f9b 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -76,6 +76,10 @@ MODULE_PARM_DESC(maxdev, "Maximum number of slcan interfaces");
 /* maximum rx buffer len: extended CAN frame with timestamp */
 #define SLC_MTU (sizeof("T1111222281122334455667788EA5F\r")+1)
+#define SLC_CMD_LEN 1
+#define SLC_SFF_ID_LEN 3
+#define SLC_EFF_ID_LEN 8
 struct slcan {
        int                     magic;
@@ -142,47 +146,63 @@ static void slc_bump(struct slcan *sl)
 {
        struct sk_buff *skb;
        struct can_frame cf;
-        int i, dlc_pos, tmp;
+        int i, tmp;
-        unsigned long ultmp;
+        u32 tmpid;
-        char cmd = sl->rbuff[0];
+        char *cmd = sl->rbuff;
-        if ((cmd != 't') && (cmd != 'T') && (cmd != 'r') && (cmd != 'R'))
+        cf.can_id = 0;
+        switch (*cmd) {
+        case 'r':
+                cf.can_id = CAN_RTR_FLAG;
+                /* fallthrough */
+        case 't':
+                /* store dlc ASCII value and terminate SFF CAN ID string */
+                cf.can_dlc = sl->rbuff[SLC_CMD_LEN + SLC_SFF_ID_LEN];
+                sl->rbuff[SLC_CMD_LEN + SLC_SFF_ID_LEN] = 0;
+                /* point to payload data behind the dlc */
+                cmd += SLC_CMD_LEN + SLC_SFF_ID_LEN + 1;
+                break;
+        case 'R':
+                cf.can_id = CAN_RTR_FLAG;
+                /* fallthrough */
+        case 'T':
+                cf.can_id |= CAN_EFF_FLAG;
+                /* store dlc ASCII value and terminate EFF CAN ID string */
+                cf.can_dlc = sl->rbuff[SLC_CMD_LEN + SLC_EFF_ID_LEN];
+                sl->rbuff[SLC_CMD_LEN + SLC_EFF_ID_LEN] = 0;
+                /* point to payload data behind the dlc */
+                cmd += SLC_CMD_LEN + SLC_EFF_ID_LEN + 1;
+                break;
+        default:
                return;
+        }
-        if (cmd & 0x20) /* tiny chars 'r' 't' => standard frame format */
+        if (kstrtou32(sl->rbuff + SLC_CMD_LEN, 16, &tmpid))
-                dlc_pos = 4; /* dlc position tiiid */
-        else
-                dlc_pos = 9; /* dlc position Tiiiiiiiid */
-        if (!((sl->rbuff[dlc_pos] >= '0') && (sl->rbuff[dlc_pos] < '9')))
                return;
-        cf.can_dlc = sl->rbuff[dlc_pos] - '0'; /* get can_dlc from ASCII val */
+        cf.can_id |= tmpid;
-        sl->rbuff[dlc_pos] = 0; /* terminate can_id string */
+        /* get can_dlc from sanitized ASCII value */
+        if (cf.can_dlc >= '0' && cf.can_dlc < '9')
-        if (kstrtoul(sl->rbuff+1, 16, &ultmp))
+                cf.can_dlc -= '0';
+        else
                return;
-        cf.can_id = ultmp;
-        if (!(cmd & 0x20)) /* NO tiny chars => extended frame format */
-                cf.can_id |= CAN_EFF_FLAG;
-        if ((cmd | 0x20) == 'r') /* RTR frame */
-                cf.can_id |= CAN_RTR_FLAG;
        *(u64 *) (&cf.data) = 0; /* clear payload */
-        for (i = 0, dlc_pos++; i < cf.can_dlc; i++) {
+        /* RTR frames may have a dlc > 0 but they never have any data bytes */
-                tmp = hex_to_bin(sl->rbuff[dlc_pos++]);
+        if (!(cf.can_id & CAN_RTR_FLAG)) {
-                if (tmp < 0)
+                for (i = 0; i < cf.can_dlc; i++) {
-                        return;
+                        tmp = hex_to_bin(*cmd++);
-                cf.data[i] = (tmp << 4);
+                        if (tmp < 0)
-                tmp = hex_to_bin(sl->rbuff[dlc_pos++]);
+                                return;
-                if (tmp < 0)
+                        cf.data[i] = (tmp << 4);
-                        return;
+                        tmp = hex_to_bin(*cmd++);
-                cf.data[i] |= tmp;
+                        if (tmp < 0)
+                                return;
+                        cf.data[i] |= tmp;
+                }
        }
        skb = dev_alloc_skb(sizeof(struct can_frame) +
@@ -209,7 +229,6 @@ static void slc_bump(struct slcan *sl)
 /* parse tty input stream */
 static void slcan_unesc(struct slcan *sl, unsigned char s)
 {
        if ((s == '\r') || (s == '\a')) { /* CR or BEL ends the pdu */
                if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
                    (sl->rcount > 4))  {
@@ -236,27 +255,46 @@ static void slcan_unesc(struct slcan *sl, unsigned char s)
 /* Encapsulate one can_frame and stuff into a TTY queue. */
 static void slc_encaps(struct slcan *sl, struct can_frame *cf)
 {
-        int actual, idx, i;
+        int actual, i;
-        char cmd;
+        unsigned char *pos;
+        unsigned char *endpos;
+        canid_t id = cf->can_id;
+        pos = sl->xbuff;
        if (cf->can_id & CAN_RTR_FLAG)
-                cmd = 'R'; /* becomes 'r' in standard frame format */
+                *pos = 'R'; /* becomes 'r' in standard frame format (SFF) */
        else
-                cmd = 'T'; /* becomes 't' in standard frame format */
+                *pos = 'T'; /* becomes 't' in standard frame format (SSF) */
-        if (cf->can_id & CAN_EFF_FLAG)
+        /* determine number of chars for the CAN-identifier */
-                sprintf(sl->xbuff, "%c%08X%d", cmd,
+        if (cf->can_id & CAN_EFF_FLAG) {
-                        cf->can_id & CAN_EFF_MASK, cf->can_dlc);
+                id &= CAN_EFF_MASK;
-        else
+                endpos = pos + SLC_EFF_ID_LEN;
-                sprintf(sl->xbuff, "%c%03X%d", cmd | 0x20,
+        } else {
-                        cf->can_id & CAN_SFF_MASK, cf->can_dlc);
+                *pos |= 0x20; /* convert R/T to lower case for SFF */
+                id &= CAN_SFF_MASK;
+                endpos = pos + SLC_SFF_ID_LEN;
+        }
-        idx = strlen(sl->xbuff);
+        /* build 3 (SFF) or 8 (EFF) digit CAN identifier */
+        pos++;
+        while (endpos >= pos) {
+                *endpos-- = hex_asc_upper[id & 0xf];
+                id >>= 4;
+        }
+        pos += (cf->can_id & CAN_EFF_FLAG) ? SLC_EFF_ID_LEN : SLC_SFF_ID_LEN;
-        for (i = 0; i < cf->can_dlc; i++)
+        *pos++ = cf->can_dlc + '0';
-                sprintf(&sl->xbuff[idx + 2*i], "%02X", cf->data[i]);
+        /* RTR frames may have a dlc > 0 but they never have any data bytes */
+        if (!(cf->can_id & CAN_RTR_FLAG)) {
+                for (i = 0; i < cf->can_dlc; i++)
+                        pos = hex_byte_pack_upper(pos, cf->data[i]);
+        }
-        strcat(sl->xbuff, "\r"); /* add terminating character */
+        *pos++ = '\r';
        /* Order of next two lines is *very* important.
         * When we are sending a little amount of data,
@@ -267,8 +305,8 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
         *       14 Oct 1994  Dmitry Gorodchanin.
         */
        set_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
-        actual = sl->tty->ops->write(sl->tty, sl->xbuff, strlen(sl->xbuff));
+        actual = sl->tty->ops->write(sl->tty, sl->xbuff, pos - sl->xbuff);
-        sl->xleft = strlen(sl->xbuff) - actual;
+        sl->xleft = (pos - sl->xbuff) - actual;
        sl->xhead = sl->xbuff + actual;
        sl->dev->stats.tx_bytes += cf->can_dlc;
 }
@@ -286,11 +324,13 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
                return;
+        spin_lock(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                spin_unlock(&sl->lock);
                netif_wake_queue(sl->dev);
                return;
        }
@@ -298,6 +338,7 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
+        spin_unlock(&sl->lock);
 }
 /* Send a can_frame to a TTY queue. */
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index a0f647f92bf5..0b7a4c3b01a2 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -463,7 +463,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
        if (i < PCAN_USB_MAX_TX_URBS) {
                if (i == 0) {
                        netdev_err(netdev, "couldn't setup any tx URB\n");
-                        return err;
+                        goto err_tx;
                }
                netdev_warn(netdev, "tx performance may be slow\n");
@@ -472,7 +472,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
        if (dev->adapter->dev_start) {
                err = dev->adapter->dev_start(dev);
                if (err)
-                        goto failed;
+                        goto err_adapter;
        }
        dev->state |= PCAN_USB_STATE_STARTED;
@@ -481,19 +481,26 @@ static int peak_usb_start(struct peak_usb_device *dev)
        if (dev->adapter->dev_set_bus) {
                err = dev->adapter->dev_set_bus(dev, 1);
                if (err)
-                        goto failed;
+                        goto err_adapter;
        }
        dev->can.state = CAN_STATE_ERROR_ACTIVE;
        return 0;
-failed:
+err_adapter:
        if (err == -ENODEV)
                netif_device_detach(dev->netdev);
        netdev_warn(netdev, "couldn't submit control: %d\n", err);
+        for (i = 0; i < PCAN_USB_MAX_TX_URBS; i++) {
+                usb_free_urb(dev->tx_contexts[i].urb);
+                dev->tx_contexts[i].urb = NULL;
+        }
+err_tx:
+        usb_kill_anchored_urbs(&dev->rx_submitted);
        return err;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 61726af1de6e..e66beff2704d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2481,8 +2481,7 @@ load_error_cnic2:
 load_error_cnic1:
        bnx2x_napi_disable_cnic(bp);
        /* Update the number of queues without the cnic queues */
-        rc = bnx2x_set_real_num_queues(bp, 0);
+        if (bnx2x_set_real_num_queues(bp, 0))
-        if (rc)
                BNX2X_ERR("Unable to set real_num_queues not including cnic\n");
 load_error_cnic0:
        BNX2X_ERR("CNIC-related load failed\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index d60a2ea3da19..51468227bf3b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -175,6 +175,7 @@ typedef int (*read_sfp_module_eeprom_func_p)(struct bnx2x_phy *phy,
 #define EDC_MODE_LINEAR                         0x0022
 #define EDC_MODE_LIMITING                               0x0044
 #define EDC_MODE_PASSIVE_DAC                    0x0055
+#define EDC_MODE_ACTIVE_DAC                     0x0066
 /* ETS defines*/
 #define DCBX_INVALID_COS                                        (0xFF)
@@ -3684,6 +3685,41 @@ static void bnx2x_warpcore_enable_AN_KR2(struct bnx2x_phy *phy,
        bnx2x_update_link_attr(params, vars->link_attr_sync);
 }
+static void bnx2x_disable_kr2(struct link_params *params,
+                              struct link_vars *vars,
+                              struct bnx2x_phy *phy)
+{
+        struct bnx2x *bp = params->bp;
+        int i;
+        static struct bnx2x_reg_set reg_set[] = {
+                /* Step 1 - Program the TX/RX alignment markers */
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL5, 0x7690},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL7, 0xe647},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL6, 0xc4f0},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL9, 0x7690},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL11, 0xe647},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL10, 0xc4f0},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_USERB0_CTRL, 0x000c},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL1, 0x6000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL3, 0x0000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CODE_FIELD, 0x0002},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI1, 0x0000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI2, 0x0af7},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI3, 0x0af7},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_BAM_CODE, 0x0002},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_UD_CODE, 0x0000}
+        };
+        DP(NETIF_MSG_LINK, "Disabling 20G-KR2\n");
+        for (i = 0; i < ARRAY_SIZE(reg_set); i++)
+                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
+                                 reg_set[i].val);
+        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
+        bnx2x_update_link_attr(params, vars->link_attr_sync);
+        vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
+}
 static void bnx2x_warpcore_set_lpi_passthrough(struct bnx2x_phy *phy,
                                               struct link_params *params)
 {
@@ -3715,7 +3751,6 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                                        struct link_params *params,
                                        struct link_vars *vars) {
        u16 lane, i, cl72_ctrl, an_adv = 0;
-        u16 ucode_ver;
        struct bnx2x *bp = params->bp;
        static struct bnx2x_reg_set reg_set[] = {
                {MDIO_WC_DEVAD, MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X2, 0x7},
@@ -3806,15 +3841,7 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
        /* Advertise pause */
        bnx2x_ext_phy_set_pause(params, phy, vars);
-        /* Set KR Autoneg Work-Around flag for Warpcore version older than D108
+        vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
-         */
-        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
-                        MDIO_WC_REG_UC_INFO_B1_VERSION, &ucode_ver);
-        if (ucode_ver < 0xd108) {
-                DP(NETIF_MSG_LINK, "Enable AN KR work-around. WC ver:0x%x\n",
-                               ucode_ver);
-                vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
-        }
        bnx2x_cl45_read_or_write(bp, phy, MDIO_WC_DEVAD,
                                 MDIO_WC_REG_DIGITAL5_MISC7, 0x100);
@@ -3838,6 +3865,8 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                bnx2x_set_aer_mmd(params, phy);
                bnx2x_warpcore_enable_AN_KR2(phy, params, vars);
+        } else {
+                bnx2x_disable_kr2(params, vars, phy);
        }
        /* Enable Autoneg: only on the main lane */
@@ -4347,20 +4376,14 @@ static void bnx2x_warpcore_config_runtime(struct bnx2x_phy *phy,
        struct bnx2x *bp = params->bp;
        u32 serdes_net_if;
        u16 gp_status1 = 0, lnkup = 0, lnkup_kr = 0;
-        u16 lane = bnx2x_get_warpcore_lane(phy, params);
        vars->turn_to_run_wc_rt = vars->turn_to_run_wc_rt ? 0 : 1;
        if (!vars->turn_to_run_wc_rt)
                return;
-        /* Return if there is no link partner */
-        if (!(bnx2x_warpcore_get_sigdet(phy, params))) {
-                DP(NETIF_MSG_LINK, "bnx2x_warpcore_get_sigdet false\n");
-                return;
-        }
        if (vars->rx_tx_asic_rst) {
+                u16 lane = bnx2x_get_warpcore_lane(phy, params);
                serdes_net_if = (REG_RD(bp, params->shmem_base +
                                offsetof(struct shmem_region, dev_info.
                                port_hw_config[params->port].default_cfg)) &
@@ -4375,14 +4398,8 @@ static void bnx2x_warpcore_config_runtime(struct bnx2x_phy *phy,
                                /*10G KR*/
                        lnkup_kr = (gp_status1 >> (12+lane)) & 0x1;
-                        DP(NETIF_MSG_LINK,
-                                "gp_status1 0x%x\n", gp_status1);
                        if (lnkup_kr || lnkup) {
-                                        vars->rx_tx_asic_rst = 0;
+                                vars->rx_tx_asic_rst = 0;
-                                        DP(NETIF_MSG_LINK,
-                                        "link up, rx_tx_asic_rst 0x%x\n",
-                                        vars->rx_tx_asic_rst);
                        } else {
                                /* Reset the lane to see if link comes up.*/
                                bnx2x_warpcore_reset_lane(bp, phy, 1);
@@ -4507,10 +4524,14 @@ static void bnx2x_warpcore_config_init(struct bnx2x_phy *phy,
                         * enabled transmitter to avoid current leakage in case
                         * no module is connected
                         */
-                        if (bnx2x_is_sfp_module_plugged(phy, params))
+                        if ((params->loopback_mode == LOOPBACK_NONE) ||
-                                bnx2x_sfp_module_detection(phy, params);
+                            (params->loopback_mode == LOOPBACK_EXT)) {
-                        else
+                                if (bnx2x_is_sfp_module_plugged(phy, params))
-                                bnx2x_sfp_e3_set_transmitter(params, phy, 1);
+                                        bnx2x_sfp_module_detection(phy, params);
+                                else
+                                        bnx2x_sfp_e3_set_transmitter(params,
+                                                                     phy, 1);
+                        }
                        bnx2x_warpcore_config_sfi(phy, params);
                        break;
@@ -5757,6 +5778,11 @@ static int bnx2x_warpcore_read_status(struct bnx2x_phy *phy,
        rc = bnx2x_get_link_speed_duplex(phy, params, vars, link_up, gp_speed,
                                         duplex);
+        /* In case of KR link down, start up the recovering procedure */
+        if ((!link_up) && (phy->media_type == ETH_PHY_KR) &&
+            (!(phy->flags & FLAGS_WC_DUAL_MODE)))
+                vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
        DP(NETIF_MSG_LINK, "duplex %x  flow_ctrl 0x%x link_status 0x%x\n",
                   vars->duplex, vars->flow_ctrl, vars->link_status);
        return rc;
@@ -6507,6 +6533,11 @@ static int bnx2x_link_initialize(struct link_params *params,
                        params->phy[INT_PHY].config_init(phy, params, vars);
        }
+        /* Re-read this value in case it was changed inside config_init due to
+         * limitations of optic module
+         */
+        vars->line_speed = params->phy[INT_PHY].req_line_speed;
        /* Init external phy*/
        if (non_ext_phy) {
                if (params->phy[INT_PHY].supported &
@@ -8080,7 +8111,10 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                if (copper_module_type &
                    SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_ACTIVE) {
                        DP(NETIF_MSG_LINK, "Active Copper cable detected\n");
-                        check_limiting_mode = 1;
+                        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT)
+                                *edc_mode = EDC_MODE_ACTIVE_DAC;
+                        else
+                                check_limiting_mode = 1;
                } else if (copper_module_type &
                        SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
                                DP(NETIF_MSG_LINK,
@@ -8555,6 +8589,7 @@ static void bnx2x_warpcore_set_limiting_mode(struct link_params *params,
                mode = MDIO_WC_REG_UC_INFO_B1_FIRMWARE_MODE_DEFAULT;
                break;
        case EDC_MODE_PASSIVE_DAC:
+        case EDC_MODE_ACTIVE_DAC:
                mode = MDIO_WC_REG_UC_INFO_B1_FIRMWARE_MODE_SFP_DAC;
                break;
        default:
@@ -9730,32 +9765,41 @@ static int bnx2x_848xx_cmn_config_init(struct bnx2x_phy *phy,
                         MDIO_AN_DEVAD, MDIO_AN_REG_8481_1000T_CTRL,
                         an_1000_val);
-        /* set 100 speed advertisement */
+        /* Set 10/100 speed advertisement */
-        if ((phy->req_line_speed == SPEED_AUTO_NEG) &&
+        if (phy->req_line_speed == SPEED_AUTO_NEG) {
-             (phy->speed_cap_mask &
+                if (phy->speed_cap_mask &
-              (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
-               PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF))) {
+                        /* Enable autoneg and restart autoneg for legacy speeds
-                an_10_100_val |= (1<<7);
+                         */
-                /* Enable autoneg and restart autoneg for legacy speeds */
+                        autoneg_val |= (1<<9 | 1<<12);
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
                        an_10_100_val |= (1<<8);
-                DP(NETIF_MSG_LINK, "Advertising 100M\n");
+                        DP(NETIF_MSG_LINK, "Advertising 100M-FD\n");
-        }
+                }
-        /* set 10 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+                if (phy->speed_cap_mask &
-             (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
-              (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
+                        /* Enable autoneg and restart autoneg for legacy speeds
-               PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)) &&
+                         */
-             (phy->supported &
+                        autoneg_val |= (1<<9 | 1<<12);
-              (SUPPORTED_10baseT_Half |
+                        an_10_100_val |= (1<<7);
-               SUPPORTED_10baseT_Full)))) {
+                        DP(NETIF_MSG_LINK, "Advertising 100M-HD\n");
-                an_10_100_val |= (1<<5);
+                }
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
+                if ((phy->speed_cap_mask &
+                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) &&
+                    (phy->supported & SUPPORTED_10baseT_Full)) {
                        an_10_100_val |= (1<<6);
-                DP(NETIF_MSG_LINK, "Advertising 10M\n");
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-FD\n");
+                }
+                if ((phy->speed_cap_mask &
+                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) &&
+                    (phy->supported & SUPPORTED_10baseT_Half)) {
+                        an_10_100_val |= (1<<5);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-HD\n");
+                }
        }
        /* Only 10/100 are allowed to work in FORCE mode */
@@ -13432,43 +13476,6 @@ static void bnx2x_sfp_tx_fault_detection(struct bnx2x_phy *phy,
                }
        }
 }
-static void bnx2x_disable_kr2(struct link_params *params,
-                              struct link_vars *vars,
-                              struct bnx2x_phy *phy)
-{
-        struct bnx2x *bp = params->bp;
-        int i;
-        static struct bnx2x_reg_set reg_set[] = {
-                /* Step 1 - Program the TX/RX alignment markers */
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL5, 0x7690},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL7, 0xe647},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL6, 0xc4f0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL9, 0x7690},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL11, 0xe647},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL10, 0xc4f0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_USERB0_CTRL, 0x000c},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL1, 0x6000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL3, 0x0000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CODE_FIELD, 0x0002},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI1, 0x0000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI2, 0x0af7},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI3, 0x0af7},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_BAM_CODE, 0x0002},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_UD_CODE, 0x0000}
-        };
-        DP(NETIF_MSG_LINK, "Disabling 20G-KR2\n");
-        for (i = 0; i < ARRAY_SIZE(reg_set); i++)
-                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
-                                 reg_set[i].val);
-        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
-        bnx2x_update_link_attr(params, vars->link_attr_sync);
-        vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
-        /* Restart AN on leading lane */
-        bnx2x_warpcore_restart_AN_KR(phy, params);
-}
 static void bnx2x_kr2_recovery(struct link_params *params,
                               struct link_vars *vars,
                               struct bnx2x_phy *phy)
@@ -13546,6 +13553,8 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
                /* Disable KR2 on both lanes */
                DP(NETIF_MSG_LINK, "BP=0x%x, NP=0x%x\n", base_page, next_page);
                bnx2x_disable_kr2(params, vars, phy);
+                /* Restart AN on leading lane */
+                bnx2x_warpcore_restart_AN_KR(phy, params);
                return;
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index a6704b555042..82b658d8c04c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4703,6 +4703,14 @@ bool bnx2x_chk_parity_attn(struct bnx2x *bp, bool *global, bool print)
        attn.sig[3] = REG_RD(bp,
                MISC_REG_AEU_AFTER_INVERT_4_FUNC_0 +
                             port*4);
+        /* Since MCP attentions can't be disabled inside the block, we need to
+         * read AEU registers to see whether they're currently disabled
+         */
+        attn.sig[3] &= ((REG_RD(bp,
+                                !port ? MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0
+                                      : MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0) &
+                         MISC_AEU_ENABLE_MCP_PRTY_BITS) |
+                        ~MISC_AEU_ENABLE_MCP_PRTY_BITS);
        if (!CHIP_IS_E1x(bp))
                attn.sig[4] = REG_RD(bp,
@@ -5447,26 +5455,24 @@ static void bnx2x_timer(unsigned long data)
        if (IS_PF(bp) &&
            !BP_NOMCP(bp)) {
                int mb_idx = BP_FW_MB_IDX(bp);
-                u32 drv_pulse;
+                u16 drv_pulse;
-                u32 mcp_pulse;
+                u16 mcp_pulse;
                ++bp->fw_drv_pulse_wr_seq;
                bp->fw_drv_pulse_wr_seq &= DRV_PULSE_SEQ_MASK;
-                /* TBD - add SYSTEM_TIME */
                drv_pulse = bp->fw_drv_pulse_wr_seq;
                bnx2x_drv_pulse(bp);
                mcp_pulse = (SHMEM_RD(bp, func_mb[mb_idx].mcp_pulse_mb) &
                             MCP_PULSE_SEQ_MASK);
                /* The delta between driver pulse and mcp response
-                 * should be 1 (before mcp response) or 0 (after mcp response)
+                 * should not get too big. If the MFW is more than 5 pulses
+                 * behind, we should worry about it enough to generate an error
+                 * log.
                 */
-                if ((drv_pulse != mcp_pulse) &&
+                if (((drv_pulse - mcp_pulse) & MCP_PULSE_SEQ_MASK) > 5)
-                    (drv_pulse != ((mcp_pulse + 1) & MCP_PULSE_SEQ_MASK))) {
+                        BNX2X_ERR("MFW seems hanged: drv_pulse (0x%x) != mcp_pulse (0x%x)\n",
-                        /* someone lost a heartbeat... */
-                        BNX2X_ERR("drv_pulse (0x%x) != mcp_pulse (0x%x)\n",
                                  drv_pulse, mcp_pulse);
-                }
        }
        if (bp->state == BNX2X_STATE_OPEN)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 2604b6204abe..9ad012bdd915 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1819,7 +1819,7 @@ bnx2x_get_vf_igu_cam_info(struct bnx2x *bp)
                fid = GET_FIELD((val), IGU_REG_MAPPING_MEMORY_FID);
                if (fid & IGU_FID_ENCODE_IS_PF)
                        current_pf = fid & IGU_FID_PF_NUM_MASK;
-                else if (current_pf == BP_ABS_FUNC(bp))
+                else if (current_pf == BP_FUNC(bp))
                        bnx2x_vf_set_igu_info(bp, sb_id,
                                              (fid & IGU_FID_VF_NUM_MASK));
                DP(BNX2X_MSG_IOV, "%s[%d], igu_sb_id=%d, msix=%d\n",
@@ -3180,6 +3180,7 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                /* set local queue arrays */
                vf->vfqs = &bp->vfdb->vfqs[qcount];
                qcount += vf_sb_count(vf);
+                bnx2x_iov_static_resc(bp, vf);
        }
        /* prepare msix vectors in VF configuration space */
@@ -3187,6 +3188,8 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                bnx2x_pretend_func(bp, HW_VF_HANDLE(bp, vf_idx));
                REG_WR(bp, PCICFG_OFFSET + GRC_CONFIG_REG_VF_MSIX_CONTROL,
                       num_vf_queues);
+                DP(BNX2X_MSG_IOV, "set msix vec num in VF %d cfg space to %d\n",
+                   vf_idx, num_vf_queues);
        }
        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 6cfb88732452..da16953eb2ec 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -1765,28 +1765,28 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
                switch (mbx->first_tlv.tl.type) {
                case CHANNEL_TLV_ACQUIRE:
                        bnx2x_vf_mbx_acquire(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_INIT:
                        bnx2x_vf_mbx_init_vf(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_SETUP_Q:
                        bnx2x_vf_mbx_setup_q(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_SET_Q_FILTERS:
                        bnx2x_vf_mbx_set_q_filters(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_TEARDOWN_Q:
                        bnx2x_vf_mbx_teardown_q(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_CLOSE:
                        bnx2x_vf_mbx_close_vf(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_RELEASE:
                        bnx2x_vf_mbx_release_vf(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_UPDATE_RSS:
                        bnx2x_vf_mbx_update_rss(bp, vf, mbx);
-                        break;
+                        return;
                }
        } else {
@@ -1802,26 +1802,24 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
                for (i = 0; i < 20; i++)
                        DP_CONT(BNX2X_MSG_IOV, "%x ",
                                mbx->msg->req.tlv_buf_size.tlv_buffer[i]);
+        }
-                /* test whether we can respond to the VF (do we have an address
+        /* can we respond to VF (do we have an address for it?) */
-                 * for it?)
+        if (vf->state == VF_ACQUIRED || vf->state == VF_ENABLED) {
-                 */
+                /* mbx_resp uses the op_rc of the VF */
-                if (vf->state == VF_ACQUIRED || vf->state == VF_ENABLED) {
+                vf->op_rc = PFVF_STATUS_NOT_SUPPORTED;
-                        /* mbx_resp uses the op_rc of the VF */
-                        vf->op_rc = PFVF_STATUS_NOT_SUPPORTED;
-                        /* notify the VF that we do not support this request */
+                /* notify the VF that we do not support this request */
-                        bnx2x_vf_mbx_resp(bp, vf);
+                bnx2x_vf_mbx_resp(bp, vf);
-                } else {
+        } else {
-                        /* can't send a response since this VF is unknown to us
+                /* can't send a response since this VF is unknown to us
-                         * just ack the FW to release the mailbox and unlock
+                 * just ack the FW to release the mailbox and unlock
-                         * the channel.
+                 * the channel.
-                         */
+                 */
-                        storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
+                storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
-                        mmiowb();
+                /* Firmware ack should be written before unlocking channel */
-                        bnx2x_unlock_vf_pf_channel(bp, vf,
+                mmiowb();
-                                                   mbx->first_tlv.tl.type);
+                bnx2x_unlock_vf_pf_channel(bp, vf, mbx->first_tlv.tl.type);
-                }
        }
 }
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index ace5050dba38..db020230bd0b 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -88,6 +88,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define BE_MIN_MTU              256
 #define BE_NUM_VLANS_SUPPORTED  64
+#define BE_UMC_NUM_VLANS_SUPPORTED      15
 #define BE_MAX_EQD              96u
 #define BE_MAX_TX_FRAG_COUNT    30
@@ -333,6 +334,7 @@ enum vf_state {
 #define BE_FLAGS_LINK_STATUS_INIT               1
 #define BE_FLAGS_WORKER_SCHEDULED               (1 << 3)
+#define BE_FLAGS_VLAN_PROMISC                   (1 << 4)
 #define BE_FLAGS_NAPI_ENABLED                   (1 << 9)
 #define BE_UC_PMAC_COUNT                30
 #define BE_VF_UC_PMAC_COUNT             2
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 1ab5dab11eff..bd0e0c0bbcd8 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -180,6 +180,9 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                        dev_err(&adapter->pdev->dev,
                                "opcode %d-%d failed:status %d-%d\n",
                                opcode, subsystem, compl_status, extd_status);
+                        if (extd_status == MCC_ADDL_STS_INSUFFICIENT_RESOURCES)
+                                return extd_status;
                }
        }
 done:
@@ -1812,6 +1815,12 @@ int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
        } else if (flags & IFF_ALLMULTI) {
                req->if_flags_mask = req->if_flags =
                                cpu_to_le32(BE_IF_FLAGS_MCAST_PROMISCUOUS);
+        } else if (flags & BE_FLAGS_VLAN_PROMISC) {
+                req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_VLAN_PROMISCUOUS);
+                if (value == ON)
+                        req->if_flags =
+                                cpu_to_le32(BE_IF_FLAGS_VLAN_PROMISCUOUS);
        } else {
                struct netdev_hw_addr *ha;
                int i = 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index d026226db88c..108ca8abf0af 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -60,6 +60,8 @@ enum {
        MCC_STATUS_NOT_SUPPORTED = 66
 };
+#define MCC_ADDL_STS_INSUFFICIENT_RESOURCES     0x16
 #define CQE_STATUS_COMPL_MASK           0xFFFF
 #define CQE_STATUS_COMPL_SHIFT          0       /* bits 0 - 15 */
 #define CQE_STATUS_EXTD_MASK            0xFFFF
@@ -1791,7 +1793,7 @@ struct be_nic_res_desc {
        u8 acpi_params;
        u8 wol_param;
        u16 rsvd7;
-        u32 rsvd8[3];
+        u32 rsvd8[7];
 } __packed;
 struct be_cmd_req_get_func_config {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 100b528b9bd0..2c38cc402119 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -855,11 +855,11 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
        unsigned int eth_hdr_len;
        struct iphdr *ip;
-        /* Lancer ASIC has a bug wherein packets that are 32 bytes or less
+        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or less
         * may cause a transmit stall on that port. So the work-around is to
-         * pad such packets to a 36-byte length.
+         * pad short packets (<= 32 bytes) to a 36-byte length.
         */
-        if (unlikely(lancer_chip(adapter) && skb->len <= 32)) {
+        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
                if (skb_padto(skb, 36))
                        goto tx_drop;
                skb->len = 36;
@@ -1013,18 +1013,40 @@ static int be_vid_config(struct be_adapter *adapter)
        status = be_cmd_vlan_config(adapter, adapter->if_handle,
                                    vids, num, 1, 0);
-        /* Set to VLAN promisc mode as setting VLAN filter failed */
        if (status) {
-                dev_info(&adapter->pdev->dev, "Exhausted VLAN HW filters.\n");
+                /* Set to VLAN promisc mode as setting VLAN filter failed */
-                dev_info(&adapter->pdev->dev, "Disabling HW VLAN filtering.\n");
+                if (status == MCC_ADDL_STS_INSUFFICIENT_RESOURCES)
-                goto set_vlan_promisc;
+                        goto set_vlan_promisc;
+                dev_err(&adapter->pdev->dev,
+                        "Setting HW VLAN filtering failed.\n");
+        } else {
+                if (adapter->flags & BE_FLAGS_VLAN_PROMISC) {
+                        /* hw VLAN filtering re-enabled. */
+                        status = be_cmd_rx_filter(adapter,
+                                                  BE_FLAGS_VLAN_PROMISC, OFF);
+                        if (!status) {
+                                dev_info(&adapter->pdev->dev,
+                                         "Disabling VLAN Promiscuous mode.\n");
+                                adapter->flags &= ~BE_FLAGS_VLAN_PROMISC;
+                                dev_info(&adapter->pdev->dev,
+                                         "Re-Enabling HW VLAN filtering\n");
+                        }
+                }
        }
        return status;
 set_vlan_promisc:
-        status = be_cmd_vlan_config(adapter, adapter->if_handle,
+        dev_warn(&adapter->pdev->dev, "Exhausted VLAN HW filters.\n");
-                                    NULL, 0, 1, 1);
+        status = be_cmd_rx_filter(adapter, BE_FLAGS_VLAN_PROMISC, ON);
+        if (!status) {
+                dev_info(&adapter->pdev->dev, "Enable VLAN Promiscuous mode\n");
+                dev_info(&adapter->pdev->dev, "Disabling HW VLAN filtering\n");
+                adapter->flags |= BE_FLAGS_VLAN_PROMISC;
+        } else
+                dev_err(&adapter->pdev->dev,
+                        "Failed to enable VLAN Promiscuous mode.\n");
        return status;
 }
@@ -1033,10 +1055,6 @@ static int be_vlan_add_vid(struct net_device *netdev, __be16 proto, u16 vid)
        struct be_adapter *adapter = netdev_priv(netdev);
        int status = 0;
-        if (!lancer_chip(adapter) && !be_physfn(adapter)) {
-                status = -EINVAL;
-                goto ret;
-        }
        /* Packets with VID 0 are always received by Lancer by default */
        if (lancer_chip(adapter) && vid == 0)
@@ -1059,11 +1077,6 @@ static int be_vlan_rem_vid(struct net_device *netdev, __be16 proto, u16 vid)
        struct be_adapter *adapter = netdev_priv(netdev);
        int status = 0;
-        if (!lancer_chip(adapter) && !be_physfn(adapter)) {
-                status = -EINVAL;
-                goto ret;
-        }
        /* Packets with VID 0 are always received by Lancer by default */
        if (lancer_chip(adapter) && vid == 0)
                goto ret;
@@ -1188,8 +1201,8 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
        vi->vf = vf;
        vi->tx_rate = vf_cfg->tx_rate;
-        vi->vlan = vf_cfg->vlan_tag;
+        vi->vlan = vf_cfg->vlan_tag & VLAN_VID_MASK;
-        vi->qos = 0;
+        vi->qos = vf_cfg->vlan_tag >> VLAN_PRIO_SHIFT;
        memcpy(&vi->mac, vf_cfg->mac_addr, ETH_ALEN);
        return 0;
@@ -1199,28 +1212,29 @@ static int be_set_vf_vlan(struct net_device *netdev,
                        int vf, u16 vlan, u8 qos)
 {
        struct be_adapter *adapter = netdev_priv(netdev);
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
        int status = 0;
        if (!sriov_enabled(adapter))
                return -EPERM;
-        if (vf >= adapter->num_vfs || vlan > 4095)
+        if (vf >= adapter->num_vfs || vlan > 4095 || qos > 7)
                return -EINVAL;
-        if (vlan) {
+        if (vlan || qos) {
-                if (adapter->vf_cfg[vf].vlan_tag != vlan) {
+                vlan |= qos << VLAN_PRIO_SHIFT;
+                if (vf_cfg->vlan_tag != vlan) {
                        /* If this is new value, program it. Else skip. */
-                        adapter->vf_cfg[vf].vlan_tag = vlan;
+                        vf_cfg->vlan_tag = vlan;
+                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                        status = be_cmd_set_hsw_config(adapter, vlan,
+                                                       vf_cfg->if_handle, 0);
-                                vf + 1, adapter->vf_cfg[vf].if_handle, 0);
                }
        } else {
                /* Reset Transparent Vlan Tagging. */
-                adapter->vf_cfg[vf].vlan_tag = 0;
+                vf_cfg->vlan_tag = 0;
-                vlan = adapter->vf_cfg[vf].def_vid;
+                vlan = vf_cfg->def_vid;
                status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                        adapter->vf_cfg[vf].if_handle, 0);
+                                               vf_cfg->if_handle, 0);
        }
@@ -2963,6 +2977,8 @@ static void BEx_get_resources(struct be_adapter *adapter,
        if (adapter->function_mode & FLEX10_MODE)
                res->max_vlans = BE_NUM_VLANS_SUPPORTED/8;
+        else if (adapter->function_mode & UMC_ENABLED)
+                res->max_vlans = BE_UMC_NUM_VLANS_SUPPORTED;
        else
                res->max_vlans = BE_NUM_VLANS_SUPPORTED;
        res->max_mcast_mac = BE_MAX_MC;
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index 098f133908ae..e006a09ba899 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -452,7 +452,9 @@ static int gianfar_ptp_probe(struct platform_device *dev)
        err = -ENODEV;
        etsects->caps = ptp_gianfar_caps;
-        etsects->cksel = DEFAULT_CKSEL;
+        if (get_of_u32(node, "fsl,cksel", &etsects->cksel))
+                etsects->cksel = DEFAULT_CKSEL;
        if (get_of_u32(node, "fsl,tclk-period", &etsects->tclk_period) ||
            get_of_u32(node, "fsl,tmr-prsc", &etsects->tmr_prsc) ||
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.c b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
index 0c524fa9f811..cfef7fc32cdd 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
@@ -701,8 +701,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
        details = I40E_ADMINQ_DETAILS(hw->aq.asq, hw->aq.asq.next_to_use);
        if (cmd_details) {
-                memcpy(details, cmd_details,
+                *details = *cmd_details;
-                       sizeof(struct i40e_asq_cmd_details));
                /* If the cmd_details are defined copy the cookie.  The
                 * cpu_to_le32 is not needed here because the data is ignored
@@ -760,7 +759,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
        desc_on_ring = I40E_ADMINQ_DESC(hw->aq.asq, hw->aq.asq.next_to_use);
        /* if the desc is available copy the temp desc to the right place */
-        memcpy(desc_on_ring, desc, sizeof(struct i40e_aq_desc));
+        *desc_on_ring = *desc;
        /* if buff is not NULL assume indirect command */
        if (buff != NULL) {
@@ -807,7 +806,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
        /* if ready, copy the desc back to temp */
        if (i40e_asq_done(hw)) {
-                memcpy(desc, desc_on_ring, sizeof(struct i40e_aq_desc));
+                *desc = *desc_on_ring;
                if (buff != NULL)
                        memcpy(buff, dma_buff->va, buff_size);
                retval = le16_to_cpu(desc->retval);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index c21df7bc3b1d..1e4ea134975a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -507,7 +507,7 @@ i40e_status i40e_aq_get_link_info(struct i40e_hw *hw,
        /* save link status information */
        if (link)
-                memcpy(link, hw_link_info, sizeof(struct i40e_link_status));
+                *link = *hw_link_info;
        /* flag cleared so helper functions don't call AQ again */
        hw->phy.get_link_info = false;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 601d482694ea..221aa4795017 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -101,10 +101,10 @@ int i40e_allocate_dma_mem_d(struct i40e_hw *hw, struct i40e_dma_mem *mem,
        mem->size = ALIGN(size, alignment);
        mem->va = dma_zalloc_coherent(&pf->pdev->dev, mem->size,
                                      &mem->pa, GFP_KERNEL);
-        if (mem->va)
+        if (!mem->va)
-                return 0;
+                return -ENOMEM;
-        return -ENOMEM;
+        return 0;
 }
 /**
@@ -136,10 +136,10 @@ int i40e_allocate_virt_mem_d(struct i40e_hw *hw, struct i40e_virt_mem *mem,
        mem->size = size;
        mem->va = kzalloc(size, GFP_KERNEL);
-        if (mem->va)
+        if (!mem->va)
-                return 0;
+                return -ENOMEM;
-        return -ENOMEM;
+        return 0;
 }
 /**
@@ -174,8 +174,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
                         u16 needed, u16 id)
 {
        int ret = -ENOMEM;
-        int i = 0;
+        int i, j;
-        int j = 0;
        if (!pile || needed == 0 || id >= I40E_PILE_VALID_BIT) {
                dev_info(&pf->pdev->dev,
@@ -186,7 +185,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
        /* start the linear search with an imperfect hint */
        i = pile->search_hint;
-        while (i < pile->num_entries && ret < 0) {
+        while (i < pile->num_entries) {
                /* skip already allocated entries */
                if (pile->list[i] & I40E_PILE_VALID_BIT) {
                        i++;
@@ -205,6 +204,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
                                pile->list[i+j] = id | I40E_PILE_VALID_BIT;
                        ret = i;
                        pile->search_hint = i + j;
+                        break;
                } else {
                        /* not enough, so skip over it and continue looking */
                        i += j;
@@ -1388,7 +1388,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
        bool add_happened = false;
        int filter_list_len = 0;
        u32 changed_flags = 0;
-        i40e_status ret = 0;
+        i40e_status aq_ret = 0;
        struct i40e_pf *pf;
        int num_add = 0;
        int num_del = 0;
@@ -1449,28 +1449,28 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                        /* flush a full buffer */
                        if (num_del == filter_list_len) {
-                                ret = i40e_aq_remove_macvlan(&pf->hw,
+                                aq_ret = i40e_aq_remove_macvlan(&pf->hw,
                                            vsi->seid, del_list, num_del,
                                            NULL);
                                num_del = 0;
                                memset(del_list, 0, sizeof(*del_list));
-                                if (ret)
+                                if (aq_ret)
                                        dev_info(&pf->pdev->dev,
                                                 "ignoring delete macvlan error, err %d, aq_err %d while flushing a full buffer\n",
-                                                 ret,
+                                                 aq_ret,
                                                 pf->hw.aq.asq_last_status);
                        }
                }
                if (num_del) {
-                        ret = i40e_aq_remove_macvlan(&pf->hw, vsi->seid,
+                        aq_ret = i40e_aq_remove_macvlan(&pf->hw, vsi->seid,
                                                     del_list, num_del, NULL);
                        num_del = 0;
-                        if (ret)
+                        if (aq_ret)
                                dev_info(&pf->pdev->dev,
                                         "ignoring delete macvlan error, err %d, aq_err %d\n",
-                                         ret, pf->hw.aq.asq_last_status);
+                                         aq_ret, pf->hw.aq.asq_last_status);
                }
                kfree(del_list);
@@ -1515,32 +1515,30 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                        /* flush a full buffer */
                        if (num_add == filter_list_len) {
-                                ret = i40e_aq_add_macvlan(&pf->hw,
+                                aq_ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
-                                                          vsi->seid,
+                                                             add_list, num_add,
-                                                          add_list,
+                                                             NULL);
-                                                          num_add,
-                                                          NULL);
                                num_add = 0;
-                                if (ret)
+                                if (aq_ret)
                                        break;
                                memset(add_list, 0, sizeof(*add_list));
                        }
                }
                if (num_add) {
-                        ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
+                        aq_ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
-                                                  add_list, num_add, NULL);
+                                                     add_list, num_add, NULL);
                        num_add = 0;
                }
                kfree(add_list);
                add_list = NULL;
-                if (add_happened && (!ret)) {
+                if (add_happened && (!aq_ret)) {
                        /* do nothing */;
-                } else if (add_happened && (ret)) {
+                } else if (add_happened && (aq_ret)) {
                        dev_info(&pf->pdev->dev,
                                 "add filter failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
                        if ((pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOSPC) &&
                            !test_bit(__I40E_FILTER_OVERFLOW_PROMISC,
                                      &vsi->state)) {
@@ -1556,28 +1554,27 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
        if (changed_flags & IFF_ALLMULTI) {
                bool cur_multipromisc;
                cur_multipromisc = !!(vsi->current_netdev_flags & IFF_ALLMULTI);
-                ret = i40e_aq_set_vsi_multicast_promiscuous(&vsi->back->hw,
+                aq_ret = i40e_aq_set_vsi_multicast_promiscuous(&vsi->back->hw,
-                                                            vsi->seid,
+                                                               vsi->seid,
-                                                            cur_multipromisc,
+                                                               cur_multipromisc,
-                                                            NULL);
+                                                               NULL);
-                if (ret)
+                if (aq_ret)
                        dev_info(&pf->pdev->dev,
                                 "set multi promisc failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
        }
        if ((changed_flags & IFF_PROMISC) || promisc_forced_on) {
                bool cur_promisc;
                cur_promisc = (!!(vsi->current_netdev_flags & IFF_PROMISC) ||
                               test_bit(__I40E_FILTER_OVERFLOW_PROMISC,
                                        &vsi->state));
-                ret = i40e_aq_set_vsi_unicast_promiscuous(&vsi->back->hw,
+                aq_ret = i40e_aq_set_vsi_unicast_promiscuous(&vsi->back->hw,
-                                                          vsi->seid,
+                                                             vsi->seid,
-                                                          cur_promisc,
+                                                             cur_promisc, NULL);
-                                                          NULL);
+                if (aq_ret)
-                if (ret)
                        dev_info(&pf->pdev->dev,
                                 "set uni promisc failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
        }
        clear_bit(__I40E_CONFIG_BUSY, &vsi->state);
@@ -1790,6 +1787,8 @@ int i40e_vsi_add_vlan(struct i40e_vsi *vsi, s16 vid)
 * i40e_vsi_kill_vlan - Remove vsi membership for given vlan
 * @vsi: the vsi being configured
 * @vid: vlan id to be removed (0 = untagged only , -1 = any)
+ *
+ * Return: 0 on success or negative otherwise
 **/
 int i40e_vsi_kill_vlan(struct i40e_vsi *vsi, s16 vid)
 {
@@ -1863,37 +1862,39 @@ int i40e_vsi_kill_vlan(struct i40e_vsi *vsi, s16 vid)
 * i40e_vlan_rx_add_vid - Add a vlan id filter to HW offload
 * @netdev: network interface to be adjusted
 * @vid: vlan id to be added
+ *
+ * net_device_ops implementation for adding vlan ids
 **/
 static int i40e_vlan_rx_add_vid(struct net_device *netdev,
                                __always_unused __be16 proto, u16 vid)
 {
        struct i40e_netdev_priv *np = netdev_priv(netdev);
        struct i40e_vsi *vsi = np->vsi;
-        int ret;
+        int ret = 0;
        if (vid > 4095)
-                return 0;
+                return -EINVAL;
+        netdev_info(netdev, "adding %pM vid=%d\n", netdev->dev_addr, vid);
-        netdev_info(vsi->netdev, "adding %pM vid=%d\n",
-                    netdev->dev_addr, vid);
        /* If the network stack called us with vid = 0, we should
         * indicate to i40e_vsi_add_vlan() that we want to receive
         * any traffic (i.e. with any vlan tag, or untagged)
         */
        ret = i40e_vsi_add_vlan(vsi, vid ? vid : I40E_VLAN_ANY);
-        if (!ret) {
+        if (!ret && (vid < VLAN_N_VID))
-                if (vid < VLAN_N_VID)
+                set_bit(vid, vsi->active_vlans);
-                        set_bit(vid, vsi->active_vlans);
-        }
-        return 0;
+        return ret;
 }
 /**
 * i40e_vlan_rx_kill_vid - Remove a vlan id filter from HW offload
 * @netdev: network interface to be adjusted
 * @vid: vlan id to be removed
+ *
+ * net_device_ops implementation for adding vlan ids
 **/
 static int i40e_vlan_rx_kill_vid(struct net_device *netdev,
                                 __always_unused __be16 proto, u16 vid)
@@ -1901,15 +1902,16 @@ static int i40e_vlan_rx_kill_vid(struct net_device *netdev,
        struct i40e_netdev_priv *np = netdev_priv(netdev);
        struct i40e_vsi *vsi = np->vsi;
-        netdev_info(vsi->netdev, "removing %pM vid=%d\n",
+        netdev_info(netdev, "removing %pM vid=%d\n", netdev->dev_addr, vid);
-                    netdev->dev_addr, vid);
        /* return code is ignored as there is nothing a user
         * can do about failure to remove and a log message was
-         * already printed from another function
+         * already printed from the other function
         */
        i40e_vsi_kill_vlan(vsi, vid);
        clear_bit(vid, vsi->active_vlans);
        return 0;
 }
@@ -1936,10 +1938,10 @@ static void i40e_restore_vlan(struct i40e_vsi *vsi)
 * @vsi: the vsi being adjusted
 * @vid: the vlan id to set as a PVID
 **/
-i40e_status i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
+int i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
 {
        struct i40e_vsi_context ctxt;
-        i40e_status ret;
+        i40e_status aq_ret;
        vsi->info.valid_sections = cpu_to_le16(I40E_AQ_VSI_PROP_VLAN_VALID);
        vsi->info.pvid = cpu_to_le16(vid);
@@ -1948,14 +1950,15 @@ i40e_status i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
        ctxt.seid = vsi->seid;
        memcpy(&ctxt.info, &vsi->info, sizeof(vsi->info));
-        ret = i40e_aq_update_vsi_params(&vsi->back->hw, &ctxt, NULL);
+        aq_ret = i40e_aq_update_vsi_params(&vsi->back->hw, &ctxt, NULL);
-        if (ret) {
+        if (aq_ret) {
                dev_info(&vsi->back->pdev->dev,
                         "%s: update vsi failed, aq_err=%d\n",
                         __func__, vsi->back->hw.aq.asq_last_status);
+                return -ENOENT;
        }
-        return ret;
+        return 0;
 }
 /**
@@ -3326,7 +3329,8 @@ static void i40e_pf_unquiesce_all_vsi(struct i40e_pf *pf)
 **/
 static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
 {
-        int num_tc = 0, i;
+        u8 num_tc = 0;
+        int i;
        /* Scan the ETS Config Priority Table to find
         * traffic class enabled for a given priority
@@ -3341,9 +3345,7 @@ static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
        /* Traffic class index starts from zero so
         * increment to return the actual count
         */
-        num_tc++;
+        return num_tc + 1;
-        return num_tc;
 }
 /**
@@ -3451,28 +3453,27 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
        struct i40e_aqc_query_vsi_bw_config_resp bw_config = {0};
        struct i40e_pf *pf = vsi->back;
        struct i40e_hw *hw = &pf->hw;
+        i40e_status aq_ret;
        u32 tc_bw_max;
-        int ret;
        int i;
        /* Get the VSI level BW configuration */
-        ret = i40e_aq_query_vsi_bw_config(hw, vsi->seid, &bw_config, NULL);
+        aq_ret = i40e_aq_query_vsi_bw_config(hw, vsi->seid, &bw_config, NULL);
-        if (ret) {
+        if (aq_ret) {
                dev_info(&pf->pdev->dev,
                         "couldn't get pf vsi bw config, err %d, aq_err %d\n",
-                         ret, pf->hw.aq.asq_last_status);
+                         aq_ret, pf->hw.aq.asq_last_status);
-                return ret;
+                return -EINVAL;
        }
        /* Get the VSI level BW configuration per TC */
-        ret = i40e_aq_query_vsi_ets_sla_config(hw, vsi->seid,
+        aq_ret = i40e_aq_query_vsi_ets_sla_config(hw, vsi->seid, &bw_ets_config,
-                                               &bw_ets_config,
+                                                  NULL);
-                                               NULL);
+        if (aq_ret) {
-        if (ret) {
                dev_info(&pf->pdev->dev,
                         "couldn't get pf vsi ets bw config, err %d, aq_err %d\n",
-                         ret, pf->hw.aq.asq_last_status);
+                         aq_ret, pf->hw.aq.asq_last_status);
-                return ret;
+                return -EINVAL;
        }
        if (bw_config.tc_valid_bits != bw_ets_config.tc_valid_bits) {
@@ -3494,7 +3495,8 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
                /* 3 bits out of 4 for each TC */
                vsi->bw_ets_max_quanta[i] = (u8)((tc_bw_max >> (i*4)) & 0x7);
        }
-        return ret;
+        return 0;
 }
 /**
@@ -3505,30 +3507,30 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
 *
 * Returns 0 on success, negative value on failure
 **/
-static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi,
+static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi, u8 enabled_tc,
-                                       u8 enabled_tc,
                                       u8 *bw_share)
 {
        struct i40e_aqc_configure_vsi_tc_bw_data bw_data;
-        int i, ret = 0;
+        i40e_status aq_ret;
+        int i;
        bw_data.tc_valid_bits = enabled_tc;
        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                bw_data.tc_bw_credits[i] = bw_share[i];
-        ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid,
+        aq_ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data,
-                                       &bw_data, NULL);
+                                          NULL);
-        if (ret) {
+        if (aq_ret) {
                dev_info(&vsi->back->pdev->dev,
                         "%s: AQ command Config VSI BW allocation per TC failed = %d\n",
                         __func__, vsi->back->hw.aq.asq_last_status);
-                return ret;
+                return -EINVAL;
        }
        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                vsi->info.qs_handle[i] = bw_data.qs_handles[i];
-        return ret;
+        return 0;
 }
 /**
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 48cbc833b051..86d51429a189 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1607,6 +1607,9 @@ static int igb_integrated_phy_loopback(struct igb_adapter *adapter)
                        igb_write_phy_reg(hw, I347AT4_PAGE_SELECT, 0);
                        igb_write_phy_reg(hw, PHY_CONTROL, 0x4140);
                }
+        } else if (hw->phy.type == e1000_phy_82580) {
+                /* enable MII loopback */
+                igb_write_phy_reg(hw, I82580_PHY_LBK_CTRL, 0x8041);
        }
        /* add small delay to avoid loopback test failure */
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 1a9c4f6269ea..ecc7f7b696b8 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -3086,13 +3086,16 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                                               PCI_DMA_FROMDEVICE);
                skge_rx_reuse(e, skge->rx_buf_size);
        } else {
+                struct skge_element ee;
                struct sk_buff *nskb;
                nskb = netdev_alloc_skb_ip_align(dev, skge->rx_buf_size);
                if (!nskb)
                        goto resubmit;
-                skb = e->skb;
+                ee = *e;
+                skb = ee.skb;
                prefetch(skb->data);
                if (skge_rx_setup(skge, e, nskb, skge->rx_buf_size) < 0) {
@@ -3101,8 +3104,8 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                }
                pci_unmap_single(skge->hw->pdev,
-                                 dma_unmap_addr(e, mapaddr),
+                                 dma_unmap_addr(&ee, mapaddr),
-                                 dma_unmap_len(e, maplen),
+                                 dma_unmap_len(&ee, maplen),
                                 PCI_DMA_FROMDEVICE);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5472cbd34028..6ca30739625f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -180,28 +180,32 @@ static int verify_block_sig(struct mlx5_cmd_prot_block *block)
        return 0;
 }
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token)
+static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
+                           int csum)
 {
        block->token = token;
-        block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 2);
+        if (csum) {
-        block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+                block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
+                                            sizeof(block->data) - 2);
+                block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+        }
 }
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
 {
        struct mlx5_cmd_mailbox *next = msg->next;
        while (next) {
-                calc_block_sig(next->buf, token);
+                calc_block_sig(next->buf, token, csum);
                next = next->next;
        }
 }
-static void set_signature(struct mlx5_cmd_work_ent *ent)
+static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
 {
        ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
-        calc_chain_sig(ent->in, ent->token);
+        calc_chain_sig(ent->in, ent->token, csum);
-        calc_chain_sig(ent->out, ent->token);
+        calc_chain_sig(ent->out, ent->token, csum);
 }
 static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -539,8 +543,7 @@ static void cmd_work_handler(struct work_struct *work)
        lay->type = MLX5_PCI_CMD_XPORT;
        lay->token = ent->token;
        lay->status_own = CMD_OWNER_HW;
-        if (!cmd->checksum_disabled)
+        set_signature(ent, !cmd->checksum_disabled);
-                set_signature(ent);
        dump_command(dev, ent, 1);
        ktime_get_ts(&ent->ts1);
@@ -773,8 +776,6 @@ static int mlx5_copy_from_msg(void *to, struct mlx5_cmd_msg *from, int size)
                copy = min_t(int, size, MLX5_CMD_DATA_BLOCK_SIZE);
                block = next->buf;
-                if (xor8_buf(block, sizeof(*block)) != 0xff)
-                        return -EINVAL;
                memcpy(to, block->data, copy);
                to += copy;
@@ -1361,6 +1362,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
                goto err_map;
        }
+        cmd->checksum_disabled = 1;
        cmd->max_reg_cmds = (1 << cmd->log_sz) - 1;
        cmd->bitmask = (1 << cmd->max_reg_cmds) - 1;
@@ -1510,7 +1512,7 @@ int mlx5_cmd_status_to_err(struct mlx5_outbox_hdr *hdr)
        case MLX5_CMD_STAT_BAD_SYS_STATE_ERR:           return -EIO;
        case MLX5_CMD_STAT_BAD_RES_ERR:                 return -EINVAL;
        case MLX5_CMD_STAT_RES_BUSY:                    return -EBUSY;
-        case MLX5_CMD_STAT_LIM_ERR:                     return -EINVAL;
+        case MLX5_CMD_STAT_LIM_ERR:                     return -ENOMEM;
        case MLX5_CMD_STAT_BAD_RES_STATE_ERR:           return -EINVAL;
        case MLX5_CMD_STAT_IX_ERR:                      return -EINVAL;
        case MLX5_CMD_STAT_NO_RES_ERR:                  return -EAGAIN;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index 443cc4d7b024..2231d93cc7ad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -366,9 +366,11 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
                goto err_in;
        }
+        snprintf(eq->name, MLX5_MAX_EQ_NAME, "%s@pci:%s",
+                 name, pci_name(dev->pdev));
        eq->eqn = out.eq_number;
        err = request_irq(table->msix_arr[vecidx].vector, mlx5_msix_handler, 0,
-                          name, eq);
+                          eq->name, eq);
        if (err)
                goto err_eq;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index b47739b0b5f6..bc0f5fb66e24 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -165,9 +165,7 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
        struct mlx5_cmd_set_hca_cap_mbox_in *set_ctx = NULL;
        struct mlx5_cmd_query_hca_cap_mbox_in query_ctx;
        struct mlx5_cmd_set_hca_cap_mbox_out set_out;
-        struct mlx5_profile *prof = dev->profile;
        u64 flags;
-        int csum = 1;
        int err;
        memset(&query_ctx, 0, sizeof(query_ctx));
@@ -197,20 +195,14 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
        memcpy(&set_ctx->hca_cap, &query_out->hca_cap,
               sizeof(set_ctx->hca_cap));
-        if (prof->mask & MLX5_PROF_MASK_CMDIF_CSUM) {
-                csum = !!prof->cmdif_csum;
-                flags = be64_to_cpu(set_ctx->hca_cap.flags);
-                if (csum)
-                        flags |= MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
-                else
-                        flags &= ~MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
-                set_ctx->hca_cap.flags = cpu_to_be64(flags);
-        }
        if (dev->profile->mask & MLX5_PROF_MASK_QP_SIZE)
                set_ctx->hca_cap.log_max_qp = dev->profile->log_max_qp;
+        flags = be64_to_cpu(query_out->hca_cap.flags);
+        /* disable checksum */
+        flags &= ~MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
+        set_ctx->hca_cap.flags = cpu_to_be64(flags);
        memset(&set_out, 0, sizeof(set_out));
        set_ctx->hca_cap.log_uar_page_sz = cpu_to_be16(PAGE_SHIFT - 12);
        set_ctx->hdr.opcode = cpu_to_be16(MLX5_CMD_OP_SET_HCA_CAP);
@@ -225,9 +217,6 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
        if (err)
                goto query_ex;
-        if (!csum)
-                dev->cmd.checksum_disabled = 1;
 query_ex:
        kfree(query_out);
        kfree(set_ctx);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 3a2408d44820..7b12acf210f8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -90,6 +90,10 @@ struct mlx5_manage_pages_outbox {
        __be64                  pas[0];
 };
+enum {
+        MAX_RECLAIM_TIME_MSECS  = 5000,
+};
 static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u16 func_id)
 {
        struct rb_root *root = &dev->priv.page_root;
@@ -279,6 +283,9 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
        int err;
        int i;
+        if (nclaimed)
+                *nclaimed = 0;
        memset(&in, 0, sizeof(in));
        outlen = sizeof(*out) + npages * sizeof(out->pas[0]);
        out = mlx5_vzalloc(outlen);
@@ -388,20 +395,25 @@ static int optimal_reclaimed_pages(void)
 int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev)
 {
-        unsigned long end = jiffies + msecs_to_jiffies(5000);
+        unsigned long end = jiffies + msecs_to_jiffies(MAX_RECLAIM_TIME_MSECS);
        struct fw_page *fwp;
        struct rb_node *p;
+        int nclaimed = 0;
        int err;
        do {
                p = rb_first(&dev->priv.page_root);
                if (p) {
                        fwp = rb_entry(p, struct fw_page, rb_node);
-                        err = reclaim_pages(dev, fwp->func_id, optimal_reclaimed_pages(), NULL);
+                        err = reclaim_pages(dev, fwp->func_id,
+                                            optimal_reclaimed_pages(),
+                                            &nclaimed);
                        if (err) {
                                mlx5_core_warn(dev, "failed reclaiming pages (%d)\n", err);
                                return err;
                        }
+                        if (nclaimed)
+                                end = jiffies + msecs_to_jiffies(MAX_RECLAIM_TIME_MSECS);
                }
                if (time_after(jiffies, end)) {
                        mlx5_core_warn(dev, "FW did not return all pages. giving up...\n");
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 83c2091c9c23..bd1a2d2bc2ae 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -543,7 +543,7 @@ static const struct of_device_id moxart_mac_match[] = {
        { }
 };
-struct __initdata platform_driver moxart_mac_driver = {
+static struct platform_driver moxart_mac_driver = {
        .probe  = moxart_mac_probe,
        .remove = moxart_remove,
        .driver = {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 4d7ad0074d1c..ebe4c86e5230 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1794,3 +1794,11 @@ const struct ethtool_ops qlcnic_sriov_vf_ethtool_ops = {
        .set_msglevel           = qlcnic_set_msglevel,
        .get_msglevel           = qlcnic_get_msglevel,
 };
+const struct ethtool_ops qlcnic_ethtool_failed_ops = {
+        .get_settings           = qlcnic_get_settings,
+        .get_drvinfo            = qlcnic_get_drvinfo,
+        .set_msglevel           = qlcnic_set_msglevel,
+        .get_msglevel           = qlcnic_get_msglevel,
+        .set_dump               = qlcnic_set_dump,
+};
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index c4c5023e1fdf..21d00a0449a1 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -431,6 +431,9 @@ static void qlcnic_82xx_cancel_idc_work(struct qlcnic_adapter *adapter)
        while (test_and_set_bit(__QLCNIC_RESETTING, &adapter->state))
                usleep_range(10000, 11000);
+        if (!adapter->fw_work.work.func)
+                return;
        cancel_delayed_work_sync(&adapter->fw_work);
 }
@@ -2275,8 +2278,9 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                adapter->portnum = adapter->ahw->pci_func;
                err = qlcnic_start_firmware(adapter);
                if (err) {
-                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n");
+                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n"
-                        goto err_out_free_hw;
+                                "\t\tIf reboot doesn't help, try flashing the card\n");
+                        goto err_out_maintenance_mode;
                }
                qlcnic_get_multiq_capability(adapter);
@@ -2408,6 +2412,22 @@ err_out_disable_pdev:
        pci_set_drvdata(pdev, NULL);
        pci_disable_device(pdev);
        return err;
+err_out_maintenance_mode:
+        netdev->netdev_ops = &qlcnic_netdev_failed_ops;
+        SET_ETHTOOL_OPS(netdev, &qlcnic_ethtool_failed_ops);
+        err = register_netdev(netdev);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to register net device\n");
+                qlcnic_clr_all_drv_state(adapter, 0);
+                goto err_out_free_hw;
+        }
+        pci_set_drvdata(pdev, adapter);
+        qlcnic_add_sysfs(adapter);
+        return 0;
 }
 static void qlcnic_remove(struct pci_dev *pdev)
@@ -2518,8 +2538,16 @@ static int qlcnic_resume(struct pci_dev *pdev)
 static int qlcnic_open(struct net_device *netdev)
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
+        u32 state;
        int err;
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD) {
+                netdev_err(netdev, "%s: Device is in FAILED state\n", __func__);
+                return -EIO;
+        }
        netif_carrier_off(netdev);
        err = qlcnic_attach(adapter);
@@ -3228,6 +3256,13 @@ void qlcnic_82xx_dev_request_reset(struct qlcnic_adapter *adapter, u32 key)
                return;
        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD) {
+                netdev_err(adapter->netdev, "%s: Device is in FAILED state\n",
+                           __func__);
+                qlcnic_api_unlock(adapter);
+                return;
+        }
        if (state == QLCNIC_DEV_READY) {
                QLC_SHARED_REG_WR32(adapter, QLCNIC_CRB_DEV_STATE,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 330d9a8774ad..686f460b1502 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -397,6 +397,7 @@ static int qlcnic_pci_sriov_disable(struct qlcnic_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
+        rtnl_lock();
        if (netif_running(netdev))
                __qlcnic_down(adapter, netdev);
@@ -407,12 +408,15 @@ static int qlcnic_pci_sriov_disable(struct qlcnic_adapter *adapter)
        /* After disabling SRIOV re-init the driver in default mode
           configure opmode based on op_mode of function
         */
-        if (qlcnic_83xx_configure_opmode(adapter))
+        if (qlcnic_83xx_configure_opmode(adapter)) {
+                rtnl_unlock();
                return -EIO;
+        }
        if (netif_running(netdev))
                __qlcnic_up(adapter, netdev);
+        rtnl_unlock();
        return 0;
 }
@@ -533,6 +537,7 @@ static int qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, int num_vfs)
                return -EIO;
        }
+        rtnl_lock();
        if (netif_running(netdev))
                __qlcnic_down(adapter, netdev);
@@ -555,6 +560,7 @@ static int qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, int num_vfs)
                __qlcnic_up(adapter, netdev);
 error:
+        rtnl_unlock();
        return err;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index c6165d05cc13..019f4377307f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1272,6 +1272,7 @@ void qlcnic_remove_sysfs_entries(struct qlcnic_adapter *adapter)
 void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
 {
        struct device *dev = &adapter->pdev->dev;
+        u32 state;
        if (device_create_bin_file(dev, &bin_attr_port_stats))
                dev_info(dev, "failed to create port stats sysfs entry");
@@ -1285,8 +1286,13 @@ void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
        if (device_create_bin_file(dev, &bin_attr_mem))
                dev_info(dev, "failed to create mem sysfs entry\n");
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD)
+                return;
        if (device_create_bin_file(dev, &bin_attr_pci_config))
                dev_info(dev, "failed to create pci config sysfs entry");
        if (device_create_file(dev, &dev_attr_beacon))
                dev_info(dev, "failed to create beacon sysfs entry");
@@ -1307,6 +1313,7 @@ void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
 void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
 {
        struct device *dev = &adapter->pdev->dev;
+        u32 state;
        device_remove_bin_file(dev, &bin_attr_port_stats);
@@ -1315,6 +1322,11 @@ void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
        device_remove_file(dev, &dev_attr_diag_mode);
        device_remove_bin_file(dev, &bin_attr_crb);
        device_remove_bin_file(dev, &bin_attr_mem);
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD)
+                return;
        device_remove_bin_file(dev, &bin_attr_pci_config);
        device_remove_file(dev, &dev_attr_beacon);
        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
index 10093f0c4c0f..6bc5db703920 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
@@ -740,8 +740,8 @@ int ql_core_dump(struct ql_adapter *qdev, struct ql_mpi_coredump *mpi_coredump)
        int i;
        if (!mpi_coredump) {
-                netif_err(qdev, drv, qdev->ndev, "No memory available\n");
+                netif_err(qdev, drv, qdev->ndev, "No memory allocated\n");
-                return -ENOMEM;
+                return -EINVAL;
        }
        /* Try to get the spinlock, but dont worry if
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c b/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
index ff2bf8a4e247..7ad146080c36 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
@@ -1274,7 +1274,7 @@ void ql_mpi_reset_work(struct work_struct *work)
                return;
        }
-        if (!ql_core_dump(qdev, qdev->mpi_coredump)) {
+        if (qdev->mpi_coredump && !ql_core_dump(qdev, qdev->mpi_coredump)) {
                netif_err(qdev, drv, qdev->ndev, "Core is dumped!\n");
                qdev->core_is_dumped = 1;
                queue_delayed_work(qdev->workqueue,
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index 128d7cdf9eb2..c082562dbf4e 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -27,10 +27,10 @@
 /* A reboot/assertion causes the MCDI status word to be set after the
 * command word is set or a REBOOT event is sent. If we notice a reboot
- * via these mechanisms then wait 20ms for the status word to be set.
+ * via these mechanisms then wait 250ms for the status word to be set.
 */
 #define MCDI_STATUS_DELAY_US            100
-#define MCDI_STATUS_DELAY_COUNT         200
+#define MCDI_STATUS_DELAY_COUNT         2500
 #define MCDI_STATUS_SLEEP_MS                                            \
        (MCDI_STATUS_DELAY_US * MCDI_STATUS_DELAY_COUNT / 1000)
@@ -800,9 +800,6 @@ static void efx_mcdi_ev_death(struct efx_nic *efx, int rc)
        } else {
                int count;
-                /* Nobody was waiting for an MCDI request, so trigger a reset */
-                efx_schedule_reset(efx, RESET_TYPE_MC_FAILURE);
                /* Consume the status word since efx_mcdi_rpc_finish() won't */
                for (count = 0; count < MCDI_STATUS_DELAY_COUNT; ++count) {
                        if (efx_mcdi_poll_reboot(efx))
@@ -810,6 +807,9 @@ static void efx_mcdi_ev_death(struct efx_nic *efx, int rc)
                        udelay(MCDI_STATUS_DELAY_US);
                }
                mcdi->new_epoch = true;
+                /* Nobody was waiting for an MCDI request, so trigger a reset */
+                efx_schedule_reset(efx, RESET_TYPE_MC_FAILURE);
        }
        spin_unlock(&mcdi->iface_lock);
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index c8f088ab5fdf..bdf697b184ae 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -32,7 +32,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #define DRV_NAME        "via-rhine"
-#define DRV_VERSION     "1.5.0"
+#define DRV_VERSION     "1.5.1"
 #define DRV_RELDATE     "2010-10-09"
 #include <linux/types.h>
@@ -1704,7 +1704,12 @@ static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
                cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
        if (unlikely(vlan_tx_tag_present(skb))) {
-                rp->tx_ring[entry].tx_status = cpu_to_le32((vlan_tx_tag_get(skb)) << 16);
+                u16 vid_pcp = vlan_tx_tag_get(skb);
+                /* drop CFI/DEI bit, register needs VID and PCP */
+                vid_pcp = (vid_pcp & VLAN_VID_MASK) |
+                          ((vid_pcp & VLAN_PRIO_MASK) >> 1);
+                rp->tx_ring[entry].tx_status = cpu_to_le32((vid_pcp) << 16);
                /* request tagging */
                rp->tx_ring[entry].desc_length |= cpu_to_le32(0x020000);
        }
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index b88121f240ca..0029148077a9 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -297,6 +297,12 @@ static int temac_dma_bd_init(struct net_device *ndev)
                       lp->rx_bd_p + (sizeof(*lp->rx_bd_v) * (RX_BD_NUM - 1)));
        lp->dma_out(lp, TX_CURDESC_PTR, lp->tx_bd_p);
+        /* Init descriptor indexes */
+        lp->tx_bd_ci = 0;
+        lp->tx_bd_next = 0;
+        lp->tx_bd_tail = 0;
+        lp->rx_bd_ci = 0;
        return 0;
 out:
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index a34d6bf5e43b..cc70ecfc7062 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -429,11 +429,13 @@ static void slip_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
                return;
+        spin_lock(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                spin_unlock(&sl->lock);
                sl_unlock(sl);
                return;
        }
@@ -441,6 +443,7 @@ static void slip_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
+        spin_unlock(&sl->lock);
 }
 static void sl_tx_timeout(struct net_device *dev)
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 2dbb9460349d..c6867f926cff 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -303,7 +303,7 @@ static void dm9601_set_multicast(struct net_device *net)
                rx_ctl |= 0x02;
        } else if (net->flags & IFF_ALLMULTI ||
                   netdev_mc_count(net) > DM_MAX_MCAST) {
-                rx_ctl |= 0x04;
+                rx_ctl |= 0x08;
        } else if (!netdev_mc_empty(net)) {
                struct netdev_hw_addr *ha;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6312332afeba..3d6aaf79d8b2 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -714,7 +714,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
-        {QMI_FIXED_INTF(0x1e2d, 0x12d1, 4)},    /* Cinterion PLxx */
+        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 7b331e613e02..bf94e10a37c8 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1241,7 +1241,9 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
        if (num_sgs == 1)
                return 0;
-        urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist), GFP_ATOMIC);
+        /* reserve one for zero packet */
+        urb->sg = kmalloc((num_sgs + 1) * sizeof(struct scatterlist),
+                          GFP_ATOMIC);
        if (!urb->sg)
                return -ENOMEM;
@@ -1305,7 +1307,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                if (build_dma_sg(skb, urb) < 0)
                        goto drop;
        }
-        entry->length = length = urb->transfer_buffer_length;
+        length = urb->transfer_buffer_length;
        /* don't assume the hardware handles USB_ZERO_PACKET
         * NOTE:  strictly conforming cdc-ether devices should expect
@@ -1317,15 +1319,18 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
        if (length % dev->maxpacket == 0) {
                if (!(info->flags & FLAG_SEND_ZLP)) {
                        if (!(info->flags & FLAG_MULTI_PACKET)) {
-                                urb->transfer_buffer_length++;
+                                length++;
-                                if (skb_tailroom(skb)) {
+                                if (skb_tailroom(skb) && !urb->num_sgs) {
                                        skb->data[skb->len] = 0;
                                        __skb_put(skb, 1);
-                                }
+                                } else if (urb->num_sgs)
+                                        sg_set_buf(&urb->sg[urb->num_sgs++],
+                                                        dev->padding_pkt, 1);
                        }
                } else
                        urb->transfer_flags |= URB_ZERO_PACKET;
        }
+        entry->length = urb->transfer_buffer_length = length;
        spin_lock_irqsave(&dev->txq.lock, flags);
        retval = usb_autopm_get_interface_async(dev->intf);
@@ -1509,6 +1514,7 @@ void usbnet_disconnect (struct usb_interface *intf)
        usb_kill_urb(dev->interrupt);
        usb_free_urb(dev->interrupt);
+        kfree(dev->padding_pkt);
        free_netdev(net);
 }
@@ -1679,9 +1685,16 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        /* initialize max rx_qlen and tx_qlen */
        usbnet_update_max_qlen(dev);
+        if (dev->can_dma_sg && !(info->flags & FLAG_SEND_ZLP) &&
+                !(info->flags & FLAG_MULTI_PACKET)) {
+                dev->padding_pkt = kzalloc(1, GFP_KERNEL);
+                if (!dev->padding_pkt)
+                        goto out4;
+        }
        status = register_netdev (net);
        if (status)
-                goto out4;
+                goto out5;
        netif_info(dev, probe, dev->net,
                   "register '%s' at usb-%s-%s, %s, %pM\n",
                   udev->dev.driver->name,
@@ -1699,6 +1712,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        return 0;
+out5:
+        kfree(dev->padding_pkt);
 out4:
        usb_free_urb(dev->interrupt);
 out3:
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index d1292fe746bc..2ef5b6219f3f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -952,8 +952,7 @@ void vxlan_sock_release(struct vxlan_sock *vs)
        spin_lock(&vn->sock_lock);
        hlist_del_rcu(&vs->hlist);
-        smp_wmb();
+        rcu_assign_sk_user_data(vs->sock->sk, NULL);
-        vs->sock->sk->sk_user_data = NULL;
        vxlan_notify_del_rx_port(sk);
        spin_unlock(&vn->sock_lock);
@@ -1048,8 +1047,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
        port = inet_sk(sk)->inet_sport;
-        smp_read_barrier_depends();
+        vs = rcu_dereference_sk_user_data(sk);
-        vs = (struct vxlan_sock *)sk->sk_user_data;
        if (!vs)
                goto drop;
@@ -2302,8 +2300,7 @@ static struct vxlan_sock *vxlan_socket_create(struct net *net, __be16 port,
        atomic_set(&vs->refcnt, 1);
        vs->rcv = rcv;
        vs->data = data;
-        smp_wmb();
+        rcu_assign_sk_user_data(vs->sock->sk, vs);
-        vs->sock->sk->sk_user_data = vs;
        spin_lock(&vn->sock_lock);
        hlist_add_head_rcu(&vs->hlist, vs_head(net, port));
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 4ee472a5a4e4..ab9e3a8410bc 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -1270,13 +1270,6 @@ static void ath9k_antenna_check(struct ath_softc *sc,
                return;
        /*
-         * All MPDUs in an aggregate will use the same LNA
-         * as the first MPDU.
-         */
-        if (rs->rs_isaggr && !rs->rs_firstaggr)
-                return;
-        /*
         * Change the default rx antenna if rx diversity
         * chooses the other antenna 3 times in a row.
         */
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 35b515fe3ffa..5ac713d2ff5d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -399,6 +399,7 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
        tbf->bf_buf_addr = bf->bf_buf_addr;
        memcpy(tbf->bf_desc, bf->bf_desc, sc->sc_ah->caps.tx_desc_len);
        tbf->bf_state = bf->bf_state;
+        tbf->bf_state.stale = false;
        return tbf;
 }
@@ -1389,11 +1390,15 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                      u16 tid, u16 *ssn)
 {
        struct ath_atx_tid *txtid;
+        struct ath_txq *txq;
        struct ath_node *an;
        u8 density;
        an = (struct ath_node *)sta->drv_priv;
        txtid = ATH_AN_2_TID(an, tid);
+        txq = txtid->ac->txq;
+        ath_txq_lock(sc, txq);
        /* update ampdu factor/density, they may have changed. This may happen
         * in HT IBSS when a beacon with HT-info is received after the station
@@ -1417,6 +1422,8 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
        memset(txtid->tx_buf, 0, sizeof(txtid->tx_buf));
        txtid->baw_head = txtid->baw_tail = 0;
+        ath_txq_unlock_complete(sc, txq);
        return 0;
 }
@@ -1555,8 +1562,10 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                        __skb_unlink(bf->bf_mpdu, tid_q);
                        list_add_tail(&bf->list, &bf_q);
                        ath_set_rates(tid->an->vif, tid->an->sta, bf);
-                        ath_tx_addto_baw(sc, tid, bf);
+                        if (bf_isampdu(bf)) {
-                        bf->bf_state.bf_type &= ~BUF_AGGR;
+                                ath_tx_addto_baw(sc, tid, bf);
+                                bf->bf_state.bf_type &= ~BUF_AGGR;
+                        }
                        if (bf_tail)
                                bf_tail->bf_next = bf;
@@ -1950,7 +1959,9 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                        if (bf_is_ampdu_not_probing(bf))
                                txq->axq_ampdu_depth++;
-                        bf = bf->bf_lastbf->bf_next;
+                        bf_last = bf->bf_lastbf;
+                        bf = bf_last->bf_next;
+                        bf_last->bf_next = NULL;
                }
        }
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 64f4a2bc8dde..c3462b75bd08 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -464,8 +464,6 @@ static struct sdio_driver brcmf_sdmmc_driver = {
 static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 {
-        int ret;
        brcmf_dbg(SDIO, "Enter\n");
        brcmfmac_sdio_pdata = pdev->dev.platform_data;
@@ -473,11 +471,7 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
        if (brcmfmac_sdio_pdata->power_on)
                brcmfmac_sdio_pdata->power_on();
-        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        return 0;
-        if (ret)
-                brcmf_err("sdio_register_driver failed: %d\n", ret);
-        return ret;
 }
 static int brcmf_sdio_pd_remove(struct platform_device *pdev)
@@ -500,6 +494,15 @@ static struct platform_driver brcmf_sdio_pd = {
        }
 };
+void brcmf_sdio_register(void)
+{
+        int ret;
+        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        if (ret)
+                brcmf_err("sdio_register_driver failed: %d\n", ret);
+}
 void brcmf_sdio_exit(void)
 {
        brcmf_dbg(SDIO, "Enter\n");
@@ -510,18 +513,13 @@ void brcmf_sdio_exit(void)
                sdio_unregister_driver(&brcmf_sdmmc_driver);
 }
-void brcmf_sdio_init(void)
+void __init brcmf_sdio_init(void)
 {
        int ret;
        brcmf_dbg(SDIO, "Enter\n");
        ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
-        if (ret == -ENODEV) {
+        if (ret == -ENODEV)
-                brcmf_dbg(SDIO, "No platform data available, registering without.\n");
+                brcmf_dbg(SDIO, "No platform data available.\n");
-                ret = sdio_register_driver(&brcmf_sdmmc_driver);
-        }
-        if (ret)
-                brcmf_err("driver registration failed: %d\n", ret);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index f7c1985844e4..74156f84180c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -156,10 +156,11 @@ extern int brcmf_bus_start(struct device *dev);
 #ifdef CONFIG_BRCMFMAC_SDIO
 extern void brcmf_sdio_exit(void);
 extern void brcmf_sdio_init(void);
+extern void brcmf_sdio_register(void);
 #endif
 #ifdef CONFIG_BRCMFMAC_USB
 extern void brcmf_usb_exit(void);
-extern void brcmf_usb_init(void);
+extern void brcmf_usb_register(void);
 #endif
 #endif                          /* _BRCMF_BUS_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index e067aec1fbf1..40e7f854e10f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -1231,21 +1231,23 @@ u32 brcmf_get_chip_info(struct brcmf_if *ifp)
        return bus->chip << 4 | bus->chiprev;
 }
-static void brcmf_driver_init(struct work_struct *work)
+static void brcmf_driver_register(struct work_struct *work)
 {
-        brcmf_debugfs_init();
 #ifdef CONFIG_BRCMFMAC_SDIO
-        brcmf_sdio_init();
+        brcmf_sdio_register();
 #endif
 #ifdef CONFIG_BRCMFMAC_USB
-        brcmf_usb_init();
+        brcmf_usb_register();
 #endif
 }
-static DECLARE_WORK(brcmf_driver_work, brcmf_driver_init);
+static DECLARE_WORK(brcmf_driver_work, brcmf_driver_register);
 static int __init brcmfmac_module_init(void)
 {
+        brcmf_debugfs_init();
+#ifdef CONFIG_BRCMFMAC_SDIO
+        brcmf_sdio_init();
+#endif
        if (!schedule_work(&brcmf_driver_work))
                return -EBUSY;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 39e01a7c8556..f4aea47e0730 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1539,7 +1539,7 @@ void brcmf_usb_exit(void)
        brcmf_release_fw(&fw_image_list);
 }
-void brcmf_usb_init(void)
+void brcmf_usb_register(void)
 {
        brcmf_dbg(USB, "Enter\n");
        INIT_LIST_HEAD(&fw_image_list);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 3a6544710c8a..edc5d105ff98 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -457,6 +457,8 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
        if (err != 0)
                brcms_err(wl->wlc->hw->d11core, "%s: brcms_up() returned %d\n",
                          __func__, err);
+        bcma_core_pci_power_save(wl->wlc->hw->d11core->bus, true);
        return err;
 }
@@ -479,6 +481,8 @@ static void brcms_ops_stop(struct ieee80211_hw *hw)
                return;
        }
+        bcma_core_pci_power_save(wl->wlc->hw->d11core->bus, false);
        /* put driver in down state */
        spin_lock_bh(&wl->lock);
        brcms_down(wl);
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index f5e6b489ed32..899cad34ccd3 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -42,7 +42,6 @@ struct hwbus_priv {
        spinlock_t              lock; /* Serialize all bus operations */
        wait_queue_head_t       wq;
        int claimed;
-        int irq_disabled;
 };
 #define SDIO_TO_SPI_ADDR(addr) ((addr & 0x1f)>>2)
@@ -238,8 +237,6 @@ static irqreturn_t cw1200_spi_irq_handler(int irq, void *dev_id)
        struct hwbus_priv *self = dev_id;
        if (self->core) {
-                disable_irq_nosync(self->func->irq);
-                self->irq_disabled = 1;
                cw1200_irq_handler(self->core);
                return IRQ_HANDLED;
        } else {
@@ -253,9 +250,10 @@ static int cw1200_spi_irq_subscribe(struct hwbus_priv *self)
        pr_debug("SW IRQ subscribe\n");
-        ret = request_any_context_irq(self->func->irq, cw1200_spi_irq_handler,
+        ret = request_threaded_irq(self->func->irq, NULL,
-                                      IRQF_TRIGGER_HIGH,
+                                   cw1200_spi_irq_handler,
-                                      "cw1200_wlan_irq", self);
+                                   IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+                                   "cw1200_wlan_irq", self);
        if (WARN_ON(ret < 0))
                goto exit;
@@ -273,22 +271,13 @@ exit:
 static int cw1200_spi_irq_unsubscribe(struct hwbus_priv *self)
 {
+        int ret = 0;
        pr_debug("SW IRQ unsubscribe\n");
        disable_irq_wake(self->func->irq);
        free_irq(self->func->irq, self);
-        return 0;
+        return ret;
-}
-static int cw1200_spi_irq_enable(struct hwbus_priv *self, int enable)
-{
-        /* Disables are handled by the interrupt handler */
-        if (enable && self->irq_disabled) {
-                enable_irq(self->func->irq);
-                self->irq_disabled = 0;
-        }
-        return 0;
 }
 static int cw1200_spi_off(const struct cw1200_platform_data_spi *pdata)
@@ -368,7 +357,6 @@ static struct hwbus_ops cw1200_spi_hwbus_ops = {
        .unlock                 = cw1200_spi_unlock,
        .align_size             = cw1200_spi_align_size,
        .power_mgmt             = cw1200_spi_pm,
-        .irq_enable             = cw1200_spi_irq_enable,
 };
 /* Probe Function to be called by SPI stack when device is discovered */
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
index 0b2061bbc68b..acdff0f7f952 100644
--- a/drivers/net/wireless/cw1200/fwio.c
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -485,7 +485,7 @@ int cw1200_load_firmware(struct cw1200_common *priv)
        /* Enable interrupt signalling */
        priv->hwbus_ops->lock(priv->hwbus_priv);
-        ret = __cw1200_irq_enable(priv, 2);
+        ret = __cw1200_irq_enable(priv, 1);
        priv->hwbus_ops->unlock(priv->hwbus_priv);
        if (ret < 0)
                goto unsubscribe;
diff --git a/drivers/net/wireless/cw1200/hwbus.h b/drivers/net/wireless/cw1200/hwbus.h
index 51dfb3a90735..8b2fc831c3de 100644
--- a/drivers/net/wireless/cw1200/hwbus.h
+++ b/drivers/net/wireless/cw1200/hwbus.h
@@ -28,7 +28,6 @@ struct hwbus_ops {
        void (*unlock)(struct hwbus_priv *self);
        size_t (*align_size)(struct hwbus_priv *self, size_t size);
        int (*power_mgmt)(struct hwbus_priv *self, bool suspend);
-        int (*irq_enable)(struct hwbus_priv *self, int enable);
 };
 #endif /* CW1200_HWBUS_H */
diff --git a/drivers/net/wireless/cw1200/hwio.c b/drivers/net/wireless/cw1200/hwio.c
index 41bd7615ccaa..ff230b7aeedd 100644
--- a/drivers/net/wireless/cw1200/hwio.c
+++ b/drivers/net/wireless/cw1200/hwio.c
@@ -273,21 +273,6 @@ int __cw1200_irq_enable(struct cw1200_common *priv, int enable)
        u16 val16;
        int ret;
-        /* We need to do this hack because the SPI layer can sleep on I/O
-           and the general path involves I/O to the device in interrupt
-           context.
-           However, the initial enable call needs to go to the hardware.
-           We don't worry about shutdown because we do a full reset which
-           clears the interrupt enabled bits.
-        */
-        if (priv->hwbus_ops->irq_enable) {
-                ret = priv->hwbus_ops->irq_enable(priv->hwbus_priv, enable);
-                if (ret || enable < 2)
-                        return ret;
-        }
        if (HIF_8601_SILICON == priv->hw_type) {
                ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
                if (ret < 0) {
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 21c688264708..1214c587fd08 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -150,7 +150,7 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
 */
 int
 mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
-                          struct mwifiex_ra_list_tbl *pra_list, int headroom,
+                          struct mwifiex_ra_list_tbl *pra_list,
                          int ptrindex, unsigned long ra_list_flags)
                          __releases(&priv->wmm.ra_list_spinlock)
 {
@@ -160,6 +160,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
        int pad = 0, ret;
        struct mwifiex_tx_param tx_param;
        struct txpd *ptx_pd = NULL;
+        int headroom = adapter->iface_type == MWIFIEX_USB ? 0 : INTF_HEADER_LEN;
        skb_src = skb_peek(&pra_list->skb_head);
        if (!skb_src) {
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.h b/drivers/net/wireless/mwifiex/11n_aggr.h
index 900e1c62a0cc..892098d6a696 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.h
+++ b/drivers/net/wireless/mwifiex/11n_aggr.h
@@ -26,7 +26,7 @@
 int mwifiex_11n_deaggregate_pkt(struct mwifiex_private *priv,
                                struct sk_buff *skb);
 int mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
-                              struct mwifiex_ra_list_tbl *ptr, int headroom,
+                              struct mwifiex_ra_list_tbl *ptr,
                              int ptr_index, unsigned long flags)
                              __releases(&priv->wmm.ra_list_spinlock);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 2d761477d15e..a6c46f3b6e3a 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1155,7 +1155,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
        uint32_t conditions = le32_to_cpu(phs_cfg->params.hs_config.conditions);
        if (phs_cfg->action == cpu_to_le16(HS_ACTIVATE) &&
-            adapter->iface_type == MWIFIEX_SDIO) {
+            adapter->iface_type != MWIFIEX_USB) {
                mwifiex_hs_activated_event(priv, true);
                return 0;
        } else {
@@ -1167,8 +1167,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
        }
        if (conditions != HS_CFG_CANCEL) {
                adapter->is_hs_configured = true;
-                if (adapter->iface_type == MWIFIEX_USB ||
+                if (adapter->iface_type == MWIFIEX_USB)
-                    adapter->iface_type == MWIFIEX_PCIE)
                        mwifiex_hs_activated_event(priv, true);
        } else {
                adapter->is_hs_configured = false;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 2472d4b7f00e..1c70b8d09227 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -447,9 +447,6 @@ static int mwifiex_usb_suspend(struct usb_interface *intf, pm_message_t message)
         */
        adapter->is_suspended = true;
-        for (i = 0; i < adapter->priv_num; i++)
-                netif_carrier_off(adapter->priv[i]->netdev);
        if (atomic_read(&card->rx_cmd_urb_pending) && card->rx_cmd.urb)
                usb_kill_urb(card->rx_cmd.urb);
@@ -509,10 +506,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
                                                  MWIFIEX_RX_CMD_BUF_SIZE);
        }
-        for (i = 0; i < adapter->priv_num; i++)
-                if (adapter->priv[i]->media_connected)
-                        netif_carrier_on(adapter->priv[i]->netdev);
        /* Disable Host Sleep */
        if (adapter->hs_activated)
                mwifiex_cancel_hs(mwifiex_get_priv(adapter,
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 2e8f9cdea54d..95fa3599b407 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -1239,8 +1239,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
                if (enable_tx_amsdu && mwifiex_is_amsdu_allowed(priv, tid) &&
                    mwifiex_is_11n_aggragation_possible(priv, ptr,
                                                        adapter->tx_buf_size))
-                        mwifiex_11n_aggregate_pkt(priv, ptr, INTF_HEADER_LEN,
+                        mwifiex_11n_aggregate_pkt(priv, ptr, ptr_index, flags);
-                                                  ptr_index, flags);
                        /* ra_list_spinlock has been freed in
                           mwifiex_11n_aggregate_pkt() */
                else
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index b9deef66cf4b..e328d3058c41 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -83,6 +83,7 @@ static struct usb_device_id p54u_table[] = {
        {USB_DEVICE(0x06a9, 0x000e)},   /* Westell 802.11g USB (A90-211WG-01) */
        {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
        {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
+        {USB_DEVICE(0x07aa, 0x0020)},   /* Corega WLUSB2GTST USB */
        {USB_DEVICE(0x0803, 0x4310)},   /* Zoom 4410a */
        {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
        {USB_DEVICE(0x083a, 0x4531)},   /* T-Com Sinus 154 data II */
@@ -979,6 +980,7 @@ static int p54u_load_firmware(struct ieee80211_hw *dev,
        if (err) {
                dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
                                          "(%d)!\n", p54u_fwlist[i].fw, err);
+                usb_put_dev(udev);
        }
        return err;
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index cc03e7c87cbe..703258742d28 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2057,7 +2057,7 @@ struct rtl_priv {
           that it points to the data allocated
           beyond  this structure like:
           rtl_pci_priv or rtl_usb_priv */
-        u8 priv[0];
+        u8 priv[0] __aligned(sizeof(void *));
 };
 #define rtl_priv(hw)            (((struct rtl_priv *)(hw)->priv))
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index a53782ef1540..b45bce20ad76 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -24,6 +24,12 @@
 struct backend_info {
        struct xenbus_device *dev;
        struct xenvif *vif;
+        /* This is the state that will be reflected in xenstore when any
+         * active hotplug script completes.
+         */
+        enum xenbus_state state;
        enum xenbus_state frontend_state;
        struct xenbus_watch hotplug_status_watch;
        u8 have_hotplug_status_watch:1;
@@ -136,6 +142,8 @@ static int netback_probe(struct xenbus_device *dev,
        if (err)
                goto fail;
+        be->state = XenbusStateInitWait;
        /* This kicks hotplug scripts, so do it immediately. */
        backend_create_xenvif(be);
@@ -208,24 +216,113 @@ static void backend_create_xenvif(struct backend_info *be)
        kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
 }
+static void backend_disconnect(struct backend_info *be)
-static void disconnect_backend(struct xenbus_device *dev)
 {
-        struct backend_info *be = dev_get_drvdata(&dev->dev);
        if (be->vif)
                xenvif_disconnect(be->vif);
 }
-static void destroy_backend(struct xenbus_device *dev)
+static void backend_connect(struct backend_info *be)
 {
-        struct backend_info *be = dev_get_drvdata(&dev->dev);
+        if (be->vif)
+                connect(be);
+}
-        if (be->vif) {
+static inline void backend_switch_state(struct backend_info *be,
-                kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
+                                        enum xenbus_state state)
-                xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
+{
-                xenvif_free(be->vif);
+        struct xenbus_device *dev = be->dev;
-                be->vif = NULL;
+        pr_debug("%s -> %s\n", dev->nodename, xenbus_strstate(state));
+        be->state = state;
+        /* If we are waiting for a hotplug script then defer the
+         * actual xenbus state change.
+         */
+        if (!be->have_hotplug_status_watch)
+                xenbus_switch_state(dev, state);
+}
+/* Handle backend state transitions:
+ *
+ * The backend state starts in InitWait and the following transitions are
+ * allowed.
+ *
+ * InitWait -> Connected
+ *
+ *    ^    \         |
+ *    |     \        |
+ *    |      \       |
+ *    |       \      |
+ *    |        \     |
+ *    |         \    |
+ *    |          V   V
+ *
+ *  Closed  <-> Closing
+ *
+ * The state argument specifies the eventual state of the backend and the
+ * function transitions to that state via the shortest path.
+ */
+static void set_backend_state(struct backend_info *be,
+                              enum xenbus_state state)
+{
+        while (be->state != state) {
+                switch (be->state) {
+                case XenbusStateClosed:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                                pr_info("%s: prepare for reconnect\n",
+                                        be->dev->nodename);
+                                backend_switch_state(be, XenbusStateInitWait);
+                                break;
+                        case XenbusStateClosing:
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateInitWait:
+                        switch (state) {
+                        case XenbusStateConnected:
+                                backend_connect(be);
+                                backend_switch_state(be, XenbusStateConnected);
+                                break;
+                        case XenbusStateClosing:
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateConnected:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateClosing:
+                        case XenbusStateClosed:
+                                backend_disconnect(be);
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateClosing:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosed);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                default:
+                        BUG();
+                }
        }
 }
@@ -237,40 +334,33 @@ static void frontend_changed(struct xenbus_device *dev,
 {
        struct backend_info *be = dev_get_drvdata(&dev->dev);
-        pr_debug("frontend state %s\n", xenbus_strstate(frontend_state));
+        pr_debug("%s -> %s\n", dev->otherend, xenbus_strstate(frontend_state));
        be->frontend_state = frontend_state;
        switch (frontend_state) {
        case XenbusStateInitialising:
-                if (dev->state == XenbusStateClosed) {
+                set_backend_state(be, XenbusStateInitWait);
-                        pr_info("%s: prepare for reconnect\n", dev->nodename);
-                        xenbus_switch_state(dev, XenbusStateInitWait);
-                }
                break;
        case XenbusStateInitialised:
                break;
        case XenbusStateConnected:
-                if (dev->state == XenbusStateConnected)
+                set_backend_state(be, XenbusStateConnected);
-                        break;
-                if (be->vif)
-                        connect(be);
                break;
        case XenbusStateClosing:
-                disconnect_backend(dev);
+                set_backend_state(be, XenbusStateClosing);
-                xenbus_switch_state(dev, XenbusStateClosing);
                break;
        case XenbusStateClosed:
-                xenbus_switch_state(dev, XenbusStateClosed);
+                set_backend_state(be, XenbusStateClosed);
                if (xenbus_dev_is_online(dev))
                        break;
-                destroy_backend(dev);
                /* fall through if not online */
        case XenbusStateUnknown:
+                set_backend_state(be, XenbusStateClosed);
                device_unregister(&dev->dev);
                break;
@@ -363,7 +453,9 @@ static void hotplug_status_changed(struct xenbus_watch *watch,
        if (IS_ERR(str))
                return;
        if (len == sizeof("connected")-1 && !memcmp(str, "connected", len)) {
-                xenbus_switch_state(be->dev, XenbusStateConnected);
+                /* Complete any pending state change */
+                xenbus_switch_state(be->dev, be->state);
                /* Not interested in this watch anymore. */
                unregister_hotplug_status_watch(be);
        }
@@ -393,12 +485,8 @@ static void connect(struct backend_info *be)
        err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
                                   hotplug_status_changed,
                                   "%s/%s", dev->nodename, "hotplug-status");
-        if (err) {
+        if (!err)
-                /* Switch now, since we can't do a watch. */
-                xenbus_switch_state(dev, XenbusStateConnected);
-        } else {
                be->have_hotplug_status_watch = 1;
-        }
        netif_wake_queue(be->vif->dev);
 }
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 9d2009a9004d..78cc76053328 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -74,10 +74,4 @@ config OF_MTD
        depends on MTD
        def_bool y
-config OF_RESERVED_MEM
-        depends on OF_FLATTREE && (DMA_CMA || (HAVE_GENERIC_DMA_COHERENT && HAVE_MEMBLOCK))
-        def_bool y
-        help
-          Initialization code for DMA reserved memory
 endmenu # OF
diff --git a/drivers/of/Makefile b/drivers/of/Makefile
index ed9660adad77..efd05102c405 100644
--- a/drivers/of/Makefile
+++ b/drivers/of/Makefile
@@ -9,4 +9,3 @@ obj-$(CONFIG_OF_MDIO)	+= of_mdio.o
 obj-$(CONFIG_OF_PCI)    += of_pci.o
 obj-$(CONFIG_OF_PCI_IRQ)  += of_pci_irq.o
 obj-$(CONFIG_OF_MTD)    += of_mtd.o
-obj-$(CONFIG_OF_RESERVED_MEM) += of_reserved_mem.o
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 865d3f66c86b..7d4c70f859e3 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -303,10 +303,8 @@ struct device_node *of_get_cpu_node(int cpu, unsigned int *thread)
        struct device_node *cpun, *cpus;
        cpus = of_find_node_by_path("/cpus");
-        if (!cpus) {
+        if (!cpus)
-                pr_warn("Missing cpus node, bailing out\n");
                return NULL;
-        }
        for_each_child_of_node(cpus, cpun) {
                if (of_node_cmp(cpun->type, "cpu"))
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 229dd9d69e18..a4fa9ad31b8f 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -18,7 +18,6 @@
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
-#include <linux/random.h>
 #include <asm/setup.h>  /* for COMMAND_LINE_SIZE */
 #ifdef CONFIG_PPC
@@ -803,14 +802,3 @@ void __init unflatten_device_tree(void)
 }
 #endif /* CONFIG_OF_EARLY_FLATTREE */
-/* Feed entire flattened device tree into the random pool */
-static int __init add_fdt_randomness(void)
-{
-        if (initial_boot_params)
-                add_device_randomness(initial_boot_params,
-                                be32_to_cpu(initial_boot_params->totalsize));
-        return 0;
-}
-core_initcall(add_fdt_randomness);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
deleted file mode 100644
index 0fe40c7d6904..000000000000
--- a/drivers/of/of_reserved_mem.c
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Device tree based initialization code for reserved memory.
- *
- * Copyright (c) 2013 Samsung Electronics Co., Ltd.
- *              http://www.samsung.com
- * Author: Marek Szyprowski <m.szyprowski@samsung.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License or (at your optional) any later version of the license.
- */
-#include <linux/memblock.h>
-#include <linux/err.h>
-#include <linux/of.h>
-#include <linux/of_fdt.h>
-#include <linux/of_platform.h>
-#include <linux/mm.h>
-#include <linux/sizes.h>
-#include <linux/mm_types.h>
-#include <linux/dma-contiguous.h>
-#include <linux/dma-mapping.h>
-#include <linux/of_reserved_mem.h>
-#define MAX_RESERVED_REGIONS    16
-struct reserved_mem {
-        phys_addr_t             base;
-        unsigned long           size;
-        struct cma              *cma;
-        char                    name[32];
-};
-static struct reserved_mem reserved_mem[MAX_RESERVED_REGIONS];
-static int reserved_mem_count;
-static int __init fdt_scan_reserved_mem(unsigned long node, const char *uname,
-                                        int depth, void *data)
-{
-        struct reserved_mem *rmem = &reserved_mem[reserved_mem_count];
-        phys_addr_t base, size;
-        int is_cma, is_reserved;
-        unsigned long len;
-        const char *status;
-        __be32 *prop;
-        is_cma = IS_ENABLED(CONFIG_DMA_CMA) &&
-               of_flat_dt_is_compatible(node, "linux,contiguous-memory-region");
-        is_reserved = of_flat_dt_is_compatible(node, "reserved-memory-region");
-        if (!is_reserved && !is_cma) {
-                /* ignore node and scan next one */
-                return 0;
-        }
-        status = of_get_flat_dt_prop(node, "status", &len);
-        if (status && strcmp(status, "okay") != 0) {
-                /* ignore disabled node nad scan next one */
-                return 0;
-        }
-        prop = of_get_flat_dt_prop(node, "reg", &len);
-        if (!prop || (len < (dt_root_size_cells + dt_root_addr_cells) *
-                             sizeof(__be32))) {
-                pr_err("Reserved mem: node %s, incorrect \"reg\" property\n",
-                       uname);
-                /* ignore node and scan next one */
-                return 0;
-        }
-        base = dt_mem_next_cell(dt_root_addr_cells, &prop);
-        size = dt_mem_next_cell(dt_root_size_cells, &prop);
-        if (!size) {
-                /* ignore node and scan next one */
-                return 0;
-        }
-        pr_info("Reserved mem: found %s, memory base %lx, size %ld MiB\n",
-                uname, (unsigned long)base, (unsigned long)size / SZ_1M);
-        if (reserved_mem_count == ARRAY_SIZE(reserved_mem))
-                return -ENOSPC;
-        rmem->base = base;
-        rmem->size = size;
-        strlcpy(rmem->name, uname, sizeof(rmem->name));
-        if (is_cma) {
-                struct cma *cma;
-                if (dma_contiguous_reserve_area(size, base, 0, &cma) == 0) {
-                        rmem->cma = cma;
-                        reserved_mem_count++;
-                        if (of_get_flat_dt_prop(node,
-                                                "linux,default-contiguous-region",
-                                                NULL))
-                                dma_contiguous_set_default(cma);
-                }
-        } else if (is_reserved) {
-                if (memblock_remove(base, size) == 0)
-                        reserved_mem_count++;
-                else
-                        pr_err("Failed to reserve memory for %s\n", uname);
-        }
-        return 0;
-}
-static struct reserved_mem *get_dma_memory_region(struct device *dev)
-{
-        struct device_node *node;
-        const char *name;
-        int i;
-        node = of_parse_phandle(dev->of_node, "memory-region", 0);
-        if (!node)
-                return NULL;
-        name = kbasename(node->full_name);
-        for (i = 0; i < reserved_mem_count; i++)
-                if (strcmp(name, reserved_mem[i].name) == 0)
-                        return &reserved_mem[i];
-        return NULL;
-}
-/**
- * of_reserved_mem_device_init() - assign reserved memory region to given device
- *
- * This function assign memory region pointed by "memory-region" device tree
- * property to the given device.
- */
-void of_reserved_mem_device_init(struct device *dev)
-{
-        struct reserved_mem *region = get_dma_memory_region(dev);
-        if (!region)
-                return;
-        if (region->cma) {
-                dev_set_cma_area(dev, region->cma);
-                pr_info("Assigned CMA %s to %s device\n", region->name,
-                        dev_name(dev));
-        } else {
-                if (dma_declare_coherent_memory(dev, region->base, region->base,
-                    region->size, DMA_MEMORY_MAP | DMA_MEMORY_EXCLUSIVE) != 0)
-                        pr_info("Declared reserved memory %s to %s device\n",
-                                region->name, dev_name(dev));
-        }
-}
-/**
- * of_reserved_mem_device_release() - release reserved memory device structures
- *
- * This function releases structures allocated for memory region handling for
- * the given device.
- */
-void of_reserved_mem_device_release(struct device *dev)
-{
-        struct reserved_mem *region = get_dma_memory_region(dev);
-        if (!region && !region->cma)
-                dma_release_declared_memory(dev);
-}
-/**
- * early_init_dt_scan_reserved_mem() - create reserved memory regions
- *
- * This function grabs memory from early allocator for device exclusive use
- * defined in device tree structures. It should be called by arch specific code
- * once the early allocator (memblock) has been activated and all other
- * subsystems have already allocated/reserved memory.
- */
-void __init early_init_dt_scan_reserved_mem(void)
-{
-        of_scan_flat_dt_by_path("/memory/reserved-memory",
-                                fdt_scan_reserved_mem, NULL);
-}
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 9b439ac63d8e..f6dcde220821 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -21,7 +21,6 @@
 #include <linux/of_device.h>
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
-#include <linux/of_reserved_mem.h>
 #include <linux/platform_device.h>
 const struct of_device_id of_default_bus_match_table[] = {
@@ -219,8 +218,6 @@ static struct platform_device *of_platform_device_create_pdata(
        dev->dev.bus = &platform_bus_type;
        dev->dev.platform_data = platform_data;
-        of_reserved_mem_device_init(&dev->dev);
        /* We do not fill the DMA ops for platform devices by default.
         * This is currently the responsibility of the platform code
         * to do such, possibly using a device notifier
@@ -228,7 +225,6 @@ static struct platform_device *of_platform_device_create_pdata(
        if (of_device_add(dev) != 0) {
                platform_device_put(dev);
-                of_reserved_mem_device_release(&dev->dev);
                return NULL;
        }
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 0b7d23b4ad95..be12fbfcae10 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -994,14 +994,16 @@ void acpiphp_enumerate_slots(struct pci_bus *bus)
                /*
                 * This bridge should have been registered as a hotplug function
-                 * under its parent, so the context has to be there.  If not, we
+                 * under its parent, so the context should be there, unless the
-                 * are in deep goo.
+                 * parent is going to be handled by pciehp, in which case this
+                 * bridge is not interesting to us either.
                 */
                mutex_lock(&acpiphp_context_lock);
                context = acpiphp_get_context(handle);
-                if (WARN_ON(!context)) {
+                if (!context) {
                        mutex_unlock(&acpiphp_context_lock);
                        put_device(&bus->dev);
+                        pci_dev_put(bridge->pci_dev);
                        kfree(bridge);
                        return;
                }
diff --git a/drivers/pinctrl/pinconf.c b/drivers/pinctrl/pinconf.c
index a138965c01cb..b8fcc38c0d11 100644
--- a/drivers/pinctrl/pinconf.c
+++ b/drivers/pinctrl/pinconf.c
@@ -490,7 +490,7 @@ exit:
 * <devicename> <state> <pinname> are values that should match the pinctrl-maps
 * <newvalue> reflects the new config and is driver dependant
 */
-static int pinconf_dbg_config_write(struct file *file,
+static ssize_t pinconf_dbg_config_write(struct file *file,
        const char __user *user_buf, size_t count, loff_t *ppos)
 {
        struct pinctrl_maps *maps_node;
@@ -508,7 +508,7 @@ static int pinconf_dbg_config_write(struct file *file,
        int i;
        /* Get userspace string and assure termination */
-        buf_size = min(count, (size_t)(sizeof(buf)-1));
+        buf_size = min(count, sizeof(buf) - 1);
        if (copy_from_user(buf, user_buf, buf_size))
                return -EFAULT;
        buf[buf_size] = 0;
diff --git a/drivers/pinctrl/pinctrl-exynos.c b/drivers/pinctrl/pinctrl-exynos.c
index 2689f8d01a1e..155b1b3a0e7a 100644
--- a/drivers/pinctrl/pinctrl-exynos.c
+++ b/drivers/pinctrl/pinctrl-exynos.c
@@ -663,18 +663,18 @@ static void exynos_pinctrl_resume(struct samsung_pinctrl_drv_data *drvdata)
 /* pin banks of s5pv210 pin-controller */
 static struct samsung_pin_bank s5pv210_pin_bank[] = {
        EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
-        EXYNOS_PIN_BANK_EINTG(6, 0x020, "gpa1", 0x04),
+        EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpa1", 0x04),
        EXYNOS_PIN_BANK_EINTG(8, 0x040, "gpb", 0x08),
        EXYNOS_PIN_BANK_EINTG(5, 0x060, "gpc0", 0x0c),
        EXYNOS_PIN_BANK_EINTG(5, 0x080, "gpc1", 0x10),
        EXYNOS_PIN_BANK_EINTG(4, 0x0a0, "gpd0", 0x14),
-        EXYNOS_PIN_BANK_EINTG(4, 0x0c0, "gpd1", 0x18),
+        EXYNOS_PIN_BANK_EINTG(6, 0x0c0, "gpd1", 0x18),
-        EXYNOS_PIN_BANK_EINTG(5, 0x0e0, "gpe0", 0x1c),
+        EXYNOS_PIN_BANK_EINTG(8, 0x0e0, "gpe0", 0x1c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x100, "gpe1", 0x20),
+        EXYNOS_PIN_BANK_EINTG(5, 0x100, "gpe1", 0x20),
-        EXYNOS_PIN_BANK_EINTG(6, 0x120, "gpf0", 0x24),
+        EXYNOS_PIN_BANK_EINTG(8, 0x120, "gpf0", 0x24),
        EXYNOS_PIN_BANK_EINTG(8, 0x140, "gpf1", 0x28),
        EXYNOS_PIN_BANK_EINTG(8, 0x160, "gpf2", 0x2c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x180, "gpf3", 0x30),
+        EXYNOS_PIN_BANK_EINTG(6, 0x180, "gpf3", 0x30),
        EXYNOS_PIN_BANK_EINTG(7, 0x1a0, "gpg0", 0x34),
        EXYNOS_PIN_BANK_EINTG(7, 0x1c0, "gpg1", 0x38),
        EXYNOS_PIN_BANK_EINTG(7, 0x1e0, "gpg2", 0x3c),
diff --git a/drivers/pinctrl/pinctrl-palmas.c b/drivers/pinctrl/pinctrl-palmas.c
index 82638fac3cfa..30c4d356cb33 100644
--- a/drivers/pinctrl/pinctrl-palmas.c
+++ b/drivers/pinctrl/pinctrl-palmas.c
@@ -891,9 +891,10 @@ static int palmas_pinconf_set(struct pinctrl_dev *pctldev,
                param = pinconf_to_config_param(configs[i]);
                param_val = pinconf_to_config_argument(configs[i]);
+                if (param == PIN_CONFIG_BIAS_PULL_PIN_DEFAULT)
+                        continue;
                switch (param) {
-                case PIN_CONFIG_BIAS_PULL_PIN_DEFAULT:
-                        return 0;
                case PIN_CONFIG_BIAS_DISABLE:
                case PIN_CONFIG_BIAS_PULL_UP:
                case PIN_CONFIG_BIAS_PULL_DOWN:
diff --git a/drivers/pinctrl/pinctrl-tegra114.c b/drivers/pinctrl/pinctrl-tegra114.c
index 622c4854977e..93c9e3899d5e 100644
--- a/drivers/pinctrl/pinctrl-tegra114.c
+++ b/drivers/pinctrl/pinctrl-tegra114.c
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2012-2013, NVIDIA CORPORATION.  All rights reserved.
 *
- * Arthur:  Pritesh Raithatha <praithatha@nvidia.com>
+ * Author:  Pritesh Raithatha <praithatha@nvidia.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -2763,7 +2763,6 @@ static struct platform_driver tegra114_pinctrl_driver = {
 };
 module_platform_driver(tegra114_pinctrl_driver);
-MODULE_ALIAS("platform:tegra114-pinctrl");
 MODULE_AUTHOR("Pritesh Raithatha <praithatha@nvidia.com>");
-MODULE_DESCRIPTION("NVIDIA Tegra114 pincontrol driver");
+MODULE_DESCRIPTION("NVIDIA Tegra114 pinctrl driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/da9063-regulator.c b/drivers/regulator/da9063-regulator.c
index 1a7816390773..b9f2653e4ef9 100644
--- a/drivers/regulator/da9063-regulator.c
+++ b/drivers/regulator/da9063-regulator.c
@@ -709,7 +709,7 @@ static struct da9063_regulators_pdata *da9063_parse_regulators_dt(
                struct of_regulator_match **da9063_reg_matches)
 {
        da9063_reg_matches = NULL;
-        return PTR_ERR(-ENODEV);
+        return ERR_PTR(-ENODEV);
 }
 #endif
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 488dfe7ce9a6..7e2b165972e6 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -201,13 +201,7 @@ static unsigned int palmas_smps_ramp_delay[4] = {0, 10000, 5000, 2500};
 #define SMPS_CTRL_MODE_ECO              0x02
 #define SMPS_CTRL_MODE_PWM              0x03
-/* These values are derived from the data sheet. And are the number of steps
+#define PALMAS_SMPS_NUM_VOLTAGES        122
- * where there is a voltage change, the ranges at beginning and end of register
- * max/min values where there are no change are ommitted.
- *
- * So they are basically (maxV-minV)/stepV
- */
-#define PALMAS_SMPS_NUM_VOLTAGES        117
 #define PALMAS_SMPS10_NUM_VOLTAGES      2
 #define PALMAS_LDO_NUM_VOLTAGES         50
@@ -979,6 +973,7 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                        pmic->desc[id].min_uV = 900000;
                        pmic->desc[id].uV_step = 50000;
                        pmic->desc[id].linear_min_sel = 1;
+                        pmic->desc[id].enable_time = 500;
                        pmic->desc[id].vsel_reg =
                                        PALMAS_BASE_TO_REG(PALMAS_LDO_BASE,
                                                palmas_regs_info[id].vsel_addr);
@@ -997,6 +992,11 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                                pmic->desc[id].min_uV = 450000;
                                pmic->desc[id].uV_step = 25000;
                        }
+                        /* LOD6 in vibrator mode will have enable time 2000us */
+                        if (pdata && pdata->ldo6_vibrator &&
+                                (id == PALMAS_REG_LDO6))
+                                pmic->desc[id].enable_time = 2000;
                } else {
                        pmic->desc[id].n_voltages = 1;
                        pmic->desc[id].ops = &palmas_ops_extreg;
diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
index d8e3e1262bc2..20c271d49dcb 100644
--- a/drivers/regulator/ti-abb-regulator.c
+++ b/drivers/regulator/ti-abb-regulator.c
@@ -279,8 +279,12 @@ static int ti_abb_set_opp(struct regulator_dev *rdev, struct ti_abb *abb,
        ti_abb_rmw(regs->opp_sel_mask, info->opp_sel, regs->control_reg,
                   abb->base);
-        /* program LDO VBB vset override if needed */
+        /*
-        if (abb->ldo_base)
+         * program LDO VBB vset override if needed for !bypass mode
+         * XXX: Do not switch sequence - for !bypass, LDO override reset *must*
+         * be performed *before* switch to bias mode else VBB glitches.
+         */
+        if (abb->ldo_base && info->opp_sel != TI_ABB_NOMINAL_OPP)
                ti_abb_program_ldovbb(dev, abb, info);
        /* Initiate ABB ldo change */
@@ -295,6 +299,14 @@ static int ti_abb_set_opp(struct regulator_dev *rdev, struct ti_abb *abb,
        if (ret)
                goto out;
+        /*
+         * Reset LDO VBB vset override bypass mode
+         * XXX: Do not switch sequence - for bypass, LDO override reset *must*
+         * be performed *after* switch to bypass else VBB glitches.
+         */
+        if (abb->ldo_base && info->opp_sel == TI_ABB_NOMINAL_OPP)
+                ti_abb_program_ldovbb(dev, abb, info);
 out:
        return ret;
 }
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index 1432b26ef2e9..2205fbc2c37b 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -63,7 +63,7 @@ static irqreturn_t wm831x_ldo_uv_irq(int irq, void *data)
 */
 static const struct regulator_linear_range wm831x_gp_ldo_ranges[] = {
-        { .min_uV =  900000, .max_uV = 1650000, .min_sel =  0, .max_sel = 14,
+        { .min_uV =  900000, .max_uV = 1600000, .min_sel =  0, .max_sel = 14,
          .uV_step =  50000 },
        { .min_uV = 1700000, .max_uV = 3300000, .min_sel = 15, .max_sel = 31,
          .uV_step = 100000 },
@@ -332,7 +332,7 @@ static struct platform_driver wm831x_gp_ldo_driver = {
 */
 static const struct regulator_linear_range wm831x_aldo_ranges[] = {
-        { .min_uV = 1000000, .max_uV = 1650000, .min_sel =  0, .max_sel = 12,
+        { .min_uV = 1000000, .max_uV = 1600000, .min_sel =  0, .max_sel = 12,
          .uV_step =  50000 },
        { .min_uV = 1700000, .max_uV = 3500000, .min_sel = 13, .max_sel = 31,
          .uV_step = 100000 },
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 835b5f0f344e..61ca9292a429 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -543,7 +543,7 @@ static int wm8350_dcdc_set_suspend_mode(struct regulator_dev *rdev,
 }
 static const struct regulator_linear_range wm8350_ldo_ranges[] = {
-        { .min_uV =  900000, .max_uV = 1750000, .min_sel =  0, .max_sel = 15,
+        { .min_uV =  900000, .max_uV = 1650000, .min_sel =  0, .max_sel = 15,
          .uV_step =  50000 },
        { .min_uV = 1800000, .max_uV = 3300000, .min_sel = 16, .max_sel = 31,
          .uV_step = 100000 },
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 8cd34bf644b3..77df9cb00688 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -145,9 +145,11 @@ bool __init sclp_has_linemode(void)
        if (sccb->header.response_code != 0x20)
                return 0;
-        if (sccb->sclp_send_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK))
+        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
-                return 1;
+                return 0;
-        return 0;
+        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        return 1;
 }
 bool __init sclp_has_vt220(void)
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index a0f47c83fd62..3f4ca4e09a4c 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -810,7 +810,7 @@ static void tty3270_resize_work(struct work_struct *work)
        struct winsize ws;
        screen = tty3270_alloc_screen(tp->n_rows, tp->n_cols);
-        if (!screen)
+        if (IS_ERR(screen))
                return;
        /* Switch to new output size */
        spin_lock_bh(&tp->view.lock);
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index fd7cc566095a..d4ac60b4a56e 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1583,7 +1583,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
        /* Initialize the hardware */
        ret = clk_prepare_enable(clk);
        if (ret)
-                goto out_unmap_regs;
+                goto out_free_irq;
        spi_writel(as, CR, SPI_BIT(SWRST));
        spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
        if (as->caps.has_wdrbt) {
@@ -1614,6 +1614,7 @@ out_free_dma:
        spi_writel(as, CR, SPI_BIT(SWRST));
        spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
        clk_disable_unprepare(clk);
+out_free_irq:
        free_irq(irq, master);
 out_unmap_regs:
        iounmap(as->regs);
diff --git a/drivers/spi/spi-clps711x.c b/drivers/spi/spi-clps711x.c
index 5655acf55bfe..6416798828e7 100644
--- a/drivers/spi/spi-clps711x.c
+++ b/drivers/spi/spi-clps711x.c
@@ -226,7 +226,6 @@ static int spi_clps711x_probe(struct platform_device *pdev)
                               dev_name(&pdev->dev), hw);
        if (ret) {
                dev_err(&pdev->dev, "Can't request IRQ\n");
-                clk_put(hw->spi_clk);
                goto clk_out;
        }
@@ -247,7 +246,6 @@ err_out:
                        gpio_free(hw->chipselect[i]);
        spi_master_put(master);
-        kfree(master);
        return ret;
 }
@@ -263,7 +261,6 @@ static int spi_clps711x_remove(struct platform_device *pdev)
                        gpio_free(hw->chipselect[i]);
        spi_unregister_master(master);
-        kfree(master);
        return 0;
 }
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 6cd07d13ecab..4e44575bd87a 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -476,15 +476,9 @@ static int dspi_probe(struct platform_device *pdev)
        master->bus_num = bus_num;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(&pdev->dev, "can't get platform resource\n");
-                ret = -EINVAL;
-                goto out_master_put;
-        }
        dspi->base = devm_ioremap_resource(&pdev->dev, res);
-        if (!dspi->base) {
+        if (IS_ERR(dspi->base)) {
-                ret = -EINVAL;
+                ret = PTR_ERR(dspi->base);
                goto out_master_put;
        }
diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
index dbc5e999a1f5..6adf4e35816d 100644
--- a/drivers/spi/spi-mpc512x-psc.c
+++ b/drivers/spi/spi-mpc512x-psc.c
@@ -522,8 +522,10 @@ static int mpc512x_psc_spi_do_probe(struct device *dev, u32 regaddr,
        psc_num = master->bus_num;
        snprintf(clk_name, sizeof(clk_name), "psc%d_mclk", psc_num);
        clk = devm_clk_get(dev, clk_name);
-        if (IS_ERR(clk))
+        if (IS_ERR(clk)) {
+                ret = PTR_ERR(clk);
                goto free_irq;
+        }
        ret = clk_prepare_enable(clk);
        if (ret)
                goto free_irq;
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index 2eb06ee0b326..c1a50674c1e3 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -546,8 +546,17 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
        if (pm_runtime_suspended(&drv_data->pdev->dev))
                return IRQ_NONE;
-        sccr1_reg = read_SSCR1(reg);
+        /*
+         * If the device is not yet in RPM suspended state and we get an
+         * interrupt that is meant for another device, check if status bits
+         * are all set to one. That means that the device is already
+         * powered off.
+         */
        status = read_SSSR(reg);
+        if (status == ~0)
+                return IRQ_NONE;
+        sccr1_reg = read_SSCR1(reg);
        /* Ignore possible writes if we don't need to write */
        if (!(sccr1_reg & SSCR1_TIE))
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 512b8893893b..a80376dc3a10 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -1428,6 +1428,8 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
               S3C64XX_SPI_INT_TX_OVERRUN_EN | S3C64XX_SPI_INT_TX_UNDERRUN_EN,
               sdd->regs + S3C64XX_SPI_INT_EN);
+        pm_runtime_enable(&pdev->dev);
        if (spi_register_master(master)) {
                dev_err(&pdev->dev, "cannot register SPI master\n");
                ret = -EBUSY;
@@ -1440,8 +1442,6 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
                                        mem_res,
                                        sdd->rx_dma.dmach, sdd->tx_dma.dmach);
-        pm_runtime_enable(&pdev->dev);
        return 0;
 err3:
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index 0b68cb592fa4..e488a90a98b8 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -296,6 +296,8 @@ static int hspi_probe(struct platform_device *pdev)
                goto error1;
        }
+        pm_runtime_enable(&pdev->dev);
        master->num_chipselect  = 1;
        master->bus_num         = pdev->id;
        master->setup           = hspi_setup;
@@ -309,8 +311,6 @@ static int hspi_probe(struct platform_device *pdev)
                goto error1;
        }
-        pm_runtime_enable(&pdev->dev);
        return 0;
 error1:
diff --git a/drivers/staging/comedi/drivers/ni_65xx.c b/drivers/staging/comedi/drivers/ni_65xx.c
index 3ba4c5712dff..853f62b2b1a9 100644
--- a/drivers/staging/comedi/drivers/ni_65xx.c
+++ b/drivers/staging/comedi/drivers/ni_65xx.c
@@ -369,28 +369,23 @@ static int ni_65xx_dio_insn_bits(struct comedi_device *dev,
 {
        const struct ni_65xx_board *board = comedi_board(dev);
        struct ni_65xx_private *devpriv = dev->private;
-        unsigned base_bitfield_channel;
+        int base_bitfield_channel;
-        const unsigned max_ports_per_bitfield = 5;
        unsigned read_bits = 0;
-        unsigned j;
+        int last_port_offset = ni_65xx_port_by_channel(s->n_chan - 1);
+        int port_offset;
        base_bitfield_channel = CR_CHAN(insn->chanspec);
-        for (j = 0; j < max_ports_per_bitfield; ++j) {
+        for (port_offset = ni_65xx_port_by_channel(base_bitfield_channel);
-                const unsigned port_offset =
+             port_offset <= last_port_offset; port_offset++) {
-                        ni_65xx_port_by_channel(base_bitfield_channel) + j;
+                unsigned port = sprivate(s)->base_port + port_offset;
-                const unsigned port =
+                int base_port_channel = port_offset * ni_65xx_channels_per_port;
-                        sprivate(s)->base_port + port_offset;
-                unsigned base_port_channel;
                unsigned port_mask, port_data, port_read_bits;
-                int bitshift;
+                int bitshift = base_port_channel - base_bitfield_channel;
-                if (port >= ni_65xx_total_num_ports(board))
+                if (bitshift >= 32)
                        break;
-                base_port_channel = port_offset * ni_65xx_channels_per_port;
                port_mask = data[0];
                port_data = data[1];
-                bitshift = base_port_channel - base_bitfield_channel;
-                if (bitshift >= 32 || bitshift <= -32)
-                        break;
                if (bitshift > 0) {
                        port_mask >>= bitshift;
                        port_data >>= bitshift;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 35b61f7d6c63..38e44b9abf0f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -753,7 +753,8 @@ static void iscsit_unmap_iovec(struct iscsi_cmd *cmd)
 static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
 {
-        struct iscsi_cmd *cmd;
+        LIST_HEAD(ack_list);
+        struct iscsi_cmd *cmd, *cmd_p;
        conn->exp_statsn = exp_statsn;
@@ -761,19 +762,23 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
                return;
        spin_lock_bh(&conn->cmd_lock);
-        list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
+        list_for_each_entry_safe(cmd, cmd_p, &conn->conn_cmd_list, i_conn_node) {
                spin_lock(&cmd->istate_lock);
                if ((cmd->i_state == ISTATE_SENT_STATUS) &&
                    iscsi_sna_lt(cmd->stat_sn, exp_statsn)) {
                        cmd->i_state = ISTATE_REMOVE;
                        spin_unlock(&cmd->istate_lock);
-                        iscsit_add_cmd_to_immediate_queue(cmd, conn,
+                        list_move_tail(&cmd->i_conn_node, &ack_list);
-                                                cmd->i_state);
                        continue;
                }
                spin_unlock(&cmd->istate_lock);
        }
        spin_unlock_bh(&conn->cmd_lock);
+        list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
+                list_del(&cmd->i_conn_node);
+                iscsit_free_cmd(cmd, false);
+        }
 }
 static int iscsit_allocate_iovecs(struct iscsi_cmd *cmd)
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 14d1aed5af1d..ef6d836a4d09 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -1192,7 +1192,7 @@ get_target:
         */
 alloc_tags:
        tag_num = max_t(u32, ISCSIT_MIN_TAGS, queue_depth);
-        tag_num += ISCSIT_EXTRA_TAGS;
+        tag_num += (tag_num / 2) + ISCSIT_EXTRA_TAGS;
        tag_size = sizeof(struct iscsi_cmd) + conn->conn_transport->priv_size;
        ret = transport_alloc_session_tags(sess->se_sess, tag_num, tag_size);
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index f2de28e178fd..b0cac0c342e1 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -736,7 +736,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
                 * Fallthrough
                 */
        case ISCSI_OP_SCSI_TMFUNC:
-                rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
                if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
                        __iscsit_free_cmd(cmd, true, shutdown);
                        target_put_sess_cmd(se_cmd->se_sess, se_cmd);
@@ -752,7 +752,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
                        se_cmd = &cmd->se_cmd;
                        __iscsit_free_cmd(cmd, true, shutdown);
-                        rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                        rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
                        if (!rc && shutdown && se_cmd->se_sess) {
                                __iscsit_free_cmd(cmd, true, shutdown);
                                target_put_sess_cmd(se_cmd->se_sess, se_cmd);
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 6c17295e8d7c..4714c6f8da4b 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -349,7 +349,16 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
-        cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+        /*
+         * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
+         * within target_complete_ok_work() if the command was successfully
+         * sent to the backend driver.
+         */
+        spin_lock_irq(&cmd->t_state_lock);
+        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
+                cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+        spin_unlock_irq(&cmd->t_state_lock);
        /*
         * Unlock ->caw_sem originally obtained during sbc_compare_and_write()
         * before the original READ I/O submission.
@@ -363,7 +372,7 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
        struct scatterlist *write_sg = NULL, *sg;
-        unsigned char *buf, *addr;
+        unsigned char *buf = NULL, *addr;
        struct sg_mapping_iter m;
        unsigned int offset = 0, len;
        unsigned int nlbas = cmd->t_task_nolb;
@@ -378,6 +387,15 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
         */
        if (!cmd->t_data_sg || !cmd->t_bidi_data_sg)
                return TCM_NO_SENSE;
+        /*
+         * Immediately exit + release dev->caw_sem if command has already
+         * been failed with a non-zero SCSI status.
+         */
+        if (cmd->scsi_status) {
+                pr_err("compare_and_write_callback: non zero scsi_status:"
+                        " 0x%02x\n", cmd->scsi_status);
+                goto out;
+        }
        buf = kzalloc(cmd->data_length, GFP_KERNEL);
        if (!buf) {
@@ -508,6 +526,12 @@ sbc_compare_and_write(struct se_cmd *cmd)
                cmd->transport_complete_callback = NULL;
                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
        }
+        /*
+         * Reset cmd->data_length to individual block_size in order to not
+         * confuse backend drivers that depend on this value matching the
+         * size of the I/O being submitted.
+         */
+        cmd->data_length = cmd->t_task_nolb * dev->dev_attrib.block_size;
        ret = cmd->execute_rw(cmd, cmd->t_bidi_data_sg, cmd->t_bidi_data_nents,
                              DMA_FROM_DEVICE);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 84747cc1aac0..81e945eefbbd 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -236,17 +236,24 @@ int transport_alloc_session_tags(struct se_session *se_sess,
 {
        int rc;
-        se_sess->sess_cmd_map = kzalloc(tag_num * tag_size, GFP_KERNEL);
+        se_sess->sess_cmd_map = kzalloc(tag_num * tag_size,
+                                        GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
        if (!se_sess->sess_cmd_map) {
-                pr_err("Unable to allocate se_sess->sess_cmd_map\n");
+                se_sess->sess_cmd_map = vzalloc(tag_num * tag_size);
-                return -ENOMEM;
+                if (!se_sess->sess_cmd_map) {
+                        pr_err("Unable to allocate se_sess->sess_cmd_map\n");
+                        return -ENOMEM;
+                }
        }
        rc = percpu_ida_init(&se_sess->sess_tag_pool, tag_num);
        if (rc < 0) {
                pr_err("Unable to init se_sess->sess_tag_pool,"
                        " tag_num: %u\n", tag_num);
-                kfree(se_sess->sess_cmd_map);
+                if (is_vmalloc_addr(se_sess->sess_cmd_map))
+                        vfree(se_sess->sess_cmd_map);
+                else
+                        kfree(se_sess->sess_cmd_map);
                se_sess->sess_cmd_map = NULL;
                return -ENOMEM;
        }
@@ -412,7 +419,10 @@ void transport_free_session(struct se_session *se_sess)
 {
        if (se_sess->sess_cmd_map) {
                percpu_ida_destroy(&se_sess->sess_tag_pool);
-                kfree(se_sess->sess_cmd_map);
+                if (is_vmalloc_addr(se_sess->sess_cmd_map))
+                        vfree(se_sess->sess_cmd_map);
+                else
+                        kfree(se_sess->sess_cmd_map);
        }
        kmem_cache_free(se_sess_cache, se_sess);
 }
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 4d22e7d2adca..3da4fd10b9f8 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -298,8 +298,8 @@ static int target_xcopy_parse_segdesc_02(struct se_cmd *se_cmd, struct xcopy_op
                (unsigned long long)xop->dst_lba);
        if (dc != 0) {
-                xop->dbl = (desc[29] << 16) & 0xff;
+                xop->dbl = (desc[29] & 0xff) << 16;
-                xop->dbl |= (desc[30] << 8) & 0xff;
+                xop->dbl |= (desc[30] & 0xff) << 8;
                xop->dbl |= desc[31] & 0xff;
                pr_debug("XCOPY seg desc 0x02: DC=1 w/ dbl: %u\n", xop->dbl);
diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index e61c36cbb866..c193af6a628f 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -636,6 +636,7 @@ struct console xenboot_console = {
        .name           = "xenboot",
        .write          = xenboot_write_console,
        .flags          = CON_PRINTBUFFER | CON_BOOT | CON_ANYTIME,
+        .index          = -1,
 };
 #endif  /* CONFIG_EARLY_PRINTK */
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 01bf5eb4f238..7a744b69c3d1 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2183,28 +2183,34 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                if (!input_available_p(tty, 0)) {
                        if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
-                                retval = -EIO;
+                                up_read(&tty->termios_rwsem);
-                                break;
+                                tty_flush_to_ldisc(tty);
-                        }
+                                down_read(&tty->termios_rwsem);
-                        if (tty_hung_up_p(file))
+                                if (!input_available_p(tty, 0)) {
-                                break;
+                                        retval = -EIO;
-                        if (!timeout)
+                                        break;
-                                break;
+                                }
-                        if (file->f_flags & O_NONBLOCK) {
+                        } else {
-                                retval = -EAGAIN;
+                                if (tty_hung_up_p(file))
-                                break;
+                                        break;
-                        }
+                                if (!timeout)
-                        if (signal_pending(current)) {
+                                        break;
-                                retval = -ERESTARTSYS;
+                                if (file->f_flags & O_NONBLOCK) {
-                                break;
+                                        retval = -EAGAIN;
-                        }
+                                        break;
-                        n_tty_set_room(tty);
+                                }
-                        up_read(&tty->termios_rwsem);
+                                if (signal_pending(current)) {
+                                        retval = -ERESTARTSYS;
+                                        break;
+                                }
+                                n_tty_set_room(tty);
+                                up_read(&tty->termios_rwsem);
-                        timeout = schedule_timeout(timeout);
+                                timeout = schedule_timeout(timeout);
-                        down_read(&tty->termios_rwsem);
+                                down_read(&tty->termios_rwsem);
-                        continue;
+                                continue;
+                        }
                }
                __set_current_state(TASK_RUNNING);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index a0ebbc9ce5cd..042aa077b5b3 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1912,9 +1912,6 @@ static int serial_imx_probe_dt(struct imx_port *sport,
        sport->devdata = of_id->data;
-        if (of_device_is_stdout_path(np))
-                add_preferred_console(imx_reg.cons->name, sport->port.line, 0);
        return 0;
 }
 #else
diff --git a/drivers/tty/serial/vt8500_serial.c b/drivers/tty/serial/vt8500_serial.c
index 93b697a0de65..15ad6fcda88b 100644
--- a/drivers/tty/serial/vt8500_serial.c
+++ b/drivers/tty/serial/vt8500_serial.c
@@ -561,12 +561,13 @@ static int vt8500_serial_probe(struct platform_device *pdev)
        if (!mmres || !irqres)
                return -ENODEV;
-        if (np)
+        if (np) {
                port = of_alias_get_id(np, "serial");
                if (port >= VT8500_MAX_PORTS)
                        port = -1;
-        else
+        } else {
                port = -1;
+        }
        if (port < 0) {
                /* calculate the port id */
diff --git a/drivers/usb/chipidea/ci_hdrc_pci.c b/drivers/usb/chipidea/ci_hdrc_pci.c
index 042320a6c6c7..d514332ac081 100644
--- a/drivers/usb/chipidea/ci_hdrc_pci.c
+++ b/drivers/usb/chipidea/ci_hdrc_pci.c
@@ -129,7 +129,12 @@ static DEFINE_PCI_DEVICE_TABLE(ci_hdrc_pci_id_table) = {
                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0829),
                .driver_data = (kernel_ulong_t)&penwell_pci_platdata,
        },
-        { 0, 0, 0, 0, 0, 0, 0 /* end: all zeroes */ }
+        {
+                /* Intel Clovertrail */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe006),
+                .driver_data = (kernel_ulong_t)&penwell_pci_platdata,
+        },
+        { 0 } /* end: all zeroes */
 };
 MODULE_DEVICE_TABLE(pci, ci_hdrc_pci_id_table);
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 6f96795dd20c..64d7a6d9a1ad 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -100,8 +100,10 @@ static void host_stop(struct ci_hdrc *ci)
 {
        struct usb_hcd *hcd = ci->hcd;
-        usb_remove_hcd(hcd);
+        if (hcd) {
-        usb_put_hcd(hcd);
+                usb_remove_hcd(hcd);
+                usb_put_hcd(hcd);
+        }
        if (ci->platdata->reg_vbus)
                regulator_disable(ci->platdata->reg_vbus);
 }
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 5b44cd47da5b..01fe36273f3b 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -97,6 +97,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Alcor Micro Corp. Hub */
        { USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* MicroTouch Systems touchscreen */
+        { USB_DEVICE(0x0596, 0x051e), .driver_info = USB_QUIRK_RESET_RESUME },
        /* appletouch */
        { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
@@ -130,6 +133,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Broadcom BCM92035DGROM BT dongle */
        { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* MAYA44USB sound device */
+        { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
        /* Action Semiconductor flash disk */
        { USB_DEVICE(0x10d6, 0x2200), .driver_info =
                        USB_QUIRK_STRING_FETCH_255 },
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 0658908d8968..44cf775a8627 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -2256,6 +2256,8 @@ static int ffs_func_bind(struct usb_configuration *c,
                                   data->raw_descs + ret,
                                   (sizeof data->raw_descs) - ret,
                                   __ffs_func_bind_do_descs, func);
+                if (unlikely(ret < 0))
+                        goto error;
        }
        /*
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index cc9207473dbc..0ac6064aa3b8 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -2054,7 +2054,7 @@ static struct pxa25x_udc memory = {
 /*
 *      probe - binds to the platform device
 */
-static int __init pxa25x_udc_probe(struct platform_device *pdev)
+static int pxa25x_udc_probe(struct platform_device *pdev)
 {
        struct pxa25x_udc *dev = &memory;
        int retval, irq;
@@ -2203,7 +2203,7 @@ static void pxa25x_udc_shutdown(struct platform_device *_dev)
        pullup_off();
 }
-static int __exit pxa25x_udc_remove(struct platform_device *pdev)
+static int pxa25x_udc_remove(struct platform_device *pdev)
 {
        struct pxa25x_udc *dev = platform_get_drvdata(pdev);
@@ -2294,7 +2294,8 @@ static int pxa25x_udc_resume(struct platform_device *dev)
 static struct platform_driver udc_driver = {
        .shutdown       = pxa25x_udc_shutdown,
-        .remove         = __exit_p(pxa25x_udc_remove),
+        .probe          = pxa25x_udc_probe,
+        .remove         = pxa25x_udc_remove,
        .suspend        = pxa25x_udc_suspend,
        .resume         = pxa25x_udc_resume,
        .driver         = {
@@ -2303,7 +2304,7 @@ static struct platform_driver udc_driver = {
        },
 };
-module_platform_driver_probe(udc_driver, pxa25x_udc_probe);
+module_platform_driver(udc_driver);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Frank Becker, Robert Schwebel, David Brownell");
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 6bddf1aa2347..a8a99e4748d5 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -543,7 +543,7 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
         * FIFO, requests of >512 cause the endpoint to get stuck with a
         * fragment of the end of the transfer in it.
         */
-        if (can_write > 512)
+        if (can_write > 512 && !periodic)
                can_write = 512;
        /*
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 2c76ef1320ea..08ef2829a7e2 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -799,7 +799,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
         * switchable ports.
         */
        pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
-                        cpu_to_le32(ports_available));
+                        ports_available);
        pci_read_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
                        &ports_available);
@@ -821,7 +821,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
         * host.
         */
        pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
-                        cpu_to_le32(ports_available));
+                        ports_available);
        pci_read_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
                        &ports_available);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 773a6b28c4f1..e8b4c56dcf62 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1157,18 +1157,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                t1 = xhci_port_state_to_neutral(t1);
                if (t1 != t2)
                        xhci_writel(xhci, t2, port_array[port_index]);
-                if (hcd->speed != HCD_USB3) {
-                        /* enable remote wake up for USB 2.0 */
-                        __le32 __iomem *addr;
-                        u32 tmp;
-                        /* Get the port power control register address. */
-                        addr = port_array[port_index] + PORTPMSC;
-                        tmp = xhci_readl(xhci, addr);
-                        tmp |= PORT_RWE;
-                        xhci_writel(xhci, tmp, addr);
-                }
        }
        hcd->state = HC_STATE_SUSPENDED;
        bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
@@ -1247,20 +1235,6 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                                xhci_ring_device(xhci, slot_id);
                } else
                        xhci_writel(xhci, temp, port_array[port_index]);
-                if (hcd->speed != HCD_USB3) {
-                        /* disable remote wake up for USB 2.0 */
-                        __le32 __iomem *addr;
-                        u32 tmp;
-                        /* Add one to the port status register address to get
-                         * the port power control register address.
-                         */
-                        addr = port_array[port_index] + PORTPMSC;
-                        tmp = xhci_readl(xhci, addr);
-                        tmp &= ~PORT_RWE;
-                        xhci_writel(xhci, tmp, addr);
-                }
        }
        (void) xhci_readl(xhci, &xhci->op_regs->command);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 236c3aabe940..b8dffd59eb25 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -35,6 +35,9 @@
 #define PCI_VENDOR_ID_ETRON             0x1b6f
 #define PCI_DEVICE_ID_ASROCK_P67        0x7023
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI      0x8c31
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
 static const char hcd_name[] = "xhci_hcd";
 /* called after powerup, by probe or system-pm "wakeup" */
@@ -69,6 +72,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                                "QUIRK: Fresco Logic xHC needs configure"
                                " endpoint cmd after reset endpoint");
                }
+                if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+                                pdev->revision == 0x4) {
+                        xhci->quirks |= XHCI_SLOW_SUSPEND;
+                        xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+                                "QUIRK: Fresco Logic xHC revision %u"
+                                "must be suspended extra slowly",
+                                pdev->revision);
+                }
                /* Fresco Logic confirms: all revisions of this chip do not
                 * support MSI, even though some of them claim to in their PCI
                 * capabilities.
@@ -110,6 +121,15 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
                xhci->quirks |= XHCI_AVOID_BEI;
        }
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+            (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) {
+                /* Workaround for occasional spurious wakeups from S5 (or
+                 * any other sleep) on Haswell machines with LPT and LPT-LP
+                 * with the new Intel BIOS
+                 */
+                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+        }
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
                xhci->quirks |= XHCI_RESET_ON_RESUME;
@@ -217,6 +237,11 @@ static void xhci_pci_remove(struct pci_dev *dev)
                usb_put_hcd(xhci->shared_hcd);
        }
        usb_hcd_pci_remove(dev);
+        /* Workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                pci_set_power_state(dev, PCI_D3hot);
        kfree(xhci);
 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 1e36dbb48366..6e0d886bcce5 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -730,6 +730,9 @@ void xhci_shutdown(struct usb_hcd *hcd)
        spin_lock_irq(&xhci->lock);
        xhci_halt(xhci);
+        /* Workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                xhci_reset(xhci);
        spin_unlock_irq(&xhci->lock);
        xhci_cleanup_msix(xhci);
@@ -737,6 +740,10 @@ void xhci_shutdown(struct usb_hcd *hcd)
        xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                        "xhci_shutdown completed - status = %x",
                        xhci_readl(xhci, &xhci->op_regs->status));
+        /* Yet another workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                pci_set_power_state(to_pci_dev(hcd->self.controller), PCI_D3hot);
 }
 #ifdef CONFIG_PM
@@ -839,6 +846,7 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
 int xhci_suspend(struct xhci_hcd *xhci)
 {
        int                     rc = 0;
+        unsigned int            delay = XHCI_MAX_HALT_USEC;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        u32                     command;
@@ -861,8 +869,12 @@ int xhci_suspend(struct xhci_hcd *xhci)
        command = xhci_readl(xhci, &xhci->op_regs->command);
        command &= ~CMD_RUN;
        xhci_writel(xhci, command, &xhci->op_regs->command);
+        /* Some chips from Fresco Logic need an extraordinary delay */
+        delay *= (xhci->quirks & XHCI_SLOW_SUSPEND) ? 10 : 1;
        if (xhci_handshake(xhci, &xhci->op_regs->status,
-                      STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC)) {
+                      STS_HALT, STS_HALT, delay)) {
                xhci_warn(xhci, "WARN: xHC CMD_RUN timeout\n");
                spin_unlock_irq(&xhci->lock);
                return -ETIMEDOUT;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 289fbfbae746..941d5f59e4dc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1548,6 +1548,8 @@ struct xhci_hcd {
 #define XHCI_COMP_MODE_QUIRK    (1 << 14)
 #define XHCI_AVOID_BEI          (1 << 15)
 #define XHCI_PLAT               (1 << 16)
+#define XHCI_SLOW_SUSPEND       (1 << 17)
+#define XHCI_SPURIOUS_WAKEUP    (1 << 18)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
        /* There are two roothubs to keep track of bus suspend info for */
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index e2b21c1d9c40..ba5f70f92888 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -246,6 +246,6 @@ config USB_EZUSB_FX2
 config USB_HSIC_USB3503
       tristate "USB3503 HSIC to USB20 Driver"
       depends on I2C
-       select REGMAP
+       select REGMAP_I2C
       help
         This option enables support for SMSC USB3503 HSIC to USB 2.0 Driver.
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 18e877ffe7b7..cd70cc886171 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -922,6 +922,52 @@ static void musb_generic_disable(struct musb *musb)
 }
 /*
+ * Program the HDRC to start (enable interrupts, dma, etc.).
+ */
+void musb_start(struct musb *musb)
+{
+        void __iomem    *regs = musb->mregs;
+        u8              devctl = musb_readb(regs, MUSB_DEVCTL);
+        dev_dbg(musb->controller, "<== devctl %02x\n", devctl);
+        /*  Set INT enable registers, enable interrupts */
+        musb->intrtxe = musb->epmask;
+        musb_writew(regs, MUSB_INTRTXE, musb->intrtxe);
+        musb->intrrxe = musb->epmask & 0xfffe;
+        musb_writew(regs, MUSB_INTRRXE, musb->intrrxe);
+        musb_writeb(regs, MUSB_INTRUSBE, 0xf7);
+        musb_writeb(regs, MUSB_TESTMODE, 0);
+        /* put into basic highspeed mode and start session */
+        musb_writeb(regs, MUSB_POWER, MUSB_POWER_ISOUPDATE
+                        | MUSB_POWER_HSENAB
+                        /* ENSUSPEND wedges tusb */
+                        /* | MUSB_POWER_ENSUSPEND */
+                   );
+        musb->is_active = 0;
+        devctl = musb_readb(regs, MUSB_DEVCTL);
+        devctl &= ~MUSB_DEVCTL_SESSION;
+        /* session started after:
+         * (a) ID-grounded irq, host mode;
+         * (b) vbus present/connect IRQ, peripheral mode;
+         * (c) peripheral initiates, using SRP
+         */
+        if (musb->port_mode != MUSB_PORT_MODE_HOST &&
+                        (devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS) {
+                musb->is_active = 1;
+        } else {
+                devctl |= MUSB_DEVCTL_SESSION;
+        }
+        musb_platform_enable(musb);
+        musb_writeb(regs, MUSB_DEVCTL, devctl);
+}
+/*
 * Make the HDRC stop (disable interrupts, etc.);
 * reversible by musb_start
 * called on gadget driver unregister
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 65f3917b4fc5..1c5bf75ee8ff 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -503,6 +503,7 @@ static inline void musb_configure_ep0(struct musb *musb)
 extern const char musb_driver_name[];
 extern void musb_stop(struct musb *musb);
+extern void musb_start(struct musb *musb);
 extern void musb_write_fifo(struct musb_hw_ep *ep, u16 len, const u8 *src);
 extern void musb_read_fifo(struct musb_hw_ep *ep, u16 len, u8 *dst);
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 4047cbb91bac..bd4138d80a48 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -535,6 +535,9 @@ static int dsps_probe(struct platform_device *pdev)
        struct dsps_glue *glue;
        int ret;
+        if (!strcmp(pdev->name, "musb-hdrc"))
+                return -ENODEV;
        match = of_match_node(musb_dsps_of_match, pdev->dev.of_node);
        if (!match) {
                dev_err(&pdev->dev, "fail to get matching of_match struct\n");
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 9a08679d204d..3671898a4535 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1790,6 +1790,10 @@ int musb_gadget_setup(struct musb *musb)
        musb->g.max_speed = USB_SPEED_HIGH;
        musb->g.speed = USB_SPEED_UNKNOWN;
+        MUSB_DEV_MODE(musb);
+        musb->xceiv->otg->default_a = 0;
+        musb->xceiv->state = OTG_STATE_B_IDLE;
        /* this "gadget" abstracts/virtualizes the controller */
        musb->g.name = musb_driver_name;
        musb->g.is_otg = 1;
@@ -1855,6 +1859,8 @@ static int musb_gadget_start(struct usb_gadget *g,
        musb->xceiv->state = OTG_STATE_B_IDLE;
        spin_unlock_irqrestore(&musb->lock, flags);
+        musb_start(musb);
        /* REVISIT:  funcall to other code, which also
         * handles power budgeting ... this way also
         * ensures HdrcStart is indirectly called.
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index a523950c2b32..d1d6b83aabca 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -44,52 +44,6 @@
 #include "musb_core.h"
-/*
-* Program the HDRC to start (enable interrupts, dma, etc.).
-*/
-static void musb_start(struct musb *musb)
-{
-        void __iomem    *regs = musb->mregs;
-        u8              devctl = musb_readb(regs, MUSB_DEVCTL);
-        dev_dbg(musb->controller, "<== devctl %02x\n", devctl);
-        /*  Set INT enable registers, enable interrupts */
-        musb->intrtxe = musb->epmask;
-        musb_writew(regs, MUSB_INTRTXE, musb->intrtxe);
-        musb->intrrxe = musb->epmask & 0xfffe;
-        musb_writew(regs, MUSB_INTRRXE, musb->intrrxe);
-        musb_writeb(regs, MUSB_INTRUSBE, 0xf7);
-        musb_writeb(regs, MUSB_TESTMODE, 0);
-        /* put into basic highspeed mode and start session */
-        musb_writeb(regs, MUSB_POWER, MUSB_POWER_ISOUPDATE
-                                                | MUSB_POWER_HSENAB
-                                                /* ENSUSPEND wedges tusb */
-                                                /* | MUSB_POWER_ENSUSPEND */
-                                                );
-        musb->is_active = 0;
-        devctl = musb_readb(regs, MUSB_DEVCTL);
-        devctl &= ~MUSB_DEVCTL_SESSION;
-        /* session started after:
-         * (a) ID-grounded irq, host mode;
-         * (b) vbus present/connect IRQ, peripheral mode;
-         * (c) peripheral initiates, using SRP
-         */
-        if (musb->port_mode != MUSB_PORT_MODE_HOST &&
-            (devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS) {
-                musb->is_active = 1;
-        } else {
-                devctl |= MUSB_DEVCTL_SESSION;
-        }
-        musb_platform_enable(musb);
-        musb_writeb(regs, MUSB_DEVCTL, devctl);
-}
 static void musb_port_suspend(struct musb *musb, bool do_suspend)
 {
        struct usb_otg  *otg = musb->xceiv->otg;
diff --git a/drivers/usb/phy/phy-gpio-vbus-usb.c b/drivers/usb/phy/phy-gpio-vbus-usb.c
index b2f29c9aebbf..02799a5efcd4 100644
--- a/drivers/usb/phy/phy-gpio-vbus-usb.c
+++ b/drivers/usb/phy/phy-gpio-vbus-usb.c
@@ -241,7 +241,7 @@ static int gpio_vbus_set_suspend(struct usb_phy *phy, int suspend)
 /* platform driver interface */
-static int __init gpio_vbus_probe(struct platform_device *pdev)
+static int gpio_vbus_probe(struct platform_device *pdev)
 {
        struct gpio_vbus_mach_info *pdata = dev_get_platdata(&pdev->dev);
        struct gpio_vbus_data *gpio_vbus;
@@ -349,7 +349,7 @@ err_gpio:
        return err;
 }
-static int __exit gpio_vbus_remove(struct platform_device *pdev)
+static int gpio_vbus_remove(struct platform_device *pdev)
 {
        struct gpio_vbus_data *gpio_vbus = platform_get_drvdata(pdev);
        struct gpio_vbus_mach_info *pdata = dev_get_platdata(&pdev->dev);
@@ -398,8 +398,6 @@ static const struct dev_pm_ops gpio_vbus_dev_pm_ops = {
 };
 #endif
-/* NOTE:  the gpio-vbus device may *NOT* be hotplugged */
 MODULE_ALIAS("platform:gpio-vbus");
 static struct platform_driver gpio_vbus_driver = {
@@ -410,10 +408,11 @@ static struct platform_driver gpio_vbus_driver = {
                .pm = &gpio_vbus_dev_pm_ops,
 #endif
        },
-        .remove  = __exit_p(gpio_vbus_remove),
+        .probe          = gpio_vbus_probe,
+        .remove         = gpio_vbus_remove,
 };
-module_platform_driver_probe(gpio_vbus_driver, gpio_vbus_probe);
+module_platform_driver(gpio_vbus_driver);
 MODULE_DESCRIPTION("simple GPIO controlled OTG transceiver driver");
 MODULE_AUTHOR("Philipp Zabel");
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 1cf6f125f5f0..acaee066b99a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -81,6 +81,7 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_VENDOR_ID                        0x12D1
 #define HUAWEI_PRODUCT_E173                     0x140C
+#define HUAWEI_PRODUCT_E1750                    0x1406
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_K4605                    0x14C6
@@ -450,6 +451,10 @@ static void option_instat_callback(struct urb *urb);
 #define CHANGHONG_VENDOR_ID                     0x2077
 #define CHANGHONG_PRODUCT_CH690                 0x7001
+/* Inovia */
+#define INOVIA_VENDOR_ID                        0x20a6
+#define INOVIA_SEW858                           0x1105
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                OPTION_BLACKLIST_NONE = 0,
@@ -567,6 +572,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t) &net_intf2_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
@@ -686,6 +693,222 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7B) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
@@ -1254,7 +1477,9 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
-        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist
+        },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
@@ -1342,6 +1567,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 760b78560f67..c9a35697ebe9 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -190,6 +190,7 @@ static struct usb_device_id ti_id_table_combined[] = {
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
        { }     /* terminator */
 };
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 94d75edef77f..18509e6c21ab 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -211,8 +211,11 @@ static int slave_configure(struct scsi_device *sdev)
                /*
                 * Many devices do not respond properly to READ_CAPACITY_16.
                 * Tell the SCSI layer to try READ_CAPACITY_10 first.
+                 * However some USB 3.0 drive enclosures return capacity
+                 * modulo 2TB. Those must use READ_CAPACITY_16
                 */
-                sdev->try_rc_10_first = 1;
+                if (!(us->fflags & US_FL_NEEDS_CAP16))
+                        sdev->try_rc_10_first = 1;
                /* assume SPC3 or latter devices support sense size > 18 */
                if (sdev->scsi_level > SCSI_SPC_2)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c015f2c16729..de32cfa5bfa6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1925,6 +1925,13 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_IGNORE_RESIDUE ),
+/* Reported by Oliver Neukum <oneukum@suse.com> */
+UNUSUAL_DEV(  0x174c, 0x55aa, 0x0100, 0x0100,
+                "ASMedia",
+                "AS2105",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NEEDS_CAP16),
 /* Reported by Jesse Feddema <jdfeddema@gmail.com> */
 UNUSUAL_DEV(  0x177f, 0x0400, 0x0000, 0x0000,
                "Yarvik",
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index a9807dea3887..4fb7a8f83c8a 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -545,6 +545,8 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
        long npage;
        int ret = 0, prot = 0;
        uint64_t mask;
+        struct vfio_dma *dma = NULL;
+        unsigned long pfn;
        end = map->iova + map->size;
@@ -587,8 +589,6 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
        }
        for (iova = map->iova; iova < end; iova += size, vaddr += size) {
-                struct vfio_dma *dma = NULL;
-                unsigned long pfn;
                long i;
                /* Pin a contiguous chunk of memory */
@@ -597,16 +597,15 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                if (npage <= 0) {
                        WARN_ON(!npage);
                        ret = (int)npage;
-                        break;
+                        goto out;
                }
                /* Verify pages are not already mapped */
                for (i = 0; i < npage; i++) {
                        if (iommu_iova_to_phys(iommu->domain,
                                               iova + (i << PAGE_SHIFT))) {
-                                vfio_unpin_pages(pfn, npage, prot, true);
                                ret = -EBUSY;
-                                break;
+                                goto out_unpin;
                        }
                }
@@ -616,8 +615,7 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                if (ret) {
                        if (ret != -EBUSY ||
                            map_try_harder(iommu, iova, pfn, npage, prot)) {
-                                vfio_unpin_pages(pfn, npage, prot, true);
+                                goto out_unpin;
-                                break;
                        }
                }
@@ -672,9 +670,8 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                        dma = kzalloc(sizeof(*dma), GFP_KERNEL);
                        if (!dma) {
                                iommu_unmap(iommu->domain, iova, size);
-                                vfio_unpin_pages(pfn, npage, prot, true);
                                ret = -ENOMEM;
-                                break;
+                                goto out_unpin;
                        }
                        dma->size = size;
@@ -685,16 +682,21 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                }
        }
-        if (ret) {
+        WARN_ON(ret);
-                struct vfio_dma *tmp;
+        mutex_unlock(&iommu->lock);
-                iova = map->iova;
+        return ret;
-                size = map->size;
-                while ((tmp = vfio_find_dma(iommu, iova, size))) {
+out_unpin:
-                        int r = vfio_remove_dma_overlap(iommu, iova,
+        vfio_unpin_pages(pfn, npage, prot, true);
-                                                        &size, tmp);
-                        if (WARN_ON(r || !size))
+out:
-                                break;
+        iova = map->iova;
-                }
+        size = map->size;
+        while ((dma = vfio_find_dma(iommu, iova, size))) {
+                int r = vfio_remove_dma_overlap(iommu, iova,
+                                                &size, dma);
+                if (WARN_ON(r || !size))
+                        break;
        }
        mutex_unlock(&iommu->lock);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 592b31698fc8..ce5221fa393a 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -728,7 +728,12 @@ vhost_scsi_get_tag(struct vhost_virtqueue *vq,
        }
        se_sess = tv_nexus->tvn_se_sess;
-        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_KERNEL);
+        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
+        if (tag < 0) {
+                pr_err("Unable to obtain tag for tcm_vhost_cmd\n");
+                return ERR_PTR(-ENOMEM);
+        }
        cmd = &((struct tcm_vhost_cmd *)se_sess->sess_cmd_map)[tag];
        sg = cmd->tvc_sgl;
        pages = cmd->tvc_upages;
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index c7c64f18773d..fa932c2f7d97 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -613,6 +613,9 @@ static int w1_bus_notify(struct notifier_block *nb, unsigned long action,
        sl = dev_to_w1_slave(dev);
        fops = sl->family->fops;
+        if (!fops)
+                return 0;
        switch (action) {
        case BUS_NOTIFY_ADD_DEVICE:
                /* if the family driver needs to initialize something... */
@@ -713,7 +716,10 @@ static int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn)
        atomic_set(&sl->refcnt, 0);
        init_completion(&sl->released);
+        /* slave modules need to be loaded in a context with unlocked mutex */
+        mutex_unlock(&dev->mutex);
        request_module("w1-family-0x%0x", rn->family);
+        mutex_lock(&dev->mutex);
        spin_lock(&w1_flock);
        f = w1_family_registered(rn->family);
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 5be5e3d14f79..19f3c3fc65f4 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -802,6 +802,12 @@ static int hpwdt_init_one(struct pci_dev *dev,
                return -ENODEV;
        }
+        /*
+         * Ignore all auxilary iLO devices with the following PCI ID
+         */
+        if (dev->subsystem_device == 0x1979)
+                return -ENODEV;
        if (pci_enable_device(dev)) {
                dev_warn(&dev->dev,
                        "Not possible to enable PCI Device: 0x%x:0x%x.\n",
diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index 491419e0772a..5c3d4df63e68 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -35,7 +35,7 @@
 #define KEMPLD_WDT_STAGE_TIMEOUT(x)     (0x1b + (x) * 4)
 #define KEMPLD_WDT_STAGE_CFG(x)         (0x18 + (x))
 #define STAGE_CFG_GET_PRESCALER(x)      (((x) & 0x30) >> 4)
-#define STAGE_CFG_SET_PRESCALER(x)      (((x) & 0x30) << 4)
+#define STAGE_CFG_SET_PRESCALER(x)      (((x) & 0x3) << 4)
 #define STAGE_CFG_PRESCALER_MASK        0x30
 #define STAGE_CFG_ACTION_MASK           0x7
 #define STAGE_CFG_ASSERT                (1 << 3)
diff --git a/drivers/watchdog/sunxi_wdt.c b/drivers/watchdog/sunxi_wdt.c
index 1f94b42764aa..f6caa77151c7 100644
--- a/drivers/watchdog/sunxi_wdt.c
+++ b/drivers/watchdog/sunxi_wdt.c
@@ -146,7 +146,7 @@ static const struct watchdog_ops sunxi_wdt_ops = {
        .set_timeout    = sunxi_wdt_set_timeout,
 };
-static int __init sunxi_wdt_probe(struct platform_device *pdev)
+static int sunxi_wdt_probe(struct platform_device *pdev)
 {
        struct sunxi_wdt_dev *sunxi_wdt;
        struct resource *res;
@@ -187,7 +187,7 @@ static int __init sunxi_wdt_probe(struct platform_device *pdev)
        return 0;
 }
-static int __exit sunxi_wdt_remove(struct platform_device *pdev)
+static int sunxi_wdt_remove(struct platform_device *pdev)
 {
        struct sunxi_wdt_dev *sunxi_wdt = platform_get_drvdata(pdev);
diff --git a/drivers/watchdog/ts72xx_wdt.c b/drivers/watchdog/ts72xx_wdt.c
index 42913f131dc2..c9b0c627fe7e 100644
--- a/drivers/watchdog/ts72xx_wdt.c
+++ b/drivers/watchdog/ts72xx_wdt.c
@@ -310,7 +310,8 @@ static long ts72xx_wdt_ioctl(struct file *file, unsigned int cmd,
        case WDIOC_GETSTATUS:
        case WDIOC_GETBOOTSTATUS:
-                return put_user(0, p);
+                error = put_user(0, p);
+                break;
        case WDIOC_KEEPALIVE:
                ts72xx_wdt_kick(wdt);
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 646337dc5201..529300327f45 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -600,9 +600,6 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
        /* lock down the parent dentry so we can peer at it */
        parent = dget_parent(dentry);
-        if (!parent->d_inode)
-                goto out_bad;
        dir = AFS_FS_I(parent->d_inode);
        /* validate the parent directory */
diff --git a/fs/aio.c b/fs/aio.c
index 6b868f0e0c4c..067e3d340c35 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -167,10 +167,25 @@ static int __init aio_setup(void)
 }
 __initcall(aio_setup);
+static void put_aio_ring_file(struct kioctx *ctx)
+{
+        struct file *aio_ring_file = ctx->aio_ring_file;
+        if (aio_ring_file) {
+                truncate_setsize(aio_ring_file->f_inode, 0);
+                /* Prevent further access to the kioctx from migratepages */
+                spin_lock(&aio_ring_file->f_inode->i_mapping->private_lock);
+                aio_ring_file->f_inode->i_mapping->private_data = NULL;
+                ctx->aio_ring_file = NULL;
+                spin_unlock(&aio_ring_file->f_inode->i_mapping->private_lock);
+                fput(aio_ring_file);
+        }
+}
 static void aio_free_ring(struct kioctx *ctx)
 {
        int i;
-        struct file *aio_ring_file = ctx->aio_ring_file;
        for (i = 0; i < ctx->nr_pages; i++) {
                pr_debug("pid(%d) [%d] page->count=%d\n", current->pid, i,
@@ -178,14 +193,10 @@ static void aio_free_ring(struct kioctx *ctx)
                put_page(ctx->ring_pages[i]);
        }
+        put_aio_ring_file(ctx);
        if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages)
                kfree(ctx->ring_pages);
-        if (aio_ring_file) {
-                truncate_setsize(aio_ring_file->f_inode, 0);
-                fput(aio_ring_file);
-                ctx->aio_ring_file = NULL;
-        }
 }
 static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
@@ -207,9 +218,8 @@ static int aio_set_page_dirty(struct page *page)
 static int aio_migratepage(struct address_space *mapping, struct page *new,
                        struct page *old, enum migrate_mode mode)
 {
-        struct kioctx *ctx = mapping->private_data;
+        struct kioctx *ctx;
        unsigned long flags;
-        unsigned idx = old->index;
        int rc;
        /* Writeback must be complete */
@@ -224,10 +234,23 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
        get_page(new);
-        spin_lock_irqsave(&ctx->completion_lock, flags);
+        /* We can potentially race against kioctx teardown here.  Use the
-        migrate_page_copy(new, old);
+         * address_space's private data lock to protect the mapping's
-        ctx->ring_pages[idx] = new;
+         * private_data.
-        spin_unlock_irqrestore(&ctx->completion_lock, flags);
+         */
+        spin_lock(&mapping->private_lock);
+        ctx = mapping->private_data;
+        if (ctx) {
+                pgoff_t idx;
+                spin_lock_irqsave(&ctx->completion_lock, flags);
+                migrate_page_copy(new, old);
+                idx = old->index;
+                if (idx < (pgoff_t)ctx->nr_pages)
+                        ctx->ring_pages[idx] = new;
+                spin_unlock_irqrestore(&ctx->completion_lock, flags);
+        } else
+                rc = -EBUSY;
+        spin_unlock(&mapping->private_lock);
        return rc;
 }
@@ -617,8 +640,7 @@ out_freepcpu:
 out_freeref:
        free_percpu(ctx->users.pcpu_count);
 out_freectx:
-        if (ctx->aio_ring_file)
+        put_aio_ring_file(ctx);
-                fput(ctx->aio_ring_file);
        kmem_cache_free(kioctx_cachep, ctx);
        pr_debug("error allocating ioctx %d\n", err);
        return ERR_PTR(err);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 100edcc5e312..4c94a79991bb 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1413,7 +1413,7 @@ static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
 *   long file_ofs
 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
 */
-static void fill_files_note(struct memelfnote *note)
+static int fill_files_note(struct memelfnote *note)
 {
        struct vm_area_struct *vma;
        unsigned count, size, names_ofs, remaining, n;
@@ -1428,11 +1428,11 @@ static void fill_files_note(struct memelfnote *note)
        names_ofs = (2 + 3 * count) * sizeof(data[0]);
 alloc:
        if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
-                goto err;
+                return -EINVAL;
        size = round_up(size, PAGE_SIZE);
        data = vmalloc(size);
        if (!data)
-                goto err;
+                return -ENOMEM;
        start_end_ofs = data + 2;
        name_base = name_curpos = ((char *)data) + names_ofs;
@@ -1485,7 +1485,7 @@ static void fill_files_note(struct memelfnote *note)
        size = name_curpos - (char *)data;
        fill_note(note, "CORE", NT_FILE, size, data);
- err: ;
+        return 0;
 }
 #ifdef CORE_DUMP_USE_REGSET
@@ -1686,8 +1686,8 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
        fill_auxv_note(&info->auxv, current->mm);
        info->size += notesize(&info->auxv);
-        fill_files_note(&info->files);
+        if (fill_files_note(&info->files) == 0)
-        info->size += notesize(&info->files);
+                info->size += notesize(&info->files);
        return 1;
 }
@@ -1719,7 +1719,8 @@ static int write_note_info(struct elf_note_info *info,
                        return 0;
                if (first && !writenote(&info->auxv, file, foffset))
                        return 0;
-                if (first && !writenote(&info->files, file, foffset))
+                if (first && info->files.data &&
+                                !writenote(&info->files, file, foffset))
                        return 0;
                for (i = 1; i < info->thread_notes; ++i)
@@ -1806,6 +1807,7 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
 struct elf_note_info {
        struct memelfnote *notes;
+        struct memelfnote *notes_files;
        struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
        struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
        struct list_head thread_list;
@@ -1896,9 +1898,12 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
        fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
        fill_auxv_note(info->notes + 3, current->mm);
-        fill_files_note(info->notes + 4);
+        info->numnote = 4;
-        info->numnote = 5;
+        if (fill_files_note(info->notes + info->numnote) == 0) {
+                info->notes_files = info->notes + info->numnote;
+                info->numnote++;
+        }
        /* Try to dump the FPU. */
        info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
@@ -1960,8 +1965,9 @@ static void free_note_info(struct elf_note_info *info)
                kfree(list_entry(tmp, struct elf_thread_status, list));
        }
-        /* Free data allocated by fill_files_note(): */
+        /* Free data possibly allocated by fill_files_note(): */
-        vfree(info->notes[4].data);
+        if (info->notes_files)
+                vfree(info->notes_files->data);
        kfree(info->prstatus);
        kfree(info->psinfo);
@@ -2044,7 +2050,7 @@ static int elf_core_dump(struct coredump_params *cprm)
        struct vm_area_struct *vma, *gate_vma;
        struct elfhdr *elf = NULL;
        loff_t offset = 0, dataoff, foffset;
-        struct elf_note_info info;
+        struct elf_note_info info = { };
        struct elf_phdr *phdr4note = NULL;
        struct elf_shdr *shdr4extnum = NULL;
        Elf_Half e_phnum;
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 58b7d14b08ee..08cc08f037a6 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -107,7 +107,8 @@ static void check_idle_worker(struct btrfs_worker_thread *worker)
                worker->idle = 1;
                /* the list may be empty if the worker is just starting */
-                if (!list_empty(&worker->worker_list)) {
+                if (!list_empty(&worker->worker_list) &&
+                    !worker->workers->stopping) {
                        list_move(&worker->worker_list,
                                 &worker->workers->idle_list);
                }
@@ -127,7 +128,8 @@ static void check_busy_worker(struct btrfs_worker_thread *worker)
                spin_lock_irqsave(&worker->workers->lock, flags);
                worker->idle = 0;
-                if (!list_empty(&worker->worker_list)) {
+                if (!list_empty(&worker->worker_list) &&
+                    !worker->workers->stopping) {
                        list_move_tail(&worker->worker_list,
                                      &worker->workers->worker_list);
                }
@@ -412,6 +414,7 @@ void btrfs_stop_workers(struct btrfs_workers *workers)
        int can_stop;
        spin_lock_irq(&workers->lock);
+        workers->stopping = 1;
        list_splice_init(&workers->idle_list, &workers->worker_list);
        while (!list_empty(&workers->worker_list)) {
                cur = workers->worker_list.next;
@@ -455,6 +458,7 @@ void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max,
        workers->ordered = 0;
        workers->atomic_start_pending = 0;
        workers->atomic_worker_start = async_helper;
+        workers->stopping = 0;
 }
 /*
@@ -480,15 +484,19 @@ static int __btrfs_start_workers(struct btrfs_workers *workers)
        atomic_set(&worker->num_pending, 0);
        atomic_set(&worker->refs, 1);
        worker->workers = workers;
-        worker->task = kthread_run(worker_loop, worker,
+        worker->task = kthread_create(worker_loop, worker,
-                                   "btrfs-%s-%d", workers->name,
+                                      "btrfs-%s-%d", workers->name,
-                                   workers->num_workers + 1);
+                                      workers->num_workers + 1);
        if (IS_ERR(worker->task)) {
                ret = PTR_ERR(worker->task);
-                kfree(worker);
                goto fail;
        }
        spin_lock_irq(&workers->lock);
+        if (workers->stopping) {
+                spin_unlock_irq(&workers->lock);
+                goto fail_kthread;
+        }
        list_add_tail(&worker->worker_list, &workers->idle_list);
        worker->idle = 1;
        workers->num_workers++;
@@ -496,8 +504,13 @@ static int __btrfs_start_workers(struct btrfs_workers *workers)
        WARN_ON(workers->num_workers_starting < 0);
        spin_unlock_irq(&workers->lock);
+        wake_up_process(worker->task);
        return 0;
+fail_kthread:
+        kthread_stop(worker->task);
 fail:
+        kfree(worker);
        spin_lock_irq(&workers->lock);
        workers->num_workers_starting--;
        spin_unlock_irq(&workers->lock);
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index 063698b90ce2..1f26792683ed 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -107,6 +107,8 @@ struct btrfs_workers {
        /* extra name for this worker, used for current->name */
        char *name;
+        int stopping;
 };
 void btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work);
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 70681686e8dc..9efb94e95858 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -535,10 +535,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
        list_add(&tgt_device->dev_alloc_list, &fs_info->fs_devices->alloc_list);
        btrfs_rm_dev_replace_srcdev(fs_info, src_device);
-        if (src_device->bdev) {
-                /* zero out the old super */
-                btrfs_scratch_superblock(src_device);
-        }
        /*
         * this is again a consistent state where no dev_replace procedure
         * is running, the target device is part of the filesystem, the
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 4ae17ed13b32..62176ad89846 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1561,8 +1561,9 @@ int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
        return ret;
 }
-struct btrfs_root *btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
+struct btrfs_root *btrfs_get_fs_root(struct btrfs_fs_info *fs_info,
-                                              struct btrfs_key *location)
+                                     struct btrfs_key *location,
+                                     bool check_ref)
 {
        struct btrfs_root *root;
        int ret;
@@ -1586,7 +1587,7 @@ struct btrfs_root *btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
 again:
        root = btrfs_lookup_fs_root(fs_info, location->objectid);
        if (root) {
-                if (btrfs_root_refs(&root->root_item) == 0)
+                if (check_ref && btrfs_root_refs(&root->root_item) == 0)
                        return ERR_PTR(-ENOENT);
                return root;
        }
@@ -1595,7 +1596,7 @@ again:
        if (IS_ERR(root))
                return root;
-        if (btrfs_root_refs(&root->root_item) == 0) {
+        if (check_ref && btrfs_root_refs(&root->root_item) == 0) {
                ret = -ENOENT;
                goto fail;
        }
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index b71acd6e1e5b..5ce2a7da8b11 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -68,8 +68,17 @@ struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root,
 int btrfs_init_fs_root(struct btrfs_root *root);
 int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
                         struct btrfs_root *root);
-struct btrfs_root *btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
-                                              struct btrfs_key *location);
+struct btrfs_root *btrfs_get_fs_root(struct btrfs_fs_info *fs_info,
+                                     struct btrfs_key *key,
+                                     bool check_ref);
+static inline struct btrfs_root *
+btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
+                           struct btrfs_key *location)
+{
+        return btrfs_get_fs_root(fs_info, location, true);
+}
 int btrfs_cleanup_fs_roots(struct btrfs_fs_info *fs_info);
 void btrfs_btree_balance_dirty(struct btrfs_root *root);
 void btrfs_btree_balance_dirty_nodelay(struct btrfs_root *root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index c09a40db53db..51731b76900d 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -145,8 +145,16 @@ int __init extent_io_init(void)
                                     offsetof(struct btrfs_io_bio, bio));
        if (!btrfs_bioset)
                goto free_buffer_cache;
+        if (bioset_integrity_create(btrfs_bioset, BIO_POOL_SIZE))
+                goto free_bioset;
        return 0;
+free_bioset:
+        bioset_free(btrfs_bioset);
+        btrfs_bioset = NULL;
 free_buffer_cache:
        kmem_cache_destroy(extent_buffer_cache);
        extent_buffer_cache = NULL;
@@ -1482,10 +1490,8 @@ static noinline u64 find_delalloc_range(struct extent_io_tree *tree,
                cur_start = state->end + 1;
                node = rb_next(node);
                total_bytes += state->end - state->start + 1;
-                if (total_bytes >= max_bytes) {
+                if (total_bytes >= max_bytes)
-                        *end = *start + max_bytes - 1;
                        break;
-                }
                if (!node)
                        break;
        }
@@ -1614,7 +1620,7 @@ again:
                *start = delalloc_start;
                *end = delalloc_end;
                free_extent_state(cached_state);
-                return found;
+                return 0;
        }
        /*
@@ -1627,10 +1633,9 @@ again:
        /*
         * make sure to limit the number of pages we try to lock down
-         * if we're looping.
         */
-        if (delalloc_end + 1 - delalloc_start > max_bytes && loops)
+        if (delalloc_end + 1 - delalloc_start > max_bytes)
-                delalloc_end = delalloc_start + PAGE_CACHE_SIZE - 1;
+                delalloc_end = delalloc_start + max_bytes - 1;
        /* step two, lock all the pages after the page that has start */
        ret = lock_delalloc_pages(inode, locked_page,
@@ -1641,8 +1646,7 @@ again:
                 */
                free_extent_state(cached_state);
                if (!loops) {
-                        unsigned long offset = (*start) & (PAGE_CACHE_SIZE - 1);
+                        max_bytes = PAGE_CACHE_SIZE;
-                        max_bytes = PAGE_CACHE_SIZE - offset;
                        loops = 1;
                        goto again;
                } else {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 22ebc13b6c99..51e3afa78354 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6437,6 +6437,7 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len,
        if (btrfs_extent_readonly(root, disk_bytenr))
                goto out;
+        btrfs_release_path(path);
        /*
         * look for other files referencing this extent, if we
@@ -7986,7 +7987,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        /* check for collisions, even if the  name isn't there */
-        ret = btrfs_check_dir_item_collision(root, new_dir->i_ino,
+        ret = btrfs_check_dir_item_collision(dest, new_dir->i_ino,
                             new_dentry->d_name.name,
                             new_dentry->d_name.len);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index a5a26320503f..4a355726151e 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -588,7 +588,7 @@ static struct btrfs_root *read_fs_root(struct btrfs_fs_info *fs_info,
        else
                key.offset = (u64)-1;
-        return btrfs_read_fs_root_no_name(fs_info, &key);
+        return btrfs_get_fs_root(fs_info, &key, false);
 }
 #ifdef BTRFS_COMPAT_EXTENT_TREE_V0
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 0b1f4ef8db98..ec71ea44d2b4 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -299,11 +299,6 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                        continue;
                }
-                if (btrfs_root_refs(&root->root_item) == 0) {
-                        btrfs_add_dead_root(root);
-                        continue;
-                }
                err = btrfs_init_fs_root(root);
                if (err) {
                        btrfs_free_fs_root(root);
@@ -318,6 +313,9 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                        btrfs_free_fs_root(root);
                        break;
                }
+                if (btrfs_root_refs(&root->root_item) == 0)
+                        btrfs_add_dead_root(root);
        }
        btrfs_free_path(path);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index e7a95356df83..8c81bdc1ef9b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1838,11 +1838,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
        assert_qgroups_uptodate(trans);
        update_super_roots(root);
-        if (!root->fs_info->log_root_recovering) {
+        btrfs_set_super_log_root(root->fs_info->super_copy, 0);
-                btrfs_set_super_log_root(root->fs_info->super_copy, 0);
+        btrfs_set_super_log_root_level(root->fs_info->super_copy, 0);
-                btrfs_set_super_log_root_level(root->fs_info->super_copy, 0);
-        }
        memcpy(root->fs_info->super_for_commit, root->fs_info->super_copy,
               sizeof(*root->fs_info->super_copy));
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a10645830223..043b215769c2 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1716,6 +1716,7 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
                                 struct btrfs_device *srcdev)
 {
        WARN_ON(!mutex_is_locked(&fs_info->fs_devices->device_list_mutex));
        list_del_rcu(&srcdev->dev_list);
        list_del_rcu(&srcdev->dev_alloc_list);
        fs_info->fs_devices->num_devices--;
@@ -1725,9 +1726,13 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
        }
        if (srcdev->can_discard)
                fs_info->fs_devices->num_can_discard--;
-        if (srcdev->bdev)
+        if (srcdev->bdev) {
                fs_info->fs_devices->open_devices--;
+                /* zero out the old super */
+                btrfs_scratch_superblock(srcdev);
+        }
        call_rcu(&srcdev->rcu, free_device);
 }
diff --git a/fs/buffer.c b/fs/buffer.c
index 4d7433534f5c..6024877335ca 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1005,9 +1005,19 @@ grow_dev_page(struct block_device *bdev, sector_t block,
        struct buffer_head *bh;
        sector_t end_block;
        int ret = 0;            /* Will call free_more_memory() */
+        gfp_t gfp_mask;
-        page = find_or_create_page(inode->i_mapping, index,
+        gfp_mask = mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS;
-                (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
+        gfp_mask |= __GFP_MOVABLE;
+        /*
+         * XXX: __getblk_slow() can not really deal with failure and
+         * will endlessly loop on improvised global reclaim.  Prefer
+         * looping in the allocator rather than here, at least that
+         * code knows what it's doing.
+         */
+        gfp_mask |= __GFP_NOFAIL;
+        page = find_or_create_page(inode->i_mapping, index, gfp_mask);
        if (!page)
                return ret;
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index a16b4e58bcc6..77fc5e181077 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -120,14 +120,16 @@ cifs_read_super(struct super_block *sb)
 {
        struct inode *inode;
        struct cifs_sb_info *cifs_sb;
+        struct cifs_tcon *tcon;
        int rc = 0;
        cifs_sb = CIFS_SB(sb);
+        tcon = cifs_sb_master_tcon(cifs_sb);
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIXACL)
                sb->s_flags |= MS_POSIXACL;
-        if (cifs_sb_master_tcon(cifs_sb)->ses->capabilities & CAP_LARGE_FILES)
+        if (tcon->ses->capabilities & tcon->ses->server->vals->cap_large_files)
                sb->s_maxbytes = MAX_LFS_FILESIZE;
        else
                sb->s_maxbytes = MAX_NON_LFS;
@@ -147,7 +149,7 @@ cifs_read_super(struct super_block *sb)
                goto out_no_root;
        }
-        if (cifs_sb_master_tcon(cifs_sb)->nocase)
+        if (tcon->nocase)
                sb->s_d_op = &cifs_ci_dentry_ops;
        else
                sb->s_d_op = &cifs_dentry_ops;
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index ea723a5e8226..6d0b07217ac9 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -132,5 +132,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
-#define CIFS_VERSION   "2.01"
+#define CIFS_VERSION   "2.02"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index cfa14c80ef3b..52b6f6c26bfc 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -547,9 +547,6 @@ struct TCP_Server_Info {
        unsigned int max_rw;    /* maxRw specifies the maximum */
        /* message size the server can send or receive for */
        /* SMB_COM_WRITE_RAW or SMB_COM_READ_RAW. */
-        unsigned int max_vcs;   /* maximum number of smb sessions, at least
-                                   those that can be specified uniquely with
-                                   vcnumbers */
        unsigned int capabilities; /* selective disabling of caps by smb sess */
        int timeAdj;  /* Adjust for difference in server time zone in sec */
        __u64 CurrentMid;         /* multiplex id - rotating counter */
@@ -715,7 +712,6 @@ struct cifs_ses {
        enum statusEnum status;
        unsigned overrideSecFlg;  /* if non-zero override global sec flags */
        __u16 ipc_tid;          /* special tid for connection to IPC share */
-        __u16 vcnum;
        char *serverOS;         /* name of operating system underlying server */
        char *serverNOS;        /* name of network operating system of server */
        char *serverDomain;     /* security realm of server */
@@ -1272,6 +1268,7 @@ struct dfs_info3_param {
 #define CIFS_FATTR_DELETE_PENDING       0x2
 #define CIFS_FATTR_NEED_REVAL           0x4
 #define CIFS_FATTR_INO_COLLISION        0x8
+#define CIFS_FATTR_UNKNOWN_NLINK        0x10
 struct cifs_fattr {
        u32             cf_flags;
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 948676db8e2e..08f9dfb1a894 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -1491,15 +1491,30 @@ struct file_notify_information {
        __u8  FileName[0];
 } __attribute__((packed));
-struct reparse_data {
+/* For IO_REPARSE_TAG_SYMLINK */
-        __u32   ReparseTag;
+struct reparse_symlink_data {
-        __u16   ReparseDataLength;
+        __le32  ReparseTag;
+        __le16  ReparseDataLength;
        __u16   Reserved;
-        __u16   SubstituteNameOffset;
+        __le16  SubstituteNameOffset;
-        __u16   SubstituteNameLength;
+        __le16  SubstituteNameLength;
-        __u16   PrintNameOffset;
+        __le16  PrintNameOffset;
-        __u16   PrintNameLength;
+        __le16  PrintNameLength;
-        __u32   Flags;
+        __le32  Flags;
+        char    PathBuffer[0];
+} __attribute__((packed));
+/* For IO_REPARSE_TAG_NFS */
+#define NFS_SPECFILE_LNK        0x00000000014B4E4C
+#define NFS_SPECFILE_CHR        0x0000000000524843
+#define NFS_SPECFILE_BLK        0x00000000004B4C42
+#define NFS_SPECFILE_FIFO       0x000000004F464946
+#define NFS_SPECFILE_SOCK       0x000000004B434F53
+struct reparse_posix_data {
+        __le32  ReparseTag;
+        __le16  ReparseDataLength;
+        __u16   Reserved;
+        __le64  InodeType; /* LNK, FIFO, CHR etc. */
        char    PathBuffer[0];
 } __attribute__((packed));
@@ -2652,26 +2667,7 @@ typedef struct file_xattr_info {
 } __attribute__((packed)) FILE_XATTR_INFO; /* extended attribute info
                                              level 0x205 */
+/* flags for lsattr and chflags commands removed arein uapi/linux/fs.h */
-/* flags for chattr command */
-#define EXT_SECURE_DELETE               0x00000001 /* EXT3_SECRM_FL */
-#define EXT_ENABLE_UNDELETE             0x00000002 /* EXT3_UNRM_FL */
-/* Reserved for compress file 0x4 */
-#define EXT_SYNCHRONOUS                 0x00000008 /* EXT3_SYNC_FL */
-#define EXT_IMMUTABLE_FL                0x00000010 /* EXT3_IMMUTABLE_FL */
-#define EXT_OPEN_APPEND_ONLY            0x00000020 /* EXT3_APPEND_FL */
-#define EXT_DO_NOT_BACKUP               0x00000040 /* EXT3_NODUMP_FL */
-#define EXT_NO_UPDATE_ATIME             0x00000080 /* EXT3_NOATIME_FL */
-/* 0x100 through 0x800 reserved for compression flags and are GET-ONLY */
-#define EXT_HASH_TREE_INDEXED_DIR       0x00001000 /* GET-ONLY EXT3_INDEX_FL */
-/* 0x2000 reserved for IMAGIC_FL */
-#define EXT_JOURNAL_THIS_FILE   0x00004000 /* GET-ONLY EXT3_JOURNAL_DATA_FL */
-/* 0x8000 reserved for EXT3_NOTAIL_FL */
-#define EXT_SYNCHRONOUS_DIR             0x00010000 /* EXT3_DIRSYNC_FL */
-#define EXT_TOPDIR                      0x00020000 /* EXT3_TOPDIR_FL */
-#define EXT_SET_MASK                    0x000300FF
-#define EXT_GET_MASK                    0x0003DFFF
 typedef struct file_chattr_info {
        __le64  mask; /* list of all possible attribute bits */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index a3d74fea1623..ccd31ab815d4 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -463,7 +463,6 @@ decode_lanman_negprot_rsp(struct TCP_Server_Info *server, NEGOTIATE_RSP *pSMBr)
                               cifs_max_pending);
        set_credits(server, server->maxReq);
        server->maxBuf = le16_to_cpu(rsp->MaxBufSize);
-        server->max_vcs = le16_to_cpu(rsp->MaxNumberVcs);
        /* even though we do not use raw we might as well set this
        accurately, in case we ever find a need for it */
        if ((le16_to_cpu(rsp->RawMode) & RAW_ENABLE) == RAW_ENABLE) {
@@ -3089,7 +3088,8 @@ CIFSSMBQuerySymLink(const unsigned int xid, struct cifs_tcon *tcon,
        bool is_unicode;
        unsigned int sub_len;
        char *sub_start;
-        struct reparse_data *reparse_buf;
+        struct reparse_symlink_data *reparse_buf;
+        struct reparse_posix_data *posix_buf;
        __u32 data_offset, data_count;
        char *end_of_smb;
@@ -3138,20 +3138,47 @@ CIFSSMBQuerySymLink(const unsigned int xid, struct cifs_tcon *tcon,
                goto qreparse_out;
        }
        end_of_smb = 2 + get_bcc(&pSMBr->hdr) + (char *)&pSMBr->ByteCount;
-        reparse_buf = (struct reparse_data *)
+        reparse_buf = (struct reparse_symlink_data *)
                                ((char *)&pSMBr->hdr.Protocol + data_offset);
        if ((char *)reparse_buf >= end_of_smb) {
                rc = -EIO;
                goto qreparse_out;
        }
-        if ((reparse_buf->PathBuffer + reparse_buf->PrintNameOffset +
+        if (reparse_buf->ReparseTag == cpu_to_le32(IO_REPARSE_TAG_NFS)) {
-                                reparse_buf->PrintNameLength) > end_of_smb) {
+                cifs_dbg(FYI, "NFS style reparse tag\n");
+                posix_buf =  (struct reparse_posix_data *)reparse_buf;
+                if (posix_buf->InodeType != cpu_to_le64(NFS_SPECFILE_LNK)) {
+                        cifs_dbg(FYI, "unsupported file type 0x%llx\n",
+                                 le64_to_cpu(posix_buf->InodeType));
+                        rc = -EOPNOTSUPP;
+                        goto qreparse_out;
+                }
+                is_unicode = true;
+                sub_len = le16_to_cpu(reparse_buf->ReparseDataLength);
+                if (posix_buf->PathBuffer + sub_len > end_of_smb) {
+                        cifs_dbg(FYI, "reparse buf beyond SMB\n");
+                        rc = -EIO;
+                        goto qreparse_out;
+                }
+                *symlinkinfo = cifs_strndup_from_utf16(posix_buf->PathBuffer,
+                                sub_len, is_unicode, nls_codepage);
+                goto qreparse_out;
+        } else if (reparse_buf->ReparseTag !=
+                        cpu_to_le32(IO_REPARSE_TAG_SYMLINK)) {
+                rc = -EOPNOTSUPP;
+                goto qreparse_out;
+        }
+        /* Reparse tag is NTFS symlink */
+        sub_start = le16_to_cpu(reparse_buf->SubstituteNameOffset) +
+                                reparse_buf->PathBuffer;
+        sub_len = le16_to_cpu(reparse_buf->SubstituteNameLength);
+        if (sub_start + sub_len > end_of_smb) {
                cifs_dbg(FYI, "reparse buf beyond SMB\n");
                rc = -EIO;
                goto qreparse_out;
        }
-        sub_start = reparse_buf->SubstituteNameOffset + reparse_buf->PathBuffer;
-        sub_len = reparse_buf->SubstituteNameLength;
        if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE)
                is_unicode = true;
        else
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index eb955b525e55..7ddddf2e2504 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -3254,6 +3254,9 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
        /*
         * Reads as many pages as possible from fscache. Returns -ENOBUFS
         * immediately if the cookie is negative
+         *
+         * After this point, every page in the list might have PG_fscache set,
+         * so we will need to clean that up off of every page we don't use.
         */
        rc = cifs_readpages_from_fscache(mapping->host, mapping, page_list,
                                         &num_pages);
@@ -3376,6 +3379,11 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                kref_put(&rdata->refcount, cifs_readdata_release);
        }
+        /* Any pages that have been shown to fscache but didn't get added to
+         * the pagecache must be uncached before they get returned to the
+         * allocator.
+         */
+        cifs_fscache_readpages_cancel(mapping->host, page_list);
        return rc;
 }
diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
index 2f4bc5a58054..b3258f35e88a 100644
--- a/fs/cifs/fscache.c
+++ b/fs/cifs/fscache.c
@@ -223,6 +223,13 @@ void __cifs_readpage_to_fscache(struct inode *inode, struct page *page)
                fscache_uncache_page(CIFS_I(inode)->fscache, page);
 }
+void __cifs_fscache_readpages_cancel(struct inode *inode, struct list_head *pages)
+{
+        cifs_dbg(FYI, "%s: (fsc: %p, i: %p)\n",
+                 __func__, CIFS_I(inode)->fscache, inode);
+        fscache_readpages_cancel(CIFS_I(inode)->fscache, pages);
+}
 void __cifs_fscache_invalidate_page(struct page *page, struct inode *inode)
 {
        struct cifsInodeInfo *cifsi = CIFS_I(inode);
diff --git a/fs/cifs/fscache.h b/fs/cifs/fscache.h
index 63539323e0b9..24794b6cd8ec 100644
--- a/fs/cifs/fscache.h
+++ b/fs/cifs/fscache.h
@@ -54,6 +54,7 @@ extern int __cifs_readpages_from_fscache(struct inode *,
                                         struct address_space *,
                                         struct list_head *,
                                         unsigned *);
+extern void __cifs_fscache_readpages_cancel(struct inode *, struct list_head *);
 extern void __cifs_readpage_to_fscache(struct inode *, struct page *);
@@ -91,6 +92,13 @@ static inline void cifs_readpage_to_fscache(struct inode *inode,
                __cifs_readpage_to_fscache(inode, page);
 }
+static inline void cifs_fscache_readpages_cancel(struct inode *inode,
+                                                 struct list_head *pages)
+{
+        if (CIFS_I(inode)->fscache)
+                return __cifs_fscache_readpages_cancel(inode, pages);
+}
 #else /* CONFIG_CIFS_FSCACHE */
 static inline int cifs_fscache_register(void) { return 0; }
 static inline void cifs_fscache_unregister(void) {}
@@ -131,6 +139,11 @@ static inline int cifs_readpages_from_fscache(struct inode *inode,
 static inline void cifs_readpage_to_fscache(struct inode *inode,
                        struct page *page) {}
+static inline void cifs_fscache_readpages_cancel(struct inode *inode,
+                                                 struct list_head *pages)
+{
+}
 #endif /* CONFIG_CIFS_FSCACHE */
 #endif /* _CIFS_FSCACHE_H */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f9ff9c173f78..867b7cdc794a 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -120,6 +120,33 @@ cifs_revalidate_cache(struct inode *inode, struct cifs_fattr *fattr)
        cifs_i->invalid_mapping = true;
 }
+/*
+ * copy nlink to the inode, unless it wasn't provided.  Provide
+ * sane values if we don't have an existing one and none was provided
+ */
+static void
+cifs_nlink_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
+{
+        /*
+         * if we're in a situation where we can't trust what we
+         * got from the server (readdir, some non-unix cases)
+         * fake reasonable values
+         */
+        if (fattr->cf_flags & CIFS_FATTR_UNKNOWN_NLINK) {
+                /* only provide fake values on a new inode */
+                if (inode->i_state & I_NEW) {
+                        if (fattr->cf_cifsattrs & ATTR_DIRECTORY)
+                                set_nlink(inode, 2);
+                        else
+                                set_nlink(inode, 1);
+                }
+                return;
+        }
+        /* we trust the server, so update it */
+        set_nlink(inode, fattr->cf_nlink);
+}
 /* populate an inode with info from a cifs_fattr struct */
 void
 cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
@@ -134,7 +161,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
        inode->i_mtime = fattr->cf_mtime;
        inode->i_ctime = fattr->cf_ctime;
        inode->i_rdev = fattr->cf_rdev;
-        set_nlink(inode, fattr->cf_nlink);
+        cifs_nlink_fattr_to_inode(inode, fattr);
        inode->i_uid = fattr->cf_uid;
        inode->i_gid = fattr->cf_gid;
@@ -541,6 +568,7 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
        fattr->cf_bytes = le64_to_cpu(info->AllocationSize);
        fattr->cf_createtime = le64_to_cpu(info->CreationTime);
+        fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
        if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
                fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
                fattr->cf_dtype = DT_DIR;
@@ -548,7 +576,8 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                 * Server can return wrong NumberOfLinks value for directories
                 * when Unix extensions are disabled - fake it.
                 */
-                fattr->cf_nlink = 2;
+                if (!tcon->unix_ext)
+                        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
        } else if (fattr->cf_cifsattrs & ATTR_REPARSE) {
                fattr->cf_mode = S_IFLNK;
                fattr->cf_dtype = DT_LNK;
@@ -561,11 +590,15 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                if (fattr->cf_cifsattrs & ATTR_READONLY)
                        fattr->cf_mode &= ~(S_IWUGO);
-                fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+                /*
-                if (fattr->cf_nlink < 1) {
+                 * Don't accept zero nlink from non-unix servers unless
-                        cifs_dbg(1, "replacing bogus file nlink value %u\n",
+                 * delete is pending.  Instead mark it as unknown.
+                 */
+                if ((fattr->cf_nlink < 1) && !tcon->unix_ext &&
+                    !info->DeletePending) {
+                        cifs_dbg(1, "bogus file nlink value %u\n",
                                fattr->cf_nlink);
-                        fattr->cf_nlink = 1;
+                        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
                }
        }
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index af847e1cf1c1..651a5279607b 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -780,7 +780,9 @@ static const struct {
        ERRDOS, ERRnoaccess, 0xc0000290}, {
        ERRDOS, ERRbadfunc, 0xc000029c}, {
        ERRDOS, ERRsymlink, NT_STATUS_STOPPED_ON_SYMLINK}, {
-        ERRDOS, ERRinvlevel, 0x007c0001}, };
+        ERRDOS, ERRinvlevel, 0x007c0001}, {
+        0, 0, 0 }
+};
 /*****************************************************************************
 Print an error message from the status code
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 42ef03be089f..53a75f3d0179 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -180,6 +180,9 @@ cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb)
                fattr->cf_dtype = DT_REG;
        }
+        /* non-unix readdir doesn't provide nlink */
+        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
        if (fattr->cf_cifsattrs & ATTR_READONLY)
                fattr->cf_mode &= ~S_IWUGO;
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 5f99b7f19e78..e87387dbf39f 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -32,88 +32,6 @@
 #include <linux/slab.h>
 #include "cifs_spnego.h"
-/*
- * Checks if this is the first smb session to be reconnected after
- * the socket has been reestablished (so we know whether to use vc 0).
- * Called while holding the cifs_tcp_ses_lock, so do not block
- */
-static bool is_first_ses_reconnect(struct cifs_ses *ses)
-{
-        struct list_head *tmp;
-        struct cifs_ses *tmp_ses;
-        list_for_each(tmp, &ses->server->smb_ses_list) {
-                tmp_ses = list_entry(tmp, struct cifs_ses,
-                                     smb_ses_list);
-                if (tmp_ses->need_reconnect == false)
-                        return false;
-        }
-        /* could not find a session that was already connected,
-           this must be the first one we are reconnecting */
-        return true;
-}
-/*
- *      vc number 0 is treated specially by some servers, and should be the
- *      first one we request.  After that we can use vcnumbers up to maxvcs,
- *      one for each smb session (some Windows versions set maxvcs incorrectly
- *      so maxvc=1 can be ignored).  If we have too many vcs, we can reuse
- *      any vc but zero (some servers reset the connection on vcnum zero)
- *
- */
-static __le16 get_next_vcnum(struct cifs_ses *ses)
-{
-        __u16 vcnum = 0;
-        struct list_head *tmp;
-        struct cifs_ses *tmp_ses;
-        __u16 max_vcs = ses->server->max_vcs;
-        __u16 i;
-        int free_vc_found = 0;
-        /* Quoting the MS-SMB specification: "Windows-based SMB servers set this
-        field to one but do not enforce this limit, which allows an SMB client
-        to establish more virtual circuits than allowed by this value ... but
-        other server implementations can enforce this limit." */
-        if (max_vcs < 2)
-                max_vcs = 0xFFFF;
-        spin_lock(&cifs_tcp_ses_lock);
-        if ((ses->need_reconnect) && is_first_ses_reconnect(ses))
-                        goto get_vc_num_exit;  /* vcnum will be zero */
-        for (i = ses->server->srv_count - 1; i < max_vcs; i++) {
-                if (i == 0) /* this is the only connection, use vc 0 */
-                        break;
-                free_vc_found = 1;
-                list_for_each(tmp, &ses->server->smb_ses_list) {
-                        tmp_ses = list_entry(tmp, struct cifs_ses,
-                                             smb_ses_list);
-                        if (tmp_ses->vcnum == i) {
-                                free_vc_found = 0;
-                                break; /* found duplicate, try next vcnum */
-                        }
-                }
-                if (free_vc_found)
-                        break; /* we found a vcnumber that will work - use it */
-        }
-        if (i == 0)
-                vcnum = 0; /* for most common case, ie if one smb session, use
-                              vc zero.  Also for case when no free vcnum, zero
-                              is safest to send (some clients only send zero) */
-        else if (free_vc_found == 0)
-                vcnum = 1;  /* we can not reuse vc=0 safely, since some servers
-                                reset all uids on that, but 1 is ok. */
-        else
-                vcnum = i;
-        ses->vcnum = vcnum;
-get_vc_num_exit:
-        spin_unlock(&cifs_tcp_ses_lock);
-        return cpu_to_le16(vcnum);
-}
 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
 {
        __u32 capabilities = 0;
@@ -128,7 +46,7 @@ static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
                                        CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
                                        USHRT_MAX));
        pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
-        pSMB->req.VcNumber = get_next_vcnum(ses);
+        pSMB->req.VcNumber = __constant_cpu_to_le16(1);
        /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
@@ -582,9 +500,9 @@ select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
                                return NTLMv2;
                        if (global_secflags & CIFSSEC_MAY_NTLM)
                                return NTLM;
-                        /* Fallthrough */
                default:
-                        return Unspecified;
+                        /* Fallthrough to attempt LANMAN authentication next */
+                        break;
                }
        case CIFS_NEGFLAVOR_LANMAN:
                switch (requested) {
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index eba0efde66d7..edccb5252462 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -687,6 +687,10 @@ SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
        else
                return -EIO;
+        /* no need to send SMB logoff if uid already closed due to reconnect */
+        if (ses->need_reconnect)
+                goto smb2_session_already_dead;
        rc = small_smb2_init(SMB2_LOGOFF, NULL, (void **) &req);
        if (rc)
                return rc;
@@ -701,6 +705,8 @@ SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
         * No tcon so can't do
         * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
         */
+smb2_session_already_dead:
        return rc;
 }
diff --git a/fs/cifs/smbfsctl.h b/fs/cifs/smbfsctl.h
index d952ee48f4dc..a4b2391fe66e 100644
--- a/fs/cifs/smbfsctl.h
+++ b/fs/cifs/smbfsctl.h
@@ -97,9 +97,23 @@
 #define FSCTL_QUERY_NETWORK_INTERFACE_INFO 0x001401FC /* BB add struct */
 #define FSCTL_SRV_READ_HASH          0x001441BB /* BB add struct */
+/* See FSCC 2.1.2.5 */
 #define IO_REPARSE_TAG_MOUNT_POINT   0xA0000003
 #define IO_REPARSE_TAG_HSM           0xC0000004
 #define IO_REPARSE_TAG_SIS           0x80000007
+#define IO_REPARSE_TAG_HSM2          0x80000006
+#define IO_REPARSE_TAG_DRIVER_EXTENDER 0x80000005
+/* Used by the DFS filter. See MS-DFSC */
+#define IO_REPARSE_TAG_DFS           0x8000000A
+/* Used by the DFS filter See MS-DFSC */
+#define IO_REPARSE_TAG_DFSR          0x80000012
+#define IO_REPARSE_TAG_FILTER_MANAGER 0x8000000B
+/* See section MS-FSCC 2.1.2.4 */
+#define IO_REPARSE_TAG_SYMLINK       0xA000000C
+#define IO_REPARSE_TAG_DEDUP         0x80000013
+#define IO_REPARSE_APPXSTREAM        0xC0000014
+/* NFS symlinks, Win 8/SMB3 and later */
+#define IO_REPARSE_TAG_NFS           0x80000014
 /* fsctl flags */
 /* If Flags is set to this value, the request is an FSCTL not ioctl request */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 6fdcb1b4a106..800b938e4061 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -410,8 +410,13 @@ static int
 wait_for_free_request(struct TCP_Server_Info *server, const int timeout,
                      const int optype)
 {
-        return wait_for_free_credits(server, timeout,
+        int *val;
-                                server->ops->get_credits_field(server, optype));
+        val = server->ops->get_credits_field(server, optype);
+        /* Since an echo is already inflight, no need to wait to send another */
+        if (*val <= 0 && optype == CIFS_ECHO_OP)
+                return -EAGAIN;
+        return wait_for_free_credits(server, timeout, val);
 }
 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 1194b1f0f839..f8cde46de9cd 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1783,7 +1783,7 @@ retry:
                d_tmpfile(dentry, inode);
                err = ext3_orphan_add(handle, inode);
                if (err)
-                        goto err_drop_inode;
+                        goto err_unlock_inode;
                mark_inode_dirty(inode);
                unlock_new_inode(inode);
        }
@@ -1791,10 +1791,9 @@ retry:
        if (err == -ENOSPC && ext3_should_retry_alloc(dir->i_sb, &retries))
                goto retry;
        return err;
-err_drop_inode:
+err_unlock_inode:
        ext3_journal_stop(handle);
        unlock_new_inode(inode);
-        iput(inode);
        return err;
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 0d424d7ac02b..e274e9c1171f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2563,7 +2563,7 @@ retry:
                        break;
        }
        blk_finish_plug(&plug);
-        if (!ret && !cycled) {
+        if (!ret && !cycled && wbc->nr_to_write > 0) {
                cycled = 1;
                mpd.last_page = writeback_index - 1;
                mpd.first_page = 0;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 1bec5a5c1e45..5a0408d7b114 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2319,7 +2319,7 @@ retry:
                d_tmpfile(dentry, inode);
                err = ext4_orphan_add(handle, inode);
                if (err)
-                        goto err_drop_inode;
+                        goto err_unlock_inode;
                mark_inode_dirty(inode);
                unlock_new_inode(inode);
        }
@@ -2328,10 +2328,9 @@ retry:
        if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))
                goto retry;
        return err;
-err_drop_inode:
+err_unlock_inode:
        ext4_journal_stop(handle);
        unlock_new_inode(inode);
-        iput(inode);
        return err;
 }
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index c081e34f717f..03e9bebba198 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1350,6 +1350,8 @@ retry:
                                    s_min_extra_isize) {
                                        tried_min_extra_isize++;
                                        new_extra_isize = s_min_extra_isize;
+                                        kfree(is); is = NULL;
+                                        kfree(bs); bs = NULL;
                                        goto retry;
                                }
                                error = -1;
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 62b43b577bfc..b7989f2ab4c4 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -182,6 +182,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
        struct inode *inode;
        struct dentry *parent;
        struct fuse_conn *fc;
+        struct fuse_inode *fi;
        int ret;
        inode = ACCESS_ONCE(entry->d_inode);
@@ -228,7 +229,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                if (!err && !outarg.nodeid)
                        err = -ENOENT;
                if (!err) {
-                        struct fuse_inode *fi = get_fuse_inode(inode);
+                        fi = get_fuse_inode(inode);
                        if (outarg.nodeid != get_node_id(inode)) {
                                fuse_queue_forget(fc, forget, outarg.nodeid, 1);
                                goto invalid;
@@ -246,8 +247,11 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                                       attr_version);
                fuse_change_entry_timeout(entry, &outarg);
        } else if (inode) {
-                fc = get_fuse_conn(inode);
+                fi = get_fuse_inode(inode);
-                if (fc->readdirplus_auto) {
+                if (flags & LOOKUP_RCU) {
+                        if (test_bit(FUSE_I_INIT_RDPLUS, &fi->state))
+                                return -ECHILD;
+                } else if (test_and_clear_bit(FUSE_I_INIT_RDPLUS, &fi->state)) {
                        parent = dget_parent(entry);
                        fuse_advise_use_readdirplus(parent->d_inode);
                        dput(parent);
@@ -259,7 +263,8 @@ out:
 invalid:
        ret = 0;
-        if (check_submounts_and_drop(entry) != 0)
+        if (!(flags & LOOKUP_RCU) && check_submounts_and_drop(entry) != 0)
                ret = 1;
        goto out;
 }
@@ -1063,6 +1068,8 @@ static int fuse_access(struct inode *inode, int mask)
        struct fuse_access_in inarg;
        int err;
+        BUG_ON(mask & MAY_NOT_BLOCK);
        if (fc->no_access)
                return 0;
@@ -1150,9 +1157,6 @@ static int fuse_permission(struct inode *inode, int mask)
                   noticed immediately, only after the attribute
                   timeout has expired */
        } else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
-                if (mask & MAY_NOT_BLOCK)
-                        return -ECHILD;
                err = fuse_access(inode, mask);
        } else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
                if (!(inode->i_mode & S_IXUGO)) {
@@ -1291,6 +1295,8 @@ static int fuse_direntplus_link(struct file *file,
        }
 found:
+        if (fc->readdirplus_auto)
+                set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);
        fuse_change_entry_timeout(dentry, o);
        err = 0;
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index d409deafc67b..4598345ab87d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2467,6 +2467,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
 {
        struct fuse_file *ff = file->private_data;
        struct inode *inode = file->f_inode;
+        struct fuse_inode *fi = get_fuse_inode(inode);
        struct fuse_conn *fc = ff->fc;
        struct fuse_req *req;
        struct fuse_fallocate_in inarg = {
@@ -2484,10 +2485,20 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
        if (lock_inode) {
                mutex_lock(&inode->i_mutex);
-                if (mode & FALLOC_FL_PUNCH_HOLE)
+                if (mode & FALLOC_FL_PUNCH_HOLE) {
-                        fuse_set_nowrite(inode);
+                        loff_t endbyte = offset + length - 1;
+                        err = filemap_write_and_wait_range(inode->i_mapping,
+                                                           offset, endbyte);
+                        if (err)
+                                goto out;
+                        fuse_sync_writes(inode);
+                }
        }
+        if (!(mode & FALLOC_FL_KEEP_SIZE))
+                set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
        req = fuse_get_req_nopages(fc);
        if (IS_ERR(req)) {
                err = PTR_ERR(req);
@@ -2520,11 +2531,11 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
        fuse_invalidate_attr(inode);
 out:
-        if (lock_inode) {
+        if (!(mode & FALLOC_FL_KEEP_SIZE))
-                if (mode & FALLOC_FL_PUNCH_HOLE)
+                clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
-                        fuse_release_nowrite(inode);
+        if (lock_inode)
                mutex_unlock(&inode->i_mutex);
-        }
        return err;
 }
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 5ced199b50bb..5b9e6f3b6aef 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -115,6 +115,8 @@ struct fuse_inode {
 enum {
        /** Advise readdirplus  */
        FUSE_I_ADVISE_RDPLUS,
+        /** Initialized with readdirplus */
+        FUSE_I_INIT_RDPLUS,
        /** An operation changing file size is in progress  */
        FUSE_I_SIZE_UNSTABLE,
 };
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 854a8f05a610..02b0df769e2d 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1458,7 +1458,7 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
        trace_nfs_atomic_open_enter(dir, ctx, open_flags);
        nfs_block_sillyrename(dentry->d_parent);
-        inode = NFS_PROTO(dir)->open_context(dir, ctx, open_flags, &attr);
+        inode = NFS_PROTO(dir)->open_context(dir, ctx, open_flags, &attr, opened);
        nfs_unblock_sillyrename(dentry->d_parent);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index e5b804dd944c..77efaf15ec90 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -19,6 +19,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
        struct inode *dir;
        unsigned openflags = filp->f_flags;
        struct iattr attr;
+        int opened = 0;
        int err;
        /*
@@ -55,7 +56,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
                nfs_wb_all(inode);
        }
-        inode = NFS_PROTO(dir)->open_context(dir, ctx, openflags, &attr);
+        inode = NFS_PROTO(dir)->open_context(dir, ctx, openflags, &attr, &opened);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
                switch (err) {
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 95604f64cab8..c7c295e556ed 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -185,6 +185,7 @@ nfs4_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds)
        if (status)
                goto out_put;
+        smp_wmb();
        ds->ds_clp = clp;
        dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
 out:
@@ -801,34 +802,35 @@ nfs4_fl_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx)
        struct nfs4_file_layout_dsaddr *dsaddr = FILELAYOUT_LSEG(lseg)->dsaddr;
        struct nfs4_pnfs_ds *ds = dsaddr->ds_list[ds_idx];
        struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
+        struct nfs4_pnfs_ds *ret = ds;
-        if (filelayout_test_devid_unavailable(devid))
-                return NULL;
        if (ds == NULL) {
                printk(KERN_ERR "NFS: %s: No data server for offset index %d\n",
                        __func__, ds_idx);
                filelayout_mark_devid_invalid(devid);
-                return NULL;
+                goto out;
        }
+        smp_rmb();
        if (ds->ds_clp)
-                return ds;
+                goto out_test_devid;
        if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
                struct nfs_server *s = NFS_SERVER(lseg->pls_layout->plh_inode);
                int err;
                err = nfs4_ds_connect(s, ds);
-                if (err) {
+                if (err)
                        nfs4_mark_deviceid_unavailable(devid);
-                        ds = NULL;
-                }
                nfs4_clear_ds_conn_bit(ds);
        } else {
                /* Either ds is connected, or ds is NULL */
                nfs4_wait_ds_connect(ds);
        }
-        return ds;
+out_test_devid:
+        if (filelayout_test_devid_unavailable(devid))
+                ret = NULL;
+out:
+        return ret;
 }
 module_param(dataserver_retrans, uint, 0644);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 989bb9d3074d..d53d6785cba2 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -912,6 +912,7 @@ struct nfs4_opendata {
        struct iattr attrs;
        unsigned long timestamp;
        unsigned int rpc_done : 1;
+        unsigned int file_created : 1;
        unsigned int is_recover : 1;
        int rpc_status;
        int cancelled;
@@ -1946,8 +1947,13 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
        nfs_fattr_map_and_free_names(server, &data->f_attr);
-        if (o_arg->open_flags & O_CREAT)
+        if (o_arg->open_flags & O_CREAT) {
                update_changeattr(dir, &o_res->cinfo);
+                if (o_arg->open_flags & O_EXCL)
+                        data->file_created = 1;
+                else if (o_res->cinfo.before != o_res->cinfo.after)
+                        data->file_created = 1;
+        }
        if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
                server->caps &= ~NFS_CAP_POSIX_LOCK;
        if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
@@ -2191,7 +2197,8 @@ static int _nfs4_do_open(struct inode *dir,
                        struct nfs_open_context *ctx,
                        int flags,
                        struct iattr *sattr,
-                        struct nfs4_label *label)
+                        struct nfs4_label *label,
+                        int *opened)
 {
        struct nfs4_state_owner  *sp;
        struct nfs4_state     *state = NULL;
@@ -2261,6 +2268,8 @@ static int _nfs4_do_open(struct inode *dir,
                        nfs_setsecurity(state->inode, opendata->o_res.f_attr, olabel);
                }
        }
+        if (opendata->file_created)
+                *opened |= FILE_CREATED;
        if (pnfs_use_threshold(ctx_th, opendata->f_attr.mdsthreshold, server))
                *ctx_th = opendata->f_attr.mdsthreshold;
@@ -2289,7 +2298,8 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
                                        struct nfs_open_context *ctx,
                                        int flags,
                                        struct iattr *sattr,
-                                        struct nfs4_label *label)
+                                        struct nfs4_label *label,
+                                        int *opened)
 {
        struct nfs_server *server = NFS_SERVER(dir);
        struct nfs4_exception exception = { };
@@ -2297,7 +2307,7 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
        int status;
        do {
-                status = _nfs4_do_open(dir, ctx, flags, sattr, label);
+                status = _nfs4_do_open(dir, ctx, flags, sattr, label, opened);
                res = ctx->state;
                trace_nfs4_open_file(ctx, flags, status);
                if (status == 0)
@@ -2659,7 +2669,8 @@ out:
 }
 static struct inode *
-nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx, int open_flags, struct iattr *attr)
+nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx,
+                int open_flags, struct iattr *attr, int *opened)
 {
        struct nfs4_state *state;
        struct nfs4_label l = {0, 0, 0, NULL}, *label = NULL;
@@ -2667,7 +2678,7 @@ nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx, int open_flags
        label = nfs4_label_init_security(dir, ctx->dentry, attr, &l);
        /* Protect against concurrent sillydeletes */
-        state = nfs4_do_open(dir, ctx, open_flags, attr, label);
+        state = nfs4_do_open(dir, ctx, open_flags, attr, label, opened);
        nfs4_label_release_security(label);
@@ -3332,6 +3343,7 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
        struct nfs4_label l, *ilabel = NULL;
        struct nfs_open_context *ctx;
        struct nfs4_state *state;
+        int opened = 0;
        int status = 0;
        ctx = alloc_nfs_open_context(dentry, FMODE_READ);
@@ -3341,7 +3353,7 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
        ilabel = nfs4_label_init_security(dir, dentry, sattr, &l);
        sattr->ia_mode &= ~current_umask();
-        state = nfs4_do_open(dir, ctx, flags, sattr, ilabel);
+        state = nfs4_do_open(dir, ctx, flags, sattr, ilabel, &opened);
        if (IS_ERR(state)) {
                status = PTR_ERR(state);
                goto out;
@@ -7564,8 +7576,10 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
 {
        int err;
        struct page *page;
-        rpc_authflavor_t flavor;
+        rpc_authflavor_t flavor = RPC_AUTH_MAXFLAVOR;
        struct nfs4_secinfo_flavors *flavors;
+        struct nfs4_secinfo4 *secinfo;
+        int i;
        page = alloc_page(GFP_KERNEL);
        if (!page) {
@@ -7587,9 +7601,31 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
        if (err)
                goto out_freepage;
-        flavor = nfs_find_best_sec(flavors);
+        for (i = 0; i < flavors->num_flavors; i++) {
-        if (err == 0)
+                secinfo = &flavors->flavors[i];
-                err = nfs4_lookup_root_sec(server, fhandle, info, flavor);
+                switch (secinfo->flavor) {
+                case RPC_AUTH_NULL:
+                case RPC_AUTH_UNIX:
+                case RPC_AUTH_GSS:
+                        flavor = rpcauth_get_pseudoflavor(secinfo->flavor,
+                                        &secinfo->flavor_info);
+                        break;
+                default:
+                        flavor = RPC_AUTH_MAXFLAVOR;
+                        break;
+                }
+                if (flavor != RPC_AUTH_MAXFLAVOR) {
+                        err = nfs4_lookup_root_sec(server, fhandle,
+                                                   info, flavor);
+                        if (!err)
+                                break;
+                }
+        }
+        if (flavor == RPC_AUTH_MAXFLAVOR)
+                err = -EPERM;
 out_freepage:
        put_page(page);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 0ba679866e50..da276640f776 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -94,6 +94,7 @@ void nilfs_forget_buffer(struct buffer_head *bh)
        clear_buffer_nilfs_volatile(bh);
        clear_buffer_nilfs_checked(bh);
        clear_buffer_nilfs_redirected(bh);
+        clear_buffer_async_write(bh);
        clear_buffer_dirty(bh);
        if (nilfs_page_buffers_clean(page))
                __nilfs_clear_page_dirty(page);
@@ -429,6 +430,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent)
                                        "discard block %llu, size %zu",
                                        (u64)bh->b_blocknr, bh->b_size);
                        }
+                        clear_buffer_async_write(bh);
                        clear_buffer_dirty(bh);
                        clear_buffer_nilfs_volatile(bh);
                        clear_buffer_nilfs_checked(bh);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index bd88a7461063..9f6b486b6c01 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -665,7 +665,7 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
                bh = head = page_buffers(page);
                do {
-                        if (!buffer_dirty(bh))
+                        if (!buffer_dirty(bh) || buffer_async_write(bh))
                                continue;
                        get_bh(bh);
                        list_add_tail(&bh->b_assoc_buffers, listp);
@@ -699,7 +699,8 @@ static void nilfs_lookup_dirty_node_buffers(struct inode *inode,
                for (i = 0; i < pagevec_count(&pvec); i++) {
                        bh = head = page_buffers(pvec.pages[i]);
                        do {
-                                if (buffer_dirty(bh)) {
+                                if (buffer_dirty(bh) &&
+                                                !buffer_async_write(bh)) {
                                        get_bh(bh);
                                        list_add_tail(&bh->b_assoc_buffers,
                                                      listp);
@@ -1579,6 +1580,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
                list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
                                    b_assoc_buffers) {
+                        set_buffer_async_write(bh);
                        if (bh->b_page != bd_page) {
                                if (bd_page) {
                                        lock_page(bd_page);
@@ -1592,6 +1594,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
                list_for_each_entry(bh, &segbuf->sb_payload_buffers,
                                    b_assoc_buffers) {
+                        set_buffer_async_write(bh);
                        if (bh == segbuf->sb_super_root) {
                                if (bh->b_page != bd_page) {
                                        lock_page(bd_page);
@@ -1677,6 +1680,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
        list_for_each_entry(segbuf, logs, sb_list) {
                list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
                                    b_assoc_buffers) {
+                        clear_buffer_async_write(bh);
                        if (bh->b_page != bd_page) {
                                if (bd_page)
                                        end_page_writeback(bd_page);
@@ -1686,6 +1690,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
                list_for_each_entry(bh, &segbuf->sb_payload_buffers,
                                    b_assoc_buffers) {
+                        clear_buffer_async_write(bh);
                        if (bh == segbuf->sb_super_root) {
                                if (bh->b_page != bd_page) {
                                        end_page_writeback(bd_page);
@@ -1755,6 +1760,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
                                    b_assoc_buffers) {
                        set_buffer_uptodate(bh);
                        clear_buffer_dirty(bh);
+                        clear_buffer_async_write(bh);
                        if (bh->b_page != bd_page) {
                                if (bd_page)
                                        end_page_writeback(bd_page);
@@ -1776,6 +1782,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
                                    b_assoc_buffers) {
                        set_buffer_uptodate(bh);
                        clear_buffer_dirty(bh);
+                        clear_buffer_async_write(bh);
                        clear_buffer_delay(bh);
                        clear_buffer_nilfs_volatile(bh);
                        clear_buffer_nilfs_redirected(bh);
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index ef999729e274..0d3a97d2d5f6 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -70,9 +70,10 @@ static int ocfs2_dentry_revalidate(struct dentry *dentry, unsigned int flags)
         */
        if (inode == NULL) {
                unsigned long gen = (unsigned long) dentry->d_fsdata;
-                unsigned long pgen =
+                unsigned long pgen;
-                        OCFS2_I(dentry->d_parent->d_inode)->ip_dir_lock_gen;
+                spin_lock(&dentry->d_lock);
+                pgen = OCFS2_I(dentry->d_parent->d_inode)->ip_dir_lock_gen;
+                spin_unlock(&dentry->d_lock);
                trace_ocfs2_dentry_revalidate_negative(dentry->d_name.len,
                                                       dentry->d_name.name,
                                                       pgen, gen);
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 9f8ef9b7674d..8eaa1ba793fc 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -288,10 +288,14 @@ static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
 static unsigned long proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr, unsigned long len, unsigned long pgoff, unsigned long flags)
 {
        struct proc_dir_entry *pde = PDE(file_inode(file));
-        int rv = -EIO;
+        unsigned long rv = -EIO;
-        unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
+        unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long) = NULL;
        if (use_pde(pde)) {
-                get_unmapped_area = pde->proc_fops->get_unmapped_area;
+#ifdef CONFIG_MMU
+                get_unmapped_area = current->mm->get_unmapped_area;
+#endif
+                if (pde->proc_fops->get_unmapped_area)
+                        get_unmapped_area = pde->proc_fops->get_unmapped_area;
                if (get_unmapped_area)
                        rv = get_unmapped_area(file, orig_addr, len, pgoff, flags);
                unuse_pde(pde);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 7366e9d63cee..390bdab01c3c 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -941,6 +941,8 @@ static void pte_to_pagemap_entry(pagemap_entry_t *pme, struct pagemapread *pm,
                frame = pte_pfn(pte);
                flags = PM_PRESENT;
                page = vm_normal_page(vma, addr, pte);
+                if (pte_soft_dirty(pte))
+                        flags2 |= __PM_SOFT_DIRTY;
        } else if (is_swap_pte(pte)) {
                swp_entry_t entry;
                if (pte_swp_soft_dirty(pte))
@@ -960,7 +962,7 @@ static void pte_to_pagemap_entry(pagemap_entry_t *pme, struct pagemapread *pm,
        if (page && !PageAnon(page))
                flags |= PM_FILE;
-        if ((vma->vm_flags & VM_SOFTDIRTY) || pte_soft_dirty(pte))
+        if ((vma->vm_flags & VM_SOFTDIRTY))
                flags2 |= __PM_SOFT_DIRTY;
        *pme = make_pme(PM_PFRAME(frame) | PM_STATUS2(pm->v2, flags2) | flags);
diff --git a/fs/statfs.c b/fs/statfs.c
index c219e733f553..083dc0ac9140 100644
--- a/fs/statfs.c
+++ b/fs/statfs.c
@@ -94,7 +94,7 @@ retry:
 int fd_statfs(int fd, struct kstatfs *st)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_raw(fd);
        int error = -EBADF;
        if (f.file) {
                error = vfs_statfs(&f.file->f_path, st);
diff --git a/fs/super.c b/fs/super.c
index 3a96c9783a8b..0225c20f8770 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -264,6 +264,8 @@ out_free_sb:
 */
 static inline void destroy_super(struct super_block *s)
 {
+        list_lru_destroy(&s->s_dentry_lru);
+        list_lru_destroy(&s->s_inode_lru);
 #ifdef CONFIG_SMP
        free_percpu(s->s_files);
 #endif
@@ -323,8 +325,6 @@ void deactivate_locked_super(struct super_block *s)
                /* caches are now gone, we can safely kill the shrinker now */
                unregister_shrinker(&s->s_shrink);
-                list_lru_destroy(&s->s_dentry_lru);
-                list_lru_destroy(&s->s_inode_lru);
                put_filesystem(fs);
                put_super(s);
diff --git a/fs/sysv/super.c b/fs/sysv/super.c
index d0c6a007ce83..eda10959714f 100644
--- a/fs/sysv/super.c
+++ b/fs/sysv/super.c
@@ -487,6 +487,7 @@ static int v7_fill_super(struct super_block *sb, void *data, int silent)
        sbi->s_sb = sb;
        sbi->s_block_base = 0;
        sbi->s_type = FSTYPE_V7;
+        mutex_init(&sbi->s_lock);
        sb->s_fs_info = sbi;
        
        sb_set_blocksize(sb, 512);
diff --git a/fs/xfs/xfs_dir2_block.c b/fs/xfs/xfs_dir2_block.c
index 0957aa98b6c0..12dad188939d 100644
--- a/fs/xfs/xfs_dir2_block.c
+++ b/fs/xfs/xfs_dir2_block.c
@@ -1158,7 +1158,7 @@ xfs_dir2_sf_to_block(
        /*
         * Create entry for .
         */
-        dep = xfs_dir3_data_dot_entry_p(hdr);
+        dep = xfs_dir3_data_dot_entry_p(mp, hdr);
        dep->inumber = cpu_to_be64(dp->i_ino);
        dep->namelen = 1;
        dep->name[0] = '.';
@@ -1172,7 +1172,7 @@ xfs_dir2_sf_to_block(
        /*
         * Create entry for ..
         */
-        dep = xfs_dir3_data_dotdot_entry_p(hdr);
+        dep = xfs_dir3_data_dotdot_entry_p(mp, hdr);
        dep->inumber = cpu_to_be64(xfs_dir2_sf_get_parent_ino(sfp));
        dep->namelen = 2;
        dep->name[0] = dep->name[1] = '.';
@@ -1183,7 +1183,7 @@ xfs_dir2_sf_to_block(
        blp[1].hashval = cpu_to_be32(xfs_dir_hash_dotdot);
        blp[1].address = cpu_to_be32(xfs_dir2_byte_to_dataptr(mp,
                                (char *)dep - (char *)hdr));
-        offset = xfs_dir3_data_first_offset(hdr);
+        offset = xfs_dir3_data_first_offset(mp);
        /*
         * Loop over existing entries, stuff them in.
         */
diff --git a/fs/xfs/xfs_dir2_format.h b/fs/xfs/xfs_dir2_format.h
index a0961a61ac1a..9cf67381adf6 100644
--- a/fs/xfs/xfs_dir2_format.h
+++ b/fs/xfs/xfs_dir2_format.h
@@ -497,69 +497,58 @@ xfs_dir3_data_unused_p(struct xfs_dir2_data_hdr *hdr)
 /*
 * Offsets of . and .. in data space (always block 0)
 *
- * The macros are used for shortform directories as they have no headers to read
- * the magic number out of. Shortform directories need to know the size of the
- * data block header because the sfe embeds the block offset of the entry into
- * it so that it doesn't change when format conversion occurs. Bad Things Happen
- * if we don't follow this rule.
- *
 * XXX: there is scope for significant optimisation of the logic here. Right
 * now we are checking for "dir3 format" over and over again. Ideally we should
 * only do it once for each operation.
 */
-#define XFS_DIR3_DATA_DOT_OFFSET(mp)    \
-        xfs_dir3_data_hdr_size(xfs_sb_version_hascrc(&(mp)->m_sb))
-#define XFS_DIR3_DATA_DOTDOT_OFFSET(mp) \
-        (XFS_DIR3_DATA_DOT_OFFSET(mp) + xfs_dir3_data_entsize(mp, 1))
-#define XFS_DIR3_DATA_FIRST_OFFSET(mp)          \
-        (XFS_DIR3_DATA_DOTDOT_OFFSET(mp) + xfs_dir3_data_entsize(mp, 2))
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_dot_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dot_offset(struct xfs_mount *mp)
 {
-        return xfs_dir3_data_entry_offset(hdr);
+        return xfs_dir3_data_hdr_size(xfs_sb_version_hascrc(&mp->m_sb));
 }
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_dotdot_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dotdot_offset(struct xfs_mount *mp)
 {
-        bool dir3 = hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC) ||
+        return xfs_dir3_data_dot_offset(mp) +
-                    hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC);
+                xfs_dir3_data_entsize(mp, 1);
-        return xfs_dir3_data_dot_offset(hdr) +
-                __xfs_dir3_data_entsize(dir3, 1);
 }
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_first_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_first_offset(struct xfs_mount *mp)
 {
-        bool dir3 = hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC) ||
+        return xfs_dir3_data_dotdot_offset(mp) +
-                    hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC);
+                xfs_dir3_data_entsize(mp, 2);
-        return xfs_dir3_data_dotdot_offset(hdr) +
-                __xfs_dir3_data_entsize(dir3, 2);
 }
 /*
 * location of . and .. in data space (always block 0)
 */
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_dot_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dot_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
        return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_dot_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_dot_offset(mp));
 }
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_dotdot_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dotdot_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
        return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_dotdot_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_dotdot_offset(mp));
 }
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_first_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_first_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
        return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_first_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_first_offset(mp));
 }
 /*
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 8993ec17452c..8f84153e98a8 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -119,9 +119,9 @@ xfs_dir2_sf_getdents(
         * mp->m_dirdatablk.
         */
        dot_offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk,
-                                             XFS_DIR3_DATA_DOT_OFFSET(mp));
+                                             xfs_dir3_data_dot_offset(mp));
        dotdot_offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk,
-                                                XFS_DIR3_DATA_DOTDOT_OFFSET(mp));
+                                                xfs_dir3_data_dotdot_offset(mp));
        /*
         * Put . entry unless we're starting past it.
diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
index bb6e2848f473..3ef6d402084c 100644
--- a/fs/xfs/xfs_dir2_sf.c
+++ b/fs/xfs/xfs_dir2_sf.c
@@ -557,7 +557,7 @@ xfs_dir2_sf_addname_hard(
         * to insert the new entry.
         * If it's going to end up at the end then oldsfep will point there.
         */
-        for (offset = XFS_DIR3_DATA_FIRST_OFFSET(mp),
+        for (offset = xfs_dir3_data_first_offset(mp),
              oldsfep = xfs_dir2_sf_firstentry(oldsfp),
              add_datasize = xfs_dir3_data_entsize(mp, args->namelen),
              eof = (char *)oldsfep == &buf[old_isize];
@@ -640,7 +640,7 @@ xfs_dir2_sf_addname_pick(
        sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
        size = xfs_dir3_data_entsize(mp, args->namelen);
-        offset = XFS_DIR3_DATA_FIRST_OFFSET(mp);
+        offset = xfs_dir3_data_first_offset(mp);
        sfep = xfs_dir2_sf_firstentry(sfp);
        holefit = 0;
        /*
@@ -713,7 +713,7 @@ xfs_dir2_sf_check(
        mp = dp->i_mount;
        sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
-        offset = XFS_DIR3_DATA_FIRST_OFFSET(mp);
+        offset = xfs_dir3_data_first_offset(mp);
        ino = xfs_dir2_sf_get_parent_ino(sfp);
        i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 71520e6e5d65..1ee776d477c3 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -64,7 +64,8 @@ int xfs_dqerror_mod = 33;
 struct kmem_zone                *xfs_qm_dqtrxzone;
 static struct kmem_zone         *xfs_qm_dqzone;
-static struct lock_class_key xfs_dquot_other_class;
+static struct lock_class_key xfs_dquot_group_class;
+static struct lock_class_key xfs_dquot_project_class;
 /*
 * This is called to free all the memory associated with a dquot
@@ -703,8 +704,20 @@ xfs_qm_dqread(
         * Make sure group quotas have a different lock class than user
         * quotas.
         */
-        if (!(type & XFS_DQ_USER))
+        switch (type) {
-                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_other_class);
+        case XFS_DQ_USER:
+                /* uses the default lock class */
+                break;
+        case XFS_DQ_GROUP:
+                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_group_class);
+                break;
+        case XFS_DQ_PROJ:
+                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_project_class);
+                break;
+        default:
+                ASSERT(0);
+                break;
+        }
        XFS_STATS_INC(xs_qm_dquot);
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index cc179878fe41..39797490a1f1 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1585,6 +1585,7 @@ xlog_recover_add_to_trans(
                "bad number of regions (%d) in inode log format",
                                  in_f->ilf_size);
                        ASSERT(0);
+                        kmem_free(ptr);
                        return XFS_ERROR(EIO);
                }
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 02e113bb8b7d..d9019821aa60 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -311,7 +311,6 @@ struct acpi_device {
        unsigned int physical_node_count;
        struct list_head physical_node_list;
        struct mutex physical_node_lock;
-        struct list_head power_dependent;
        void (*remove)(struct acpi_device *);
 };
@@ -456,8 +455,6 @@ acpi_status acpi_add_pm_notifier(struct acpi_device *adev,
 acpi_status acpi_remove_pm_notifier(struct acpi_device *adev,
                                    acpi_notify_handler handler);
 int acpi_pm_device_sleep_state(struct device *, int *, int);
-void acpi_dev_pm_add_dependent(acpi_handle handle, struct device *depdev);
-void acpi_dev_pm_remove_dependent(acpi_handle handle, struct device *depdev);
 #else
 static inline acpi_status acpi_add_pm_notifier(struct acpi_device *adev,
                                               acpi_notify_handler handler,
@@ -478,10 +475,6 @@ static inline int acpi_pm_device_sleep_state(struct device *d, int *p, int m)
        return (m >= ACPI_STATE_D0 && m <= ACPI_STATE_D3_COLD) ?
                m : ACPI_STATE_D0;
 }
-static inline void acpi_dev_pm_add_dependent(acpi_handle handle,
-                                             struct device *depdev) {}
-static inline void acpi_dev_pm_remove_dependent(acpi_handle handle,
-                                                struct device *depdev) {}
 #endif
 #ifdef CONFIG_PM_RUNTIME
diff --git a/include/asm-generic/hugetlb.h b/include/asm-generic/hugetlb.h
index d06079c774a0..99b490b4d05a 100644
--- a/include/asm-generic/hugetlb.h
+++ b/include/asm-generic/hugetlb.h
@@ -6,12 +6,12 @@ static inline pte_t mk_huge_pte(struct page *page, pgprot_t pgprot)
        return mk_pte(page, pgprot);
 }
-static inline int huge_pte_write(pte_t pte)
+static inline unsigned long huge_pte_write(pte_t pte)
 {
        return pte_write(pte);
 }
-static inline int huge_pte_dirty(pte_t pte)
+static inline unsigned long huge_pte_dirty(pte_t pte)
 {
        return pte_dirty(pte);
 }
diff --git a/include/asm-generic/vtime.h b/include/asm-generic/vtime.h
index e69de29bb2d1..b1a49677fe25 100644
--- a/include/asm-generic/vtime.h
+++ b/include/asm-generic/vtime.h
@@ -0,0 +1 @@
+/* no content, but patch(1) dislikes empty files */
diff --git a/include/dt-bindings/pinctrl/omap.h b/include/dt-bindings/pinctrl/omap.h
index edbd250809cb..bed35e36fd27 100644
--- a/include/dt-bindings/pinctrl/omap.h
+++ b/include/dt-bindings/pinctrl/omap.h
@@ -23,7 +23,7 @@
 #define PULL_UP                 (1 << 4)
 #define ALTELECTRICALSEL        (1 << 5)
-/* 34xx specific mux bit defines */
+/* omap3/4/5 specific mux bit defines */
 #define INPUT_EN                (1 << 8)
 #define OFF_EN                  (1 << 9)
 #define OFFOUT_EN               (1 << 10)
@@ -31,8 +31,6 @@
 #define OFF_PULL_EN             (1 << 12)
 #define OFF_PULL_UP             (1 << 13)
 #define WAKEUP_EN               (1 << 14)
-/* 44xx specific mux bit defines */
 #define WAKEUP_EVENT            (1 << 15)
 /* Active pin states */
diff --git a/include/linux/balloon_compaction.h b/include/linux/balloon_compaction.h
index f7f1d7169b11..089743ade734 100644
--- a/include/linux/balloon_compaction.h
+++ b/include/linux/balloon_compaction.h
@@ -159,6 +159,26 @@ static inline bool balloon_page_movable(struct page *page)
 }
 /*
+ * isolated_balloon_page - identify an isolated balloon page on private
+ *                         compaction/migration page lists.
+ *
+ * After a compaction thread isolates a balloon page for migration, it raises
+ * the page refcount to prevent concurrent compaction threads from re-isolating
+ * the same page. For that reason putback_movable_pages(), or other routines
+ * that need to identify isolated balloon pages on private pagelists, cannot
+ * rely on balloon_page_movable() to accomplish the task.
+ */
+static inline bool isolated_balloon_page(struct page *page)
+{
+        /* Already isolated balloon pages, by default, have a raised refcount */
+        if (page_flags_cleared(page) && !page_mapped(page) &&
+            page_count(page) >= 2)
+                return __is_movable_balloon_page(page);
+        return false;
+}
+/*
 * balloon_page_insert - insert a page into the balloon's page list and make
 *                       the page->mapping assignment accordingly.
 * @page    : page to be assigned as a 'balloon page'
@@ -243,6 +263,11 @@ static inline bool balloon_page_movable(struct page *page)
        return false;
 }
+static inline bool isolated_balloon_page(struct page *page)
+{
+        return false;
+}
 static inline bool balloon_page_isolate(struct page *page)
 {
        return false;
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index d66033f418c9..0333e605ea0d 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -242,6 +242,7 @@ extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
                                 struct bcma_device *core, bool enable);
 extern void bcma_core_pci_up(struct bcma_bus *bus);
 extern void bcma_core_pci_down(struct bcma_bus *bus);
+extern void bcma_core_pci_power_save(struct bcma_bus *bus, bool up);
 extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
 extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 842de225055f..ded429966c1f 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -65,6 +65,21 @@
 #define __visible __attribute__((externally_visible))
 #endif
+/*
+ * GCC 'asm goto' miscompiles certain code sequences:
+ *
+ *   http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
+ *
+ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
+ * Fixed in GCC 4.8.2 and later versions.
+ *
+ * (asm goto is automatically volatile - the naming reflects this.)
+ */
+#if GCC_VERSION <= 40801
+# define asm_volatile_goto(x...)        do { asm goto(x); asm (""); } while (0)
+#else
+# define asm_volatile_goto(x...)        do { asm goto(x); } while (0)
+#endif
 #ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
 #if GCC_VERSION >= 40400
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index 78e2ada50cd5..d380c5e68008 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -55,7 +55,7 @@
 #define DMAR_IQT_REG    0x88    /* Invalidation queue tail register */
 #define DMAR_IQ_SHIFT   4       /* Invalidation queue head/tail shift */
 #define DMAR_IQA_REG    0x90    /* Invalidation queue addr register */
-#define DMAR_ICS_REG    0x98    /* Invalidation complete status register */
+#define DMAR_ICS_REG    0x9c    /* Invalidation complete status register */
 #define DMAR_IRTA_REG   0xb8    /* Interrupt remapping table addr register */
 #define OFFSET_STRIDE           (9)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 482ad2d84a32..672ddc4de4af 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -439,6 +439,17 @@ static inline char *hex_byte_pack(char *buf, u8 byte)
        return buf;
 }
+extern const char hex_asc_upper[];
+#define hex_asc_upper_lo(x)     hex_asc_upper[((x) & 0x0f)]
+#define hex_asc_upper_hi(x)     hex_asc_upper[((x) & 0xf0) >> 4]
+static inline char *hex_byte_pack_upper(char *buf, u8 byte)
+{
+        *buf++ = hex_asc_upper_hi(byte);
+        *buf++ = hex_asc_upper_lo(byte);
+        return buf;
+}
 static inline char * __deprecated pack_hex_byte(char *buf, u8 byte)
 {
        return hex_byte_pack(buf, byte);
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index ecc82b37c4cc..b3e7a667e03c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -137,47 +137,24 @@ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
 extern void mem_cgroup_replace_page_cache(struct page *oldpage,
                                        struct page *newpage);
-/**
+static inline void mem_cgroup_oom_enable(void)
- * mem_cgroup_toggle_oom - toggle the memcg OOM killer for the current task
- * @new: true to enable, false to disable
- *
- * Toggle whether a failed memcg charge should invoke the OOM killer
- * or just return -ENOMEM.  Returns the previous toggle state.
- *
- * NOTE: Any path that enables the OOM killer before charging must
- *       call mem_cgroup_oom_synchronize() afterward to finalize the
- *       OOM handling and clean up.
- */
-static inline bool mem_cgroup_toggle_oom(bool new)
 {
-        bool old;
+        WARN_ON(current->memcg_oom.may_oom);
+        current->memcg_oom.may_oom = 1;
-        old = current->memcg_oom.may_oom;
-        current->memcg_oom.may_oom = new;
-        return old;
 }
-static inline void mem_cgroup_enable_oom(void)
+static inline void mem_cgroup_oom_disable(void)
 {
-        bool old = mem_cgroup_toggle_oom(true);
+        WARN_ON(!current->memcg_oom.may_oom);
+        current->memcg_oom.may_oom = 0;
-        WARN_ON(old == true);
-}
-static inline void mem_cgroup_disable_oom(void)
-{
-        bool old = mem_cgroup_toggle_oom(false);
-        WARN_ON(old == false);
 }
 static inline bool task_in_memcg_oom(struct task_struct *p)
 {
-        return p->memcg_oom.in_memcg_oom;
+        return p->memcg_oom.memcg;
 }
-bool mem_cgroup_oom_synchronize(void);
+bool mem_cgroup_oom_synchronize(bool wait);
 #ifdef CONFIG_MEMCG_SWAP
 extern int do_swap_account;
@@ -402,16 +379,11 @@ static inline void mem_cgroup_end_update_page_stat(struct page *page,
 {
 }
-static inline bool mem_cgroup_toggle_oom(bool new)
+static inline void mem_cgroup_oom_enable(void)
-{
-        return false;
-}
-static inline void mem_cgroup_enable_oom(void)
 {
 }
-static inline void mem_cgroup_disable_oom(void)
+static inline void mem_cgroup_oom_disable(void)
 {
 }
@@ -420,7 +392,7 @@ static inline bool task_in_memcg_oom(struct task_struct *p)
        return false;
 }
-static inline bool mem_cgroup_oom_synchronize(void)
+static inline bool mem_cgroup_oom_synchronize(bool wait)
 {
        return false;
 }
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 09c2300ddb37..cb358355ef43 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -45,6 +45,7 @@
 #define MAPPER_CTRL_MINOR       236
 #define LOOP_CTRL_MINOR         237
 #define VHOST_NET_MINOR         238
+#define UHID_MINOR              239
 #define MISC_DYNAMIC_MINOR      255
 struct device;
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index 68029b30c3dc..5eb4e31af22b 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -181,7 +181,7 @@ enum {
        MLX5_DEV_CAP_FLAG_TLP_HINTS     = 1LL << 39,
        MLX5_DEV_CAP_FLAG_SIG_HAND_OVER = 1LL << 40,
        MLX5_DEV_CAP_FLAG_DCT           = 1LL << 41,
-        MLX5_DEV_CAP_FLAG_CMDIF_CSUM    = 1LL << 46,
+        MLX5_DEV_CAP_FLAG_CMDIF_CSUM    = 3LL << 46,
 };
 enum {
@@ -417,7 +417,7 @@ struct mlx5_init_seg {
        struct health_buffer    health;
        __be32                  rsvd2[884];
        __be32                  health_counter;
-        __be32                  rsvd3[1023];
+        __be32                  rsvd3[1019];
        __be64                  ieee1588_clk;
        __be32                  ieee1588_clk_type;
        __be32                  clr_intx;
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 8888381fc150..6b8c496572c8 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -82,7 +82,7 @@ enum {
 };
 enum {
-        MLX5_MAX_EQ_NAME        = 20
+        MLX5_MAX_EQ_NAME        = 32
 };
 enum {
@@ -747,8 +747,7 @@ static inline u32 mlx5_idx_to_mkey(u32 mkey_idx)
 enum {
        MLX5_PROF_MASK_QP_SIZE          = (u64)1 << 0,
-        MLX5_PROF_MASK_CMDIF_CSUM       = (u64)1 << 1,
+        MLX5_PROF_MASK_MR_CACHE         = (u64)1 << 1,
-        MLX5_PROF_MASK_MR_CACHE         = (u64)1 << 2,
 };
 enum {
@@ -758,7 +757,6 @@ enum {
 struct mlx5_profile {
        u64     mask;
        u32     log_max_qp;
-        int     cmdif_csum;
        struct {
                int     size;
                int     limit;
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 01fd84b566f7..49f52c8f4422 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1455,7 +1455,8 @@ struct nfs_rpc_ops {
        struct inode * (*open_context) (struct inode *dir,
                                struct nfs_open_context *ctx,
                                int open_flags,
-                                struct iattr *iattr);
+                                struct iattr *iattr,
+                                int *);
        int (*have_delegation)(struct inode *, fmode_t);
        int (*return_delegation)(struct inode *);
        struct nfs_client *(*alloc_client) (const struct nfs_client_initdata *);
diff --git a/include/linux/of_reserved_mem.h b/include/linux/of_reserved_mem.h
deleted file mode 100644
index c84128255814..000000000000
--- a/include/linux/of_reserved_mem.h
+++ /dev/null
@@ -1,14 +0,0 @@
-#ifndef __OF_RESERVED_MEM_H
-#define __OF_RESERVED_MEM_H
-#ifdef CONFIG_OF_RESERVED_MEM
-void of_reserved_mem_device_init(struct device *dev);
-void of_reserved_mem_device_release(struct device *dev);
-void early_init_dt_scan_reserved_mem(void);
-#else
-static inline void of_reserved_mem_device_init(struct device *dev) { }
-static inline void of_reserved_mem_device_release(struct device *dev) { }
-static inline void early_init_dt_scan_reserved_mem(void) { }
-#endif
-#endif /* __OF_RESERVED_MEM_H */
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 866e85c5eb94..c8ba627c1d60 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -294,9 +294,31 @@ struct ring_buffer;
 */
 struct perf_event {
 #ifdef CONFIG_PERF_EVENTS
-        struct list_head                group_entry;
+        /*
+         * entry onto perf_event_context::event_list;
+         *   modifications require ctx->lock
+         *   RCU safe iterations.
+         */
        struct list_head                event_entry;
+        /*
+         * XXX: group_entry and sibling_list should be mutually exclusive;
+         * either you're a sibling on a group, or you're the group leader.
+         * Rework the code to always use the same list element.
+         *
+         * Locked for modification by both ctx->mutex and ctx->lock; holding
+         * either sufficies for read.
+         */
+        struct list_head                group_entry;
        struct list_head                sibling_list;
+        /*
+         * We need storage to track the entries in perf_pmu_migrate_context; we
+         * cannot use the event_entry because of RCU and we want to keep the
+         * group in tact which avoids us using the other two entries.
+         */
+        struct list_head                migrate_entry;
        struct hlist_node               hlist_entry;
        int                             nr_siblings;
        int                             group_flags;
diff --git a/include/linux/random.h b/include/linux/random.h
index 3b9377d6b7a5..6312dd9ba449 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -17,6 +17,7 @@ extern void add_interrupt_randomness(int irq, int irq_flags);
 extern void get_random_bytes(void *buf, int nbytes);
 extern void get_random_bytes_arch(void *buf, int nbytes);
 void generate_random_uuid(unsigned char uuid_out[16]);
+extern int random_int_secret_init(void);
 #ifndef MODULE
 extern const struct file_operations random_fops, urandom_fops;
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index 67e13aa5a478..9bdad43ad228 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -40,6 +40,8 @@ enum regulator_status {
 };
 /**
+ * struct regulator_linear_range - specify linear voltage ranges
+ *
 * Specify a range of voltages for regulator_map_linar_range() and
 * regulator_list_linear_range().
 *
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6682da36b293..e27baeeda3f4 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1394,11 +1394,10 @@ struct task_struct {
        } memcg_batch;
        unsigned int memcg_kmem_skip_account;
        struct memcg_oom_info {
+                struct mem_cgroup *memcg;
+                gfp_t gfp_mask;
+                int order;
                unsigned int may_oom:1;
-                unsigned int in_memcg_oom:1;
-                unsigned int oom_locked:1;
-                int wakeups;
-                struct mem_cgroup *wait_on_memcg;
        } memcg_oom;
 #endif
 #ifdef CONFIG_UPROBES
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2ddb48d9312c..c2d89335f637 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -498,7 +498,7 @@ struct sk_buff {
         * headers if needed
         */
        __u8                    encapsulation:1;
-        /* 7/9 bit hole (depending on ndisc_nodetype presence) */
+        /* 6/8 bit hole (depending on ndisc_nodetype presence) */
        kmemcheck_bitfield_end(flags2);
 #if defined CONFIG_NET_DMA || defined CONFIG_NET_RX_BUSY_POLL
diff --git a/include/linux/timex.h b/include/linux/timex.h
index dd3edd7dfc94..9d3f1a5b6178 100644
--- a/include/linux/timex.h
+++ b/include/linux/timex.h
@@ -64,6 +64,20 @@
 #include <asm/timex.h>
+#ifndef random_get_entropy
+/*
+ * The random_get_entropy() function is used by the /dev/random driver
+ * in order to extract entropy via the relative unpredictability of
+ * when an interrupt takes places versus a high speed, fine-grained
+ * timing source or cycle counter.  Since it will be occurred on every
+ * single interrupt, it must have a very low cost/overhead.
+ *
+ * By default we use get_cycles() for this purpose, but individual
+ * architectures may override this in their asm/timex.h header file.
+ */
+#define random_get_entropy()    get_cycles()
+#endif
 /*
 * SHIFT_PLL is used as a dampening factor to define how much we
 * adjust the frequency correction for a given offset in PLL mode.
diff --git a/include/linux/usb/usb_phy_gen_xceiv.h b/include/linux/usb/usb_phy_gen_xceiv.h
index f9a7e7bc925b..11d85b9c1b08 100644
--- a/include/linux/usb/usb_phy_gen_xceiv.h
+++ b/include/linux/usb/usb_phy_gen_xceiv.h
@@ -12,7 +12,7 @@ struct usb_phy_gen_xceiv_platform_data {
        unsigned int needs_reset:1;
 };
-#if IS_ENABLED(CONFIG_NOP_USB_XCEIV)
+#if defined(CONFIG_NOP_USB_XCEIV) || (defined(CONFIG_NOP_USB_XCEIV_MODULE) && defined(MODULE))
 /* sometimes transceivers are accessed only through e.g. ULPI */
 extern void usb_nop_xceiv_register(void);
 extern void usb_nop_xceiv_unregister(void);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 9cb2fe8ca944..e303eef94dd5 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -42,6 +42,7 @@ struct usbnet {
        struct usb_host_endpoint *status;
        unsigned                maxpacket;
        struct timer_list       delay;
+        const char              *padding_pkt;
        /* protocol/interface state */
        struct net_device       *net;
diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
index bf99cd01be20..630356866030 100644
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -66,7 +66,9 @@
        US_FLAG(INITIAL_READ10, 0x00100000)                     \
                /* Initial READ(10) (and others) must be retried */     \
        US_FLAG(WRITE_CACHE,    0x00200000)                     \
-                /* Write Cache status is not available */
+                /* Write Cache status is not available */       \
+        US_FLAG(NEEDS_CAP16,    0x00400000)
+                /* cannot handle READ_CAPACITY_10 */
 #define US_FLAG(name, value)    US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index 80cf8173a65b..2c02f3a8d2ba 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -65,15 +65,8 @@ struct pci_dev;
 *     out of the arbitration process (and can be safe to take
 *     interrupts at any time.
 */
-#if defined(CONFIG_VGA_ARB)
 extern void vga_set_legacy_decoding(struct pci_dev *pdev,
                                    unsigned int decodes);
-#else
-static inline void vga_set_legacy_decoding(struct pci_dev *pdev,
-                                           unsigned int decodes)
-{
-}
-#endif
 /**
 *     vga_get         - acquire & locks VGA resources
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index fb314de2b61b..86505bfa5d2c 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -67,6 +67,10 @@ int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr);
 #endif
+bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
+                                   const unsigned int prefix_len,
+                                   struct net_device *dev);
 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev);
 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net,
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index aaeaf0938ec0..15f10841e2b5 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -104,6 +104,7 @@ enum {
 enum {
        HCI_SETUP,
        HCI_AUTO_OFF,
+        HCI_RFKILLED,
        HCI_MGMT,
        HCI_PAIRABLE,
        HCI_SERVICE_CACHE,
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index f0d70f066f3d..9c4d37ec45a1 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -723,8 +723,6 @@ struct ip_vs_dest_dst {
        struct rcu_head         rcu_head;
 };
-/* In grace period after removing */
-#define IP_VS_DEST_STATE_REMOVING       0x01
 /*
 *      The real server destination forwarding entry
 *      with ip address, port number, and so on.
@@ -742,7 +740,7 @@ struct ip_vs_dest {
        atomic_t                refcnt;         /* reference counter */
        struct ip_vs_stats      stats;          /* statistics */
-        unsigned long           state;          /* state flags */
+        unsigned long           idle_start;     /* start time, jiffies */
        /* connection counters and thresholds */
        atomic_t                activeconns;    /* active connections */
@@ -756,14 +754,13 @@ struct ip_vs_dest {
        struct ip_vs_dest_dst __rcu *dest_dst;  /* cached dst info */
        /* for virtual service */
-        struct ip_vs_service    *svc;           /* service it belongs to */
+        struct ip_vs_service __rcu *svc;        /* service it belongs to */
        __u16                   protocol;       /* which protocol (TCP/UDP) */
        __be16                  vport;          /* virtual port number */
        union nf_inet_addr      vaddr;          /* virtual IP address */
        __u32                   vfwmark;        /* firewall mark of service */
        struct list_head        t_list;         /* in dest_trash */
-        struct rcu_head         rcu_head;
        unsigned int            in_rs_table:1;  /* we are in rs_table */
 };
@@ -1649,7 +1646,7 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
 /* CONFIG_IP_VS_NFCT */
 #endif
-static inline unsigned int
+static inline int
 ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)
 {
        /*
diff --git a/include/net/mrp.h b/include/net/mrp.h
index 4fbf02aa2ec1..0f7558b638ae 100644
--- a/include/net/mrp.h
+++ b/include/net/mrp.h
@@ -112,6 +112,7 @@ struct mrp_applicant {
        struct mrp_application  *app;
        struct net_device       *dev;
        struct timer_list       join_timer;
+        struct timer_list       periodic_timer;
        spinlock_t              lock;
        struct sk_buff_head     queue;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 1313456a0994..9d22f08896c6 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -74,6 +74,7 @@ struct net {
        struct hlist_head       *dev_index_head;
        unsigned int            dev_base_seq;   /* protected by rtnl_mutex */
        int                     ifindex;
+        unsigned int            dev_unreg_count;
        /* core fib_rules */
        struct list_head        rules_ops;
diff --git a/include/net/netfilter/nf_conntrack_synproxy.h b/include/net/netfilter/nf_conntrack_synproxy.h
index 806f54a290d6..f572f313d6f1 100644
--- a/include/net/netfilter/nf_conntrack_synproxy.h
+++ b/include/net/netfilter/nf_conntrack_synproxy.h
@@ -56,7 +56,7 @@ struct synproxy_options {
 struct tcphdr;
 struct xt_synproxy_info;
-extern void synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
+extern bool synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
                                   const struct tcphdr *th,
                                   struct synproxy_options *opts);
 extern unsigned int synproxy_options_size(const struct synproxy_options *opts);
diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
index 6ca975bebd37..c2e542b27a5a 100644
--- a/include/net/secure_seq.h
+++ b/include/net/secure_seq.h
@@ -3,7 +3,6 @@
 #include <linux/types.h>
-extern void net_secret_init(void);
 extern __u32 secure_ip_id(__be32 daddr);
 extern __u32 secure_ipv6_id(const __be32 daddr[4]);
 extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
diff --git a/include/net/sock.h b/include/net/sock.h
index 6ba2e7b0e2b1..1d37a8086bed 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -409,6 +409,11 @@ struct sock {
        void                    (*sk_destruct)(struct sock *sk);
 };
+#define __sk_user_data(sk) ((*((void __rcu **)&(sk)->sk_user_data)))
+#define rcu_dereference_sk_user_data(sk)        rcu_dereference(__sk_user_data((sk)))
+#define rcu_assign_sk_user_data(sk, ptr)        rcu_assign_pointer(__sk_user_data((sk)), ptr)
 /*
 * SK_CAN_REUSE and SK_NO_REUSE on a socket mean that the socket is OK
 * or not whether his port will be reused by someone else. SK_FORCE_REUSE
diff --git a/init/main.c b/init/main.c
index af310afbef28..63d3e8f2970c 100644
--- a/init/main.c
+++ b/init/main.c
@@ -76,6 +76,7 @@
 #include <linux/elevator.h>
 #include <linux/sched_clock.h>
 #include <linux/context_tracking.h>
+#include <linux/random.h>
 #include <asm/io.h>
 #include <asm/bugs.h>
@@ -780,6 +781,7 @@ static void __init do_basic_setup(void)
        do_ctors();
        usermodehelper_enable();
        do_initcalls();
+        random_int_secret_init();
 }
 static void __init do_pre_smp_initcalls(void)
diff --git a/ipc/msg.c b/ipc/msg.c
index 9e4310c546ae..558aa91186b6 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -695,6 +695,12 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
                if (ipcperms(ns, &msq->q_perm, S_IWUGO))
                        goto out_unlock0;
+                /* raced with RMID? */
+                if (msq->q_perm.deleted) {
+                        err = -EIDRM;
+                        goto out_unlock0;
+                }
                err = security_msg_queue_msgsnd(msq, msg, msgflg);
                if (err)
                        goto out_unlock0;
@@ -901,6 +907,13 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl
                        goto out_unlock1;
                ipc_lock_object(&msq->q_perm);
+                /* raced with RMID? */
+                if (msq->q_perm.deleted) {
+                        msg = ERR_PTR(-EIDRM);
+                        goto out_unlock0;
+                }
                msg = find_msg(msq, &msgtyp, mode);
                if (!IS_ERR(msg)) {
                        /*
diff --git a/ipc/sem.c b/ipc/sem.c
index 19c8b980d1fe..db9d241af133 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -253,70 +253,112 @@ static void sem_rcu_free(struct rcu_head *head)
 }
 /*
+ * Wait until all currently ongoing simple ops have completed.
+ * Caller must own sem_perm.lock.
+ * New simple ops cannot start, because simple ops first check
+ * that sem_perm.lock is free.
+ * that a) sem_perm.lock is free and b) complex_count is 0.
+ */
+static void sem_wait_array(struct sem_array *sma)
+{
+        int i;
+        struct sem *sem;
+        if (sma->complex_count)  {
+                /* The thread that increased sma->complex_count waited on
+                 * all sem->lock locks. Thus we don't need to wait again.
+                 */
+                return;
+        }
+        for (i = 0; i < sma->sem_nsems; i++) {
+                sem = sma->sem_base + i;
+                spin_unlock_wait(&sem->lock);
+        }
+}
+/*
 * If the request contains only one semaphore operation, and there are
 * no complex transactions pending, lock only the semaphore involved.
 * Otherwise, lock the entire semaphore array, since we either have
 * multiple semaphores in our own semops, or we need to look at
 * semaphores from other pending complex operations.
- *
- * Carefully guard against sma->complex_count changing between zero
- * and non-zero while we are spinning for the lock. The value of
- * sma->complex_count cannot change while we are holding the lock,
- * so sem_unlock should be fine.
- *
- * The global lock path checks that all the local locks have been released,
- * checking each local lock once. This means that the local lock paths
- * cannot start their critical sections while the global lock is held.
 */
 static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
                              int nsops)
 {
-        int locknum;
+        struct sem *sem;
- again:
-        if (nsops == 1 && !sma->complex_count) {
-                struct sem *sem = sma->sem_base + sops->sem_num;
-                /* Lock just the semaphore we are interested in. */
+        if (nsops != 1) {
-                spin_lock(&sem->lock);
+                /* Complex operation - acquire a full lock */
+                ipc_lock_object(&sma->sem_perm);
-                /*
+                /* And wait until all simple ops that are processed
-                 * If sma->complex_count was set while we were spinning,
+                 * right now have dropped their locks.
-                 * we may need to look at things we did not lock here.
                 */
-                if (unlikely(sma->complex_count)) {
+                sem_wait_array(sma);
-                        spin_unlock(&sem->lock);
+                return -1;
-                        goto lock_array;
+        }
-                }
+        /*
+         * Only one semaphore affected - try to optimize locking.
+         * The rules are:
+         * - optimized locking is possible if no complex operation
+         *   is either enqueued or processed right now.
+         * - The test for enqueued complex ops is simple:
+         *      sma->complex_count != 0
+         * - Testing for complex ops that are processed right now is
+         *   a bit more difficult. Complex ops acquire the full lock
+         *   and first wait that the running simple ops have completed.
+         *   (see above)
+         *   Thus: If we own a simple lock and the global lock is free
+         *      and complex_count is now 0, then it will stay 0 and
+         *      thus just locking sem->lock is sufficient.
+         */
+        sem = sma->sem_base + sops->sem_num;
+        if (sma->complex_count == 0) {
                /*
-                 * Another process is holding the global lock on the
+                 * It appears that no complex operation is around.
-                 * sem_array; we cannot enter our critical section,
+                 * Acquire the per-semaphore lock.
-                 * but have to wait for the global lock to be released.
                 */
-                if (unlikely(spin_is_locked(&sma->sem_perm.lock))) {
+                spin_lock(&sem->lock);
-                        spin_unlock(&sem->lock);
-                        spin_unlock_wait(&sma->sem_perm.lock);
+                /* Then check that the global lock is free */
-                        goto again;
+                if (!spin_is_locked(&sma->sem_perm.lock)) {
+                        /* spin_is_locked() is not a memory barrier */
+                        smp_mb();
+                        /* Now repeat the test of complex_count:
+                         * It can't change anymore until we drop sem->lock.
+                         * Thus: if is now 0, then it will stay 0.
+                         */
+                        if (sma->complex_count == 0) {
+                                /* fast path successful! */
+                                return sops->sem_num;
+                        }
                }
+                spin_unlock(&sem->lock);
+        }
+        /* slow path: acquire the full lock */
+        ipc_lock_object(&sma->sem_perm);
-                locknum = sops->sem_num;
+        if (sma->complex_count == 0) {
+                /* False alarm:
+                 * There is no complex operation, thus we can switch
+                 * back to the fast path.
+                 */
+                spin_lock(&sem->lock);
+                ipc_unlock_object(&sma->sem_perm);
+                return sops->sem_num;
        } else {
-                int i;
+                /* Not a false alarm, thus complete the sequence for a
-                /*
+                 * full lock.
-                 * Lock the semaphore array, and wait for all of the
-                 * individual semaphore locks to go away.  The code
-                 * above ensures no new single-lock holders will enter
-                 * their critical section while the array lock is held.
                 */
- lock_array:
+                sem_wait_array(sma);
-                ipc_lock_object(&sma->sem_perm);
+                return -1;
-                for (i = 0; i < sma->sem_nsems; i++) {
-                        struct sem *sem = sma->sem_base + i;
-                        spin_unlock_wait(&sem->lock);
-                }
-                locknum = -1;
        }
-        return locknum;
 }
 static inline void sem_unlock(struct sem_array *sma, int locknum)
@@ -876,6 +918,24 @@ again:
 }
 /**
+ * set_semotime(sma, sops) - set sem_otime
+ * @sma: semaphore array
+ * @sops: operations that modified the array, may be NULL
+ *
+ * sem_otime is replicated to avoid cache line trashing.
+ * This function sets one instance to the current time.
+ */
+static void set_semotime(struct sem_array *sma, struct sembuf *sops)
+{
+        if (sops == NULL) {
+                sma->sem_base[0].sem_otime = get_seconds();
+        } else {
+                sma->sem_base[sops[0].sem_num].sem_otime =
+                                                        get_seconds();
+        }
+}
+/**
 * do_smart_update(sma, sops, nsops, otime, pt) - optimized update_queue
 * @sma: semaphore array
 * @sops: operations that were performed
@@ -925,17 +985,10 @@ static void do_smart_update(struct sem_array *sma, struct sembuf *sops, int nsop
                        }
                }
        }
-        if (otime) {
+        if (otime)
-                if (sops == NULL) {
+                set_semotime(sma, sops);
-                        sma->sem_base[0].sem_otime = get_seconds();
-                } else {
-                        sma->sem_base[sops[0].sem_num].sem_otime =
-                                                                get_seconds();
-                }
-        }
 }
 /* The following counts are associated to each semaphore:
 *   semncnt        number of tasks waiting on semval being nonzero
 *   semzcnt        number of tasks waiting on semval being zero
@@ -1229,6 +1282,12 @@ static int semctl_setval(struct ipc_namespace *ns, int semid, int semnum,
        sem_lock(sma, NULL, -1);
+        if (sma->sem_perm.deleted) {
+                sem_unlock(sma, -1);
+                rcu_read_unlock();
+                return -EIDRM;
+        }
        curr = &sma->sem_base[semnum];
        ipc_assert_locked_object(&sma->sem_perm);
@@ -1283,12 +1342,14 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                int i;
                sem_lock(sma, NULL, -1);
+                if (sma->sem_perm.deleted) {
+                        err = -EIDRM;
+                        goto out_unlock;
+                }
                if(nsems > SEMMSL_FAST) {
                        if (!ipc_rcu_getref(sma)) {
-                                sem_unlock(sma, -1);
-                                rcu_read_unlock();
                                err = -EIDRM;
-                                goto out_free;
+                                goto out_unlock;
                        }
                        sem_unlock(sma, -1);
                        rcu_read_unlock();
@@ -1301,10 +1362,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                        rcu_read_lock();
                        sem_lock_and_putref(sma);
                        if (sma->sem_perm.deleted) {
-                                sem_unlock(sma, -1);
-                                rcu_read_unlock();
                                err = -EIDRM;
-                                goto out_free;
+                                goto out_unlock;
                        }
                }
                for (i = 0; i < sma->sem_nsems; i++)
@@ -1322,8 +1381,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                struct sem_undo *un;
                if (!ipc_rcu_getref(sma)) {
-                        rcu_read_unlock();
+                        err = -EIDRM;
-                        return -EIDRM;
+                        goto out_rcu_wakeup;
                }
                rcu_read_unlock();
@@ -1351,10 +1410,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                rcu_read_lock();
                sem_lock_and_putref(sma);
                if (sma->sem_perm.deleted) {
-                        sem_unlock(sma, -1);
-                        rcu_read_unlock();
                        err = -EIDRM;
-                        goto out_free;
+                        goto out_unlock;
                }
                for (i = 0; i < nsems; i++)
@@ -1378,6 +1435,10 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                goto out_rcu_wakeup;
        sem_lock(sma, NULL, -1);
+        if (sma->sem_perm.deleted) {
+                err = -EIDRM;
+                goto out_unlock;
+        }
        curr = &sma->sem_base[semnum];
        switch (cmd) {
@@ -1783,6 +1844,10 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
        if (error)
                goto out_rcu_wakeup;
+        error = -EIDRM;
+        locknum = sem_lock(sma, sops, nsops);
+        if (sma->sem_perm.deleted)
+                goto out_unlock_free;
        /*
         * semid identifiers are not unique - find_alloc_undo may have
         * allocated an undo structure, it was invalidated by an RMID
@@ -1790,19 +1855,22 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
         * This case can be detected checking un->semid. The existence of
         * "un" itself is guaranteed by rcu.
         */
-        error = -EIDRM;
-        locknum = sem_lock(sma, sops, nsops);
        if (un && un->semid == -1)
                goto out_unlock_free;
        error = perform_atomic_semop(sma, sops, nsops, un,
                                        task_tgid_vnr(current));
-        if (error <= 0) {
+        if (error == 0) {
-                if (alter && error == 0)
+                /* If the operation was successful, then do
+                 * the required updates.
+                 */
+                if (alter)
                        do_smart_update(sma, sops, nsops, 1, &tasks);
+                else
-                goto out_unlock_free;
+                        set_semotime(sma, sops);
        }
+        if (error <= 0)
+                goto out_unlock_free;
        /* We need to sleep on this operation, so we put the current
         * task into the pending queue and go to sleep.
@@ -1999,6 +2067,12 @@ void exit_sem(struct task_struct *tsk)
                }
                sem_lock(sma, NULL, -1);
+                /* exit_sem raced with IPC_RMID, nothing to do */
+                if (sma->sem_perm.deleted) {
+                        sem_unlock(sma, -1);
+                        rcu_read_unlock();
+                        continue;
+                }
                un = __lookup_undo(ulp, semid);
                if (un == NULL) {
                        /* exit_sem raced with IPC_RMID+semget() that created
@@ -2061,6 +2135,14 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
        struct sem_array *sma = it;
        time_t sem_otime;
+        /*
+         * The proc interface isn't aware of sem_lock(), it calls
+         * ipc_lock_object() directly (in sysvipc_find_ipc).
+         * In order to stay compatible with sem_lock(), we must wait until
+         * all simple semop() calls have left their critical regions.
+         */
+        sem_wait_array(sma);
        sem_otime = get_semotime(sma);
        return seq_printf(s,
diff --git a/ipc/util.c b/ipc/util.c
index fdb8ae740775..7684f41bce76 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -17,12 +17,27 @@
 *            Pavel Emelianov <xemul@openvz.org>
 *
 * General sysv ipc locking scheme:
- *  when doing ipc id lookups, take the ids->rwsem
+ *      rcu_read_lock()
- *      rcu_read_lock()
+ *          obtain the ipc object (kern_ipc_perm) by looking up the id in an idr
- *          obtain the ipc object (kern_ipc_perm)
+ *          tree.
- *          perform security, capabilities, auditing and permission checks, etc.
+ *          - perform initial checks (capabilities, auditing and permission,
- *          acquire the ipc lock (kern_ipc_perm.lock) throught ipc_lock_object()
+ *            etc).
- *             perform data updates (ie: SET, RMID, LOCK/UNLOCK commands)
+ *          - perform read-only operations, such as STAT, INFO commands.
+ *            acquire the ipc lock (kern_ipc_perm.lock) through
+ *            ipc_lock_object()
+ *              - perform data updates, such as SET, RMID commands and
+ *                mechanism-specific operations (semop/semtimedop,
+ *                msgsnd/msgrcv, shmat/shmdt).
+ *          drop the ipc lock, through ipc_unlock_object().
+ *      rcu_read_unlock()
+ *
+ *  The ids->rwsem must be taken when:
+ *      - creating, removing and iterating the existing entries in ipc
+ *        identifier sets.
+ *      - iterating through files under /proc/sysvipc/
+ *
+ *  Note that sems have a special fast path that avoids kern_ipc_perm.lock -
+ *  see sem_lock().
 */
 #include <linux/mm.h>
diff --git a/kernel/events/core.c b/kernel/events/core.c
index cb4238e85b38..d49a9d29334c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7234,15 +7234,15 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
                perf_remove_from_context(event);
                unaccount_event_cpu(event, src_cpu);
                put_ctx(src_ctx);
-                list_add(&event->event_entry, &events);
+                list_add(&event->migrate_entry, &events);
        }
        mutex_unlock(&src_ctx->mutex);
        synchronize_rcu();
        mutex_lock(&dst_ctx->mutex);
-        list_for_each_entry_safe(event, tmp, &events, event_entry) {
+        list_for_each_entry_safe(event, tmp, &events, migrate_entry) {
-                list_del(&event->event_entry);
+                list_del(&event->migrate_entry);
                if (event->state >= PERF_EVENT_STATE_OFF)
                        event->state = PERF_EVENT_STATE_INACTIVE;
                account_event_cpu(event, dst_cpu);
diff --git a/kernel/kmod.c b/kernel/kmod.c
index fb326365b694..b086006c59e7 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -571,6 +571,10 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
        DECLARE_COMPLETION_ONSTACK(done);
        int retval = 0;
+        if (!sub_info->path) {
+                call_usermodehelper_freeinfo(sub_info);
+                return -EINVAL;
+        }
        helper_lock();
        if (!khelper_wq || usermodehelper_disabled) {
                retval = -EBUSY;
diff --git a/kernel/pid.c b/kernel/pid.c
index ebe5e80b10f8..9b9a26698144 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -273,6 +273,11 @@ void free_pid(struct pid *pid)
                         */
                        wake_up_process(ns->child_reaper);
                        break;
+                case PIDNS_HASH_ADDING:
+                        /* Handle a fork failure of the first process */
+                        WARN_ON(ns->child_reaper);
+                        ns->nr_hashed = 0;
+                        /* fall through */
                case 0:
                        schedule_work(&ns->proc_work);
                        break;
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 358a146fd4da..98c3b34a4cff 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -743,7 +743,10 @@ int create_basic_memory_bitmaps(void)
        struct memory_bitmap *bm1, *bm2;
        int error = 0;
-        BUG_ON(forbidden_pages_map || free_pages_map);
+        if (forbidden_pages_map && free_pages_map)
+                return 0;
+        else
+                BUG_ON(forbidden_pages_map || free_pages_map);
        bm1 = kzalloc(sizeof(struct memory_bitmap), GFP_KERNEL);
        if (!bm1)
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 72e8f4fd616d..957f06164ad1 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -39,6 +39,7 @@ static struct snapshot_data {
        char frozen;
        char ready;
        char platform_support;
+        bool free_bitmaps;
 } snapshot_state;
 atomic_t snapshot_device_available = ATOMIC_INIT(1);
@@ -82,6 +83,10 @@ static int snapshot_open(struct inode *inode, struct file *filp)
                data->swap = -1;
                data->mode = O_WRONLY;
                error = pm_notifier_call_chain(PM_RESTORE_PREPARE);
+                if (!error) {
+                        error = create_basic_memory_bitmaps();
+                        data->free_bitmaps = !error;
+                }
                if (error)
                        pm_notifier_call_chain(PM_POST_RESTORE);
        }
@@ -111,6 +116,8 @@ static int snapshot_release(struct inode *inode, struct file *filp)
                pm_restore_gfp_mask();
                free_basic_memory_bitmaps();
                thaw_processes();
+        } else if (data->free_bitmaps) {
+                free_basic_memory_bitmaps();
        }
        pm_notifier_call_chain(data->mode == O_RDONLY ?
                        PM_POST_HIBERNATION : PM_POST_RESTORE);
@@ -231,6 +238,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                        break;
                pm_restore_gfp_mask();
                free_basic_memory_bitmaps();
+                data->free_bitmaps = false;
                thaw_processes();
                data->frozen = 0;
                break;
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 53cc09ceb0b8..d7d498d8cc4f 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -328,10 +328,19 @@ void irq_enter(void)
 static inline void invoke_softirq(void)
 {
-        if (!force_irqthreads)
+        if (!force_irqthreads) {
-                __do_softirq();
+                /*
-        else
+                 * We can safely execute softirq on the current stack if
+                 * it is the irq stack, because it should be near empty
+                 * at this stage. But we have no way to know if the arch
+                 * calls irq_exit() on the irq stack. So call softirq
+                 * in its own stack to prevent from any overrun on top
+                 * of a potentially deep task stack.
+                 */
+                do_softirq();
+        } else {
                wakeup_softirqd();
+        }
 }
 static inline void tick_irq_exit(void)
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 3f0494c9d57a..8499c810909a 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -14,6 +14,8 @@
 const char hex_asc[] = "0123456789abcdef";
 EXPORT_SYMBOL(hex_asc);
+const char hex_asc_upper[] = "0123456789ABCDEF";
+EXPORT_SYMBOL(hex_asc_upper);
 /**
 * hex_to_bin - convert a hex digit to its real value
diff --git a/lib/kobject.c b/lib/kobject.c
index 669bf190d4fb..084f7b18d0c0 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -592,7 +592,7 @@ static void kobject_release(struct kref *kref)
 {
        struct kobject *kobj = container_of(kref, struct kobject, kref);
 #ifdef CONFIG_DEBUG_KOBJECT_RELEASE
-        pr_debug("kobject: '%s' (%p): %s, parent %p (delayed)\n",
+        pr_info("kobject: '%s' (%p): %s, parent %p (delayed)\n",
                 kobject_name(kobj), kobj, __func__, kobj->parent);
        INIT_DELAYED_WORK(&kobj->release, kobject_delayed_cleanup);
        schedule_delayed_work(&kobj->release, HZ);
diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
index 7deeb6297a48..1a53d497a8c5 100644
--- a/lib/percpu-refcount.c
+++ b/lib/percpu-refcount.c
@@ -53,6 +53,7 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release)
        ref->release = release;
        return 0;
 }
+EXPORT_SYMBOL_GPL(percpu_ref_init);
 /**
 * percpu_ref_cancel_init - cancel percpu_ref_init()
@@ -84,6 +85,7 @@ void percpu_ref_cancel_init(struct percpu_ref *ref)
                free_percpu(ref->pcpu_count);
        }
 }
+EXPORT_SYMBOL_GPL(percpu_ref_cancel_init);
 static void percpu_ref_kill_rcu(struct rcu_head *rcu)
 {
@@ -156,3 +158,4 @@ void percpu_ref_kill_and_confirm(struct percpu_ref *ref,
        call_rcu_sched(&ref->rcu, percpu_ref_kill_rcu);
 }
+EXPORT_SYMBOL_GPL(percpu_ref_kill_and_confirm);
diff --git a/mm/Kconfig b/mm/Kconfig
index 026771a9b097..394838f489eb 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -183,7 +183,7 @@ config MEMORY_HOTPLUG_SPARSE
 config MEMORY_HOTREMOVE
        bool "Allow for memory hot remove"
        select MEMORY_ISOLATION
-        select HAVE_BOOTMEM_INFO_NODE if X86_64
+        select HAVE_BOOTMEM_INFO_NODE if (X86_64 || PPC64)
        depends on MEMORY_HOTPLUG && ARCH_ENABLE_MEMORY_HOTREMOVE
        depends on MIGRATION
diff --git a/mm/bounce.c b/mm/bounce.c
index c9f0a4339a7d..5a7d58fb883b 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -204,6 +204,8 @@ static void __blk_queue_bounce(struct request_queue *q, struct bio **bio_orig,
        struct bio_vec *to, *from;
        unsigned i;
+        if (force)
+                goto bounce;
        bio_for_each_segment(from, *bio_orig, i)
                if (page_to_pfn(from->bv_page) > queue_bounce_pfn(q))
                        goto bounce;
diff --git a/mm/compaction.c b/mm/compaction.c
index c43789388cd8..b5326b141a25 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -677,6 +677,13 @@ static void isolate_freepages(struct zone *zone,
                                        pfn -= pageblock_nr_pages) {
                unsigned long isolated;
+                /*
+                 * This can iterate a massively long zone without finding any
+                 * suitable migration targets, so periodically check if we need
+                 * to schedule.
+                 */
+                cond_resched();
                if (!pfn_valid(pfn))
                        continue;
diff --git a/mm/filemap.c b/mm/filemap.c
index 1e6aec4a2d2e..ae4846ff4849 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1616,7 +1616,6 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        struct inode *inode = mapping->host;
        pgoff_t offset = vmf->pgoff;
        struct page *page;
-        bool memcg_oom;
        pgoff_t size;
        int ret = 0;
@@ -1625,11 +1624,7 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                return VM_FAULT_SIGBUS;
        /*
-         * Do we have something in the page cache already?  Either
+         * Do we have something in the page cache already?
-         * way, try readahead, but disable the memcg OOM killer for it
-         * as readahead is optional and no errors are propagated up
-         * the fault stack.  The OOM killer is enabled while trying to
-         * instantiate the faulting page individually below.
         */
        page = find_get_page(mapping, offset);
        if (likely(page) && !(vmf->flags & FAULT_FLAG_TRIED)) {
@@ -1637,14 +1632,10 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                 * We found the page, so try async readahead before
                 * waiting for the lock.
                 */
-                memcg_oom = mem_cgroup_toggle_oom(false);
                do_async_mmap_readahead(vma, ra, file, page, offset);
-                mem_cgroup_toggle_oom(memcg_oom);
        } else if (!page) {
                /* No page in the page cache at all */
-                memcg_oom = mem_cgroup_toggle_oom(false);
                do_sync_mmap_readahead(vma, ra, file, offset);
-                mem_cgroup_toggle_oom(memcg_oom);
                count_vm_event(PGMAJFAULT);
                mem_cgroup_count_vm_event(vma->vm_mm, PGMAJFAULT);
                ret = VM_FAULT_MAJOR;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 7489884682d8..610e3df2768a 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2697,6 +2697,7 @@ void __split_huge_page_pmd(struct vm_area_struct *vma, unsigned long address,
        mmun_start = haddr;
        mmun_end   = haddr + HPAGE_PMD_SIZE;
+again:
        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
        spin_lock(&mm->page_table_lock);
        if (unlikely(!pmd_trans_huge(*pmd))) {
@@ -2719,7 +2720,14 @@ void __split_huge_page_pmd(struct vm_area_struct *vma, unsigned long address,
        split_huge_page(page);
        put_page(page);
-        BUG_ON(pmd_trans_huge(*pmd));
+        /*
+         * We don't always have down_write of mmap_sem here: a racing
+         * do_huge_pmd_wp_page() might have copied-on-write to another
+         * huge page before our split_huge_page() got the anon_vma lock.
+         */
+        if (unlikely(pmd_trans_huge(*pmd)))
+                goto again;
 }
 void split_huge_page_pmd_mm(struct mm_struct *mm, unsigned long address,
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b49579c7f2a5..0b7656e804d1 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -653,6 +653,7 @@ static void free_huge_page(struct page *page)
        BUG_ON(page_count(page));
        BUG_ON(page_mapcount(page));
        restore_reserve = PagePrivate(page);
+        ClearPagePrivate(page);
        spin_lock(&hugetlb_lock);
        hugetlb_cgroup_uncharge_page(hstate_index(h),
@@ -695,8 +696,22 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
        /* we rely on prep_new_huge_page to set the destructor */
        set_compound_order(page, order);
        __SetPageHead(page);
+        __ClearPageReserved(page);
        for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
                __SetPageTail(p);
+                /*
+                 * For gigantic hugepages allocated through bootmem at
+                 * boot, it's safer to be consistent with the not-gigantic
+                 * hugepages and clear the PG_reserved bit from all tail pages
+                 * too.  Otherwse drivers using get_user_pages() to access tail
+                 * pages may get the reference counting wrong if they see
+                 * PG_reserved set on a tail page (despite the head page not
+                 * having PG_reserved set).  Enforcing this consistency between
+                 * head and tail pages allows drivers to optimize away a check
+                 * on the head page when they need know if put_page() is needed
+                 * after get_user_pages().
+                 */
+                __ClearPageReserved(p);
                set_page_count(p, 0);
                p->first_page = page;
        }
@@ -1329,9 +1344,9 @@ static void __init gather_bootmem_prealloc(void)
 #else
                page = virt_to_page(m);
 #endif
-                __ClearPageReserved(page);
                WARN_ON(page_count(page) != 1);
                prep_compound_huge_page(page, h->order);
+                WARN_ON(PageReserved(page));
                prep_new_huge_page(h, page, page_to_nid(page));
                /*
                 * If we had gigantic hugepages allocated at boot time, we need
diff --git a/mm/hwpoison-inject.c b/mm/hwpoison-inject.c
index afc2daa91c60..4c84678371eb 100644
--- a/mm/hwpoison-inject.c
+++ b/mm/hwpoison-inject.c
@@ -20,8 +20,6 @@ static int hwpoison_inject(void *data, u64 val)
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
-        if (!hwpoison_filter_enable)
-                goto inject;
        if (!pfn_valid(pfn))
                return -ENXIO;
@@ -33,6 +31,9 @@ static int hwpoison_inject(void *data, u64 val)
        if (!get_page_unless_zero(hpage))
                return 0;
+        if (!hwpoison_filter_enable)
+                goto inject;
        if (!PageLRU(p) && !PageHuge(p))
                shake_page(p, 0);
        /*
diff --git a/mm/madvise.c b/mm/madvise.c
index 6975bc812542..539eeb96b323 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -343,10 +343,11 @@ static long madvise_remove(struct vm_area_struct *vma,
 */
 static int madvise_hwpoison(int bhv, unsigned long start, unsigned long end)
 {
+        struct page *p;
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
-        for (; start < end; start += PAGE_SIZE) {
+        for (; start < end; start += PAGE_SIZE <<
-                struct page *p;
+                                compound_order(compound_head(p))) {
                int ret;
                ret = get_user_pages_fast(start, 1, 0, &p);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 1c52ddbc839b..34d3ca9572d6 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -866,6 +866,7 @@ static unsigned long mem_cgroup_read_events(struct mem_cgroup *memcg,
        unsigned long val = 0;
        int cpu;
+        get_online_cpus();
        for_each_online_cpu(cpu)
                val += per_cpu(memcg->stat->events[idx], cpu);
 #ifdef CONFIG_HOTPLUG_CPU
@@ -873,6 +874,7 @@ static unsigned long mem_cgroup_read_events(struct mem_cgroup *memcg,
        val += memcg->nocpu_base.events[idx];
        spin_unlock(&memcg->pcp_counter_lock);
 #endif
+        put_online_cpus();
        return val;
 }
@@ -2159,110 +2161,59 @@ static void memcg_oom_recover(struct mem_cgroup *memcg)
                memcg_wakeup_oom(memcg);
 }
-/*
- * try to call OOM killer
- */
 static void mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int order)
 {
-        bool locked;
-        int wakeups;
        if (!current->memcg_oom.may_oom)
                return;
-        current->memcg_oom.in_memcg_oom = 1;
        /*
-         * As with any blocking lock, a contender needs to start
+         * We are in the middle of the charge context here, so we
-         * listening for wakeups before attempting the trylock,
+         * don't want to block when potentially sitting on a callstack
-         * otherwise it can miss the wakeup from the unlock and sleep
+         * that holds all kinds of filesystem and mm locks.
-         * indefinitely.  This is just open-coded because our locking
+         *
-         * is so particular to memcg hierarchies.
+         * Also, the caller may handle a failed allocation gracefully
+         * (like optional page cache readahead) and so an OOM killer
+         * invocation might not even be necessary.
+         *
+         * That's why we don't do anything here except remember the
+         * OOM context and then deal with it at the end of the page
+         * fault when the stack is unwound, the locks are released,
+         * and when we know whether the fault was overall successful.
         */
-        wakeups = atomic_read(&memcg->oom_wakeups);
+        css_get(&memcg->css);
-        mem_cgroup_mark_under_oom(memcg);
+        current->memcg_oom.memcg = memcg;
+        current->memcg_oom.gfp_mask = mask;
-        locked = mem_cgroup_oom_trylock(memcg);
+        current->memcg_oom.order = order;
-        if (locked)
-                mem_cgroup_oom_notify(memcg);
-        if (locked && !memcg->oom_kill_disable) {
-                mem_cgroup_unmark_under_oom(memcg);
-                mem_cgroup_out_of_memory(memcg, mask, order);
-                mem_cgroup_oom_unlock(memcg);
-                /*
-                 * There is no guarantee that an OOM-lock contender
-                 * sees the wakeups triggered by the OOM kill
-                 * uncharges.  Wake any sleepers explicitely.
-                 */
-                memcg_oom_recover(memcg);
-        } else {
-                /*
-                 * A system call can just return -ENOMEM, but if this
-                 * is a page fault and somebody else is handling the
-                 * OOM already, we need to sleep on the OOM waitqueue
-                 * for this memcg until the situation is resolved.
-                 * Which can take some time because it might be
-                 * handled by a userspace task.
-                 *
-                 * However, this is the charge context, which means
-                 * that we may sit on a large call stack and hold
-                 * various filesystem locks, the mmap_sem etc. and we
-                 * don't want the OOM handler to deadlock on them
-                 * while we sit here and wait.  Store the current OOM
-                 * context in the task_struct, then return -ENOMEM.
-                 * At the end of the page fault handler, with the
-                 * stack unwound, pagefault_out_of_memory() will check
-                 * back with us by calling
-                 * mem_cgroup_oom_synchronize(), possibly putting the
-                 * task to sleep.
-                 */
-                current->memcg_oom.oom_locked = locked;
-                current->memcg_oom.wakeups = wakeups;
-                css_get(&memcg->css);
-                current->memcg_oom.wait_on_memcg = memcg;
-        }
 }
 /**
 * mem_cgroup_oom_synchronize - complete memcg OOM handling
+ * @handle: actually kill/wait or just clean up the OOM state
 *
- * This has to be called at the end of a page fault if the the memcg
+ * This has to be called at the end of a page fault if the memcg OOM
- * OOM handler was enabled and the fault is returning %VM_FAULT_OOM.
+ * handler was enabled.
 *
- * Memcg supports userspace OOM handling, so failed allocations must
+ * Memcg supports userspace OOM handling where failed allocations must
 * sleep on a waitqueue until the userspace task resolves the
 * situation.  Sleeping directly in the charge context with all kinds
 * of locks held is not a good idea, instead we remember an OOM state
 * in the task and mem_cgroup_oom_synchronize() has to be called at
- * the end of the page fault to put the task to sleep and clean up the
+ * the end of the page fault to complete the OOM handling.
- * OOM state.
 *
 * Returns %true if an ongoing memcg OOM situation was detected and
- * finalized, %false otherwise.
+ * completed, %false otherwise.
 */
-bool mem_cgroup_oom_synchronize(void)
+bool mem_cgroup_oom_synchronize(bool handle)
 {
+        struct mem_cgroup *memcg = current->memcg_oom.memcg;
        struct oom_wait_info owait;
-        struct mem_cgroup *memcg;
+        bool locked;
        /* OOM is global, do not handle */
-        if (!current->memcg_oom.in_memcg_oom)
-                return false;
-        /*
-         * We invoked the OOM killer but there is a chance that a kill
-         * did not free up any charges.  Everybody else might already
-         * be sleeping, so restart the fault and keep the rampage
-         * going until some charges are released.
-         */
-        memcg = current->memcg_oom.wait_on_memcg;
        if (!memcg)
-                goto out;
+                return false;
-        if (test_thread_flag(TIF_MEMDIE) || fatal_signal_pending(current))
+        if (!handle)
-                goto out_memcg;
+                goto cleanup;
        owait.memcg = memcg;
        owait.wait.flags = 0;
@@ -2271,13 +2222,25 @@ bool mem_cgroup_oom_synchronize(void)
        INIT_LIST_HEAD(&owait.wait.task_list);
        prepare_to_wait(&memcg_oom_waitq, &owait.wait, TASK_KILLABLE);
-        /* Only sleep if we didn't miss any wakeups since OOM */
+        mem_cgroup_mark_under_oom(memcg);
-        if (atomic_read(&memcg->oom_wakeups) == current->memcg_oom.wakeups)
+        locked = mem_cgroup_oom_trylock(memcg);
+        if (locked)
+                mem_cgroup_oom_notify(memcg);
+        if (locked && !memcg->oom_kill_disable) {
+                mem_cgroup_unmark_under_oom(memcg);
+                finish_wait(&memcg_oom_waitq, &owait.wait);
+                mem_cgroup_out_of_memory(memcg, current->memcg_oom.gfp_mask,
+                                         current->memcg_oom.order);
+        } else {
                schedule();
-        finish_wait(&memcg_oom_waitq, &owait.wait);
+                mem_cgroup_unmark_under_oom(memcg);
-out_memcg:
+                finish_wait(&memcg_oom_waitq, &owait.wait);
-        mem_cgroup_unmark_under_oom(memcg);
+        }
-        if (current->memcg_oom.oom_locked) {
+        if (locked) {
                mem_cgroup_oom_unlock(memcg);
                /*
                 * There is no guarantee that an OOM-lock contender
@@ -2286,10 +2249,9 @@ out_memcg:
                 */
                memcg_oom_recover(memcg);
        }
+cleanup:
+        current->memcg_oom.memcg = NULL;
        css_put(&memcg->css);
-        current->memcg_oom.wait_on_memcg = NULL;
-out:
-        current->memcg_oom.in_memcg_oom = 0;
        return true;
 }
@@ -2703,6 +2665,9 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                     || fatal_signal_pending(current)))
                goto bypass;
+        if (unlikely(task_in_memcg_oom(current)))
+                goto bypass;
        /*
         * We always charge the cgroup the mm_struct belongs to.
         * The mm_struct's mem_cgroup changes on task migration if the
@@ -2801,6 +2766,8 @@ done:
        return 0;
 nomem:
        *ptr = NULL;
+        if (gfp_mask & __GFP_NOFAIL)
+                return 0;
        return -ENOMEM;
 bypass:
        *ptr = root_mem_cgroup;
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 947ed5413279..bf3351b5115e 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1114,8 +1114,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                         * shake_page could have turned it free.
                         */
                        if (is_free_buddy_page(p)) {
-                                action_result(pfn, "free buddy, 2nd try",
+                                if (flags & MF_COUNT_INCREASED)
-                                                DELAYED);
+                                        action_result(pfn, "free buddy", DELAYED);
+                                else
+                                        action_result(pfn, "free buddy, 2nd try", DELAYED);
                                return 0;
                        }
                        action_result(pfn, "non LRU", IGNORED);
@@ -1349,7 +1351,7 @@ int unpoison_memory(unsigned long pfn)
         * worked by memory_failure() and the page lock is not held yet.
         * In such case, we yield to memory_failure() and make unpoison fail.
         */
-        if (PageTransHuge(page)) {
+        if (!PageHuge(page) && PageTransHuge(page)) {
                pr_info("MCE: Memory failure is now running on %#lx\n", pfn);
                        return 0;
        }
diff --git a/mm/memory.c b/mm/memory.c
index ca0003947115..1311f26497e6 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -837,6 +837,8 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                                         */
                                        make_migration_entry_read(&entry);
                                        pte = swp_entry_to_pte(entry);
+                                        if (pte_swp_soft_dirty(*src_pte))
+                                                pte = pte_swp_mksoft_dirty(pte);
                                        set_pte_at(src_mm, addr, src_pte, pte);
                                }
                        }
@@ -3863,15 +3865,21 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         * space.  Kernel faults are handled more gracefully.
         */
        if (flags & FAULT_FLAG_USER)
-                mem_cgroup_enable_oom();
+                mem_cgroup_oom_enable();
        ret = __handle_mm_fault(mm, vma, address, flags);
-        if (flags & FAULT_FLAG_USER)
+        if (flags & FAULT_FLAG_USER) {
-                mem_cgroup_disable_oom();
+                mem_cgroup_oom_disable();
+                /*
-        if (WARN_ON(task_in_memcg_oom(current) && !(ret & VM_FAULT_OOM)))
+                 * The task may have entered a memcg OOM situation but
-                mem_cgroup_oom_synchronize();
+                 * if the allocation error was handled gracefully (no
+                 * VM_FAULT_OOM), there is no need to kill anything.
+                 * Just clean up the OOM state peacefully.
+                 */
+                if (task_in_memcg_oom(current) && !(ret & VM_FAULT_OOM))
+                        mem_cgroup_oom_synchronize(false);
+        }
        return ret;
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 9c8d5f59d30b..7a7325ee1d08 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -107,7 +107,7 @@ void putback_movable_pages(struct list_head *l)
                list_del(&page->lru);
                dec_zone_page_state(page, NR_ISOLATED_ANON +
                                page_is_file_cache(page));
-                if (unlikely(balloon_page_movable(page)))
+                if (unlikely(isolated_balloon_page(page)))
                        balloon_page_putback(page);
                else
                        putback_lru_page(page);
@@ -161,6 +161,8 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
        get_page(new);
        pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
+        if (pte_swp_soft_dirty(*ptep))
+                pte = pte_mksoft_dirty(pte);
        if (is_write_migration_entry(entry))
                pte = pte_mkwrite(pte);
 #ifdef CONFIG_HUGETLB_PAGE
diff --git a/mm/mlock.c b/mm/mlock.c
index 67ba6da7d0e3..d480cd6fc475 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -379,10 +379,14 @@ static unsigned long __munlock_pagevec_fill(struct pagevec *pvec,
        /*
         * Initialize pte walk starting at the already pinned page where we
-         * are sure that there is a pte.
+         * are sure that there is a pte, as it was pinned under the same
+         * mmap_sem write op.
         */
        pte = get_locked_pte(vma->vm_mm, start, &ptl);
-        end = min(end, pmd_addr_end(start, end));
+        /* Make sure we do not cross the page table boundary */
+        end = pgd_addr_end(start, end);
+        end = pud_addr_end(start, end);
+        end = pmd_addr_end(start, end);
        /* The page next to the pinned page is the first we will try to get */
        start += PAGE_SIZE;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 94722a4d6b43..a3af058f68e4 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -94,13 +94,16 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                        swp_entry_t entry = pte_to_swp_entry(oldpte);
                        if (is_write_migration_entry(entry)) {
+                                pte_t newpte;
                                /*
                                 * A protection check is difficult so
                                 * just be safe and disable write
                                 */
                                make_migration_entry_read(&entry);
-                                set_pte_at(mm, addr, pte,
+                                newpte = swp_entry_to_pte(entry);
-                                        swp_entry_to_pte(entry));
+                                if (pte_swp_soft_dirty(oldpte))
+                                        newpte = pte_swp_mksoft_dirty(newpte);
+                                set_pte_at(mm, addr, pte, newpte);
                        }
                        pages++;
                }
diff --git a/mm/mremap.c b/mm/mremap.c
index 91b13d6a16d4..0843feb66f3d 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -25,7 +25,6 @@
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
-#include <asm/pgalloc.h>
 #include "internal.h"
@@ -63,10 +62,8 @@ static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
                return NULL;
        pmd = pmd_alloc(mm, pud, addr);
-        if (!pmd) {
+        if (!pmd)
-                pud_free(mm, pud);
                return NULL;
-        }
        VM_BUG_ON(pmd_trans_huge(*pmd));
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 314e9d274381..6738c47f1f72 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -680,7 +680,7 @@ void pagefault_out_of_memory(void)
 {
        struct zonelist *zonelist;
-        if (mem_cgroup_oom_synchronize())
+        if (mem_cgroup_oom_synchronize(true))
                return;
        zonelist = node_zonelist(first_online_node, GFP_KERNEL);
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index f5236f804aa6..63807583d8e8 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1210,11 +1210,11 @@ static unsigned long dirty_poll_interval(unsigned long dirty,
        return 1;
 }
-static long bdi_max_pause(struct backing_dev_info *bdi,
+static unsigned long bdi_max_pause(struct backing_dev_info *bdi,
-                          unsigned long bdi_dirty)
+                                   unsigned long bdi_dirty)
 {
-        long bw = bdi->avg_write_bandwidth;
+        unsigned long bw = bdi->avg_write_bandwidth;
-        long t;
+        unsigned long t;
        /*
         * Limit pause time for small memory systems. If sleeping for too long
@@ -1226,7 +1226,7 @@ static long bdi_max_pause(struct backing_dev_info *bdi,
        t = bdi_dirty / (1 + bw / roundup_pow_of_two(1 + HZ / 8));
        t++;
-        return min_t(long, t, MAX_PAUSE);
+        return min_t(unsigned long, t, MAX_PAUSE);
 }
 static long bdi_min_pause(struct backing_dev_info *bdi,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 0ee638f76ebe..dd886fac451a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6366,10 +6366,6 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn)
                list_del(&page->lru);
                rmv_page_order(page);
                zone->free_area[order].nr_free--;
-#ifdef CONFIG_HIGHMEM
-                if (PageHighMem(page))
-                        totalhigh_pages -= 1 << order;
-#endif
                for (i = 0; i < (1 << order); i++)
                        SetPageReserved((page+i));
                pfn += (1 << order);
diff --git a/mm/slab_common.c b/mm/slab_common.c
index a3443278ce3a..e2e98af703ea 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -56,6 +56,7 @@ static int kmem_cache_sanity_check(struct mem_cgroup *memcg, const char *name,
                        continue;
                }
+#if !defined(CONFIG_SLUB) || !defined(CONFIG_SLUB_DEBUG_ON)
                /*
                 * For simplicity, we won't check this in the list of memcg
                 * caches. We have control over memcg naming, and if there
@@ -69,6 +70,7 @@ static int kmem_cache_sanity_check(struct mem_cgroup *memcg, const char *name,
                        s = NULL;
                        return -EINVAL;
                }
+#endif
        }
        WARN_ON(strchr(name, ' '));     /* It confuses parsers */
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 3963fc24fcc1..de7c904e52e5 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1824,6 +1824,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
        struct filename *pathname;
        int i, type, prev;
        int err;
+        unsigned int old_block_size;
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
@@ -1914,6 +1915,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
        }
        swap_file = p->swap_file;
+        old_block_size = p->old_block_size;
        p->swap_file = NULL;
        p->max = 0;
        swap_map = p->swap_map;
@@ -1938,7 +1940,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
        inode = mapping->host;
        if (S_ISBLK(inode->i_mode)) {
                struct block_device *bdev = I_BDEV(inode);
-                set_blocksize(bdev, p->old_block_size);
+                set_blocksize(bdev, old_block_size);
                blkdev_put(bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL);
        } else {
                mutex_lock(&inode->i_mutex);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index beb35778c69f..eea668d9cff6 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -48,6 +48,7 @@
 #include <asm/div64.h>
 #include <linux/swapops.h>
+#include <linux/balloon_compaction.h>
 #include "internal.h"
@@ -210,6 +211,7 @@ void unregister_shrinker(struct shrinker *shrinker)
        down_write(&shrinker_rwsem);
        list_del(&shrinker->list);
        up_write(&shrinker_rwsem);
+        kfree(shrinker->nr_deferred);
 }
 EXPORT_SYMBOL(unregister_shrinker);
@@ -1113,7 +1115,8 @@ unsigned long reclaim_clean_pages_from_list(struct zone *zone,
        LIST_HEAD(clean_pages);
        list_for_each_entry_safe(page, next, page_list, lru) {
-                if (page_is_file_cache(page) && !PageDirty(page)) {
+                if (page_is_file_cache(page) && !PageDirty(page) &&
+                    !isolated_balloon_page(page)) {
                        ClearPageActive(page);
                        list_move(&page->lru, &clean_pages);
                }
diff --git a/mm/zswap.c b/mm/zswap.c
index 841e35f1db22..d93510c6aa2d 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -804,6 +804,10 @@ static void zswap_frontswap_invalidate_area(unsigned type)
        }
        tree->rbroot = RB_ROOT;
        spin_unlock(&tree->lock);
+        zbud_destroy_pool(tree->pool);
+        kfree(tree);
+        zswap_trees[type] = NULL;
 }
 static struct zbud_ops zswap_zbud_ops = {
diff --git a/net/802/mrp.c b/net/802/mrp.c
index 1eb05d80b07b..3ed616215870 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -24,6 +24,11 @@
 static unsigned int mrp_join_time __read_mostly = 200;
 module_param(mrp_join_time, uint, 0644);
 MODULE_PARM_DESC(mrp_join_time, "Join time in ms (default 200ms)");
+static unsigned int mrp_periodic_time __read_mostly = 1000;
+module_param(mrp_periodic_time, uint, 0644);
+MODULE_PARM_DESC(mrp_periodic_time, "Periodic time in ms (default 1s)");
 MODULE_LICENSE("GPL");
 static const u8
@@ -595,6 +600,24 @@ static void mrp_join_timer(unsigned long data)
        mrp_join_timer_arm(app);
 }
+static void mrp_periodic_timer_arm(struct mrp_applicant *app)
+{
+        mod_timer(&app->periodic_timer,
+                  jiffies + msecs_to_jiffies(mrp_periodic_time));
+}
+static void mrp_periodic_timer(unsigned long data)
+{
+        struct mrp_applicant *app = (struct mrp_applicant *)data;
+        spin_lock(&app->lock);
+        mrp_mad_event(app, MRP_EVENT_PERIODIC);
+        mrp_pdu_queue(app);
+        spin_unlock(&app->lock);
+        mrp_periodic_timer_arm(app);
+}
 static int mrp_pdu_parse_end_mark(struct sk_buff *skb, int *offset)
 {
        __be16 endmark;
@@ -845,6 +868,9 @@ int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl)
        rcu_assign_pointer(dev->mrp_port->applicants[appl->type], app);
        setup_timer(&app->join_timer, mrp_join_timer, (unsigned long)app);
        mrp_join_timer_arm(app);
+        setup_timer(&app->periodic_timer, mrp_periodic_timer,
+                    (unsigned long)app);
+        mrp_periodic_timer_arm(app);
        return 0;
 err3:
@@ -870,6 +896,7 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
         * all pending messages before the applicant is gone.
         */
        del_timer_sync(&app->join_timer);
+        del_timer_sync(&app->periodic_timer);
        spin_lock_bh(&app->lock);
        mrp_mad_event(app, MRP_EVENT_TX);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 634debab4d54..fb7356fcfe51 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1146,7 +1146,11 @@ int hci_dev_open(__u16 dev)
                goto done;
        }
-        if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
+        /* Check for rfkill but allow the HCI setup stage to proceed
+         * (which in itself doesn't cause any RF activity).
+         */
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags) &&
+            !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                ret = -ERFKILL;
                goto done;
        }
@@ -1566,10 +1570,13 @@ static int hci_rfkill_set_block(void *data, bool blocked)
        BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
-        if (!blocked)
+        if (blocked) {
-                return 0;
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
+                if (!test_bit(HCI_SETUP, &hdev->dev_flags))
-        hci_dev_do_close(hdev);
+                        hci_dev_do_close(hdev);
+        } else {
+                clear_bit(HCI_RFKILLED, &hdev->dev_flags);
+        }
        return 0;
 }
@@ -1591,9 +1598,13 @@ static void hci_power_on(struct work_struct *work)
                return;
        }
-        if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
+                clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+                hci_dev_do_close(hdev);
+        } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
                queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
                                   HCI_AUTO_OFF_TIMEOUT);
+        }
        if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                mgmt_index_added(hdev);
@@ -2209,6 +2220,9 @@ int hci_register_dev(struct hci_dev *hdev)
                }
        }
+        if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
        set_bit(HCI_SETUP, &hdev->dev_flags);
        if (hdev->dev_type != HCI_AMP)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 94aab73f89d4..8db3e89fae35 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3557,7 +3557,11 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
        cp.handle = cpu_to_le16(conn->handle);
        if (ltk->authenticated)
-                conn->sec_level = BT_SECURITY_HIGH;
+                conn->pending_sec_level = BT_SECURITY_HIGH;
+        else
+                conn->pending_sec_level = BT_SECURITY_MEDIUM;
+        conn->enc_key_size = ltk->enc_size;
        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b3bb7bca8e60..63fa11109a1c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3755,6 +3755,13 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
        sk = chan->sk;
+        /* For certain devices (ex: HID mouse), support for authentication,
+         * pairing and bonding is optional. For such devices, inorder to avoid
+         * the ACL alive for too long after L2CAP disconnection, reset the ACL
+         * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
+         */
+        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
        bacpy(&bt_sk(sk)->src, conn->src);
        bacpy(&bt_sk(sk)->dst, conn->dst);
        chan->psm  = psm;
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 6d126faf145f..84fcf9fff3ea 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -569,7 +569,6 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 {
        struct rfcomm_dev *dev = dlc->owner;
-        struct tty_struct *tty;
        if (!dev)
                return;
@@ -581,38 +580,8 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                            DPM_ORDER_DEV_AFTER_PARENT);
                wake_up_interruptible(&dev->port.open_wait);
-        } else if (dlc->state == BT_CLOSED) {
+        } else if (dlc->state == BT_CLOSED)
-                tty = tty_port_tty_get(&dev->port);
+                tty_port_tty_hangup(&dev->port, false);
-                if (!tty) {
-                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                /* Drop DLC lock here to avoid deadlock
-                                 * 1. rfcomm_dev_get will take rfcomm_dev_lock
-                                 *    but in rfcomm_dev_add there's lock order:
-                                 *    rfcomm_dev_lock -> dlc lock
-                                 * 2. tty_port_put will deadlock if it's
-                                 *    the last reference
-                                 *
-                                 * FIXME: when we release the lock anything
-                                 * could happen to dev, even its destruction
-                                 */
-                                rfcomm_dlc_unlock(dlc);
-                                if (rfcomm_dev_get(dev->id) == NULL) {
-                                        rfcomm_dlc_lock(dlc);
-                                        return;
-                                }
-                                if (!test_and_set_bit(RFCOMM_TTY_RELEASED,
-                                                      &dev->flags))
-                                        tty_port_put(&dev->port);
-                                tty_port_put(&dev->port);
-                                rfcomm_dlc_lock(dlc);
-                        }
-                } else {
-                        tty_hangup(tty);
-                        tty_kref_put(tty);
-                }
-        }
 }
 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
diff --git a/net/core/dev.c b/net/core/dev.c
index 5c713f2239cc..65f829cfd928 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5247,10 +5247,12 @@ static int dev_new_index(struct net *net)
 /* Delayed registration/unregisteration */
 static LIST_HEAD(net_todo_list);
+static DECLARE_WAIT_QUEUE_HEAD(netdev_unregistering_wq);
 static void net_set_todo(struct net_device *dev)
 {
        list_add_tail(&dev->todo_list, &net_todo_list);
+        dev_net(dev)->dev_unreg_count++;
 }
 static void rollback_registered_many(struct list_head *head)
@@ -5918,6 +5920,12 @@ void netdev_run_todo(void)
                if (dev->destructor)
                        dev->destructor(dev);
+                /* Report a network device has been unregistered */
+                rtnl_lock();
+                dev_net(dev)->dev_unreg_count--;
+                __rtnl_unlock();
+                wake_up(&netdev_unregistering_wq);
                /* Free network device */
                kobject_put(&dev->dev.kobj);
        }
@@ -6603,6 +6611,34 @@ static void __net_exit default_device_exit(struct net *net)
        rtnl_unlock();
 }
+static void __net_exit rtnl_lock_unregistering(struct list_head *net_list)
+{
+        /* Return with the rtnl_lock held when there are no network
+         * devices unregistering in any network namespace in net_list.
+         */
+        struct net *net;
+        bool unregistering;
+        DEFINE_WAIT(wait);
+        for (;;) {
+                prepare_to_wait(&netdev_unregistering_wq, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                unregistering = false;
+                rtnl_lock();
+                list_for_each_entry(net, net_list, exit_list) {
+                        if (net->dev_unreg_count > 0) {
+                                unregistering = true;
+                                break;
+                        }
+                }
+                if (!unregistering)
+                        break;
+                __rtnl_unlock();
+                schedule();
+        }
+        finish_wait(&netdev_unregistering_wq, &wait);
+}
 static void __net_exit default_device_exit_batch(struct list_head *net_list)
 {
        /* At exit all network devices most be removed from a network
@@ -6614,7 +6650,18 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
        struct net *net;
        LIST_HEAD(dev_kill_list);
-        rtnl_lock();
+        /* To prevent network device cleanup code from dereferencing
+         * loopback devices or network devices that have been freed
+         * wait here for all pending unregistrations to complete,
+         * before unregistring the loopback device and allowing the
+         * network namespace be freed.
+         *
+         * The netdev todo list containing all network devices
+         * unregistrations that happen in default_device_exit_batch
+         * will run in the rtnl_unlock() at the end of
+         * default_device_exit_batch.
+         */
+        rtnl_lock_unregistering(net_list);
        list_for_each_entry(net, net_list, exit_list) {
                for_each_netdev_reverse(net, dev) {
                        if (dev->rtnl_link_ops)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 1929af87b260..8d7d0dd72db2 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -154,8 +154,8 @@ ipv6:
        if (poff >= 0) {
                __be32 *ports, _ports;
-                nhoff += poff;
+                ports = skb_header_pointer(skb, nhoff + poff,
-                ports = skb_header_pointer(skb, nhoff, sizeof(_ports), &_ports);
+                                           sizeof(_ports), &_ports);
                if (ports)
                        flow->ports = *ports;
        }
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 6a2f13cee86a..3f1ec1586ae1 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -10,11 +10,24 @@
 #include <net/secure_seq.h>
-static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
+#define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
-void net_secret_init(void)
+static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
+static void net_secret_init(void)
 {
-        get_random_bytes(net_secret, sizeof(net_secret));
+        u32 tmp;
+        int i;
+        if (likely(net_secret[0]))
+                return;
+        for (i = NET_SECRET_SIZE; i > 0;) {
+                do {
+                        get_random_bytes(&tmp, sizeof(tmp));
+                } while (!tmp);
+                cmpxchg(&net_secret[--i], 0, tmp);
+        }
 }
 #ifdef CONFIG_INET
@@ -42,6 +55,7 @@ __u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
        u32 hash[MD5_DIGEST_WORDS];
        u32 i;
+        net_secret_init();
        memcpy(hash, saddr, 16);
        for (i = 0; i < 4; i++)
                secret[i] = net_secret[i] + (__force u32)daddr[i];
@@ -63,6 +77,7 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
        u32 hash[MD5_DIGEST_WORDS];
        u32 i;
+        net_secret_init();
        memcpy(hash, saddr, 16);
        for (i = 0; i < 4; i++)
                secret[i] = net_secret[i] + (__force u32) daddr[i];
@@ -82,6 +97,7 @@ __u32 secure_ip_id(__be32 daddr)
 {
        u32 hash[MD5_DIGEST_WORDS];
+        net_secret_init();
        hash[0] = (__force __u32) daddr;
        hash[1] = net_secret[13];
        hash[2] = net_secret[14];
@@ -96,6 +112,7 @@ __u32 secure_ipv6_id(const __be32 daddr[4])
 {
        __u32 hash[4];
+        net_secret_init();
        memcpy(hash, daddr, 16);
        md5_transform(hash, net_secret);
@@ -107,6 +124,7 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
 {
        u32 hash[MD5_DIGEST_WORDS];
+        net_secret_init();
        hash[0] = (__force u32)saddr;
        hash[1] = (__force u32)daddr;
        hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
@@ -121,6 +139,7 @@ u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
 {
        u32 hash[MD5_DIGEST_WORDS];
+        net_secret_init();
        hash[0] = (__force u32)saddr;
        hash[1] = (__force u32)daddr;
        hash[2] = (__force u32)dport ^ net_secret[14];
@@ -140,6 +159,7 @@ u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
        u32 hash[MD5_DIGEST_WORDS];
        u64 seq;
+        net_secret_init();
        hash[0] = (__force u32)saddr;
        hash[1] = (__force u32)daddr;
        hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
@@ -164,6 +184,7 @@ u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
        u64 seq;
        u32 i;
+        net_secret_init();
        memcpy(hash, saddr, 16);
        for (i = 0; i < 4; i++)
                secret[i] = net_secret[i] + daddr[i];
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 7a1874b7b8fd..cfeb85cff4f0 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -263,10 +263,8 @@ void build_ehash_secret(void)
                get_random_bytes(&rnd, sizeof(rnd));
        } while (rnd == 0);
-        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) {
+        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
                get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
-                net_secret_init();
-        }
 }
 EXPORT_SYMBOL(build_ehash_secret);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index dace87f06e5f..7defdc9ba167 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -736,7 +736,7 @@ static void igmp_gq_timer_expire(unsigned long data)
        in_dev->mr_gq_running = 0;
        igmpv3_send_report(in_dev, NULL);
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 static void igmp_ifc_timer_expire(unsigned long data)
@@ -749,7 +749,7 @@ static void igmp_ifc_timer_expire(unsigned long data)
                igmp_ifc_start_timer(in_dev,
                                     unsolicited_report_interval(in_dev));
        }
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 static void igmp_ifc_event(struct in_device *in_dev)
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index ac9fabe0300f..63a6d6d6b875 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -623,6 +623,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                        tunnel->err_count = 0;
        }
+        tos = ip_tunnel_ecn_encap(tos, inner_iph, skb);
        ttl = tnl_params->ttl;
        if (ttl == 0) {
                if (skb->protocol == htons(ETH_P_IP))
@@ -641,18 +642,17 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
                        + rt->dst.header_len;
-        if (max_headroom > dev->needed_headroom) {
+        if (max_headroom > dev->needed_headroom)
                dev->needed_headroom = max_headroom;
-                if (skb_cow_head(skb, dev->needed_headroom)) {
-                        dev->stats.tx_dropped++;
+        if (skb_cow_head(skb, dev->needed_headroom)) {
-                        dev_kfree_skb(skb);
+                dev->stats.tx_dropped++;
-                        return;
+                dev_kfree_skb(skb);
-                }
+                return;
        }
        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol,
-                            ip_tunnel_ecn_encap(tos, inner_iph, skb), ttl, df,
+                            tos, ttl, df, !net_eq(tunnel->net, dev_net(dev)));
-                            !net_eq(tunnel->net, dev_net(dev)));
        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
        return;
@@ -853,8 +853,10 @@ int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
        /* FB netdevice is special: we have one, and only one per netns.
         * Allowing to move it to another netns is clearly unsafe.
         */
-        if (!IS_ERR(itn->fb_tunnel_dev))
+        if (!IS_ERR(itn->fb_tunnel_dev)) {
                itn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
+                ip_tunnel_add(itn, netdev_priv(itn->fb_tunnel_dev));
+        }
        rtnl_unlock();
        return PTR_RET(itn->fb_tunnel_dev);
@@ -884,8 +886,6 @@ static void ip_tunnel_destroy(struct ip_tunnel_net *itn, struct list_head *head,
                        if (!net_eq(dev_net(t->dev), net))
                                unregister_netdevice_queue(t->dev, head);
        }
-        if (itn->fb_tunnel_dev)
-                unregister_netdevice_queue(itn->fb_tunnel_dev, head);
 }
 void ip_tunnel_delete_net(struct ip_tunnel_net *itn, struct rtnl_link_ops *ops)
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index d6c856b17fd4..c31e3ad98ef2 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -61,7 +61,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
        /* Push down and install the IP header. */
-        __skb_push(skb, sizeof(struct iphdr));
+        skb_push(skb, sizeof(struct iphdr));
        skb_reset_network_header(skb);
        iph = ip_hdr(skb);
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 67e17dcda65e..b6346bf2fde3 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -267,7 +267,8 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
        if (th == NULL)
                return NF_DROP;
-        synproxy_parse_options(skb, par->thoff, th, &opts);
+        if (!synproxy_parse_options(skb, par->thoff, th, &opts))
+                return NF_DROP;
        if (th->syn && !(th->ack || th->fin || th->rst)) {
                /* Initial SYN from client */
@@ -350,7 +351,8 @@ static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
                /* fall through */
        case TCP_CONNTRACK_SYN_SENT:
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
                if (!th->syn && th->ack &&
                    CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
@@ -373,7 +375,9 @@ static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
                if (!th->syn || !th->ack)
                        break;
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
                        synproxy->tsoff = opts.tsval - synproxy->its;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bfec521c717f..193db03540ad 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -218,8 +218,10 @@ static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info)
        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
                ipv4_sk_update_pmtu(skb, sk, info);
-        else if (type == ICMP_REDIRECT)
+        else if (type == ICMP_REDIRECT) {
                ipv4_sk_redirect(skb, sk);
+                return;
+        }
        /* Report error on raw socket, if:
           1. User requested ip_recverr.
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7c83cb8bf137..e6bb8256e59f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -895,8 +895,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        skb_orphan(skb);
        skb->sk = sk;
-        skb->destructor = (sysctl_tcp_limit_output_bytes > 0) ?
+        skb->destructor = tcp_wfree;
-                          tcp_wfree : sock_wfree;
        atomic_add(skb->truesize, &sk->sk_wmem_alloc);
        /* Build TCP header and checksum it. */
@@ -1840,7 +1839,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
        while ((skb = tcp_send_head(sk))) {
                unsigned int limit;
                tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                BUG_ON(!tso_segs);
@@ -1869,13 +1867,20 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                                break;
                }
-                /* TSQ : sk_wmem_alloc accounts skb truesize,
+                /* TCP Small Queues :
-                 * including skb overhead. But thats OK.
+                 * Control number of packets in qdisc/devices to two packets / or ~1 ms.
+                 * This allows for :
+                 *  - better RTT estimation and ACK scheduling
+                 *  - faster recovery
+                 *  - high rates
                 */
-                if (atomic_read(&sk->sk_wmem_alloc) >= sysctl_tcp_limit_output_bytes) {
+                limit = max(skb->truesize, sk->sk_pacing_rate >> 10);
+                if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
                        break;
                }
                limit = mss_now;
                if (tso_segs > 1 && !tcp_urg_mode(tp))
                        limit = tcp_mss_split_point(sk, skb, mss_now,
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 74d2c95db57f..0ca44df51ee9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -658,7 +658,7 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
                break;
        case ICMP_REDIRECT:
                ipv4_sk_redirect(skb, sk);
-                break;
+                goto out;
        }
        /*
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d6ff12617f36..cd3fb301da38 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1499,6 +1499,33 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
        return false;
 }
+/* Compares an address/prefix_len with addresses on device @dev.
+ * If one is found it returns true.
+ */
+bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
+        const unsigned int prefix_len, struct net_device *dev)
+{
+        struct inet6_dev *idev;
+        struct inet6_ifaddr *ifa;
+        bool ret = false;
+        rcu_read_lock();
+        idev = __in6_dev_get(dev);
+        if (idev) {
+                read_lock_bh(&idev->lock);
+                list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                        ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
+                        if (ret)
+                                break;
+                }
+                read_unlock_bh(&idev->lock);
+        }
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL(ipv6_chk_custom_prefix);
 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
 {
        struct inet6_dev *idev;
@@ -2193,43 +2220,21 @@ ok:
                        else
                                stored_lft = 0;
                        if (!update_lft && !create && stored_lft) {
-                                if (valid_lft > MIN_VALID_LIFETIME ||
+                                const u32 minimum_lft = min(
-                                    valid_lft > stored_lft)
+                                        stored_lft, (u32)MIN_VALID_LIFETIME);
-                                        update_lft = 1;
+                                valid_lft = max(valid_lft, minimum_lft);
-                                else if (stored_lft <= MIN_VALID_LIFETIME) {
-                                        /* valid_lft <= stored_lft is always true */
+                                /* RFC4862 Section 5.5.3e:
-                                        /*
+                                 * "Note that the preferred lifetime of the
-                                         * RFC 4862 Section 5.5.3e:
+                                 *  corresponding address is always reset to
-                                         * "Note that the preferred lifetime of
+                                 *  the Preferred Lifetime in the received
-                                         *  the corresponding address is always
+                                 *  Prefix Information option, regardless of
-                                         *  reset to the Preferred Lifetime in
+                                 *  whether the valid lifetime is also reset or
-                                         *  the received Prefix Information
+                                 *  ignored."
-                                         *  option, regardless of whether the
+                                 *
-                                         *  valid lifetime is also reset or
+                                 * So we should always update prefered_lft here.
-                                         *  ignored."
+                                 */
-                                         *
+                                update_lft = 1;
-                                         *  So if the preferred lifetime in
-                                         *  this advertisement is different
-                                         *  than what we have stored, but the
-                                         *  valid lifetime is invalid, just
-                                         *  reset prefered_lft.
-                                         *
-                                         *  We must set the valid lifetime
-                                         *  to the stored lifetime since we'll
-                                         *  be updating the timestamp below,
-                                         *  else we'll set it back to the
-                                         *  minimum.
-                                         */
-                                        if (prefered_lft != ifp->prefered_lft) {
-                                                valid_lft = stored_lft;
-                                                update_lft = 1;
-                                        }
-                                } else {
-                                        valid_lft = MIN_VALID_LIFETIME;
-                                        if (valid_lft < prefered_lft)
-                                                prefered_lft = valid_lft;
-                                        update_lft = 1;
-                                }
                        }
                        if (update_lft) {
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 6b26e9feafb9..7bb5446b9d73 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -618,7 +618,7 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
        struct ip6_tnl *tunnel = netdev_priv(dev);
        struct net_device *tdev;    /* Device to other host */
        struct ipv6hdr  *ipv6h;     /* Our new IP header */
-        unsigned int max_headroom;  /* The extra header space needed */
+        unsigned int max_headroom = 0; /* The extra header space needed */
        int    gre_hlen;
        struct ipv6_tel_txoption opt;
        int    mtu;
@@ -693,7 +693,7 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
+        max_headroom += LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
        if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 3a692d529163..a54c45ce4a48 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1015,6 +1015,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         * udp datagram
         */
        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
+                struct frag_hdr fhdr;
                skb = sock_alloc_send_skb(sk,
                        hh_len + fragheaderlen + transhdrlen + 20,
                        (flags & MSG_DONTWAIT), &err);
@@ -1036,12 +1038,6 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                skb->protocol = htons(ETH_P_IPV6);
                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
-        }
-        err = skb_append_datato_frags(sk,skb, getfrag, from,
-                                      (length - transhdrlen));
-        if (!err) {
-                struct frag_hdr fhdr;
                /* Specify the length of each IPv6 datagram fragment.
                 * It has to be a multiple of 8.
@@ -1052,15 +1048,10 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                ipv6_select_ident(&fhdr, rt);
                skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                __skb_queue_tail(&sk->sk_write_queue, skb);
-                return 0;
        }
-        /* There is not enough support do UPD LSO,
-         * so follow normal path
-         */
-        kfree_skb(skb);
-        return err;
+        return skb_append_datato_frags(sk, skb, getfrag, from,
+                                       (length - transhdrlen));
 }
 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
@@ -1227,27 +1218,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         * --yoshfuji
         */
-        cork->length += length;
+        if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
-        if (length > mtu) {
+                                           sk->sk_protocol == IPPROTO_RAW)) {
-                int proto = sk->sk_protocol;
+                ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
-                if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
+                return -EMSGSIZE;
-                        ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
+        }
-                        return -EMSGSIZE;
-                }
-                if (proto == IPPROTO_UDP &&
-                    (rt->dst.dev->features & NETIF_F_UFO)) {
-                        err = ip6_ufo_append_data(sk, getfrag, from, length,
+        skb = skb_peek_tail(&sk->sk_write_queue);
-                                                  hh_len, fragheaderlen,
+        cork->length += length;
-                                                  transhdrlen, mtu, flags, rt);
+        if (((length > mtu) ||
-                        if (err)
+             (skb && skb_is_gso(skb))) &&
-                                goto error;
+            (sk->sk_protocol == IPPROTO_UDP) &&
-                        return 0;
+            (rt->dst.dev->features & NETIF_F_UFO)) {
-                }
+                err = ip6_ufo_append_data(sk, getfrag, from, length,
+                                          hh_len, fragheaderlen,
+                                          transhdrlen, mtu, flags, rt);
+                if (err)
+                        goto error;
+                return 0;
        }
-        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+        if (!skb)
                goto alloc_new_skb;
        while (length > 0) {
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2d8f4829575b..a791552e0422 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1731,8 +1731,6 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
                }
        }
-        t = rtnl_dereference(ip6n->tnls_wc[0]);
-        unregister_netdevice_queue(t->dev, &list);
        unregister_netdevice_many(&list);
 }
@@ -1752,6 +1750,7 @@ static int __net_init ip6_tnl_init_net(struct net *net)
        if (!ip6n->fb_tnl_dev)
                goto err_alloc_dev;
        dev_net_set(ip6n->fb_tnl_dev, net);
+        ip6n->fb_tnl_dev->rtnl_link_ops = &ip6_link_ops;
        /* FB netdevice is special: we have one, and only one per netns.
         * Allowing to move it to another netns is clearly unsafe.
         */
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 096cd67b737c..d18f9f903db6 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2034,7 +2034,7 @@ static void mld_dad_timer_expire(unsigned long data)
                if (idev->mc_dad_count)
                        mld_dad_start_timer(idev, idev->mc_maxdelay);
        }
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
@@ -2379,7 +2379,7 @@ static void mld_gq_timer_expire(unsigned long data)
        idev->mc_gq_running = 0;
        mld_send_report(idev, NULL);
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 static void mld_ifc_timer_expire(unsigned long data)
@@ -2392,7 +2392,7 @@ static void mld_ifc_timer_expire(unsigned long data)
                if (idev->mc_ifc_count)
                        mld_ifc_start_timer(idev, idev->mc_maxdelay);
        }
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 static void mld_ifc_event(struct inet6_dev *idev)
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index 19cfea8dbcaa..2748b042da72 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -282,7 +282,8 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
        if (th == NULL)
                return NF_DROP;
-        synproxy_parse_options(skb, par->thoff, th, &opts);
+        if (!synproxy_parse_options(skb, par->thoff, th, &opts))
+                return NF_DROP;
        if (th->syn && !(th->ack || th->fin || th->rst)) {
                /* Initial SYN from client */
@@ -372,7 +373,8 @@ static unsigned int ipv6_synproxy_hook(unsigned int hooknum,
                /* fall through */
        case TCP_CONNTRACK_SYN_SENT:
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
                if (!th->syn && th->ack &&
                    CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
@@ -395,7 +397,9 @@ static unsigned int ipv6_synproxy_hook(unsigned int hooknum,
                if (!th->syn || !th->ack)
                        break;
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
                if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
                        synproxy->tsoff = opts.tsval - synproxy->its;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 58916bbb1728..a4ed2416399e 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -335,8 +335,10 @@ static void rawv6_err(struct sock *sk, struct sk_buff *skb,
                ip6_sk_update_pmtu(skb, sk, info);
                harderr = (np->pmtudisc == IPV6_PMTUDISC_DO);
        }
-        if (type == NDISC_REDIRECT)
+        if (type == NDISC_REDIRECT) {
                ip6_sk_redirect(skb, sk);
+                return;
+        }
        if (np->recverr) {
                u8 *payload = skb->data;
                if (!inet->hdrincl)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 7ee5cb96db34..19269453a8ea 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -566,6 +566,70 @@ static inline bool is_spoofed_6rd(struct ip_tunnel *tunnel, const __be32 v4addr,
        return false;
 }
+/* Checks if an address matches an address on the tunnel interface.
+ * Used to detect the NAT of proto 41 packets and let them pass spoofing test.
+ * Long story:
+ * This function is called after we considered the packet as spoofed
+ * in is_spoofed_6rd.
+ * We may have a router that is doing NAT for proto 41 packets
+ * for an internal station. Destination a.a.a.a/PREFIX:bbbb:bbbb
+ * will be translated to n.n.n.n/PREFIX:bbbb:bbbb. And is_spoofed_6rd
+ * function will return true, dropping the packet.
+ * But, we can still check if is spoofed against the IP
+ * addresses associated with the interface.
+ */
+static bool only_dnatted(const struct ip_tunnel *tunnel,
+        const struct in6_addr *v6dst)
+{
+        int prefix_len;
+#ifdef CONFIG_IPV6_SIT_6RD
+        prefix_len = tunnel->ip6rd.prefixlen + 32
+                - tunnel->ip6rd.relay_prefixlen;
+#else
+        prefix_len = 48;
+#endif
+        return ipv6_chk_custom_prefix(v6dst, prefix_len, tunnel->dev);
+}
+/* Returns true if a packet is spoofed */
+static bool packet_is_spoofed(struct sk_buff *skb,
+                              const struct iphdr *iph,
+                              struct ip_tunnel *tunnel)
+{
+        const struct ipv6hdr *ipv6h;
+        if (tunnel->dev->priv_flags & IFF_ISATAP) {
+                if (!isatap_chksrc(skb, iph, tunnel))
+                        return true;
+                return false;
+        }
+        if (tunnel->dev->flags & IFF_POINTOPOINT)
+                return false;
+        ipv6h = ipv6_hdr(skb);
+        if (unlikely(is_spoofed_6rd(tunnel, iph->saddr, &ipv6h->saddr))) {
+                net_warn_ratelimited("Src spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
+                                     &iph->saddr, &ipv6h->saddr,
+                                     &iph->daddr, &ipv6h->daddr);
+                return true;
+        }
+        if (likely(!is_spoofed_6rd(tunnel, iph->daddr, &ipv6h->daddr)))
+                return false;
+        if (only_dnatted(tunnel, &ipv6h->daddr))
+                return false;
+        net_warn_ratelimited("Dst spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
+                             &iph->saddr, &ipv6h->saddr,
+                             &iph->daddr, &ipv6h->daddr);
+        return true;
+}
 static int ipip6_rcv(struct sk_buff *skb)
 {
        const struct iphdr *iph = ip_hdr(skb);
@@ -586,19 +650,9 @@ static int ipip6_rcv(struct sk_buff *skb)
                IPCB(skb)->flags = 0;
                skb->protocol = htons(ETH_P_IPV6);
-                if (tunnel->dev->priv_flags & IFF_ISATAP) {
+                if (packet_is_spoofed(skb, iph, tunnel)) {
-                        if (!isatap_chksrc(skb, iph, tunnel)) {
+                        tunnel->dev->stats.rx_errors++;
-                                tunnel->dev->stats.rx_errors++;
+                        goto out;
-                                goto out;
-                        }
-                } else if (!(tunnel->dev->flags&IFF_POINTOPOINT)) {
-                        if (is_spoofed_6rd(tunnel, iph->saddr,
-                                           &ipv6_hdr(skb)->saddr) ||
-                            is_spoofed_6rd(tunnel, iph->daddr,
-                                           &ipv6_hdr(skb)->daddr)) {
-                                tunnel->dev->stats.rx_errors++;
-                                goto out;
-                        }
                }
                __skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
@@ -748,7 +802,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                        neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
                if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("nexthop == NULL\n");
                        goto tx_error;
                }
@@ -777,7 +831,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                        neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
                if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("nexthop == NULL\n");
                        goto tx_error;
                }
@@ -1612,6 +1666,7 @@ static int __net_init sit_init_net(struct net *net)
                goto err_alloc_dev;
        }
        dev_net_set(sitn->fb_tunnel_dev, net);
+        sitn->fb_tunnel_dev->rtnl_link_ops = &sit_link_ops;
        /* FB netdevice is special: we have one, and only one per netns.
         * Allowing to move it to another netns is clearly unsafe.
         */
@@ -1646,7 +1701,6 @@ static void __net_exit sit_exit_net(struct net *net)
        rtnl_lock();
        sit_destroy_tunnels(sitn, &list);
-        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
        unregister_netdevice_many(&list);
        rtnl_unlock();
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index f4058150262b..72b7eaaf3ca0 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -525,8 +525,10 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        if (type == ICMPV6_PKT_TOOBIG)
                ip6_sk_update_pmtu(skb, sk, info);
-        if (type == NDISC_REDIRECT)
+        if (type == NDISC_REDIRECT) {
                ip6_sk_redirect(skb, sk);
+                goto out;
+        }
        np = inet6_sk(sk);
diff --git a/net/lapb/lapb_timer.c b/net/lapb/lapb_timer.c
index 54563ad8aeb1..355cc3b6fa4d 100644
--- a/net/lapb/lapb_timer.c
+++ b/net/lapb/lapb_timer.c
@@ -154,6 +154,7 @@ static void lapb_t1timer_expiry(unsigned long param)
                        } else {
                                lapb->n2count++;
                                lapb_requeue_frames(lapb);
+                                lapb_kick(lapb);
                        }
                        break;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 4f69e83ff836..74fd00c27210 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -116,6 +116,7 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
        if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                struct ip_vs_cpu_stats *s;
+                struct ip_vs_service *svc;
                s = this_cpu_ptr(dest->stats.cpustats);
                s->ustats.inpkts++;
@@ -123,11 +124,14 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
                s->ustats.inbytes += skb->len;
                u64_stats_update_end(&s->syncp);
-                s = this_cpu_ptr(dest->svc->stats.cpustats);
+                rcu_read_lock();
+                svc = rcu_dereference(dest->svc);
+                s = this_cpu_ptr(svc->stats.cpustats);
                s->ustats.inpkts++;
                u64_stats_update_begin(&s->syncp);
                s->ustats.inbytes += skb->len;
                u64_stats_update_end(&s->syncp);
+                rcu_read_unlock();
                s = this_cpu_ptr(ipvs->tot_stats.cpustats);
                s->ustats.inpkts++;
@@ -146,6 +150,7 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
        if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                struct ip_vs_cpu_stats *s;
+                struct ip_vs_service *svc;
                s = this_cpu_ptr(dest->stats.cpustats);
                s->ustats.outpkts++;
@@ -153,11 +158,14 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
                s->ustats.outbytes += skb->len;
                u64_stats_update_end(&s->syncp);
-                s = this_cpu_ptr(dest->svc->stats.cpustats);
+                rcu_read_lock();
+                svc = rcu_dereference(dest->svc);
+                s = this_cpu_ptr(svc->stats.cpustats);
                s->ustats.outpkts++;
                u64_stats_update_begin(&s->syncp);
                s->ustats.outbytes += skb->len;
                u64_stats_update_end(&s->syncp);
+                rcu_read_unlock();
                s = this_cpu_ptr(ipvs->tot_stats.cpustats);
                s->ustats.outpkts++;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c8148e487386..a3df9bddc4f7 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -460,7 +460,7 @@ static inline void
 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 {
        atomic_inc(&svc->refcnt);
-        dest->svc = svc;
+        rcu_assign_pointer(dest->svc, svc);
 }
 static void ip_vs_service_free(struct ip_vs_service *svc)
@@ -470,18 +470,25 @@ static void ip_vs_service_free(struct ip_vs_service *svc)
        kfree(svc);
 }
-static void
+static void ip_vs_service_rcu_free(struct rcu_head *head)
-__ip_vs_unbind_svc(struct ip_vs_dest *dest)
 {
-        struct ip_vs_service *svc = dest->svc;
+        struct ip_vs_service *svc;
+        svc = container_of(head, struct ip_vs_service, rcu_head);
+        ip_vs_service_free(svc);
+}
-        dest->svc = NULL;
+static void __ip_vs_svc_put(struct ip_vs_service *svc, bool do_delay)
+{
        if (atomic_dec_and_test(&svc->refcnt)) {
                IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
                              svc->fwmark,
                              IP_VS_DBG_ADDR(svc->af, &svc->addr),
                              ntohs(svc->port));
-                ip_vs_service_free(svc);
+                if (do_delay)
+                        call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
+                else
+                        ip_vs_service_free(svc);
        }
 }
@@ -667,11 +674,6 @@ ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
                              IP_VS_DBG_ADDR(svc->af, &dest->addr),
                              ntohs(dest->port),
                              atomic_read(&dest->refcnt));
-                /* We can not reuse dest while in grace period
-                 * because conns still can use dest->svc
-                 */
-                if (test_bit(IP_VS_DEST_STATE_REMOVING, &dest->state))
-                        continue;
                if (dest->af == svc->af &&
                    ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
                    dest->port == dport &&
@@ -697,8 +699,10 @@ out:
 static void ip_vs_dest_free(struct ip_vs_dest *dest)
 {
+        struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1);
        __ip_vs_dst_cache_reset(dest);
-        __ip_vs_unbind_svc(dest);
+        __ip_vs_svc_put(svc, false);
        free_percpu(dest->stats.cpustats);
        kfree(dest);
 }
@@ -771,6 +775,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
                    struct ip_vs_dest_user_kern *udest, int add)
 {
        struct netns_ipvs *ipvs = net_ipvs(svc->net);
+        struct ip_vs_service *old_svc;
        struct ip_vs_scheduler *sched;
        int conn_flags;
@@ -792,13 +797,14 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
        atomic_set(&dest->conn_flags, conn_flags);
        /* bind the service */
-        if (!dest->svc) {
+        old_svc = rcu_dereference_protected(dest->svc, 1);
+        if (!old_svc) {
                __ip_vs_bind_svc(dest, svc);
        } else {
-                if (dest->svc != svc) {
+                if (old_svc != svc) {
-                        __ip_vs_unbind_svc(dest);
                        ip_vs_zero_stats(&dest->stats);
                        __ip_vs_bind_svc(dest, svc);
+                        __ip_vs_svc_put(old_svc, true);
                }
        }
@@ -998,16 +1004,6 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
        return 0;
 }
-static void ip_vs_dest_wait_readers(struct rcu_head *head)
-{
-        struct ip_vs_dest *dest = container_of(head, struct ip_vs_dest,
-                                               rcu_head);
-        /* End of grace period after unlinking */
-        clear_bit(IP_VS_DEST_STATE_REMOVING, &dest->state);
-}
 /*
 *      Delete a destination (must be already unlinked from the service)
 */
@@ -1023,20 +1019,16 @@ static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest,
         */
        ip_vs_rs_unhash(dest);
-        if (!cleanup) {
-                set_bit(IP_VS_DEST_STATE_REMOVING, &dest->state);
-                call_rcu(&dest->rcu_head, ip_vs_dest_wait_readers);
-        }
        spin_lock_bh(&ipvs->dest_trash_lock);
        IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n",
                      IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port),
                      atomic_read(&dest->refcnt));
        if (list_empty(&ipvs->dest_trash) && !cleanup)
                mod_timer(&ipvs->dest_trash_timer,
-                          jiffies + IP_VS_DEST_TRASH_PERIOD);
+                          jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
        /* dest lives in trash without reference */
        list_add(&dest->t_list, &ipvs->dest_trash);
+        dest->idle_start = 0;
        spin_unlock_bh(&ipvs->dest_trash_lock);
        ip_vs_dest_put(dest);
 }
@@ -1108,24 +1100,30 @@ static void ip_vs_dest_trash_expire(unsigned long data)
        struct net *net = (struct net *) data;
        struct netns_ipvs *ipvs = net_ipvs(net);
        struct ip_vs_dest *dest, *next;
+        unsigned long now = jiffies;
        spin_lock(&ipvs->dest_trash_lock);
        list_for_each_entry_safe(dest, next, &ipvs->dest_trash, t_list) {
-                /* Skip if dest is in grace period */
-                if (test_bit(IP_VS_DEST_STATE_REMOVING, &dest->state))
-                        continue;
                if (atomic_read(&dest->refcnt) > 0)
                        continue;
+                if (dest->idle_start) {
+                        if (time_before(now, dest->idle_start +
+                                             IP_VS_DEST_TRASH_PERIOD))
+                                continue;
+                } else {
+                        dest->idle_start = max(1UL, now);
+                        continue;
+                }
                IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u from trash\n",
                              dest->vfwmark,
-                              IP_VS_DBG_ADDR(dest->svc->af, &dest->addr),
+                              IP_VS_DBG_ADDR(dest->af, &dest->addr),
                              ntohs(dest->port));
                list_del(&dest->t_list);
                ip_vs_dest_free(dest);
        }
        if (!list_empty(&ipvs->dest_trash))
                mod_timer(&ipvs->dest_trash_timer,
-                          jiffies + IP_VS_DEST_TRASH_PERIOD);
+                          jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
        spin_unlock(&ipvs->dest_trash_lock);
 }
@@ -1320,14 +1318,6 @@ out:
        return ret;
 }
-static void ip_vs_service_rcu_free(struct rcu_head *head)
-{
-        struct ip_vs_service *svc;
-        svc = container_of(head, struct ip_vs_service, rcu_head);
-        ip_vs_service_free(svc);
-}
 /*
 *      Delete a service from the service list
 *      - The service must be unlinked, unlocked and not referenced!
@@ -1376,13 +1366,7 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
        /*
         *    Free the service if nobody refers to it
         */
-        if (atomic_dec_and_test(&svc->refcnt)) {
+        __ip_vs_svc_put(svc, true);
-                IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
-                              svc->fwmark,
-                              IP_VS_DBG_ADDR(svc->af, &svc->addr),
-                              ntohs(svc->port));
-                call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
-        }
        /* decrease the module use count */
        ip_vs_use_count_dec();
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index 6bee6d0c73a5..1425e9a924c4 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -59,12 +59,13 @@ static void ip_vs_read_cpu_stats(struct ip_vs_stats_user *sum,
                                 struct ip_vs_cpu_stats __percpu *stats)
 {
        int i;
+        bool add = false;
        for_each_possible_cpu(i) {
                struct ip_vs_cpu_stats *s = per_cpu_ptr(stats, i);
                unsigned int start;
                __u64 inbytes, outbytes;
-                if (i) {
+                if (add) {
                        sum->conns += s->ustats.conns;
                        sum->inpkts += s->ustats.inpkts;
                        sum->outpkts += s->ustats.outpkts;
@@ -76,6 +77,7 @@ static void ip_vs_read_cpu_stats(struct ip_vs_stats_user *sum,
                        sum->inbytes += inbytes;
                        sum->outbytes += outbytes;
                } else {
+                        add = true;
                        sum->conns = s->ustats.conns;
                        sum->inpkts = s->ustats.inpkts;
                        sum->outpkts = s->ustats.outpkts;
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 1383b0eadc0e..eff13c94498e 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -93,7 +93,7 @@ struct ip_vs_lblc_entry {
        struct hlist_node       list;
        int                     af;             /* address family */
        union nf_inet_addr      addr;           /* destination IP address */
-        struct ip_vs_dest __rcu *dest;          /* real server (cache) */
+        struct ip_vs_dest       *dest;          /* real server (cache) */
        unsigned long           lastuse;        /* last used time */
        struct rcu_head         rcu_head;
 };
@@ -130,20 +130,21 @@ static struct ctl_table vs_vars_table[] = {
 };
 #endif
-static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
+static void ip_vs_lblc_rcu_free(struct rcu_head *head)
 {
-        struct ip_vs_dest *dest;
+        struct ip_vs_lblc_entry *en = container_of(head,
+                                                   struct ip_vs_lblc_entry,
+                                                   rcu_head);
-        hlist_del_rcu(&en->list);
+        ip_vs_dest_put(en->dest);
-        /*
+        kfree(en);
-         * We don't kfree dest because it is referred either by its service
-         * or the trash dest list.
-         */
-        dest = rcu_dereference_protected(en->dest, 1);
-        ip_vs_dest_put(dest);
-        kfree_rcu(en, rcu_head);
 }
+static inline void ip_vs_lblc_del(struct ip_vs_lblc_entry *en)
+{
+        hlist_del_rcu(&en->list);
+        call_rcu(&en->rcu_head, ip_vs_lblc_rcu_free);
+}
 /*
 *      Returns hash value for IPVS LBLC entry
@@ -203,30 +204,23 @@ ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, const union nf_inet_addr *daddr,
        struct ip_vs_lblc_entry *en;
        en = ip_vs_lblc_get(dest->af, tbl, daddr);
-        if (!en) {
+        if (en) {
-                en = kmalloc(sizeof(*en), GFP_ATOMIC);
+                if (en->dest == dest)
-                if (!en)
+                        return en;
-                        return NULL;
+                ip_vs_lblc_del(en);
+        }
-                en->af = dest->af;
+        en = kmalloc(sizeof(*en), GFP_ATOMIC);
-                ip_vs_addr_copy(dest->af, &en->addr, daddr);
+        if (!en)
-                en->lastuse = jiffies;
+                return NULL;
-                ip_vs_dest_hold(dest);
+        en->af = dest->af;
-                RCU_INIT_POINTER(en->dest, dest);
+        ip_vs_addr_copy(dest->af, &en->addr, daddr);
+        en->lastuse = jiffies;
-                ip_vs_lblc_hash(tbl, en);
+        ip_vs_dest_hold(dest);
-        } else {
+        en->dest = dest;
-                struct ip_vs_dest *old_dest;
-                old_dest = rcu_dereference_protected(en->dest, 1);
+        ip_vs_lblc_hash(tbl, en);
-                if (old_dest != dest) {
-                        ip_vs_dest_put(old_dest);
-                        ip_vs_dest_hold(dest);
-                        /* No ordering constraints for refcnt */
-                        RCU_INIT_POINTER(en->dest, dest);
-                }
-        }
        return en;
 }
@@ -246,7 +240,7 @@ static void ip_vs_lblc_flush(struct ip_vs_service *svc)
        tbl->dead = 1;
        for (i=0; i<IP_VS_LBLC_TAB_SIZE; i++) {
                hlist_for_each_entry_safe(en, next, &tbl->bucket[i], list) {
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                        atomic_dec(&tbl->entries);
                }
        }
@@ -281,7 +275,7 @@ static inline void ip_vs_lblc_full_check(struct ip_vs_service *svc)
                                        sysctl_lblc_expiration(svc)))
                                continue;
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                        atomic_dec(&tbl->entries);
                }
                spin_unlock(&svc->sched_lock);
@@ -335,7 +329,7 @@ static void ip_vs_lblc_check_expire(unsigned long data)
                        if (time_before(now, en->lastuse + ENTRY_TIMEOUT))
                                continue;
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                        atomic_dec(&tbl->entries);
                        goal--;
                }
@@ -443,8 +437,8 @@ __ip_vs_lblc_schedule(struct ip_vs_service *svc)
                        continue;
                doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
+                if ((__s64)loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                    (__s64)doh * atomic_read(&least->weight)) {
                        least = dest;
                        loh = doh;
                }
@@ -511,7 +505,7 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                 * free up entries from the trash at any time.
                 */
-                dest = rcu_dereference(en->dest);
+                dest = en->dest;
                if ((dest->flags & IP_VS_DEST_F_AVAILABLE) &&
                    atomic_read(&dest->weight) > 0 && !is_overloaded(dest, svc))
                        goto out;
@@ -631,7 +625,7 @@ static void __exit ip_vs_lblc_cleanup(void)
 {
        unregister_ip_vs_scheduler(&ip_vs_lblc_scheduler);
        unregister_pernet_subsys(&ip_vs_lblc_ops);
-        synchronize_rcu();
+        rcu_barrier();
 }
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 5199448697f6..0b8550089a2e 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -89,7 +89,7 @@
 */
 struct ip_vs_dest_set_elem {
        struct list_head        list;          /* list link */
-        struct ip_vs_dest __rcu *dest;         /* destination server */
+        struct ip_vs_dest       *dest;          /* destination server */
        struct rcu_head         rcu_head;
 };
@@ -107,11 +107,7 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
        if (check) {
                list_for_each_entry(e, &set->list, list) {
-                        struct ip_vs_dest *d;
+                        if (e->dest == dest)
-                        d = rcu_dereference_protected(e->dest, 1);
-                        if (d == dest)
-                                /* already existed */
                                return;
                }
        }
@@ -121,7 +117,7 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
                return;
        ip_vs_dest_hold(dest);
-        RCU_INIT_POINTER(e->dest, dest);
+        e->dest = dest;
        list_add_rcu(&e->list, &set->list);
        atomic_inc(&set->size);
@@ -129,22 +125,27 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
        set->lastmod = jiffies;
 }
+static void ip_vs_lblcr_elem_rcu_free(struct rcu_head *head)
+{
+        struct ip_vs_dest_set_elem *e;
+        e = container_of(head, struct ip_vs_dest_set_elem, rcu_head);
+        ip_vs_dest_put(e->dest);
+        kfree(e);
+}
 static void
 ip_vs_dest_set_erase(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 {
        struct ip_vs_dest_set_elem *e;
        list_for_each_entry(e, &set->list, list) {
-                struct ip_vs_dest *d;
+                if (e->dest == dest) {
-                d = rcu_dereference_protected(e->dest, 1);
-                if (d == dest) {
                        /* HIT */
                        atomic_dec(&set->size);
                        set->lastmod = jiffies;
-                        ip_vs_dest_put(dest);
                        list_del_rcu(&e->list);
-                        kfree_rcu(e, rcu_head);
+                        call_rcu(&e->rcu_head, ip_vs_lblcr_elem_rcu_free);
                        break;
                }
        }
@@ -155,16 +156,8 @@ static void ip_vs_dest_set_eraseall(struct ip_vs_dest_set *set)
        struct ip_vs_dest_set_elem *e, *ep;
        list_for_each_entry_safe(e, ep, &set->list, list) {
-                struct ip_vs_dest *d;
-                d = rcu_dereference_protected(e->dest, 1);
-                /*
-                 * We don't kfree dest because it is referred either
-                 * by its service or by the trash dest list.
-                 */
-                ip_vs_dest_put(d);
                list_del_rcu(&e->list);
-                kfree_rcu(e, rcu_head);
+                call_rcu(&e->rcu_head, ip_vs_lblcr_elem_rcu_free);
        }
 }
@@ -175,12 +168,9 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
        struct ip_vs_dest *dest, *least;
        int loh, doh;
-        if (set == NULL)
-                return NULL;
        /* select the first destination server, whose weight > 0 */
        list_for_each_entry_rcu(e, &set->list, list) {
-                least = rcu_dereference(e->dest);
+                least = e->dest;
                if (least->flags & IP_VS_DEST_F_OVERLOAD)
                        continue;
@@ -195,13 +185,13 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
        /* find the destination with the weighted least load */
  nextstage:
        list_for_each_entry_continue_rcu(e, &set->list, list) {
-                dest = rcu_dereference(e->dest);
+                dest = e->dest;
                if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                        continue;
                doh = ip_vs_dest_conn_overhead(dest);
-                if ((loh * atomic_read(&dest->weight) >
+                if (((__s64)loh * atomic_read(&dest->weight) >
-                     doh * atomic_read(&least->weight))
+                     (__s64)doh * atomic_read(&least->weight))
                    && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                        least = dest;
                        loh = doh;
@@ -232,7 +222,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
        /* select the first destination server, whose weight > 0 */
        list_for_each_entry(e, &set->list, list) {
-                most = rcu_dereference_protected(e->dest, 1);
+                most = e->dest;
                if (atomic_read(&most->weight) > 0) {
                        moh = ip_vs_dest_conn_overhead(most);
                        goto nextstage;
@@ -243,11 +233,11 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
        /* find the destination with the weighted most load */
  nextstage:
        list_for_each_entry_continue(e, &set->list, list) {
-                dest = rcu_dereference_protected(e->dest, 1);
+                dest = e->dest;
                doh = ip_vs_dest_conn_overhead(dest);
                /* moh/mw < doh/dw ==> moh*dw < doh*mw, where mw,dw>0 */
-                if ((moh * atomic_read(&dest->weight) <
+                if (((__s64)moh * atomic_read(&dest->weight) <
-                     doh * atomic_read(&most->weight))
+                     (__s64)doh * atomic_read(&most->weight))
                    && (atomic_read(&dest->weight) > 0)) {
                        most = dest;
                        moh = doh;
@@ -611,8 +601,8 @@ __ip_vs_lblcr_schedule(struct ip_vs_service *svc)
                        continue;
                doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
+                if ((__s64)loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                    (__s64)doh * atomic_read(&least->weight)) {
                        least = dest;
                        loh = doh;
                }
@@ -819,7 +809,7 @@ static void __exit ip_vs_lblcr_cleanup(void)
 {
        unregister_ip_vs_scheduler(&ip_vs_lblcr_scheduler);
        unregister_pernet_subsys(&ip_vs_lblcr_ops);
-        synchronize_rcu();
+        rcu_barrier();
 }
diff --git a/net/netfilter/ipvs/ip_vs_nq.c b/net/netfilter/ipvs/ip_vs_nq.c
index d8d9860934fe..961a6de9bb29 100644
--- a/net/netfilter/ipvs/ip_vs_nq.c
+++ b/net/netfilter/ipvs/ip_vs_nq.c
@@ -40,7 +40,7 @@
 #include <net/ip_vs.h>
-static inline unsigned int
+static inline int
 ip_vs_nq_dest_overhead(struct ip_vs_dest *dest)
 {
        /*
@@ -59,7 +59,7 @@ ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                  struct ip_vs_iphdr *iph)
 {
        struct ip_vs_dest *dest, *least = NULL;
-        unsigned int loh = 0, doh;
+        int loh = 0, doh;
        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
@@ -92,8 +92,8 @@ ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                }
                if (!least ||
-                    (loh * atomic_read(&dest->weight) >
+                    ((__s64)loh * atomic_read(&dest->weight) >
-                     doh * atomic_read(&least->weight))) {
+                     (__s64)doh * atomic_read(&least->weight))) {
                        least = dest;
                        loh = doh;
                }
diff --git a/net/netfilter/ipvs/ip_vs_sed.c b/net/netfilter/ipvs/ip_vs_sed.c
index a5284cc3d882..e446b9fa7424 100644
--- a/net/netfilter/ipvs/ip_vs_sed.c
+++ b/net/netfilter/ipvs/ip_vs_sed.c
@@ -44,7 +44,7 @@
 #include <net/ip_vs.h>
-static inline unsigned int
+static inline int
 ip_vs_sed_dest_overhead(struct ip_vs_dest *dest)
 {
        /*
@@ -63,7 +63,7 @@ ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                   struct ip_vs_iphdr *iph)
 {
        struct ip_vs_dest *dest, *least;
-        unsigned int loh, doh;
+        int loh, doh;
        IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
@@ -99,8 +99,8 @@ ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                        continue;
                doh = ip_vs_sed_dest_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
+                if ((__s64)loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                    (__s64)doh * atomic_read(&least->weight)) {
                        least = dest;
                        loh = doh;
                }
diff --git a/net/netfilter/ipvs/ip_vs_wlc.c b/net/netfilter/ipvs/ip_vs_wlc.c
index 6dc1fa128840..b5b4650d50a9 100644
--- a/net/netfilter/ipvs/ip_vs_wlc.c
+++ b/net/netfilter/ipvs/ip_vs_wlc.c
@@ -35,7 +35,7 @@ ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                   struct ip_vs_iphdr *iph)
 {
        struct ip_vs_dest *dest, *least;
-        unsigned int loh, doh;
+        int loh, doh;
        IP_VS_DBG(6, "ip_vs_wlc_schedule(): Scheduling...\n");
@@ -71,8 +71,8 @@ ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                        continue;
                doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
+                if ((__s64)loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                    (__s64)doh * atomic_read(&least->weight)) {
                        least = dest;
                        loh = doh;
                }
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 6fd967c6278c..cdf4567ba9b3 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -24,7 +24,7 @@
 int synproxy_net_id;
 EXPORT_SYMBOL_GPL(synproxy_net_id);
-void
+bool
 synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
                       const struct tcphdr *th, struct synproxy_options *opts)
 {
@@ -32,7 +32,8 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
        u8 buf[40], *ptr;
        ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
-        BUG_ON(ptr == NULL);
+        if (ptr == NULL)
+                return false;
        opts->options = 0;
        while (length > 0) {
@@ -41,16 +42,16 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
                switch (opcode) {
                case TCPOPT_EOL:
-                        return;
+                        return true;
                case TCPOPT_NOP:
                        length--;
                        continue;
                default:
                        opsize = *ptr++;
                        if (opsize < 2)
-                                return;
+                                return true;
                        if (opsize > length)
-                                return;
+                                return true;
                        switch (opcode) {
                        case TCPOPT_MSS:
@@ -84,6 +85,7 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
                        length -= opsize;
                }
        }
+        return true;
 }
 EXPORT_SYMBOL_GPL(synproxy_parse_options);
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 32ad015ee8ce..a2fef8b10b96 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -285,7 +285,7 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
 /* remove one skb from head of flow queue */
-static struct sk_buff *fq_dequeue_head(struct fq_flow *flow)
+static struct sk_buff *fq_dequeue_head(struct Qdisc *sch, struct fq_flow *flow)
 {
        struct sk_buff *skb = flow->head;
@@ -293,6 +293,8 @@ static struct sk_buff *fq_dequeue_head(struct fq_flow *flow)
                flow->head = skb->next;
                skb->next = NULL;
                flow->qlen--;
+                sch->qstats.backlog -= qdisc_pkt_len(skb);
+                sch->q.qlen--;
        }
        return skb;
 }
@@ -418,8 +420,9 @@ static struct sk_buff *fq_dequeue(struct Qdisc *sch)
        struct fq_flow_head *head;
        struct sk_buff *skb;
        struct fq_flow *f;
+        u32 rate;
-        skb = fq_dequeue_head(&q->internal);
+        skb = fq_dequeue_head(sch, &q->internal);
        if (skb)
                goto out;
        fq_check_throttled(q, now);
@@ -449,7 +452,7 @@ begin:
                goto begin;
        }
-        skb = fq_dequeue_head(f);
+        skb = fq_dequeue_head(sch, f);
        if (!skb) {
                head->first = f->next;
                /* force a pass through old_flows to prevent starvation */
@@ -466,43 +469,74 @@ begin:
        f->time_next_packet = now;
        f->credit -= qdisc_pkt_len(skb);
-        if (f->credit <= 0 &&
+        if (f->credit > 0 || !q->rate_enable)
-            q->rate_enable &&
+                goto out;
-            skb->sk && skb->sk->sk_state != TCP_TIME_WAIT) {
-                u32 rate = skb->sk->sk_pacing_rate ?: q->flow_default_rate;
-                rate = min(rate, q->flow_max_rate);
+        if (skb->sk && skb->sk->sk_state != TCP_TIME_WAIT) {
-                if (rate) {
+                rate = skb->sk->sk_pacing_rate ?: q->flow_default_rate;
-                        u64 len = (u64)qdisc_pkt_len(skb) * NSEC_PER_SEC;
-                        do_div(len, rate);
-                        /* Since socket rate can change later,
-                         * clamp the delay to 125 ms.
-                         * TODO: maybe segment the too big skb, as in commit
-                         * e43ac79a4bc ("sch_tbf: segment too big GSO packets")
-                         */
-                        if (unlikely(len > 125 * NSEC_PER_MSEC)) {
-                                len = 125 * NSEC_PER_MSEC;
-                                q->stat_pkts_too_long++;
-                        }
-                        f->time_next_packet = now + len;
+                rate = min(rate, q->flow_max_rate);
+        } else {
+                rate = q->flow_max_rate;
+                if (rate == ~0U)
+                        goto out;
+        }
+        if (rate) {
+                u32 plen = max(qdisc_pkt_len(skb), q->quantum);
+                u64 len = (u64)plen * NSEC_PER_SEC;
+                do_div(len, rate);
+                /* Since socket rate can change later,
+                 * clamp the delay to 125 ms.
+                 * TODO: maybe segment the too big skb, as in commit
+                 * e43ac79a4bc ("sch_tbf: segment too big GSO packets")
+                 */
+                if (unlikely(len > 125 * NSEC_PER_MSEC)) {
+                        len = 125 * NSEC_PER_MSEC;
+                        q->stat_pkts_too_long++;
                }
+                f->time_next_packet = now + len;
        }
 out:
-        sch->qstats.backlog -= qdisc_pkt_len(skb);
        qdisc_bstats_update(sch, skb);
-        sch->q.qlen--;
        qdisc_unthrottled(sch);
        return skb;
 }
 static void fq_reset(struct Qdisc *sch)
 {
+        struct fq_sched_data *q = qdisc_priv(sch);
+        struct rb_root *root;
        struct sk_buff *skb;
+        struct rb_node *p;
+        struct fq_flow *f;
+        unsigned int idx;
-        while ((skb = fq_dequeue(sch)) != NULL)
+        while ((skb = fq_dequeue_head(sch, &q->internal)) != NULL)
                kfree_skb(skb);
+        if (!q->fq_root)
+                return;
+        for (idx = 0; idx < (1U << q->fq_trees_log); idx++) {
+                root = &q->fq_root[idx];
+                while ((p = rb_first(root)) != NULL) {
+                        f = container_of(p, struct fq_flow, fq_node);
+                        rb_erase(p, root);
+                        while ((skb = fq_dequeue_head(sch, f)) != NULL)
+                                kfree_skb(skb);
+                        kmem_cache_free(fq_flow_cachep, f);
+                }
+        }
+        q->new_flows.first      = NULL;
+        q->old_flows.first      = NULL;
+        q->delayed              = RB_ROOT;
+        q->flows                = 0;
+        q->inactive_flows       = 0;
+        q->throttled_flows      = 0;
 }
 static void fq_rehash(struct fq_sched_data *q,
@@ -645,6 +679,8 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
        while (sch->q.qlen > sch->limit) {
                struct sk_buff *skb = fq_dequeue(sch);
+                if (!skb)
+                        break;
                kfree_skb(skb);
                drop_count++;
        }
@@ -657,21 +693,9 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
 static void fq_destroy(struct Qdisc *sch)
 {
        struct fq_sched_data *q = qdisc_priv(sch);
-        struct rb_root *root;
-        struct rb_node *p;
-        unsigned int idx;
-        if (q->fq_root) {
+        fq_reset(sch);
-                for (idx = 0; idx < (1U << q->fq_trees_log); idx++) {
+        kfree(q->fq_root);
-                        root = &q->fq_root[idx];
-                        while ((p = rb_first(root)) != NULL) {
-                                rb_erase(p, root);
-                                kmem_cache_free(fq_flow_cachep,
-                                                container_of(p, struct fq_flow, fq_node));
-                        }
-                }
-                kfree(q->fq_root);
-        }
        qdisc_watchdog_cancel(&q->watchdog);
 }
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 9bc6db04be3e..e7000be321b0 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -47,12 +47,12 @@ static int net_ctl_permissions(struct ctl_table_header *head,
        /* Allow network administrator to have same access as root. */
        if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
-            uid_eq(root_uid, current_uid())) {
+            uid_eq(root_uid, current_euid())) {
                int mode = (table->mode >> 6) & 7;
                return (mode << 6) | (mode << 3) | mode;
        }
        /* Allow netns root group to have the same access as the root group */
-        if (gid_eq(root_gid, current_gid())) {
+        if (in_egroup_p(root_gid)) {
                int mode = (table->mode >> 3) & 7;
                return (mode << 3) | mode;
        }
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 95c2b2689a03..7db9954f1af2 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -580,15 +580,13 @@ static struct aa_namespace *__next_namespace(struct aa_namespace *root,
        /* check if the next ns is a sibling, parent, gp, .. */
        parent = ns->parent;
-        while (parent) {
+        while (ns != root) {
                mutex_unlock(&ns->lock);
                next = list_entry_next(ns, base.list);
                if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
                        mutex_lock(&next->lock);
                        return next;
                }
-                if (parent == root)
-                        return NULL;
                ns = parent;
                parent = parent->parent;
        }
diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
index d6222ba4e919..532471d0b3a0 100644
--- a/security/apparmor/crypto.c
+++ b/security/apparmor/crypto.c
@@ -15,14 +15,14 @@
 * it should be.
 */
-#include <linux/crypto.h>
+#include <crypto/hash.h>
 #include "include/apparmor.h"
 #include "include/crypto.h"
 static unsigned int apparmor_hash_size;
-static struct crypto_hash *apparmor_tfm;
+static struct crypto_shash *apparmor_tfm;
 unsigned int aa_hash_size(void)
 {
@@ -32,35 +32,33 @@ unsigned int aa_hash_size(void)
 int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
                         size_t len)
 {
-        struct scatterlist sg[2];
+        struct {
-        struct hash_desc desc = {
+                struct shash_desc shash;
-                .tfm = apparmor_tfm,
+                char ctx[crypto_shash_descsize(apparmor_tfm)];
-                .flags = 0
+        } desc;
-        };
        int error = -ENOMEM;
        u32 le32_version = cpu_to_le32(version);
        if (!apparmor_tfm)
                return 0;
-        sg_init_table(sg, 2);
-        sg_set_buf(&sg[0], &le32_version, 4);
-        sg_set_buf(&sg[1], (u8 *) start, len);
        profile->hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
        if (!profile->hash)
                goto fail;
-        error = crypto_hash_init(&desc);
+        desc.shash.tfm = apparmor_tfm;
+        desc.shash.flags = 0;
+        error = crypto_shash_init(&desc.shash);
        if (error)
                goto fail;
-        error = crypto_hash_update(&desc, &sg[0], 4);
+        error = crypto_shash_update(&desc.shash, (u8 *) &le32_version, 4);
        if (error)
                goto fail;
-        error = crypto_hash_update(&desc, &sg[1], len);
+        error = crypto_shash_update(&desc.shash, (u8 *) start, len);
        if (error)
                goto fail;
-        error = crypto_hash_final(&desc, profile->hash);
+        error = crypto_shash_final(&desc.shash, profile->hash);
        if (error)
                goto fail;
@@ -75,19 +73,19 @@ fail:
 static int __init init_profile_hash(void)
 {
-        struct crypto_hash *tfm;
+        struct crypto_shash *tfm;
        if (!apparmor_initialized)
                return 0;
-        tfm = crypto_alloc_hash("sha1", 0, CRYPTO_ALG_ASYNC);
+        tfm = crypto_alloc_shash("sha1", 0, CRYPTO_ALG_ASYNC);
        if (IS_ERR(tfm)) {
                int error = PTR_ERR(tfm);
                AA_ERROR("failed to setup profile sha1 hashing: %d\n", error);
                return error;
        }
        apparmor_tfm = tfm;
-        apparmor_hash_size = crypto_hash_digestsize(apparmor_tfm);
+        apparmor_hash_size = crypto_shash_digestsize(apparmor_tfm);
        aa_info_message("AppArmor sha1 policy hashing enabled");
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index f2d4b6348cbc..c28b0f20ab53 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -360,7 +360,9 @@ static inline void aa_put_replacedby(struct aa_replacedby *p)
 static inline void __aa_update_replacedby(struct aa_profile *orig,
                                          struct aa_profile *new)
 {
-        struct aa_profile *tmp = rcu_dereference(orig->replacedby->profile);
+        struct aa_profile *tmp;
+        tmp = rcu_dereference_protected(orig->replacedby->profile,
+                                        mutex_is_locked(&orig->ns->lock));
        rcu_assign_pointer(orig->replacedby->profile, aa_get_profile(new));
        orig->flags |= PFLAG_INVALID;
        aa_put_profile(tmp);
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 6172509fa2b7..705c2879d3a9 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -563,7 +563,8 @@ void __init aa_free_root_ns(void)
 static void free_replacedby(struct aa_replacedby *r)
 {
        if (r) {
-                aa_put_profile(rcu_dereference(r->profile));
+                /* r->profile will not be updated any more as r is dead */
+                aa_put_profile(rcu_dereference_protected(r->profile, true));
                kzfree(r);
        }
 }
@@ -609,6 +610,7 @@ void aa_free_profile(struct aa_profile *profile)
        aa_put_dfa(profile->policy.dfa);
        aa_put_replacedby(profile->replacedby);
+        kzfree(profile->hash);
        kzfree(profile);
 }
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index dad36a6ab45f..fc3e6628a864 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -746,7 +746,6 @@ inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
 * @tclass: target security class
 * @requested: requested permissions, interpreted based on @tclass
 * @auditdata: auxiliary audit data
- * @flags: VFS walk flags
 *
 * Check the AVC to determine whether the @requested permissions are granted
 * for the SID pair (@ssid, @tsid), interpreting the permissions
@@ -756,17 +755,15 @@ inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
 * permissions are granted, -%EACCES if any permissions are denied, or
 * another -errno upon other errors.
 */
-int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass,
+int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
-                       u32 requested, struct common_audit_data *auditdata,
+                 u32 requested, struct common_audit_data *auditdata)
-                       unsigned flags)
 {
        struct av_decision avd;
        int rc, rc2;
        rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
-        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata,
+        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
-                        flags);
        if (rc2)
                return rc2;
        return rc;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a5091ec06aa6..5b5231068516 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1502,7 +1502,7 @@ static int cred_has_capability(const struct cred *cred,
        rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
        if (audit == SECURITY_CAP_AUDIT) {
-                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
+                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
                if (rc2)
                        return rc2;
        }
@@ -1525,8 +1525,7 @@ static int task_has_system(struct task_struct *tsk,
 static int inode_has_perm(const struct cred *cred,
                          struct inode *inode,
                          u32 perms,
-                          struct common_audit_data *adp,
+                          struct common_audit_data *adp)
-                          unsigned flags)
 {
        struct inode_security_struct *isec;
        u32 sid;
@@ -1539,7 +1538,7 @@ static int inode_has_perm(const struct cred *cred,
        sid = cred_sid(cred);
        isec = inode->i_security;
-        return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
+        return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
 }
 /* Same as inode_has_perm, but pass explicit audit data containing
@@ -1554,7 +1553,7 @@ static inline int dentry_has_perm(const struct cred *cred,
        ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;
-        return inode_has_perm(cred, inode, av, &ad, 0);
+        return inode_has_perm(cred, inode, av, &ad);
 }
 /* Same as inode_has_perm, but pass explicit audit data containing
@@ -1569,7 +1568,7 @@ static inline int path_has_perm(const struct cred *cred,
        ad.type = LSM_AUDIT_DATA_PATH;
        ad.u.path = *path;
-        return inode_has_perm(cred, inode, av, &ad, 0);
+        return inode_has_perm(cred, inode, av, &ad);
 }
 /* Same as path_has_perm, but uses the inode from the file struct. */
@@ -1581,7 +1580,7 @@ static inline int file_path_has_perm(const struct cred *cred,
        ad.type = LSM_AUDIT_DATA_PATH;
        ad.u.path = file->f_path;
-        return inode_has_perm(cred, file_inode(file), av, &ad, 0);
+        return inode_has_perm(cred, file_inode(file), av, &ad);
 }
 /* Check whether a task can use an open file descriptor to
@@ -1617,7 +1616,7 @@ static int file_has_perm(const struct cred *cred,
        /* av is zero if only checking access to the descriptor. */
        rc = 0;
        if (av)
-                rc = inode_has_perm(cred, inode, av, &ad, 0);
+                rc = inode_has_perm(cred, inode, av, &ad);
 out:
        return rc;
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index 92d0ab561db8..f53ee3c58d0f 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -130,7 +130,7 @@ static inline int avc_audit(u32 ssid, u32 tsid,
                            u16 tclass, u32 requested,
                            struct av_decision *avd,
                            int result,
-                            struct common_audit_data *a, unsigned flags)
+                            struct common_audit_data *a)
 {
        u32 audited, denied;
        audited = avc_audit_required(requested, avd, result, 0, &denied);
@@ -138,7 +138,7 @@ static inline int avc_audit(u32 ssid, u32 tsid,
                return 0;
        return slow_avc_audit(ssid, tsid, tclass,
                              requested, audited, denied,
-                              a, flags);
+                              a, 0);
 }
 #define AVC_STRICT 1 /* Ignore permissive mode. */
@@ -147,17 +147,9 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                         unsigned flags,
                         struct av_decision *avd);
-int avc_has_perm_flags(u32 ssid, u32 tsid,
+int avc_has_perm(u32 ssid, u32 tsid,
-                       u16 tclass, u32 requested,
+                 u16 tclass, u32 requested,
-                       struct common_audit_data *auditdata,
+                 struct common_audit_data *auditdata);
-                       unsigned);
-static inline int avc_has_perm(u32 ssid, u32 tsid,
-                               u16 tclass, u32 requested,
-                               struct common_audit_data *auditdata)
-{
-        return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
-}
 u32 avc_policy_seqno(void);
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index 445ca481d8d3..bf578ba2677e 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -175,6 +175,7 @@ static const struct ac97_codec_id snd_ac97_codec_ids[] = {
 { 0x54524106, 0xffffffff, "TR28026",            NULL,           NULL },
 { 0x54524108, 0xffffffff, "TR28028",            patch_tritech_tr28028,  NULL }, // added by xin jin [07/09/99]
 { 0x54524123, 0xffffffff, "TR28602",            NULL,           NULL }, // only guess --jk [TR28023 = eMicro EM28023 (new CT1297)]
+{ 0x54584e03, 0xffffffff, "TLV320AIC27",        NULL,           NULL },
 { 0x54584e20, 0xffffffff, "TLC320AD9xC",        NULL,           NULL },
 { 0x56494161, 0xffffffff, "VIA1612A",           NULL,           NULL }, // modified ICE1232 with S/PDIF
 { 0x56494170, 0xffffffff, "VIA1617A",           patch_vt1617a,  NULL }, // modified VT1616 with S/PDIF
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index ac41e9cdc976..26ad4f0aade3 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -3531,7 +3531,7 @@ static int create_capture_mixers(struct hda_codec *codec)
                if (!multi)
                        err = create_single_cap_vol_ctl(codec, n, vol, sw,
                                                        inv_dmic);
-                else if (!multi_cap_vol)
+                else if (!multi_cap_vol && !inv_dmic)
                        err = create_bind_cap_vol_ctl(codec, n, vol, sw);
                else
                        err = create_multi_cap_vol_ctl(codec);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 4edd2d0f9a3c..ec68eaea0336 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3231,6 +3231,7 @@ enum {
        CXT_FIXUP_INC_MIC_BOOST,
        CXT_FIXUP_HEADPHONE_MIC_PIN,
        CXT_FIXUP_HEADPHONE_MIC,
+        CXT_FIXUP_GPIO1,
 };
 static void cxt_fixup_stereo_dmic(struct hda_codec *codec,
@@ -3375,6 +3376,15 @@ static const struct hda_fixup cxt_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = cxt_fixup_headphone_mic,
        },
+        [CXT_FIXUP_GPIO1] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        { 0x01, AC_VERB_SET_GPIO_MASK, 0x01 },
+                        { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x01 },
+                        { 0x01, AC_VERB_SET_GPIO_DATA, 0x01 },
+                        { }
+                },
+        },
 };
 static const struct snd_pci_quirk cxt5051_fixups[] = {
@@ -3384,6 +3394,7 @@ static const struct snd_pci_quirk cxt5051_fixups[] = {
 static const struct snd_pci_quirk cxt5066_fixups[] = {
        SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
+        SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_GPIO1),
        SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
        SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
        SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 7ea0245fc6bd..50173d412ac5 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -937,6 +937,14 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
        }
        /*
+         * always configure channel mapping, it may have been changed by the
+         * user in the meantime
+         */
+        hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
+                                   channels, per_pin->chmap,
+                                   per_pin->chmap_set);
+        /*
         * sizeof(ai) is used instead of sizeof(*hdmi_ai) or
         * sizeof(*dp_ai) to avoid partial match/update problems when
         * the user switches between HDMI/DP monitors.
@@ -947,20 +955,10 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
                            "pin=%d channels=%d\n",
                            pin_nid,
                            channels);
-                hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
-                                           channels, per_pin->chmap,
-                                           per_pin->chmap_set);
                hdmi_stop_infoframe_trans(codec, pin_nid);
                hdmi_fill_audio_infoframe(codec, pin_nid,
                                            ai.bytes, sizeof(ai));
                hdmi_start_infoframe_trans(codec, pin_nid);
-        } else {
-                /* For non-pcm audio switch, setup new channel mapping
-                 * accordingly */
-                if (per_pin->non_pcm != non_pcm)
-                        hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
-                                                   channels, per_pin->chmap,
-                                                   per_pin->chmap_set);
        }
        per_pin->non_pcm = non_pcm;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0e303b99a47c..bf313bea7085 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2819,6 +2819,15 @@ static void alc269_fixup_hweq(struct hda_codec *codec,
        alc_write_coef_idx(codec, 0x1e, coef | 0x80);
 }
+static void alc269_fixup_headset_mic(struct hda_codec *codec,
+                                       const struct hda_fixup *fix, int action)
+{
+        struct alc_spec *spec = codec->spec;
+        if (action == HDA_FIXUP_ACT_PRE_PROBE)
+                spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
+}
 static void alc271_fixup_dmic(struct hda_codec *codec,
                              const struct hda_fixup *fix, int action)
 {
@@ -3496,6 +3505,15 @@ static void alc282_fixup_asus_tx300(struct hda_codec *codec,
        }
 }
+static void alc290_fixup_mono_speakers(struct hda_codec *codec,
+                                       const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE)
+                /* Remove DAC node 0x03, as it seems to be
+                   giving mono output */
+                snd_hda_override_wcaps(codec, 0x03, 0);
+}
 enum {
        ALC269_FIXUP_SONY_VAIO,
        ALC275_FIXUP_SONY_VAIO_GPIO2,
@@ -3507,6 +3525,7 @@ enum {
        ALC271_FIXUP_DMIC,
        ALC269_FIXUP_PCM_44K,
        ALC269_FIXUP_STEREO_DMIC,
+        ALC269_FIXUP_HEADSET_MIC,
        ALC269_FIXUP_QUANTA_MUTE,
        ALC269_FIXUP_LIFEBOOK,
        ALC269_FIXUP_AMIC,
@@ -3519,9 +3538,11 @@ enum {
        ALC269_FIXUP_HP_GPIO_LED,
        ALC269_FIXUP_INV_DMIC,
        ALC269_FIXUP_LENOVO_DOCK,
+        ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
        ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
        ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
        ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
+        ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
        ALC269_FIXUP_HEADSET_MODE,
        ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
        ALC269_FIXUP_ASUS_X101_FUNC,
@@ -3535,6 +3556,7 @@ enum {
        ALC283_FIXUP_CHROME_BOOK,
        ALC282_FIXUP_ASUS_TX300,
        ALC283_FIXUP_INT_MIC,
+        ALC290_FIXUP_MONO_SPEAKERS,
 };
 static const struct hda_fixup alc269_fixups[] = {
@@ -3603,6 +3625,10 @@ static const struct hda_fixup alc269_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc269_fixup_stereo_dmic,
        },
+        [ALC269_FIXUP_HEADSET_MIC] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_headset_mic,
+        },
        [ALC269_FIXUP_QUANTA_MUTE] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc269_fixup_quanta_mute,
@@ -3712,6 +3738,15 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
        },
+        [ALC269_FIXUP_DELL3_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1a, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
        [ALC269_FIXUP_HEADSET_MODE] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc_fixup_headset_mode,
@@ -3720,6 +3755,15 @@ static const struct hda_fixup alc269_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc_fixup_headset_mode_no_hp_mic,
        },
+        [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MIC
+        },
        [ALC269_FIXUP_ASUS_X101_FUNC] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc269_fixup_x101_headset_mic,
@@ -3804,6 +3848,12 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
        },
+        [ALC290_FIXUP_MONO_SPEAKERS] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc290_fixup_mono_speakers,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
+        },
 };
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -3845,6 +3895,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_MONO_SPEAKERS),
        SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -3867,6 +3918,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
        SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
        SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
+        SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
        SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
        SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
@@ -3952,6 +4004,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
        {.id = ALC269_FIXUP_STEREO_DMIC, .name = "alc269-dmic"},
        {.id = ALC271_FIXUP_DMIC, .name = "alc271-dmic"},
        {.id = ALC269_FIXUP_INV_DMIC, .name = "inv-dmic"},
+        {.id = ALC269_FIXUP_HEADSET_MIC, .name = "headset-mic"},
        {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
        {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
        {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
@@ -4569,6 +4622,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+        SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4),
        SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
        SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
        SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
index 4f255dfee450..f59a321a6d6a 100644
--- a/sound/pci/rme9652/hdsp.c
+++ b/sound/pci/rme9652/hdsp.c
@@ -4845,6 +4845,7 @@ static int snd_hdsp_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, unsigne
                        if ((err = hdsp_get_iobox_version(hdsp)) < 0)
                                return err;
                }
+                memset(&hdsp_version, 0, sizeof(hdsp_version));
                hdsp_version.io_type = hdsp->io_type;
                hdsp_version.firmware_rev = hdsp->firmware_rev;
                if ((err = copy_to_user(argp, &hdsp_version, sizeof(hdsp_version))))
diff --git a/sound/soc/blackfin/bf6xx-i2s.c b/sound/soc/blackfin/bf6xx-i2s.c
index c02405cc007d..5810a0603f2f 100644
--- a/sound/soc/blackfin/bf6xx-i2s.c
+++ b/sound/soc/blackfin/bf6xx-i2s.c
@@ -88,6 +88,7 @@ static int bfin_i2s_hw_params(struct snd_pcm_substream *substream,
        case SNDRV_PCM_FORMAT_S8:
                param.spctl |= 0x70;
                sport->wdsize = 1;
+                break;
        case SNDRV_PCM_FORMAT_S16_LE:
                param.spctl |= 0xf0;
                sport->wdsize = 2;
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index 8af04343cc1a..259d1ac4492f 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -349,6 +349,9 @@ static int snd_soc_put_volsw_2r_st(struct snd_kcontrol *kcontrol,
        val = ucontrol->value.integer.value[0];
        val2 = ucontrol->value.integer.value[1];
+        if (val >= ARRAY_SIZE(st_table) || val2 >= ARRAY_SIZE(st_table))
+                return -EINVAL;
        err = snd_soc_update_bits(codec, reg, 0x3f, st_table[val].m);
        if (err < 0)
                return err;
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index b8ba0adacfce..80555d7551e6 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -1225,13 +1225,18 @@ static int anc_status_control_put(struct snd_kcontrol *kcontrol,
        struct ab8500_codec_drvdata *drvdata = dev_get_drvdata(codec->dev);
        struct device *dev = codec->dev;
        bool apply_fir, apply_iir;
-        int req, status;
+        unsigned int req;
+        int status;
        dev_dbg(dev, "%s: Enter.\n", __func__);
        mutex_lock(&drvdata->anc_lock);
        req = ucontrol->value.integer.value[0];
+        if (req >= ARRAY_SIZE(enum_anc_state)) {
+                status = -EINVAL;
+                goto cleanup;
+        }
        if (req != ANC_APPLY_FIR_IIR && req != ANC_APPLY_FIR &&
                req != ANC_APPLY_IIR) {
                dev_err(dev, "%s: ERROR: Unsupported status to set '%s'!\n",
diff --git a/sound/soc/codecs/max98095.c b/sound/soc/codecs/max98095.c
index 41cdd1642970..8dbcacd44e6a 100644
--- a/sound/soc/codecs/max98095.c
+++ b/sound/soc/codecs/max98095.c
@@ -1863,7 +1863,7 @@ static int max98095_put_eq_enum(struct snd_kcontrol *kcontrol,
        struct max98095_pdata *pdata = max98095->pdata;
        int channel = max98095_get_eq_channel(kcontrol->id.name);
        struct max98095_cdata *cdata;
-        int sel = ucontrol->value.integer.value[0];
+        unsigned int sel = ucontrol->value.integer.value[0];
        struct max98095_eq_cfg *coef_set;
        int fs, best, best_val, i;
        int regmask, regsave;
@@ -2016,7 +2016,7 @@ static int max98095_put_bq_enum(struct snd_kcontrol *kcontrol,
        struct max98095_pdata *pdata = max98095->pdata;
        int channel = max98095_get_bq_channel(codec, kcontrol->id.name);
        struct max98095_cdata *cdata;
-        int sel = ucontrol->value.integer.value[0];
+        unsigned int sel = ucontrol->value.integer.value[0];
        struct max98095_biquad_cfg *coef_set;
        int fs, best, best_val, i;
        int regmask, regsave;
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index 46c5b4fdfc52..ca1be1d9dcf0 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -62,7 +62,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
        struct device_node *ssi_np, *codec_np;
        struct platform_device *ssi_pdev;
        struct i2c_client *codec_dev;
-        struct imx_sgtl5000_data *data;
+        struct imx_sgtl5000_data *data = NULL;
        int int_port, ext_port;
        int ret;
@@ -128,7 +128,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
                goto fail;
        }
-        data->codec_clk = devm_clk_get(&codec_dev->dev, NULL);
+        data->codec_clk = clk_get(&codec_dev->dev, NULL);
        if (IS_ERR(data->codec_clk)) {
                ret = PTR_ERR(data->codec_clk);
                goto fail;
@@ -172,6 +172,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
        return 0;
 fail:
+        if (data && !IS_ERR(data->codec_clk))
+                clk_put(data->codec_clk);
        if (ssi_np)
                of_node_put(ssi_np);
        if (codec_np)
@@ -185,6 +187,7 @@ static int imx_sgtl5000_remove(struct platform_device *pdev)
        struct imx_sgtl5000_data *data = platform_get_drvdata(pdev);
        snd_soc_unregister_card(&data->card);
+        clk_put(data->codec_clk);
        return 0;
 }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 4d0561312f3b..1a38be0d0ca8 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1380,7 +1380,6 @@ static int soc_probe_link_dais(struct snd_soc_card *card, int num, int order)
                                return -ENODEV;
                        list_add(&cpu_dai->dapm.list, &card->dapm_list);
-                        snd_soc_dapm_new_dai_widgets(&cpu_dai->dapm, cpu_dai);
                }
                if (cpu_dai->driver->probe) {
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index d0323a693ba2..999550bbad40 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -262,7 +262,9 @@ static int usb_stream_hwdep_mmap(struct snd_hwdep *hw,
        }
        area->vm_ops = &usb_stream_hwdep_vm_ops;
-        area->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+        area->vm_flags |= VM_DONTDUMP;
+        if (!read)
+                area->vm_flags |= VM_DONTEXPAND;
        area->vm_private_data = us122l;
        atomic_inc(&us122l->mmap_count);
 out:
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 63fb5219f0f8..6234a51625b1 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -299,19 +299,6 @@ static void usX2Y_error_urb_status(struct usX2Ydev *usX2Y,
        usX2Y_clients_stop(usX2Y);
 }
-static void usX2Y_error_sequence(struct usX2Ydev *usX2Y,
-                                 struct snd_usX2Y_substream *subs, struct urb *urb)
-{
-        snd_printk(KERN_ERR
-"Sequence Error!(hcd_frame=%i ep=%i%s;wait=%i,frame=%i).\n"
-"Most probably some urb of usb-frame %i is still missing.\n"
-"Cause could be too long delays in usb-hcd interrupt handling.\n",
-                   usb_get_current_frame_number(usX2Y->dev),
-                   subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out",
-                   usX2Y->wait_iso_frame, urb->start_frame, usX2Y->wait_iso_frame);
-        usX2Y_clients_stop(usX2Y);
-}
 static void i_usX2Y_urb_complete(struct urb *urb)
 {
        struct snd_usX2Y_substream *subs = urb->context;
@@ -328,12 +315,9 @@ static void i_usX2Y_urb_complete(struct urb *urb)
                usX2Y_error_urb_status(usX2Y, subs, urb);
                return;
        }
-        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
-                subs->completed_urb = urb;
+        subs->completed_urb = urb;
-        else {
-                usX2Y_error_sequence(usX2Y, subs, urb);
-                return;
-        }
        {
                struct snd_usX2Y_substream *capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE],
                        *playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK];
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index f2a1acdc4d83..814d0e887c62 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -244,13 +244,8 @@ static void i_usX2Y_usbpcm_urb_complete(struct urb *urb)
                usX2Y_error_urb_status(usX2Y, subs, urb);
                return;
        }
-        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
-                subs->completed_urb = urb;
-        else {
-                usX2Y_error_sequence(usX2Y, subs, urb);
-                return;
-        }
+        subs->completed_urb = urb;
        capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE];
        capsubs2 = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE + 2];
        playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK];
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 3a0ff7fb71b6..64c043b7a438 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -770,6 +770,7 @@ check: $(OUTPUT)common-cmds.h
 install-bin: all
        $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(bindir_SQ)'
        $(INSTALL) $(OUTPUT)perf '$(DESTDIR_SQ)$(bindir_SQ)'
+        $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)'
        $(INSTALL) $(OUTPUT)perf-archive -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)'
 ifndef NO_LIBPERL
        $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/perl/Perf-Trace-Util/lib/Perf/Trace'
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index f686d5ff594e..5098f144b92d 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -457,6 +457,7 @@ static int __run_perf_stat(int argc, const char **argv)
                        perror("failed to prepare workload");
                        return -1;
                }
+                child_pid = evsel_list->workload.pid;
        }
        if (group)
diff --git a/tools/perf/config/feature-tests.mak b/tools/perf/config/feature-tests.mak
index d5a8dd44945f..f79305739ecc 100644
--- a/tools/perf/config/feature-tests.mak
+++ b/tools/perf/config/feature-tests.mak
@@ -219,7 +219,7 @@ define SOURCE_LIBAUDIT
 int main(void)
 {
-        printf(\"error message: %s\n\", audit_errno_to_name(0));
+        printf(\"error message: %s\", audit_errno_to_name(0));
        return audit_open();
 }
 endef
diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index e23bde19d590..7defd77105d0 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -426,7 +426,7 @@ static int __die_search_func_cb(Dwarf_Die *fn_die, void *data)
 * @die_mem: a buffer for result DIE
 *
 * Search a non-inlined function DIE which includes @addr. Stores the
- * DIE to @die_mem and returns it if found. Returns NULl if failed.
+ * DIE to @die_mem and returns it if found. Returns NULL if failed.
 */
 Dwarf_Die *die_find_realfunc(Dwarf_Die *cu_die, Dwarf_Addr addr,
                                    Dwarf_Die *die_mem)
@@ -454,15 +454,32 @@ static int __die_find_inline_cb(Dwarf_Die *die_mem, void *data)
 }
 /**
+ * die_find_top_inlinefunc - Search the top inlined function at given address
+ * @sp_die: a subprogram DIE which including @addr
+ * @addr: target address
+ * @die_mem: a buffer for result DIE
+ *
+ * Search an inlined function DIE which includes @addr. Stores the
+ * DIE to @die_mem and returns it if found. Returns NULL if failed.
+ * Even if several inlined functions are expanded recursively, this
+ * doesn't trace it down, and returns the topmost one.
+ */
+Dwarf_Die *die_find_top_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
+                                   Dwarf_Die *die_mem)
+{
+        return die_find_child(sp_die, __die_find_inline_cb, &addr, die_mem);
+}
+/**
 * die_find_inlinefunc - Search an inlined function at given address
- * @cu_die: a CU DIE which including @addr
+ * @sp_die: a subprogram DIE which including @addr
 * @addr: target address
 * @die_mem: a buffer for result DIE
 *
 * Search an inlined function DIE which includes @addr. Stores the
- * DIE to @die_mem and returns it if found. Returns NULl if failed.
+ * DIE to @die_mem and returns it if found. Returns NULL if failed.
 * If several inlined functions are expanded recursively, this trace
- * it and returns deepest one.
+ * it down and returns deepest one.
 */
 Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
                               Dwarf_Die *die_mem)
diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h
index 8658d41697d2..b4fe90c6cb2d 100644
--- a/tools/perf/util/dwarf-aux.h
+++ b/tools/perf/util/dwarf-aux.h
@@ -79,7 +79,11 @@ extern Dwarf_Die *die_find_child(Dwarf_Die *rt_die,
 extern Dwarf_Die *die_find_realfunc(Dwarf_Die *cu_die, Dwarf_Addr addr,
                                    Dwarf_Die *die_mem);
-/* Search an inlined function including given address */
+/* Search the top inlined function including given address */
+extern Dwarf_Die *die_find_top_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
+                                          Dwarf_Die *die_mem);
+/* Search the deepest inlined function including given address */
 extern Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
                                      Dwarf_Die *die_mem);
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index ce69901176d8..c3e5a3b817ab 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2768,6 +2768,18 @@ int perf_session__read_header(struct perf_session *session)
        if (perf_file_header__read(&f_header, header, fd) < 0)
                return -EINVAL;
+        /*
+         * Sanity check that perf.data was written cleanly; data size is
+         * initialized to 0 and updated only if the on_exit function is run.
+         * If data size is still 0 then the file contains only partial
+         * information.  Just warn user and process it as much as it can.
+         */
+        if (f_header.data.size == 0) {
+                pr_warning("WARNING: The %s file's data size field is 0 which is unexpected.\n"
+                           "Was the 'perf record' command properly terminated?\n",
+                           session->filename);
+        }
        nr_attrs = f_header.attrs.size / f_header.attr_size;
        lseek(fd, f_header.attrs.offset, SEEK_SET);
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 371476cb8ddc..c09e0a9fdf4c 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1327,8 +1327,8 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
                                struct perf_probe_point *ppt)
 {
        Dwarf_Die cudie, spdie, indie;
-        Dwarf_Addr _addr, baseaddr;
+        Dwarf_Addr _addr = 0, baseaddr = 0;
-        const char *fname = NULL, *func = NULL, *tmp;
+        const char *fname = NULL, *func = NULL, *basefunc = NULL, *tmp;
        int baseline = 0, lineno = 0, ret = 0;
        /* Adjust address with bias */
@@ -1349,27 +1349,36 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
        /* Find a corresponding function (name, baseline and baseaddr) */
        if (die_find_realfunc(&cudie, (Dwarf_Addr)addr, &spdie)) {
                /* Get function entry information */
-                tmp = dwarf_diename(&spdie);
+                func = basefunc = dwarf_diename(&spdie);
-                if (!tmp ||
+                if (!func ||
                    dwarf_entrypc(&spdie, &baseaddr) != 0 ||
-                    dwarf_decl_line(&spdie, &baseline) != 0)
+                    dwarf_decl_line(&spdie, &baseline) != 0) {
+                        lineno = 0;
                        goto post;
-                func = tmp;
+                }
-                if (addr == (unsigned long)baseaddr)
+                if (addr == (unsigned long)baseaddr) {
                        /* Function entry - Relative line number is 0 */
                        lineno = baseline;
-                else if (die_find_inlinefunc(&spdie, (Dwarf_Addr)addr,
+                        fname = dwarf_decl_file(&spdie);
-                                             &indie)) {
+                        goto post;
+                }
+                /* Track down the inline functions step by step */
+                while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr,
+                                                &indie)) {
+                        /* There is an inline function */
                        if (dwarf_entrypc(&indie, &_addr) == 0 &&
-                            _addr == addr)
+                            _addr == addr) {
                                /*
                                 * addr is at an inline function entry.
                                 * In this case, lineno should be the call-site
-                                 * line number.
+                                 * line number. (overwrite lineinfo)
                                 */
                                lineno = die_get_call_lineno(&indie);
-                        else {
+                                fname = die_get_call_file(&indie);
+                                break;
+                        } else {
                                /*
                                 * addr is in an inline function body.
                                 * Since lineno points one of the lines
@@ -1377,19 +1386,27 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
                                 * be the entry line of the inline function.
                                 */
                                tmp = dwarf_diename(&indie);
-                                if (tmp &&
+                                if (!tmp ||
-                                    dwarf_decl_line(&spdie, &baseline) == 0)
+                                    dwarf_decl_line(&indie, &baseline) != 0)
-                                        func = tmp;
+                                        break;
+                                func = tmp;
+                                spdie = indie;
                        }
                }
+                /* Verify the lineno and baseline are in a same file */
+                tmp = dwarf_decl_file(&spdie);
+                if (!tmp || strcmp(tmp, fname) != 0)
+                        lineno = 0;
        }
 post:
        /* Make a relative line number or an offset */
        if (lineno)
                ppt->line = lineno - baseline;
-        else if (func)
+        else if (basefunc) {
                ppt->offset = addr - (unsigned long)baseaddr;
+                func = basefunc;
+        }
        /* Duplicate strings */
        if (func) {
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 70ffa41518f3..568b750c01f6 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -256,6 +256,8 @@ void perf_tool__fill_defaults(struct perf_tool *tool)
                tool->sample = process_event_sample_stub;
        if (tool->mmap == NULL)
                tool->mmap = process_event_stub;
+        if (tool->mmap2 == NULL)
+                tool->mmap2 = process_event_stub;
        if (tool->comm == NULL)
                tool->comm = process_event_stub;
        if (tool->fork == NULL)
@@ -1310,7 +1312,7 @@ int __perf_session__process_events(struct perf_session *session,
        file_offset = page_offset;
        head = data_offset - page_offset;
-        if (data_offset + data_size < file_size)
+        if (data_size && (data_offset + data_size < file_size))
                file_size = data_offset + data_size;
        progress_next = file_size / 16;
diff --git a/tools/testing/selftests/timers/posix_timers.c b/tools/testing/selftests/timers/posix_timers.c
index 4fa655d68a81..41bd85559d4b 100644
--- a/tools/testing/selftests/timers/posix_timers.c
+++ b/tools/testing/selftests/timers/posix_timers.c
@@ -151,7 +151,7 @@ static int check_timer_create(int which)
        fflush(stdout);
        done = 0;
-        timer_create(which, NULL, &id);
+        err = timer_create(which, NULL, &id);
        if (err < 0) {
                perror("Can't create timer\n");
                return -1;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 979bff485fb0..a9dd682cf5e3 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1064,10 +1064,12 @@ EXPORT_SYMBOL_GPL(gfn_to_hva);
 unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
 {
        struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
-        if (writable)
+        unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);
+        if (!kvm_is_error_hva(hva) && writable)
                *writable = !memslot_is_readonly(slot);
-        return __gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL, false);
+        return hva;
 }
 static int kvm_read_hva(void *data, void __user *hva, int len)
author	Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-10-19 16:02:47 -0400
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2013-10-19 16:02:47 -0400
commit	dfc568e6bc08916f1035af456e4631c47166b5cf (patch)
tree	3c96bdc26687e0f6958e790c8c93c0c6efb6b8d6
parent	fdf91dae6f024c6dfee425fe754df6b1957f6c53 (diff)
parent	31d141e3a666269a3b6fcccddb0351caf7454240 (diff)