Merge tag 'tags/soc_for_v3.10' into mvebu/dt

Pulling in mvebu branches which contain changes to armada*.dts? files for LPAE conversion. mvebu soc changes for v3.10 - use the mvebu-mbus driver - prep for LPAE support Depends: - mvebu/cleanup (tags/cleanup_for_v3.10) - mvebu/drivers (tags/drivers_for_v3.10)
author: Jason Cooper <jason@lakedaemon.net> 2013-04-15 10:55:23 -0400
committer: Jason Cooper <jason@lakedaemon.net> 2013-04-15 10:55:23 -0400
commit: b757f17e9184b65428c48a281d82f9acb3e96f0e (patch)
tree: 7dc22c9f82f78c20caeff00fdd68a2e92e40504a
parent: 3c76a8a95daeecd881718f88324041f6a5faab86 (diff)
parent: da497f6fbaa190d34907ecc9dd85cfc62ba9f5a2 (diff)
668 files changed, 6910 insertions, 4090 deletions
diff --git a/CREDITS b/CREDITS
index 78163cb3eb6a..afaa7cec6ea5 100644
--- a/CREDITS
+++ b/CREDITS
@@ -1510,6 +1510,14 @@ D: Natsemi ethernet
 D: Cobalt Networks (x86) support
 D: This-and-That
+N: Mark M. Hoffman
+E: mhoffman@lightlink.com
+D: asb100, lm93 and smsc47b397 hardware monitoring drivers
+D: hwmon subsystem core
+D: hwmon subsystem maintainer
+D: i2c-sis96x and i2c-stub SMBus drivers
+S: USA
 N: Dirk Hohndel
 E: hohndel@suse.de
 D: The XFree86[tm] Project
diff --git a/Documentation/devicetree/bindings/mfd/ab8500.txt b/Documentation/devicetree/bindings/mfd/ab8500.txt
index 13b707b7355c..c3a14e0ad0ad 100644
--- a/Documentation/devicetree/bindings/mfd/ab8500.txt
+++ b/Documentation/devicetree/bindings/mfd/ab8500.txt
@@ -13,9 +13,6 @@ Required parent device properties:
                                  4 = active high level-sensitive
                                  8 = active low level-sensitive
-Optional parent device properties:
- reg                    : contains the PRCMU mailbox address for the AB8500 i2c port
 The AB8500 consists of a large and varied group of sub-devices:
 Device                     IRQ Names              Supply Names   Description
@@ -86,9 +83,8 @@ Non-standard child device properties:
   - stericsson,amic2-bias-vamic1           : Analoge Mic wishes to use a non-standard Vamic
   - stericsson,earpeice-cmv                : Earpeice voltage (only: 950 | 1100 | 1270 | 1580)
-ab8500@5 {
+ab8500 {
         compatible = "stericsson,ab8500";
-         reg = <5>; /* mailbox 5 is i2c */
         interrupts = <0 40 0x4>;
         interrupt-controller;
         #interrupt-cells = <2>;
diff --git a/Documentation/devicetree/bindings/tty/serial/of-serial.txt b/Documentation/devicetree/bindings/tty/serial/of-serial.txt
index 1e1145ca4f3c..8f01cb190f25 100644
--- a/Documentation/devicetree/bindings/tty/serial/of-serial.txt
+++ b/Documentation/devicetree/bindings/tty/serial/of-serial.txt
@@ -11,6 +11,9 @@ Required properties:
        - "nvidia,tegra20-uart"
        - "nxp,lpc3220-uart"
        - "ibm,qpace-nwp-serial"
+        - "altr,16550-FIFO32"
+        - "altr,16550-FIFO64"
+        - "altr,16550-FIFO128"
        - "serial" if the port type is unknown.
 - reg : offset and length of the register set for the device.
 - interrupts : should contain uart interrupt.
diff --git a/Documentation/hwmon/lm75 b/Documentation/hwmon/lm75
index c91a1d15fa28..69af1c7db6b7 100644
--- a/Documentation/hwmon/lm75
+++ b/Documentation/hwmon/lm75
@@ -23,7 +23,7 @@ Supported chips:
    Datasheet: Publicly available at the Maxim website
               http://www.maxim-ic.com/
  * Microchip (TelCom) TCN75
-    Prefix: 'lm75'
+    Prefix: 'tcn75'
    Addresses scanned: none
    Datasheet: Publicly available at the Microchip website
               http://www.microchip.com/
diff --git a/Documentation/i2c/busses/i2c-diolan-u2c b/Documentation/i2c/busses/i2c-diolan-u2c
index 30fe4bb9a069..0d6018c316c7 100644
--- a/Documentation/i2c/busses/i2c-diolan-u2c
+++ b/Documentation/i2c/busses/i2c-diolan-u2c
@@ -5,7 +5,7 @@ Supported adapters:
    Documentation:
        http://www.diolan.com/i2c/u2c12.html
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
 -----------
diff --git a/Documentation/input/alps.txt b/Documentation/input/alps.txt
index 3262b6e4d686..e544c7ff8cfa 100644
--- a/Documentation/input/alps.txt
+++ b/Documentation/input/alps.txt
@@ -3,10 +3,26 @@ ALPS Touchpad Protocol
 Introduction
 ------------
+Currently the ALPS touchpad driver supports five protocol versions in use by
-Currently the ALPS touchpad driver supports four protocol versions in use by
+ALPS touchpads, called versions 1, 2, 3, 4 and 5.
-ALPS touchpads, called versions 1, 2, 3, and 4. Information about the various
-protocol versions is contained in the following sections.
+Since roughly mid-2010 several new ALPS touchpads have been released and
+integrated into a variety of laptops and netbooks.  These new touchpads
+have enough behavior differences that the alps_model_data definition
+table, describing the properties of the different versions, is no longer
+adequate.  The design choices were to re-define the alps_model_data
+table, with the risk of regression testing existing devices, or isolate
+the new devices outside of the alps_model_data table.  The latter design
+choice was made.  The new touchpad signatures are named: "Rushmore",
+"Pinnacle", and "Dolphin", which you will see in the alps.c code.
+For the purposes of this document, this group of ALPS touchpads will
+generically be called "new ALPS touchpads".
+We experimented with probing the ACPI interface _HID (Hardware ID)/_CID
+(Compatibility ID) definition as a way to uniquely identify the
+different ALPS variants but there did not appear to be a 1:1 mapping.
+In fact, it appeared to be an m:n mapping between the _HID and actual
+hardware type.
 Detection
 ---------
@@ -20,9 +36,13 @@ If the E6 report is successful, the touchpad model is identified using the "E7
 report" sequence: E8-E7-E7-E7-E9. The response is the model signature and is
 matched against known models in the alps_model_data_array.
-With protocol versions 3 and 4, the E7 report model signature is always
+For older touchpads supporting protocol versions 3 and 4, the E7 report
-73-02-64. To differentiate between these versions, the response from the
+model signature is always 73-02-64. To differentiate between these
-"Enter Command Mode" sequence must be inspected as described below.
+versions, the response from the "Enter Command Mode" sequence must be
+inspected as described below.
+The new ALPS touchpads have an E7 signature of 73-03-50 or 73-03-0A but
+seem to be better differentiated by the EC Command Mode response.
 Command Mode
 ------------
@@ -47,6 +67,14 @@ address of the register being read, and the third contains the value of the
 register. Registers are written by writing the value one nibble at a time
 using the same encoding used for addresses.
+For the new ALPS touchpads, the EC command is used to enter command
+mode. The response in the new ALPS touchpads is significantly different,
+and more important in determining the behavior.  This code has been
+separated from the original alps_model_data table and put in the
+alps_identify function.  For example, there seem to be two hardware init
+sequences for the "Dolphin" touchpads as determined by the second byte
+of the EC response.
 Packet Format
 -------------
@@ -187,3 +215,28 @@ There are several things worth noting here.
    well.
 So far no v4 devices with tracksticks have been encountered.
+ALPS Absolute Mode - Protocol Version 5
+---------------------------------------
+This is basically Protocol Version 3 but with different logic for packet
+decode.  It uses the same alps_process_touchpad_packet_v3 call with a
+specialized decode_fields function pointer to correctly interpret the
+packets.  This appears to only be used by the Dolphin devices.
+For single-touch, the 6-byte packet format is:
+ byte 0:    1    1    0    0    1    0    0    0
+ byte 1:    0   x6   x5   x4   x3   x2   x1   x0
+ byte 2:    0   y6   y5   y4   y3   y2   y1   y0
+ byte 3:    0    M    R    L    1    m    r    l
+ byte 4:   y10  y9   y8   y7  x10   x9   x8   x7
+ byte 5:    0   z6   z5   z4   z3   z2   z1   z0
+For mt, the format is:
+ byte 0:    1    1    1    n3   1   n2   n1   x24
+ byte 1:    1   y7   y6    y5  y4   y3   y2    y1
+ byte 2:    ?   x2   x1   y12 y11  y10   y9    y8
+ byte 3:    0  x23  x22   x21 x20  x19  x18   x17
+ byte 4:    0   x9   x8    x7  x6   x5   x4    x3
+ byte 5:    0  x16  x15   x14 x13  x12  x11   x10
diff --git a/Documentation/networking/tuntap.txt b/Documentation/networking/tuntap.txt
index c0aab985bad9..949d5dcdd9a3 100644
--- a/Documentation/networking/tuntap.txt
+++ b/Documentation/networking/tuntap.txt
@@ -105,6 +105,83 @@ Copyright (C) 1999-2000 Maxim Krasnyansky <max_mk@yahoo.com>
     Proto [2 bytes]
     Raw protocol(IP, IPv6, etc) frame.
+  3.3 Multiqueue tuntap interface:
+  From version 3.8, Linux supports multiqueue tuntap which can uses multiple
+  file descriptors (queues) to parallelize packets sending or receiving. The
+  device allocation is the same as before, and if user wants to create multiple
+  queues, TUNSETIFF with the same device name must be called many times with
+  IFF_MULTI_QUEUE flag.
+  char *dev should be the name of the device, queues is the number of queues to
+  be created, fds is used to store and return the file descriptors (queues)
+  created to the caller. Each file descriptor were served as the interface of a
+  queue which could be accessed by userspace.
+  #include <linux/if.h>
+  #include <linux/if_tun.h>
+  int tun_alloc_mq(char *dev, int queues, int *fds)
+  {
+      struct ifreq ifr;
+      int fd, err, i;
+      if (!dev)
+          return -1;
+      memset(&ifr, 0, sizeof(ifr));
+      /* Flags: IFF_TUN   - TUN device (no Ethernet headers)
+       *        IFF_TAP   - TAP device
+       *
+       *        IFF_NO_PI - Do not provide packet information
+       *        IFF_MULTI_QUEUE - Create a queue of multiqueue device
+       */
+      ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_MULTI_QUEUE;
+      strcpy(ifr.ifr_name, dev);
+      for (i = 0; i < queues; i++) {
+          if ((fd = open("/dev/net/tun", O_RDWR)) < 0)
+             goto err;
+          err = ioctl(fd, TUNSETIFF, (void *)&ifr);
+          if (err) {
+             close(fd);
+             goto err;
+          }
+          fds[i] = fd;
+      }
+      return 0;
+  err:
+      for (--i; i >= 0; i--)
+          close(fds[i]);
+      return err;
+  }
+  A new ioctl(TUNSETQUEUE) were introduced to enable or disable a queue. When
+  calling it with IFF_DETACH_QUEUE flag, the queue were disabled. And when
+  calling it with IFF_ATTACH_QUEUE flag, the queue were enabled. The queue were
+  enabled by default after it was created through TUNSETIFF.
+  fd is the file descriptor (queue) that we want to enable or disable, when
+  enable is true we enable it, otherwise we disable it
+  #include <linux/if.h>
+  #include <linux/if_tun.h>
+  int tun_set_queue(int fd, int enable)
+  {
+      struct ifreq ifr;
+      memset(&ifr, 0, sizeof(ifr));
+      if (enable)
+         ifr.ifr_flags = IFF_ATTACH_QUEUE;
+      else
+         ifr.ifr_flags = IFF_DETACH_QUEUE;
+      return ioctl(fd, TUNSETQUEUE, (void *)&ifr);
+  }
 Universal TUN/TAP device driver Frequently Asked Question.
   
 1. What platforms are supported by TUN/TAP driver ?
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index ce6581c8ca26..4499bd948860 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -912,7 +912,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
    models depending on the codec chip.  The list of available models
    is found in HD-Audio-Models.txt
-    The model name "genric" is treated as a special case.  When this
+    The model name "generic" is treated as a special case.  When this
    model is given, the driver uses the generic codec parser without
    "codec-patch".  It's sometimes good for testing and debugging.
diff --git a/Documentation/sound/alsa/seq_oss.html b/Documentation/sound/alsa/seq_oss.html
index d9776cf60c07..9663b45f6fde 100644
--- a/Documentation/sound/alsa/seq_oss.html
+++ b/Documentation/sound/alsa/seq_oss.html
@@ -285,7 +285,7 @@ sample data.
 <H4>
 7.2.4 Close Callback</H4>
 The <TT>close</TT> callback is called when this device is closed by the
-applicaion. If any private data was allocated in open callback, it must
+application. If any private data was allocated in open callback, it must
 be released in the close callback. The deletion of ALSA port should be
 done here, too. This callback must not be NULL.
 <H4>
diff --git a/Documentation/trace/ftrace.txt b/Documentation/trace/ftrace.txt
index 53d6a3c51d87..a372304aef10 100644
--- a/Documentation/trace/ftrace.txt
+++ b/Documentation/trace/ftrace.txt
@@ -1873,7 +1873,7 @@ feature:
        status\input  |     0      |     1      |    else    |
        --------------+------------+------------+------------+
-        not allocated |(do nothing)| alloc+swap |   EINVAL   |
+        not allocated |(do nothing)| alloc+swap |(do nothing)|
        --------------+------------+------------+------------+
        allocated     |    free    |    swap    |   clear    |
        --------------+------------+------------+------------+
diff --git a/MAINTAINERS b/MAINTAINERS
index 95616582c728..4cf5fd334a06 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1338,12 +1338,6 @@ S:	Maintained
 F:      drivers/platform/x86/asus*.c
 F:      drivers/platform/x86/eeepc*.c
-ASUS ASB100 HARDWARE MONITOR DRIVER
-M:      "Mark M. Hoffman" <mhoffman@lightlink.com>
-L:      lm-sensors@lm-sensors.org
-S:      Maintained
-F:      drivers/hwmon/asb100.c
 ASYNCHRONOUS TRANSFERS/TRANSFORMS (IOAT) API
 M:      Dan Williams <djbw@fb.com>
 W:      http://sourceforge.net/projects/xscaleiop
@@ -1467,6 +1461,12 @@ F:	drivers/dma/at_hdmac.c
 F:      drivers/dma/at_hdmac_regs.h
 F:      include/linux/platform_data/dma-atmel.h
+ATMEL I2C DRIVER
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+L:      linux-i2c@vger.kernel.org
+S:      Supported
+F:      drivers/i2c/busses/i2c-at91.c
 ATMEL ISI DRIVER
 M:      Josh Wu <josh.wu@atmel.com>
 L:      linux-media@vger.kernel.org
@@ -2629,7 +2629,7 @@ F:	include/uapi/drm/
 INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
 M:      Daniel Vetter <daniel.vetter@ffwll.ch>
-L:      intel-gfx@lists.freedesktop.org (subscribers-only)
+L:      intel-gfx@lists.freedesktop.org
 L:      dri-devel@lists.freedesktop.org
 T:      git git://people.freedesktop.org/~danvet/drm-intel
 S:      Supported
@@ -3851,7 +3851,7 @@ F:	drivers/i2c/busses/i2c-ismt.c
 F:      Documentation/i2c/busses/i2c-ismt
 I2C/SMBUS STUB DRIVER
-M:      "Mark M. Hoffman" <mhoffman@lightlink.com>
+M:      Jean Delvare <khali@linux-fr.org>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/i2c-stub.c
@@ -4005,6 +4005,22 @@ M:	Stanislaw Gruszka <stf_xl@wp.pl>
 S:      Maintained
 F:      drivers/usb/atm/ueagle-atm.c
+INA209 HARDWARE MONITOR DRIVER
+M:      Guenter Roeck <linux@roeck-us.net>
+L:      lm-sensors@lm-sensors.org
+S:      Maintained
+F:      Documentation/hwmon/ina209
+F:      Documentation/devicetree/bindings/i2c/ina209.txt
+F:      drivers/hwmon/ina209.c
+INA2XX HARDWARE MONITOR DRIVER
+M:      Guenter Roeck <linux@roeck-us.net>
+L:      lm-sensors@lm-sensors.org
+S:      Maintained
+F:      Documentation/hwmon/ina2xx
+F:      drivers/hwmon/ina2xx.c
+F:      include/linux/platform_data/ina2xx.h
 INDUSTRY PACK SUBSYSTEM (IPACK)
 M:      Samuel Iglesias Gonsalvez <siglesias@igalia.com>
 M:      Jens Taprogge <jens.taprogge@taprogge.org>
@@ -5098,6 +5114,15 @@ S:	Maintained
 F:      Documentation/hwmon/max6650
 F:      drivers/hwmon/max6650.c
+MAX6697 HARDWARE MONITOR DRIVER
+M:      Guenter Roeck <linux@roeck-us.net>
+L:      lm-sensors@lm-sensors.org
+S:      Maintained
+F:      Documentation/hwmon/max6697
+F:      Documentation/devicetree/bindings/i2c/max6697.txt
+F:      drivers/hwmon/max6697.c
+F:      include/linux/platform_data/max6697.h
 MAXIRADIO FM RADIO RECEIVER DRIVER
 M:      Hans Verkuil <hverkuil@xs4all.nl>
 L:      linux-media@vger.kernel.org
@@ -5622,6 +5647,14 @@ S:	Maintained
 F:      drivers/video/riva/
 F:      drivers/video/nvidia/
+NVM EXPRESS DRIVER
+M:      Matthew Wilcox <willy@linux.intel.com>
+L:      linux-nvme@lists.infradead.org
+T:      git git://git.infradead.org/users/willy/linux-nvme.git
+S:      Supported
+F:      drivers/block/nvme.c
+F:      include/linux/nvme.h
 OMAP SUPPORT
 M:      Tony Lindgren <tony@atomide.com>
 L:      linux-omap@vger.kernel.org
@@ -6412,6 +6445,8 @@ F:	Documentation/networking/LICENSE.qla3xxx
 F:      drivers/net/ethernet/qlogic/qla3xxx.*
 QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER
+M:      Rajesh Borundia <rajesh.borundia@qlogic.com>
+M:      Shahed Shaikh <shahed.shaikh@qlogic.com>
 M:      Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
 M:      Sony Chacko <sony.chacko@qlogic.com>
 M:      linux-driver@qlogic.com
@@ -7171,13 +7206,6 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/sis/sis900.*
-SIS 96X I2C/SMBUS DRIVER
-M:      "Mark M. Hoffman" <mhoffman@lightlink.com>
-L:      linux-i2c@vger.kernel.org
-S:      Maintained
-F:      Documentation/i2c/busses/i2c-sis96x
-F:      drivers/i2c/busses/i2c-sis96x.c
 SIS FRAMEBUFFER DRIVER
 M:      Thomas Winischhofer <thomas@winischhofer.net>
 W:      http://www.winischhofer.net/linuxsisvga.shtml
@@ -7255,7 +7283,7 @@ F:	Documentation/hwmon/sch5627
 F:      drivers/hwmon/sch5627.c
 SMSC47B397 HARDWARE MONITOR DRIVER
-M:      "Mark M. Hoffman" <mhoffman@lightlink.com>
+M:      Jean Delvare <khali@linux-fr.org>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/smsc47b397
diff --git a/Makefile b/Makefile
index a05ea42c5f18..54d2b2a0fef0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 9
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc4
 NAME = Unicycling Gorilla
 # *DOCUMENTATION*
diff --git a/arch/Kconfig b/arch/Kconfig
index 5a1779c93940..1455579791ec 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -319,13 +319,6 @@ config ARCH_WANT_OLD_COMPAT_IPC
        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
        bool
-config HAVE_VIRT_TO_BUS
-        bool
-        help
-          An architecture should select this if it implements the
-          deprecated interface virt_to_bus().  All new architectures
-          should probably not select this.
 config HAVE_ARCH_SECCOMP_FILTER
        bool
        help
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 5833aa441481..8a33ba01301f 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -9,7 +9,7 @@ config ALPHA
        select HAVE_PERF_EVENTS
        select HAVE_DMA_ATTRS
        select HAVE_GENERIC_HARDIRQS
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select GENERIC_IRQ_PROBE
        select AUTO_IRQ_AFFINITY if SMP
        select GENERIC_IRQ_SHOW
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 0c990b75082f..9462dd931b33 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -49,7 +49,6 @@ config ARM
        select HAVE_REGS_AND_STACK_ACCESS_API
        select HAVE_SYSCALL_TRACEPOINTS
        select HAVE_UID16
-        select HAVE_VIRT_TO_BUS
        select KTIME_SCALAR
        select PERF_USE_VMALLOC
        select RTC_LIB
@@ -563,6 +562,7 @@ config ARCH_DOVE
        select PINCTRL_DOVE
        select PLAT_ORION_LEGACY
        select USB_ARCH_HAS_EHCI
+        select MVEBU_MBUS
        help
          Support for the Marvell Dove SoC 88AP510
@@ -576,6 +576,7 @@ config ARCH_KIRKWOOD
        select PINCTRL
        select PINCTRL_KIRKWOOD
        select PLAT_ORION_LEGACY
+        select MVEBU_MBUS
        help
          Support for the following Marvell Kirkwood series SoCs:
          88F6180, 88F6192 and 88F6281.
@@ -587,6 +588,7 @@ config ARCH_MV78XX0
        select GENERIC_CLOCKEVENTS
        select PCI
        select PLAT_ORION_LEGACY
+        select MVEBU_MBUS
        help
          Support for the following Marvell MV78xx0 series SoCs:
          MV781x0, MV782x0.
@@ -599,6 +601,7 @@ config ARCH_ORION5X
        select GENERIC_CLOCKEVENTS
        select PCI
        select PLAT_ORION_LEGACY
+        select MVEBU_MBUS
        help
          Support for the following Marvell Orion 5x series SoCs:
          Orion-1 (5181), Orion-VoIP (5181L), Orion-NAS (5182),
@@ -743,6 +746,7 @@ config ARCH_RPC
        select NEED_MACH_IO_H
        select NEED_MACH_MEMORY_H
        select NO_IOPORT
+        select VIRT_TO_BUS
        help
          On the Acorn Risc-PC, Linux can support the internal IDE disk and
          CD-ROM interface, serial and parallel port, and the floppy drive.
@@ -878,6 +882,7 @@ config ARCH_SHARK
        select ISA_DMA
        select NEED_MACH_MEMORY_H
        select PCI
+        select VIRT_TO_BUS
        select ZONE_DMA
        help
          Support for the StrongARM based Digital DNARD machine, also known
@@ -1005,12 +1010,12 @@ config ARCH_MULTI_V4_V5
        bool
 config ARCH_MULTI_V6
-        bool "ARMv6 based platforms (ARM11, Scorpion, ...)"
+        bool "ARMv6 based platforms (ARM11)"
        select ARCH_MULTI_V6_V7
        select CPU_V6
 config ARCH_MULTI_V7
-        bool "ARMv7 based platforms (Cortex-A, PJ4, Krait)"
+        bool "ARMv7 based platforms (Cortex-A, PJ4, Scorpion, Krait)"
        default y
        select ARCH_MULTI_V6_V7
        select ARCH_VEXPRESS
@@ -1461,10 +1466,6 @@ config ISA_DMA
        bool
        select ISA_DMA_API
-config ARCH_NO_VIRT_TO_BUS
-        def_bool y
-        depends on !ARCH_RPC && !ARCH_NETWINDER && !ARCH_SHARK
 # Select ISA DMA interface
 config ISA_DMA_API
        bool
@@ -1656,13 +1657,16 @@ config LOCAL_TIMERS
          accounting to be spread across the timer interval, preventing a
          "thundering herd" at every timer tick.
+# The GPIO number here must be sorted by descending number. In case of
+# a multiplatform kernel, we just want the highest value required by the
+# selected platforms.
 config ARCH_NR_GPIO
        int
        default 1024 if ARCH_SHMOBILE || ARCH_TEGRA
-        default 355 if ARCH_U8500
-        default 264 if MACH_H4700
        default 512 if SOC_OMAP5
+        default 355 if ARCH_U8500
        default 288 if ARCH_VT8500 || ARCH_SUNXI
+        default 264 if MACH_H4700
        default 0
        help
          Maximum number of GPIOs in the system.
@@ -1886,8 +1890,9 @@ config XEN_DOM0
 config XEN
        bool "Xen guest support on ARM (EXPERIMENTAL)"
-        depends on ARM && OF
+        depends on ARM && AEABI && OF
        depends on CPU_V7 && !CPU_V6
+        depends on !GENERIC_ATOMIC64
        help
          Say Y if you want to run Linux in a Virtual Machine on Xen on ARM.
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index acddddac7ee4..ecfcdba2d17c 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -492,7 +492,7 @@ config DEBUG_IMX_UART_PORT
                                                DEBUG_IMX31_UART || \
                                                DEBUG_IMX35_UART || \
                                                DEBUG_IMX51_UART || \
-                                                DEBUG_IMX50_IMX53_UART || \
+                                                DEBUG_IMX53_UART || \
                                                DEBUG_IMX6Q_UART
        default 1
        help
diff --git a/arch/arm/boot/Makefile b/arch/arm/boot/Makefile
index 71768b8a1ab9..84aa2caf07ed 100644
--- a/arch/arm/boot/Makefile
+++ b/arch/arm/boot/Makefile
@@ -115,4 +115,4 @@ i:
        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
        $(obj)/Image System.map "$(INSTALL_PATH)"
-subdir-     := bootp compressed
+subdir-     := bootp compressed dts
diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
index 758c4ea90344..9693f796bcfe 100644
--- a/arch/arm/boot/dts/armada-370-xp.dtsi
+++ b/arch/arm/boot/dts/armada-370-xp.dtsi
@@ -73,11 +73,6 @@
                               clocks = <&coreclk 2>;
                };
-                addr-decoding@d0020000 {
-                        compatible = "marvell,armada-addr-decoding-controller";
-                        reg = <0xd0020000 0x258>;
-                };
                sata@d00a0000 {
                        compatible = "marvell,orion-sata";
                        reg = <0xd00a0000 0x2400>;
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index aa98e641931f..a98c0d50fbbe 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -238,8 +238,32 @@
                                nand {
                                        pinctrl_nand: nand-0 {
                                                atmel,pins =
-                                                        <3 4 0x0 0x1    /* PD5 gpio RDY pin pull_up */
+                                                        <3 0 0x1 0x0    /* PD0 periph A Read Enable */
-                                                         3 5 0x0 0x1>;  /* PD4 gpio enable pin pull_up */
+                                                         3 1 0x1 0x0    /* PD1 periph A Write Enable */
+                                                         3 2 0x1 0x0    /* PD2 periph A Address Latch Enable */
+                                                         3 3 0x1 0x0    /* PD3 periph A Command Latch Enable */
+                                                         3 4 0x0 0x1    /* PD4 gpio Chip Enable pin pull_up */
+                                                         3 5 0x0 0x1    /* PD5 gpio RDY/BUSY pin pull_up */
+                                                         3 6 0x1 0x0    /* PD6 periph A Data bit 0 */
+                                                         3 7 0x1 0x0    /* PD7 periph A Data bit 1 */
+                                                         3 8 0x1 0x0    /* PD8 periph A Data bit 2 */
+                                                         3 9 0x1 0x0    /* PD9 periph A Data bit 3 */
+                                                         3 10 0x1 0x0   /* PD10 periph A Data bit 4 */
+                                                         3 11 0x1 0x0   /* PD11 periph A Data bit 5 */
+                                                         3 12 0x1 0x0   /* PD12 periph A Data bit 6 */
+                                                         3 13 0x1 0x0>; /* PD13 periph A Data bit 7 */
+                                        };
+                                        pinctrl_nand_16bits: nand_16bits-0 {
+                                                atmel,pins =
+                                                        <3 14 0x1 0x0   /* PD14 periph A Data bit 8 */
+                                                         3 15 0x1 0x0   /* PD15 periph A Data bit 9 */
+                                                         3 16 0x1 0x0   /* PD16 periph A Data bit 10 */
+                                                         3 17 0x1 0x0   /* PD17 periph A Data bit 11 */
+                                                         3 18 0x1 0x0   /* PD18 periph A Data bit 12 */
+                                                         3 19 0x1 0x0   /* PD19 periph A Data bit 13 */
+                                                         3 20 0x1 0x0   /* PD20 periph A Data bit 14 */
+                                                         3 21 0x1 0x0>; /* PD21 periph A Data bit 15 */
                                        };
                                };
diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
index 4bf2a8774aa7..7e0481e2441a 100644
--- a/arch/arm/boot/dts/bcm2835.dtsi
+++ b/arch/arm/boot/dts/bcm2835.dtsi
@@ -105,7 +105,7 @@
                        compatible = "fixed-clock";
                        reg = <1>;
                        #clock-cells = <0>;
-                        clock-frequency = <150000000>;
+                        clock-frequency = <250000000>;
                };
        };
 };
diff --git a/arch/arm/boot/dts/dbx5x0.dtsi b/arch/arm/boot/dts/dbx5x0.dtsi
index 69140ba99f46..9de93096601a 100644
--- a/arch/arm/boot/dts/dbx5x0.dtsi
+++ b/arch/arm/boot/dts/dbx5x0.dtsi
@@ -319,9 +319,8 @@
                                };
                        };
-                        ab8500@5 {
+                        ab8500 {
                                compatible = "stericsson,ab8500";
-                                reg = <5>; /* mailbox 5 is i2c */
                                interrupt-parent = <&intc>;
                                interrupts = <0 40 0x4>;
                                interrupt-controller;
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index e1347fceb5bc..1a62bcf18aa3 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -275,18 +275,27 @@
                        compatible = "arm,pl330", "arm,primecell";
                        reg = <0x12680000 0x1000>;
                        interrupts = <0 35 0>;
+                        #dma-cells = <1>;
+                        #dma-channels = <8>;
+                        #dma-requests = <32>;
                };
                pdma1: pdma@12690000 {
                        compatible = "arm,pl330", "arm,primecell";
                        reg = <0x12690000 0x1000>;
                        interrupts = <0 36 0>;
+                        #dma-cells = <1>;
+                        #dma-channels = <8>;
+                        #dma-requests = <32>;
                };
                mdma1: mdma@12850000 {
                        compatible = "arm,pl330", "arm,primecell";
                        reg = <0x12850000 0x1000>;
                        interrupts = <0 34 0>;
+                        #dma-cells = <1>;
+                        #dma-channels = <8>;
+                        #dma-requests = <1>;
                };
        };
 };
diff --git a/arch/arm/boot/dts/exynos5440.dtsi b/arch/arm/boot/dts/exynos5440.dtsi
index 5f3562ad6746..9a99755920c0 100644
--- a/arch/arm/boot/dts/exynos5440.dtsi
+++ b/arch/arm/boot/dts/exynos5440.dtsi
@@ -142,12 +142,18 @@
                        compatible = "arm,pl330", "arm,primecell";
                        reg = <0x120000 0x1000>;
                        interrupts = <0 34 0>;
+                        #dma-cells = <1>;
+                        #dma-channels = <8>;
+                        #dma-requests = <32>;
                };
                pdma1: pdma@121B0000 {
                        compatible = "arm,pl330", "arm,primecell";
                        reg = <0x121000 0x1000>;
                        interrupts = <0 35 0>;
+                        #dma-cells = <1>;
+                        #dma-channels = <8>;
+                        #dma-requests = <32>;
                };
        };
diff --git a/arch/arm/boot/dts/href.dtsi b/arch/arm/boot/dts/href.dtsi
index 592fb9dc35bd..379128eb9d98 100644
--- a/arch/arm/boot/dts/href.dtsi
+++ b/arch/arm/boot/dts/href.dtsi
@@ -221,7 +221,7 @@
                                };
                        };
-                        ab8500@5 {
+                        ab8500 {
                                ab8500-regulators {
                                        ab8500_ldo_aux1_reg: ab8500_ldo_aux1 {
                                                regulator-name = "V-DISPLAY";
diff --git a/arch/arm/boot/dts/hrefv60plus.dts b/arch/arm/boot/dts/hrefv60plus.dts
index 55f4191a626e..2b587a74b813 100644
--- a/arch/arm/boot/dts/hrefv60plus.dts
+++ b/arch/arm/boot/dts/hrefv60plus.dts
@@ -158,7 +158,7 @@
                                };
                        };
-                        ab8500@5 {
+                        ab8500 {
                                ab8500-regulators {
                                        ab8500_ldo_aux1_reg: ab8500_ldo_aux1 {
                                                regulator-name = "V-DISPLAY";
diff --git a/arch/arm/boot/dts/imx53-mba53.dts b/arch/arm/boot/dts/imx53-mba53.dts
index e54fffd48369..468c0a1d48d9 100644
--- a/arch/arm/boot/dts/imx53-mba53.dts
+++ b/arch/arm/boot/dts/imx53-mba53.dts
@@ -42,10 +42,9 @@
                        fsl,pins = <689 0x10000         /* DISP1_DRDY   */
                                    482 0x10000         /* DISP1_HSYNC  */
                                    489 0x10000         /* DISP1_VSYNC  */
-                                    684 0x10000         /* DISP1_DAT_0  */
                                    515 0x10000         /* DISP1_DAT_22 */
                                    523 0x10000         /* DISP1_DAT_23 */
-                                    543 0x10000         /* DISP1_DAT_21 */
+                                    545 0x10000         /* DISP1_DAT_21 */
                                    553 0x10000         /* DISP1_DAT_20 */
                                    558 0x10000         /* DISP1_DAT_19 */
                                    564 0x10000         /* DISP1_DAT_18 */
diff --git a/arch/arm/boot/dts/snowball.dts b/arch/arm/boot/dts/snowball.dts
index 27f31a5fa494..d3ec32f6b790 100644
--- a/arch/arm/boot/dts/snowball.dts
+++ b/arch/arm/boot/dts/snowball.dts
@@ -298,7 +298,7 @@
                                };
                        };
-                        ab8500@5 {
+                        ab8500 {
                                ab8500-regulators {
                                        ab8500_ldo_aux1_reg: ab8500_ldo_aux1 {
                                                regulator-name = "V-DISPLAY";
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 936d2306e7e1..7e8769bd5977 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -75,6 +75,9 @@
                                compatible = "arm,pl330", "arm,primecell";
                                reg = <0xffe01000 0x1000>;
                                interrupts = <0 180 4>;
+                                #dma-cells = <1>;
+                                #dma-channels = <8>;
+                                #dma-requests = <32>;
                        };
                };
diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
index 9a428931d042..48d00a099ce3 100644
--- a/arch/arm/boot/dts/tegra20.dtsi
+++ b/arch/arm/boot/dts/tegra20.dtsi
@@ -118,6 +118,7 @@
                compatible = "arm,cortex-a9-twd-timer";
                reg = <0x50040600 0x20>;
                interrupts = <1 13 0x304>;
+                clocks = <&tegra_car 132>;
        };
        intc: interrupt-controller {
diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
index 767803e1fd55..9d87a3ffe998 100644
--- a/arch/arm/boot/dts/tegra30.dtsi
+++ b/arch/arm/boot/dts/tegra30.dtsi
@@ -119,6 +119,7 @@
                compatible = "arm,cortex-a9-twd-timer";
                reg = <0x50040600 0x20>;
                interrupts = <1 13 0xf04>;
+                clocks = <&tegra_car 214>;
        };
        intc: interrupt-controller {
diff --git a/arch/arm/configs/mxs_defconfig b/arch/arm/configs/mxs_defconfig
index fbbc5bb022d5..6a99e30f81d2 100644
--- a/arch/arm/configs/mxs_defconfig
+++ b/arch/arm/configs/mxs_defconfig
@@ -116,6 +116,7 @@ CONFIG_SND_SOC=y
 CONFIG_SND_MXS_SOC=y
 CONFIG_SND_SOC_MXS_SGTL5000=y
 CONFIG_USB=y
+CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_CHIPIDEA=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_STORAGE=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index b16bae2c9a60..bd07864f14a0 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -126,6 +126,8 @@ CONFIG_INPUT_MISC=y
 CONFIG_INPUT_TWL4030_PWRBUTTON=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
diff --git a/arch/arm/include/asm/xen/events.h b/arch/arm/include/asm/xen/events.h
index 5c27696de14f..8b1f37bfeeec 100644
--- a/arch/arm/include/asm/xen/events.h
+++ b/arch/arm/include/asm/xen/events.h
@@ -2,6 +2,7 @@
 #define _ASM_ARM_XEN_EVENTS_H
 #include <asm/ptrace.h>
+#include <asm/atomic.h>
 enum ipi_vector {
        XEN_PLACEHOLDER_VECTOR,
@@ -15,26 +16,8 @@ static inline int xen_irqs_disabled(struct pt_regs *regs)
        return raw_irqs_disabled_flags(regs->ARM_cpsr);
 }
-/*
+#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((ptr),      \
- * We cannot use xchg because it does not support 8-byte
+                                                            atomic64_t, \
- * values. However it is safe to use {ldr,dtd}exd directly because all
+                                                            counter), (val))
- * platforms which Xen can run on support those instructions.
- */
-static inline xen_ulong_t xchg_xen_ulong(xen_ulong_t *ptr, xen_ulong_t val)
-{
-        xen_ulong_t oldval;
-        unsigned int tmp;
-        wmb();
-        asm volatile("@ xchg_xen_ulong\n"
-                "1:     ldrexd  %0, %H0, [%3]\n"
-                "       strexd  %1, %2, %H2, [%3]\n"
-                "       teq     %1, #0\n"
-                "       bne     1b"
-                : "=&r" (oldval), "=&r" (tmp)
-                : "r" (val), "r" (ptr)
-                : "memory", "cc");
-        return oldval;
-}
 #endif /* _ASM_ARM_XEN_EVENTS_H */
diff --git a/arch/arm/include/debug/mvebu.S b/arch/arm/include/debug/mvebu.S
index 865c6d02b332..df191afa3be1 100644
--- a/arch/arm/include/debug/mvebu.S
+++ b/arch/arm/include/debug/mvebu.S
@@ -12,7 +12,7 @@
 */
 #define ARMADA_370_XP_REGS_PHYS_BASE    0xd0000000
-#define ARMADA_370_XP_REGS_VIRT_BASE    0xfeb00000
+#define ARMADA_370_XP_REGS_VIRT_BASE    0xfec00000
        .macro  addruart, rp, rv, tmp
        ldr     \rp, =ARMADA_370_XP_REGS_PHYS_BASE
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 31644f1978d5..79078edbb9bc 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -480,7 +480,7 @@ static void __cpuinit broadcast_timer_setup(struct clock_event_device *evt)
        evt->features   = CLOCK_EVT_FEAT_ONESHOT |
                          CLOCK_EVT_FEAT_PERIODIC |
                          CLOCK_EVT_FEAT_DUMMY;
-        evt->rating     = 400;
+        evt->rating     = 100;
        evt->mult       = 1;
        evt->set_mode   = broadcast_timer_set_mode;
diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
index d912e7397ecc..94b0650ea98f 100644
--- a/arch/arm/lib/memset.S
+++ b/arch/arm/lib/memset.S
@@ -14,31 +14,15 @@
        .text
        .align  5
-        .word   0
-1:      subs    r2, r2, #4              @ 1 do we have enough
-        blt     5f                      @ 1 bytes to align with?
-        cmp     r3, #2                  @ 1
-        strltb  r1, [ip], #1            @ 1
-        strleb  r1, [ip], #1            @ 1
-        strb    r1, [ip], #1            @ 1
-        add     r2, r2, r3              @ 1 (r2 = r2 - (4 - r3))
-/*
- * The pointer is now aligned and the length is adjusted.  Try doing the
- * memset again.
- */
 ENTRY(memset)
-/*
+        ands    r3, r0, #3              @ 1 unaligned?
- * Preserve the contents of r0 for the return value.
+        mov     ip, r0                  @ preserve r0 as return value
- */
+        bne     6f                      @ 1
-        mov     ip, r0
-        ands    r3, ip, #3              @ 1 unaligned?
-        bne     1b                      @ 1
 /*
 * we know that the pointer in ip is aligned to a word boundary.
 */
-        orr     r1, r1, r1, lsl #8
+1:      orr     r1, r1, r1, lsl #8
        orr     r1, r1, r1, lsl #16
        mov     r3, r1
        cmp     r2, #16
@@ -127,4 +111,13 @@ ENTRY(memset)
        tst     r2, #1
        strneb  r1, [ip], #1
        mov     pc, lr
+6:      subs    r2, r2, #4              @ 1 do we have enough
+        blt     5b                      @ 1 bytes to align with?
+        cmp     r3, #2                  @ 1
+        strltb  r1, [ip], #1            @ 1
+        strleb  r1, [ip], #1            @ 1
+        strb    r1, [ip], #1            @ 1
+        add     r2, r2, r3              @ 1 (r2 = r2 - (4 - r3))
+        b       1b
 ENDPROC(memset)
diff --git a/arch/arm/mach-at91/board-foxg20.c b/arch/arm/mach-at91/board-foxg20.c
index 2ea7059b840b..c20a870ea9c9 100644
--- a/arch/arm/mach-at91/board-foxg20.c
+++ b/arch/arm/mach-at91/board-foxg20.c
@@ -176,6 +176,7 @@ static struct w1_gpio_platform_data w1_gpio_pdata = {
        /* If you choose to use a pin other than PB16 it needs to be 3.3V */
        .pin            = AT91_PIN_PB16,
        .is_open_drain  = 1,
+        .ext_pullup_enable_pin  = -EINVAL,
 };
 static struct platform_device w1_device = {
diff --git a/arch/arm/mach-at91/board-stamp9g20.c b/arch/arm/mach-at91/board-stamp9g20.c
index a033b8df9fb2..869cbecf00b7 100644
--- a/arch/arm/mach-at91/board-stamp9g20.c
+++ b/arch/arm/mach-at91/board-stamp9g20.c
@@ -188,6 +188,7 @@ static struct spi_board_info portuxg20_spi_devices[] = {
 static struct w1_gpio_platform_data w1_gpio_pdata = {
        .pin            = AT91_PIN_PA29,
        .is_open_drain  = 1,
+        .ext_pullup_enable_pin  = -EINVAL,
 };
 static struct platform_device w1_device = {
diff --git a/arch/arm/mach-at91/include/mach/gpio.h b/arch/arm/mach-at91/include/mach/gpio.h
index eed465ab0dd7..5fc23771c154 100644
--- a/arch/arm/mach-at91/include/mach/gpio.h
+++ b/arch/arm/mach-at91/include/mach/gpio.h
@@ -209,6 +209,14 @@ extern int at91_get_gpio_value(unsigned pin);
 extern void at91_gpio_suspend(void);
 extern void at91_gpio_resume(void);
+#ifdef CONFIG_PINCTRL_AT91
+extern void at91_pinctrl_gpio_suspend(void);
+extern void at91_pinctrl_gpio_resume(void);
+#else
+static inline void at91_pinctrl_gpio_suspend(void) {}
+static inline void at91_pinctrl_gpio_resume(void) {}
+#endif
 #endif  /* __ASSEMBLY__ */
 #endif
diff --git a/arch/arm/mach-at91/irq.c b/arch/arm/mach-at91/irq.c
index 8e210262aeee..e0ca59171022 100644
--- a/arch/arm/mach-at91/irq.c
+++ b/arch/arm/mach-at91/irq.c
@@ -92,23 +92,21 @@ static int at91_aic_set_wake(struct irq_data *d, unsigned value)
 void at91_irq_suspend(void)
 {
-        int i = 0, bit;
+        int bit = -1;
        if (has_aic5()) {
                /* disable enabled irqs */
-                while ((bit = find_next_bit(backups, n_irqs, i)) < n_irqs) {
+                while ((bit = find_next_bit(backups, n_irqs, bit + 1)) < n_irqs) {
                        at91_aic_write(AT91_AIC5_SSR,
                                       bit & AT91_AIC5_INTSEL_MSK);
                        at91_aic_write(AT91_AIC5_IDCR, 1);
-                        i = bit;
                }
                /* enable wakeup irqs */
-                i = 0;
+                bit = -1;
-                while ((bit = find_next_bit(wakeups, n_irqs, i)) < n_irqs) {
+                while ((bit = find_next_bit(wakeups, n_irqs, bit + 1)) < n_irqs) {
                        at91_aic_write(AT91_AIC5_SSR,
                                       bit & AT91_AIC5_INTSEL_MSK);
                        at91_aic_write(AT91_AIC5_IECR, 1);
-                        i = bit;
                }
        } else {
                at91_aic_write(AT91_AIC_IDCR, *backups);
@@ -118,23 +116,21 @@ void at91_irq_suspend(void)
 void at91_irq_resume(void)
 {
-        int i = 0, bit;
+        int bit = -1;
        if (has_aic5()) {
                /* disable wakeup irqs */
-                while ((bit = find_next_bit(wakeups, n_irqs, i)) < n_irqs) {
+                while ((bit = find_next_bit(wakeups, n_irqs, bit + 1)) < n_irqs) {
                        at91_aic_write(AT91_AIC5_SSR,
                                       bit & AT91_AIC5_INTSEL_MSK);
                        at91_aic_write(AT91_AIC5_IDCR, 1);
-                        i = bit;
                }
                /* enable irqs disabled for suspend */
-                i = 0;
+                bit = -1;
-                while ((bit = find_next_bit(backups, n_irqs, i)) < n_irqs) {
+                while ((bit = find_next_bit(backups, n_irqs, bit + 1)) < n_irqs) {
                        at91_aic_write(AT91_AIC5_SSR,
                                       bit & AT91_AIC5_INTSEL_MSK);
                        at91_aic_write(AT91_AIC5_IECR, 1);
-                        i = bit;
                }
        } else {
                at91_aic_write(AT91_AIC_IDCR, *wakeups);
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index adb6db888a1f..73f1f250403a 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -201,7 +201,10 @@ extern u32 at91_slow_clock_sz;
 static int at91_pm_enter(suspend_state_t state)
 {
-        at91_gpio_suspend();
+        if (of_have_populated_dt())
+                at91_pinctrl_gpio_suspend();
+        else
+                at91_gpio_suspend();
        at91_irq_suspend();
        pr_debug("AT91: PM - wake mask %08x, pm state %d\n",
@@ -286,7 +289,10 @@ static int at91_pm_enter(suspend_state_t state)
 error:
        target_state = PM_SUSPEND_ON;
        at91_irq_resume();
-        at91_gpio_resume();
+        if (of_have_populated_dt())
+                at91_pinctrl_gpio_resume();
+        else
+                at91_gpio_resume();
        return 0;
 }
diff --git a/arch/arm/mach-davinci/dma.c b/arch/arm/mach-davinci/dma.c
index a685e9706b7b..45b7c71d9cc1 100644
--- a/arch/arm/mach-davinci/dma.c
+++ b/arch/arm/mach-davinci/dma.c
@@ -743,6 +743,9 @@ EXPORT_SYMBOL(edma_free_channel);
 */
 int edma_alloc_slot(unsigned ctlr, int slot)
 {
+        if (!edma_cc[ctlr])
+                return -EINVAL;
        if (slot >= 0)
                slot = EDMA_CHAN_SLOT(slot);
diff --git a/arch/arm/mach-dove/Makefile b/arch/arm/mach-dove/Makefile
index 3f0a858fb597..4d9d2ffc4535 100644
--- a/arch/arm/mach-dove/Makefile
+++ b/arch/arm/mach-dove/Makefile
@@ -1,4 +1,4 @@
-obj-y                           += common.o addr-map.o irq.o
+obj-y                           += common.o irq.o
 obj-$(CONFIG_DOVE_LEGACY)       += mpp.o
 obj-$(CONFIG_PCI)               += pcie.o
 obj-$(CONFIG_MACH_DOVE_DB)      += dove-db-setup.o
diff --git a/arch/arm/mach-dove/addr-map.c b/arch/arm/mach-dove/addr-map.c
deleted file mode 100644
index 2a06c0163418..000000000000
--- a/arch/arm/mach-dove/addr-map.c
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * arch/arm/mach-dove/addr-map.c
- *
- * Address map functions for Marvell Dove 88AP510 SoC
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mbus.h>
-#include <linux/io.h>
-#include <asm/mach/arch.h>
-#include <asm/setup.h>
-#include <mach/dove.h>
-#include <plat/addr-map.h>
-#include "common.h"
-/*
- * Generic Address Decode Windows bit settings
- */
-#define TARGET_DDR              0x0
-#define TARGET_BOOTROM          0x1
-#define TARGET_CESA             0x3
-#define TARGET_PCIE0            0x4
-#define TARGET_PCIE1            0x8
-#define TARGET_SCRATCHPAD       0xd
-#define ATTR_CESA               0x01
-#define ATTR_BOOTROM            0xfd
-#define ATTR_DEV_SPI0_ROM       0xfe
-#define ATTR_DEV_SPI1_ROM       0xfb
-#define ATTR_PCIE_IO            0xe0
-#define ATTR_PCIE_MEM           0xe8
-#define ATTR_SCRATCHPAD         0x0
-static inline void __iomem *ddr_map_sc(int i)
-{
-        return (void __iomem *)(DOVE_MC_VIRT_BASE + 0x100 + ((i) << 4));
-}
-/*
- * Description of the windows needed by the platform code
- */
-static struct __initdata orion_addr_map_cfg addr_map_cfg = {
-        .num_wins = 8,
-        .remappable_wins = 4,
-        .bridge_virt_base = BRIDGE_VIRT_BASE,
-};
-static const struct __initdata orion_addr_map_info addr_map_info[] = {
-        /*
-         * Windows for PCIe IO+MEM space.
-         */
-        { 0, DOVE_PCIE0_IO_PHYS_BASE, DOVE_PCIE0_IO_SIZE,
-          TARGET_PCIE0, ATTR_PCIE_IO, DOVE_PCIE0_IO_BUS_BASE
-        },
-        { 1, DOVE_PCIE1_IO_PHYS_BASE, DOVE_PCIE1_IO_SIZE,
-          TARGET_PCIE1, ATTR_PCIE_IO, DOVE_PCIE1_IO_BUS_BASE
-        },
-        { 2, DOVE_PCIE0_MEM_PHYS_BASE, DOVE_PCIE0_MEM_SIZE,
-          TARGET_PCIE0, ATTR_PCIE_MEM, -1
-        },
-        { 3, DOVE_PCIE1_MEM_PHYS_BASE, DOVE_PCIE1_MEM_SIZE,
-          TARGET_PCIE1, ATTR_PCIE_MEM, -1
-        },
-        /*
-         * Window for CESA engine.
-         */
-        { 4, DOVE_CESA_PHYS_BASE, DOVE_CESA_SIZE,
-          TARGET_CESA, ATTR_CESA, -1
-        },
-        /*
-         * Window to the BootROM for Standby and Sleep Resume
-         */
-        { 5, DOVE_BOOTROM_PHYS_BASE, DOVE_BOOTROM_SIZE,
-          TARGET_BOOTROM, ATTR_BOOTROM, -1
-        },
-        /*
-         * Window to the PMU Scratch Pad space
-         */
-        { 6, DOVE_SCRATCHPAD_PHYS_BASE, DOVE_SCRATCHPAD_SIZE,
-          TARGET_SCRATCHPAD, ATTR_SCRATCHPAD, -1
-        },
-        /* End marker */
-        { -1, 0, 0, 0, 0, 0 }
-};
-void __init dove_setup_cpu_mbus(void)
-{
-        int i;
-        int cs;
-        /*
-         * Disable, clear and configure windows.
-         */
-        orion_config_wins(&addr_map_cfg, addr_map_info);
-        /*
-         * Setup MBUS dram target info.
-         */
-        orion_mbus_dram_info.mbus_dram_target_id = TARGET_DDR;
-        for (i = 0, cs = 0; i < 2; i++) {
-                u32 map = readl(ddr_map_sc(i));
-                /*
-                 * Chip select enabled?
-                 */
-                if (map & 1) {
-                        struct mbus_dram_window *w;
-                        w = &orion_mbus_dram_info.cs[cs++];
-                        w->cs_index = i;
-                        w->mbus_attr = 0; /* CS address decoding done inside */
-                                          /* the DDR controller, no need to  */
-                                          /* provide attributes */
-                        w->base = map & 0xff800000;
-                        w->size = 0x100000 << (((map & 0x000f0000) >> 16) - 4);
-                }
-        }
-        orion_mbus_dram_info.num_cs = cs;
-}
diff --git a/arch/arm/mach-dove/board-dt.c b/arch/arm/mach-dove/board-dt.c
index fbde1dd67113..0b142803b2e1 100644
--- a/arch/arm/mach-dove/board-dt.c
+++ b/arch/arm/mach-dove/board-dt.c
@@ -64,7 +64,7 @@ static void __init dove_dt_init(void)
 #ifdef CONFIG_CACHE_TAUROS2
        tauros2_init(0);
 #endif
-        dove_setup_cpu_mbus();
+        dove_setup_cpu_wins();
        /* Setup root of clk tree */
        dove_of_clk_init();
diff --git a/arch/arm/mach-dove/common.c b/arch/arm/mach-dove/common.c
index c6b3b2bb50e7..e2b5da031f96 100644
--- a/arch/arm/mach-dove/common.c
+++ b/arch/arm/mach-dove/common.c
@@ -224,6 +224,9 @@ void __init dove_i2c_init(void)
 void __init dove_init_early(void)
 {
        orion_time_set_base(TIMER_VIRT_BASE);
+        mvebu_mbus_init("marvell,dove-mbus",
+                        BRIDGE_WINS_BASE, BRIDGE_WINS_SZ,
+                        DOVE_MC_WINS_BASE, DOVE_MC_WINS_SZ);
 }
 static int __init dove_find_tclk(void)
@@ -326,6 +329,40 @@ void __init dove_sdio1_init(void)
        platform_device_register(&dove_sdio1);
 }
+void __init dove_setup_cpu_wins(void)
+{
+        /*
+         * The PCIe windows will no longer be statically allocated
+         * here once Dove is migrated to the pci-mvebu driver.
+         */
+        mvebu_mbus_add_window_remap_flags("pcie0.0",
+                                          DOVE_PCIE0_IO_PHYS_BASE,
+                                          DOVE_PCIE0_IO_SIZE,
+                                          DOVE_PCIE0_IO_BUS_BASE,
+                                          MVEBU_MBUS_PCI_IO);
+        mvebu_mbus_add_window_remap_flags("pcie1.0",
+                                          DOVE_PCIE1_IO_PHYS_BASE,
+                                          DOVE_PCIE1_IO_SIZE,
+                                          DOVE_PCIE1_IO_BUS_BASE,
+                                          MVEBU_MBUS_PCI_IO);
+        mvebu_mbus_add_window_remap_flags("pcie0.0",
+                                          DOVE_PCIE0_MEM_PHYS_BASE,
+                                          DOVE_PCIE0_MEM_SIZE,
+                                          MVEBU_MBUS_NO_REMAP,
+                                          MVEBU_MBUS_PCI_MEM);
+        mvebu_mbus_add_window_remap_flags("pcie1.0",
+                                          DOVE_PCIE1_MEM_PHYS_BASE,
+                                          DOVE_PCIE1_MEM_SIZE,
+                                          MVEBU_MBUS_NO_REMAP,
+                                          MVEBU_MBUS_PCI_MEM);
+        mvebu_mbus_add_window("cesa", DOVE_CESA_PHYS_BASE,
+                              DOVE_CESA_SIZE);
+        mvebu_mbus_add_window("bootrom", DOVE_BOOTROM_PHYS_BASE,
+                              DOVE_BOOTROM_SIZE);
+        mvebu_mbus_add_window("scratchpad", DOVE_SCRATCHPAD_PHYS_BASE,
+                              DOVE_SCRATCHPAD_SIZE);
+}
 void __init dove_init(void)
 {
        pr_info("Dove 88AP510 SoC, TCLK = %d MHz.\n",
@@ -334,7 +371,7 @@ void __init dove_init(void)
 #ifdef CONFIG_CACHE_TAUROS2
        tauros2_init(0);
 #endif
-        dove_setup_cpu_mbus();
+        dove_setup_cpu_wins();
        /* Setup root of clk tree */
        dove_clk_init();
diff --git a/arch/arm/mach-dove/common.h b/arch/arm/mach-dove/common.h
index ee59fba4c6d1..e86347928b67 100644
--- a/arch/arm/mach-dove/common.h
+++ b/arch/arm/mach-dove/common.h
@@ -23,7 +23,7 @@ void dove_map_io(void);
 void dove_init(void);
 void dove_init_early(void);
 void dove_init_irq(void);
-void dove_setup_cpu_mbus(void);
+void dove_setup_cpu_wins(void);
 void dove_ge00_init(struct mv643xx_eth_platform_data *eth_data);
 void dove_sata_init(struct mv_sata_platform_data *sata_data);
 #ifdef CONFIG_PCI
diff --git a/arch/arm/mach-dove/include/mach/dove.h b/arch/arm/mach-dove/include/mach/dove.h
index 661725e3115a..0c4b35f4ee5b 100644
--- a/arch/arm/mach-dove/include/mach/dove.h
+++ b/arch/arm/mach-dove/include/mach/dove.h
@@ -77,6 +77,8 @@
 /* North-South Bridge */
 #define BRIDGE_VIRT_BASE        (DOVE_SB_REGS_VIRT_BASE + 0x20000)
 #define BRIDGE_PHYS_BASE        (DOVE_SB_REGS_PHYS_BASE + 0x20000)
+#define  BRIDGE_WINS_BASE       (BRIDGE_PHYS_BASE)
+#define  BRIDGE_WINS_SZ         (0x80)
 /* Cryptographic Engine */
 #define DOVE_CRYPT_PHYS_BASE    (DOVE_SB_REGS_PHYS_BASE + 0x30000)
@@ -168,6 +170,9 @@
 #define  DOVE_SSP_CLOCK_ENABLE          (1 << 1)
 #define  DOVE_SSP_BPB_CLOCK_SRC_SSP     (1 << 11)
 /* Memory Controller */
+#define DOVE_MC_PHYS_BASE       (DOVE_NB_REGS_PHYS_BASE + 0x00000)
+#define  DOVE_MC_WINS_BASE      (DOVE_MC_PHYS_BASE + 0x100)
+#define  DOVE_MC_WINS_SZ        (0x8)
 #define DOVE_MC_VIRT_BASE       (DOVE_NB_REGS_VIRT_BASE + 0x00000)
 /* LCD Controller */
diff --git a/arch/arm/mach-footbridge/Kconfig b/arch/arm/mach-footbridge/Kconfig
index abda5a18a664..0f2111a11315 100644
--- a/arch/arm/mach-footbridge/Kconfig
+++ b/arch/arm/mach-footbridge/Kconfig
@@ -67,6 +67,7 @@ config ARCH_NETWINDER
        select ISA
        select ISA_DMA
        select PCI
+        select VIRT_TO_BUS
        help
          Say Y here if you intend to run this kernel on the Rebel.COM
          NetWinder.  Information about this machine can be found at:
diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
index 74e3a34d78b8..e13a8fa5e62c 100644
--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -264,6 +264,7 @@ int __init mx35_clocks_init(void)
        clk_prepare_enable(clk[gpio3_gate]);
        clk_prepare_enable(clk[iim_gate]);
        clk_prepare_enable(clk[emi_gate]);
+        clk_prepare_enable(clk[max_gate]);
        /*
         * SCC is needed to boot via mmc after a watchdog reset. The clock code
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 7b025ee528a5..2f9ff93a4e61 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -172,7 +172,7 @@ static struct clk *clk[clk_max];
 static struct clk_onecell_data clk_data;
 static enum mx6q_clks const clks_init_on[] __initconst = {
-        mmdc_ch0_axi, rom,
+        mmdc_ch0_axi, rom, pll1_sys,
 };
 static struct clk_div_table clk_enet_ref_table[] = {
diff --git a/arch/arm/mach-imx/headsmp.S b/arch/arm/mach-imx/headsmp.S
index 921fc1555854..a58c8b0527cc 100644
--- a/arch/arm/mach-imx/headsmp.S
+++ b/arch/arm/mach-imx/headsmp.S
@@ -26,16 +26,16 @@ ENDPROC(v7_secondary_startup)
 #ifdef CONFIG_PM
 /*
- * The following code is located into the .data section.  This is to
+ * The following code must assume it is running from physical address
- * allow phys_l2x0_saved_regs to be accessed with a relative load
+ * where absolute virtual addresses to the data section have to be
- * as we are running on physical address here.
+ * turned into relative ones.
 */
-        .data
-        .align
 #ifdef CONFIG_CACHE_L2X0
        .macro  pl310_resume
-        ldr     r2, phys_l2x0_saved_regs
+        adr     r0, l2x0_saved_regs_offset
+        ldr     r2, [r0]
+        add     r2, r2, r0
        ldr     r0, [r2, #L2X0_R_PHY_BASE]      @ get physical base of l2x0
        ldr     r1, [r2, #L2X0_R_AUX_CTRL]      @ get aux_ctrl value
        str     r1, [r0, #L2X0_AUX_CTRL]        @ restore aux_ctrl
@@ -43,9 +43,9 @@ ENDPROC(v7_secondary_startup)
        str     r1, [r0, #L2X0_CTRL]            @ re-enable L2
        .endm
-        .globl  phys_l2x0_saved_regs
+l2x0_saved_regs_offset:
-phys_l2x0_saved_regs:
+        .word   l2x0_saved_regs - .
-        .long   0
 #else
        .macro  pl310_resume
        .endm
diff --git a/arch/arm/mach-imx/imx25-dt.c b/arch/arm/mach-imx/imx25-dt.c
index 03b65e5ea541..82348391582a 100644
--- a/arch/arm/mach-imx/imx25-dt.c
+++ b/arch/arm/mach-imx/imx25-dt.c
@@ -27,6 +27,11 @@ static const char * const imx25_dt_board_compat[] __initconst = {
        NULL
 };
+static void __init imx25_timer_init(void)
+{
+        mx25_clocks_init_dt();
+}
 DT_MACHINE_START(IMX25_DT, "Freescale i.MX25 (Device Tree Support)")
        .map_io         = mx25_map_io,
        .init_early     = imx25_init_early,
diff --git a/arch/arm/mach-imx/pm-imx6q.c b/arch/arm/mach-imx/pm-imx6q.c
index ee42d20cba19..5faba7a3c95f 100644
--- a/arch/arm/mach-imx/pm-imx6q.c
+++ b/arch/arm/mach-imx/pm-imx6q.c
@@ -22,8 +22,6 @@
 #include "common.h"
 #include "hardware.h"
-extern unsigned long phys_l2x0_saved_regs;
 static int imx6q_suspend_finish(unsigned long val)
 {
        cpu_do_idle();
@@ -57,18 +55,5 @@ static const struct platform_suspend_ops imx6q_pm_ops = {
 void __init imx6q_pm_init(void)
 {
-        /*
-         * The l2x0 core code provides an infrastucture to save and restore
-         * l2x0 registers across suspend/resume cycle.  But because imx6q
-         * retains L2 content during suspend and needs to resume L2 before
-         * MMU is enabled, it can only utilize register saving support and
-         * have to take care of restoring on its own.  So we save physical
-         * address of the data structure used by l2x0 core to save registers,
-         * and later restore the necessary ones in imx6q resume entry.
-         */
-#ifdef CONFIG_CACHE_L2X0
-        phys_l2x0_saved_regs = __pa(&l2x0_saved_regs);
-#endif
        suspend_set_ops(&imx6q_pm_ops);
 }
diff --git a/arch/arm/mach-ixp4xx/vulcan-setup.c b/arch/arm/mach-ixp4xx/vulcan-setup.c
index d42730a1d4ab..d599e354ca57 100644
--- a/arch/arm/mach-ixp4xx/vulcan-setup.c
+++ b/arch/arm/mach-ixp4xx/vulcan-setup.c
@@ -163,6 +163,7 @@ static struct platform_device vulcan_max6369 = {
 static struct w1_gpio_platform_data vulcan_w1_gpio_pdata = {
        .pin                    = 14,
+        .ext_pullup_enable_pin  = -EINVAL,
 };
 static struct platform_device vulcan_w1_gpio = {
diff --git a/arch/arm/mach-kirkwood/Makefile b/arch/arm/mach-kirkwood/Makefile
index 4cc4bee4d0cf..d805f8078fa3 100644
--- a/arch/arm/mach-kirkwood/Makefile
+++ b/arch/arm/mach-kirkwood/Makefile
@@ -1,4 +1,4 @@
-obj-y                           += common.o addr-map.o irq.o pcie.o mpp.o
+obj-y                           += common.o irq.o pcie.o mpp.o
 obj-$(CONFIG_MACH_DB88F6281_BP)         += db88f6281-bp-setup.o
 obj-$(CONFIG_MACH_RD88F6192_NAS)        += rd88f6192-nas-setup.o
diff --git a/arch/arm/mach-kirkwood/addr-map.c b/arch/arm/mach-kirkwood/addr-map.c
deleted file mode 100644
index 8f0d162a1e1d..000000000000
--- a/arch/arm/mach-kirkwood/addr-map.c
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * arch/arm/mach-kirkwood/addr-map.c
- *
- * Address map functions for Marvell Kirkwood SoCs
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mbus.h>
-#include <linux/io.h>
-#include <mach/hardware.h>
-#include <plat/addr-map.h>
-#include "common.h"
-/*
- * Generic Address Decode Windows bit settings
- */
-#define TARGET_DEV_BUS          1
-#define TARGET_SRAM             3
-#define TARGET_PCIE             4
-#define ATTR_DEV_SPI_ROM        0x1e
-#define ATTR_DEV_BOOT           0x1d
-#define ATTR_DEV_NAND           0x2f
-#define ATTR_DEV_CS3            0x37
-#define ATTR_DEV_CS2            0x3b
-#define ATTR_DEV_CS1            0x3d
-#define ATTR_DEV_CS0            0x3e
-#define ATTR_PCIE_IO            0xe0
-#define ATTR_PCIE_MEM           0xe8
-#define ATTR_PCIE1_IO           0xd0
-#define ATTR_PCIE1_MEM          0xd8
-#define ATTR_SRAM               0x01
-/*
- * Description of the windows needed by the platform code
- */
-static struct __initdata orion_addr_map_cfg addr_map_cfg = {
-        .num_wins = 8,
-        .remappable_wins = 4,
-        .bridge_virt_base = BRIDGE_VIRT_BASE,
-};
-static const struct __initdata orion_addr_map_info addr_map_info[] = {
-        /*
-         * Windows for PCIe IO+MEM space.
-         */
-        { 0, KIRKWOOD_PCIE_IO_PHYS_BASE, KIRKWOOD_PCIE_IO_SIZE,
-          TARGET_PCIE, ATTR_PCIE_IO, KIRKWOOD_PCIE_IO_BUS_BASE
-        },
-        { 1, KIRKWOOD_PCIE_MEM_PHYS_BASE, KIRKWOOD_PCIE_MEM_SIZE,
-          TARGET_PCIE, ATTR_PCIE_MEM, KIRKWOOD_PCIE_MEM_BUS_BASE
-        },
-        { 2, KIRKWOOD_PCIE1_IO_PHYS_BASE, KIRKWOOD_PCIE1_IO_SIZE,
-          TARGET_PCIE, ATTR_PCIE1_IO, KIRKWOOD_PCIE1_IO_BUS_BASE
-        },
-        { 3, KIRKWOOD_PCIE1_MEM_PHYS_BASE, KIRKWOOD_PCIE1_MEM_SIZE,
-          TARGET_PCIE, ATTR_PCIE1_MEM, KIRKWOOD_PCIE1_MEM_BUS_BASE
-        },
-        /*
-         * Window for NAND controller.
-         */
-        { 4, KIRKWOOD_NAND_MEM_PHYS_BASE, KIRKWOOD_NAND_MEM_SIZE,
-          TARGET_DEV_BUS, ATTR_DEV_NAND, -1
-        },
-        /*
-         * Window for SRAM.
-         */
-        { 5, KIRKWOOD_SRAM_PHYS_BASE, KIRKWOOD_SRAM_SIZE,
-          TARGET_SRAM, ATTR_SRAM, -1
-        },
-        /* End marker */
-        { -1, 0, 0, 0, 0, 0 }
-};
-void __init kirkwood_setup_cpu_mbus(void)
-{
-        /*
-         * Disable, clear and configure windows.
-         */
-        orion_config_wins(&addr_map_cfg, addr_map_info);
-        /*
-         * Setup MBUS dram target info.
-         */
-        orion_setup_cpu_mbus_target(&addr_map_cfg,
-                                    (void __iomem *) DDR_WINDOW_CPU_BASE);
-}
diff --git a/arch/arm/mach-kirkwood/board-dt.c b/arch/arm/mach-kirkwood/board-dt.c
index d367aa6b47bb..f5437c27dc2a 100644
--- a/arch/arm/mach-kirkwood/board-dt.c
+++ b/arch/arm/mach-kirkwood/board-dt.c
@@ -93,7 +93,7 @@ static void __init kirkwood_dt_init(void)
         */
        writel(readl(CPU_CONFIG) & ~CPU_CONFIG_ERROR_PROP, CPU_CONFIG);
-        kirkwood_setup_cpu_mbus();
+        kirkwood_setup_wins();
        kirkwood_l2_init();
diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
index 49792a0cd2d3..c2cae69e6d2b 100644
--- a/arch/arm/mach-kirkwood/common.c
+++ b/arch/arm/mach-kirkwood/common.c
@@ -33,7 +33,6 @@
 #include <linux/platform_data/usb-ehci-orion.h>
 #include <plat/common.h>
 #include <plat/time.h>
-#include <plat/addr-map.h>
 #include <linux/platform_data/dma-mv_xor.h>
 #include "common.h"
@@ -535,6 +534,9 @@ void __init kirkwood_init_early(void)
         * the allocations won't fail.
         */
        init_dma_coherent_pool_size(SZ_1M);
+        mvebu_mbus_init("marvell,kirkwood-mbus",
+                        BRIDGE_WINS_BASE, BRIDGE_WINS_SZ,
+                        DDR_WINDOW_CPU_BASE, DDR_WINDOW_CPU_SZ);
 }
 int kirkwood_tclk;
@@ -650,6 +652,38 @@ char * __init kirkwood_id(void)
        }
 }
+void __init kirkwood_setup_wins(void)
+{
+        /*
+         * The PCIe windows will no longer be statically allocated
+         * here once Kirkwood is migrated to the pci-mvebu driver.
+         */
+        mvebu_mbus_add_window_remap_flags("pcie0.0",
+                                          KIRKWOOD_PCIE_IO_PHYS_BASE,
+                                          KIRKWOOD_PCIE_IO_SIZE,
+                                          KIRKWOOD_PCIE_IO_BUS_BASE,
+                                          MVEBU_MBUS_PCI_IO);
+        mvebu_mbus_add_window_remap_flags("pcie0.0",
+                                          KIRKWOOD_PCIE_MEM_PHYS_BASE,
+                                          KIRKWOOD_PCIE_MEM_SIZE,
+                                          MVEBU_MBUS_NO_REMAP,
+                                          MVEBU_MBUS_PCI_MEM);
+        mvebu_mbus_add_window_remap_flags("pcie1.0",
+                                          KIRKWOOD_PCIE1_IO_PHYS_BASE,
+                                          KIRKWOOD_PCIE1_IO_SIZE,
+                                          KIRKWOOD_PCIE1_IO_BUS_BASE,
+                                          MVEBU_MBUS_PCI_IO);
+        mvebu_mbus_add_window_remap_flags("pcie1.0",
+                                          KIRKWOOD_PCIE1_MEM_PHYS_BASE,
+                                          KIRKWOOD_PCIE1_MEM_SIZE,
+                                          MVEBU_MBUS_NO_REMAP,
+                                          MVEBU_MBUS_PCI_MEM);
+        mvebu_mbus_add_window("nand", KIRKWOOD_NAND_MEM_PHYS_BASE,
+                              KIRKWOOD_NAND_MEM_SIZE);
+        mvebu_mbus_add_window("sram", KIRKWOOD_SRAM_PHYS_BASE,
+                              KIRKWOOD_SRAM_SIZE);
+}
 void __init kirkwood_l2_init(void)
 {
 #ifdef CONFIG_CACHE_FEROCEON_L2
@@ -675,7 +709,7 @@ void __init kirkwood_init(void)
         */
        writel(readl(CPU_CONFIG) & ~CPU_CONFIG_ERROR_PROP, CPU_CONFIG);
-        kirkwood_setup_cpu_mbus();
+        kirkwood_setup_wins();
        kirkwood_l2_init();
diff --git a/arch/arm/mach-kirkwood/common.h b/arch/arm/mach-kirkwood/common.h
index 5ed70565c843..e24f74305b34 100644
--- a/arch/arm/mach-kirkwood/common.h
+++ b/arch/arm/mach-kirkwood/common.h
@@ -30,7 +30,7 @@ void kirkwood_init(void);
 void kirkwood_init_early(void);
 void kirkwood_init_irq(void);
-void kirkwood_setup_cpu_mbus(void);
+void kirkwood_setup_wins(void);
 void kirkwood_enable_pcie(void);
 void kirkwood_pcie_id(u32 *dev, u32 *rev);
diff --git a/arch/arm/mach-kirkwood/include/mach/kirkwood.h b/arch/arm/mach-kirkwood/include/mach/kirkwood.h
index a05563a31c95..92976cef3910 100644
--- a/arch/arm/mach-kirkwood/include/mach/kirkwood.h
+++ b/arch/arm/mach-kirkwood/include/mach/kirkwood.h
@@ -60,8 +60,9 @@
 * Register Map
 */
 #define DDR_VIRT_BASE           (KIRKWOOD_REGS_VIRT_BASE + 0x00000)
-#define DDR_PHYS_BASE           (KIRKWOOD_REGS_PHYS_BASE + 0x00000)
+#define DDR_PHYS_BASE           (KIRKWOOD_REGS_PHYS_BASE + 0x00000)
-#define  DDR_WINDOW_CPU_BASE    (DDR_VIRT_BASE + 0x1500)
+#define  DDR_WINDOW_CPU_BASE    (DDR_PHYS_BASE + 0x1500)
+#define  DDR_WINDOW_CPU_SZ      (0x20)
 #define DDR_OPERATION_BASE      (DDR_PHYS_BASE + 0x1418)
 #define DEV_BUS_PHYS_BASE       (KIRKWOOD_REGS_PHYS_BASE + 0x10000)
@@ -80,6 +81,8 @@
 #define BRIDGE_VIRT_BASE        (KIRKWOOD_REGS_VIRT_BASE + 0x20000)
 #define BRIDGE_PHYS_BASE        (KIRKWOOD_REGS_PHYS_BASE + 0x20000)
+#define  BRIDGE_WINS_BASE       (BRIDGE_PHYS_BASE)
+#define  BRIDGE_WINS_SZ         (0x80)
 #define CRYPTO_PHYS_BASE        (KIRKWOOD_REGS_PHYS_BASE + 0x30000)
diff --git a/arch/arm/mach-kirkwood/pcie.c b/arch/arm/mach-kirkwood/pcie.c
index d96ad4c09972..7f43e6c2f8c0 100644
--- a/arch/arm/mach-kirkwood/pcie.c
+++ b/arch/arm/mach-kirkwood/pcie.c
@@ -17,7 +17,6 @@
 #include <asm/mach/pci.h>
 #include <plat/pcie.h>
 #include <mach/bridge-regs.h>
-#include <plat/addr-map.h>
 #include "common.h"
 static void kirkwood_enable_pcie_clk(const char *port)
diff --git a/arch/arm/mach-mmp/gplugd.c b/arch/arm/mach-mmp/gplugd.c
index d1e2d595e79c..f62b68d926f4 100644
--- a/arch/arm/mach-mmp/gplugd.c
+++ b/arch/arm/mach-mmp/gplugd.c
@@ -9,6 +9,7 @@
 */
 #include <linux/init.h>
+#include <linux/platform_device.h>
 #include <linux/gpio.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-mv78xx0/Makefile b/arch/arm/mach-mv78xx0/Makefile
index 67a13f9bfe64..7cd04634d302 100644
--- a/arch/arm/mach-mv78xx0/Makefile
+++ b/arch/arm/mach-mv78xx0/Makefile
@@ -1,4 +1,4 @@
-obj-y                           += common.o addr-map.o mpp.o irq.o pcie.o
+obj-y                           += common.o mpp.o irq.o pcie.o
 obj-$(CONFIG_MACH_DB78X00_BP)   += db78x00-bp-setup.o
 obj-$(CONFIG_MACH_RD78X00_MASA) += rd78x00-masa-setup.o
 obj-$(CONFIG_MACH_TERASTATION_WXL) += buffalo-wxl-setup.o
diff --git a/arch/arm/mach-mv78xx0/addr-map.c b/arch/arm/mach-mv78xx0/addr-map.c
deleted file mode 100644
index 26e9876b50e9..000000000000
--- a/arch/arm/mach-mv78xx0/addr-map.c
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * arch/arm/mach-mv78xx0/addr-map.c
- *
- * Address map functions for Marvell MV78xx0 SoCs
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mbus.h>
-#include <linux/io.h>
-#include <plat/addr-map.h>
-#include <mach/mv78xx0.h>
-#include "common.h"
-/*
- * Generic Address Decode Windows bit settings
- */
-#define TARGET_DEV_BUS          1
-#define TARGET_PCIE0            4
-#define TARGET_PCIE1            8
-#define TARGET_PCIE(i)          ((i) ? TARGET_PCIE1 : TARGET_PCIE0)
-#define ATTR_DEV_SPI_ROM        0x1f
-#define ATTR_DEV_BOOT           0x2f
-#define ATTR_DEV_CS3            0x37
-#define ATTR_DEV_CS2            0x3b
-#define ATTR_DEV_CS1            0x3d
-#define ATTR_DEV_CS0            0x3e
-#define ATTR_PCIE_IO(l)         (0xf0 & ~(0x10 << (l)))
-#define ATTR_PCIE_MEM(l)        (0xf8 & ~(0x10 << (l)))
-/*
- * CPU Address Decode Windows registers
- */
-#define WIN0_OFF(n)             (BRIDGE_VIRT_BASE + 0x0000 + ((n) << 4))
-#define WIN8_OFF(n)             (BRIDGE_VIRT_BASE + 0x0900 + (((n) - 8) << 4))
-static void __init __iomem *win_cfg_base(const struct orion_addr_map_cfg *cfg, int win)
-{
-        /*
-         * Find the control register base address for this window.
-         *
-         * BRIDGE_VIRT_BASE points to the right (CPU0's or CPU1's)
-         * MBUS bridge depending on which CPU core we're running on,
-         * so we don't need to take that into account here.
-         */
-        return (win < 8) ? WIN0_OFF(win) : WIN8_OFF(win);
-}
-/*
- * Description of the windows needed by the platform code
- */
-static struct orion_addr_map_cfg addr_map_cfg __initdata = {
-        .num_wins = 14,
-        .remappable_wins = 8,
-        .win_cfg_base = win_cfg_base,
-};
-void __init mv78xx0_setup_cpu_mbus(void)
-{
-        /*
-         * Disable, clear and configure windows.
-         */
-        orion_config_wins(&addr_map_cfg, NULL);
-        /*
-         * Setup MBUS dram target info.
-         */
-        if (mv78xx0_core_index() == 0)
-                orion_setup_cpu_mbus_target(&addr_map_cfg,
-                                            (void __iomem *) DDR_WINDOW_CPU0_BASE);
-        else
-                orion_setup_cpu_mbus_target(&addr_map_cfg,
-                                            (void __iomem *) DDR_WINDOW_CPU1_BASE);
-}
-void __init mv78xx0_setup_pcie_io_win(int window, u32 base, u32 size,
-                                      int maj, int min)
-{
-        orion_setup_cpu_win(&addr_map_cfg, window, base, size,
-                            TARGET_PCIE(maj), ATTR_PCIE_IO(min), 0);
-}
-void __init mv78xx0_setup_pcie_mem_win(int window, u32 base, u32 size,
-                                       int maj, int min)
-{
-        orion_setup_cpu_win(&addr_map_cfg, window, base, size,
-                            TARGET_PCIE(maj), ATTR_PCIE_MEM(min), -1);
-}
diff --git a/arch/arm/mach-mv78xx0/common.c b/arch/arm/mach-mv78xx0/common.c
index 0efa14498ebc..749a7f8c4992 100644
--- a/arch/arm/mach-mv78xx0/common.c
+++ b/arch/arm/mach-mv78xx0/common.c
@@ -334,6 +334,14 @@ void __init mv78xx0_uart3_init(void)
 void __init mv78xx0_init_early(void)
 {
        orion_time_set_base(TIMER_VIRT_BASE);
+        if (mv78xx0_core_index() == 0)
+                mvebu_mbus_init("marvell,mv78xx0-mbus",
+                                BRIDGE_WINS_CPU0_BASE, BRIDGE_WINS_SZ,
+                                DDR_WINDOW_CPU0_BASE, DDR_WINDOW_CPU_SZ);
+        else
+                mvebu_mbus_init("marvell,mv78xx0-mbus",
+                                BRIDGE_WINS_CPU1_BASE, BRIDGE_WINS_SZ,
+                                DDR_WINDOW_CPU1_BASE, DDR_WINDOW_CPU_SZ);
 }
 void __init_refok mv78xx0_timer_init(void)
@@ -397,8 +405,6 @@ void __init mv78xx0_init(void)
        printk("HCLK = %dMHz, ", (hclk + 499999) / 1000000);
        printk("TCLK = %dMHz\n", (get_tclk() + 499999) / 1000000);
-        mv78xx0_setup_cpu_mbus();
 #ifdef CONFIG_CACHE_FEROCEON_L2
        feroceon_l2_init(is_l2_writethrough());
 #endif
diff --git a/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h b/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
index 46200a183cf2..723748d8ba7d 100644
--- a/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
+++ b/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
@@ -60,13 +60,18 @@
 */
 #define BRIDGE_VIRT_BASE        (MV78XX0_CORE_REGS_VIRT_BASE)
 #define BRIDGE_PHYS_BASE        (MV78XX0_CORE_REGS_PHYS_BASE)
+#define  BRIDGE_WINS_CPU0_BASE  (MV78XX0_CORE0_REGS_PHYS_BASE)
+#define  BRIDGE_WINS_CPU1_BASE  (MV78XX0_CORE1_REGS_PHYS_BASE)
+#define  BRIDGE_WINS_SZ         (0xA000)
 /*
 * Register Map
 */
 #define DDR_VIRT_BASE           (MV78XX0_REGS_VIRT_BASE + 0x00000)
-#define  DDR_WINDOW_CPU0_BASE   (DDR_VIRT_BASE + 0x1500)
+#define DDR_PHYS_BASE           (MV78XX0_REGS_PHYS_BASE + 0x00000)
-#define  DDR_WINDOW_CPU1_BASE   (DDR_VIRT_BASE + 0x1570)
+#define  DDR_WINDOW_CPU0_BASE   (DDR_PHYS_BASE + 0x1500)
+#define  DDR_WINDOW_CPU1_BASE   (DDR_PHYS_BASE + 0x1570)
+#define  DDR_WINDOW_CPU_SZ      (0x20)
 #define DEV_BUS_PHYS_BASE       (MV78XX0_REGS_PHYS_BASE + 0x10000)
 #define DEV_BUS_VIRT_BASE       (MV78XX0_REGS_VIRT_BASE + 0x10000)
diff --git a/arch/arm/mach-mv78xx0/pcie.c b/arch/arm/mach-mv78xx0/pcie.c
index ee8c0b51df2c..dc26a654c496 100644
--- a/arch/arm/mach-mv78xx0/pcie.c
+++ b/arch/arm/mach-mv78xx0/pcie.c
@@ -10,11 +10,11 @@
 #include <linux/kernel.h>
 #include <linux/pci.h>
+#include <linux/mbus.h>
 #include <video/vga.h>
 #include <asm/irq.h>
 #include <asm/mach/pci.h>
 #include <plat/pcie.h>
-#include <plat/addr-map.h>
 #include <mach/mv78xx0.h>
 #include "common.h"
@@ -54,7 +54,6 @@ static void __init mv78xx0_pcie_preinit(void)
        int i;
        u32 size_each;
        u32 start;
-        int win = 0;
        pcie_io_space.name = "PCIe I/O Space";
        pcie_io_space.start = MV78XX0_PCIE_IO_PHYS_BASE(0);
@@ -72,6 +71,7 @@ static void __init mv78xx0_pcie_preinit(void)
        start = MV78XX0_PCIE_MEM_PHYS_BASE;
        for (i = 0; i < num_pcie_ports; i++) {
                struct pcie_port *pp = pcie_port + i;
+                char winname[MVEBU_MBUS_MAX_WINNAME_SZ];
                snprintf(pp->mem_space_name, sizeof(pp->mem_space_name),
                        "PCIe %d.%d MEM", pp->maj, pp->min);
@@ -85,12 +85,17 @@ static void __init mv78xx0_pcie_preinit(void)
                if (request_resource(&iomem_resource, &pp->res))
                        panic("can't allocate PCIe MEM sub-space");
-                mv78xx0_setup_pcie_mem_win(win + i + 8, pp->res.start,
+                snprintf(winname, sizeof(winname), "pcie%d.%d",
-                                           resource_size(&pp->res),
+                         pp->maj, pp->min);
-                                           pp->maj, pp->min);
+                mvebu_mbus_add_window_remap_flags(winname,
-                mv78xx0_setup_pcie_io_win(win + i, i * SZ_64K, SZ_64K,
+                                                  pp->res.start,
-                                          pp->maj, pp->min);
+                                                  resource_size(&pp->res),
+                                                  MVEBU_MBUS_NO_REMAP,
+                                                  MVEBU_MBUS_PCI_MEM);
+                mvebu_mbus_add_window_remap_flags(winname,
+                                                  i * SZ_64K, SZ_64K,
+                                                  0, MVEBU_MBUS_PCI_IO);
        }
 }
diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig
index 440b13ef1fed..e11acbb0a46d 100644
--- a/arch/arm/mach-mvebu/Kconfig
+++ b/arch/arm/mach-mvebu/Kconfig
@@ -13,6 +13,8 @@ config ARCH_MVEBU
        select MVEBU_CLK_CORE
        select MVEBU_CLK_CPU
        select MVEBU_CLK_GATING
+        select MVEBU_MBUS
+        select ZONE_DMA if ARM_LPAE
 if ARCH_MVEBU
diff --git a/arch/arm/mach-mvebu/Makefile b/arch/arm/mach-mvebu/Makefile
index da93bcbc74c1..ba769e082ad4 100644
--- a/arch/arm/mach-mvebu/Makefile
+++ b/arch/arm/mach-mvebu/Makefile
@@ -5,6 +5,6 @@ AFLAGS_coherency_ll.o		:= -Wa,-march=armv7-a
 obj-y                            += system-controller.o
 obj-$(CONFIG_MACH_ARMADA_370_XP) += armada-370-xp.o
-obj-$(CONFIG_ARCH_MVEBU)         += addr-map.o coherency.o coherency_ll.o pmsu.o irq-armada-370-xp.o 
+obj-$(CONFIG_ARCH_MVEBU)         += coherency.o coherency_ll.o pmsu.o irq-armada-370-xp.o
 obj-$(CONFIG_SMP)                += platsmp.o headsmp.o
 obj-$(CONFIG_HOTPLUG_CPU)        += hotplug.o
diff --git a/arch/arm/mach-mvebu/addr-map.c b/arch/arm/mach-mvebu/addr-map.c
deleted file mode 100644
index ab9b3bd4fef5..000000000000
--- a/arch/arm/mach-mvebu/addr-map.c
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Address map functions for Marvell 370 / XP SoCs
- *
- * Copyright (C) 2012 Marvell
- *
- * Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mbus.h>
-#include <linux/io.h>
-#include <linux/of.h>
-#include <linux/of_address.h>
-#include <plat/addr-map.h>
-/*
- * Generic Address Decode Windows bit settings
- */
-#define ARMADA_XP_TARGET_DEV_BUS        1
-#define   ARMADA_XP_ATTR_DEV_BOOTROM    0x1D
-#define ARMADA_XP_TARGET_ETH1           3
-#define ARMADA_XP_TARGET_PCIE_0_2       4
-#define ARMADA_XP_TARGET_ETH0           7
-#define ARMADA_XP_TARGET_PCIE_1_3       8
-#define ARMADA_370_TARGET_DEV_BUS       1
-#define   ARMADA_370_ATTR_DEV_BOOTROM   0x1D
-#define ARMADA_370_TARGET_PCIE_0        4
-#define ARMADA_370_TARGET_PCIE_1        8
-#define ARMADA_WINDOW_8_PLUS_OFFSET       0x90
-#define ARMADA_SDRAM_ADDR_DECODING_OFFSET 0x180
-static const struct __initdata orion_addr_map_info
-armada_xp_addr_map_info[] = {
-        /*
-         * Window for the BootROM, needed for SMP on Armada XP
-         */
-        { 0, 0xfff00000, SZ_1M, ARMADA_XP_TARGET_DEV_BUS,
-          ARMADA_XP_ATTR_DEV_BOOTROM, -1 },
-        /* End marker */
-        { -1, 0, 0, 0, 0, 0 },
-};
-static const struct __initdata orion_addr_map_info
-armada_370_addr_map_info[] = {
-        /* End marker */
-        { -1, 0, 0, 0, 0, 0 },
-};
-static struct of_device_id of_addr_decoding_controller_table[] = {
-        { .compatible = "marvell,armada-addr-decoding-controller" },
-        { /* end of list */ },
-};
-static void __iomem *
-armada_cfg_base(const struct orion_addr_map_cfg *cfg, int win)
-{
-        unsigned int offset;
-        /* The register layout is a bit annoying and the below code
-         * tries to cope with it.
-         * - At offset 0x0, there are the registers for the first 8
-         *   windows, with 4 registers of 32 bits per window (ctrl,
-         *   base, remap low, remap high)
-         * - Then at offset 0x80, there is a hole of 0x10 bytes for
-         *   the internal registers base address and internal units
-         *   sync barrier register.
-         * - Then at offset 0x90, there the registers for 12
-         *   windows, with only 2 registers of 32 bits per window
-         *   (ctrl, base).
-         */
-        if (win < 8)
-                offset = (win << 4);
-        else
-                offset = ARMADA_WINDOW_8_PLUS_OFFSET + ((win - 8) << 3);
-        return cfg->bridge_virt_base + offset;
-}
-static struct __initdata orion_addr_map_cfg addr_map_cfg = {
-        .num_wins = 20,
-        .remappable_wins = 8,
-        .win_cfg_base = armada_cfg_base,
-};
-static int __init armada_setup_cpu_mbus(void)
-{
-        struct device_node *np;
-        void __iomem *mbus_unit_addr_decoding_base;
-        void __iomem *sdram_addr_decoding_base;
-        np = of_find_matching_node(NULL, of_addr_decoding_controller_table);
-        if (!np)
-                return -ENODEV;
-        mbus_unit_addr_decoding_base = of_iomap(np, 0);
-        BUG_ON(!mbus_unit_addr_decoding_base);
-        sdram_addr_decoding_base =
-                mbus_unit_addr_decoding_base +
-                ARMADA_SDRAM_ADDR_DECODING_OFFSET;
-        addr_map_cfg.bridge_virt_base = mbus_unit_addr_decoding_base;
-        if (of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric"))
-                addr_map_cfg.hw_io_coherency = 1;
-        /*
-         * Disable, clear and configure windows.
-         */
-        if (of_machine_is_compatible("marvell,armadaxp"))
-                orion_config_wins(&addr_map_cfg, armada_xp_addr_map_info);
-        else if (of_machine_is_compatible("marvell,armada370"))
-                orion_config_wins(&addr_map_cfg, armada_370_addr_map_info);
-        else {
-                pr_err("Unsupported SoC\n");
-                return -EINVAL;
-        }
-        /*
-         * Setup MBUS dram target info.
-         */
-        orion_setup_cpu_mbus_target(&addr_map_cfg,
-                                    sdram_addr_decoding_base);
-        return 0;
-}
-/* Using a early_initcall is needed so that this initialization gets
- * done before the SMP initialization, which requires the BootROM to
- * be remapped. */
-early_initcall(armada_setup_cpu_mbus);
diff --git a/arch/arm/mach-mvebu/armada-370-xp.c b/arch/arm/mach-mvebu/armada-370-xp.c
index a5ea616d6d12..12d3655830d1 100644
--- a/arch/arm/mach-mvebu/armada-370-xp.c
+++ b/arch/arm/mach-mvebu/armada-370-xp.c
@@ -19,6 +19,7 @@
 #include <linux/time-armada-370-xp.h>
 #include <linux/clk/mvebu.h>
 #include <linux/dma-mapping.h>
+#include <linux/mbus.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
 #include <asm/mach/time.h>
@@ -48,12 +49,29 @@ void __init armada_370_xp_timer_and_clk_init(void)
 void __init armada_370_xp_init_early(void)
 {
+        char *mbus_soc_name;
        /*
         * Some Armada 370/XP devices allocate their coherent buffers
         * from atomic context. Increase size of atomic coherent pool
         * to make sure such the allocations won't fail.
         */
        init_dma_coherent_pool_size(SZ_1M);
+        /*
+         * This initialization will be replaced by a DT-based
+         * initialization once the mvebu-mbus driver gains DT support.
+         */
+        if (of_machine_is_compatible("marvell,armada370"))
+                mbus_soc_name = "marvell,armada370-mbus";
+        else
+                mbus_soc_name = "marvell,armadaxp-mbus";
+        mvebu_mbus_init(mbus_soc_name,
+                        ARMADA_370_XP_MBUS_WINS_BASE,
+                        ARMADA_370_XP_MBUS_WINS_SIZE,
+                        ARMADA_370_XP_SDRAM_WINS_BASE,
+                        ARMADA_370_XP_SDRAM_WINS_SIZE);
 }
 static void __init armada_370_xp_dt_init(void)
diff --git a/arch/arm/mach-mvebu/armada-370-xp.h b/arch/arm/mach-mvebu/armada-370-xp.h
index c6a7d74fddfe..2070e1b4f342 100644
--- a/arch/arm/mach-mvebu/armada-370-xp.h
+++ b/arch/arm/mach-mvebu/armada-370-xp.h
@@ -16,9 +16,15 @@
 #define __MACH_ARMADA_370_XP_H
 #define ARMADA_370_XP_REGS_PHYS_BASE    0xd0000000
-#define ARMADA_370_XP_REGS_VIRT_BASE    IOMEM(0xfeb00000)
+#define ARMADA_370_XP_REGS_VIRT_BASE    IOMEM(0xfec00000)
 #define ARMADA_370_XP_REGS_SIZE         SZ_1M
+/* These defines can go away once mvebu-mbus has a DT binding */
+#define ARMADA_370_XP_MBUS_WINS_BASE    (ARMADA_370_XP_REGS_PHYS_BASE + 0x20000)
+#define ARMADA_370_XP_MBUS_WINS_SIZE    0x100
+#define ARMADA_370_XP_SDRAM_WINS_BASE   (ARMADA_370_XP_REGS_PHYS_BASE + 0x20180)
+#define ARMADA_370_XP_SDRAM_WINS_SIZE   0x20
 #ifdef CONFIG_SMP
 #include <linux/cpumask.h>
diff --git a/arch/arm/mach-mvebu/platsmp.c b/arch/arm/mach-mvebu/platsmp.c
index fe16aaf7c19c..875ea748391c 100644
--- a/arch/arm/mach-mvebu/platsmp.c
+++ b/arch/arm/mach-mvebu/platsmp.c
@@ -21,6 +21,7 @@
 #include <linux/smp.h>
 #include <linux/clk.h>
 #include <linux/of.h>
+#include <linux/mbus.h>
 #include <asm/cacheflush.h>
 #include <asm/smp_plat.h>
 #include "common.h"
@@ -109,6 +110,7 @@ void __init armada_xp_smp_prepare_cpus(unsigned int max_cpus)
        set_secondary_cpus_clock();
        flush_cache_all();
        set_cpu_coherent(cpu_logical_map(smp_processor_id()), 0);
+        mvebu_mbus_add_window("bootrom", 0xfff00000, SZ_1M);
 }
 struct smp_operations armada_xp_smp_ops __initdata = {
diff --git a/arch/arm/mach-mxs/icoll.c b/arch/arm/mach-mxs/icoll.c
index 8fb23af154b3..e26eeba46598 100644
--- a/arch/arm/mach-mxs/icoll.c
+++ b/arch/arm/mach-mxs/icoll.c
@@ -100,7 +100,7 @@ static struct irq_domain_ops icoll_irq_domain_ops = {
        .xlate = irq_domain_xlate_onecell,
 };
-void __init icoll_of_init(struct device_node *np,
+static void __init icoll_of_init(struct device_node *np,
                          struct device_node *interrupt_parent)
 {
        /*
diff --git a/arch/arm/mach-mxs/mach-mxs.c b/arch/arm/mach-mxs/mach-mxs.c
index 052186713347..3218f1f2c0e0 100644
--- a/arch/arm/mach-mxs/mach-mxs.c
+++ b/arch/arm/mach-mxs/mach-mxs.c
@@ -402,17 +402,17 @@ static void __init cfa10049_init(void)
 {
        enable_clk_enet_out();
        update_fec_mac_prop(OUI_CRYSTALFONTZ);
+        mxsfb_pdata.mode_list = cfa10049_video_modes;
+        mxsfb_pdata.mode_count = ARRAY_SIZE(cfa10049_video_modes);
+        mxsfb_pdata.default_bpp = 32;
+        mxsfb_pdata.ld_intf_width = STMLCDIF_18BIT;
 }
 static void __init cfa10037_init(void)
 {
        enable_clk_enet_out();
        update_fec_mac_prop(OUI_CRYSTALFONTZ);
-        mxsfb_pdata.mode_list = cfa10049_video_modes;
-        mxsfb_pdata.mode_count = ARRAY_SIZE(cfa10049_video_modes);
-        mxsfb_pdata.default_bpp = 32;
-        mxsfb_pdata.ld_intf_width = STMLCDIF_18BIT;
 }
 static void __init apf28_init(void)
diff --git a/arch/arm/mach-mxs/mm.c b/arch/arm/mach-mxs/mm.c
index a4294aa9f301..e63b7d87acbd 100644
--- a/arch/arm/mach-mxs/mm.c
+++ b/arch/arm/mach-mxs/mm.c
@@ -18,6 +18,7 @@
 #include <mach/mx23.h>
 #include <mach/mx28.h>
+#include <mach/common.h>
 /*
 * Define the MX23 memory map.
diff --git a/arch/arm/mach-mxs/ocotp.c b/arch/arm/mach-mxs/ocotp.c
index 54add60f94c9..1dff46703753 100644
--- a/arch/arm/mach-mxs/ocotp.c
+++ b/arch/arm/mach-mxs/ocotp.c
@@ -19,6 +19,7 @@
 #include <asm/processor.h>      /* for cpu_relax() */
 #include <mach/mxs.h>
+#include <mach/common.h>
 #define OCOTP_WORD_OFFSET               0x20
 #define OCOTP_WORD_COUNT                0x20
diff --git a/arch/arm/mach-omap1/common.h b/arch/arm/mach-omap1/common.h
index fb18831e88aa..14f7e9920479 100644
--- a/arch/arm/mach-omap1/common.h
+++ b/arch/arm/mach-omap1/common.h
@@ -31,6 +31,8 @@
 #include <plat/i2c.h>
+#include <mach/irqs.h>
 #if defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP850)
 void omap7xx_map_io(void);
 #else
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 49ac3dfebef9..8111cd9ff3e5 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -311,9 +311,6 @@ config MACH_OMAP_ZOOM2
        default y
        select OMAP_PACKAGE_CBB
        select REGULATOR_FIXED_VOLTAGE if REGULATOR
-        select SERIAL_8250
-        select SERIAL_8250_CONSOLE
-        select SERIAL_CORE_CONSOLE
 config MACH_OMAP_ZOOM3
        bool "OMAP3630 Zoom3 board"
@@ -321,9 +318,6 @@ config MACH_OMAP_ZOOM3
        default y
        select OMAP_PACKAGE_CBP
        select REGULATOR_FIXED_VOLTAGE if REGULATOR
-        select SERIAL_8250
-        select SERIAL_8250_CONSOLE
-        select SERIAL_CORE_CONSOLE
 config MACH_CM_T35
        bool "CompuLab CM-T35/CM-T3730 modules"
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 0274ff7a2a2b..e54a48060198 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -102,6 +102,7 @@ DT_MACHINE_START(OMAP3_DT, "Generic OMAP3 (Flattened Device Tree)")
        .init_irq       = omap_intc_of_init,
        .handle_irq     = omap3_intc_handle_irq,
        .init_machine   = omap_generic_init,
+        .init_late      = omap3_init_late,
        .init_time      = omap3_sync32k_timer_init,
        .dt_compat      = omap3_boards_compat,
        .restart        = omap3xxx_restart,
@@ -119,6 +120,7 @@ DT_MACHINE_START(OMAP3_GP_DT, "Generic OMAP3-GP (Flattened Device Tree)")
        .init_irq       = omap_intc_of_init,
        .handle_irq     = omap3_intc_handle_irq,
        .init_machine   = omap_generic_init,
+        .init_late      = omap3_init_late,
        .init_time      = omap3_secure_sync32k_timer_init,
        .dt_compat      = omap3_gp_boards_compat,
        .restart        = omap3xxx_restart,
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index f7c4616cbb60..d2ea68ea678a 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -17,6 +17,7 @@
 #include <linux/io.h>
 #include <linux/gpio.h>
 #include <linux/leds.h>
+#include <linux/usb/phy.h>
 #include <linux/usb/musb.h>
 #include <linux/platform_data/spi-omap2-mcspi.h>
@@ -98,6 +99,7 @@ static void __init rx51_init(void)
        sdrc_params = nokia_get_sdram_timings();
        omap_sdrc_init(sdrc_params, sdrc_params);
+        usb_bind_phy("musb-hdrc.0.auto", 0, "twl4030_usb");
        usb_musb_init(&musb_board_data);
        rx51_peripherals_init();
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index 0a6b9c7a63da..40f4a03d728f 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -108,7 +108,6 @@ void omap35xx_init_late(void);
 void omap3630_init_late(void);
 void am35xx_init_late(void);
 void ti81xx_init_late(void);
-void omap4430_init_late(void);
 int omap2_common_pm_late_init(void);
 #if defined(CONFIG_SOC_OMAP2420) || defined(CONFIG_SOC_OMAP2430)
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index e4b16c8efe8b..410e1bac7815 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -1122,9 +1122,6 @@ int gpmc_calc_timings(struct gpmc_timings *gpmc_t,
        /* TODO: remove, see function definition */
        gpmc_convert_ps_to_ns(gpmc_t);
-        /* Now the GPMC is initialised, unreserve the chip-selects */
-        gpmc_cs_map = 0;
        return 0;
 }
@@ -1383,6 +1380,9 @@ static int gpmc_probe(struct platform_device *pdev)
        if (IS_ERR_VALUE(gpmc_setup_irq()))
                dev_warn(gpmc_dev, "gpmc_setup_irq failed\n");
+        /* Now the GPMC is initialised, unreserve the chip-selects */
+        gpmc_cs_map = 0;
        rc = gpmc_probe_dt(pdev);
        if (rc < 0) {
                clk_disable_unprepare(gpmc_l3_clk);
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index 6a217c98db54..f82cf878d6af 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -211,8 +211,6 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
                return -EINVAL;
        }
-        pr_err("%s: Could not find signal %s\n", __func__, muxname);
        return -ENODEV;
 }
@@ -234,6 +232,8 @@ int __init omap_mux_get_by_name(const char *muxname,
                return mux_mode;
        }
+        pr_err("%s: Could not find signal %s\n", __func__, muxname);
        return -ENODEV;
 }
@@ -739,8 +739,9 @@ static void __init omap_mux_dbg_create_entry(
        list_for_each_entry(e, &partition->muxmodes, node) {
                struct omap_mux *m = &e->mux;
-                (void)debugfs_create_file(m->muxnames[0], S_IWUSR, mux_dbg_dir,
+                (void)debugfs_create_file(m->muxnames[0], S_IWUSR | S_IRUGO,
-                                          m, &omap_mux_dbg_signal_fops);
+                                          mux_dbg_dir, m,
+                                          &omap_mux_dbg_signal_fops);
        }
 }
diff --git a/arch/arm/mach-orion5x/Makefile b/arch/arm/mach-orion5x/Makefile
index 9e809a7c05c0..45da805fb236 100644
--- a/arch/arm/mach-orion5x/Makefile
+++ b/arch/arm/mach-orion5x/Makefile
@@ -1,4 +1,4 @@
-obj-y                           += common.o addr-map.o pci.o irq.o mpp.o
+obj-y                           += common.o pci.o irq.o mpp.o
 obj-$(CONFIG_MACH_DB88F5281)    += db88f5281-setup.o
 obj-$(CONFIG_MACH_RD88F5182)    += rd88f5182-setup.o
 obj-$(CONFIG_MACH_KUROBOX_PRO)  += kurobox_pro-setup.o
diff --git a/arch/arm/mach-orion5x/addr-map.c b/arch/arm/mach-orion5x/addr-map.c
deleted file mode 100644
index b5efc0fd31cb..000000000000
--- a/arch/arm/mach-orion5x/addr-map.c
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * arch/arm/mach-orion5x/addr-map.c
- *
- * Address map functions for Marvell Orion 5x SoCs
- *
- * Maintainer: Tzachi Perelstein <tzachi@marvell.com>
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mbus.h>
-#include <linux/io.h>
-#include <mach/hardware.h>
-#include <plat/addr-map.h>
-#include "common.h"
-/*
- * The Orion has fully programmable address map. There's a separate address
- * map for each of the device _master_ interfaces, e.g. CPU, PCI, PCIe, USB,
- * Gigabit Ethernet, DMA/XOR engines, etc. Each interface has its own
- * address decode windows that allow it to access any of the Orion resources.
- *
- * CPU address decoding --
- * Linux assumes that it is the boot loader that already setup the access to
- * DDR and internal registers.
- * Setup access to PCI and PCIe IO/MEM space is issued by this file.
- * Setup access to various devices located on the device bus interface (e.g.
- * flashes, RTC, etc) should be issued by machine-setup.c according to
- * specific board population (by using orion5x_setup_*_win()).
- *
- * Non-CPU Masters address decoding --
- * Unlike the CPU, we setup the access from Orion's master interfaces to DDR
- * banks only (the typical use case).
- * Setup access for each master to DDR is issued by platform device setup.
- */
-/*
- * Generic Address Decode Windows bit settings
- */
-#define TARGET_DEV_BUS          1
-#define TARGET_PCI              3
-#define TARGET_PCIE             4
-#define TARGET_SRAM             9
-#define ATTR_PCIE_MEM           0x59
-#define ATTR_PCIE_IO            0x51
-#define ATTR_PCIE_WA            0x79
-#define ATTR_PCI_MEM            0x59
-#define ATTR_PCI_IO             0x51
-#define ATTR_DEV_CS0            0x1e
-#define ATTR_DEV_CS1            0x1d
-#define ATTR_DEV_CS2            0x1b
-#define ATTR_DEV_BOOT           0xf
-#define ATTR_SRAM               0x0
-static int __initdata win_alloc_count;
-static int __init cpu_win_can_remap(const struct orion_addr_map_cfg *cfg,
-                  const int win)
-{
-        u32 dev, rev;
-        orion5x_pcie_id(&dev, &rev);
-        if ((dev == MV88F5281_DEV_ID && win < 4)
-            || (dev == MV88F5182_DEV_ID && win < 2)
-            || (dev == MV88F5181_DEV_ID && win < 2)
-            || (dev == MV88F6183_DEV_ID && win < 4))
-                return 1;
-        return 0;
-}
-/*
- * Description of the windows needed by the platform code
- */
-static struct orion_addr_map_cfg addr_map_cfg __initdata = {
-        .num_wins = 8,
-        .cpu_win_can_remap = cpu_win_can_remap,
-        .bridge_virt_base = ORION5X_BRIDGE_VIRT_BASE,
-};
-static const struct __initdata orion_addr_map_info addr_map_info[] = {
-        /*
-         * Setup windows for PCI+PCIe IO+MEM space.
-         */
-        { 0, ORION5X_PCIE_IO_PHYS_BASE, ORION5X_PCIE_IO_SIZE,
-          TARGET_PCIE, ATTR_PCIE_IO, ORION5X_PCIE_IO_BUS_BASE
-        },
-        { 1, ORION5X_PCI_IO_PHYS_BASE, ORION5X_PCI_IO_SIZE,
-          TARGET_PCI, ATTR_PCI_IO, ORION5X_PCI_IO_BUS_BASE
-        },
-        { 2, ORION5X_PCIE_MEM_PHYS_BASE, ORION5X_PCIE_MEM_SIZE,
-          TARGET_PCIE, ATTR_PCIE_MEM, -1
-        },
-        { 3, ORION5X_PCI_MEM_PHYS_BASE, ORION5X_PCI_MEM_SIZE,
-          TARGET_PCI, ATTR_PCI_MEM, -1
-        },
-        /* End marker */
-        { -1, 0, 0, 0, 0, 0 }
-};
-void __init orion5x_setup_cpu_mbus_bridge(void)
-{
-        /*
-         * Disable, clear and configure windows.
-         */
-        orion_config_wins(&addr_map_cfg, addr_map_info);
-        win_alloc_count = 4;
-        /*
-         * Setup MBUS dram target info.
-         */
-        orion_setup_cpu_mbus_target(&addr_map_cfg,
-                                    (void __iomem *) ORION5X_DDR_WINDOW_CPU_BASE);
-}
-void __init orion5x_setup_dev_boot_win(u32 base, u32 size)
-{
-        orion_setup_cpu_win(&addr_map_cfg, win_alloc_count++, base, size,
-                            TARGET_DEV_BUS, ATTR_DEV_BOOT, -1);
-}
-void __init orion5x_setup_dev0_win(u32 base, u32 size)
-{
-        orion_setup_cpu_win(&addr_map_cfg, win_alloc_count++, base, size,
-                            TARGET_DEV_BUS, ATTR_DEV_CS0, -1);
-}
-void __init orion5x_setup_dev1_win(u32 base, u32 size)
-{
-        orion_setup_cpu_win(&addr_map_cfg, win_alloc_count++, base, size,
-                            TARGET_DEV_BUS, ATTR_DEV_CS1, -1);
-}
-void __init orion5x_setup_dev2_win(u32 base, u32 size)
-{
-        orion_setup_cpu_win(&addr_map_cfg, win_alloc_count++, base, size,
-                            TARGET_DEV_BUS, ATTR_DEV_CS2, -1);
-}
-void __init orion5x_setup_pcie_wa_win(u32 base, u32 size)
-{
-        orion_setup_cpu_win(&addr_map_cfg, win_alloc_count++, base, size,
-                            TARGET_PCIE, ATTR_PCIE_WA, -1);
-}
-void __init orion5x_setup_sram_win(void)
-{
-        orion_setup_cpu_win(&addr_map_cfg, win_alloc_count++,
-                            ORION5X_SRAM_PHYS_BASE, ORION5X_SRAM_SIZE,
-                            TARGET_SRAM, ATTR_SRAM, -1);
-}
diff --git a/arch/arm/mach-orion5x/board-dt.c b/arch/arm/mach-orion5x/board-dt.c
index 35a8014529ca..6bbc8786c1e3 100644
--- a/arch/arm/mach-orion5x/board-dt.c
+++ b/arch/arm/mach-orion5x/board-dt.c
@@ -41,7 +41,7 @@ static void __init orion5x_dt_init(void)
        /*
         * Setup Orion address map
         */
-        orion5x_setup_cpu_mbus_bridge();
+        orion5x_setup_wins();
        /* Setup root of clk tree */
        clk_init();
diff --git a/arch/arm/mach-orion5x/common.c b/arch/arm/mach-orion5x/common.c
index d068f1431c40..8e468e3a6015 100644
--- a/arch/arm/mach-orion5x/common.c
+++ b/arch/arm/mach-orion5x/common.c
@@ -34,7 +34,6 @@
 #include <linux/platform_data/usb-ehci-orion.h>
 #include <plat/time.h>
 #include <plat/common.h>
-#include <plat/addr-map.h>
 #include "common.h"
 /*****************************************************************************
@@ -174,7 +173,8 @@ void __init orion5x_xor_init(void)
 ****************************************************************************/
 static void __init orion5x_crypto_init(void)
 {
-        orion5x_setup_sram_win();
+        mvebu_mbus_add_window("sram", ORION5X_SRAM_PHYS_BASE,
+                              ORION5X_SRAM_SIZE);
        orion_crypto_init(ORION5X_CRYPTO_PHYS_BASE, ORION5X_SRAM_PHYS_BASE,
                          SZ_8K, IRQ_ORION5X_CESA);
 }
@@ -193,6 +193,9 @@ void __init orion5x_wdt_init(void)
 ****************************************************************************/
 void __init orion5x_init_early(void)
 {
+        u32 rev, dev;
+        const char *mbus_soc_name;
        orion_time_set_base(TIMER_VIRT_BASE);
        /*
@@ -201,6 +204,46 @@ void __init orion5x_init_early(void)
         * the allocations won't fail.
         */
        init_dma_coherent_pool_size(SZ_1M);
+        /* Initialize the MBUS driver */
+        orion5x_pcie_id(&dev, &rev);
+        if (dev == MV88F5281_DEV_ID)
+                mbus_soc_name = "marvell,orion5x-88f5281-mbus";
+        else if (dev == MV88F5182_DEV_ID)
+                mbus_soc_name = "marvell,orion5x-88f5182-mbus";
+        else if (dev == MV88F5181_DEV_ID)
+                mbus_soc_name = "marvell,orion5x-88f5181-mbus";
+        else if (dev == MV88F6183_DEV_ID)
+                mbus_soc_name = "marvell,orion5x-88f6183-mbus";
+        else
+                mbus_soc_name = NULL;
+        mvebu_mbus_init(mbus_soc_name, ORION5X_BRIDGE_WINS_BASE,
+                        ORION5X_BRIDGE_WINS_SZ,
+                        ORION5X_DDR_WINS_BASE, ORION5X_DDR_WINS_SZ);
+}
+void orion5x_setup_wins(void)
+{
+        /*
+         * The PCIe windows will no longer be statically allocated
+         * here once Orion5x is migrated to the pci-mvebu driver.
+         */
+        mvebu_mbus_add_window_remap_flags("pcie0.0", ORION5X_PCIE_IO_PHYS_BASE,
+                                          ORION5X_PCIE_IO_SIZE,
+                                          ORION5X_PCIE_IO_BUS_BASE,
+                                          MVEBU_MBUS_PCI_IO);
+        mvebu_mbus_add_window_remap_flags("pcie0.0", ORION5X_PCIE_MEM_PHYS_BASE,
+                                          ORION5X_PCIE_MEM_SIZE,
+                                          MVEBU_MBUS_NO_REMAP,
+                                          MVEBU_MBUS_PCI_MEM);
+        mvebu_mbus_add_window_remap_flags("pci0.0", ORION5X_PCI_IO_PHYS_BASE,
+                                          ORION5X_PCI_IO_SIZE,
+                                          ORION5X_PCI_IO_BUS_BASE,
+                                          MVEBU_MBUS_PCI_IO);
+        mvebu_mbus_add_window_remap_flags("pci0.0", ORION5X_PCI_MEM_PHYS_BASE,
+                                          ORION5X_PCI_MEM_SIZE,
+                                          MVEBU_MBUS_NO_REMAP,
+                                          MVEBU_MBUS_PCI_MEM);
 }
 int orion5x_tclk;
@@ -282,7 +325,7 @@ void __init orion5x_init(void)
        /*
         * Setup Orion address map
         */
-        orion5x_setup_cpu_mbus_bridge();
+        orion5x_setup_wins();
        /* Setup root of clk tree */
        clk_init();
diff --git a/arch/arm/mach-orion5x/common.h b/arch/arm/mach-orion5x/common.h
index e60345760283..cdaa01f3d186 100644
--- a/arch/arm/mach-orion5x/common.h
+++ b/arch/arm/mach-orion5x/common.h
@@ -17,18 +17,7 @@ void clk_init(void);
 extern int orion5x_tclk;
 extern void orion5x_timer_init(void);
-/*
+void orion5x_setup_wins(void);
- * Enumerations and functions for Orion windows mapping. Used by Orion core
- * functions to map its interfaces and by the machine-setup to map its on-
- * board devices. Details in /mach-orion/addr-map.c
- */
-void orion5x_setup_cpu_mbus_bridge(void);
-void orion5x_setup_dev_boot_win(u32 base, u32 size);
-void orion5x_setup_dev0_win(u32 base, u32 size);
-void orion5x_setup_dev1_win(u32 base, u32 size);
-void orion5x_setup_dev2_win(u32 base, u32 size);
-void orion5x_setup_pcie_wa_win(u32 base, u32 size);
-void orion5x_setup_sram_win(void);
 void orion5x_ehci0_init(void);
 void orion5x_ehci1_init(void);
diff --git a/arch/arm/mach-orion5x/d2net-setup.c b/arch/arm/mach-orion5x/d2net-setup.c
index 57d0af74874d..16c88bbabc98 100644
--- a/arch/arm/mach-orion5x/d2net-setup.c
+++ b/arch/arm/mach-orion5x/d2net-setup.c
@@ -317,8 +317,8 @@ static void __init d2net_init(void)
        d2net_sata_power_init();
        orion5x_sata_init(&d2net_sata_data);
-        orion5x_setup_dev_boot_win(D2NET_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", D2NET_NOR_BOOT_BASE,
-                                D2NET_NOR_BOOT_SIZE);
+                              D2NET_NOR_BOOT_SIZE);
        platform_device_register(&d2net_nor_flash);
        platform_device_register(&d2net_gpio_buttons);
diff --git a/arch/arm/mach-orion5x/db88f5281-setup.c b/arch/arm/mach-orion5x/db88f5281-setup.c
index 76665640087b..4e1263da38bb 100644
--- a/arch/arm/mach-orion5x/db88f5281-setup.c
+++ b/arch/arm/mach-orion5x/db88f5281-setup.c
@@ -340,16 +340,19 @@ static void __init db88f5281_init(void)
        orion5x_uart0_init();
        orion5x_uart1_init();
-        orion5x_setup_dev_boot_win(DB88F5281_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", DB88F5281_NOR_BOOT_BASE,
-                                DB88F5281_NOR_BOOT_SIZE);
+                              DB88F5281_NOR_BOOT_SIZE);
        platform_device_register(&db88f5281_boot_flash);
-        orion5x_setup_dev0_win(DB88F5281_7SEG_BASE, DB88F5281_7SEG_SIZE);
+        mvebu_mbus_add_window("devbus-cs0", DB88F5281_7SEG_BASE,
+                              DB88F5281_7SEG_SIZE);
-        orion5x_setup_dev1_win(DB88F5281_NOR_BASE, DB88F5281_NOR_SIZE);
+        mvebu_mbus_add_window("devbus-cs1", DB88F5281_NOR_BASE,
+                              DB88F5281_NOR_SIZE);
        platform_device_register(&db88f5281_nor_flash);
-        orion5x_setup_dev2_win(DB88F5281_NAND_BASE, DB88F5281_NAND_SIZE);
+        mvebu_mbus_add_window("devbus-cs2", DB88F5281_NAND_BASE,
+                              DB88F5281_NAND_SIZE);
        platform_device_register(&db88f5281_nand_flash);
        i2c_register_board_info(0, &db88f5281_i2c_rtc, 1);
diff --git a/arch/arm/mach-orion5x/dns323-setup.c b/arch/arm/mach-orion5x/dns323-setup.c
index 6eb1732757fd..9e6baf581ed3 100644
--- a/arch/arm/mach-orion5x/dns323-setup.c
+++ b/arch/arm/mach-orion5x/dns323-setup.c
@@ -611,7 +611,8 @@ static void __init dns323_init(void)
        /* setup flash mapping
         * CS3 holds a 8 MB Spansion S29GL064M90TFIR4
         */
-        orion5x_setup_dev_boot_win(DNS323_NOR_BOOT_BASE, DNS323_NOR_BOOT_SIZE);
+        mvebu_mbus_add_window("devbus-boot", DNS323_NOR_BOOT_BASE,
+                              DNS323_NOR_BOOT_SIZE);
        platform_device_register(&dns323_nor_flash);
        /* Sort out LEDs, Buttons and i2c devices */
diff --git a/arch/arm/mach-orion5x/edmini_v2-setup.c b/arch/arm/mach-orion5x/edmini_v2-setup.c
index d675e727803d..147615510dd0 100644
--- a/arch/arm/mach-orion5x/edmini_v2-setup.c
+++ b/arch/arm/mach-orion5x/edmini_v2-setup.c
@@ -154,8 +154,8 @@ void __init edmini_v2_init(void)
        orion5x_ehci0_init();
        orion5x_eth_init(&edmini_v2_eth_data);
-        orion5x_setup_dev_boot_win(EDMINI_V2_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", EDMINI_V2_NOR_BOOT_BASE,
-                                EDMINI_V2_NOR_BOOT_SIZE);
+                              EDMINI_V2_NOR_BOOT_SIZE);
        platform_device_register(&edmini_v2_nor_flash);
        pr_notice("edmini_v2: USB device port, flash write and power-off "
diff --git a/arch/arm/mach-orion5x/include/mach/orion5x.h b/arch/arm/mach-orion5x/include/mach/orion5x.h
index d265f5484a8e..b78ff3248868 100644
--- a/arch/arm/mach-orion5x/include/mach/orion5x.h
+++ b/arch/arm/mach-orion5x/include/mach/orion5x.h
@@ -66,8 +66,10 @@
 * Orion Registers Map
 ******************************************************************************/
+#define ORION5X_DDR_PHYS_BASE           (ORION5X_REGS_PHYS_BASE + 0x00000)
+#define  ORION5X_DDR_WINS_BASE          (ORION5X_DDR_PHYS_BASE + 0x1500)
+#define  ORION5X_DDR_WINS_SZ            (0x10)
 #define ORION5X_DDR_VIRT_BASE           (ORION5X_REGS_VIRT_BASE + 0x00000)
-#define  ORION5X_DDR_WINDOW_CPU_BASE    (ORION5X_DDR_VIRT_BASE + 0x1500)
 #define ORION5X_DEV_BUS_PHYS_BASE       (ORION5X_REGS_PHYS_BASE + 0x10000)
 #define ORION5X_DEV_BUS_VIRT_BASE       (ORION5X_REGS_VIRT_BASE + 0x10000)
 #define ORION5X_DEV_BUS_REG(x)          (ORION5X_DEV_BUS_VIRT_BASE + (x))
@@ -81,6 +83,8 @@
 #define ORION5X_BRIDGE_VIRT_BASE        (ORION5X_REGS_VIRT_BASE + 0x20000)
 #define ORION5X_BRIDGE_PHYS_BASE        (ORION5X_REGS_PHYS_BASE + 0x20000)
+#define  ORION5X_BRIDGE_WINS_BASE       (ORION5X_BRIDGE_PHYS_BASE)
+#define  ORION5X_BRIDGE_WINS_SZ         (0x80)
 #define ORION5X_PCI_VIRT_BASE           (ORION5X_REGS_VIRT_BASE + 0x30000)
diff --git a/arch/arm/mach-orion5x/kurobox_pro-setup.c b/arch/arm/mach-orion5x/kurobox_pro-setup.c
index b98403526218..aae10e4a917c 100644
--- a/arch/arm/mach-orion5x/kurobox_pro-setup.c
+++ b/arch/arm/mach-orion5x/kurobox_pro-setup.c
@@ -359,13 +359,13 @@ static void __init kurobox_pro_init(void)
        orion5x_uart1_init();
        orion5x_xor_init();
-        orion5x_setup_dev_boot_win(KUROBOX_PRO_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", KUROBOX_PRO_NOR_BOOT_BASE,
-                                   KUROBOX_PRO_NOR_BOOT_SIZE);
+                              KUROBOX_PRO_NOR_BOOT_SIZE);
        platform_device_register(&kurobox_pro_nor_flash);
        if (machine_is_kurobox_pro()) {
-                orion5x_setup_dev0_win(KUROBOX_PRO_NAND_BASE,
+                mvebu_mbus_add_window("devbus-cs0", KUROBOX_PRO_NAND_BASE,
-                                       KUROBOX_PRO_NAND_SIZE);
+                                      KUROBOX_PRO_NAND_SIZE);
                platform_device_register(&kurobox_pro_nand_flash);
        }
diff --git a/arch/arm/mach-orion5x/ls-chl-setup.c b/arch/arm/mach-orion5x/ls-chl-setup.c
index 044da5b6a6ae..24f4e14e5893 100644
--- a/arch/arm/mach-orion5x/ls-chl-setup.c
+++ b/arch/arm/mach-orion5x/ls-chl-setup.c
@@ -294,8 +294,8 @@ static void __init lschl_init(void)
        orion5x_uart0_init();
        orion5x_xor_init();
-        orion5x_setup_dev_boot_win(LSCHL_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", LSCHL_NOR_BOOT_BASE,
-                                   LSCHL_NOR_BOOT_SIZE);
+                              LSCHL_NOR_BOOT_SIZE);
        platform_device_register(&lschl_nor_flash);
        platform_device_register(&lschl_leds);
diff --git a/arch/arm/mach-orion5x/ls_hgl-setup.c b/arch/arm/mach-orion5x/ls_hgl-setup.c
index d49f93423f52..fc653bb41e78 100644
--- a/arch/arm/mach-orion5x/ls_hgl-setup.c
+++ b/arch/arm/mach-orion5x/ls_hgl-setup.c
@@ -243,8 +243,8 @@ static void __init ls_hgl_init(void)
        orion5x_uart0_init();
        orion5x_xor_init();
-        orion5x_setup_dev_boot_win(LS_HGL_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", LS_HGL_NOR_BOOT_BASE,
-                                   LS_HGL_NOR_BOOT_SIZE);
+                              LS_HGL_NOR_BOOT_SIZE);
        platform_device_register(&ls_hgl_nor_flash);
        platform_device_register(&ls_hgl_button_device);
diff --git a/arch/arm/mach-orion5x/lsmini-setup.c b/arch/arm/mach-orion5x/lsmini-setup.c
index 8e3965c6c0fe..18e66e617dc2 100644
--- a/arch/arm/mach-orion5x/lsmini-setup.c
+++ b/arch/arm/mach-orion5x/lsmini-setup.c
@@ -244,8 +244,8 @@ static void __init lsmini_init(void)
        orion5x_uart0_init();
        orion5x_xor_init();
-        orion5x_setup_dev_boot_win(LSMINI_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", LSMINI_NOR_BOOT_BASE,
-                                   LSMINI_NOR_BOOT_SIZE);
+                              LSMINI_NOR_BOOT_SIZE);
        platform_device_register(&lsmini_nor_flash);
        platform_device_register(&lsmini_button_device);
diff --git a/arch/arm/mach-orion5x/mss2-setup.c b/arch/arm/mach-orion5x/mss2-setup.c
index 0ec94a1f2b16..827acbafc9dc 100644
--- a/arch/arm/mach-orion5x/mss2-setup.c
+++ b/arch/arm/mach-orion5x/mss2-setup.c
@@ -241,7 +241,8 @@ static void __init mss2_init(void)
        orion5x_uart0_init();
        orion5x_xor_init();
-        orion5x_setup_dev_boot_win(MSS2_NOR_BOOT_BASE, MSS2_NOR_BOOT_SIZE);
+        mvebu_mbus_add_window("devbus-boot", MSS2_NOR_BOOT_BASE,
+                              MSS2_NOR_BOOT_SIZE);
        platform_device_register(&mss2_nor_flash);
        platform_device_register(&mss2_button_device);
diff --git a/arch/arm/mach-orion5x/mv2120-setup.c b/arch/arm/mach-orion5x/mv2120-setup.c
index 18143f2a9093..92600ae2b4b6 100644
--- a/arch/arm/mach-orion5x/mv2120-setup.c
+++ b/arch/arm/mach-orion5x/mv2120-setup.c
@@ -204,7 +204,8 @@ static void __init mv2120_init(void)
        orion5x_uart0_init();
        orion5x_xor_init();
-        orion5x_setup_dev_boot_win(MV2120_NOR_BOOT_BASE, MV2120_NOR_BOOT_SIZE);
+        mvebu_mbus_add_window("devbus-boot", MV2120_NOR_BOOT_BASE,
+                              MV2120_NOR_BOOT_SIZE);
        platform_device_register(&mv2120_nor_flash);
        platform_device_register(&mv2120_button_device);
diff --git a/arch/arm/mach-orion5x/net2big-setup.c b/arch/arm/mach-orion5x/net2big-setup.c
index 282e503b003e..dd0641a0d074 100644
--- a/arch/arm/mach-orion5x/net2big-setup.c
+++ b/arch/arm/mach-orion5x/net2big-setup.c
@@ -397,8 +397,8 @@ static void __init net2big_init(void)
        net2big_sata_power_init();
        orion5x_sata_init(&net2big_sata_data);
-        orion5x_setup_dev_boot_win(NET2BIG_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", NET2BIG_NOR_BOOT_BASE,
-                                   NET2BIG_NOR_BOOT_SIZE);
+                              NET2BIG_NOR_BOOT_SIZE);
        platform_device_register(&net2big_nor_flash);
        platform_device_register(&net2big_gpio_buttons);
diff --git a/arch/arm/mach-orion5x/pci.c b/arch/arm/mach-orion5x/pci.c
index d9c7c3bf0d9c..503368023bb1 100644
--- a/arch/arm/mach-orion5x/pci.c
+++ b/arch/arm/mach-orion5x/pci.c
@@ -157,8 +157,11 @@ static int __init pcie_setup(struct pci_sys_data *sys)
        if (dev == MV88F5181_DEV_ID || dev == MV88F5182_DEV_ID) {
                printk(KERN_NOTICE "Applying Orion-1/Orion-NAS PCIe config "
                                   "read transaction workaround\n");
-                orion5x_setup_pcie_wa_win(ORION5X_PCIE_WA_PHYS_BASE,
+                mvebu_mbus_add_window_remap_flags("pcie0.0",
-                                          ORION5X_PCIE_WA_SIZE);
+                                                  ORION5X_PCIE_WA_PHYS_BASE,
+                                                  ORION5X_PCIE_WA_SIZE,
+                                                  MVEBU_MBUS_NO_REMAP,
+                                                  MVEBU_MBUS_PCI_WA);
                pcie_ops.read = pcie_rd_conf_wa;
        }
@@ -402,8 +405,9 @@ static void __init orion5x_pci_master_slave_enable(void)
        orion5x_pci_hw_wr_conf(bus_nr, 0, func, reg, 4, val | 0x7);
 }
-static void __init orion5x_setup_pci_wins(struct mbus_dram_target_info *dram)
+static void __init orion5x_setup_pci_wins(void)
 {
+        const struct mbus_dram_target_info *dram = mv_mbus_dram_info();
        u32 win_enable;
        int bus;
        int i;
@@ -420,7 +424,7 @@ static void __init orion5x_setup_pci_wins(struct mbus_dram_target_info *dram)
        bus = orion5x_pci_local_bus_nr();
        for (i = 0; i < dram->num_cs; i++) {
-                struct mbus_dram_window *cs = dram->cs + i;
+                const struct mbus_dram_window *cs = dram->cs + i;
                u32 func = PCI_CONF_FUNC_BAR_CS(cs->cs_index);
                u32 reg;
                u32 val;
@@ -467,7 +471,7 @@ static int __init pci_setup(struct pci_sys_data *sys)
        /*
         * Point PCI unit MBUS decode windows to DRAM space.
         */
-        orion5x_setup_pci_wins(&orion_mbus_dram_info);
+        orion5x_setup_pci_wins();
        /*
         * Master + Slave enable
diff --git a/arch/arm/mach-orion5x/rd88f5181l-fxo-setup.c b/arch/arm/mach-orion5x/rd88f5181l-fxo-setup.c
index d6e72f672afb..1c4498bf650a 100644
--- a/arch/arm/mach-orion5x/rd88f5181l-fxo-setup.c
+++ b/arch/arm/mach-orion5x/rd88f5181l-fxo-setup.c
@@ -123,8 +123,8 @@ static void __init rd88f5181l_fxo_init(void)
        orion5x_eth_switch_init(&rd88f5181l_fxo_switch_plat_data, NO_IRQ);
        orion5x_uart0_init();
-        orion5x_setup_dev_boot_win(RD88F5181L_FXO_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", RD88F5181L_FXO_NOR_BOOT_BASE,
-                                   RD88F5181L_FXO_NOR_BOOT_SIZE);
+                              RD88F5181L_FXO_NOR_BOOT_SIZE);
        platform_device_register(&rd88f5181l_fxo_nor_boot_flash);
 }
diff --git a/arch/arm/mach-orion5x/rd88f5181l-ge-setup.c b/arch/arm/mach-orion5x/rd88f5181l-ge-setup.c
index c8b7913310e5..adabe34c4fc6 100644
--- a/arch/arm/mach-orion5x/rd88f5181l-ge-setup.c
+++ b/arch/arm/mach-orion5x/rd88f5181l-ge-setup.c
@@ -130,8 +130,8 @@ static void __init rd88f5181l_ge_init(void)
        orion5x_i2c_init();
        orion5x_uart0_init();
-        orion5x_setup_dev_boot_win(RD88F5181L_GE_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", RD88F5181L_GE_NOR_BOOT_BASE,
-                                   RD88F5181L_GE_NOR_BOOT_SIZE);
+                              RD88F5181L_GE_NOR_BOOT_SIZE);
        platform_device_register(&rd88f5181l_ge_nor_boot_flash);
        i2c_register_board_info(0, &rd88f5181l_ge_i2c_rtc, 1);
diff --git a/arch/arm/mach-orion5x/rd88f5182-setup.c b/arch/arm/mach-orion5x/rd88f5182-setup.c
index f9e156725d7c..66e77ec91532 100644
--- a/arch/arm/mach-orion5x/rd88f5182-setup.c
+++ b/arch/arm/mach-orion5x/rd88f5182-setup.c
@@ -264,10 +264,11 @@ static void __init rd88f5182_init(void)
        orion5x_uart0_init();
        orion5x_xor_init();
-        orion5x_setup_dev_boot_win(RD88F5182_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", RD88F5182_NOR_BOOT_BASE,
-                                   RD88F5182_NOR_BOOT_SIZE);
+                              RD88F5182_NOR_BOOT_SIZE);
-        orion5x_setup_dev1_win(RD88F5182_NOR_BASE, RD88F5182_NOR_SIZE);
+        mvebu_mbus_add_window("devbus-cs1", RD88F5182_NOR_BASE,
+                              RD88F5182_NOR_SIZE);
        platform_device_register(&rd88f5182_nor_flash);
        platform_device_register(&rd88f5182_gpio_leds);
diff --git a/arch/arm/mach-orion5x/terastation_pro2-setup.c b/arch/arm/mach-orion5x/terastation_pro2-setup.c
index acc0877ec1c9..a0bfa53e7556 100644
--- a/arch/arm/mach-orion5x/terastation_pro2-setup.c
+++ b/arch/arm/mach-orion5x/terastation_pro2-setup.c
@@ -329,8 +329,8 @@ static void __init tsp2_init(void)
        /*
         * Configure peripherals.
         */
-        orion5x_setup_dev_boot_win(TSP2_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", TSP2_NOR_BOOT_BASE,
-                                   TSP2_NOR_BOOT_SIZE);
+                              TSP2_NOR_BOOT_SIZE);
        platform_device_register(&tsp2_nor_flash);
        orion5x_ehci0_init();
diff --git a/arch/arm/mach-orion5x/ts209-setup.c b/arch/arm/mach-orion5x/ts209-setup.c
index 9c17f0c2b488..80174f0f168e 100644
--- a/arch/arm/mach-orion5x/ts209-setup.c
+++ b/arch/arm/mach-orion5x/ts209-setup.c
@@ -286,8 +286,8 @@ static void __init qnap_ts209_init(void)
        /*
         * Configure peripherals.
         */
-        orion5x_setup_dev_boot_win(QNAP_TS209_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", QNAP_TS209_NOR_BOOT_BASE,
-                                   QNAP_TS209_NOR_BOOT_SIZE);
+                              QNAP_TS209_NOR_BOOT_SIZE);
        platform_device_register(&qnap_ts209_nor_flash);
        orion5x_ehci0_init();
diff --git a/arch/arm/mach-orion5x/ts409-setup.c b/arch/arm/mach-orion5x/ts409-setup.c
index 8cc5ab6c503e..92592790d6da 100644
--- a/arch/arm/mach-orion5x/ts409-setup.c
+++ b/arch/arm/mach-orion5x/ts409-setup.c
@@ -277,8 +277,8 @@ static void __init qnap_ts409_init(void)
        /*
         * Configure peripherals.
         */
-        orion5x_setup_dev_boot_win(QNAP_TS409_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", QNAP_TS409_NOR_BOOT_BASE,
-                                   QNAP_TS409_NOR_BOOT_SIZE);
+                              QNAP_TS409_NOR_BOOT_SIZE);
        platform_device_register(&qnap_ts409_nor_flash);
        orion5x_ehci0_init();
diff --git a/arch/arm/mach-orion5x/wnr854t-setup.c b/arch/arm/mach-orion5x/wnr854t-setup.c
index 66552ca7e05d..6b84863c018d 100644
--- a/arch/arm/mach-orion5x/wnr854t-setup.c
+++ b/arch/arm/mach-orion5x/wnr854t-setup.c
@@ -127,8 +127,8 @@ static void __init wnr854t_init(void)
        orion5x_eth_switch_init(&wnr854t_switch_plat_data, NO_IRQ);
        orion5x_uart0_init();
-        orion5x_setup_dev_boot_win(WNR854T_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", WNR854T_NOR_BOOT_BASE,
-                                   WNR854T_NOR_BOOT_SIZE);
+                              WNR854T_NOR_BOOT_SIZE);
        platform_device_register(&wnr854t_nor_flash);
 }
diff --git a/arch/arm/mach-orion5x/wrt350n-v2-setup.c b/arch/arm/mach-orion5x/wrt350n-v2-setup.c
index 2c5408e2e689..fae684bc54f2 100644
--- a/arch/arm/mach-orion5x/wrt350n-v2-setup.c
+++ b/arch/arm/mach-orion5x/wrt350n-v2-setup.c
@@ -213,8 +213,8 @@ static void __init wrt350n_v2_init(void)
        orion5x_eth_switch_init(&wrt350n_v2_switch_plat_data, NO_IRQ);
        orion5x_uart0_init();
-        orion5x_setup_dev_boot_win(WRT350N_V2_NOR_BOOT_BASE,
+        mvebu_mbus_add_window("devbus-boot", WRT350N_V2_NOR_BOOT_BASE,
-                                   WRT350N_V2_NOR_BOOT_SIZE);
+                              WRT350N_V2_NOR_BOOT_SIZE);
        platform_device_register(&wrt350n_v2_nor_flash);
        platform_device_register(&wrt350n_v2_leds);
        platform_device_register(&wrt350n_v2_button_device);
diff --git a/arch/arm/mach-pxa/raumfeld.c b/arch/arm/mach-pxa/raumfeld.c
index af41888acbd6..969b0ba7fa70 100644
--- a/arch/arm/mach-pxa/raumfeld.c
+++ b/arch/arm/mach-pxa/raumfeld.c
@@ -505,6 +505,7 @@ static struct w1_gpio_platform_data w1_gpio_platform_data = {
        .pin                    = GPIO_ONE_WIRE,
        .is_open_drain          = 0,
        .enable_external_pullup = w1_enable_external_pullup,
+        .ext_pullup_enable_pin  = -EINVAL,
 };
 struct platform_device raumfeld_w1_gpio_device = {
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index fcdf52dbcc49..f051f53e35b7 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -214,11 +214,6 @@ static struct clk clk_pcmcdclk2 = {
        .name           = "pcmcdclk",
 };
-static struct clk dummy_apb_pclk = {
-        .name           = "apb_pclk",
-        .id             = -1,
-};
 static struct clk *clkset_vpllsrc_list[] = {
        [0] = &clk_fin_vpll,
        [1] = &clk_sclk_hdmi27m,
@@ -305,18 +300,6 @@ static struct clk_ops clk_fout_apll_ops = {
 static struct clk init_clocks_off[] = {
        {
-                .name           = "dma",
-                .devname        = "dma-pl330.0",
-                .parent         = &clk_hclk_psys.clk,
-                .enable         = s5pv210_clk_ip0_ctrl,
-                .ctrlbit        = (1 << 3),
-        }, {
-                .name           = "dma",
-                .devname        = "dma-pl330.1",
-                .parent         = &clk_hclk_psys.clk,
-                .enable         = s5pv210_clk_ip0_ctrl,
-                .ctrlbit        = (1 << 4),
-        }, {
                .name           = "rot",
                .parent         = &clk_hclk_dsys.clk,
                .enable         = s5pv210_clk_ip0_ctrl,
@@ -573,6 +556,20 @@ static struct clk clk_hsmmc3 = {
        .ctrlbit        = (1<<19),
 };
+static struct clk clk_pdma0 = {
+        .name           = "pdma0",
+        .parent         = &clk_hclk_psys.clk,
+        .enable         = s5pv210_clk_ip0_ctrl,
+        .ctrlbit        = (1 << 3),
+};
+static struct clk clk_pdma1 = {
+        .name           = "pdma1",
+        .parent         = &clk_hclk_psys.clk,
+        .enable         = s5pv210_clk_ip0_ctrl,
+        .ctrlbit        = (1 << 4),
+};
 static struct clk *clkset_uart_list[] = {
        [6] = &clk_mout_mpll.clk,
        [7] = &clk_mout_epll.clk,
@@ -1075,6 +1072,8 @@ static struct clk *clk_cdev[] = {
        &clk_hsmmc1,
        &clk_hsmmc2,
        &clk_hsmmc3,
+        &clk_pdma0,
+        &clk_pdma1,
 };
 /* Clock initialisation code */
@@ -1333,6 +1332,8 @@ static struct clk_lookup s5pv210_clk_lookup[] = {
        CLKDEV_INIT(NULL, "spi_busclk0", &clk_p),
        CLKDEV_INIT("s5pv210-spi.0", "spi_busclk1", &clk_sclk_spi0.clk),
        CLKDEV_INIT("s5pv210-spi.1", "spi_busclk1", &clk_sclk_spi1.clk),
+        CLKDEV_INIT("dma-pl330.0", "apb_pclk", &clk_pdma0),
+        CLKDEV_INIT("dma-pl330.1", "apb_pclk", &clk_pdma1),
 };
 void __init s5pv210_register_clocks(void)
@@ -1361,6 +1362,5 @@ void __init s5pv210_register_clocks(void)
        for (ptr = 0; ptr < ARRAY_SIZE(clk_cdev); ptr++)
                s3c_disable_clocks(clk_cdev[ptr], 1);
-        s3c24xx_register_clock(&dummy_apb_pclk);
        s3c_pwmclk_init();
 }
diff --git a/arch/arm/mach-s5pv210/mach-goni.c b/arch/arm/mach-s5pv210/mach-goni.c
index 3a38f7b34b94..e373de44a8b6 100644
--- a/arch/arm/mach-s5pv210/mach-goni.c
+++ b/arch/arm/mach-s5pv210/mach-goni.c
@@ -845,7 +845,7 @@ static struct fimc_source_info goni_camera_sensors[] = {
                .mux_id         = 0,
                .flags          = V4L2_MBUS_PCLK_SAMPLE_FALLING |
                                  V4L2_MBUS_VSYNC_ACTIVE_LOW,
-                .bus_type       = FIMC_BUS_TYPE_ITU_601,
+                .fimc_bus_type  = FIMC_BUS_TYPE_ITU_601,
                .board_info     = &noon010pc30_board_info,
                .i2c_bus_num    = 0,
                .clk_frequency  = 16000000UL,
diff --git a/arch/arm/mach-shmobile/board-marzen.c b/arch/arm/mach-shmobile/board-marzen.c
index cdcb799e802f..fec49ebc359a 100644
--- a/arch/arm/mach-shmobile/board-marzen.c
+++ b/arch/arm/mach-shmobile/board-marzen.c
@@ -32,6 +32,7 @@
 #include <linux/smsc911x.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/sh_hspi.h>
+#include <linux/mmc/host.h>
 #include <linux/mmc/sh_mobile_sdhi.h>
 #include <linux/mfd/tmio.h>
 #include <linux/usb/otg.h>
diff --git a/arch/arm/mach-spear3xx/spear3xx.c b/arch/arm/mach-spear3xx/spear3xx.c
index f9d754f90c59..d2b3937c4014 100644
--- a/arch/arm/mach-spear3xx/spear3xx.c
+++ b/arch/arm/mach-spear3xx/spear3xx.c
@@ -14,7 +14,7 @@
 #define pr_fmt(fmt) "SPEAr3xx: " fmt
 #include <linux/amba/pl022.h>
-#include <linux/amba/pl08x.h>
+#include <linux/amba/pl080.h>
 #include <linux/io.h>
 #include <plat/pl080.h>
 #include <mach/generic.h>
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index c7e3759f16d3..e9db6b4bf65a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -342,6 +342,7 @@ static int __init atomic_pool_init(void)
 {
        struct dma_pool *pool = &atomic_pool;
        pgprot_t prot = pgprot_dmacoherent(pgprot_kernel);
+        gfp_t gfp = GFP_KERNEL | GFP_DMA;
        unsigned long nr_pages = pool->size >> PAGE_SHIFT;
        unsigned long *bitmap;
        struct page *page;
@@ -361,8 +362,8 @@ static int __init atomic_pool_init(void)
                ptr = __alloc_from_contiguous(NULL, pool->size, prot, &page,
                                              atomic_pool_init);
        else
-                ptr = __alloc_remap_buffer(NULL, pool->size, GFP_KERNEL, prot,
+                ptr = __alloc_remap_buffer(NULL, pool->size, gfp, prot, &page,
-                                           &page, atomic_pool_init);
+                                           atomic_pool_init);
        if (ptr) {
                int i;
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 6828ef6ce80e..a0bd8a755bdf 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -576,7 +576,7 @@ load_ind:
                        /* x = ((*(frame + k)) & 0xf) << 2; */
                        ctx->seen |= SEEN_X | SEEN_DATA | SEEN_CALL;
                        /* the interpreter should deal with the negative K */
-                        if (k < 0)
+                        if ((int)k < 0)
                                return -1;
                        /* offset in r1: we might have to take the slow path */
                        emit_mov_i(r_off, k, ctx);
diff --git a/arch/arm/plat-orion/Makefile b/arch/arm/plat-orion/Makefile
index a82cecb84948..2eca54b65906 100644
--- a/arch/arm/plat-orion/Makefile
+++ b/arch/arm/plat-orion/Makefile
@@ -3,8 +3,6 @@
 #
 ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/$(src)/include
-obj-y                             += addr-map.o
 orion-gpio-$(CONFIG_GENERIC_GPIO) += gpio.o
 obj-$(CONFIG_PLAT_ORION_LEGACY)   += irq.o pcie.o time.o common.o mpp.o
 obj-$(CONFIG_PLAT_ORION_LEGACY)   += $(orion-gpio-y)
diff --git a/arch/arm/plat-orion/addr-map.c b/arch/arm/plat-orion/addr-map.c
deleted file mode 100644
index 807ac8e5cbc0..000000000000
--- a/arch/arm/plat-orion/addr-map.c
+++ /dev/null
@@ -1,178 +0,0 @@
-/*
- * arch/arm/plat-orion/addr-map.c
- *
- * Address map functions for Marvell Orion based SoCs
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/mbus.h>
-#include <linux/io.h>
-#include <plat/addr-map.h>
-struct mbus_dram_target_info orion_mbus_dram_info;
-const struct mbus_dram_target_info *mv_mbus_dram_info(void)
-{
-        return &orion_mbus_dram_info;
-}
-EXPORT_SYMBOL_GPL(mv_mbus_dram_info);
-/*
- * DDR target is the same on all Orion platforms.
- */
-#define TARGET_DDR              0
-/*
- * Helpers to get DDR bank info
- */
-#define DDR_BASE_CS_OFF(n)      (0x0000 + ((n) << 3))
-#define DDR_SIZE_CS_OFF(n)      (0x0004 + ((n) << 3))
-/*
- * CPU Address Decode Windows registers
- */
-#define WIN_CTRL_OFF            0x0000
-#define WIN_BASE_OFF            0x0004
-#define WIN_REMAP_LO_OFF        0x0008
-#define WIN_REMAP_HI_OFF        0x000c
-#define ATTR_HW_COHERENCY       (0x1 << 4)
-/*
- * Default implementation
- */
-static void __init __iomem *
-orion_win_cfg_base(const struct orion_addr_map_cfg *cfg, int win)
-{
-        return cfg->bridge_virt_base + (win << 4);
-}
-/*
- * Default implementation
- */
-static int __init orion_cpu_win_can_remap(const struct orion_addr_map_cfg *cfg,
-                                          const int win)
-{
-        if (win < cfg->remappable_wins)
-                return 1;
-        return 0;
-}
-void __init orion_setup_cpu_win(const struct orion_addr_map_cfg *cfg,
-                                const int win, const u32 base,
-                                const u32 size, const u8 target,
-                                const u8 attr, const int remap)
-{
-        void __iomem *addr = cfg->win_cfg_base(cfg, win);
-        u32 ctrl, base_high, remap_addr;
-        if (win >= cfg->num_wins) {
-                printk(KERN_ERR "setup_cpu_win: trying to allocate window "
-                       "%d when only %d allowed\n", win, cfg->num_wins);
-        }
-        base_high = base & 0xffff0000;
-        ctrl = ((size - 1) & 0xffff0000) | (attr << 8) | (target << 4) | 1;
-        writel(base_high, addr + WIN_BASE_OFF);
-        writel(ctrl, addr + WIN_CTRL_OFF);
-        if (cfg->cpu_win_can_remap(cfg, win)) {
-                if (remap < 0)
-                        remap_addr = base;
-                else
-                        remap_addr = remap;
-                writel(remap_addr & 0xffff0000, addr + WIN_REMAP_LO_OFF);
-                writel(0, addr + WIN_REMAP_HI_OFF);
-        }
-}
-/*
- * Configure a number of windows.
- */
-static void __init orion_setup_cpu_wins(const struct orion_addr_map_cfg * cfg,
-                                        const struct orion_addr_map_info *info)
-{
-        while (info->win != -1) {
-                orion_setup_cpu_win(cfg, info->win, info->base, info->size,
-                                    info->target, info->attr, info->remap);
-                info++;
-        }
-}
-static void __init orion_disable_wins(const struct orion_addr_map_cfg * cfg)
-{
-        void __iomem *addr;
-        int i;
-        for (i = 0; i < cfg->num_wins; i++) {
-                addr = cfg->win_cfg_base(cfg, i);
-                writel(0, addr + WIN_BASE_OFF);
-                writel(0, addr + WIN_CTRL_OFF);
-                if (cfg->cpu_win_can_remap(cfg, i)) {
-                        writel(0, addr + WIN_REMAP_LO_OFF);
-                        writel(0, addr + WIN_REMAP_HI_OFF);
-                }
-        }
-}
-/*
- * Disable, clear and configure windows.
- */
-void __init orion_config_wins(struct orion_addr_map_cfg * cfg,
-                              const struct orion_addr_map_info *info)
-{
-        if (!cfg->cpu_win_can_remap)
-                cfg->cpu_win_can_remap = orion_cpu_win_can_remap;
-        if (!cfg->win_cfg_base)
-                cfg->win_cfg_base = orion_win_cfg_base;
-        orion_disable_wins(cfg);
-        if (info)
-                orion_setup_cpu_wins(cfg, info);
-}
-/*
- * Setup MBUS dram target info.
- */
-void __init orion_setup_cpu_mbus_target(const struct orion_addr_map_cfg *cfg,
-                                        const void __iomem *ddr_window_cpu_base)
-{
-        int i;
-        int cs;
-        orion_mbus_dram_info.mbus_dram_target_id = TARGET_DDR;
-        for (i = 0, cs = 0; i < 4; i++) {
-                u32 base = readl(ddr_window_cpu_base + DDR_BASE_CS_OFF(i));
-                u32 size = readl(ddr_window_cpu_base + DDR_SIZE_CS_OFF(i));
-                /*
-                 * We only take care of entries for which the chip
-                 * select is enabled, and that don't have high base
-                 * address bits set (devices can only access the first
-                 * 32 bits of the memory).
-                 */
-                if ((size & 1) && !(base & 0xF)) {
-                        struct mbus_dram_window *w;
-                        w = &orion_mbus_dram_info.cs[cs++];
-                        w->cs_index = i;
-                        w->mbus_attr = 0xf & ~(1 << i);
-                        if (cfg->hw_io_coherency)
-                                w->mbus_attr |= ATTR_HW_COHERENCY;
-                        w->base = base & 0xffff0000;
-                        w->size = (size | 0x0000ffff) + 1;
-                }
-        }
-        orion_mbus_dram_info.num_cs = cs;
-}
diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
index c29ee7ea200b..e39c2ba6e2fb 100644
--- a/arch/arm/plat-orion/gpio.c
+++ b/arch/arm/plat-orion/gpio.c
@@ -439,6 +439,64 @@ static void gpio_irq_handler(unsigned irq, struct irq_desc *desc)
        }
 }
+#ifdef CONFIG_DEBUG_FS
+#include <linux/seq_file.h>
+static void orion_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
+{
+        struct orion_gpio_chip *ochip =
+                container_of(chip, struct orion_gpio_chip, chip);
+        u32 out, io_conf, blink, in_pol, data_in, cause, edg_msk, lvl_msk;
+        int i;
+        out     = readl_relaxed(GPIO_OUT(ochip));
+        io_conf = readl_relaxed(GPIO_IO_CONF(ochip));
+        blink   = readl_relaxed(GPIO_BLINK_EN(ochip));
+        in_pol  = readl_relaxed(GPIO_IN_POL(ochip));
+        data_in = readl_relaxed(GPIO_DATA_IN(ochip));
+        cause   = readl_relaxed(GPIO_EDGE_CAUSE(ochip));
+        edg_msk = readl_relaxed(GPIO_EDGE_MASK(ochip));
+        lvl_msk = readl_relaxed(GPIO_LEVEL_MASK(ochip));
+        for (i = 0; i < chip->ngpio; i++) {
+                const char *label;
+                u32 msk;
+                bool is_out;
+                label = gpiochip_is_requested(chip, i);
+                if (!label)
+                        continue;
+                msk = 1 << i;
+                is_out = !(io_conf & msk);
+                seq_printf(s, " gpio-%-3d (%-20.20s)", chip->base + i, label);
+                if (is_out) {
+                        seq_printf(s, " out %s %s\n",
+                                   out & msk ? "hi" : "lo",
+                                   blink & msk ? "(blink )" : "");
+                        continue;
+                }
+                seq_printf(s, " in  %s (act %s) - IRQ",
+                           (data_in ^ in_pol) & msk  ? "hi" : "lo",
+                           in_pol & msk ? "lo" : "hi");
+                if (!((edg_msk | lvl_msk) & msk)) {
+                        seq_printf(s, " disabled\n");
+                        continue;
+                }
+                if (edg_msk & msk)
+                        seq_printf(s, " edge ");
+                if (lvl_msk & msk)
+                        seq_printf(s, " level");
+                seq_printf(s, " (%s)\n", cause & msk ? "pending" : "clear  ");
+        }
+}
+#else
+#define orion_gpio_dbg_show NULL
+#endif
 void __init orion_gpio_init(struct device_node *np,
                            int gpio_base, int ngpio,
                            void __iomem *base, int mask_offset,
@@ -471,6 +529,7 @@ void __init orion_gpio_init(struct device_node *np,
 #ifdef CONFIG_OF
        ochip->chip.of_node = np;
 #endif
+        ochip->chip.dbg_show = orion_gpio_dbg_show;
        spin_lock_init(&ochip->lock);
        ochip->base = (void __iomem *)base;
diff --git a/arch/arm/plat-orion/pcie.c b/arch/arm/plat-orion/pcie.c
index f20a321088a2..8b8c06d2e9c4 100644
--- a/arch/arm/plat-orion/pcie.c
+++ b/arch/arm/plat-orion/pcie.c
@@ -120,12 +120,14 @@ void __init orion_pcie_reset(void __iomem *base)
 * BAR[0,2] -> disabled, BAR[1] -> covers all DRAM banks
 * WIN[0-3] -> DRAM bank[0-3]
 */
-static void __init orion_pcie_setup_wins(void __iomem *base,
+static void __init orion_pcie_setup_wins(void __iomem *base)
-                                         struct mbus_dram_target_info *dram)
 {
+        const struct mbus_dram_target_info *dram;
        u32 size;
        int i;
+        dram = mv_mbus_dram_info();
        /*
         * First, disable and clear BARs and windows.
         */
@@ -150,7 +152,7 @@ static void __init orion_pcie_setup_wins(void __iomem *base,
         */
        size = 0;
        for (i = 0; i < dram->num_cs; i++) {
-                struct mbus_dram_window *cs = dram->cs + i;
+                const struct mbus_dram_window *cs = dram->cs + i;
                writel(cs->base & 0xffff0000, base + PCIE_WIN04_BASE_OFF(i));
                writel(0, base + PCIE_WIN04_REMAP_OFF(i));
@@ -184,7 +186,7 @@ void __init orion_pcie_setup(void __iomem *base)
        /*
         * Point PCIe unit MBUS decode windows to DRAM space.
         */
-        orion_pcie_setup_wins(base, &orion_mbus_dram_info);
+        orion_pcie_setup_wins(base);
        /*
         * Master + slave enable.
diff --git a/arch/arm/plat-spear/Kconfig b/arch/arm/plat-spear/Kconfig
index 739d016eb273..8a08c31b5e20 100644
--- a/arch/arm/plat-spear/Kconfig
+++ b/arch/arm/plat-spear/Kconfig
@@ -10,7 +10,7 @@ choice
 config ARCH_SPEAR13XX
        bool "ST SPEAr13xx with Device Tree"
-        select ARCH_HAVE_CPUFREQ
+        select ARCH_HAS_CPUFREQ
        select ARM_GIC
        select CPU_V7
        select GPIO_SPEAR_SPICS
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index fd70a68387eb..9b6d19f74078 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -9,7 +9,6 @@ config ARM64
        select CLONE_BACKWARDS
        select COMMON_CLK
        select GENERIC_CLOCKEVENTS
-        select GENERIC_HARDIRQS_NO_DEPRECATED
        select GENERIC_IOMAP
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug
index 51493430f142..1a6bfe954d49 100644
--- a/arch/arm64/Kconfig.debug
+++ b/arch/arm64/Kconfig.debug
@@ -6,17 +6,6 @@ config FRAME_POINTER
        bool
        default y
-config DEBUG_ERRORS
-        bool "Verbose kernel error messages"
-        depends on DEBUG_KERNEL
-        help
-          This option controls verbose debugging information which can be
-          printed when the kernel detects an internal error. This debugging
-          information is useful to kernel hackers when tracking down problems,
-          but mostly meaningless to other people. It's safe to say Y unless
-          you are concerned with the code size or don't want to see these
-          messages.
 config DEBUG_STACK_USAGE
        bool "Enable stack utilization instrumentation"
        depends on DEBUG_KERNEL
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 9212c7880da7..09bef29f3a09 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -82,4 +82,3 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_INFO=y
 # CONFIG_FTRACE is not set
 CONFIG_ATOMIC64_SELFTEST=y
-CONFIG_DEBUG_ERRORS=y
diff --git a/arch/arm64/include/asm/ucontext.h b/arch/arm64/include/asm/ucontext.h
index bde960720892..42e04c877428 100644
--- a/arch/arm64/include/asm/ucontext.h
+++ b/arch/arm64/include/asm/ucontext.h
@@ -22,7 +22,7 @@ struct ucontext {
        stack_t           uc_stack;
        sigset_t          uc_sigmask;
        /* glibc uses a 1024-bit sigset_t */
-        __u8              __unused[(1024 - sizeof(sigset_t)) / 8];
+        __u8              __unused[1024 / 8 - sizeof(sigset_t)];
        /* last for future expansion */
        struct sigcontext uc_mcontext;
 };
diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
index cef3925eaf60..aa3e948f7885 100644
--- a/arch/arm64/kernel/arm64ksyms.c
+++ b/arch/arm64/kernel/arm64ksyms.c
@@ -40,7 +40,9 @@ EXPORT_SYMBOL(__copy_to_user);
 EXPORT_SYMBOL(__clear_user);
        /* bitops */
+#ifdef CONFIG_SMP
 EXPORT_SYMBOL(__atomic_hash);
+#endif
        /* physical memory */
 EXPORT_SYMBOL(memstart_addr);
diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
index 7f4f3673f2bc..e393174fe859 100644
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -549,7 +549,6 @@ int compat_setup_rt_frame(int usig, struct k_sigaction *ka, siginfo_t *info,
                          sigset_t *set, struct pt_regs *regs)
 {
        struct compat_rt_sigframe __user *frame;
-        compat_stack_t stack;
        int err = 0;
        frame = compat_get_sigframe(ka, regs, sizeof(*frame));
diff --git a/arch/avr32/Kconfig b/arch/avr32/Kconfig
index 9b89257b2cfd..c1a868d398bd 100644
--- a/arch/avr32/Kconfig
+++ b/arch/avr32/Kconfig
@@ -7,7 +7,7 @@ config AVR32
        select HAVE_OPROFILE
        select HAVE_KPROBES
        select HAVE_GENERIC_HARDIRQS
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select GENERIC_IRQ_PROBE
        select GENERIC_ATOMIC64
        select HARDIRQS_SW_RESEND
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index 600494c70e96..c3f2e0bc644a 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -33,7 +33,7 @@ config BLACKFIN
        select ARCH_HAVE_CUSTOM_GPIO_H
        select ARCH_WANT_OPTIONAL_GPIOLIB
        select HAVE_UID16
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select ARCH_WANT_IPC_PARSE_VERSION
        select HAVE_GENERIC_HARDIRQS
        select GENERIC_ATOMIC64
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index bb0ac66cf533..06dd026533e3 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -43,7 +43,7 @@ config CRIS
        select GENERIC_ATOMIC64
        select HAVE_GENERIC_HARDIRQS
        select HAVE_UID16
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select ARCH_WANT_IPC_PARSE_VERSION
        select GENERIC_IRQ_SHOW
        select GENERIC_IOMAP
diff --git a/arch/frv/Kconfig b/arch/frv/Kconfig
index 12369b194c7b..2ce731f9aa4d 100644
--- a/arch/frv/Kconfig
+++ b/arch/frv/Kconfig
@@ -6,7 +6,7 @@ config FRV
        select HAVE_PERF_EVENTS
        select HAVE_UID16
        select HAVE_GENERIC_HARDIRQS
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select GENERIC_IRQ_SHOW
        select HAVE_DEBUG_BUGVERBOSE
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig
index ae8551eb3736..79250de1b12a 100644
--- a/arch/h8300/Kconfig
+++ b/arch/h8300/Kconfig
@@ -5,7 +5,7 @@ config H8300
        select HAVE_GENERIC_HARDIRQS
        select GENERIC_ATOMIC64
        select HAVE_UID16
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select ARCH_WANT_IPC_PARSE_VERSION
        select GENERIC_IRQ_SHOW
        select GENERIC_CPU_DEVICES
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 33f3fdc0b214..9a02f71c6b1f 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -26,7 +26,7 @@ config IA64
        select HAVE_MEMBLOCK
        select HAVE_MEMBLOCK_NODE_MAP
        select HAVE_VIRT_CPU_ACCOUNTING
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select ARCH_DISCARD_MEMBLOCK
        select GENERIC_IRQ_PROBE
        select GENERIC_PENDING_IRQ if SMP
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 92623818a1fe..bcd17b206571 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -10,7 +10,7 @@ config M32R
        select ARCH_WANT_IPC_PARSE_VERSION
        select HAVE_DEBUG_BUGVERBOSE
        select HAVE_GENERIC_HARDIRQS
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
        select GENERIC_ATOMIC64
diff --git a/arch/m32r/include/uapi/asm/stat.h b/arch/m32r/include/uapi/asm/stat.h
index da4518f82d6d..98470fe483b6 100644
--- a/arch/m32r/include/uapi/asm/stat.h
+++ b/arch/m32r/include/uapi/asm/stat.h
@@ -63,10 +63,10 @@ struct stat64 {
        long long       st_size;
        unsigned long   st_blksize;
-#if defined(__BIG_ENDIAN)
+#if defined(__BYTE_ORDER) ? __BYTE_ORDER == __BIG_ENDIAN : defined(__BIG_ENDIAN)
        unsigned long   __pad4;         /* future possible st_blocks high bits */
        unsigned long   st_blocks;      /* Number 512-byte blocks allocated. */
-#elif defined(__LITTLE_ENDIAN)
+#elif defined(__BYTE_ORDER) ? __BYTE_ORDER == __LITTLE_ENDIAN : defined(__LITTLE_ENDIAN)
        unsigned long   st_blocks;      /* Number 512-byte blocks allocated. */
        unsigned long   __pad4;         /* future possible st_blocks high bits */
 #else
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 0e708c78e01c..6de813370b8c 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -8,7 +8,7 @@ config M68K
        select GENERIC_IRQ_SHOW
        select GENERIC_ATOMIC64
        select HAVE_UID16
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select ARCH_HAVE_NMI_SAFE_CMPXCHG if RMW_INSNS
        select GENERIC_CPU_DEVICES
        select GENERIC_STRNCPY_FROM_USER if MMU
diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine
index 7cdf6b010381..7240584d3439 100644
--- a/arch/m68k/Kconfig.machine
+++ b/arch/m68k/Kconfig.machine
@@ -310,7 +310,6 @@ config COBRA5282
 config SOM5282EM
        bool "EMAC.Inc SOM5282EM board support"
        depends on M528x
-        select EMAC_INC
        help
          Support for the EMAC.Inc SOM5282EM module.
diff --git a/arch/m68k/include/asm/MC68328.h b/arch/m68k/include/asm/MC68328.h
index a337e56d09bf..4ebf098b8a1f 100644
--- a/arch/m68k/include/asm/MC68328.h
+++ b/arch/m68k/include/asm/MC68328.h
@@ -293,7 +293,7 @@
 /*
 * Here go the bitmasks themselves
 */
-#define IMR_MSPIM       (1 << SPIM _IRQ_NUM)    /* Mask SPI Master interrupt */
+#define IMR_MSPIM       (1 << SPIM_IRQ_NUM)     /* Mask SPI Master interrupt */
 #define IMR_MTMR2       (1 << TMR2_IRQ_NUM)     /* Mask Timer 2 interrupt */
 #define IMR_MUART       (1 << UART_IRQ_NUM)     /* Mask UART interrupt */       
 #define IMR_MWDT        (1 << WDT_IRQ_NUM)      /* Mask Watchdog Timer interrupt */
@@ -327,7 +327,7 @@
 #define IWR_ADDR        0xfffff308
 #define IWR             LONG_REF(IWR_ADDR)
-#define IWR_SPIM        (1 << SPIM _IRQ_NUM)    /* SPI Master interrupt */
+#define IWR_SPIM        (1 << SPIM_IRQ_NUM)     /* SPI Master interrupt */
 #define IWR_TMR2        (1 << TMR2_IRQ_NUM)     /* Timer 2 interrupt */
 #define IWR_UART        (1 << UART_IRQ_NUM)     /* UART interrupt */    
 #define IWR_WDT         (1 << WDT_IRQ_NUM)      /* Watchdog Timer interrupt */
@@ -357,7 +357,7 @@
 #define ISR_ADDR        0xfffff30c
 #define ISR             LONG_REF(ISR_ADDR)
-#define ISR_SPIM        (1 << SPIM _IRQ_NUM)    /* SPI Master interrupt */
+#define ISR_SPIM        (1 << SPIM_IRQ_NUM)     /* SPI Master interrupt */
 #define ISR_TMR2        (1 << TMR2_IRQ_NUM)     /* Timer 2 interrupt */
 #define ISR_UART        (1 << UART_IRQ_NUM)     /* UART interrupt */    
 #define ISR_WDT         (1 << WDT_IRQ_NUM)      /* Watchdog Timer interrupt */
@@ -391,7 +391,7 @@
 #define IPR_ADDR        0xfffff310
 #define IPR             LONG_REF(IPR_ADDR)
-#define IPR_SPIM        (1 << SPIM _IRQ_NUM)    /* SPI Master interrupt */
+#define IPR_SPIM        (1 << SPIM_IRQ_NUM)     /* SPI Master interrupt */
 #define IPR_TMR2        (1 << TMR2_IRQ_NUM)     /* Timer 2 interrupt */
 #define IPR_UART        (1 << UART_IRQ_NUM)     /* UART interrupt */    
 #define IPR_WDT         (1 << WDT_IRQ_NUM)      /* Watchdog Timer interrupt */
@@ -757,7 +757,7 @@
 /* 'EZ328-compatible definitions */
 #define TCN_ADDR        TCN1_ADDR
-#define TCN             TCN
+#define TCN             TCN1
 /*
 * Timer Unit 1 and 2 Status Registers
diff --git a/arch/m68k/kernel/setup_no.c b/arch/m68k/kernel/setup_no.c
index 71fb29938dba..911ba472e6c4 100644
--- a/arch/m68k/kernel/setup_no.c
+++ b/arch/m68k/kernel/setup_no.c
@@ -57,6 +57,9 @@ void (*mach_reset)(void);
 void (*mach_halt)(void);
 void (*mach_power_off)(void);
+#ifdef CONFIG_M68000
+#define CPU_NAME        "MC68000"
+#endif
 #ifdef CONFIG_M68328
 #define CPU_NAME        "MC68328"
 #endif
diff --git a/arch/m68k/mm/init.c b/arch/m68k/mm/init.c
index afd8106fd83b..519aad8fa812 100644
--- a/arch/m68k/mm/init.c
+++ b/arch/m68k/mm/init.c
@@ -188,7 +188,7 @@ void __init mem_init(void)
                }
        }
-#if !defined(CONFIG_SUN3) && !defined(CONFIG_COLDFIRE)
+#if defined(CONFIG_MMU) && !defined(CONFIG_SUN3) && !defined(CONFIG_COLDFIRE)
        /* insert pointer tables allocated so far into the tablelist */
        init_pointer_table((unsigned long)kernel_pg_dir);
        for (i = 0; i < PTRS_PER_PGD; i++) {
diff --git a/arch/m68k/platform/coldfire/m528x.c b/arch/m68k/platform/coldfire/m528x.c
index 83b7dad7a84e..b03a9d271837 100644
--- a/arch/m68k/platform/coldfire/m528x.c
+++ b/arch/m68k/platform/coldfire/m528x.c
@@ -69,7 +69,7 @@ static void __init m528x_uarts_init(void)
        u8 port;
        /* make sure PUAPAR is set for UART0 and UART1 */
-        port = readb(MCF5282_GPIO_PUAPAR);
+        port = readb(MCFGPIO_PUAPAR);
        port |= 0x03 | (0x03 << 2);
        writeb(port, MCFGPIO_PUAPAR);
 }
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 7843d11156e6..1323fa2530eb 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -19,7 +19,7 @@ config MICROBLAZE
        select HAVE_DEBUG_KMEMLEAK
        select IRQ_DOMAIN
        select HAVE_GENERIC_HARDIRQS
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
        select GENERIC_PCI_IOMAP
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index ae9c716c46bb..cd2e21ff562a 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -38,7 +38,7 @@ config MIPS
        select GENERIC_CLOCKEVENTS
        select GENERIC_CMOS_UPDATE
        select HAVE_MOD_ARCH_SPECIFIC
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select MODULES_USE_ELF_REL if MODULES
        select MODULES_USE_ELF_RELA if MODULES && 64BIT
        select CLONE_BACKWARDS
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index b06c7360b1c6..428da175d073 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -8,7 +8,7 @@ config MN10300
        select HAVE_ARCH_KGDB
        select GENERIC_ATOMIC64
        select HAVE_NMI_WATCHDOG if MN10300_WD_TIMER
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select GENERIC_CLOCKEVENTS
        select MODULES_USE_ELF_RELA
        select OLD_SIGSUSPEND3
diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index 014a6482ed4c..9ab3bf2eca8d 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -9,10 +9,9 @@ config OPENRISC
        select OF_EARLY_FLATTREE
        select IRQ_DOMAIN
        select HAVE_MEMBLOCK
-        select ARCH_WANT_OPTIONAL_GPIOLIB
+        select ARCH_REQUIRE_GPIOLIB
        select HAVE_ARCH_TRACEHOOK
        select HAVE_GENERIC_HARDIRQS
-        select HAVE_VIRT_TO_BUS
        select GENERIC_IRQ_CHIP
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index a9ff712a2864..0339181bf3ac 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -21,7 +21,7 @@ config PARISC
        select GENERIC_STRNCPY_FROM_USER
        select SYSCTL_ARCH_UNALIGN_ALLOW
        select HAVE_MOD_ARCH_SPECIFIC
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select MODULES_USE_ELF_RELA
        select CLONE_BACKWARDS
        select TTY # Needed for pdc_cons.c
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index b89d7eb730a2..ea5bb045983a 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -90,6 +90,7 @@ config GENERIC_GPIO
 config PPC
        bool
        default y
+        select BINFMT_ELF
        select OF
        select OF_EARLY_FLATTREE
        select HAVE_FTRACE_MCOUNT_RECORD
@@ -98,7 +99,7 @@ config PPC
        select HAVE_FUNCTION_GRAPH_TRACER
        select SYSCTL_EXCEPTION_TRACE
        select ARCH_WANT_OPTIONAL_GPIOLIB
-        select HAVE_VIRT_TO_BUS if !PPC64
+        select VIRT_TO_BUS if !PPC64
        select HAVE_IDE
        select HAVE_IOREMAP_PROT
        select HAVE_EFFICIENT_UNALIGNED_ACCESS
diff --git a/arch/powerpc/include/asm/mmu-hash64.h b/arch/powerpc/include/asm/mmu-hash64.h
index 2fdb47a19efd..b59e06f507ea 100644
--- a/arch/powerpc/include/asm/mmu-hash64.h
+++ b/arch/powerpc/include/asm/mmu-hash64.h
@@ -343,17 +343,16 @@ extern void slb_set_size(u16 size);
 /*
 * VSID allocation (256MB segment)
 *
- * We first generate a 38-bit "proto-VSID".  For kernel addresses this
+ * We first generate a 37-bit "proto-VSID". Proto-VSIDs are generated
- * is equal to the ESID | 1 << 37, for user addresses it is:
+ * from mmu context id and effective segment id of the address.
- *      (context << USER_ESID_BITS) | (esid & ((1U << USER_ESID_BITS) - 1)
 *
- * This splits the proto-VSID into the below range
+ * For user processes max context id is limited to ((1ul << 19) - 5)
- *  0 - (2^(CONTEXT_BITS + USER_ESID_BITS) - 1) : User proto-VSID range
+ * for kernel space, we use the top 4 context ids to map address as below
- *  2^(CONTEXT_BITS + USER_ESID_BITS) - 2^(VSID_BITS) : Kernel proto-VSID range
+ * NOTE: each context only support 64TB now.
- *
+ * 0x7fffc -  [ 0xc000000000000000 - 0xc0003fffffffffff ]
- * We also have CONTEXT_BITS + USER_ESID_BITS = VSID_BITS - 1
+ * 0x7fffd -  [ 0xd000000000000000 - 0xd0003fffffffffff ]
- * That is, we assign half of the space to user processes and half
+ * 0x7fffe -  [ 0xe000000000000000 - 0xe0003fffffffffff ]
- * to the kernel.
+ * 0x7ffff -  [ 0xf000000000000000 - 0xf0003fffffffffff ]
 *
 * The proto-VSIDs are then scrambled into real VSIDs with the
 * multiplicative hash:
@@ -363,41 +362,49 @@ extern void slb_set_size(u16 size);
 * VSID_MULTIPLIER is prime, so in particular it is
 * co-prime to VSID_MODULUS, making this a 1:1 scrambling function.
 * Because the modulus is 2^n-1 we can compute it efficiently without
- * a divide or extra multiply (see below).
+ * a divide or extra multiply (see below). The scramble function gives
- *
+ * robust scattering in the hash table (at least based on some initial
- * This scheme has several advantages over older methods:
+ * results).
- *
- *      - We have VSIDs allocated for every kernel address
- * (i.e. everything above 0xC000000000000000), except the very top
- * segment, which simplifies several things.
 *
- *      - We allow for USER_ESID_BITS significant bits of ESID and
+ * We also consider VSID 0 special. We use VSID 0 for slb entries mapping
- * CONTEXT_BITS  bits of context for user addresses.
+ * bad address. This enables us to consolidate bad address handling in
- *  i.e. 64T (46 bits) of address space for up to half a million contexts.
+ * hash_page.
 *
- *      - The scramble function gives robust scattering in the hash
+ * We also need to avoid the last segment of the last context, because that
- * table (at least based on some initial results).  The previous
+ * would give a protovsid of 0x1fffffffff. That will result in a VSID 0
- * method was more susceptible to pathological cases giving excessive
+ * because of the modulo operation in vsid scramble. But the vmemmap
- * hash collisions.
+ * (which is what uses region 0xf) will never be close to 64TB in size
+ * (it's 56 bytes per page of system memory).
 */
+#define CONTEXT_BITS            19
+#define ESID_BITS               18
+#define ESID_BITS_1T            6
+/*
+ * 256MB segment
+ * The proto-VSID space has 2^(CONTEX_BITS + ESID_BITS) - 1 segments
+ * available for user + kernel mapping. The top 4 contexts are used for
+ * kernel mapping. Each segment contains 2^28 bytes. Each
+ * context maps 2^46 bytes (64TB) so we can support 2^19-1 contexts
+ * (19 == 37 + 28 - 46).
+ */
+#define MAX_USER_CONTEXT        ((ASM_CONST(1) << CONTEXT_BITS) - 5)
 /*
 * This should be computed such that protovosid * vsid_mulitplier
 * doesn't overflow 64 bits. It should also be co-prime to vsid_modulus
 */
 #define VSID_MULTIPLIER_256M    ASM_CONST(12538073)     /* 24-bit prime */
-#define VSID_BITS_256M          38
+#define VSID_BITS_256M          (CONTEXT_BITS + ESID_BITS)
 #define VSID_MODULUS_256M       ((1UL<<VSID_BITS_256M)-1)
 #define VSID_MULTIPLIER_1T      ASM_CONST(12538073)     /* 24-bit prime */
-#define VSID_BITS_1T            26
+#define VSID_BITS_1T            (CONTEXT_BITS + ESID_BITS_1T)
 #define VSID_MODULUS_1T         ((1UL<<VSID_BITS_1T)-1)
-#define CONTEXT_BITS            19
-#define USER_ESID_BITS          18
-#define USER_ESID_BITS_1T       6
-#define USER_VSID_RANGE (1UL << (USER_ESID_BITS + SID_SHIFT))
+#define USER_VSID_RANGE (1UL << (ESID_BITS + SID_SHIFT))
 /*
 * This macro generates asm code to compute the VSID scramble
@@ -421,7 +428,8 @@ extern void slb_set_size(u16 size);
        srdi    rx,rt,VSID_BITS_##size;                                 \
        clrldi  rt,rt,(64-VSID_BITS_##size);                            \
        add     rt,rt,rx;               /* add high and low bits */     \
-        /* Now, r3 == VSID (mod 2^36-1), and lies between 0 and         \
+        /* NOTE: explanation based on VSID_BITS_##size = 36             \
+         * Now, r3 == VSID (mod 2^36-1), and lies between 0 and         \
         * 2^36-1+2^28-1.  That in particular means that if r3 >=       \
         * 2^36-1, then r3+1 has the 2^36 bit set.  So, if r3+1 has     \
         * the bit clear, r3 already has the answer we want, if it      \
@@ -513,34 +521,6 @@ typedef struct {
        })
 #endif /* 1 */
-/*
- * This is only valid for addresses >= PAGE_OFFSET
- * The proto-VSID space is divided into two class
- * User:   0 to 2^(CONTEXT_BITS + USER_ESID_BITS) -1
- * kernel: 2^(CONTEXT_BITS + USER_ESID_BITS) to 2^(VSID_BITS) - 1
- *
- * With KERNEL_START at 0xc000000000000000, the proto vsid for
- * the kernel ends up with 0xc00000000 (36 bits). With 64TB
- * support we need to have kernel proto-VSID in the
- * [2^37 to 2^38 - 1] range due to the increased USER_ESID_BITS.
- */
-static inline unsigned long get_kernel_vsid(unsigned long ea, int ssize)
-{
-        unsigned long proto_vsid;
-        /*
-         * We need to make sure proto_vsid for the kernel is
-         * >= 2^(CONTEXT_BITS + USER_ESID_BITS[_1T])
-         */
-        if (ssize == MMU_SEGSIZE_256M) {
-                proto_vsid = ea >> SID_SHIFT;
-                proto_vsid |= (1UL << (CONTEXT_BITS + USER_ESID_BITS));
-                return vsid_scramble(proto_vsid, 256M);
-        }
-        proto_vsid = ea >> SID_SHIFT_1T;
-        proto_vsid |= (1UL << (CONTEXT_BITS + USER_ESID_BITS_1T));
-        return vsid_scramble(proto_vsid, 1T);
-}
 /* Returns the segment size indicator for a user address */
 static inline int user_segment_size(unsigned long addr)
 {
@@ -550,17 +530,41 @@ static inline int user_segment_size(unsigned long addr)
        return MMU_SEGSIZE_256M;
 }
-/* This is only valid for user addresses (which are below 2^44) */
 static inline unsigned long get_vsid(unsigned long context, unsigned long ea,
                                     int ssize)
 {
+        /*
+         * Bad address. We return VSID 0 for that
+         */
+        if ((ea & ~REGION_MASK) >= PGTABLE_RANGE)
+                return 0;
        if (ssize == MMU_SEGSIZE_256M)
-                return vsid_scramble((context << USER_ESID_BITS)
+                return vsid_scramble((context << ESID_BITS)
                                     | (ea >> SID_SHIFT), 256M);
-        return vsid_scramble((context << USER_ESID_BITS_1T)
+        return vsid_scramble((context << ESID_BITS_1T)
                             | (ea >> SID_SHIFT_1T), 1T);
 }
+/*
+ * This is only valid for addresses >= PAGE_OFFSET
+ *
+ * For kernel space, we use the top 4 context ids to map address as below
+ * 0x7fffc -  [ 0xc000000000000000 - 0xc0003fffffffffff ]
+ * 0x7fffd -  [ 0xd000000000000000 - 0xd0003fffffffffff ]
+ * 0x7fffe -  [ 0xe000000000000000 - 0xe0003fffffffffff ]
+ * 0x7ffff -  [ 0xf000000000000000 - 0xf0003fffffffffff ]
+ */
+static inline unsigned long get_kernel_vsid(unsigned long ea, int ssize)
+{
+        unsigned long context;
+        /*
+         * kernel take the top 4 context from the available range
+         */
+        context = (MAX_USER_CONTEXT) + ((ea >> 60) - 0xc) + 1;
+        return get_vsid(context, ea, ssize);
+}
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_POWERPC_MMU_HASH64_H_ */
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 75a3d71b895d..19599ef352bc 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -275,7 +275,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .cpu_features           = CPU_FTRS_PPC970,
                .cpu_user_features      = COMMON_USER_POWER4 |
                        PPC_FEATURE_HAS_ALTIVEC_COMP,
-                .mmu_features           = MMU_FTR_HPTE_TABLE,
+                .mmu_features           = MMU_FTRS_PPC970,
                .icache_bsize           = 128,
                .dcache_bsize           = 128,
                .num_pmcs               = 8,
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 87ef8f5ee5bc..200afa5bcfb7 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1452,20 +1452,36 @@ do_ste_alloc:
 _GLOBAL(do_stab_bolted)
        stw     r9,PACA_EXSLB+EX_CCR(r13)       /* save CR in exc. frame */
        std     r11,PACA_EXSLB+EX_SRR0(r13)     /* save SRR0 in exc. frame */
+        mfspr   r11,SPRN_DAR                    /* ea */
+        /*
+         * check for bad kernel/user address
+         * (ea & ~REGION_MASK) >= PGTABLE_RANGE
+         */
+        rldicr. r9,r11,4,(63 - 46 - 4)
+        li      r9,0    /* VSID = 0 for bad address */
+        bne-    0f
+        /*
+         * Calculate VSID:
+         * This is the kernel vsid, we take the top for context from
+         * the range. context = (MAX_USER_CONTEXT) + ((ea >> 60) - 0xc) + 1
+         * Here we know that (ea >> 60) == 0xc
+         */
+        lis     r9,(MAX_USER_CONTEXT + 1)@ha
+        addi    r9,r9,(MAX_USER_CONTEXT + 1)@l
+        srdi    r10,r11,SID_SHIFT
+        rldimi  r10,r9,ESID_BITS,0 /* proto vsid */
+        ASM_VSID_SCRAMBLE(r10, r9, 256M)
+        rldic   r9,r10,12,16    /* r9 = vsid << 12 */
+0:
        /* Hash to the primary group */
        ld      r10,PACASTABVIRT(r13)
-        mfspr   r11,SPRN_DAR
+        srdi    r11,r11,SID_SHIFT
-        srdi    r11,r11,28
        rldimi  r10,r11,7,52    /* r10 = first ste of the group */
-        /* Calculate VSID */
-        /* This is a kernel address, so protovsid = ESID | 1 << 37 */
-        li      r9,0x1
-        rldimi  r11,r9,(CONTEXT_BITS + USER_ESID_BITS),0
-        ASM_VSID_SCRAMBLE(r11, r9, 256M)
-        rldic   r9,r11,12,16    /* r9 = vsid << 12 */
        /* Search the primary group for a free entry */
 1:      ld      r11,0(r10)      /* Test valid bit of the current ste    */
        andi.   r11,r11,0x80
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 7f7fb7fd991b..13f8d168b3f1 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -2832,11 +2832,13 @@ static void unreloc_toc(void)
 {
 }
 #else
-static void __reloc_toc(void *tocstart, unsigned long offset,
+static void __reloc_toc(unsigned long offset, unsigned long nr_entries)
-                        unsigned long nr_entries)
 {
        unsigned long i;
-        unsigned long *toc_entry = (unsigned long *)tocstart;
+        unsigned long *toc_entry;
+        /* Get the start of the TOC by using r2 directly. */
+        asm volatile("addi %0,2,-0x8000" : "=b" (toc_entry));
        for (i = 0; i < nr_entries; i++) {
                *toc_entry = *toc_entry + offset;
@@ -2850,8 +2852,7 @@ static void reloc_toc(void)
        unsigned long nr_entries =
                (__prom_init_toc_end - __prom_init_toc_start) / sizeof(long);
-        /* Need to add offset to get at __prom_init_toc_start */
+        __reloc_toc(offset, nr_entries);
-        __reloc_toc(__prom_init_toc_start + offset, offset, nr_entries);
        mb();
 }
@@ -2864,8 +2865,7 @@ static void unreloc_toc(void)
        mb();
-        /* __prom_init_toc_start has been relocated, no need to add offset */
+        __reloc_toc(-offset, nr_entries);
-        __reloc_toc(__prom_init_toc_start, -offset, nr_entries);
 }
 #endif
 #endif
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 245c1b6a0858..f9b30c68ba47 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1428,6 +1428,7 @@ static long ppc_set_hwdebug(struct task_struct *child,
        brk.address = bp_info->addr & ~7UL;
        brk.type = HW_BRK_TYPE_TRANSLATE;
+        brk.len = 8;
        if (bp_info->trigger_type & PPC_BREAKPOINT_TRIGGER_READ)
                brk.type |= HW_BRK_TYPE_READ;
        if (bp_info->trigger_type & PPC_BREAKPOINT_TRIGGER_WRITE)
diff --git a/arch/powerpc/kvm/book3s_64_mmu_host.c b/arch/powerpc/kvm/book3s_64_mmu_host.c
index ead58e317294..5d7d29a313eb 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_host.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_host.c
@@ -326,8 +326,8 @@ int kvmppc_mmu_init(struct kvm_vcpu *vcpu)
        vcpu3s->context_id[0] = err;
        vcpu3s->proto_vsid_max = ((vcpu3s->context_id[0] + 1)
-                                  << USER_ESID_BITS) - 1;
+                                  << ESID_BITS) - 1;
-        vcpu3s->proto_vsid_first = vcpu3s->context_id[0] << USER_ESID_BITS;
+        vcpu3s->proto_vsid_first = vcpu3s->context_id[0] << ESID_BITS;
        vcpu3s->proto_vsid_next = vcpu3s->proto_vsid_first;
        kvmppc_mmu_hpte_init(vcpu);
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 1b6e1271719f..f410c3e12c1e 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -195,6 +195,11 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend,
                unsigned long vpn  = hpt_vpn(vaddr, vsid, ssize);
                unsigned long tprot = prot;
+                /*
+                 * If we hit a bad address return error.
+                 */
+                if (!vsid)
+                        return -1;
                /* Make kernel text executable */
                if (overlaps_kernel_text(vaddr, vaddr + step))
                        tprot &= ~HPTE_R_N;
@@ -759,6 +764,8 @@ void __init early_init_mmu(void)
        /* Initialize stab / SLB management */
        if (mmu_has_feature(MMU_FTR_SLB))
                slb_initialize();
+        else
+                stab_initialize(get_paca()->stab_real);
 }
 #ifdef CONFIG_SMP
@@ -922,11 +929,6 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
        DBG_LOW("hash_page(ea=%016lx, access=%lx, trap=%lx\n",
                ea, access, trap);
-        if ((ea & ~REGION_MASK) >= PGTABLE_RANGE) {
-                DBG_LOW(" out of pgtable range !\n");
-                return 1;
-        }
        /* Get region & vsid */
        switch (REGION_ID(ea)) {
        case USER_REGION_ID:
@@ -957,6 +959,11 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
        }
        DBG_LOW(" mm=%p, mm->pgdir=%p, vsid=%016lx\n", mm, mm->pgd, vsid);
+        /* Bad address. */
+        if (!vsid) {
+                DBG_LOW("Bad address!\n");
+                return 1;
+        }
        /* Get pgdir */
        pgdir = mm->pgd;
        if (pgdir == NULL)
@@ -1126,6 +1133,8 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
        /* Get VSID */
        ssize = user_segment_size(ea);
        vsid = get_vsid(mm->context.id, ea, ssize);
+        if (!vsid)
+                return;
        /* Hash doesn't like irqs */
        local_irq_save(flags);
@@ -1233,6 +1242,9 @@ static void kernel_map_linear_page(unsigned long vaddr, unsigned long lmi)
        hash = hpt_hash(vpn, PAGE_SHIFT, mmu_kernel_ssize);
        hpteg = ((hash & htab_hash_mask) * HPTES_PER_GROUP);
+        /* Don't create HPTE entries for bad address */
+        if (!vsid)
+                return;
        ret = ppc_md.hpte_insert(hpteg, vpn, __pa(vaddr),
                                 mode, HPTE_V_BOLTED,
                                 mmu_linear_psize, mmu_kernel_ssize);
diff --git a/arch/powerpc/mm/mmu_context_hash64.c b/arch/powerpc/mm/mmu_context_hash64.c
index 40bc5b0ace54..d1d1b92c5b99 100644
--- a/arch/powerpc/mm/mmu_context_hash64.c
+++ b/arch/powerpc/mm/mmu_context_hash64.c
@@ -29,15 +29,6 @@
 static DEFINE_SPINLOCK(mmu_context_lock);
 static DEFINE_IDA(mmu_context_ida);
-/*
- * 256MB segment
- * The proto-VSID space has 2^(CONTEX_BITS + USER_ESID_BITS) - 1 segments
- * available for user mappings. Each segment contains 2^28 bytes. Each
- * context maps 2^46 bytes (64TB) so we can support 2^19-1 contexts
- * (19 == 37 + 28 - 46).
- */
-#define MAX_CONTEXT     ((1UL << CONTEXT_BITS) - 1)
 int __init_new_context(void)
 {
        int index;
@@ -56,7 +47,7 @@ again:
        else if (err)
                return err;
-        if (index > MAX_CONTEXT) {
+        if (index > MAX_USER_CONTEXT) {
                spin_lock(&mmu_context_lock);
                ida_remove(&mmu_context_ida, index);
                spin_unlock(&mmu_context_lock);
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index e212a271c7a4..654258f165ae 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -61,7 +61,7 @@
 #endif
 #ifdef CONFIG_PPC_STD_MMU_64
-#if TASK_SIZE_USER64 > (1UL << (USER_ESID_BITS + SID_SHIFT))
+#if TASK_SIZE_USER64 > (1UL << (ESID_BITS + SID_SHIFT))
 #error TASK_SIZE_USER64 exceeds user VSID range
 #endif
 #endif
diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
index 1a16ca227757..17aa6dfceb34 100644
--- a/arch/powerpc/mm/slb_low.S
+++ b/arch/powerpc/mm/slb_low.S
@@ -31,10 +31,15 @@
 * No other registers are examined or changed.
 */
 _GLOBAL(slb_allocate_realmode)
-        /* r3 = faulting address */
+        /*
+         * check for bad kernel/user address
+         * (ea & ~REGION_MASK) >= PGTABLE_RANGE
+         */
+        rldicr. r9,r3,4,(63 - 46 - 4)
+        bne-    8f
        srdi    r9,r3,60                /* get region */
-        srdi    r10,r3,28               /* get esid */
+        srdi    r10,r3,SID_SHIFT        /* get esid */
        cmpldi  cr7,r9,0xc              /* cmp PAGE_OFFSET for later use */
        /* r3 = address, r10 = esid, cr7 = <> PAGE_OFFSET */
@@ -56,12 +61,14 @@ _GLOBAL(slb_allocate_realmode)
         */
 _GLOBAL(slb_miss_kernel_load_linear)
        li      r11,0
-        li      r9,0x1
        /*
-         * for 1T we shift 12 bits more.  slb_finish_load_1T will do
+         * context = (MAX_USER_CONTEXT) + ((ea >> 60) - 0xc) + 1
-         * the necessary adjustment
+         * r9 = region id.
         */
-        rldimi  r10,r9,(CONTEXT_BITS + USER_ESID_BITS),0
+        addis   r9,r9,(MAX_USER_CONTEXT - 0xc + 1)@ha
+        addi    r9,r9,(MAX_USER_CONTEXT - 0xc + 1)@l
 BEGIN_FTR_SECTION
        b       slb_finish_load
 END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
@@ -91,24 +98,19 @@ _GLOBAL(slb_miss_kernel_load_vmemmap)
        _GLOBAL(slb_miss_kernel_load_io)
        li      r11,0
 6:
-        li      r9,0x1
        /*
-         * for 1T we shift 12 bits more.  slb_finish_load_1T will do
+         * context = (MAX_USER_CONTEXT) + ((ea >> 60) - 0xc) + 1
-         * the necessary adjustment
+         * r9 = region id.
         */
-        rldimi  r10,r9,(CONTEXT_BITS + USER_ESID_BITS),0
+        addis   r9,r9,(MAX_USER_CONTEXT - 0xc + 1)@ha
+        addi    r9,r9,(MAX_USER_CONTEXT - 0xc + 1)@l
 BEGIN_FTR_SECTION
        b       slb_finish_load
 END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
        b       slb_finish_load_1T
-0:      /* user address: proto-VSID = context << 15 | ESID. First check
+0:
-         * if the address is within the boundaries of the user region
-         */
-        srdi.   r9,r10,USER_ESID_BITS
-        bne-    8f                      /* invalid ea bits set */
        /* when using slices, we extract the psize off the slice bitmaps
         * and then we need to get the sllp encoding off the mmu_psize_defs
         * array.
@@ -164,15 +166,13 @@ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
        ld      r9,PACACONTEXTID(r13)
 BEGIN_FTR_SECTION
        cmpldi  r10,0x1000
-END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
-        rldimi  r10,r9,USER_ESID_BITS,0
-BEGIN_FTR_SECTION
        bge     slb_finish_load_1T
 END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
        b       slb_finish_load
 8:      /* invalid EA */
        li      r10,0                   /* BAD_VSID */
+        li      r9,0                    /* BAD_VSID */
        li      r11,SLB_VSID_USER       /* flags don't much matter */
        b       slb_finish_load
@@ -221,8 +221,6 @@ _GLOBAL(slb_allocate_user)
        /* get context to calculate proto-VSID */
        ld      r9,PACACONTEXTID(r13)
-        rldimi  r10,r9,USER_ESID_BITS,0
        /* fall through slb_finish_load */
 #endif /* __DISABLED__ */
@@ -231,9 +229,10 @@ _GLOBAL(slb_allocate_user)
 /*
 * Finish loading of an SLB entry and return
 *
- * r3 = EA, r10 = proto-VSID, r11 = flags, clobbers r9, cr7 = <> PAGE_OFFSET
+ * r3 = EA, r9 = context, r10 = ESID, r11 = flags, clobbers r9, cr7 = <> PAGE_OFFSET
 */
 slb_finish_load:
+        rldimi  r10,r9,ESID_BITS,0
        ASM_VSID_SCRAMBLE(r10,r9,256M)
        /*
         * bits above VSID_BITS_256M need to be ignored from r10
@@ -298,10 +297,11 @@ _GLOBAL(slb_compare_rr_to_size)
 /*
 * Finish loading of a 1T SLB entry (for the kernel linear mapping) and return.
 *
- * r3 = EA, r10 = proto-VSID, r11 = flags, clobbers r9
+ * r3 = EA, r9 = context, r10 = ESID(256MB), r11 = flags, clobbers r9
 */
 slb_finish_load_1T:
-        srdi    r10,r10,40-28           /* get 1T ESID */
+        srdi    r10,r10,(SID_SHIFT_1T - SID_SHIFT)      /* get 1T ESID */
+        rldimi  r10,r9,ESID_BITS_1T,0
        ASM_VSID_SCRAMBLE(r10,r9,1T)
        /*
         * bits above VSID_BITS_1T need to be ignored from r10
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 0d82ef50dc3f..023ec8a13f38 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -82,11 +82,11 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
        if (!is_kernel_addr(addr)) {
                ssize = user_segment_size(addr);
                vsid = get_vsid(mm->context.id, addr, ssize);
-                WARN_ON(vsid == 0);
        } else {
                vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
                ssize = mmu_kernel_ssize;
        }
+        WARN_ON(vsid == 0);
        vpn = hpt_vpn(addr, vsid, ssize);
        rpte = __real_pte(__pte(pte), ptep);
diff --git a/arch/powerpc/perf/power7-pmu.c b/arch/powerpc/perf/power7-pmu.c
index b554879bd31e..3c475d6267c7 100644
--- a/arch/powerpc/perf/power7-pmu.c
+++ b/arch/powerpc/perf/power7-pmu.c
@@ -420,7 +420,20 @@ static struct attribute_group power7_pmu_events_group = {
        .attrs = power7_events_attr,
 };
+PMU_FORMAT_ATTR(event, "config:0-19");
+static struct attribute *power7_pmu_format_attr[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+struct attribute_group power7_pmu_format_group = {
+        .name = "format",
+        .attrs = power7_pmu_format_attr,
+};
 static const struct attribute_group *power7_pmu_attr_groups[] = {
+        &power7_pmu_format_group,
        &power7_pmu_events_group,
        NULL,
 };
diff --git a/arch/powerpc/platforms/85xx/sgy_cts1000.c b/arch/powerpc/platforms/85xx/sgy_cts1000.c
index 611e92f291c4..7179726ba5c5 100644
--- a/arch/powerpc/platforms/85xx/sgy_cts1000.c
+++ b/arch/powerpc/platforms/85xx/sgy_cts1000.c
@@ -69,7 +69,7 @@ static irqreturn_t gpio_halt_irq(int irq, void *__data)
        return IRQ_HANDLED;
 };
-static int __devinit gpio_halt_probe(struct platform_device *pdev)
+static int gpio_halt_probe(struct platform_device *pdev)
 {
        enum of_gpio_flags flags;
        struct device_node *node = pdev->dev.of_node;
@@ -128,7 +128,7 @@ static int __devinit gpio_halt_probe(struct platform_device *pdev)
        return 0;
 }
-static int __devexit gpio_halt_remove(struct platform_device *pdev)
+static int gpio_halt_remove(struct platform_device *pdev)
 {
        if (halt_node) {
                int gpio = of_get_gpio(halt_node, 0);
@@ -165,7 +165,7 @@ static struct platform_driver gpio_halt_driver = {
                .of_match_table = gpio_halt_match,
        },
        .probe          = gpio_halt_probe,
-        .remove         = __devexit_p(gpio_halt_remove),
+        .remove         = gpio_halt_remove,
 };
 module_platform_driver(gpio_halt_driver);
diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index cea2f09c4241..18e3b76c78d7 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype
@@ -124,9 +124,8 @@ config 6xx
        select PPC_HAVE_PMU_SUPPORT
 config POWER3
-        bool
        depends on PPC64 && PPC_BOOK3S
-        default y if !POWER4_ONLY
+        def_bool y
 config POWER4
        depends on PPC64 && PPC_BOOK3S
@@ -145,8 +144,7 @@ config TUNE_CELL
          but somewhat slower on other machines. This option only changes
          the scheduling of instructions, not the selection of instructions
          itself, so the resulting kernel will keep running on all other
-          machines. When building a kernel that is supposed to run only
+          machines.
-          on Cell, you should also select the POWER4_ONLY option.
 # this is temp to handle compat with arch=ppc
 config 8xx
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 4b505370a1d5..eb8fb629f00b 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -134,7 +134,7 @@ config S390
        select HAVE_SYSCALL_WRAPPERS
        select HAVE_UID16 if 32BIT
        select HAVE_VIRT_CPU_ACCOUNTING
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select INIT_ALL_POSSIBLE
        select KTIME_SCALAR if 32BIT
        select MODULES_USE_ELF_RELA
diff --git a/arch/s390/include/asm/cpu_mf.h b/arch/s390/include/asm/cpu_mf.h
index f1eddd150dd7..c879fad404c8 100644
--- a/arch/s390/include/asm/cpu_mf.h
+++ b/arch/s390/include/asm/cpu_mf.h
@@ -12,6 +12,7 @@
 #ifndef _ASM_S390_CPU_MF_H
 #define _ASM_S390_CPU_MF_H
+#include <linux/errno.h>
 #include <asm/facility.h>
 #define CPU_MF_INT_SF_IAE       (1 << 31)       /* invalid entry address */
diff --git a/arch/s390/include/asm/eadm.h b/arch/s390/include/asm/eadm.h
index 8d4847191ecc..dc9200ca32ed 100644
--- a/arch/s390/include/asm/eadm.h
+++ b/arch/s390/include/asm/eadm.h
@@ -34,6 +34,8 @@ struct arsb {
        u32 reserved[4];
 } __packed;
+#define EQC_WR_PROHIBIT 22
 struct msb {
        u8 fmt:4;
        u8 oc:4;
@@ -96,11 +98,13 @@ struct scm_device {
 #define OP_STATE_TEMP_ERR       2
 #define OP_STATE_PERM_ERR       3
+enum scm_event {SCM_CHANGE, SCM_AVAIL};
 struct scm_driver {
        struct device_driver drv;
        int (*probe) (struct scm_device *scmdev);
        int (*remove) (struct scm_device *scmdev);
-        void (*notify) (struct scm_device *scmdev);
+        void (*notify) (struct scm_device *scmdev, enum scm_event event);
        void (*handler) (struct scm_device *scmdev, void *data, int error);
 };
diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
index 1d8fe2b17ef6..6b32af30878c 100644
--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -74,8 +74,6 @@ static inline void __tlb_flush_idte(unsigned long asce)
 static inline void __tlb_flush_mm(struct mm_struct * mm)
 {
-        if (unlikely(cpumask_empty(mm_cpumask(mm))))
-                return;
        /*
         * If the machine has IDTE we prefer to do a per mm flush
         * on all cpus instead of doing a local flush if the mm
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 550228523267..94feff7d6132 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -636,7 +636,8 @@ ENTRY(mcck_int_handler)
        UPDATE_VTIME %r14,%r15,__LC_MCCK_ENTER_TIMER
 mcck_skip:
        SWITCH_ASYNC __LC_GPREGS_SAVE_AREA+32,__LC_PANIC_STACK,PAGE_SHIFT
-        mvc     __PT_R0(64,%r11),__LC_GPREGS_SAVE_AREA
+        stm     %r0,%r7,__PT_R0(%r11)
+        mvc     __PT_R8(32,%r11),__LC_GPREGS_SAVE_AREA+32
        stm     %r8,%r9,__PT_PSW(%r11)
        xc      __SF_BACKCHAIN(4,%r15),__SF_BACKCHAIN(%r15)
        l       %r1,BASED(.Ldo_machine_check)
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 9c837c101297..2e6d60c55f90 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -678,8 +678,9 @@ ENTRY(mcck_int_handler)
        UPDATE_VTIME %r14,__LC_MCCK_ENTER_TIMER
        LAST_BREAK %r14
 mcck_skip:
-        lghi    %r14,__LC_GPREGS_SAVE_AREA
+        lghi    %r14,__LC_GPREGS_SAVE_AREA+64
-        mvc     __PT_R0(128,%r11),0(%r14)
+        stmg    %r0,%r7,__PT_R0(%r11)
+        mvc     __PT_R8(64,%r11),0(%r14)
        stmg    %r8,%r9,__PT_PSW(%r11)
        xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
        lgr     %r2,%r11                # pass pointer to pt_regs
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index a5360de85ec7..29268859d8ee 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -571,6 +571,8 @@ static void __init setup_memory_end(void)
        /* Split remaining virtual space between 1:1 mapping & vmemmap array */
        tmp = VMALLOC_START / (PAGE_SIZE + sizeof(struct page));
+        /* vmemmap contains a multiple of PAGES_PER_SECTION struct pages */
+        tmp = SECTION_ALIGN_UP(tmp);
        tmp = VMALLOC_START - tmp * sizeof(struct page);
        tmp &= ~((vmax >> 11) - 1);     /* align to page table level */
        tmp = min(tmp, 1UL << MAX_PHYSMEM_BITS);
diff --git a/arch/score/Kconfig b/arch/score/Kconfig
index e569aa1fd2ba..c8def8bc9020 100644
--- a/arch/score/Kconfig
+++ b/arch/score/Kconfig
@@ -12,7 +12,7 @@ config SCORE
       select GENERIC_CPU_DEVICES
       select GENERIC_CLOCKEVENTS
       select HAVE_MOD_ARCH_SPECIFIC
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select MODULES_USE_ELF_REL
        select CLONE_BACKWARDS
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 289127d5241c..3d361f236308 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -84,12 +84,6 @@ config ARCH_DEFCONFIG
        default "arch/sparc/configs/sparc32_defconfig" if SPARC32
        default "arch/sparc/configs/sparc64_defconfig" if SPARC64
-# CONFIG_BITS can be used at source level to get 32/64 bits
-config BITS
-        int
-        default 32 if SPARC32
-        default 64 if SPARC64
 config IOMMU_HELPER
        bool
        default y if SPARC64
@@ -197,7 +191,7 @@ config RWSEM_XCHGADD_ALGORITHM
 config GENERIC_HWEIGHT
        bool
-        default y if !ULTRA_HAS_POPULATION_COUNT
+        default y
 config GENERIC_CALIBRATE_DELAY
        bool
diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
index d06a26601753..6b67e50fb9b4 100644
--- a/arch/sparc/include/asm/spitfire.h
+++ b/arch/sparc/include/asm/spitfire.h
@@ -45,6 +45,7 @@
 #define SUN4V_CHIP_NIAGARA3     0x03
 #define SUN4V_CHIP_NIAGARA4     0x04
 #define SUN4V_CHIP_NIAGARA5     0x05
+#define SUN4V_CHIP_SPARC64X     0x8a
 #define SUN4V_CHIP_UNKNOWN      0xff
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
index a6c94a2bf9d4..5c5125895db8 100644
--- a/arch/sparc/kernel/cpu.c
+++ b/arch/sparc/kernel/cpu.c
@@ -493,6 +493,12 @@ static void __init sun4v_cpu_probe(void)
                sparc_pmu_type = "niagara5";
                break;
+        case SUN4V_CHIP_SPARC64X:
+                sparc_cpu_type = "SPARC64-X";
+                sparc_fpu_type = "SPARC64-X integrated FPU";
+                sparc_pmu_type = "sparc64-x";
+                break;
        default:
                printk(KERN_WARNING "CPU: Unknown sun4v cpu type [%s]\n",
                       prom_cpu_compatible);
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 2feb15c35d9e..26b706a1867d 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -134,6 +134,8 @@ prom_niagara_prefix:
        .asciz  "SUNW,UltraSPARC-T"
 prom_sparc_prefix:
        .asciz  "SPARC-"
+prom_sparc64x_prefix:
+        .asciz  "SPARC64-X"
        .align  4
 prom_root_compatible:
        .skip   64
@@ -412,7 +414,7 @@ sun4v_chip_type:
        cmp     %g2, 'T'
        be,pt   %xcc, 70f
         cmp    %g2, 'M'
-        bne,pn  %xcc, 4f
+        bne,pn  %xcc, 49f
         nop
 70:     ldub    [%g1 + 7], %g2
@@ -425,7 +427,7 @@ sun4v_chip_type:
        cmp     %g2, '5'
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA5, %g4
-        ba,pt   %xcc, 4f
+        ba,pt   %xcc, 49f
         nop
 91:     sethi   %hi(prom_cpu_compatible), %g1
@@ -439,6 +441,25 @@ sun4v_chip_type:
         mov    SUN4V_CHIP_NIAGARA2, %g4
        
 4:
+        /* Athena */
+        sethi   %hi(prom_cpu_compatible), %g1
+        or      %g1, %lo(prom_cpu_compatible), %g1
+        sethi   %hi(prom_sparc64x_prefix), %g7
+        or      %g7, %lo(prom_sparc64x_prefix), %g7
+        mov     9, %g3
+41:     ldub    [%g7], %g2
+        ldub    [%g1], %g4
+        cmp     %g2, %g4
+        bne,pn  %icc, 49f
+        add     %g7, 1, %g7
+        subcc   %g3, 1, %g3
+        bne,pt  %xcc, 41b
+        add     %g1, 1, %g1
+        mov     SUN4V_CHIP_SPARC64X, %g4
+        ba,pt   %xcc, 5f
+        nop
+49:
        mov     SUN4V_CHIP_UNKNOWN, %g4
 5:      sethi   %hi(sun4v_chip_type), %g2
        or      %g2, %lo(sun4v_chip_type), %g2
diff --git a/arch/sparc/kernel/leon_pci_grpci2.c b/arch/sparc/kernel/leon_pci_grpci2.c
index fc4320886a3a..4d1487138d26 100644
--- a/arch/sparc/kernel/leon_pci_grpci2.c
+++ b/arch/sparc/kernel/leon_pci_grpci2.c
@@ -186,6 +186,8 @@ struct grpci2_cap_first {
 #define CAP9_IOMAP_OFS 0x20
 #define CAP9_BARSIZE_OFS 0x24
+#define TGT 256
 struct grpci2_priv {
        struct leon_pci_info    info; /* must be on top of this structure */
        struct grpci2_regs      *regs;
@@ -237,8 +239,12 @@ static int grpci2_cfg_r32(struct grpci2_priv *priv, unsigned int bus,
        if (where & 0x3)
                return -EINVAL;
-        if (bus == 0 && PCI_SLOT(devfn) != 0)
+        if (bus == 0) {
-                devfn += (0x8 * 6);
+                devfn += (0x8 * 6); /* start at AD16=Device0 */
+        } else if (bus == TGT) {
+                bus = 0;
+                devfn = 0; /* special case: bridge controller itself */
+        }
        /* Select bus */
        spin_lock_irqsave(&grpci2_dev_lock, flags);
@@ -303,8 +309,12 @@ static int grpci2_cfg_w32(struct grpci2_priv *priv, unsigned int bus,
        if (where & 0x3)
                return -EINVAL;
-        if (bus == 0 && PCI_SLOT(devfn) != 0)
+        if (bus == 0) {
-                devfn += (0x8 * 6);
+                devfn += (0x8 * 6); /* start at AD16=Device0 */
+        } else if (bus == TGT) {
+                bus = 0;
+                devfn = 0; /* special case: bridge controller itself */
+        }
        /* Select bus */
        spin_lock_irqsave(&grpci2_dev_lock, flags);
@@ -368,7 +378,7 @@ static int grpci2_read_config(struct pci_bus *bus, unsigned int devfn,
        unsigned int busno = bus->number;
        int ret;
-        if (PCI_SLOT(devfn) > 15 || (PCI_SLOT(devfn) == 0 && busno == 0)) {
+        if (PCI_SLOT(devfn) > 15 || busno > 255) {
                *val = ~0;
                return 0;
        }
@@ -406,7 +416,7 @@ static int grpci2_write_config(struct pci_bus *bus, unsigned int devfn,
        struct grpci2_priv *priv = grpci2priv;
        unsigned int busno = bus->number;
-        if (PCI_SLOT(devfn) > 15 || (PCI_SLOT(devfn) == 0 && busno == 0))
+        if (PCI_SLOT(devfn) > 15 || busno > 255)
                return 0;
 #ifdef GRPCI2_DEBUG_CFGACCESS
@@ -578,15 +588,15 @@ void grpci2_hw_init(struct grpci2_priv *priv)
                REGSTORE(regs->ahbmst_map[i], priv->pci_area);
        /* Get the GRPCI2 Host PCI ID */
-        grpci2_cfg_r32(priv, 0, 0, PCI_VENDOR_ID, &priv->pciid);
+        grpci2_cfg_r32(priv, TGT, 0, PCI_VENDOR_ID, &priv->pciid);
        /* Get address to first (always defined) capability structure */
-        grpci2_cfg_r8(priv, 0, 0, PCI_CAPABILITY_LIST, &capptr);
+        grpci2_cfg_r8(priv, TGT, 0, PCI_CAPABILITY_LIST, &capptr);
        /* Enable/Disable Byte twisting */
-        grpci2_cfg_r32(priv, 0, 0, capptr+CAP9_IOMAP_OFS, &io_map);
+        grpci2_cfg_r32(priv, TGT, 0, capptr+CAP9_IOMAP_OFS, &io_map);
        io_map = (io_map & ~0x1) | (priv->bt_enabled ? 1 : 0);
-        grpci2_cfg_w32(priv, 0, 0, capptr+CAP9_IOMAP_OFS, io_map);
+        grpci2_cfg_w32(priv, TGT, 0, capptr+CAP9_IOMAP_OFS, io_map);
        /* Setup the Host's PCI Target BARs for other peripherals to access,
         * and do DMA to the host's memory. The target BARs can be sized and
@@ -617,17 +627,18 @@ void grpci2_hw_init(struct grpci2_priv *priv)
                                pciadr = 0;
                        }
                }
-                grpci2_cfg_w32(priv, 0, 0, capptr+CAP9_BARSIZE_OFS+i*4, bar_sz);
+                grpci2_cfg_w32(priv, TGT, 0, capptr+CAP9_BARSIZE_OFS+i*4,
-                grpci2_cfg_w32(priv, 0, 0, PCI_BASE_ADDRESS_0+i*4, pciadr);
+                                bar_sz);
-                grpci2_cfg_w32(priv, 0, 0, capptr+CAP9_BAR_OFS+i*4, ahbadr);
+                grpci2_cfg_w32(priv, TGT, 0, PCI_BASE_ADDRESS_0+i*4, pciadr);
+                grpci2_cfg_w32(priv, TGT, 0, capptr+CAP9_BAR_OFS+i*4, ahbadr);
                printk(KERN_INFO "        TGT BAR[%d]: 0x%08x (PCI)-> 0x%08x\n",
                        i, pciadr, ahbadr);
        }
        /* set as bus master and enable pci memory responses */
-        grpci2_cfg_r32(priv, 0, 0, PCI_COMMAND, &data);
+        grpci2_cfg_r32(priv, TGT, 0, PCI_COMMAND, &data);
        data |= (PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
-        grpci2_cfg_w32(priv, 0, 0, PCI_COMMAND, data);
+        grpci2_cfg_w32(priv, TGT, 0, PCI_COMMAND, data);
        /* Enable Error respone (CPU-TRAP) on illegal memory access. */
        REGSTORE(regs->ctrl, CTRL_ER | CTRL_PE);
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index ff496ab1e794..25877aebc685 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -17,7 +17,7 @@ config TILE
        select GENERIC_IRQ_SHOW
        select HAVE_DEBUG_BUGVERBOSE
        select HAVE_SYSCALL_WRAPPERS if TILEGX
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select SYS_HYPERVISOR
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
        select GENERIC_CLOCKEVENTS
diff --git a/arch/tile/configs/tilegx_defconfig b/arch/tile/configs/tilegx_defconfig
index 8c5eff6d6df5..47684815e5c8 100644
--- a/arch/tile/configs/tilegx_defconfig
+++ b/arch/tile/configs/tilegx_defconfig
@@ -330,7 +330,6 @@ CONFIG_MD_RAID0=m
 CONFIG_MD_RAID1=m
 CONFIG_MD_RAID10=m
 CONFIG_MD_RAID456=m
-CONFIG_MULTICORE_RAID456=y
 CONFIG_MD_FAULTY=m
 CONFIG_BLK_DEV_DM=m
 CONFIG_DM_DEBUG=y
diff --git a/arch/tile/configs/tilepro_defconfig b/arch/tile/configs/tilepro_defconfig
index e7a3dfcbcda7..dd2b8f0c631f 100644
--- a/arch/tile/configs/tilepro_defconfig
+++ b/arch/tile/configs/tilepro_defconfig
@@ -324,7 +324,6 @@ CONFIG_MD_RAID0=m
 CONFIG_MD_RAID1=m
 CONFIG_MD_RAID10=m
 CONFIG_MD_RAID456=m
-CONFIG_MULTICORE_RAID456=y
 CONFIG_MD_FAULTY=m
 CONFIG_BLK_DEV_DM=m
 CONFIG_DM_DEBUG=y
diff --git a/arch/um/drivers/chan.h b/arch/um/drivers/chan.h
index 78f1b8999964..c512b0306dd4 100644
--- a/arch/um/drivers/chan.h
+++ b/arch/um/drivers/chan.h
@@ -37,7 +37,7 @@ extern int console_write_chan(struct chan *chan, const char *buf,
 extern int console_open_chan(struct line *line, struct console *co);
 extern void deactivate_chan(struct chan *chan, int irq);
 extern void reactivate_chan(struct chan *chan, int irq);
-extern void chan_enable_winch(struct chan *chan, struct tty_struct *tty);
+extern void chan_enable_winch(struct chan *chan, struct tty_port *port);
 extern int enable_chan(struct line *line);
 extern void close_chan(struct line *line);
 extern int chan_window_size(struct line *line, 
diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 15c553c239a1..80b47cb71e0a 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -122,10 +122,10 @@ static int open_chan(struct list_head *chans)
        return err;
 }
-void chan_enable_winch(struct chan *chan, struct tty_struct *tty)
+void chan_enable_winch(struct chan *chan, struct tty_port *port)
 {
        if (chan && chan->primary && chan->ops->winch)
-                register_winch(chan->fd, tty);
+                register_winch(chan->fd, port);
 }
 static void line_timer_cb(struct work_struct *work)
diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
index 9be670ad23b5..3fd7c3efdb18 100644
--- a/arch/um/drivers/chan_user.c
+++ b/arch/um/drivers/chan_user.c
@@ -216,7 +216,7 @@ static int winch_thread(void *arg)
        }
 }
-static int winch_tramp(int fd, struct tty_struct *tty, int *fd_out,
+static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
                       unsigned long *stack_out)
 {
        struct winch_data data;
@@ -271,7 +271,7 @@ static int winch_tramp(int fd, struct tty_struct *tty, int *fd_out,
        return err;
 }
-void register_winch(int fd, struct tty_struct *tty)
+void register_winch(int fd, struct tty_port *port)
 {
        unsigned long stack;
        int pid, thread, count, thread_fd = -1;
@@ -281,17 +281,17 @@ void register_winch(int fd, struct tty_struct *tty)
                return;
        pid = tcgetpgrp(fd);
-        if (is_skas_winch(pid, fd, tty)) {
+        if (is_skas_winch(pid, fd, port)) {
-                register_winch_irq(-1, fd, -1, tty, 0);
+                register_winch_irq(-1, fd, -1, port, 0);
                return;
        }
        if (pid == -1) {
-                thread = winch_tramp(fd, tty, &thread_fd, &stack);
+                thread = winch_tramp(fd, port, &thread_fd, &stack);
                if (thread < 0)
                        return;
-                register_winch_irq(thread_fd, fd, thread, tty, stack);
+                register_winch_irq(thread_fd, fd, thread, port, stack);
                count = write(thread_fd, &c, sizeof(c));
                if (count != sizeof(c))
diff --git a/arch/um/drivers/chan_user.h b/arch/um/drivers/chan_user.h
index dc693298eb8f..03f1b565c5f9 100644
--- a/arch/um/drivers/chan_user.h
+++ b/arch/um/drivers/chan_user.h
@@ -38,10 +38,10 @@ extern int generic_window_size(int fd, void *unused, unsigned short *rows_out,
                               unsigned short *cols_out);
 extern void generic_free(void *data);
-struct tty_struct;
+struct tty_port;
-extern void register_winch(int fd,  struct tty_struct *tty);
+extern void register_winch(int fd,  struct tty_port *port);
 extern void register_winch_irq(int fd, int tty_fd, int pid,
-                               struct tty_struct *tty, unsigned long stack);
+                               struct tty_port *port, unsigned long stack);
 #define __channel_help(fn, prefix) \
 __uml_help(fn, prefix "[0-9]*=<channel description>\n" \
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index f1b38571f94e..be541cf69fd2 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -305,7 +305,7 @@ static int line_activate(struct tty_port *port, struct tty_struct *tty)
                return ret;
        if (!line->sigio) {
-                chan_enable_winch(line->chan_out, tty);
+                chan_enable_winch(line->chan_out, port);
                line->sigio = 1;
        }
@@ -315,8 +315,22 @@ static int line_activate(struct tty_port *port, struct tty_struct *tty)
        return 0;
 }
+static void unregister_winch(struct tty_struct *tty);
+static void line_destruct(struct tty_port *port)
+{
+        struct tty_struct *tty = tty_port_tty_get(port);
+        struct line *line = tty->driver_data;
+        if (line->sigio) {
+                unregister_winch(tty);
+                line->sigio = 0;
+        }
+}
 static const struct tty_port_operations line_port_ops = {
        .activate = line_activate,
+        .destruct = line_destruct,
 };
 int line_open(struct tty_struct *tty, struct file *filp)
@@ -340,18 +354,6 @@ int line_install(struct tty_driver *driver, struct tty_struct *tty,
        return 0;
 }
-static void unregister_winch(struct tty_struct *tty);
-void line_cleanup(struct tty_struct *tty)
-{
-        struct line *line = tty->driver_data;
-        if (line->sigio) {
-                unregister_winch(tty);
-                line->sigio = 0;
-        }
-}
 void line_close(struct tty_struct *tty, struct file * filp)
 {
        struct line *line = tty->driver_data;
@@ -601,7 +603,7 @@ struct winch {
        int fd;
        int tty_fd;
        int pid;
-        struct tty_struct *tty;
+        struct tty_port *port;
        unsigned long stack;
        struct work_struct work;
 };
@@ -655,7 +657,7 @@ static irqreturn_t winch_interrupt(int irq, void *data)
                        goto out;
                }
        }
-        tty = winch->tty;
+        tty = tty_port_tty_get(winch->port);
        if (tty != NULL) {
                line = tty->driver_data;
                if (line != NULL) {
@@ -663,6 +665,7 @@ static irqreturn_t winch_interrupt(int irq, void *data)
                                         &tty->winsize.ws_col);
                        kill_pgrp(tty->pgrp, SIGWINCH, 1);
                }
+                tty_kref_put(tty);
        }
 out:
        if (winch->fd != -1)
@@ -670,7 +673,7 @@ static irqreturn_t winch_interrupt(int irq, void *data)
        return IRQ_HANDLED;
 }
-void register_winch_irq(int fd, int tty_fd, int pid, struct tty_struct *tty,
+void register_winch_irq(int fd, int tty_fd, int pid, struct tty_port *port,
                        unsigned long stack)
 {
        struct winch *winch;
@@ -685,7 +688,7 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_struct *tty,
                                   .fd          = fd,
                                   .tty_fd      = tty_fd,
                                   .pid         = pid,
-                                   .tty         = tty,
+                                   .port        = port,
                                   .stack       = stack });
        if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
@@ -714,15 +717,18 @@ static void unregister_winch(struct tty_struct *tty)
 {
        struct list_head *ele, *next;
        struct winch *winch;
+        struct tty_struct *wtty;
        spin_lock(&winch_handler_lock);
        list_for_each_safe(ele, next, &winch_handlers) {
                winch = list_entry(ele, struct winch, list);
-                if (winch->tty == tty) {
+                wtty = tty_port_tty_get(winch->port);
+                if (wtty == tty) {
                        free_winch(winch);
                        break;
                }
+                tty_kref_put(wtty);
        }
        spin_unlock(&winch_handler_lock);
 }
diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index d8926c303629..39f186252e02 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -218,6 +218,7 @@ static int uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
        spin_lock_irqsave(&lp->lock, flags);
        len = (*lp->write)(lp->fd, skb, lp);
+        skb_tx_timestamp(skb);
        if (len == skb->len) {
                dev->stats.tx_packets++;
@@ -281,6 +282,7 @@ static void uml_net_get_drvinfo(struct net_device *dev,
 static const struct ethtool_ops uml_net_ethtool_ops = {
        .get_drvinfo    = uml_net_get_drvinfo,
        .get_link       = ethtool_op_get_link,
+        .get_ts_info    = ethtool_op_get_ts_info,
 };
 static void uml_net_user_timer_expire(unsigned long _conn)
diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
index 16fdd0a0f9d6..b8d14fa52059 100644
--- a/arch/um/drivers/ssl.c
+++ b/arch/um/drivers/ssl.c
@@ -105,7 +105,6 @@ static const struct tty_operations ssl_ops = {
        .throttle               = line_throttle,
        .unthrottle             = line_unthrottle,
        .install                = ssl_install,
-        .cleanup                = line_cleanup,
        .hangup                 = line_hangup,
 };
diff --git a/arch/um/drivers/stdio_console.c b/arch/um/drivers/stdio_console.c
index 827777af3f6d..7b361f36ca96 100644
--- a/arch/um/drivers/stdio_console.c
+++ b/arch/um/drivers/stdio_console.c
@@ -110,7 +110,6 @@ static const struct tty_operations console_ops = {
        .set_termios            = line_set_termios,
        .throttle               = line_throttle,
        .unthrottle             = line_unthrottle,
-        .cleanup                = line_cleanup,
        .hangup                 = line_hangup,
 };
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index b1469fe93295..9d9f1b4bf826 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -15,7 +15,7 @@
 #include <sysdep/mcontext.h>
 #include "internal.h"
-void (*sig_info[NSIG])(int, siginfo_t *, struct uml_pt_regs *) = {
+void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *) = {
        [SIGTRAP]       = relay_signal,
        [SIGFPE]        = relay_signal,
        [SIGILL]        = relay_signal,
diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
index da4b9e9999fd..337518c5042a 100644
--- a/arch/um/os-Linux/start_up.c
+++ b/arch/um/os-Linux/start_up.c
@@ -15,6 +15,8 @@
 #include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
+#include <sys/time.h>
+#include <sys/resource.h>
 #include <asm/unistd.h>
 #include <init.h>
 #include <os.h>
diff --git a/arch/unicore32/Kconfig b/arch/unicore32/Kconfig
index dc50b157fc83..2943e3acdf0c 100644
--- a/arch/unicore32/Kconfig
+++ b/arch/unicore32/Kconfig
@@ -9,7 +9,7 @@ config UNICORE32
        select GENERIC_ATOMIC64
        select HAVE_KERNEL_LZO
        select HAVE_KERNEL_LZMA
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select ARCH_HAVE_CUSTOM_GPIO_H
        select GENERIC_FIND_FIRST_BIT
        select GENERIC_IRQ_PROBE
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index a4f24f5b1218..70c0f3da0476 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -112,7 +112,7 @@ config X86
        select GENERIC_STRNLEN_USER
        select HAVE_CONTEXT_TRACKING if X86_64
        select HAVE_IRQ_TIME_ACCOUNTING
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select MODULES_USE_ELF_REL if X86_32
        select MODULES_USE_ELF_RELA if X86_64
        select CLONE_BACKWARDS if X86_32
diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
index d3ddd17405d0..5a6d2873f80e 100644
--- a/arch/x86/include/asm/kprobes.h
+++ b/arch/x86/include/asm/kprobes.h
@@ -77,6 +77,7 @@ struct arch_specific_insn {
         * a post_handler or break_handler).
         */
        int boostable;
+        bool if_modifier;
 };
 struct arch_optimized_insn {
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 635a74d22409..4979778cc7fb 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -414,8 +414,8 @@ struct kvm_vcpu_arch {
        gpa_t time;
        struct pvclock_vcpu_time_info hv_clock;
        unsigned int hw_tsc_khz;
-        unsigned int time_offset;
+        struct gfn_to_hva_cache pv_time;
-        struct page *time_page;
+        bool pv_time_enabled;
        /* set guest stopped flag in pvclock flags field */
        bool pvclock_set_guest_stopped_request;
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 529c8931fc02..dab7580c47ae 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -101,6 +101,10 @@ static struct event_constraint intel_snb_event_constraints[] __read_mostly =
        FIXED_EVENT_CONSTRAINT(0x00c0, 0), /* INST_RETIRED.ANY */
        FIXED_EVENT_CONSTRAINT(0x003c, 1), /* CPU_CLK_UNHALTED.CORE */
        FIXED_EVENT_CONSTRAINT(0x0300, 2), /* CPU_CLK_UNHALTED.REF */
+        INTEL_UEVENT_CONSTRAINT(0x04a3, 0xf), /* CYCLE_ACTIVITY.CYCLES_NO_DISPATCH */
+        INTEL_UEVENT_CONSTRAINT(0x05a3, 0xf), /* CYCLE_ACTIVITY.STALLS_L2_PENDING */
+        INTEL_UEVENT_CONSTRAINT(0x02a3, 0x4), /* CYCLE_ACTIVITY.CYCLES_L1D_PENDING */
+        INTEL_UEVENT_CONSTRAINT(0x06a3, 0x4), /* CYCLE_ACTIVITY.STALLS_L1D_PENDING */
        INTEL_EVENT_CONSTRAINT(0x48, 0x4), /* L1D_PEND_MISS.PENDING */
        INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PREC_DIST */
        INTEL_EVENT_CONSTRAINT(0xcd, 0x8), /* MEM_TRANS_RETIRED.LOAD_LATENCY */
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 826054a4f2ee..b05a575d56f4 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -729,3 +729,13 @@ void intel_ds_init(void)
                }
        }
 }
+void perf_restore_debug_store(void)
+{
+        struct debug_store *ds = __this_cpu_read(cpu_hw_events.ds);
+        if (!x86_pmu.bts && !x86_pmu.pebs)
+                return;
+        wrmsrl(MSR_IA32_DS_AREA, (unsigned long)ds);
+}
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 3f06e6149981..7bfe318d3d8a 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -375,6 +375,9 @@ static void __kprobes arch_copy_kprobe(struct kprobe *p)
        else
                p->ainsn.boostable = -1;
+        /* Check whether the instruction modifies Interrupt Flag or not */
+        p->ainsn.if_modifier = is_IF_modifier(p->ainsn.insn);
        /* Also, displacement change doesn't affect the first byte */
        p->opcode = p->ainsn.insn[0];
 }
@@ -434,7 +437,7 @@ static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
        __this_cpu_write(current_kprobe, p);
        kcb->kprobe_saved_flags = kcb->kprobe_old_flags
                = (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF));
-        if (is_IF_modifier(p->ainsn.insn))
+        if (p->ainsn.if_modifier)
                kcb->kprobe_saved_flags &= ~X86_EFLAGS_IF;
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index f71500af1f81..f19ac0aca60d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1406,25 +1406,15 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
        unsigned long flags, this_tsc_khz;
        struct kvm_vcpu_arch *vcpu = &v->arch;
        struct kvm_arch *ka = &v->kvm->arch;
-        void *shared_kaddr;
        s64 kernel_ns, max_kernel_ns;
        u64 tsc_timestamp, host_tsc;
-        struct pvclock_vcpu_time_info *guest_hv_clock;
+        struct pvclock_vcpu_time_info guest_hv_clock;
        u8 pvclock_flags;
        bool use_master_clock;
        kernel_ns = 0;
        host_tsc = 0;
-        /* Keep irq disabled to prevent changes to the clock */
-        local_irq_save(flags);
-        this_tsc_khz = __get_cpu_var(cpu_tsc_khz);
-        if (unlikely(this_tsc_khz == 0)) {
-                local_irq_restore(flags);
-                kvm_make_request(KVM_REQ_CLOCK_UPDATE, v);
-                return 1;
-        }
        /*
         * If the host uses TSC clock, then passthrough TSC as stable
         * to the guest.
@@ -1436,6 +1426,15 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
                kernel_ns = ka->master_kernel_ns;
        }
        spin_unlock(&ka->pvclock_gtod_sync_lock);
+        /* Keep irq disabled to prevent changes to the clock */
+        local_irq_save(flags);
+        this_tsc_khz = __get_cpu_var(cpu_tsc_khz);
+        if (unlikely(this_tsc_khz == 0)) {
+                local_irq_restore(flags);
+                kvm_make_request(KVM_REQ_CLOCK_UPDATE, v);
+                return 1;
+        }
        if (!use_master_clock) {
                host_tsc = native_read_tsc();
                kernel_ns = get_kernel_ns();
@@ -1463,7 +1462,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
        local_irq_restore(flags);
-        if (!vcpu->time_page)
+        if (!vcpu->pv_time_enabled)
                return 0;
        /*
@@ -1525,12 +1524,12 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
         */
        vcpu->hv_clock.version += 2;
-        shared_kaddr = kmap_atomic(vcpu->time_page);
+        if (unlikely(kvm_read_guest_cached(v->kvm, &vcpu->pv_time,
+                &guest_hv_clock, sizeof(guest_hv_clock))))
-        guest_hv_clock = shared_kaddr + vcpu->time_offset;
+                return 0;
        /* retain PVCLOCK_GUEST_STOPPED if set in guest copy */
-        pvclock_flags = (guest_hv_clock->flags & PVCLOCK_GUEST_STOPPED);
+        pvclock_flags = (guest_hv_clock.flags & PVCLOCK_GUEST_STOPPED);
        if (vcpu->pvclock_set_guest_stopped_request) {
                pvclock_flags |= PVCLOCK_GUEST_STOPPED;
@@ -1543,12 +1542,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
        vcpu->hv_clock.flags = pvclock_flags;
-        memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
+        kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
-               sizeof(vcpu->hv_clock));
+                                &vcpu->hv_clock,
+                                sizeof(vcpu->hv_clock));
-        kunmap_atomic(shared_kaddr);
-        mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
        return 0;
 }
@@ -1837,10 +1833,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
 static void kvmclock_reset(struct kvm_vcpu *vcpu)
 {
-        if (vcpu->arch.time_page) {
+        vcpu->arch.pv_time_enabled = false;
-                kvm_release_page_dirty(vcpu->arch.time_page);
-                vcpu->arch.time_page = NULL;
-        }
 }
 static void accumulate_steal_time(struct kvm_vcpu *vcpu)
@@ -1947,6 +1940,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                break;
        case MSR_KVM_SYSTEM_TIME_NEW:
        case MSR_KVM_SYSTEM_TIME: {
+                u64 gpa_offset;
                kvmclock_reset(vcpu);
                vcpu->arch.time = data;
@@ -1956,14 +1950,17 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                if (!(data & 1))
                        break;
-                /* ...but clean it before doing the actual write */
+                gpa_offset = data & ~(PAGE_MASK | 1);
-                vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
-                vcpu->arch.time_page =
+                /* Check that the address is 32-byte aligned. */
-                                gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
+                if (gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1))
+                        break;
-                if (is_error_page(vcpu->arch.time_page))
+                if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
-                        vcpu->arch.time_page = NULL;
+                     &vcpu->arch.pv_time, data & ~1ULL))
+                        vcpu->arch.pv_time_enabled = false;
+                else
+                        vcpu->arch.pv_time_enabled = true;
                break;
        }
@@ -2967,7 +2964,7 @@ static int kvm_vcpu_ioctl_x86_set_xcrs(struct kvm_vcpu *vcpu,
 */
 static int kvm_set_guest_paused(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->arch.time_page)
+        if (!vcpu->arch.pv_time_enabled)
                return -EINVAL;
        vcpu->arch.pvclock_set_guest_stopped_request = true;
        kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
@@ -6718,6 +6715,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
                goto fail_free_wbinvd_dirty_mask;
        vcpu->arch.ia32_tsc_adjust_msr = 0x0;
+        vcpu->arch.pv_time_enabled = false;
        kvm_async_pf_hash_reset(vcpu);
        kvm_pmu_init(vcpu);
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index 120cee1c3f8d..3c68768d7a75 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -11,6 +11,7 @@
 #include <linux/suspend.h>
 #include <linux/export.h>
 #include <linux/smp.h>
+#include <linux/perf_event.h>
 #include <asm/pgtable.h>
 #include <asm/proto.h>
@@ -228,6 +229,7 @@ static void __restore_processor_state(struct saved_context *ctxt)
        do_fpu_end();
        x86_platform.restore_sched_clock_state();
        mtrr_bp_restore();
+        perf_restore_debug_store();
 }
 /* Needed by apm.c */
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 35876ffac11d..b09de49dbec5 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -9,7 +9,7 @@ config XTENSA
        select HAVE_IDE
        select GENERIC_ATOMIC64
        select HAVE_GENERIC_HARDIRQS
-        select HAVE_VIRT_TO_BUS
+        select VIRT_TO_BUS
        select GENERIC_IRQ_SHOW
        select GENERIC_CPU_DEVICES
        select MODULES_USE_ELF_RELA
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 53e7ac9403a7..e854582f29a6 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -465,7 +465,7 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
        return result;
 }
-static int acpi_processor_get_performance_info(struct acpi_processor *pr)
+int acpi_processor_get_performance_info(struct acpi_processor *pr)
 {
        int result = 0;
        acpi_status status = AE_OK;
@@ -509,7 +509,7 @@ static int acpi_processor_get_performance_info(struct acpi_processor *pr)
 #endif
        return result;
 }
+EXPORT_SYMBOL_GPL(acpi_processor_get_performance_info);
 int acpi_processor_notify_smm(struct module *calling_module)
 {
        acpi_status status;
diff --git a/drivers/amba/tegra-ahb.c b/drivers/amba/tegra-ahb.c
index 093c43554963..1f44e56cc65d 100644
--- a/drivers/amba/tegra-ahb.c
+++ b/drivers/amba/tegra-ahb.c
@@ -158,7 +158,7 @@ int tegra_ahb_enable_smmu(struct device_node *dn)
 EXPORT_SYMBOL(tegra_ahb_enable_smmu);
 #endif
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
 static int tegra_ahb_suspend(struct device *dev)
 {
        int i;
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 3e751b74615e..a5a3ebcbdd2c 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -59,15 +59,16 @@ config ATA_ACPI
          option libata.noacpi=1
 config SATA_ZPODD
-        bool "SATA Zero Power ODD Support"
+        bool "SATA Zero Power Optical Disc Drive (ZPODD) support"
        depends on ATA_ACPI
        default n
        help
-          This option adds support for SATA ZPODD. It requires both
+          This option adds support for SATA Zero Power Optical Disc
-          ODD and the platform support, and if enabled, will automatically
+          Drive (ZPODD). It requires both the ODD and the platform
-          power on/off the ODD when certain condition is satisfied. This
+          support, and if enabled, will automatically power on/off the
-          does not impact user's experience of the ODD, only power is saved
+          ODD when certain condition is satisfied. This does not impact
-          when ODD is not in use(i.e. no disc inside).
+          end user's experience of the ODD, only power is saved when
+          the ODD is not in use (i.e. no disc inside).
          If unsure, say N.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index a99112cfd8b1..6a67b07de494 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -281,6 +281,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
        { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
        { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
+        { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Wellsburg RAID */
+        { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Wellsburg RAID */
        { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
        { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
        { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index d2ba439cfe54..ffdd32d22602 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -1547,6 +1547,10 @@ static bool piix_broken_system_poweroff(struct pci_dev *pdev)
 static int prefer_ms_hyperv = 1;
 module_param(prefer_ms_hyperv, int, 0);
+MODULE_PARM_DESC(prefer_ms_hyperv,
+        "Prefer Hyper-V paravirtualization drivers instead of ATA, "
+        "0 - Use ATA drivers, "
+        "1 (Default) - Use the paravirtualization drivers.");
 static void piix_ignore_devices_quirk(struct ata_host *host)
 {
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index beea3115577e..8a52dab412e2 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1027,7 +1027,7 @@ static void ata_acpi_register_power_resource(struct ata_device *dev)
        handle = ata_dev_acpi_handle(dev);
        if (handle)
-                acpi_dev_pm_remove_dependent(handle, &sdev->sdev_gendev);
+                acpi_dev_pm_add_dependent(handle, &sdev->sdev_gendev);
 }
 static void ata_acpi_unregister_power_resource(struct ata_device *dev)
diff --git a/drivers/ata/pata_samsung_cf.c b/drivers/ata/pata_samsung_cf.c
index 70b0e01372b3..6ef27e98c508 100644
--- a/drivers/ata/pata_samsung_cf.c
+++ b/drivers/ata/pata_samsung_cf.c
@@ -661,18 +661,7 @@ static struct platform_driver pata_s3c_driver = {
        },
 };
-static int __init pata_s3c_init(void)
+module_platform_driver_probe(pata_s3c_driver, pata_s3c_probe);
-{
-        return platform_driver_probe(&pata_s3c_driver, pata_s3c_probe);
-}
-static void __exit pata_s3c_exit(void)
-{
-        platform_driver_unregister(&pata_s3c_driver);
-}
-module_init(pata_s3c_init);
-module_exit(pata_s3c_exit);
 MODULE_AUTHOR("Abhilash Kesavan, <a.kesavan@samsung.com>");
 MODULE_DESCRIPTION("low-level driver for Samsung PATA controller");
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 124b2c1d9c0b..608f82fed632 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1511,8 +1511,7 @@ error_exit_with_cleanup:
        if (hcr_base)
                iounmap(hcr_base);
-        if (host_priv)
+        kfree(host_priv);
-                kfree(host_priv);
        return retval;
 }
diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index 07fb2dfaae13..9dcefe40380b 100644
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -135,6 +135,7 @@ static inline void _nvme_check_size(void)
        BUILD_BUG_ON(sizeof(struct nvme_id_ctrl) != 4096);
        BUILD_BUG_ON(sizeof(struct nvme_id_ns) != 4096);
        BUILD_BUG_ON(sizeof(struct nvme_lba_range_type) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_smart_log) != 512);
 }
 typedef void (*nvme_completion_fn)(struct nvme_dev *, void *,
@@ -237,7 +238,8 @@ static void *free_cmdid(struct nvme_queue *nvmeq, int cmdid,
                *fn = special_completion;
                return CMD_CTX_INVALID;
        }
-        *fn = info[cmdid].fn;
+        if (fn)
+                *fn = info[cmdid].fn;
        ctx = info[cmdid].ctx;
        info[cmdid].fn = special_completion;
        info[cmdid].ctx = CMD_CTX_COMPLETED;
@@ -335,6 +337,7 @@ nvme_alloc_iod(unsigned nseg, unsigned nbytes, gfp_t gfp)
                iod->offset = offsetof(struct nvme_iod, sg[nseg]);
                iod->npages = -1;
                iod->length = nbytes;
+                iod->nents = 0;
        }
        return iod;
@@ -375,7 +378,8 @@ static void bio_completion(struct nvme_dev *dev, void *ctx,
        struct bio *bio = iod->private;
        u16 status = le16_to_cpup(&cqe->status) >> 1;
-        dma_unmap_sg(&dev->pci_dev->dev, iod->sg, iod->nents,
+        if (iod->nents)
+                dma_unmap_sg(&dev->pci_dev->dev, iod->sg, iod->nents,
                        bio_data_dir(bio) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
        nvme_free_iod(dev, iod);
        if (status) {
@@ -589,7 +593,7 @@ static int nvme_submit_bio_queue(struct nvme_queue *nvmeq, struct nvme_ns *ns,
        result = nvme_map_bio(nvmeq->q_dmadev, iod, bio, dma_dir, psegs);
        if (result < 0)
-                goto free_iod;
+                goto free_cmdid;
        length = result;
        cmnd->rw.command_id = cmdid;
@@ -609,6 +613,8 @@ static int nvme_submit_bio_queue(struct nvme_queue *nvmeq, struct nvme_ns *ns,
        return 0;
+ free_cmdid:
+        free_cmdid(nvmeq, cmdid, NULL);
 free_iod:
        nvme_free_iod(nvmeq->dev, iod);
 nomem:
@@ -835,8 +841,8 @@ static int nvme_identify(struct nvme_dev *dev, unsigned nsid, unsigned cns,
        return nvme_submit_admin_cmd(dev, &c, NULL);
 }
-static int nvme_get_features(struct nvme_dev *dev, unsigned fid,
+static int nvme_get_features(struct nvme_dev *dev, unsigned fid, unsigned nsid,
-                                unsigned nsid, dma_addr_t dma_addr)
+                                        dma_addr_t dma_addr, u32 *result)
 {
        struct nvme_command c;
@@ -846,7 +852,7 @@ static int nvme_get_features(struct nvme_dev *dev, unsigned fid,
        c.features.prp1 = cpu_to_le64(dma_addr);
        c.features.fid = cpu_to_le32(fid);
-        return nvme_submit_admin_cmd(dev, &c, NULL);
+        return nvme_submit_admin_cmd(dev, &c, result);
 }
 static int nvme_set_features(struct nvme_dev *dev, unsigned fid,
@@ -906,6 +912,10 @@ static void nvme_free_queue(struct nvme_dev *dev, int qid)
        spin_lock_irq(&nvmeq->q_lock);
        nvme_cancel_ios(nvmeq, false);
+        while (bio_list_peek(&nvmeq->sq_cong)) {
+                struct bio *bio = bio_list_pop(&nvmeq->sq_cong);
+                bio_endio(bio, -EIO);
+        }
        spin_unlock_irq(&nvmeq->q_lock);
        irq_set_affinity_hint(vector, NULL);
@@ -1230,12 +1240,17 @@ static int nvme_user_admin_cmd(struct nvme_dev *dev,
        if (length != cmd.data_len)
                status = -ENOMEM;
        else
-                status = nvme_submit_admin_cmd(dev, &c, NULL);
+                status = nvme_submit_admin_cmd(dev, &c, &cmd.result);
        if (cmd.data_len) {
                nvme_unmap_user_pages(dev, cmd.opcode & 1, iod);
                nvme_free_iod(dev, iod);
        }
+        if (!status && copy_to_user(&ucmd->result, &cmd.result,
+                                                        sizeof(cmd.result)))
+                status = -EFAULT;
        return status;
 }
@@ -1523,9 +1538,9 @@ static int nvme_dev_add(struct nvme_dev *dev)
                        continue;
                res = nvme_get_features(dev, NVME_FEAT_LBA_RANGE, i,
-                                                        dma_addr + 4096);
+                                                        dma_addr + 4096, NULL);
                if (res)
-                        continue;
+                        memset(mem + 4096, 0, 4096);
                ns = nvme_alloc_ns(dev, i, mem, mem + 4096);
                if (ns)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a8a41e07a221..b282af181b44 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -74,8 +74,10 @@ static struct usb_device_id ath3k_table[] = {
        /* Atheros AR3012 with sflash firmware*/
        { USB_DEVICE(0x0CF3, 0x3004) },
+        { USB_DEVICE(0x0CF3, 0x3008) },
        { USB_DEVICE(0x0CF3, 0x311D) },
        { USB_DEVICE(0x13d3, 0x3375) },
+        { USB_DEVICE(0x04CA, 0x3004) },
        { USB_DEVICE(0x04CA, 0x3005) },
        { USB_DEVICE(0x04CA, 0x3006) },
        { USB_DEVICE(0x04CA, 0x3008) },
@@ -106,8 +108,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
        /* Atheros AR3012 with sflash firmware*/
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7e351e345476..e547851870e7 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -132,8 +132,10 @@ static struct usb_device_id blacklist_table[] = {
        /* Atheros 3012 with sflash firmware */
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index 0f51ed687dc8..b05ecab915c4 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -4,6 +4,13 @@
 menu "Bus devices"
+config MVEBU_MBUS
+        bool
+        depends on PLAT_ORION
+        help
+          Driver needed for the MBus configuration on Marvell EBU SoCs
+          (Kirkwood, Dove, Orion5x, MV78XX0 and Armada 370/XP).
 config OMAP_OCP2SCP
        tristate "OMAP OCP2SCP DRIVER"
        depends on ARCH_OMAP2PLUS
diff --git a/drivers/bus/Makefile b/drivers/bus/Makefile
index 45d997c85453..3c7b53c12091 100644
--- a/drivers/bus/Makefile
+++ b/drivers/bus/Makefile
@@ -2,6 +2,7 @@
 # Makefile for the bus drivers.
 #
+obj-$(CONFIG_MVEBU_MBUS) += mvebu-mbus.o
 obj-$(CONFIG_OMAP_OCP2SCP)      += omap-ocp2scp.o
 # Interconnect bus driver for OMAP SoCs.
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
new file mode 100644
index 000000000000..8740f46b4d0d
--- /dev/null
+++ b/drivers/bus/mvebu-mbus.c
@@ -0,0 +1,870 @@
+/*
+ * Address map functions for Marvell EBU SoCs (Kirkwood, Armada
+ * 370/XP, Dove, Orion5x and MV78xx0)
+ *
+ * This file is licensed under the terms of the GNU General Public
+ * License version 2.  This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ *
+ * The Marvell EBU SoCs have a configurable physical address space:
+ * the physical address at which certain devices (PCIe, NOR, NAND,
+ * etc.) sit can be configured. The configuration takes place through
+ * two sets of registers:
+ *
+ * - One to configure the access of the CPU to the devices. Depending
+ *   on the families, there are between 8 and 20 configurable windows,
+ *   each can be use to create a physical memory window that maps to a
+ *   specific device. Devices are identified by a tuple (target,
+ *   attribute).
+ *
+ * - One to configure the access to the CPU to the SDRAM. There are
+ *   either 2 (for Dove) or 4 (for other families) windows to map the
+ *   SDRAM into the physical address space.
+ *
+ * This driver:
+ *
+ * - Reads out the SDRAM address decoding windows at initialization
+ *   time, and fills the mvebu_mbus_dram_info structure with these
+ *   informations. The exported function mv_mbus_dram_info() allow
+ *   device drivers to get those informations related to the SDRAM
+ *   address decoding windows. This is because devices also have their
+ *   own windows (configured through registers that are part of each
+ *   device register space), and therefore the drivers for Marvell
+ *   devices have to configure those device -> SDRAM windows to ensure
+ *   that DMA works properly.
+ *
+ * - Provides an API for platform code or device drivers to
+ *   dynamically add or remove address decoding windows for the CPU ->
+ *   device accesses. This API is mvebu_mbus_add_window(),
+ *   mvebu_mbus_add_window_remap_flags() and
+ *   mvebu_mbus_del_window(). Since the (target, attribute) values
+ *   differ from one SoC family to another, the API uses a 'const char
+ *   *' string to identify devices, and this driver is responsible for
+ *   knowing the mapping between the name of a device and its
+ *   corresponding (target, attribute) in the current SoC family.
+ *
+ * - Provides a debugfs interface in /sys/kernel/debug/mvebu-mbus/ to
+ *   see the list of CPU -> SDRAM windows and their configuration
+ *   (file 'sdram') and the list of CPU -> devices windows and their
+ *   configuration (file 'devices').
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/mbus.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/debugfs.h>
+/*
+ * DDR target is the same on all platforms.
+ */
+#define TARGET_DDR              0
+/*
+ * CPU Address Decode Windows registers
+ */
+#define WIN_CTRL_OFF            0x0000
+#define   WIN_CTRL_ENABLE       BIT(0)
+#define   WIN_CTRL_TGT_MASK     0xf0
+#define   WIN_CTRL_TGT_SHIFT    4
+#define   WIN_CTRL_ATTR_MASK    0xff00
+#define   WIN_CTRL_ATTR_SHIFT   8
+#define   WIN_CTRL_SIZE_MASK    0xffff0000
+#define   WIN_CTRL_SIZE_SHIFT   16
+#define WIN_BASE_OFF            0x0004
+#define   WIN_BASE_LOW          0xffff0000
+#define   WIN_BASE_HIGH         0xf
+#define WIN_REMAP_LO_OFF        0x0008
+#define   WIN_REMAP_LOW         0xffff0000
+#define WIN_REMAP_HI_OFF        0x000c
+#define ATTR_HW_COHERENCY       (0x1 << 4)
+#define DDR_BASE_CS_OFF(n)      (0x0000 + ((n) << 3))
+#define  DDR_BASE_CS_HIGH_MASK  0xf
+#define  DDR_BASE_CS_LOW_MASK   0xff000000
+#define DDR_SIZE_CS_OFF(n)      (0x0004 + ((n) << 3))
+#define  DDR_SIZE_ENABLED       BIT(0)
+#define  DDR_SIZE_CS_MASK       0x1c
+#define  DDR_SIZE_CS_SHIFT      2
+#define  DDR_SIZE_MASK          0xff000000
+#define DOVE_DDR_BASE_CS_OFF(n) ((n) << 4)
+struct mvebu_mbus_mapping {
+        const char *name;
+        u8 target;
+        u8 attr;
+        u8 attrmask;
+};
+/*
+ * Masks used for the 'attrmask' field of mvebu_mbus_mapping. They
+ * allow to get the real attribute value, discarding the special bits
+ * used to select a PCI MEM region or a PCI WA region. This allows the
+ * debugfs code to reverse-match the name of a device from its
+ * target/attr values.
+ *
+ * For all devices except PCI, all bits of 'attr' must be
+ * considered. For most SoCs, only bit 3 should be ignored (it allows
+ * to select between PCI MEM and PCI I/O). On Orion5x however, there
+ * is the special bit 5 to select a PCI WA region.
+ */
+#define MAPDEF_NOMASK       0xff
+#define MAPDEF_PCIMASK      0xf7
+#define MAPDEF_ORIONPCIMASK 0xd7
+/* Macro used to define one mvebu_mbus_mapping entry */
+#define MAPDEF(__n, __t, __a, __m) \
+        { .name = __n, .target = __t, .attr = __a, .attrmask = __m }
+struct mvebu_mbus_state;
+struct mvebu_mbus_soc_data {
+        unsigned int num_wins;
+        unsigned int num_remappable_wins;
+        unsigned int (*win_cfg_offset)(const int win);
+        void (*setup_cpu_target)(struct mvebu_mbus_state *s);
+        int (*show_cpu_target)(struct mvebu_mbus_state *s,
+                               struct seq_file *seq, void *v);
+        const struct mvebu_mbus_mapping *map;
+};
+struct mvebu_mbus_state {
+        void __iomem *mbuswins_base;
+        void __iomem *sdramwins_base;
+        struct dentry *debugfs_root;
+        struct dentry *debugfs_sdram;
+        struct dentry *debugfs_devs;
+        const struct mvebu_mbus_soc_data *soc;
+        int hw_io_coherency;
+};
+static struct mvebu_mbus_state mbus_state;
+static struct mbus_dram_target_info mvebu_mbus_dram_info;
+const struct mbus_dram_target_info *mv_mbus_dram_info(void)
+{
+        return &mvebu_mbus_dram_info;
+}
+EXPORT_SYMBOL_GPL(mv_mbus_dram_info);
+/*
+ * Functions to manipulate the address decoding windows
+ */
+static void mvebu_mbus_read_window(struct mvebu_mbus_state *mbus,
+                                   int win, int *enabled, u64 *base,
+                                   u32 *size, u8 *target, u8 *attr,
+                                   u64 *remap)
+{
+        void __iomem *addr = mbus->mbuswins_base +
+                mbus->soc->win_cfg_offset(win);
+        u32 basereg = readl(addr + WIN_BASE_OFF);
+        u32 ctrlreg = readl(addr + WIN_CTRL_OFF);
+        if (!(ctrlreg & WIN_CTRL_ENABLE)) {
+                *enabled = 0;
+                return;
+        }
+        *enabled = 1;
+        *base = ((u64)basereg & WIN_BASE_HIGH) << 32;
+        *base |= (basereg & WIN_BASE_LOW);
+        *size = (ctrlreg | ~WIN_CTRL_SIZE_MASK) + 1;
+        if (target)
+                *target = (ctrlreg & WIN_CTRL_TGT_MASK) >> WIN_CTRL_TGT_SHIFT;
+        if (attr)
+                *attr = (ctrlreg & WIN_CTRL_ATTR_MASK) >> WIN_CTRL_ATTR_SHIFT;
+        if (remap) {
+                if (win < mbus->soc->num_remappable_wins) {
+                        u32 remap_low = readl(addr + WIN_REMAP_LO_OFF);
+                        u32 remap_hi  = readl(addr + WIN_REMAP_HI_OFF);
+                        *remap = ((u64)remap_hi << 32) | remap_low;
+                } else
+                        *remap = 0;
+        }
+}
+static void mvebu_mbus_disable_window(struct mvebu_mbus_state *mbus,
+                                      int win)
+{
+        void __iomem *addr;
+        addr = mbus->mbuswins_base + mbus->soc->win_cfg_offset(win);
+        writel(0, addr + WIN_BASE_OFF);
+        writel(0, addr + WIN_CTRL_OFF);
+        if (win < mbus->soc->num_remappable_wins) {
+                writel(0, addr + WIN_REMAP_LO_OFF);
+                writel(0, addr + WIN_REMAP_HI_OFF);
+        }
+}
+/* Checks whether the given window number is available */
+static int mvebu_mbus_window_is_free(struct mvebu_mbus_state *mbus,
+                                     const int win)
+{
+        void __iomem *addr = mbus->mbuswins_base +
+                mbus->soc->win_cfg_offset(win);
+        u32 ctrl = readl(addr + WIN_CTRL_OFF);
+        return !(ctrl & WIN_CTRL_ENABLE);
+}
+/*
+ * Checks whether the given (base, base+size) area doesn't overlap an
+ * existing region
+ */
+static int mvebu_mbus_window_conflicts(struct mvebu_mbus_state *mbus,
+                                       phys_addr_t base, size_t size,
+                                       u8 target, u8 attr)
+{
+        u64 end = (u64)base + size;
+        int win;
+        for (win = 0; win < mbus->soc->num_wins; win++) {
+                u64 wbase, wend;
+                u32 wsize;
+                u8 wtarget, wattr;
+                int enabled;
+                mvebu_mbus_read_window(mbus, win,
+                                       &enabled, &wbase, &wsize,
+                                       &wtarget, &wattr, NULL);
+                if (!enabled)
+                        continue;
+                wend = wbase + wsize;
+                /*
+                 * Check if the current window overlaps with the
+                 * proposed physical range
+                 */
+                if ((u64)base < wend && end > wbase)
+                        return 0;
+                /*
+                 * Check if target/attribute conflicts
+                 */
+                if (target == wtarget && attr == wattr)
+                        return 0;
+        }
+        return 1;
+}
+static int mvebu_mbus_find_window(struct mvebu_mbus_state *mbus,
+                                  phys_addr_t base, size_t size)
+{
+        int win;
+        for (win = 0; win < mbus->soc->num_wins; win++) {
+                u64 wbase;
+                u32 wsize;
+                int enabled;
+                mvebu_mbus_read_window(mbus, win,
+                                       &enabled, &wbase, &wsize,
+                                       NULL, NULL, NULL);
+                if (!enabled)
+                        continue;
+                if (base == wbase && size == wsize)
+                        return win;
+        }
+        return -ENODEV;
+}
+static int mvebu_mbus_setup_window(struct mvebu_mbus_state *mbus,
+                                   int win, phys_addr_t base, size_t size,
+                                   phys_addr_t remap, u8 target,
+                                   u8 attr)
+{
+        void __iomem *addr = mbus->mbuswins_base +
+                mbus->soc->win_cfg_offset(win);
+        u32 ctrl, remap_addr;
+        ctrl = ((size - 1) & WIN_CTRL_SIZE_MASK) |
+                (attr << WIN_CTRL_ATTR_SHIFT)    |
+                (target << WIN_CTRL_TGT_SHIFT)   |
+                WIN_CTRL_ENABLE;
+        writel(base & WIN_BASE_LOW, addr + WIN_BASE_OFF);
+        writel(ctrl, addr + WIN_CTRL_OFF);
+        if (win < mbus->soc->num_remappable_wins) {
+                if (remap == MVEBU_MBUS_NO_REMAP)
+                        remap_addr = base;
+                else
+                        remap_addr = remap;
+                writel(remap_addr & WIN_REMAP_LOW, addr + WIN_REMAP_LO_OFF);
+                writel(0, addr + WIN_REMAP_HI_OFF);
+        }
+        return 0;
+}
+static int mvebu_mbus_alloc_window(struct mvebu_mbus_state *mbus,
+                                   phys_addr_t base, size_t size,
+                                   phys_addr_t remap, u8 target,
+                                   u8 attr)
+{
+        int win;
+        if (remap == MVEBU_MBUS_NO_REMAP) {
+                for (win = mbus->soc->num_remappable_wins;
+                     win < mbus->soc->num_wins; win++)
+                        if (mvebu_mbus_window_is_free(mbus, win))
+                                return mvebu_mbus_setup_window(mbus, win, base,
+                                                               size, remap,
+                                                               target, attr);
+        }
+        for (win = 0; win < mbus->soc->num_wins; win++)
+                if (mvebu_mbus_window_is_free(mbus, win))
+                        return mvebu_mbus_setup_window(mbus, win, base, size,
+                                                       remap, target, attr);
+        return -ENOMEM;
+}
+/*
+ * Debugfs debugging
+ */
+/* Common function used for Dove, Kirkwood, Armada 370/XP and Orion 5x */
+static int mvebu_sdram_debug_show_orion(struct mvebu_mbus_state *mbus,
+                                        struct seq_file *seq, void *v)
+{
+        int i;
+        for (i = 0; i < 4; i++) {
+                u32 basereg = readl(mbus->sdramwins_base + DDR_BASE_CS_OFF(i));
+                u32 sizereg = readl(mbus->sdramwins_base + DDR_SIZE_CS_OFF(i));
+                u64 base;
+                u32 size;
+                if (!(sizereg & DDR_SIZE_ENABLED)) {
+                        seq_printf(seq, "[%d] disabled\n", i);
+                        continue;
+                }
+                base = ((u64)basereg & DDR_BASE_CS_HIGH_MASK) << 32;
+                base |= basereg & DDR_BASE_CS_LOW_MASK;
+                size = (sizereg | ~DDR_SIZE_MASK);
+                seq_printf(seq, "[%d] %016llx - %016llx : cs%d\n",
+                           i, (unsigned long long)base,
+                           (unsigned long long)base + size + 1,
+                           (sizereg & DDR_SIZE_CS_MASK) >> DDR_SIZE_CS_SHIFT);
+        }
+        return 0;
+}
+/* Special function for Dove */
+static int mvebu_sdram_debug_show_dove(struct mvebu_mbus_state *mbus,
+                                       struct seq_file *seq, void *v)
+{
+        int i;
+        for (i = 0; i < 2; i++) {
+                u32 map = readl(mbus->sdramwins_base + DOVE_DDR_BASE_CS_OFF(i));
+                u64 base;
+                u32 size;
+                if (!(map & 1)) {
+                        seq_printf(seq, "[%d] disabled\n", i);
+                        continue;
+                }
+                base = map & 0xff800000;
+                size = 0x100000 << (((map & 0x000f0000) >> 16) - 4);
+                seq_printf(seq, "[%d] %016llx - %016llx : cs%d\n",
+                           i, (unsigned long long)base,
+                           (unsigned long long)base + size, i);
+        }
+        return 0;
+}
+static int mvebu_sdram_debug_show(struct seq_file *seq, void *v)
+{
+        struct mvebu_mbus_state *mbus = &mbus_state;
+        return mbus->soc->show_cpu_target(mbus, seq, v);
+}
+static int mvebu_sdram_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, mvebu_sdram_debug_show, inode->i_private);
+}
+static const struct file_operations mvebu_sdram_debug_fops = {
+        .open = mvebu_sdram_debug_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+static int mvebu_devs_debug_show(struct seq_file *seq, void *v)
+{
+        struct mvebu_mbus_state *mbus = &mbus_state;
+        int win;
+        for (win = 0; win < mbus->soc->num_wins; win++) {
+                u64 wbase, wremap;
+                u32 wsize;
+                u8 wtarget, wattr;
+                int enabled, i;
+                const char *name;
+                mvebu_mbus_read_window(mbus, win,
+                                       &enabled, &wbase, &wsize,
+                                       &wtarget, &wattr, &wremap);
+                if (!enabled) {
+                        seq_printf(seq, "[%02d] disabled\n", win);
+                        continue;
+                }
+                for (i = 0; mbus->soc->map[i].name; i++)
+                        if (mbus->soc->map[i].target == wtarget &&
+                            mbus->soc->map[i].attr ==
+                            (wattr & mbus->soc->map[i].attrmask))
+                                break;
+                name = mbus->soc->map[i].name ?: "unknown";
+                seq_printf(seq, "[%02d] %016llx - %016llx : %s",
+                           win, (unsigned long long)wbase,
+                           (unsigned long long)(wbase + wsize), name);
+                if (win < mbus->soc->num_remappable_wins) {
+                        seq_printf(seq, " (remap %016llx)\n",
+                                   (unsigned long long)wremap);
+                } else
+                        seq_printf(seq, "\n");
+        }
+        return 0;
+}
+static int mvebu_devs_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, mvebu_devs_debug_show, inode->i_private);
+}
+static const struct file_operations mvebu_devs_debug_fops = {
+        .open = mvebu_devs_debug_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+/*
+ * SoC-specific functions and definitions
+ */
+static unsigned int orion_mbus_win_offset(int win)
+{
+        return win << 4;
+}
+static unsigned int armada_370_xp_mbus_win_offset(int win)
+{
+        /* The register layout is a bit annoying and the below code
+         * tries to cope with it.
+         * - At offset 0x0, there are the registers for the first 8
+         *   windows, with 4 registers of 32 bits per window (ctrl,
+         *   base, remap low, remap high)
+         * - Then at offset 0x80, there is a hole of 0x10 bytes for
+         *   the internal registers base address and internal units
+         *   sync barrier register.
+         * - Then at offset 0x90, there the registers for 12
+         *   windows, with only 2 registers of 32 bits per window
+         *   (ctrl, base).
+         */
+        if (win < 8)
+                return win << 4;
+        else
+                return 0x90 + ((win - 8) << 3);
+}
+static unsigned int mv78xx0_mbus_win_offset(int win)
+{
+        if (win < 8)
+                return win << 4;
+        else
+                return 0x900 + ((win - 8) << 4);
+}
+static void __init
+mvebu_mbus_default_setup_cpu_target(struct mvebu_mbus_state *mbus)
+{
+        int i;
+        int cs;
+        mvebu_mbus_dram_info.mbus_dram_target_id = TARGET_DDR;
+        for (i = 0, cs = 0; i < 4; i++) {
+                u32 base = readl(mbus->sdramwins_base + DDR_BASE_CS_OFF(i));
+                u32 size = readl(mbus->sdramwins_base + DDR_SIZE_CS_OFF(i));
+                /*
+                 * We only take care of entries for which the chip
+                 * select is enabled, and that don't have high base
+                 * address bits set (devices can only access the first
+                 * 32 bits of the memory).
+                 */
+                if ((size & DDR_SIZE_ENABLED) &&
+                    !(base & DDR_BASE_CS_HIGH_MASK)) {
+                        struct mbus_dram_window *w;
+                        w = &mvebu_mbus_dram_info.cs[cs++];
+                        w->cs_index = i;
+                        w->mbus_attr = 0xf & ~(1 << i);
+                        if (mbus->hw_io_coherency)
+                                w->mbus_attr |= ATTR_HW_COHERENCY;
+                        w->base = base & DDR_BASE_CS_LOW_MASK;
+                        w->size = (size | ~DDR_SIZE_MASK) + 1;
+                }
+        }
+        mvebu_mbus_dram_info.num_cs = cs;
+}
+static void __init
+mvebu_mbus_dove_setup_cpu_target(struct mvebu_mbus_state *mbus)
+{
+        int i;
+        int cs;
+        mvebu_mbus_dram_info.mbus_dram_target_id = TARGET_DDR;
+        for (i = 0, cs = 0; i < 2; i++) {
+                u32 map = readl(mbus->sdramwins_base + DOVE_DDR_BASE_CS_OFF(i));
+                /*
+                 * Chip select enabled?
+                 */
+                if (map & 1) {
+                        struct mbus_dram_window *w;
+                        w = &mvebu_mbus_dram_info.cs[cs++];
+                        w->cs_index = i;
+                        w->mbus_attr = 0; /* CS address decoding done inside */
+                                          /* the DDR controller, no need to  */
+                                          /* provide attributes */
+                        w->base = map & 0xff800000;
+                        w->size = 0x100000 << (((map & 0x000f0000) >> 16) - 4);
+                }
+        }
+        mvebu_mbus_dram_info.num_cs = cs;
+}
+static const struct mvebu_mbus_mapping armada_370_map[] = {
+        MAPDEF("bootrom",     1, 0xe0, MAPDEF_NOMASK),
+        MAPDEF("devbus-boot", 1, 0x2f, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs0",  1, 0x3e, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs1",  1, 0x3d, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs2",  1, 0x3b, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs3",  1, 0x37, MAPDEF_NOMASK),
+        MAPDEF("pcie0.0",     4, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.0",     8, 0xe0, MAPDEF_PCIMASK),
+        {},
+};
+static const struct mvebu_mbus_soc_data armada_370_mbus_data = {
+        .num_wins            = 20,
+        .num_remappable_wins = 8,
+        .win_cfg_offset      = armada_370_xp_mbus_win_offset,
+        .setup_cpu_target    = mvebu_mbus_default_setup_cpu_target,
+        .show_cpu_target     = mvebu_sdram_debug_show_orion,
+        .map                 = armada_370_map,
+};
+static const struct mvebu_mbus_mapping armada_xp_map[] = {
+        MAPDEF("bootrom",     1, 0x1d, MAPDEF_NOMASK),
+        MAPDEF("devbus-boot", 1, 0x2f, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs0",  1, 0x3e, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs1",  1, 0x3d, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs2",  1, 0x3b, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs3",  1, 0x37, MAPDEF_NOMASK),
+        MAPDEF("pcie0.0",     4, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("pcie0.1",     4, 0xd0, MAPDEF_PCIMASK),
+        MAPDEF("pcie0.2",     4, 0xb0, MAPDEF_PCIMASK),
+        MAPDEF("pcie0.3",     4, 0x70, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.0",     8, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.1",     8, 0xd0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.2",     8, 0xb0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.3",     8, 0x70, MAPDEF_PCIMASK),
+        MAPDEF("pcie2.0",     4, 0xf0, MAPDEF_PCIMASK),
+        MAPDEF("pcie3.0",     8, 0xf0, MAPDEF_PCIMASK),
+        {},
+};
+static const struct mvebu_mbus_soc_data armada_xp_mbus_data = {
+        .num_wins            = 20,
+        .num_remappable_wins = 8,
+        .win_cfg_offset      = armada_370_xp_mbus_win_offset,
+        .setup_cpu_target    = mvebu_mbus_default_setup_cpu_target,
+        .show_cpu_target     = mvebu_sdram_debug_show_orion,
+        .map                 = armada_xp_map,
+};
+static const struct mvebu_mbus_mapping kirkwood_map[] = {
+        MAPDEF("pcie0.0", 4, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.0", 4, 0xd0, MAPDEF_PCIMASK),
+        MAPDEF("sram",    3, 0x01, MAPDEF_NOMASK),
+        MAPDEF("nand",    1, 0x2f, MAPDEF_NOMASK),
+        {},
+};
+static const struct mvebu_mbus_soc_data kirkwood_mbus_data = {
+        .num_wins            = 8,
+        .num_remappable_wins = 4,
+        .win_cfg_offset      = orion_mbus_win_offset,
+        .setup_cpu_target    = mvebu_mbus_default_setup_cpu_target,
+        .show_cpu_target     = mvebu_sdram_debug_show_orion,
+        .map                 = kirkwood_map,
+};
+static const struct mvebu_mbus_mapping dove_map[] = {
+        MAPDEF("pcie0.0",    0x4, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.0",    0x8, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("cesa",       0x3, 0x01, MAPDEF_NOMASK),
+        MAPDEF("bootrom",    0x1, 0xfd, MAPDEF_NOMASK),
+        MAPDEF("scratchpad", 0xd, 0x0, MAPDEF_NOMASK),
+        {},
+};
+static const struct mvebu_mbus_soc_data dove_mbus_data = {
+        .num_wins            = 8,
+        .num_remappable_wins = 4,
+        .win_cfg_offset      = orion_mbus_win_offset,
+        .setup_cpu_target    = mvebu_mbus_dove_setup_cpu_target,
+        .show_cpu_target     = mvebu_sdram_debug_show_dove,
+        .map                 = dove_map,
+};
+static const struct mvebu_mbus_mapping orion5x_map[] = {
+        MAPDEF("pcie0.0",     4, 0x51, MAPDEF_ORIONPCIMASK),
+        MAPDEF("pci0.0",      3, 0x51, MAPDEF_ORIONPCIMASK),
+        MAPDEF("devbus-boot", 1, 0x0f, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs0",  1, 0x1e, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs1",  1, 0x1d, MAPDEF_NOMASK),
+        MAPDEF("devbus-cs2",  1, 0x1b, MAPDEF_NOMASK),
+        MAPDEF("sram",        0, 0x00, MAPDEF_NOMASK),
+        {},
+};
+/*
+ * Some variants of Orion5x have 4 remappable windows, some other have
+ * only two of them.
+ */
+static const struct mvebu_mbus_soc_data orion5x_4win_mbus_data = {
+        .num_wins            = 8,
+        .num_remappable_wins = 4,
+        .win_cfg_offset      = orion_mbus_win_offset,
+        .setup_cpu_target    = mvebu_mbus_default_setup_cpu_target,
+        .show_cpu_target     = mvebu_sdram_debug_show_orion,
+        .map                 = orion5x_map,
+};
+static const struct mvebu_mbus_soc_data orion5x_2win_mbus_data = {
+        .num_wins            = 8,
+        .num_remappable_wins = 2,
+        .win_cfg_offset      = orion_mbus_win_offset,
+        .setup_cpu_target    = mvebu_mbus_default_setup_cpu_target,
+        .show_cpu_target     = mvebu_sdram_debug_show_orion,
+        .map                 = orion5x_map,
+};
+static const struct mvebu_mbus_mapping mv78xx0_map[] = {
+        MAPDEF("pcie0.0", 4, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("pcie0.1", 4, 0xd0, MAPDEF_PCIMASK),
+        MAPDEF("pcie0.2", 4, 0xb0, MAPDEF_PCIMASK),
+        MAPDEF("pcie0.3", 4, 0x70, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.0", 8, 0xe0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.1", 8, 0xd0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.2", 8, 0xb0, MAPDEF_PCIMASK),
+        MAPDEF("pcie1.3", 8, 0x70, MAPDEF_PCIMASK),
+        MAPDEF("pcie2.0", 4, 0xf0, MAPDEF_PCIMASK),
+        MAPDEF("pcie3.0", 8, 0xf0, MAPDEF_PCIMASK),
+        {},
+};
+static const struct mvebu_mbus_soc_data mv78xx0_mbus_data = {
+        .num_wins            = 14,
+        .num_remappable_wins = 8,
+        .win_cfg_offset      = mv78xx0_mbus_win_offset,
+        .setup_cpu_target    = mvebu_mbus_default_setup_cpu_target,
+        .show_cpu_target     = mvebu_sdram_debug_show_orion,
+        .map                 = mv78xx0_map,
+};
+/*
+ * The driver doesn't yet have a DT binding because the details of
+ * this DT binding still need to be sorted out. However, as a
+ * preparation, we already use of_device_id to match a SoC description
+ * string against the SoC specific details of this driver.
+ */
+static const struct of_device_id of_mvebu_mbus_ids[] = {
+        { .compatible = "marvell,armada370-mbus",
+          .data = &armada_370_mbus_data, },
+        { .compatible = "marvell,armadaxp-mbus",
+          .data = &armada_xp_mbus_data, },
+        { .compatible = "marvell,kirkwood-mbus",
+          .data = &kirkwood_mbus_data, },
+        { .compatible = "marvell,dove-mbus",
+          .data = &dove_mbus_data, },
+        { .compatible = "marvell,orion5x-88f5281-mbus",
+          .data = &orion5x_4win_mbus_data, },
+        { .compatible = "marvell,orion5x-88f5182-mbus",
+          .data = &orion5x_2win_mbus_data, },
+        { .compatible = "marvell,orion5x-88f5181-mbus",
+          .data = &orion5x_2win_mbus_data, },
+        { .compatible = "marvell,orion5x-88f6183-mbus",
+          .data = &orion5x_4win_mbus_data, },
+        { .compatible = "marvell,mv78xx0-mbus",
+          .data = &mv78xx0_mbus_data, },
+        { },
+};
+/*
+ * Public API of the driver
+ */
+int mvebu_mbus_add_window_remap_flags(const char *devname, phys_addr_t base,
+                                      size_t size, phys_addr_t remap,
+                                      unsigned int flags)
+{
+        struct mvebu_mbus_state *s = &mbus_state;
+        u8 target, attr;
+        int i;
+        if (!s->soc->map)
+                return -ENODEV;
+        for (i = 0; s->soc->map[i].name; i++)
+                if (!strcmp(s->soc->map[i].name, devname))
+                        break;
+        if (!s->soc->map[i].name) {
+                pr_err("mvebu-mbus: unknown device '%s'\n", devname);
+                return -ENODEV;
+        }
+        target = s->soc->map[i].target;
+        attr   = s->soc->map[i].attr;
+        if (flags == MVEBU_MBUS_PCI_MEM)
+                attr |= 0x8;
+        else if (flags == MVEBU_MBUS_PCI_WA)
+                attr |= 0x28;
+        if (!mvebu_mbus_window_conflicts(s, base, size, target, attr)) {
+                pr_err("mvebu-mbus: cannot add window '%s', conflicts with another window\n",
+                       devname);
+                return -EINVAL;
+        }
+        return mvebu_mbus_alloc_window(s, base, size, remap, target, attr);
+}
+int mvebu_mbus_add_window(const char *devname, phys_addr_t base, size_t size)
+{
+        return mvebu_mbus_add_window_remap_flags(devname, base, size,
+                                                 MVEBU_MBUS_NO_REMAP, 0);
+}
+int mvebu_mbus_del_window(phys_addr_t base, size_t size)
+{
+        int win;
+        win = mvebu_mbus_find_window(&mbus_state, base, size);
+        if (win < 0)
+                return win;
+        mvebu_mbus_disable_window(&mbus_state, win);
+        return 0;
+}
+static __init int mvebu_mbus_debugfs_init(void)
+{
+        struct mvebu_mbus_state *s = &mbus_state;
+        /*
+         * If no base has been initialized, doesn't make sense to
+         * register the debugfs entries. We may be on a multiplatform
+         * kernel that isn't running a Marvell EBU SoC.
+         */
+        if (!s->mbuswins_base)
+                return 0;
+        s->debugfs_root = debugfs_create_dir("mvebu-mbus", NULL);
+        if (s->debugfs_root) {
+                s->debugfs_sdram = debugfs_create_file("sdram", S_IRUGO,
+                                                       s->debugfs_root, NULL,
+                                                       &mvebu_sdram_debug_fops);
+                s->debugfs_devs = debugfs_create_file("devices", S_IRUGO,
+                                                      s->debugfs_root, NULL,
+                                                      &mvebu_devs_debug_fops);
+        }
+        return 0;
+}
+fs_initcall(mvebu_mbus_debugfs_init);
+int __init mvebu_mbus_init(const char *soc, phys_addr_t mbuswins_phys_base,
+                           size_t mbuswins_size,
+                           phys_addr_t sdramwins_phys_base,
+                           size_t sdramwins_size)
+{
+        struct mvebu_mbus_state *mbus = &mbus_state;
+        const struct of_device_id *of_id;
+        int win;
+        for (of_id = of_mvebu_mbus_ids; of_id->compatible; of_id++)
+                if (!strcmp(of_id->compatible, soc))
+                        break;
+        if (!of_id->compatible) {
+                pr_err("mvebu-mbus: could not find a matching SoC family\n");
+                return -ENODEV;
+        }
+        mbus->soc = of_id->data;
+        mbus->mbuswins_base = ioremap(mbuswins_phys_base, mbuswins_size);
+        if (!mbus->mbuswins_base)
+                return -ENOMEM;
+        mbus->sdramwins_base = ioremap(sdramwins_phys_base, sdramwins_size);
+        if (!mbus->sdramwins_base) {
+                iounmap(mbus_state.mbuswins_base);
+                return -ENOMEM;
+        }
+        if (of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric"))
+                mbus->hw_io_coherency = 1;
+        for (win = 0; win < mbus->soc->num_wins; win++)
+                mvebu_mbus_disable_window(mbus, win);
+        mbus->soc->setup_cpu_target(mbus);
+        return 0;
+}
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index 10fd71ccf587..6bf4d47324eb 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -92,14 +92,22 @@ static int probe_common(struct virtio_device *vdev)
 {
        int err;
+        if (vq) {
+                /* We only support one device for now */
+                return -EBUSY;
+        }
        /* We expect a single virtqueue. */
        vq = virtio_find_single_vq(vdev, random_recv_done, "input");
-        if (IS_ERR(vq))
+        if (IS_ERR(vq)) {
-                return PTR_ERR(vq);
+                err = PTR_ERR(vq);
+                vq = NULL;
+                return err;
+        }
        err = hwrng_register(&virtio_hwrng);
        if (err) {
                vdev->config->del_vqs(vdev);
+                vq = NULL;
                return err;
        }
@@ -112,6 +120,7 @@ static void remove_common(struct virtio_device *vdev)
        busy = false;
        hwrng_unregister(&virtio_hwrng);
        vdev->config->del_vqs(vdev);
+        vq = NULL;
 }
 static int virtrng_probe(struct virtio_device *vdev)
diff --git a/drivers/clk/clk-vt8500.c b/drivers/clk/clk-vt8500.c
index b5538bba7a10..09c63315e579 100644
--- a/drivers/clk/clk-vt8500.c
+++ b/drivers/clk/clk-vt8500.c
@@ -157,7 +157,7 @@ static int vt8500_dclk_set_rate(struct clk_hw *hw, unsigned long rate,
        divisor =  parent_rate / rate;
        /* If prate / rate would be decimal, incr the divisor */
-        if (rate * divisor < *prate)
+        if (rate * divisor < parent_rate)
                divisor++;
        if (divisor == cdev->div_mask + 1)
diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
index 143ce1f899ad..1e2de7305362 100644
--- a/drivers/clk/tegra/clk-tegra20.c
+++ b/drivers/clk/tegra/clk-tegra20.c
@@ -1292,7 +1292,6 @@ static struct tegra_clk_duplicate tegra_clk_duplicates[] = {
        TEGRA_CLK_DUPLICATE(usbd,   "tegra-ehci.0", NULL),
        TEGRA_CLK_DUPLICATE(usbd,   "tegra-otg",    NULL),
        TEGRA_CLK_DUPLICATE(cclk,   NULL,           "cpu"),
-        TEGRA_CLK_DUPLICATE(twd,    "smp_twd",      NULL),
        TEGRA_CLK_DUPLICATE(clk_max, NULL, NULL), /* Must be the last entry */
 };
diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c
index 32c61cb6d0bb..ba6f51bc9f3b 100644
--- a/drivers/clk/tegra/clk-tegra30.c
+++ b/drivers/clk/tegra/clk-tegra30.c
@@ -1931,7 +1931,6 @@ static struct tegra_clk_duplicate tegra_clk_duplicates[] = {
        TEGRA_CLK_DUPLICATE(cml1, "tegra_sata_cml", NULL),
        TEGRA_CLK_DUPLICATE(cml0, "tegra_pcie", "cml"),
        TEGRA_CLK_DUPLICATE(pciex, "tegra_pcie", "pciex"),
-        TEGRA_CLK_DUPLICATE(twd, "smp_twd", NULL),
        TEGRA_CLK_DUPLICATE(vcp, "nvavp", "vcp"),
        TEGRA_CLK_DUPLICATE(clk_max, NULL, NULL), /* MUST be the last entry */
 };
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 910b0116c128..e1d13c463c90 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -2048,12 +2048,18 @@ static int init_csrows(struct mem_ctl_info *mci)
                edac_dbg(1, "MC node: %d, csrow: %d\n",
                            pvt->mc_node_id, i);
-                if (row_dct0)
+                if (row_dct0) {
                        nr_pages = amd64_csrow_nr_pages(pvt, 0, i);
+                        csrow->channels[0]->dimm->nr_pages = nr_pages;
+                }
                /* K8 has only one DCT */
-                if (boot_cpu_data.x86 != 0xf && row_dct1)
+                if (boot_cpu_data.x86 != 0xf && row_dct1) {
-                        nr_pages += amd64_csrow_nr_pages(pvt, 1, i);
+                        int row_dct1_pages = amd64_csrow_nr_pages(pvt, 1, i);
+                        csrow->channels[1]->dimm->nr_pages = row_dct1_pages;
+                        nr_pages += row_dct1_pages;
+                }
                mtype = amd64_determine_memory_type(pvt, i);
@@ -2072,9 +2078,7 @@ static int init_csrows(struct mem_ctl_info *mci)
                        dimm = csrow->channels[j]->dimm;
                        dimm->mtype = mtype;
                        dimm->edac_mode = edac_mode;
-                        dimm->nr_pages = nr_pages;
                }
-                csrow->nr_pages = nr_pages;
        }
        return empty;
@@ -2419,7 +2423,6 @@ static int amd64_init_one_instance(struct pci_dev *F2)
        mci->pvt_info = pvt;
        mci->pdev = &pvt->F2->dev;
-        mci->csbased = 1;
        setup_mci_misc_attrs(mci, fam_type);
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index cdb81aa73ab7..27e86d938262 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -86,7 +86,7 @@ static void edac_mc_dump_dimm(struct dimm_info *dimm, int number)
        edac_dimm_info_location(dimm, location, sizeof(location));
        edac_dbg(4, "%s%i: %smapped as virtual row %d, chan %d\n",
-                 dimm->mci->mem_is_per_rank ? "rank" : "dimm",
+                 dimm->mci->csbased ? "rank" : "dimm",
                 number, location, dimm->csrow, dimm->cschannel);
        edac_dbg(4, "  dimm = %p\n", dimm);
        edac_dbg(4, "  dimm->label = '%s'\n", dimm->label);
@@ -341,7 +341,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
        memcpy(mci->layers, layers, sizeof(*layer) * n_layers);
        mci->nr_csrows = tot_csrows;
        mci->num_cschannel = tot_channels;
-        mci->mem_is_per_rank = per_rank;
+        mci->csbased = per_rank;
        /*
         * Alocate and fill the csrow/channels structs
@@ -1235,7 +1235,7 @@ void edac_mc_handle_error(const enum hw_event_mc_err_type type,
                         * incrementing the compat API counters
                         */
                        edac_dbg(4, "%s csrows map: (%d,%d)\n",
-                                 mci->mem_is_per_rank ? "rank" : "dimm",
+                                 mci->csbased ? "rank" : "dimm",
                                 dimm->csrow, dimm->cschannel);
                        if (row == -1)
                                row = dimm->csrow;
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 4f4b6137d74e..5899a76eec3b 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -143,7 +143,7 @@ static const char *edac_caps[] = {
 * and the per-dimm/per-rank one
 */
 #define DEVICE_ATTR_LEGACY(_name, _mode, _show, _store) \
-        struct device_attribute dev_attr_legacy_##_name = __ATTR(_name, _mode, _show, _store)
+        static struct device_attribute dev_attr_legacy_##_name = __ATTR(_name, _mode, _show, _store)
 struct dev_ch_attribute {
        struct device_attribute attr;
@@ -180,9 +180,6 @@ static ssize_t csrow_size_show(struct device *dev,
        int i;
        u32 nr_pages = 0;
-        if (csrow->mci->csbased)
-                return sprintf(data, "%u\n", PAGES_TO_MiB(csrow->nr_pages));
        for (i = 0; i < csrow->nr_channels; i++)
                nr_pages += csrow->channels[i]->dimm->nr_pages;
        return sprintf(data, "%u\n", PAGES_TO_MiB(nr_pages));
@@ -612,7 +609,7 @@ static int edac_create_dimm_object(struct mem_ctl_info *mci,
        device_initialize(&dimm->dev);
        dimm->dev.parent = &mci->dev;
-        if (mci->mem_is_per_rank)
+        if (mci->csbased)
                dev_set_name(&dimm->dev, "rank%d", index);
        else
                dev_set_name(&dimm->dev, "dimm%d", index);
@@ -778,14 +775,10 @@ static ssize_t mci_size_mb_show(struct device *dev,
        for (csrow_idx = 0; csrow_idx < mci->nr_csrows; csrow_idx++) {
                struct csrow_info *csrow = mci->csrows[csrow_idx];
-                if (csrow->mci->csbased) {
+                for (j = 0; j < csrow->nr_channels; j++) {
-                        total_pages += csrow->nr_pages;
+                        struct dimm_info *dimm = csrow->channels[j]->dimm;
-                } else {
-                        for (j = 0; j < csrow->nr_channels; j++) {
-                                struct dimm_info *dimm = csrow->channels[j]->dimm;
-                                total_pages += dimm->nr_pages;
+                        total_pages += dimm->nr_pages;
-                        }
                }
        }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c194f4e680ad..e2acfdbf7d3c 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1634,7 +1634,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
        unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo;
        unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) << 2 | pt->hsync_offset_lo;
        unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x30) << 4 | pt->hsync_pulse_width_lo;
-        unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) >> 2 | pt->vsync_offset_pulse_width_lo >> 4;
+        unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) << 2 | pt->vsync_offset_pulse_width_lo >> 4;
        unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf);
        /* ignore tiny modes */
@@ -1715,6 +1715,7 @@ set_size:
        }
        mode->type = DRM_MODE_TYPE_DRIVER;
+        mode->vrefresh = drm_mode_vrefresh(mode);
        drm_mode_set_name(mode);
        return mode;
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index aae31489c893..7299ea45dd03 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -103,7 +103,7 @@ static const char *cache_level_str(int type)
 static void
 describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
 {
-        seq_printf(m, "%p: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
+        seq_printf(m, "%pK: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
                   &obj->base,
                   get_pin_flag(obj),
                   get_tiling_flag(obj),
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 2f2daebd0eef..3b11ab0fbc96 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -732,6 +732,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
                   int count)
 {
        int i;
+        int relocs_total = 0;
+        int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
        for (i = 0; i < count; i++) {
                char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
@@ -740,10 +742,13 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
                if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS)
                        return -EINVAL;
-                /* First check for malicious input causing overflow */
+                /* First check for malicious input causing overflow in
-                if (exec[i].relocation_count >
+                 * the worst case where we need to allocate the entire
-                    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
+                 * relocation tree as a single array.
+                 */
+                if (exec[i].relocation_count > relocs_max - relocs_total)
                        return -EINVAL;
+                relocs_total += exec[i].relocation_count;
                length = exec[i].relocation_count *
                        sizeof(struct drm_i915_gem_relocation_entry);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 6f728e5ee793..d7d4afe01341 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -820,6 +820,7 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
        struct intel_link_m_n m_n;
        int pipe = intel_crtc->pipe;
        enum transcoder cpu_transcoder = intel_crtc->cpu_transcoder;
+        int target_clock;
        /*
         * Find the lane count in the intel_encoder private
@@ -835,13 +836,22 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
                }
        }
+        target_clock = mode->clock;
+        for_each_encoder_on_crtc(dev, crtc, intel_encoder) {
+                if (intel_encoder->type == INTEL_OUTPUT_EDP) {
+                        target_clock = intel_edp_target_clock(intel_encoder,
+                                                              mode);
+                        break;
+                }
+        }
        /*
         * Compute the GMCH and Link ratios. The '3' here is
         * the number of bytes_per_pixel post-LUT, which we always
         * set up for 8-bits of R/G/B, or 3 bytes total.
         */
        intel_link_compute_m_n(intel_crtc->bpp, lane_count,
-                               mode->clock, adjusted_mode->clock, &m_n);
+                               target_clock, adjusted_mode->clock, &m_n);
        if (IS_HASWELL(dev)) {
                I915_WRITE(PIPE_DATA_M1(cpu_transcoder),
@@ -1930,7 +1940,7 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                for (i = 0; i < intel_dp->lane_count; i++)
                        if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
                                break;
-                if (i == intel_dp->lane_count && voltage_tries == 5) {
+                if (i == intel_dp->lane_count) {
                        ++loop_tries;
                        if (loop_tries == 5) {
                                DRM_DEBUG_KMS("too many full retries, give up\n");
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index acf8aec9ada7..ef4744e1bf0b 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -203,7 +203,13 @@ intel_gpio_setup(struct intel_gmbus *bus, u32 pin)
        algo->data = bus;
 }
-#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 4)
+/*
+ * gmbus on gen4 seems to be able to generate legacy interrupts even when in MSI
+ * mode. This results in spurious interrupt warnings if the legacy irq no. is
+ * shared with another device. The kernel then disables that interrupt source
+ * and so prevents the other device from working properly.
+ */
+#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
 static int
 gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
                     u32 gmbus2_status,
@@ -214,6 +220,9 @@ gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
        u32 gmbus2 = 0;
        DEFINE_WAIT(wait);
+        if (!HAS_GMBUS_IRQ(dev_priv->dev))
+                gmbus4_irq_en = 0;
        /* Important: The hw handles only the first bit, so set only one! Since
         * we also need to check for NAKs besides the hw ready/idle signal, we
         * need to wake up periodically and check that ourselves. */
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index a274b9906ef8..fe22bb780e1d 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -382,19 +382,19 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
        m = n = p = 0;
        vcomax = 800000;
        vcomin = 400000;
-        pllreffreq = 3333;
+        pllreffreq = 33333;
        delta = 0xffffffff;
        permitteddelta = clock * 5 / 1000;
-        for (testp = 16; testp > 0; testp--) {
+        for (testp = 16; testp > 0; testp >>= 1) {
                if (clock * testp > vcomax)
                        continue;
                if (clock * testp < vcomin)
                        continue;
                for (testm = 1; testm < 33; testm++) {
-                        for (testn = 1; testn < 257; testn++) {
+                        for (testn = 17; testn < 257; testn++) {
                                computed = (pllreffreq * testn) /
                                        (testm * testp);
                                if (computed > clock)
@@ -404,11 +404,11 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
                                if (tmpdelta < delta) {
                                        delta = tmpdelta;
                                        n = testn - 1;
-                                        m = (testm - 1) | ((n >> 1) & 0x80);
+                                        m = (testm - 1);
                                        p = testp - 1;
                                }
                                if ((clock * testp) >= 600000)
-                                        p |= 80;
+                                        p |= 0x80;
                        }
                }
        }
diff --git a/drivers/gpu/drm/nouveau/core/core/object.c b/drivers/gpu/drm/nouveau/core/core/object.c
index 0daab62ea14c..3b2e7b6304d3 100644
--- a/drivers/gpu/drm/nouveau/core/core/object.c
+++ b/drivers/gpu/drm/nouveau/core/core/object.c
@@ -278,7 +278,6 @@ nouveau_object_del(struct nouveau_object *client, u32 _parent, u32 _handle)
        struct nouveau_object *parent = NULL;
        struct nouveau_object *namedb = NULL;
        struct nouveau_handle *handle = NULL;
-        int ret = -EINVAL;
        parent = nouveau_handle_ref(client, _parent);
        if (!parent)
@@ -295,7 +294,7 @@ nouveau_object_del(struct nouveau_object *client, u32 _parent, u32 _handle)
        }
        nouveau_object_ref(NULL, &parent);
-        return ret;
+        return handle ? 0 : -EINVAL;
 }
 int
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 5fa13267bd9f..02e369f80449 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -544,13 +544,13 @@ nv50_disp_curs_ofuncs = {
 static void
 nv50_disp_base_vblank_enable(struct nouveau_event *event, int head)
 {
-        nv_mask(event->priv, 0x61002c, (1 << head), (1 << head));
+        nv_mask(event->priv, 0x61002c, (4 << head), (4 << head));
 }
 static void
 nv50_disp_base_vblank_disable(struct nouveau_event *event, int head)
 {
-        nv_mask(event->priv, 0x61002c, (1 << head), (0 << head));
+        nv_mask(event->priv, 0x61002c, (4 << head), 0);
 }
 static int
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/therm.h b/drivers/gpu/drm/nouveau/core/include/subdev/therm.h
index 6b17b614629f..0b20fc0d19c1 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/therm.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/therm.h
@@ -4,7 +4,7 @@
 #include <core/device.h>
 #include <core/subdev.h>
-enum nouveau_therm_mode {
+enum nouveau_therm_fan_mode {
        NOUVEAU_THERM_CTRL_NONE = 0,
        NOUVEAU_THERM_CTRL_MANUAL = 1,
        NOUVEAU_THERM_CTRL_AUTO = 2,
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/base.c b/drivers/gpu/drm/nouveau/core/subdev/therm/base.c
index f794dc89a3b2..a00a5a76e2d6 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/base.c
@@ -134,7 +134,7 @@ nouveau_therm_alarm(struct nouveau_alarm *alarm)
 }
 int
-nouveau_therm_mode(struct nouveau_therm *therm, int mode)
+nouveau_therm_fan_mode(struct nouveau_therm *therm, int mode)
 {
        struct nouveau_therm_priv *priv = (void *)therm;
        struct nouveau_device *device = nv_device(therm);
@@ -149,10 +149,15 @@ nouveau_therm_mode(struct nouveau_therm *therm, int mode)
            (mode != NOUVEAU_THERM_CTRL_NONE && device->card_type >= NV_C0))
                return -EINVAL;
+        /* do not allow automatic fan management if the thermal sensor is
+         * not available */
+        if (priv->mode == 2 && therm->temp_get(therm) < 0)
+                return -EINVAL;
        if (priv->mode == mode)
                return 0;
-        nv_info(therm, "Thermal management: %s\n", name[mode]);
+        nv_info(therm, "fan management: %s\n", name[mode]);
        nouveau_therm_update(therm, mode);
        return 0;
 }
@@ -213,7 +218,7 @@ nouveau_therm_attr_set(struct nouveau_therm *therm,
                priv->fan->bios.max_duty = value;
                return 0;
        case NOUVEAU_THERM_ATTR_FAN_MODE:
-                return nouveau_therm_mode(therm, value);
+                return nouveau_therm_fan_mode(therm, value);
        case NOUVEAU_THERM_ATTR_THRS_FAN_BOOST:
                priv->bios_sensor.thrs_fan_boost.temp = value;
                priv->sensor.program_alarms(therm);
@@ -263,7 +268,7 @@ _nouveau_therm_init(struct nouveau_object *object)
                return ret;
        if (priv->suspend >= 0)
-                nouveau_therm_mode(therm, priv->mode);
+                nouveau_therm_fan_mode(therm, priv->mode);
        priv->sensor.program_alarms(therm);
        return 0;
 }
@@ -313,11 +318,12 @@ nouveau_therm_create_(struct nouveau_object *parent,
 int
 nouveau_therm_preinit(struct nouveau_therm *therm)
 {
-        nouveau_therm_ic_ctor(therm);
        nouveau_therm_sensor_ctor(therm);
+        nouveau_therm_ic_ctor(therm);
        nouveau_therm_fan_ctor(therm);
-        nouveau_therm_mode(therm, NOUVEAU_THERM_CTRL_NONE);
+        nouveau_therm_fan_mode(therm, NOUVEAU_THERM_CTRL_NONE);
+        nouveau_therm_sensor_preinit(therm);
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
index e24090bac195..8b3adec5fbb1 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
@@ -32,6 +32,7 @@ probe_monitoring_device(struct nouveau_i2c_port *i2c,
                        struct i2c_board_info *info)
 {
        struct nouveau_therm_priv *priv = (void *)nouveau_therm(i2c);
+        struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
        struct i2c_client *client;
        request_module("%s%s", I2C_MODULE_PREFIX, info->type);
@@ -46,8 +47,9 @@ probe_monitoring_device(struct nouveau_i2c_port *i2c,
        }
        nv_info(priv,
-                "Found an %s at address 0x%x (controlled by lm_sensors)\n",
+                "Found an %s at address 0x%x (controlled by lm_sensors, "
-                info->type, info->addr);
+                "temp offset %+i C)\n",
+                info->type, info->addr, sensor->offset_constant);
        priv->ic = client;
        return true;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
index 0f5363edb964..a70d1b7e397b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
@@ -29,54 +29,83 @@ struct nv40_therm_priv {
        struct nouveau_therm_priv base;
 };
+enum nv40_sensor_style { INVALID_STYLE = -1, OLD_STYLE = 0, NEW_STYLE = 1 };
+static enum nv40_sensor_style
+nv40_sensor_style(struct nouveau_therm *therm)
+{
+        struct nouveau_device *device = nv_device(therm);
+        switch (device->chipset) {
+        case 0x43:
+        case 0x44:
+        case 0x4a:
+        case 0x47:
+                return OLD_STYLE;
+        case 0x46:
+        case 0x49:
+        case 0x4b:
+        case 0x4e:
+        case 0x4c:
+        case 0x67:
+        case 0x68:
+        case 0x63:
+                return NEW_STYLE;
+        default:
+                return INVALID_STYLE;
+        }
+}
 static int
 nv40_sensor_setup(struct nouveau_therm *therm)
 {
-        struct nouveau_device *device = nv_device(therm);
+        enum nv40_sensor_style style = nv40_sensor_style(therm);
        /* enable ADC readout and disable the ALARM threshold */
-        if (device->chipset >= 0x46) {
+        if (style == NEW_STYLE) {
                nv_mask(therm, 0x15b8, 0x80000000, 0);
                nv_wr32(therm, 0x15b0, 0x80003fff);
-                mdelay(10); /* wait for the temperature to stabilize */
+                mdelay(20); /* wait for the temperature to stabilize */
                return nv_rd32(therm, 0x15b4) & 0x3fff;
-        } else {
+        } else if (style == OLD_STYLE) {
                nv_wr32(therm, 0x15b0, 0xff);
+                mdelay(20); /* wait for the temperature to stabilize */
                return nv_rd32(therm, 0x15b4) & 0xff;
-        }
+        } else
+                return -ENODEV;
 }
 static int
 nv40_temp_get(struct nouveau_therm *therm)
 {
        struct nouveau_therm_priv *priv = (void *)therm;
-        struct nouveau_device *device = nv_device(therm);
        struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
+        enum nv40_sensor_style style = nv40_sensor_style(therm);
        int core_temp;
-        if (device->chipset >= 0x46) {
+        if (style == NEW_STYLE) {
                nv_wr32(therm, 0x15b0, 0x80003fff);
                core_temp = nv_rd32(therm, 0x15b4) & 0x3fff;
-        } else {
+        } else if (style == OLD_STYLE) {
                nv_wr32(therm, 0x15b0, 0xff);
                core_temp = nv_rd32(therm, 0x15b4) & 0xff;
-        }
+        } else
+                return -ENODEV;
-        /* Setup the sensor if the temperature is 0 */
-        if (core_temp == 0)
-                core_temp = nv40_sensor_setup(therm);
-        if (sensor->slope_div == 0)
+        /* if the slope or the offset is unset, do no use the sensor */
-                sensor->slope_div = 1;
+        if (!sensor->slope_div || !sensor->slope_mult ||
-        if (sensor->offset_den == 0)
+            !sensor->offset_num || !sensor->offset_den)
-                sensor->offset_den = 1;
+            return -ENODEV;
-        if (sensor->slope_mult < 1)
-                sensor->slope_mult = 1;
        core_temp = core_temp * sensor->slope_mult / sensor->slope_div;
        core_temp = core_temp + sensor->offset_num / sensor->offset_den;
        core_temp = core_temp + sensor->offset_constant - 8;
+        /* reserve negative temperatures for errors */
+        if (core_temp < 0)
+                core_temp = 0;
        return core_temp;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h b/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h
index 06b98706b3fc..438d9824b774 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h
@@ -102,7 +102,7 @@ struct nouveau_therm_priv {
        struct i2c_client *ic;
 };
-int nouveau_therm_mode(struct nouveau_therm *therm, int mode);
+int nouveau_therm_fan_mode(struct nouveau_therm *therm, int mode);
 int nouveau_therm_attr_get(struct nouveau_therm *therm,
                       enum nouveau_therm_attr_type type);
 int nouveau_therm_attr_set(struct nouveau_therm *therm,
@@ -122,6 +122,7 @@ int nouveau_therm_fan_sense(struct nouveau_therm *therm);
 int nouveau_therm_preinit(struct nouveau_therm *);
+void nouveau_therm_sensor_preinit(struct nouveau_therm *);
 void nouveau_therm_sensor_set_threshold_state(struct nouveau_therm *therm,
                                             enum nouveau_therm_thrs thrs,
                                             enum nouveau_therm_thrs_state st);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
index b37624af8297..470f6a47b656 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
@@ -34,10 +34,6 @@ nouveau_therm_temp_set_defaults(struct nouveau_therm *therm)
 {
        struct nouveau_therm_priv *priv = (void *)therm;
-        priv->bios_sensor.slope_mult = 1;
-        priv->bios_sensor.slope_div = 1;
-        priv->bios_sensor.offset_num = 0;
-        priv->bios_sensor.offset_den = 1;
        priv->bios_sensor.offset_constant = 0;
        priv->bios_sensor.thrs_fan_boost.temp = 90;
@@ -60,11 +56,6 @@ nouveau_therm_temp_safety_checks(struct nouveau_therm *therm)
        struct nouveau_therm_priv *priv = (void *)therm;
        struct nvbios_therm_sensor *s = &priv->bios_sensor;
-        if (!priv->bios_sensor.slope_div)
-                priv->bios_sensor.slope_div = 1;
-        if (!priv->bios_sensor.offset_den)
-                priv->bios_sensor.offset_den = 1;
        /* enforce a minimum hysteresis on thresholds */
        s->thrs_fan_boost.hysteresis = max_t(u8, s->thrs_fan_boost.hysteresis, 2);
        s->thrs_down_clock.hysteresis = max_t(u8, s->thrs_down_clock.hysteresis, 2);
@@ -106,16 +97,16 @@ void nouveau_therm_sensor_event(struct nouveau_therm *therm,
        const char *thresolds[] = {
                "fanboost", "downclock", "critical", "shutdown"
        };
-        uint8_t temperature = therm->temp_get(therm);
+        int temperature = therm->temp_get(therm);
        if (thrs < 0 || thrs > 3)
                return;
        if (dir == NOUVEAU_THERM_THRS_FALLING)
-                nv_info(therm, "temperature (%u C) went below the '%s' threshold\n",
+                nv_info(therm, "temperature (%i C) went below the '%s' threshold\n",
                        temperature, thresolds[thrs]);
        else
-                nv_info(therm, "temperature (%u C) hit the '%s' threshold\n",
+                nv_info(therm, "temperature (%i C) hit the '%s' threshold\n",
                        temperature, thresolds[thrs]);
        active = (dir == NOUVEAU_THERM_THRS_RISING);
@@ -123,7 +114,7 @@ void nouveau_therm_sensor_event(struct nouveau_therm *therm,
        case NOUVEAU_THERM_THRS_FANBOOST:
                if (active) {
                        nouveau_therm_fan_set(therm, true, 100);
-                        nouveau_therm_mode(therm, NOUVEAU_THERM_CTRL_AUTO);
+                        nouveau_therm_fan_mode(therm, NOUVEAU_THERM_CTRL_AUTO);
                }
                break;
        case NOUVEAU_THERM_THRS_DOWNCLOCK:
@@ -202,7 +193,7 @@ alarm_timer_callback(struct nouveau_alarm *alarm)
                                             NOUVEAU_THERM_THRS_SHUTDOWN);
        /* schedule the next poll in one second */
-        if (list_empty(&alarm->head))
+        if (therm->temp_get(therm) >= 0 && list_empty(&alarm->head))
                ptimer->alarm(ptimer, 1000 * 1000 * 1000, alarm);
        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
@@ -225,6 +216,17 @@ nouveau_therm_program_alarms_polling(struct nouveau_therm *therm)
        alarm_timer_callback(&priv->sensor.therm_poll_alarm);
 }
+void
+nouveau_therm_sensor_preinit(struct nouveau_therm *therm)
+{
+        const char *sensor_avail = "yes";
+        if (therm->temp_get(therm) < 0)
+                sensor_avail = "no";
+        nv_info(therm, "internal sensor: %s\n", sensor_avail);
+}
 int
 nouveau_therm_sensor_ctor(struct nouveau_therm *therm)
 {
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 41241922263f..3b6dc883e150 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -116,6 +116,11 @@ nouveau_abi16_chan_fini(struct nouveau_abi16 *abi16,
 {
        struct nouveau_abi16_ntfy *ntfy, *temp;
+        /* wait for all activity to stop before releasing notify object, which
+         * may be still in use */
+        if (chan->chan && chan->ntfy)
+                nouveau_channel_idle(chan->chan);
        /* cleanup notifier state */
        list_for_each_entry_safe(ntfy, temp, &chan->notifiers, head) {
                nouveau_abi16_ntfy_fini(chan, ntfy);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 11ca82148edc..7ff10711a4d0 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -801,7 +801,7 @@ nv50_bo_move_m2mf(struct nouveau_channel *chan, struct ttm_buffer_object *bo,
                stride  = 16 * 4;
                height  = amount / stride;
-                if (new_mem->mem_type == TTM_PL_VRAM &&
+                if (old_mem->mem_type == TTM_PL_VRAM &&
                    nouveau_bo_tile_layout(nvbo)) {
                        ret = RING_SPACE(chan, 8);
                        if (ret)
@@ -823,7 +823,7 @@ nv50_bo_move_m2mf(struct nouveau_channel *chan, struct ttm_buffer_object *bo,
                        BEGIN_NV04(chan, NvSubCopy, 0x0200, 1);
                        OUT_RING  (chan, 1);
                }
-                if (old_mem->mem_type == TTM_PL_VRAM &&
+                if (new_mem->mem_type == TTM_PL_VRAM &&
                    nouveau_bo_tile_layout(nvbo)) {
                        ret = RING_SPACE(chan, 8);
                        if (ret)
diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.c b/drivers/gpu/drm/nouveau/nouveau_pm.c
index bb54098c6d97..936b442a6ab7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_pm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_pm.c
@@ -402,8 +402,12 @@ nouveau_hwmon_show_temp(struct device *d, struct device_attribute *a, char *buf)
        struct drm_device *dev = dev_get_drvdata(d);
        struct nouveau_drm *drm = nouveau_drm(dev);
        struct nouveau_therm *therm = nouveau_therm(drm->device);
+        int temp = therm->temp_get(therm);
-        return snprintf(buf, PAGE_SIZE, "%d\n", therm->temp_get(therm) * 1000);
+        if (temp < 0)
+                return temp;
+        return snprintf(buf, PAGE_SIZE, "%d\n", temp * 1000);
 }
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, nouveau_hwmon_show_temp,
                                                  NULL, 0);
@@ -871,7 +875,12 @@ static SENSOR_DEVICE_ATTR(pwm1_max, S_IRUGO | S_IWUSR,
                          nouveau_hwmon_get_pwm1_max,
                          nouveau_hwmon_set_pwm1_max, 0);
-static struct attribute *hwmon_attributes[] = {
+static struct attribute *hwmon_default_attributes[] = {
+        &sensor_dev_attr_name.dev_attr.attr,
+        &sensor_dev_attr_update_rate.dev_attr.attr,
+        NULL
+};
+static struct attribute *hwmon_temp_attributes[] = {
        &sensor_dev_attr_temp1_input.dev_attr.attr,
        &sensor_dev_attr_temp1_auto_point1_pwm.dev_attr.attr,
        &sensor_dev_attr_temp1_auto_point1_temp.dev_attr.attr,
@@ -882,8 +891,6 @@ static struct attribute *hwmon_attributes[] = {
        &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
        &sensor_dev_attr_temp1_emergency.dev_attr.attr,
        &sensor_dev_attr_temp1_emergency_hyst.dev_attr.attr,
-        &sensor_dev_attr_name.dev_attr.attr,
-        &sensor_dev_attr_update_rate.dev_attr.attr,
        NULL
 };
 static struct attribute *hwmon_fan_rpm_attributes[] = {
@@ -898,8 +905,11 @@ static struct attribute *hwmon_pwm_fan_attributes[] = {
        NULL
 };
-static const struct attribute_group hwmon_attrgroup = {
+static const struct attribute_group hwmon_default_attrgroup = {
-        .attrs = hwmon_attributes,
+        .attrs = hwmon_default_attributes,
+};
+static const struct attribute_group hwmon_temp_attrgroup = {
+        .attrs = hwmon_temp_attributes,
 };
 static const struct attribute_group hwmon_fan_rpm_attrgroup = {
        .attrs = hwmon_fan_rpm_attributes,
@@ -931,13 +941,22 @@ nouveau_hwmon_init(struct drm_device *dev)
        }
        dev_set_drvdata(hwmon_dev, dev);
-        /* default sysfs entries */
+        /* set the default attributes */
-        ret = sysfs_create_group(&hwmon_dev->kobj, &hwmon_attrgroup);
+        ret = sysfs_create_group(&hwmon_dev->kobj, &hwmon_default_attrgroup);
        if (ret) {
                if (ret)
                        goto error;
        }
+        /* if the card has a working thermal sensor */
+        if (therm->temp_get(therm) >= 0) {
+                ret = sysfs_create_group(&hwmon_dev->kobj, &hwmon_temp_attrgroup);
+                if (ret) {
+                        if (ret)
+                                goto error;
+                }
+        }
        /* if the card has a pwm fan */
        /*XXX: incorrect, need better detection for this, some boards have
         *     the gpio entries for pwm fan control even when there's no
@@ -979,11 +998,10 @@ nouveau_hwmon_fini(struct drm_device *dev)
        struct nouveau_pm *pm = nouveau_pm(dev);
        if (pm->hwmon) {
-                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_attrgroup);
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_default_attrgroup);
-                sysfs_remove_group(&pm->hwmon->kobj,
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_temp_attrgroup);
-                                   &hwmon_pwm_fan_attrgroup);
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_pwm_fan_attrgroup);
-                sysfs_remove_group(&pm->hwmon->kobj,
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_fan_rpm_attrgroup);
-                                   &hwmon_fan_rpm_attrgroup);
                hwmon_device_unregister(pm->hwmon);
        }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 87a5a56ed358..7f0e6c3f37d1 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -524,6 +524,8 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        swap_interval <<= 4;
        if (swap_interval == 0)
                swap_interval |= 0x100;
+        if (chan == NULL)
+                evo_sync(crtc->dev);
        push = evo_wait(sync, 128);
        if (unlikely(push == NULL))
@@ -586,8 +588,6 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                sync->addr ^= 0x10;
                sync->data++;
                FIRE_RING (chan);
-        } else {
-                evo_sync(crtc->dev);
        }
        /* queue the flip */
@@ -2276,6 +2276,7 @@ nv50_display_create(struct drm_device *dev)
                        NV_WARN(drm, "failed to create encoder %d/%d/%d: %d\n",
                                     dcbe->location, dcbe->type,
                                     ffs(dcbe->or) - 1, ret);
+                        ret = 0;
                }
        }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index d4c633e12863..27769e724b6d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -468,13 +468,19 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                    (rdev->pdev->device == 0x9907) ||
                    (rdev->pdev->device == 0x9908) ||
                    (rdev->pdev->device == 0x9909) ||
+                    (rdev->pdev->device == 0x990B) ||
+                    (rdev->pdev->device == 0x990C) ||
+                    (rdev->pdev->device == 0x990F) ||
                    (rdev->pdev->device == 0x9910) ||
-                    (rdev->pdev->device == 0x9917)) {
+                    (rdev->pdev->device == 0x9917) ||
+                    (rdev->pdev->device == 0x9999)) {
                        rdev->config.cayman.max_simds_per_se = 6;
                        rdev->config.cayman.max_backends_per_se = 2;
                } else if ((rdev->pdev->device == 0x9903) ||
                           (rdev->pdev->device == 0x9904) ||
                           (rdev->pdev->device == 0x990A) ||
+                           (rdev->pdev->device == 0x990D) ||
+                           (rdev->pdev->device == 0x990E) ||
                           (rdev->pdev->device == 0x9913) ||
                           (rdev->pdev->device == 0x9918)) {
                        rdev->config.cayman.max_simds_per_se = 4;
@@ -483,6 +489,9 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                           (rdev->pdev->device == 0x9990) ||
                           (rdev->pdev->device == 0x9991) ||
                           (rdev->pdev->device == 0x9994) ||
+                           (rdev->pdev->device == 0x9995) ||
+                           (rdev->pdev->device == 0x9996) ||
+                           (rdev->pdev->device == 0x999A) ||
                           (rdev->pdev->device == 0x99A0)) {
                        rdev->config.cayman.max_simds_per_se = 3;
                        rdev->config.cayman.max_backends_per_se = 1;
@@ -616,11 +625,22 @@ static void cayman_gpu_init(struct radeon_device *rdev)
        WREG32(DMA_TILING_CONFIG + DMA0_REGISTER_OFFSET, gb_addr_config);
        WREG32(DMA_TILING_CONFIG + DMA1_REGISTER_OFFSET, gb_addr_config);
-        tmp = gb_addr_config & NUM_PIPES_MASK;
+        if ((rdev->config.cayman.max_backends_per_se == 1) &&
-        tmp = r6xx_remap_render_backend(rdev, tmp,
+            (rdev->flags & RADEON_IS_IGP)) {
-                                        rdev->config.cayman.max_backends_per_se *
+                if ((disabled_rb_mask & 3) == 1) {
-                                        rdev->config.cayman.max_shader_engines,
+                        /* RB0 disabled, RB1 enabled */
-                                        CAYMAN_MAX_BACKENDS, disabled_rb_mask);
+                        tmp = 0x11111111;
+                } else {
+                        /* RB1 disabled, RB0 enabled */
+                        tmp = 0x00000000;
+                }
+        } else {
+                tmp = gb_addr_config & NUM_PIPES_MASK;
+                tmp = r6xx_remap_render_backend(rdev, tmp,
+                                                rdev->config.cayman.max_backends_per_se *
+                                                rdev->config.cayman.max_shader_engines,
+                                                CAYMAN_MAX_BACKENDS, disabled_rb_mask);
+        }
        WREG32(GB_BACKEND_MAP, tmp);
        cgts_tcc_disable = 0xffff0000;
@@ -1771,6 +1791,7 @@ int cayman_resume(struct radeon_device *rdev)
 int cayman_suspend(struct radeon_device *rdev)
 {
        r600_audio_fini(rdev);
+        radeon_vm_manager_fini(rdev);
        cayman_cp_enable(rdev, false);
        cayman_dma_stop(rdev);
        evergreen_irq_suspend(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
index bedda9caadd9..6e05a2e75a46 100644
--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
@@ -122,10 +122,7 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
                goto out_cleanup;
        }
-        /* r100 doesn't have dma engine so skip the test */
+        if (rdev->asic->copy.dma) {
-        /* also, VRAM-to-VRAM test doesn't make much sense for DMA */
-        /* skip it as well if domains are the same */
-        if ((rdev->asic->copy.dma) && (sdomain != ddomain)) {
                time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
                                                RADEON_BENCHMARK_COPY_DMA, n);
                if (time < 0)
@@ -135,13 +132,15 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
                                                     sdomain, ddomain, "dma");
        }
-        time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+        if (rdev->asic->copy.blit) {
-                                        RADEON_BENCHMARK_COPY_BLIT, n);
+                time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-        if (time < 0)
+                                                RADEON_BENCHMARK_COPY_BLIT, n);
-                goto out_cleanup;
+                if (time < 0)
-        if (time > 0)
+                        goto out_cleanup;
-                radeon_benchmark_log_results(n, size, time,
+                if (time > 0)
-                                             sdomain, ddomain, "blit");
+                        radeon_benchmark_log_results(n, size, time,
+                                                     sdomain, ddomain, "blit");
+        }
 out_cleanup:
        if (sobj) {
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 9128120da044..bafbe3216952 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -4469,6 +4469,7 @@ int si_resume(struct radeon_device *rdev)
 int si_suspend(struct radeon_device *rdev)
 {
+        radeon_vm_manager_fini(rdev);
        si_cp_enable(rdev, false);
        cayman_dma_stop(rdev);
        si_irq_suspend(rdev);
diff --git a/drivers/hwmon/lineage-pem.c b/drivers/hwmon/lineage-pem.c
index 41df29f59b0e..ebbb9f4f27a3 100644
--- a/drivers/hwmon/lineage-pem.c
+++ b/drivers/hwmon/lineage-pem.c
@@ -422,6 +422,7 @@ static struct attribute *pem_input_attributes[] = {
        &sensor_dev_attr_in2_input.dev_attr.attr,
        &sensor_dev_attr_curr1_input.dev_attr.attr,
        &sensor_dev_attr_power1_input.dev_attr.attr,
+        NULL
 };
 static const struct attribute_group pem_input_group = {
@@ -432,6 +433,7 @@ static struct attribute *pem_fan_attributes[] = {
        &sensor_dev_attr_fan1_input.dev_attr.attr,
        &sensor_dev_attr_fan2_input.dev_attr.attr,
        &sensor_dev_attr_fan3_input.dev_attr.attr,
+        NULL
 };
 static const struct attribute_group pem_fan_group = {
diff --git a/drivers/hwmon/lm75.h b/drivers/hwmon/lm75.h
index 668ff4721323..5cde94e56f17 100644
--- a/drivers/hwmon/lm75.h
+++ b/drivers/hwmon/lm75.h
@@ -25,7 +25,7 @@
    which contains this code, we don't worry about the wasted space.
 */
-#include <linux/hwmon.h>
+#include <linux/kernel.h>
 /* straight from the datasheet */
 #define LM75_TEMP_MIN (-55000)
diff --git a/drivers/hwmon/pmbus/ltc2978.c b/drivers/hwmon/pmbus/ltc2978.c
index a58de38e23d8..6d6130752f94 100644
--- a/drivers/hwmon/pmbus/ltc2978.c
+++ b/drivers/hwmon/pmbus/ltc2978.c
@@ -59,7 +59,7 @@ enum chips { ltc2978, ltc3880 };
 struct ltc2978_data {
        enum chips id;
        int vin_min, vin_max;
-        int temp_min, temp_max;
+        int temp_min, temp_max[2];
        int vout_min[8], vout_max[8];
        int iout_max[2];
        int temp2_max;
@@ -113,9 +113,10 @@ static int ltc2978_read_word_data_common(struct i2c_client *client, int page,
                ret = pmbus_read_word_data(client, page,
                                           LTC2978_MFR_TEMPERATURE_PEAK);
                if (ret >= 0) {
-                        if (lin11_to_val(ret) > lin11_to_val(data->temp_max))
+                        if (lin11_to_val(ret)
-                                data->temp_max = ret;
+                            > lin11_to_val(data->temp_max[page]))
-                        ret = data->temp_max;
+                                data->temp_max[page] = ret;
+                        ret = data->temp_max[page];
                }
                break;
        case PMBUS_VIRT_RESET_VOUT_HISTORY:
@@ -266,7 +267,7 @@ static int ltc2978_write_word_data(struct i2c_client *client, int page,
                break;
        case PMBUS_VIRT_RESET_TEMP_HISTORY:
                data->temp_min = 0x7bff;
-                data->temp_max = 0x7c00;
+                data->temp_max[page] = 0x7c00;
                ret = ltc2978_clear_peaks(client, page, data->id);
                break;
        default:
@@ -323,7 +324,8 @@ static int ltc2978_probe(struct i2c_client *client,
        data->vin_min = 0x7bff;
        data->vin_max = 0x7c00;
        data->temp_min = 0x7bff;
-        data->temp_max = 0x7c00;
+        for (i = 0; i < ARRAY_SIZE(data->temp_max); i++)
+                data->temp_max[i] = 0x7c00;
        data->temp2_max = 0x7c00;
        switch (data->id) {
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 80eef50c50fd..9add60920ac0 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -766,12 +766,14 @@ static ssize_t pmbus_show_label(struct device *dev,
 static int pmbus_add_attribute(struct pmbus_data *data, struct attribute *attr)
 {
        if (data->num_attributes >= data->max_attributes - 1) {
-                data->max_attributes += PMBUS_ATTR_ALLOC_SIZE;
+                int new_max_attrs = data->max_attributes + PMBUS_ATTR_ALLOC_SIZE;
-                data->group.attrs = krealloc(data->group.attrs,
+                void *new_attrs = krealloc(data->group.attrs,
-                                             sizeof(struct attribute *) *
+                                           new_max_attrs * sizeof(void *),
-                                             data->max_attributes, GFP_KERNEL);
+                                           GFP_KERNEL);
-                if (data->group.attrs == NULL)
+                if (!new_attrs)
                        return -ENOMEM;
+                data->group.attrs = new_attrs;
+                data->max_attributes = new_max_attrs;
        }
        data->group.attrs[data->num_attributes++] = attr;
diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig
index 46cde098c11c..e380c6eef3af 100644
--- a/drivers/i2c/Kconfig
+++ b/drivers/i2c/Kconfig
@@ -4,7 +4,6 @@
 menuconfig I2C
        tristate "I2C support"
-        depends on !S390
        select RT_MUTEXES
        ---help---
          I2C (pronounce: I-squared-C) is a slow serial bus protocol used in
@@ -76,6 +75,7 @@ config I2C_HELPER_AUTO
 config I2C_SMBUS
        tristate "SMBus-specific protocols" if !I2C_HELPER_AUTO
+        depends on GENERIC_HARDIRQS
        help
          Say Y here if you want support for SMBus extensions to the I2C
          specification. At the moment, the only supported extension is
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index a3725de92384..adfee98486b1 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -114,7 +114,7 @@ config I2C_I801
 config I2C_ISCH
        tristate "Intel SCH SMBus 1.0"
-        depends on PCI
+        depends on PCI && GENERIC_HARDIRQS
        select LPC_SCH
        help
          Say Y here if you want to use SMBus controller on the Intel SCH
@@ -543,6 +543,7 @@ config I2C_NUC900
 config I2C_OCORES
        tristate "OpenCores I2C Controller"
+        depends on GENERIC_HARDIRQS
        help
          If you say yes to this option, support will be included for the
          OpenCores I2C controller. For details see
@@ -777,7 +778,7 @@ config I2C_DIOLAN_U2C
 config I2C_PARPORT
        tristate "Parallel port adapter"
-        depends on PARPORT
+        depends on PARPORT && GENERIC_HARDIRQS
        select I2C_ALGOBIT
        select I2C_SMBUS
        help
@@ -802,6 +803,7 @@ config I2C_PARPORT
 config I2C_PARPORT_LIGHT
        tristate "Parallel port adapter (light)"
+        depends on GENERIC_HARDIRQS
        select I2C_ALGOBIT
        select I2C_SMBUS
        help
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index e9205ee8cf94..130f02cc9d94 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -80,6 +80,7 @@
 /* PCI DIDs for the Intel SMBus Message Transport (SMT) Devices */
 #define PCI_DEVICE_ID_INTEL_S1200_SMT0  0x0c59
 #define PCI_DEVICE_ID_INTEL_S1200_SMT1  0x0c5a
+#define PCI_DEVICE_ID_INTEL_AVOTON_SMT  0x1f15
 #define ISMT_DESC_ENTRIES       32      /* number of descriptor entries */
 #define ISMT_MAX_RETRIES        3       /* number of SMBus retries to attempt */
@@ -185,6 +186,7 @@ struct ismt_priv {
 static const DEFINE_PCI_DEVICE_TABLE(ismt_ids) = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_S1200_SMT0) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_S1200_SMT1) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_AVOTON_SMT) },
        { 0, }
 };
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index 36704e3ab3fa..b714776b6ddd 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -411,7 +411,11 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev)
        int clk_multiplier = I2C_CLK_MULTIPLIER_STD_FAST_MODE;
        u32 clk_divisor;
-        tegra_i2c_clock_enable(i2c_dev);
+        err = tegra_i2c_clock_enable(i2c_dev);
+        if (err < 0) {
+                dev_err(i2c_dev->dev, "Clock enable failed %d\n", err);
+                return err;
+        }
        tegra_periph_reset_assert(i2c_dev->div_clk);
        udelay(2);
@@ -628,7 +632,12 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
        if (i2c_dev->is_suspended)
                return -EBUSY;
-        tegra_i2c_clock_enable(i2c_dev);
+        ret = tegra_i2c_clock_enable(i2c_dev);
+        if (ret < 0) {
+                dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret);
+                return ret;
+        }
        for (i = 0; i < num; i++) {
                enum msg_end_type end_type = MSG_END_STOP;
                if (i < (num - 1)) {
diff --git a/drivers/i2c/muxes/i2c-mux-pca9541.c b/drivers/i2c/muxes/i2c-mux-pca9541.c
index f3b8f9a6a89b..966a18a5d12d 100644
--- a/drivers/i2c/muxes/i2c-mux-pca9541.c
+++ b/drivers/i2c/muxes/i2c-mux-pca9541.c
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2010 Ericsson AB.
 *
- * Author: Guenter Roeck <guenter.roeck@ericsson.com>
+ * Author: Guenter Roeck <linux@roeck-us.net>
 *
 * Derived from:
 *  pca954x.c
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index 0198324a8b0c..bd33473f8e38 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -62,7 +62,7 @@ st_sensors_match_odr_error:
 int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
 {
        int err;
-        struct st_sensor_odr_avl odr_out;
+        struct st_sensor_odr_avl odr_out = {0, 0};
        struct st_sensor_data *sdata = iio_priv(indio_dev);
        err = st_sensors_match_odr(sdata->sensor, odr, &odr_out);
@@ -114,7 +114,7 @@ st_sensors_match_odr_error:
 static int st_sensors_set_fullscale(struct iio_dev *indio_dev, unsigned int fs)
 {
-        int err, i;
+        int err, i = 0;
        struct st_sensor_data *sdata = iio_priv(indio_dev);
        err = st_sensors_match_fs(sdata->sensor, fs, &i);
@@ -139,14 +139,13 @@ st_accel_set_fullscale_error:
 int st_sensors_set_enable(struct iio_dev *indio_dev, bool enable)
 {
-        bool found;
        u8 tmp_value;
        int err = -EINVAL;
-        struct st_sensor_odr_avl odr_out;
+        bool found = false;
+        struct st_sensor_odr_avl odr_out = {0, 0};
        struct st_sensor_data *sdata = iio_priv(indio_dev);
        if (enable) {
-                found = false;
                tmp_value = sdata->sensor->pw.value_on;
                if ((sdata->sensor->odr.addr == sdata->sensor->pw.addr) &&
                        (sdata->sensor->odr.mask == sdata->sensor->pw.mask)) {
diff --git a/drivers/iio/dac/ad5064.c b/drivers/iio/dac/ad5064.c
index 2fe1d4edcb2f..74f2d52795f6 100644
--- a/drivers/iio/dac/ad5064.c
+++ b/drivers/iio/dac/ad5064.c
@@ -27,7 +27,6 @@
 #define AD5064_ADDR(x)                          ((x) << 20)
 #define AD5064_CMD(x)                           ((x) << 24)
-#define AD5064_ADDR_DAC(chan)                   (chan)
 #define AD5064_ADDR_ALL_DAC                     0xF
 #define AD5064_CMD_WRITE_INPUT_N                0x0
@@ -131,15 +130,15 @@ static int ad5064_write(struct ad5064_state *st, unsigned int cmd,
 }
 static int ad5064_sync_powerdown_mode(struct ad5064_state *st,
-        unsigned int channel)
+        const struct iio_chan_spec *chan)
 {
        unsigned int val;
        int ret;
-        val = (0x1 << channel);
+        val = (0x1 << chan->address);
-        if (st->pwr_down[channel])
+        if (st->pwr_down[chan->channel])
-                val |= st->pwr_down_mode[channel] << 8;
+                val |= st->pwr_down_mode[chan->channel] << 8;
        ret = ad5064_write(st, AD5064_CMD_POWERDOWN_DAC, 0, val, 0);
@@ -169,7 +168,7 @@ static int ad5064_set_powerdown_mode(struct iio_dev *indio_dev,
        mutex_lock(&indio_dev->mlock);
        st->pwr_down_mode[chan->channel] = mode + 1;
-        ret = ad5064_sync_powerdown_mode(st, chan->channel);
+        ret = ad5064_sync_powerdown_mode(st, chan);
        mutex_unlock(&indio_dev->mlock);
        return ret;
@@ -205,7 +204,7 @@ static ssize_t ad5064_write_dac_powerdown(struct iio_dev *indio_dev,
        mutex_lock(&indio_dev->mlock);
        st->pwr_down[chan->channel] = pwr_down;
-        ret = ad5064_sync_powerdown_mode(st, chan->channel);
+        ret = ad5064_sync_powerdown_mode(st, chan);
        mutex_unlock(&indio_dev->mlock);
        return ret ? ret : len;
 }
@@ -258,7 +257,7 @@ static int ad5064_write_raw(struct iio_dev *indio_dev,
        switch (mask) {
        case IIO_CHAN_INFO_RAW:
-                if (val > (1 << chan->scan_type.realbits) || val < 0)
+                if (val >= (1 << chan->scan_type.realbits) || val < 0)
                        return -EINVAL;
                mutex_lock(&indio_dev->mlock);
@@ -292,34 +291,44 @@ static const struct iio_chan_spec_ext_info ad5064_ext_info[] = {
        { },
 };
-#define AD5064_CHANNEL(chan, bits) {                            \
+#define AD5064_CHANNEL(chan, addr, bits) {                      \
        .type = IIO_VOLTAGE,                                    \
        .indexed = 1,                                           \
        .output = 1,                                            \
        .channel = (chan),                                      \
        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |           \
        IIO_CHAN_INFO_SCALE_SEPARATE_BIT,                       \
-        .address = AD5064_ADDR_DAC(chan),                       \
+        .address = addr,                                        \
        .scan_type = IIO_ST('u', (bits), 16, 20 - (bits)),      \
        .ext_info = ad5064_ext_info,                            \
 }
 #define DECLARE_AD5064_CHANNELS(name, bits) \
 const struct iio_chan_spec name[] = { \
-        AD5064_CHANNEL(0, bits), \
+        AD5064_CHANNEL(0, 0, bits), \
-        AD5064_CHANNEL(1, bits), \
+        AD5064_CHANNEL(1, 1, bits), \
-        AD5064_CHANNEL(2, bits), \
+        AD5064_CHANNEL(2, 2, bits), \
-        AD5064_CHANNEL(3, bits), \
+        AD5064_CHANNEL(3, 3, bits), \
-        AD5064_CHANNEL(4, bits), \
+        AD5064_CHANNEL(4, 4, bits), \
-        AD5064_CHANNEL(5, bits), \
+        AD5064_CHANNEL(5, 5, bits), \
-        AD5064_CHANNEL(6, bits), \
+        AD5064_CHANNEL(6, 6, bits), \
-        AD5064_CHANNEL(7, bits), \
+        AD5064_CHANNEL(7, 7, bits), \
+}
+#define DECLARE_AD5065_CHANNELS(name, bits) \
+const struct iio_chan_spec name[] = { \
+        AD5064_CHANNEL(0, 0, bits), \
+        AD5064_CHANNEL(1, 3, bits), \
 }
 static DECLARE_AD5064_CHANNELS(ad5024_channels, 12);
 static DECLARE_AD5064_CHANNELS(ad5044_channels, 14);
 static DECLARE_AD5064_CHANNELS(ad5064_channels, 16);
+static DECLARE_AD5065_CHANNELS(ad5025_channels, 12);
+static DECLARE_AD5065_CHANNELS(ad5045_channels, 14);
+static DECLARE_AD5065_CHANNELS(ad5065_channels, 16);
 static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
        [ID_AD5024] = {
                .shared_vref = false,
@@ -328,7 +337,7 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
        },
        [ID_AD5025] = {
                .shared_vref = false,
-                .channels = ad5024_channels,
+                .channels = ad5025_channels,
                .num_channels = 2,
        },
        [ID_AD5044] = {
@@ -338,7 +347,7 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
        },
        [ID_AD5045] = {
                .shared_vref = false,
-                .channels = ad5044_channels,
+                .channels = ad5045_channels,
                .num_channels = 2,
        },
        [ID_AD5064] = {
@@ -353,7 +362,7 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
        },
        [ID_AD5065] = {
                .shared_vref = false,
-                .channels = ad5064_channels,
+                .channels = ad5065_channels,
                .num_channels = 2,
        },
        [ID_AD5628_1] = {
@@ -429,6 +438,7 @@ static int ad5064_probe(struct device *dev, enum ad5064_type type,
 {
        struct iio_dev *indio_dev;
        struct ad5064_state *st;
+        unsigned int midscale;
        unsigned int i;
        int ret;
@@ -465,11 +475,6 @@ static int ad5064_probe(struct device *dev, enum ad5064_type type,
                        goto error_free_reg;
        }
-        for (i = 0; i < st->chip_info->num_channels; ++i) {
-                st->pwr_down_mode[i] = AD5064_LDAC_PWRDN_1K;
-                st->dac_cache[i] = 0x8000;
-        }
        indio_dev->dev.parent = dev;
        indio_dev->name = name;
        indio_dev->info = &ad5064_info;
@@ -477,6 +482,13 @@ static int ad5064_probe(struct device *dev, enum ad5064_type type,
        indio_dev->channels = st->chip_info->channels;
        indio_dev->num_channels = st->chip_info->num_channels;
+        midscale = (1 << indio_dev->channels[0].scan_type.realbits) /  2;
+        for (i = 0; i < st->chip_info->num_channels; ++i) {
+                st->pwr_down_mode[i] = AD5064_LDAC_PWRDN_1K;
+                st->dac_cache[i] = midscale;
+        }
        ret = iio_device_register(indio_dev);
        if (ret)
                goto error_disable_reg;
diff --git a/drivers/iio/imu/inv_mpu6050/Kconfig b/drivers/iio/imu/inv_mpu6050/Kconfig
index b5cfa3a354cf..361b2328453d 100644
--- a/drivers/iio/imu/inv_mpu6050/Kconfig
+++ b/drivers/iio/imu/inv_mpu6050/Kconfig
@@ -5,6 +5,7 @@
 config INV_MPU6050_IIO
        tristate "Invensense MPU6050 devices"
        depends on I2C && SYSFS
+        select IIO_BUFFER
        select IIO_TRIGGERED_BUFFER
        help
          This driver supports the Invensense MPU6050 devices.
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 565bfb161c1a..a3fde52840ca 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1575,6 +1575,12 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
        neigh = dst_neigh_lookup(ep->dst,
                        &ep->com.cm_id->remote_addr.sin_addr.s_addr);
+        if (!neigh) {
+                pr_err("%s - cannot alloc neigh.\n", __func__);
+                err = -ENOMEM;
+                goto fail4;
+        }
        /* get a l2t entry */
        if (neigh->dev->flags & IFF_LOOPBACK) {
                PDBG("%s LOOPBACK\n", __func__);
@@ -3053,6 +3059,12 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
        dst = &rt->dst;
        neigh = dst_neigh_lookup_skb(dst, skb);
+        if (!neigh) {
+                pr_err("%s - failed to allocate neigh!\n",
+                       __func__);
+                goto free_dst;
+        }
        if (neigh->dev->flags & IFF_LOOPBACK) {
                pdev = ip_dev_find(&init_net, iph->daddr);
                e = cxgb4_l2t_get(dev->rdev.lldi.l2t, neigh,
diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
index e0d79b2395e4..add98d01476c 100644
--- a/drivers/infiniband/hw/mlx4/cm.c
+++ b/drivers/infiniband/hw/mlx4/cm.c
@@ -362,7 +362,6 @@ void mlx4_ib_cm_paravirt_init(struct mlx4_ib_dev *dev)
        INIT_LIST_HEAD(&dev->sriov.cm_list);
        dev->sriov.sl_id_map = RB_ROOT;
        idr_init(&dev->sriov.pv_id_table);
-        idr_pre_get(&dev->sriov.pv_id_table, GFP_KERNEL);
 }
 /* slave = -1 ==> all slaves */
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 7cd74e29cbc8..9135606c8649 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -158,14 +158,10 @@ static unsigned int get_time_pit(void)
 #define GET_TIME(x)     rdtscl(x)
 #define DELTA(x,y)      ((y)-(x))
 #define TIME_NAME       "TSC"
-#elif defined(__alpha__)
+#elif defined(__alpha__) || defined(CONFIG_MN10300) || defined(CONFIG_ARM) || defined(CONFIG_TILE)
 #define GET_TIME(x)     do { x = get_cycles(); } while (0)
 #define DELTA(x,y)      ((y)-(x))
-#define TIME_NAME       "PCC"
+#define TIME_NAME       "get_cycles"
-#elif defined(CONFIG_MN10300) || defined(CONFIG_TILE)
-#define GET_TIME(x)     do { x = get_cycles(); } while (0)
-#define DELTA(x, y)     ((x) - (y))
-#define TIME_NAME       "TSC"
 #else
 #define FAKE_TIME
 static unsigned long analog_faketime = 0;
diff --git a/drivers/input/keyboard/tc3589x-keypad.c b/drivers/input/keyboard/tc3589x-keypad.c
index 2fb0d76a04c4..208de7cbb7fa 100644
--- a/drivers/input/keyboard/tc3589x-keypad.c
+++ b/drivers/input/keyboard/tc3589x-keypad.c
@@ -70,8 +70,6 @@
 #define TC3589x_EVT_INT_CLR     0x2
 #define TC3589x_KBD_INT_CLR     0x1
-#define TC3589x_KBD_KEYMAP_SIZE     64
 /**
 * struct tc_keypad - data structure used by keypad driver
 * @tc3589x:    pointer to tc35893
@@ -88,7 +86,7 @@ struct tc_keypad {
        const struct tc3589x_keypad_platform_data *board;
        unsigned int krow;
        unsigned int kcol;
-        unsigned short keymap[TC3589x_KBD_KEYMAP_SIZE];
+        unsigned short *keymap;
        bool keypad_stopped;
 };
@@ -338,12 +336,14 @@ static int tc3589x_keypad_probe(struct platform_device *pdev)
        error = matrix_keypad_build_keymap(plat->keymap_data, NULL,
                                           TC3589x_MAX_KPROW, TC3589x_MAX_KPCOL,
-                                           keypad->keymap, input);
+                                           NULL, input);
        if (error) {
                dev_err(&pdev->dev, "Failed to build keymap\n");
                goto err_free_mem;
        }
+        keypad->keymap = input->keycode;
        input_set_capability(input, EV_MSC, MSC_SCAN);
        if (!plat->no_autorepeat)
                __set_bit(EV_REP, input->evbit);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 7b99fc7c9438..0238e0e14335 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -490,6 +490,29 @@ static void alps_decode_rushmore(struct alps_fields *f, unsigned char *p)
        f->y_map |= (p[5] & 0x20) << 6;
 }
+static void alps_decode_dolphin(struct alps_fields *f, unsigned char *p)
+{
+        f->first_mp = !!(p[0] & 0x02);
+        f->is_mp = !!(p[0] & 0x20);
+        f->fingers = ((p[0] & 0x6) >> 1 |
+                     (p[0] & 0x10) >> 2);
+        f->x_map = ((p[2] & 0x60) >> 5) |
+                   ((p[4] & 0x7f) << 2) |
+                   ((p[5] & 0x7f) << 9) |
+                   ((p[3] & 0x07) << 16) |
+                   ((p[3] & 0x70) << 15) |
+                   ((p[0] & 0x01) << 22);
+        f->y_map = (p[1] & 0x7f) |
+                   ((p[2] & 0x1f) << 7);
+        f->x = ((p[1] & 0x7f) | ((p[4] & 0x0f) << 7));
+        f->y = ((p[2] & 0x7f) | ((p[4] & 0xf0) << 3));
+        f->z = (p[0] & 4) ? 0 : p[5] & 0x7f;
+        alps_decode_buttons_v3(f, p);
+}
 static void alps_process_touchpad_packet_v3(struct psmouse *psmouse)
 {
        struct alps_data *priv = psmouse->private;
@@ -874,7 +897,8 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
        }
        /* Bytes 2 - pktsize should have 0 in the highest bit */
-        if (psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
+        if (priv->proto_version != ALPS_PROTO_V5 &&
+            psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
            (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
                psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
                            psmouse->pktcnt - 1,
@@ -994,8 +1018,7 @@ static int alps_rpt_cmd(struct psmouse *psmouse, int init_command,
        return 0;
 }
-static int alps_enter_command_mode(struct psmouse *psmouse,
+static int alps_enter_command_mode(struct psmouse *psmouse)
-                                   unsigned char *resp)
 {
        unsigned char param[4];
@@ -1004,14 +1027,12 @@ static int alps_enter_command_mode(struct psmouse *psmouse,
                return -1;
        }
-        if (param[0] != 0x88 || (param[1] != 0x07 && param[1] != 0x08)) {
+        if ((param[0] != 0x88 || (param[1] != 0x07 && param[1] != 0x08)) &&
+            param[0] != 0x73) {
                psmouse_dbg(psmouse,
                            "unknown response while entering command mode\n");
                return -1;
        }
-        if (resp)
-                *resp = param[2];
        return 0;
 }
@@ -1176,7 +1197,7 @@ static int alps_passthrough_mode_v3(struct psmouse *psmouse,
 {
        int reg_val, ret = -1;
-        if (alps_enter_command_mode(psmouse, NULL))
+        if (alps_enter_command_mode(psmouse))
                return -1;
        reg_val = alps_command_mode_read_reg(psmouse, reg_base + 0x0008);
@@ -1216,7 +1237,7 @@ static int alps_probe_trackstick_v3(struct psmouse *psmouse, int reg_base)
 {
        int ret = -EIO, reg_val;
-        if (alps_enter_command_mode(psmouse, NULL))
+        if (alps_enter_command_mode(psmouse))
                goto error;
        reg_val = alps_command_mode_read_reg(psmouse, reg_base + 0x08);
@@ -1279,7 +1300,7 @@ static int alps_setup_trackstick_v3(struct psmouse *psmouse, int reg_base)
                 * supported by this driver. If bit 1 isn't set the packet
                 * format is different.
                 */
-                if (alps_enter_command_mode(psmouse, NULL) ||
+                if (alps_enter_command_mode(psmouse) ||
                    alps_command_mode_write_reg(psmouse,
                                                reg_base + 0x08, 0x82) ||
                    alps_exit_command_mode(psmouse))
@@ -1306,7 +1327,7 @@ static int alps_hw_init_v3(struct psmouse *psmouse)
            alps_setup_trackstick_v3(psmouse, ALPS_REG_BASE_PINNACLE) == -EIO)
                goto error;
-        if (alps_enter_command_mode(psmouse, NULL) ||
+        if (alps_enter_command_mode(psmouse) ||
            alps_absolute_mode_v3(psmouse)) {
                psmouse_err(psmouse, "Failed to enter absolute mode\n");
                goto error;
@@ -1381,7 +1402,7 @@ static int alps_hw_init_rushmore_v3(struct psmouse *psmouse)
                        priv->flags &= ~ALPS_DUALPOINT;
        }
-        if (alps_enter_command_mode(psmouse, NULL) ||
+        if (alps_enter_command_mode(psmouse) ||
            alps_command_mode_read_reg(psmouse, 0xc2d9) == -1 ||
            alps_command_mode_write_reg(psmouse, 0xc2cb, 0x00))
                goto error;
@@ -1431,7 +1452,7 @@ static int alps_hw_init_v4(struct psmouse *psmouse)
        struct ps2dev *ps2dev = &psmouse->ps2dev;
        unsigned char param[4];
-        if (alps_enter_command_mode(psmouse, NULL))
+        if (alps_enter_command_mode(psmouse))
                goto error;
        if (alps_absolute_mode_v4(psmouse)) {
@@ -1499,6 +1520,23 @@ error:
        return -1;
 }
+static int alps_hw_init_dolphin_v1(struct psmouse *psmouse)
+{
+        struct ps2dev *ps2dev = &psmouse->ps2dev;
+        unsigned char param[2];
+        /* This is dolphin "v1" as empirically defined by florin9doi */
+        param[0] = 0x64;
+        param[1] = 0x28;
+        if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSTREAM) ||
+            ps2_command(ps2dev, &param[0], PSMOUSE_CMD_SETRATE) ||
+            ps2_command(ps2dev, &param[1], PSMOUSE_CMD_SETRATE))
+                return -1;
+        return 0;
+}
 static void alps_set_defaults(struct alps_data *priv)
 {
        priv->byte0 = 0x8f;
@@ -1532,6 +1570,21 @@ static void alps_set_defaults(struct alps_data *priv)
                priv->nibble_commands = alps_v4_nibble_commands;
                priv->addr_command = PSMOUSE_CMD_DISABLE;
                break;
+        case ALPS_PROTO_V5:
+                priv->hw_init = alps_hw_init_dolphin_v1;
+                priv->process_packet = alps_process_packet_v3;
+                priv->decode_fields = alps_decode_dolphin;
+                priv->set_abs_params = alps_set_abs_params_mt;
+                priv->nibble_commands = alps_v3_nibble_commands;
+                priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
+                priv->byte0 = 0xc8;
+                priv->mask0 = 0xc8;
+                priv->flags = 0;
+                priv->x_max = 1360;
+                priv->y_max = 660;
+                priv->x_bits = 23;
+                priv->y_bits = 12;
+                break;
        }
 }
@@ -1592,6 +1645,12 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
        if (alps_match_table(psmouse, priv, e7, ec) == 0) {
                return 0;
+        } else if (e7[0] == 0x73 && e7[1] == 0x03 && e7[2] == 0x50 &&
+                   ec[0] == 0x73 && ec[1] == 0x01) {
+                priv->proto_version = ALPS_PROTO_V5;
+                alps_set_defaults(priv);
+                return 0;
        } else if (ec[0] == 0x88 && ec[1] == 0x08) {
                priv->proto_version = ALPS_PROTO_V3;
                alps_set_defaults(priv);
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index 970480551b6e..eee59853b9ce 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -16,6 +16,7 @@
 #define ALPS_PROTO_V2   2
 #define ALPS_PROTO_V3   3
 #define ALPS_PROTO_V4   4
+#define ALPS_PROTO_V5   5
 /**
 * struct alps_model_info - touchpad ID table
diff --git a/drivers/input/mouse/cypress_ps2.c b/drivers/input/mouse/cypress_ps2.c
index 1673dc6c8092..f51765fff054 100644
--- a/drivers/input/mouse/cypress_ps2.c
+++ b/drivers/input/mouse/cypress_ps2.c
@@ -236,6 +236,13 @@ static int cypress_read_fw_version(struct psmouse *psmouse)
        cytp->fw_version = param[2] & FW_VERSION_MASX;
        cytp->tp_metrics_supported = (param[2] & TP_METRICS_MASK) ? 1 : 0;
+        /*
+         * Trackpad fw_version 11 (in Dell XPS12) yields a bogus response to
+         * CYTP_CMD_READ_TP_METRICS so do not try to use it. LP: #1103594.
+         */
+        if (cytp->fw_version >= 11)
+                cytp->tp_metrics_supported = 0;
        psmouse_dbg(psmouse, "cytp->fw_version = %d\n", cytp->fw_version);
        psmouse_dbg(psmouse, "cytp->tp_metrics_supported = %d\n",
                 cytp->tp_metrics_supported);
@@ -258,6 +265,9 @@ static int cypress_read_tp_metrics(struct psmouse *psmouse)
        cytp->tp_res_x = cytp->tp_max_abs_x / cytp->tp_width;
        cytp->tp_res_y = cytp->tp_max_abs_y / cytp->tp_high;
+        if (!cytp->tp_metrics_supported)
+                return 0;
        memset(param, 0, sizeof(param));
        if (cypress_send_ext_cmd(psmouse, CYTP_CMD_READ_TP_METRICS, param) == 0) {
                /* Update trackpad parameters. */
@@ -315,18 +325,15 @@ static int cypress_read_tp_metrics(struct psmouse *psmouse)
 static int cypress_query_hardware(struct psmouse *psmouse)
 {
-        struct cytp_data *cytp = psmouse->private;
        int ret;
        ret = cypress_read_fw_version(psmouse);
        if (ret)
                return ret;
-        if (cytp->tp_metrics_supported) {
+        ret = cypress_read_tp_metrics(psmouse);
-                ret = cypress_read_tp_metrics(psmouse);
+        if (ret)
-                if (ret)
+                return ret;
-                        return ret;
-        }
        return 0;
 }
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 41b6fbf60112..1daa97913b7d 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -2017,6 +2017,9 @@ static const struct wacom_features wacom_features_0x100 =
 static const struct wacom_features wacom_features_0x101 =
        { "Wacom ISDv4 101",      WACOM_PKGLEN_MTTPC,     26202, 16325,  255,
          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0x10D =
+        { "Wacom ISDv4 10D",      WACOM_PKGLEN_MTTPC,     26202, 16325,  255,
+          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0x4001 =
        { "Wacom ISDv4 4001",      WACOM_PKGLEN_MTTPC,     26202, 16325,  255,
          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -2201,6 +2204,7 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0xEF) },
        { USB_DEVICE_WACOM(0x100) },
        { USB_DEVICE_WACOM(0x101) },
+        { USB_DEVICE_WACOM(0x10D) },
        { USB_DEVICE_WACOM(0x4001) },
        { USB_DEVICE_WACOM(0x47) },
        { USB_DEVICE_WACOM(0xF4) },
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 4f702b3ec1a3..434c3df250ca 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -236,7 +236,12 @@ static void __ads7846_disable(struct ads7846 *ts)
 /* Must be called with ts->lock held */
 static void __ads7846_enable(struct ads7846 *ts)
 {
-        regulator_enable(ts->reg);
+        int error;
+        error = regulator_enable(ts->reg);
+        if (error != 0)
+                dev_err(&ts->spi->dev, "Failed to enable supply: %d\n", error);
        ads7846_restart(ts);
 }
diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index 4a29ddf6bf1e..1443532fe6c4 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -314,15 +314,27 @@ static int mms114_start(struct mms114_data *data)
        struct i2c_client *client = data->client;
        int error;
-        if (data->core_reg)
+        error = regulator_enable(data->core_reg);
-                regulator_enable(data->core_reg);
+        if (error) {
-        if (data->io_reg)
+                dev_err(&client->dev, "Failed to enable avdd: %d\n", error);
-                regulator_enable(data->io_reg);
+                return error;
+        }
+        error = regulator_enable(data->io_reg);
+        if (error) {
+                dev_err(&client->dev, "Failed to enable vdd: %d\n", error);
+                regulator_disable(data->core_reg);
+                return error;
+        }
        mdelay(MMS114_POWERON_DELAY);
        error = mms114_setup_regs(data);
-        if (error < 0)
+        if (error < 0) {
+                regulator_disable(data->io_reg);
+                regulator_disable(data->core_reg);
                return error;
+        }
        if (data->pdata->cfg_pin)
                data->pdata->cfg_pin(true);
@@ -335,16 +347,20 @@ static int mms114_start(struct mms114_data *data)
 static void mms114_stop(struct mms114_data *data)
 {
        struct i2c_client *client = data->client;
+        int error;
        disable_irq(client->irq);
        if (data->pdata->cfg_pin)
                data->pdata->cfg_pin(false);
-        if (data->io_reg)
+        error = regulator_disable(data->io_reg);
-                regulator_disable(data->io_reg);
+        if (error)
-        if (data->core_reg)
+                dev_warn(&client->dev, "Failed to disable vdd: %d\n", error);
-                regulator_disable(data->core_reg);
+        error = regulator_disable(data->core_reg);
+        if (error)
+                dev_warn(&client->dev, "Failed to disable avdd: %d\n", error);
 }
 static int mms114_input_open(struct input_dev *dev)
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 644d72468423..a32e0d5aa45f 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -648,7 +648,7 @@ void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
        /* Convert our logical CPU mask into a physical one. */
        for_each_cpu(cpu, mask)
-                map |= 1 << cpu_logical_map(cpu);
+                map |= gic_cpu_map[cpu];
        /*
         * Ensure that stores to Normal memory are visible to the
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index 5313c9ea44dc..d9edcc94c2a8 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -237,7 +237,8 @@ config HISAX_MIC
 config HISAX_NETJET
        bool "NETjet card"
-        depends on PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on PCI && (BROKEN || !(PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on VIRT_TO_BUS
        help
          This enables HiSax support for the NetJet from Traverse
          Technologies.
@@ -248,7 +249,8 @@ config HISAX_NETJET
 config HISAX_NETJET_U
        bool "NETspider U card"
-        depends on PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on PCI && (BROKEN || !(PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on VIRT_TO_BUS
        help
          This enables HiSax support for the Netspider U interface ISDN card
          from Traverse Technologies.
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index d8a7d8323414..ebaebdf30f98 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -902,7 +902,9 @@ isdn_tty_send_msg(modem_info *info, atemu *m, char *msg)
        int j;
        int l;
-        l = strlen(msg);
+        l = min(strlen(msg), sizeof(cmd.parm) - sizeof(cmd.parm.cmsg)
+                + sizeof(cmd.parm.cmsg.para) - 2);
        if (!l) {
                isdn_tty_modem_result(RESULT_ERROR, info);
                return;
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 3c955e10a618..c6083132c4b8 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1025,6 +1025,8 @@ void dm_bufio_prefetch(struct dm_bufio_client *c,
 {
        struct blk_plug plug;
+        BUG_ON(dm_bufio_in_request());
        blk_start_plug(&plug);
        dm_bufio_lock(c);
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index fbd3625f2748..83e995fece88 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -83,6 +83,8 @@ struct cache_disk_superblock {
        __le32 read_misses;
        __le32 write_hits;
        __le32 write_misses;
+        __le32 policy_version[CACHE_POLICY_VERSION_SIZE];
 } __packed;
 struct dm_cache_metadata {
@@ -109,6 +111,7 @@ struct dm_cache_metadata {
        bool clean_when_opened:1;
        char policy_name[CACHE_POLICY_NAME_SIZE];
+        unsigned policy_version[CACHE_POLICY_VERSION_SIZE];
        size_t policy_hint_size;
        struct dm_cache_statistics stats;
 };
@@ -268,7 +271,8 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
        memset(disk_super->uuid, 0, sizeof(disk_super->uuid));
        disk_super->magic = cpu_to_le64(CACHE_SUPERBLOCK_MAGIC);
        disk_super->version = cpu_to_le32(CACHE_VERSION);
-        memset(disk_super->policy_name, 0, CACHE_POLICY_NAME_SIZE);
+        memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name));
+        memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version));
        disk_super->policy_hint_size = 0;
        r = dm_sm_copy_root(cmd->metadata_sm, &disk_super->metadata_space_map_root,
@@ -284,7 +288,6 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
        disk_super->metadata_block_size = cpu_to_le32(DM_CACHE_METADATA_BLOCK_SIZE >> SECTOR_SHIFT);
        disk_super->data_block_size = cpu_to_le32(cmd->data_block_size);
        disk_super->cache_blocks = cpu_to_le32(0);
-        memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name));
        disk_super->read_hits = cpu_to_le32(0);
        disk_super->read_misses = cpu_to_le32(0);
@@ -478,6 +481,9 @@ static void read_superblock_fields(struct dm_cache_metadata *cmd,
        cmd->data_block_size = le32_to_cpu(disk_super->data_block_size);
        cmd->cache_blocks = to_cblock(le32_to_cpu(disk_super->cache_blocks));
        strncpy(cmd->policy_name, disk_super->policy_name, sizeof(cmd->policy_name));
+        cmd->policy_version[0] = le32_to_cpu(disk_super->policy_version[0]);
+        cmd->policy_version[1] = le32_to_cpu(disk_super->policy_version[1]);
+        cmd->policy_version[2] = le32_to_cpu(disk_super->policy_version[2]);
        cmd->policy_hint_size = le32_to_cpu(disk_super->policy_hint_size);
        cmd->stats.read_hits = le32_to_cpu(disk_super->read_hits);
@@ -572,6 +578,9 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
        disk_super->discard_nr_blocks = cpu_to_le64(from_dblock(cmd->discard_nr_blocks));
        disk_super->cache_blocks = cpu_to_le32(from_cblock(cmd->cache_blocks));
        strncpy(disk_super->policy_name, cmd->policy_name, sizeof(disk_super->policy_name));
+        disk_super->policy_version[0] = cpu_to_le32(cmd->policy_version[0]);
+        disk_super->policy_version[1] = cpu_to_le32(cmd->policy_version[1]);
+        disk_super->policy_version[2] = cpu_to_le32(cmd->policy_version[2]);
        disk_super->read_hits = cpu_to_le32(cmd->stats.read_hits);
        disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses);
@@ -854,18 +863,43 @@ struct thunk {
        bool hints_valid;
 };
+static bool policy_unchanged(struct dm_cache_metadata *cmd,
+                             struct dm_cache_policy *policy)
+{
+        const char *policy_name = dm_cache_policy_get_name(policy);
+        const unsigned *policy_version = dm_cache_policy_get_version(policy);
+        size_t policy_hint_size = dm_cache_policy_get_hint_size(policy);
+        /*
+         * Ensure policy names match.
+         */
+        if (strncmp(cmd->policy_name, policy_name, sizeof(cmd->policy_name)))
+                return false;
+        /*
+         * Ensure policy major versions match.
+         */
+        if (cmd->policy_version[0] != policy_version[0])
+                return false;
+        /*
+         * Ensure policy hint sizes match.
+         */
+        if (cmd->policy_hint_size != policy_hint_size)
+                return false;
+        return true;
+}
 static bool hints_array_initialized(struct dm_cache_metadata *cmd)
 {
        return cmd->hint_root && cmd->policy_hint_size;
 }
 static bool hints_array_available(struct dm_cache_metadata *cmd,
-                                  const char *policy_name)
+                                  struct dm_cache_policy *policy)
 {
-        bool policy_names_match = !strncmp(cmd->policy_name, policy_name,
+        return cmd->clean_when_opened && policy_unchanged(cmd, policy) &&
-                                           sizeof(cmd->policy_name));
-        return cmd->clean_when_opened && policy_names_match &&
                hints_array_initialized(cmd);
 }
@@ -899,7 +933,8 @@ static int __load_mapping(void *context, uint64_t cblock, void *leaf)
        return r;
 }
-static int __load_mappings(struct dm_cache_metadata *cmd, const char *policy_name,
+static int __load_mappings(struct dm_cache_metadata *cmd,
+                           struct dm_cache_policy *policy,
                           load_mapping_fn fn, void *context)
 {
        struct thunk thunk;
@@ -909,18 +944,19 @@ static int __load_mappings(struct dm_cache_metadata *cmd, const char *policy_nam
        thunk.cmd = cmd;
        thunk.respect_dirty_flags = cmd->clean_when_opened;
-        thunk.hints_valid = hints_array_available(cmd, policy_name);
+        thunk.hints_valid = hints_array_available(cmd, policy);
        return dm_array_walk(&cmd->info, cmd->root, __load_mapping, &thunk);
 }
-int dm_cache_load_mappings(struct dm_cache_metadata *cmd, const char *policy_name,
+int dm_cache_load_mappings(struct dm_cache_metadata *cmd,
+                           struct dm_cache_policy *policy,
                           load_mapping_fn fn, void *context)
 {
        int r;
        down_read(&cmd->root_lock);
-        r = __load_mappings(cmd, policy_name, fn, context);
+        r = __load_mappings(cmd, policy, fn, context);
        up_read(&cmd->root_lock);
        return r;
@@ -979,7 +1015,7 @@ static int __dirty(struct dm_cache_metadata *cmd, dm_cblock_t cblock, bool dirty
                /* nothing to be done */
                return 0;
-        value = pack_value(oblock, flags | (dirty ? M_DIRTY : 0));
+        value = pack_value(oblock, (flags & ~M_DIRTY) | (dirty ? M_DIRTY : 0));
        __dm_bless_for_disk(&value);
        r = dm_array_set_value(&cmd->info, cmd->root, from_cblock(cblock),
@@ -1070,13 +1106,15 @@ static int begin_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *po
        __le32 value;
        size_t hint_size;
        const char *policy_name = dm_cache_policy_get_name(policy);
+        const unsigned *policy_version = dm_cache_policy_get_version(policy);
        if (!policy_name[0] ||
            (strlen(policy_name) > sizeof(cmd->policy_name) - 1))
                return -EINVAL;
-        if (strcmp(cmd->policy_name, policy_name)) {
+        if (!policy_unchanged(cmd, policy)) {
                strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name));
+                memcpy(cmd->policy_version, policy_version, sizeof(cmd->policy_version));
                hint_size = dm_cache_policy_get_hint_size(policy);
                if (!hint_size)
diff --git a/drivers/md/dm-cache-metadata.h b/drivers/md/dm-cache-metadata.h
index 135864ea0eee..f45cef21f3d0 100644
--- a/drivers/md/dm-cache-metadata.h
+++ b/drivers/md/dm-cache-metadata.h
@@ -89,7 +89,7 @@ typedef int (*load_mapping_fn)(void *context, dm_oblock_t oblock,
                               dm_cblock_t cblock, bool dirty,
                               uint32_t hint, bool hint_valid);
 int dm_cache_load_mappings(struct dm_cache_metadata *cmd,
-                           const char *policy_name,
+                           struct dm_cache_policy *policy,
                           load_mapping_fn fn,
                           void *context);
diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c
index cc05d70b3cb8..b04d1f904d07 100644
--- a/drivers/md/dm-cache-policy-cleaner.c
+++ b/drivers/md/dm-cache-policy-cleaner.c
@@ -17,7 +17,6 @@
 /*----------------------------------------------------------------*/
 #define DM_MSG_PREFIX "cache cleaner"
-#define CLEANER_VERSION "1.0.0"
 /* Cache entry struct. */
 struct wb_cache_entry {
@@ -434,6 +433,7 @@ static struct dm_cache_policy *wb_create(dm_cblock_t cache_size,
 static struct dm_cache_policy_type wb_policy_type = {
        .name = "cleaner",
+        .version = {1, 0, 0},
        .hint_size = 0,
        .owner = THIS_MODULE,
        .create = wb_create
@@ -446,7 +446,10 @@ static int __init wb_init(void)
        if (r < 0)
                DMERR("register failed %d", r);
        else
-                DMINFO("version " CLEANER_VERSION " loaded");
+                DMINFO("version %u.%u.%u loaded",
+                       wb_policy_type.version[0],
+                       wb_policy_type.version[1],
+                       wb_policy_type.version[2]);
        return r;
 }
diff --git a/drivers/md/dm-cache-policy-internal.h b/drivers/md/dm-cache-policy-internal.h
index 52a75beeced5..0928abdc49f0 100644
--- a/drivers/md/dm-cache-policy-internal.h
+++ b/drivers/md/dm-cache-policy-internal.h
@@ -117,6 +117,8 @@ void dm_cache_policy_destroy(struct dm_cache_policy *p);
 */
 const char *dm_cache_policy_get_name(struct dm_cache_policy *p);
+const unsigned *dm_cache_policy_get_version(struct dm_cache_policy *p);
 size_t dm_cache_policy_get_hint_size(struct dm_cache_policy *p);
 /*----------------------------------------------------------------*/
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 964153255076..dc112a7137fe 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -14,7 +14,6 @@
 #include <linux/vmalloc.h>
 #define DM_MSG_PREFIX "cache-policy-mq"
-#define MQ_VERSION      "1.0.0"
 static struct kmem_cache *mq_entry_cache;
@@ -1133,6 +1132,7 @@ bad_cache_alloc:
 static struct dm_cache_policy_type mq_policy_type = {
        .name = "mq",
+        .version = {1, 0, 0},
        .hint_size = 4,
        .owner = THIS_MODULE,
        .create = mq_create
@@ -1140,6 +1140,7 @@ static struct dm_cache_policy_type mq_policy_type = {
 static struct dm_cache_policy_type default_policy_type = {
        .name = "default",
+        .version = {1, 0, 0},
        .hint_size = 4,
        .owner = THIS_MODULE,
        .create = mq_create
@@ -1164,7 +1165,10 @@ static int __init mq_init(void)
        r = dm_cache_policy_register(&default_policy_type);
        if (!r) {
-                DMINFO("version " MQ_VERSION " loaded");
+                DMINFO("version %u.%u.%u loaded",
+                       mq_policy_type.version[0],
+                       mq_policy_type.version[1],
+                       mq_policy_type.version[2]);
                return 0;
        }
diff --git a/drivers/md/dm-cache-policy.c b/drivers/md/dm-cache-policy.c
index 2cbf5fdaac52..21c03c570c06 100644
--- a/drivers/md/dm-cache-policy.c
+++ b/drivers/md/dm-cache-policy.c
@@ -150,6 +150,14 @@ const char *dm_cache_policy_get_name(struct dm_cache_policy *p)
 }
 EXPORT_SYMBOL_GPL(dm_cache_policy_get_name);
+const unsigned *dm_cache_policy_get_version(struct dm_cache_policy *p)
+{
+        struct dm_cache_policy_type *t = p->private;
+        return t->version;
+}
+EXPORT_SYMBOL_GPL(dm_cache_policy_get_version);
 size_t dm_cache_policy_get_hint_size(struct dm_cache_policy *p)
 {
        struct dm_cache_policy_type *t = p->private;
diff --git a/drivers/md/dm-cache-policy.h b/drivers/md/dm-cache-policy.h
index f0f51b260544..558bdfdabf5f 100644
--- a/drivers/md/dm-cache-policy.h
+++ b/drivers/md/dm-cache-policy.h
@@ -196,6 +196,7 @@ struct dm_cache_policy {
 * We maintain a little register of the different policy types.
 */
 #define CACHE_POLICY_NAME_SIZE 16
+#define CACHE_POLICY_VERSION_SIZE 3
 struct dm_cache_policy_type {
        /* For use by the register code only. */
@@ -206,6 +207,7 @@ struct dm_cache_policy_type {
         * what gets passed on the target line to select your policy.
         */
        char name[CACHE_POLICY_NAME_SIZE];
+        unsigned version[CACHE_POLICY_VERSION_SIZE];
        /*
         * Policies may store a hint for each each cache block.
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 0f4e84b15c30..66120bd46d15 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -142,6 +142,7 @@ struct cache {
        spinlock_t lock;
        struct bio_list deferred_bios;
        struct bio_list deferred_flush_bios;
+        struct bio_list deferred_writethrough_bios;
        struct list_head quiesced_migrations;
        struct list_head completed_migrations;
        struct list_head need_commit_migrations;
@@ -158,7 +159,7 @@ struct cache {
        /*
         * origin_blocks entries, discarded if set.
         */
-        sector_t discard_block_size; /* a power of 2 times sectors per block */
+        uint32_t discard_block_size; /* a power of 2 times sectors per block */
        dm_dblock_t discard_nr_blocks;
        unsigned long *discard_bitset;
@@ -199,6 +200,11 @@ struct per_bio_data {
        bool tick:1;
        unsigned req_nr:2;
        struct dm_deferred_entry *all_io_entry;
+        /* writethrough fields */
+        struct cache *cache;
+        dm_cblock_t cblock;
+        bio_end_io_t *saved_bi_end_io;
 };
 struct dm_cache_migration {
@@ -412,17 +418,24 @@ static bool block_size_is_power_of_two(struct cache *cache)
        return cache->sectors_per_block_shift >= 0;
 }
+static dm_block_t block_div(dm_block_t b, uint32_t n)
+{
+        do_div(b, n);
+        return b;
+}
 static dm_dblock_t oblock_to_dblock(struct cache *cache, dm_oblock_t oblock)
 {
-        sector_t discard_blocks = cache->discard_block_size;
+        uint32_t discard_blocks = cache->discard_block_size;
        dm_block_t b = from_oblock(oblock);
        if (!block_size_is_power_of_two(cache))
-                (void) sector_div(discard_blocks, cache->sectors_per_block);
+                discard_blocks = discard_blocks / cache->sectors_per_block;
        else
                discard_blocks >>= cache->sectors_per_block_shift;
-        (void) sector_div(b, discard_blocks);
+        b = block_div(b, discard_blocks);
        return to_dblock(b);
 }
@@ -609,6 +622,56 @@ static void issue(struct cache *cache, struct bio *bio)
        spin_unlock_irqrestore(&cache->lock, flags);
 }
+static void defer_writethrough_bio(struct cache *cache, struct bio *bio)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cache->lock, flags);
+        bio_list_add(&cache->deferred_writethrough_bios, bio);
+        spin_unlock_irqrestore(&cache->lock, flags);
+        wake_worker(cache);
+}
+static void writethrough_endio(struct bio *bio, int err)
+{
+        struct per_bio_data *pb = get_per_bio_data(bio);
+        bio->bi_end_io = pb->saved_bi_end_io;
+        if (err) {
+                bio_endio(bio, err);
+                return;
+        }
+        remap_to_cache(pb->cache, bio, pb->cblock);
+        /*
+         * We can't issue this bio directly, since we're in interrupt
+         * context.  So it get's put on a bio list for processing by the
+         * worker thread.
+         */
+        defer_writethrough_bio(pb->cache, bio);
+}
+/*
+ * When running in writethrough mode we need to send writes to clean blocks
+ * to both the cache and origin devices.  In future we'd like to clone the
+ * bio and send them in parallel, but for now we're doing them in
+ * series as this is easier.
+ */
+static void remap_to_origin_then_cache(struct cache *cache, struct bio *bio,
+                                       dm_oblock_t oblock, dm_cblock_t cblock)
+{
+        struct per_bio_data *pb = get_per_bio_data(bio);
+        pb->cache = cache;
+        pb->cblock = cblock;
+        pb->saved_bi_end_io = bio->bi_end_io;
+        bio->bi_end_io = writethrough_endio;
+        remap_to_origin_clear_discard(pb->cache, bio, oblock);
+}
 /*----------------------------------------------------------------
 * Migration processing
 *
@@ -1002,7 +1065,7 @@ static void process_discard_bio(struct cache *cache, struct bio *bio)
        dm_block_t end_block = bio->bi_sector + bio_sectors(bio);
        dm_block_t b;
-        (void) sector_div(end_block, cache->discard_block_size);
+        end_block = block_div(end_block, cache->discard_block_size);
        for (b = start_block; b < end_block; b++)
                set_discard(cache, to_dblock(b));
@@ -1070,14 +1133,9 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
                inc_hit_counter(cache, bio);
                pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
-                if (is_writethrough_io(cache, bio, lookup_result.cblock)) {
+                if (is_writethrough_io(cache, bio, lookup_result.cblock))
-                        /*
+                        remap_to_origin_then_cache(cache, bio, block, lookup_result.cblock);
-                         * No need to mark anything dirty in write through mode.
+                else
-                         */
-                        pb->req_nr == 0 ?
-                                remap_to_cache(cache, bio, lookup_result.cblock) :
-                                remap_to_origin_clear_discard(cache, bio, block);
-                } else
                        remap_to_cache_dirty(cache, bio, block, lookup_result.cblock);
                issue(cache, bio);
@@ -1086,17 +1144,8 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
        case POLICY_MISS:
                inc_miss_counter(cache, bio);
                pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
+                remap_to_origin_clear_discard(cache, bio, block);
-                if (pb->req_nr != 0) {
+                issue(cache, bio);
-                        /*
-                         * This is a duplicate writethrough io that is no
-                         * longer needed because the block has been demoted.
-                         */
-                        bio_endio(bio, 0);
-                } else {
-                        remap_to_origin_clear_discard(cache, bio, block);
-                        issue(cache, bio);
-                }
                break;
        case POLICY_NEW:
@@ -1217,6 +1266,23 @@ static void process_deferred_flush_bios(struct cache *cache, bool submit_bios)
                submit_bios ? generic_make_request(bio) : bio_io_error(bio);
 }
+static void process_deferred_writethrough_bios(struct cache *cache)
+{
+        unsigned long flags;
+        struct bio_list bios;
+        struct bio *bio;
+        bio_list_init(&bios);
+        spin_lock_irqsave(&cache->lock, flags);
+        bio_list_merge(&bios, &cache->deferred_writethrough_bios);
+        bio_list_init(&cache->deferred_writethrough_bios);
+        spin_unlock_irqrestore(&cache->lock, flags);
+        while ((bio = bio_list_pop(&bios)))
+                generic_make_request(bio);
+}
 static void writeback_some_dirty_blocks(struct cache *cache)
 {
        int r = 0;
@@ -1313,6 +1379,7 @@ static int more_work(struct cache *cache)
        else
                return !bio_list_empty(&cache->deferred_bios) ||
                        !bio_list_empty(&cache->deferred_flush_bios) ||
+                        !bio_list_empty(&cache->deferred_writethrough_bios) ||
                        !list_empty(&cache->quiesced_migrations) ||
                        !list_empty(&cache->completed_migrations) ||
                        !list_empty(&cache->need_commit_migrations);
@@ -1331,6 +1398,8 @@ static void do_worker(struct work_struct *ws)
                writeback_some_dirty_blocks(cache);
+                process_deferred_writethrough_bios(cache);
                if (commit_if_needed(cache)) {
                        process_deferred_flush_bios(cache, false);
@@ -1756,8 +1825,11 @@ static int create_cache_policy(struct cache *cache, struct cache_args *ca,
        }
        r = set_config_values(cache->policy, ca->policy_argc, ca->policy_argv);
-        if (r)
+        if (r) {
+                *error = "Error setting cache policy's config values";
                dm_cache_policy_destroy(cache->policy);
+                cache->policy = NULL;
+        }
        return r;
 }
@@ -1793,8 +1865,6 @@ static sector_t calculate_discard_block_size(sector_t cache_block_size,
 #define DEFAULT_MIGRATION_THRESHOLD (2048 * 100)
-static unsigned cache_num_write_bios(struct dm_target *ti, struct bio *bio);
 static int cache_create(struct cache_args *ca, struct cache **result)
 {
        int r = 0;
@@ -1821,9 +1891,6 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        memcpy(&cache->features, &ca->features, sizeof(cache->features));
-        if (cache->features.write_through)
-                ti->num_write_bios = cache_num_write_bios;
        cache->callbacks.congested_fn = cache_is_congested;
        dm_table_add_target_callbacks(ti->table, &cache->callbacks);
@@ -1835,7 +1902,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        /* FIXME: factor out this whole section */
        origin_blocks = cache->origin_sectors = ca->origin_sectors;
-        (void) sector_div(origin_blocks, ca->block_size);
+        origin_blocks = block_div(origin_blocks, ca->block_size);
        cache->origin_blocks = to_oblock(origin_blocks);
        cache->sectors_per_block = ca->block_size;
@@ -1848,7 +1915,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
                dm_block_t cache_size = ca->cache_sectors;
                cache->sectors_per_block_shift = -1;
-                (void) sector_div(cache_size, ca->block_size);
+                cache_size = block_div(cache_size, ca->block_size);
                cache->cache_size = to_cblock(cache_size);
        } else {
                cache->sectors_per_block_shift = __ffs(ca->block_size);
@@ -1873,6 +1940,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        spin_lock_init(&cache->lock);
        bio_list_init(&cache->deferred_bios);
        bio_list_init(&cache->deferred_flush_bios);
+        bio_list_init(&cache->deferred_writethrough_bios);
        INIT_LIST_HEAD(&cache->quiesced_migrations);
        INIT_LIST_HEAD(&cache->completed_migrations);
        INIT_LIST_HEAD(&cache->need_commit_migrations);
@@ -2002,6 +2070,8 @@ static int cache_ctr(struct dm_target *ti, unsigned argc, char **argv)
                goto out;
        r = cache_create(ca, &cache);
+        if (r)
+                goto out;
        r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3);
        if (r) {
@@ -2016,20 +2086,6 @@ out:
        return r;
 }
-static unsigned cache_num_write_bios(struct dm_target *ti, struct bio *bio)
-{
-        int r;
-        struct cache *cache = ti->private;
-        dm_oblock_t block = get_bio_block(cache, bio);
-        dm_cblock_t cblock;
-        r = policy_lookup(cache->policy, block, &cblock);
-        if (r < 0)
-                return 2;       /* assume the worst */
-        return (!r && !is_dirty(cache, cblock)) ? 2 : 1;
-}
 static int cache_map(struct dm_target *ti, struct bio *bio)
 {
        struct cache *cache = ti->private;
@@ -2097,18 +2153,12 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
                inc_hit_counter(cache, bio);
                pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
-                if (is_writethrough_io(cache, bio, lookup_result.cblock)) {
+                if (is_writethrough_io(cache, bio, lookup_result.cblock))
-                        /*
+                        remap_to_origin_then_cache(cache, bio, block, lookup_result.cblock);
-                         * No need to mark anything dirty in write through mode.
+                else
-                         */
-                        pb->req_nr == 0 ?
-                                remap_to_cache(cache, bio, lookup_result.cblock) :
-                                remap_to_origin_clear_discard(cache, bio, block);
-                        cell_defer(cache, cell, false);
-                } else {
                        remap_to_cache_dirty(cache, bio, block, lookup_result.cblock);
-                        cell_defer(cache, cell, false);
-                }
+                cell_defer(cache, cell, false);
                break;
        case POLICY_MISS:
@@ -2319,8 +2369,7 @@ static int cache_preresume(struct dm_target *ti)
        }
        if (!cache->loaded_mappings) {
-                r = dm_cache_load_mappings(cache->cmd,
+                r = dm_cache_load_mappings(cache->cmd, cache->policy,
-                                           dm_cache_policy_get_name(cache->policy),
                                           load_mapping, cache);
                if (r) {
                        DMERR("could not load cache mappings");
@@ -2535,7 +2584,7 @@ static void cache_io_hints(struct dm_target *ti, struct queue_limits *limits)
 static struct target_type cache_target = {
        .name = "cache",
-        .version = {1, 0, 0},
+        .version = {1, 1, 0},
        .module = THIS_MODULE,
        .ctr = cache_ctr,
        .dtr = cache_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 009339d62828..004ad1652b73 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1577,6 +1577,11 @@ static bool data_dev_supports_discard(struct pool_c *pt)
        return q && blk_queue_discard(q);
 }
+static bool is_factor(sector_t block_size, uint32_t n)
+{
+        return !sector_div(block_size, n);
+}
 /*
 * If discard_passdown was enabled verify that the data device
 * supports discards.  Disable discard_passdown if not.
@@ -1602,7 +1607,7 @@ static void disable_passdown_if_not_supported(struct pool_c *pt)
        else if (data_limits->discard_granularity > block_size)
                reason = "discard granularity larger than a block";
-        else if (block_size & (data_limits->discard_granularity - 1))
+        else if (!is_factor(block_size, data_limits->discard_granularity))
                reason = "discard granularity not a factor of block size";
        if (reason) {
@@ -2544,7 +2549,7 @@ static struct target_type pool_target = {
        .name = "thin-pool",
        .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                    DM_TARGET_IMMUTABLE,
-        .version = {1, 6, 1},
+        .version = {1, 7, 0},
        .module = THIS_MODULE,
        .ctr = pool_ctr,
        .dtr = pool_dtr,
@@ -2831,7 +2836,7 @@ static int thin_iterate_devices(struct dm_target *ti,
 static struct target_type thin_target = {
        .name = "thin",
-        .version = {1, 7, 1},
+        .version = {1, 8, 0},
        .module = THIS_MODULE,
        .ctr = thin_ctr,
        .dtr = thin_dtr,
diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
index 6ad538375c3c..a746f1d21c66 100644
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -93,6 +93,13 @@ struct dm_verity_io {
         */
 };
+struct dm_verity_prefetch_work {
+        struct work_struct work;
+        struct dm_verity *v;
+        sector_t block;
+        unsigned n_blocks;
+};
 static struct shash_desc *io_hash_desc(struct dm_verity *v, struct dm_verity_io *io)
 {
        return (struct shash_desc *)(io + 1);
@@ -424,15 +431,18 @@ static void verity_end_io(struct bio *bio, int error)
 * The root buffer is not prefetched, it is assumed that it will be cached
 * all the time.
 */
-static void verity_prefetch_io(struct dm_verity *v, struct dm_verity_io *io)
+static void verity_prefetch_io(struct work_struct *work)
 {
+        struct dm_verity_prefetch_work *pw =
+                container_of(work, struct dm_verity_prefetch_work, work);
+        struct dm_verity *v = pw->v;
        int i;
        for (i = v->levels - 2; i >= 0; i--) {
                sector_t hash_block_start;
                sector_t hash_block_end;
-                verity_hash_at_level(v, io->block, i, &hash_block_start, NULL);
+                verity_hash_at_level(v, pw->block, i, &hash_block_start, NULL);
-                verity_hash_at_level(v, io->block + io->n_blocks - 1, i, &hash_block_end, NULL);
+                verity_hash_at_level(v, pw->block + pw->n_blocks - 1, i, &hash_block_end, NULL);
                if (!i) {
                        unsigned cluster = ACCESS_ONCE(dm_verity_prefetch_cluster);
@@ -452,6 +462,25 @@ no_prefetch_cluster:
                dm_bufio_prefetch(v->bufio, hash_block_start,
                                  hash_block_end - hash_block_start + 1);
        }
+        kfree(pw);
+}
+static void verity_submit_prefetch(struct dm_verity *v, struct dm_verity_io *io)
+{
+        struct dm_verity_prefetch_work *pw;
+        pw = kmalloc(sizeof(struct dm_verity_prefetch_work),
+                GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN);
+        if (!pw)
+                return;
+        INIT_WORK(&pw->work, verity_prefetch_io);
+        pw->v = v;
+        pw->block = io->block;
+        pw->n_blocks = io->n_blocks;
+        queue_work(v->verify_wq, &pw->work);
 }
 /*
@@ -498,7 +527,7 @@ static int verity_map(struct dm_target *ti, struct bio *bio)
        memcpy(io->io_vec, bio_iovec(bio),
               io->io_vec_size * sizeof(struct bio_vec));
-        verity_prefetch_io(v, io);
+        verity_submit_prefetch(v, io);
        generic_make_request(bio);
@@ -858,7 +887,7 @@ bad:
 static struct target_type verity_target = {
        .name           = "verity",
-        .version        = {1, 1, 1},
+        .version        = {1, 2, 0},
        .module         = THIS_MODULE,
        .ctr            = verity_ctr,
        .dtr            = verity_dtr,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index fcb878f88796..aeceedfc530b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7663,10 +7663,8 @@ static int remove_and_add_spares(struct mddev *mddev)
                                removed++;
                        }
                }
-        if (removed)
+        if (removed && mddev->kobj.sd)
-                sysfs_notify(&mddev->kobj, NULL,
+                sysfs_notify(&mddev->kobj, NULL, "degraded");
-                             "degraded");
        rdev_for_each(rdev, mddev) {
                if (rdev->raid_disk >= 0 &&
diff --git a/drivers/md/md.h b/drivers/md/md.h
index eca59c3074ef..d90fb1a879e1 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -506,7 +506,7 @@ static inline char * mdname (struct mddev * mddev)
 static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
        char nm[20];
-        if (!test_bit(Replacement, &rdev->flags)) {
+        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
                sprintf(nm, "rd%d", rdev->raid_disk);
                return sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
        } else
@@ -516,7 +516,7 @@ static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 static inline void sysfs_unlink_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
        char nm[20];
-        if (!test_bit(Replacement, &rdev->flags)) {
+        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
                sprintf(nm, "rd%d", rdev->raid_disk);
                sysfs_remove_link(&mddev->kobj, nm);
        }
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index c4f28133ef82..b88757cd0d1d 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -139,15 +139,8 @@ struct child {
        struct btree_node *n;
 };
-static struct dm_btree_value_type le64_type = {
+static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt,
-        .context = NULL,
+                      struct btree_node *parent,
-        .size = sizeof(__le64),
-        .inc = NULL,
-        .dec = NULL,
-        .equal = NULL
-};
-static int init_child(struct dm_btree_info *info, struct btree_node *parent,
                      unsigned index, struct child *result)
 {
        int r, inc;
@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_info *info, struct btree_node *parent,
        result->n = dm_block_data(result->block);
        if (inc)
-                inc_children(info->tm, result->n, &le64_type);
+                inc_children(info->tm, result->n, vt);
        *((__le64 *) value_ptr(parent, index)) =
                cpu_to_le64(dm_block_location(result->block));
@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent,
 }
 static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
-                      unsigned left_index)
+                      struct dm_btree_value_type *vt, unsigned left_index)
 {
        int r;
        struct btree_node *parent;
@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
        parent = dm_block_data(shadow_current(s));
-        r = init_child(info, parent, left_index, &left);
+        r = init_child(info, vt, parent, left_index, &left);
        if (r)
                return r;
-        r = init_child(info, parent, left_index + 1, &right);
+        r = init_child(info, vt, parent, left_index + 1, &right);
        if (r) {
                exit_child(info, &left);
                return r;
@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree_info *info, struct btree_node *parent,
 }
 static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
-                      unsigned left_index)
+                      struct dm_btree_value_type *vt, unsigned left_index)
 {
        int r;
        struct btree_node *parent = dm_block_data(shadow_current(s));
@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
        /*
         * FIXME: fill out an array?
         */
-        r = init_child(info, parent, left_index, &left);
+        r = init_child(info, vt, parent, left_index, &left);
        if (r)
                return r;
-        r = init_child(info, parent, left_index + 1, &center);
+        r = init_child(info, vt, parent, left_index + 1, &center);
        if (r) {
                exit_child(info, &left);
                return r;
        }
-        r = init_child(info, parent, left_index + 2, &right);
+        r = init_child(info, vt, parent, left_index + 2, &right);
        if (r) {
                exit_child(info, &left);
                exit_child(info, &center);
@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_transaction_manager *tm,
 }
 static int rebalance_children(struct shadow_spine *s,
-                              struct dm_btree_info *info, uint64_t key)
+                              struct dm_btree_info *info,
+                              struct dm_btree_value_type *vt, uint64_t key)
 {
        int i, r, has_left_sibling, has_right_sibling;
        uint32_t child_entries;
@@ -472,13 +466,13 @@ static int rebalance_children(struct shadow_spine *s,
        has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1);
        if (!has_left_sibling)
-                r = rebalance2(s, info, i);
+                r = rebalance2(s, info, vt, i);
        else if (!has_right_sibling)
-                r = rebalance2(s, info, i - 1);
+                r = rebalance2(s, info, vt, i - 1);
        else
-                r = rebalance3(s, info, i - 1);
+                r = rebalance3(s, info, vt, i - 1);
        return r;
 }
@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
                if (le32_to_cpu(n->header.flags) & LEAF_NODE)
                        return do_leaf(n, key, index);
-                r = rebalance_children(s, info, key);
+                r = rebalance_children(s, info, vt, key);
                if (r)
                        break;
@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
        return r;
 }
+static struct dm_btree_value_type le64_type = {
+        .context = NULL,
+        .size = sizeof(__le64),
+        .inc = NULL,
+        .dec = NULL,
+        .equal = NULL
+};
 int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
                    uint64_t *keys, dm_block_t *new_root)
 {
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 3ee2912889e7..24909eb13fec 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -671,9 +671,11 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        bi->bi_next = NULL;
                        if (rrdev)
                                set_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags);
-                        trace_block_bio_remap(bdev_get_queue(bi->bi_bdev),
-                                              bi, disk_devt(conf->mddev->gendisk),
+                        if (conf->mddev->gendisk)
-                                              sh->dev[i].sector);
+                                trace_block_bio_remap(bdev_get_queue(bi->bi_bdev),
+                                                      bi, disk_devt(conf->mddev->gendisk),
+                                                      sh->dev[i].sector);
                        generic_make_request(bi);
                }
                if (rrdev) {
@@ -701,9 +703,10 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        rbi->bi_io_vec[0].bv_offset = 0;
                        rbi->bi_size = STRIPE_SIZE;
                        rbi->bi_next = NULL;
-                        trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
+                        if (conf->mddev->gendisk)
-                                              rbi, disk_devt(conf->mddev->gendisk),
+                                trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
-                                              sh->dev[i].sector);
+                                                      rbi, disk_devt(conf->mddev->gendisk),
+                                                      sh->dev[i].sector);
                        generic_make_request(rbi);
                }
                if (!rdev && !rrdev) {
@@ -2280,17 +2283,6 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
        int level = conf->level;
        if (rcw) {
-                /* if we are not expanding this is a proper write request, and
-                 * there will be bios with new data to be drained into the
-                 * stripe cache
-                 */
-                if (!expand) {
-                        sh->reconstruct_state = reconstruct_state_drain_run;
-                        set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-                } else
-                        sh->reconstruct_state = reconstruct_state_run;
-                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
                for (i = disks; i--; ) {
                        struct r5dev *dev = &sh->dev[i];
@@ -2303,6 +2295,21 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                                s->locked++;
                        }
                }
+                /* if we are not expanding this is a proper write request, and
+                 * there will be bios with new data to be drained into the
+                 * stripe cache
+                 */
+                if (!expand) {
+                        if (!s->locked)
+                                /* False alarm, nothing to do */
+                                return;
+                        sh->reconstruct_state = reconstruct_state_drain_run;
+                        set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
+                } else
+                        sh->reconstruct_state = reconstruct_state_run;
+                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
                if (s->locked + conf->max_degraded == disks)
                        if (!test_and_set_bit(STRIPE_FULL_WRITE, &sh->state))
                                atomic_inc(&conf->pending_full_writes);
@@ -2311,11 +2318,6 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                BUG_ON(!(test_bit(R5_UPTODATE, &sh->dev[pd_idx].flags) ||
                        test_bit(R5_Wantcompute, &sh->dev[pd_idx].flags)));
-                sh->reconstruct_state = reconstruct_state_prexor_drain_run;
-                set_bit(STRIPE_OP_PREXOR, &s->ops_request);
-                set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
                for (i = disks; i--; ) {
                        struct r5dev *dev = &sh->dev[i];
                        if (i == pd_idx)
@@ -2330,6 +2332,13 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                                s->locked++;
                        }
                }
+                if (!s->locked)
+                        /* False alarm - nothing to do */
+                        return;
+                sh->reconstruct_state = reconstruct_state_prexor_drain_run;
+                set_bit(STRIPE_OP_PREXOR, &s->ops_request);
+                set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
+                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
        }
        /* keep the parity disk(s) locked while asynchronous operations
@@ -2564,6 +2573,8 @@ handle_failed_sync(struct r5conf *conf, struct stripe_head *sh,
        int i;
        clear_bit(STRIPE_SYNCING, &sh->state);
+        if (test_and_clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags))
+                wake_up(&conf->wait_for_overlap);
        s->syncing = 0;
        s->replacing = 0;
        /* There is nothing more to do for sync/check/repair.
@@ -2737,6 +2748,7 @@ static void handle_stripe_clean_event(struct r5conf *conf,
 {
        int i;
        struct r5dev *dev;
+        int discard_pending = 0;
        for (i = disks; i--; )
                if (sh->dev[i].written) {
@@ -2765,9 +2777,23 @@ static void handle_stripe_clean_event(struct r5conf *conf,
                                                STRIPE_SECTORS,
                                         !test_bit(STRIPE_DEGRADED, &sh->state),
                                                0);
-                        }
+                        } else if (test_bit(R5_Discard, &dev->flags))
-                } else if (test_bit(R5_Discard, &sh->dev[i].flags))
+                                discard_pending = 1;
-                        clear_bit(R5_Discard, &sh->dev[i].flags);
+                }
+        if (!discard_pending &&
+            test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) {
+                clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags);
+                clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
+                if (sh->qd_idx >= 0) {
+                        clear_bit(R5_Discard, &sh->dev[sh->qd_idx].flags);
+                        clear_bit(R5_UPTODATE, &sh->dev[sh->qd_idx].flags);
+                }
+                /* now that discard is done we can proceed with any sync */
+                clear_bit(STRIPE_DISCARD, &sh->state);
+                if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
+                        set_bit(STRIPE_HANDLE, &sh->state);
+        }
        if (test_and_clear_bit(STRIPE_FULL_WRITE, &sh->state))
                if (atomic_dec_and_test(&conf->pending_full_writes))
@@ -2826,8 +2852,10 @@ static void handle_stripe_dirtying(struct r5conf *conf,
        set_bit(STRIPE_HANDLE, &sh->state);
        if (rmw < rcw && rmw > 0) {
                /* prefer read-modify-write, but need to get some data */
-                blk_add_trace_msg(conf->mddev->queue, "raid5 rmw %llu %d",
+                if (conf->mddev->queue)
-                                  (unsigned long long)sh->sector, rmw);
+                        blk_add_trace_msg(conf->mddev->queue,
+                                          "raid5 rmw %llu %d",
+                                          (unsigned long long)sh->sector, rmw);
                for (i = disks; i--; ) {
                        struct r5dev *dev = &sh->dev[i];
                        if ((dev->towrite || i == sh->pd_idx) &&
@@ -2877,7 +2905,7 @@ static void handle_stripe_dirtying(struct r5conf *conf,
                                }
                        }
                }
-                if (rcw)
+                if (rcw && conf->mddev->queue)
                        blk_add_trace_msg(conf->mddev->queue, "raid5 rcw %llu %d %d %d",
                                          (unsigned long long)sh->sector,
                                          rcw, qread, test_bit(STRIPE_DELAYED, &sh->state));
@@ -3417,9 +3445,15 @@ static void handle_stripe(struct stripe_head *sh)
                return;
        }
-        if (test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
+        if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
-                set_bit(STRIPE_SYNCING, &sh->state);
+                spin_lock(&sh->stripe_lock);
-                clear_bit(STRIPE_INSYNC, &sh->state);
+                /* Cannot process 'sync' concurrently with 'discard' */
+                if (!test_bit(STRIPE_DISCARD, &sh->state) &&
+                    test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
+                        set_bit(STRIPE_SYNCING, &sh->state);
+                        clear_bit(STRIPE_INSYNC, &sh->state);
+                }
+                spin_unlock(&sh->stripe_lock);
        }
        clear_bit(STRIPE_DELAYED, &sh->state);
@@ -3579,6 +3613,8 @@ static void handle_stripe(struct stripe_head *sh)
            test_bit(STRIPE_INSYNC, &sh->state)) {
                md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
                clear_bit(STRIPE_SYNCING, &sh->state);
+                if (test_and_clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags))
+                        wake_up(&conf->wait_for_overlap);
        }
        /* If the failed drives are just a ReadError, then we might need
@@ -3982,9 +4018,10 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
                atomic_inc(&conf->active_aligned_reads);
                spin_unlock_irq(&conf->device_lock);
-                trace_block_bio_remap(bdev_get_queue(align_bi->bi_bdev),
+                if (mddev->gendisk)
-                                      align_bi, disk_devt(mddev->gendisk),
+                        trace_block_bio_remap(bdev_get_queue(align_bi->bi_bdev),
-                                      raid_bio->bi_sector);
+                                              align_bi, disk_devt(mddev->gendisk),
+                                              raid_bio->bi_sector);
                generic_make_request(align_bi);
                return 1;
        } else {
@@ -4078,7 +4115,8 @@ static void raid5_unplug(struct blk_plug_cb *blk_cb, bool from_schedule)
                }
                spin_unlock_irq(&conf->device_lock);
        }
-        trace_block_unplug(mddev->queue, cnt, !from_schedule);
+        if (mddev->queue)
+                trace_block_unplug(mddev->queue, cnt, !from_schedule);
        kfree(cb);
 }
@@ -4141,6 +4179,13 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
                sh = get_active_stripe(conf, logical_sector, 0, 0, 0);
                prepare_to_wait(&conf->wait_for_overlap, &w,
                                TASK_UNINTERRUPTIBLE);
+                set_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags);
+                if (test_bit(STRIPE_SYNCING, &sh->state)) {
+                        release_stripe(sh);
+                        schedule();
+                        goto again;
+                }
+                clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags);
                spin_lock_irq(&sh->stripe_lock);
                for (d = 0; d < conf->raid_disks; d++) {
                        if (d == sh->pd_idx || d == sh->qd_idx)
@@ -4153,6 +4198,7 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
                                goto again;
                        }
                }
+                set_bit(STRIPE_DISCARD, &sh->state);
                finish_wait(&conf->wait_for_overlap, &w);
                for (d = 0; d < conf->raid_disks; d++) {
                        if (d == sh->pd_idx || d == sh->qd_idx)
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 18b2c4a8a1fd..b0b663b119a8 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -221,10 +221,6 @@ struct stripe_head {
        struct stripe_operations {
                int                  target, target2;
                enum sum_check_flags zero_sum_result;
-                #ifdef CONFIG_MULTICORE_RAID456
-                unsigned long        request;
-                wait_queue_head_t    wait_for_ops;
-                #endif
        } ops;
        struct r5dev {
                /* rreq and rvec are used for the replacement device when
@@ -323,6 +319,7 @@ enum {
        STRIPE_COMPUTE_RUN,
        STRIPE_OPS_REQ_PENDING,
        STRIPE_ON_UNPLUG_LIST,
+        STRIPE_DISCARD,
 };
 /*
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 671f5b171c73..c346941a2515 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -858,6 +858,7 @@ config EZX_PCAP
 config AB8500_CORE
        bool "ST-Ericsson AB8500 Mixed Signal Power Management chip"
        depends on GENERIC_HARDIRQS && ABX500_CORE && MFD_DB8500_PRCMU
+        select POWER_SUPPLY
        select MFD_CORE
        select IRQ_DOMAIN
        help
diff --git a/drivers/mfd/ab8500-gpadc.c b/drivers/mfd/ab8500-gpadc.c
index b1f3561b023f..5f341a50ee5a 100644
--- a/drivers/mfd/ab8500-gpadc.c
+++ b/drivers/mfd/ab8500-gpadc.c
@@ -594,9 +594,12 @@ static int ab8500_gpadc_runtime_suspend(struct device *dev)
 static int ab8500_gpadc_runtime_resume(struct device *dev)
 {
        struct ab8500_gpadc *gpadc = dev_get_drvdata(dev);
+        int ret;
-        regulator_enable(gpadc->regu);
+        ret = regulator_enable(gpadc->regu);
-        return 0;
+        if (ret)
+                dev_err(dev, "Failed to enable vtvout LDO: %d\n", ret);
+        return ret;
 }
 static int ab8500_gpadc_runtime_idle(struct device *dev)
@@ -643,7 +646,7 @@ static int ab8500_gpadc_probe(struct platform_device *pdev)
        }
        /* VTVout LDO used to power up ab8500-GPADC */
-        gpadc->regu = regulator_get(&pdev->dev, "vddadc");
+        gpadc->regu = devm_regulator_get(&pdev->dev, "vddadc");
        if (IS_ERR(gpadc->regu)) {
                ret = PTR_ERR(gpadc->regu);
                dev_err(gpadc->dev, "failed to get vtvout LDO\n");
@@ -652,7 +655,11 @@ static int ab8500_gpadc_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, gpadc);
-        regulator_enable(gpadc->regu);
+        ret = regulator_enable(gpadc->regu);
+        if (ret) {
+                dev_err(gpadc->dev, "Failed to enable vtvout LDO: %d\n", ret);
+                goto fail_enable;
+        }
        pm_runtime_set_autosuspend_delay(gpadc->dev, GPADC_AUDOSUSPEND_DELAY);
        pm_runtime_use_autosuspend(gpadc->dev);
@@ -663,6 +670,8 @@ static int ab8500_gpadc_probe(struct platform_device *pdev)
        list_add_tail(&gpadc->node, &ab8500_gpadc_list);
        dev_dbg(gpadc->dev, "probe success\n");
        return 0;
+fail_enable:
 fail_irq:
        free_irq(gpadc->irq, gpadc);
 fail:
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 6b5edf64de2b..4febc5c7fdee 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -460,15 +460,15 @@ static void omap_usbhs_init(struct device *dev)
        switch (omap->usbhs_rev) {
        case OMAP_USBHS_REV1:
-                omap_usbhs_rev1_hostconfig(omap, reg);
+                reg = omap_usbhs_rev1_hostconfig(omap, reg);
                break;
        case OMAP_USBHS_REV2:
-                omap_usbhs_rev2_hostconfig(omap, reg);
+                reg = omap_usbhs_rev2_hostconfig(omap, reg);
                break;
        default:        /* newer revisions */
-                omap_usbhs_rev2_hostconfig(omap, reg);
+                reg = omap_usbhs_rev2_hostconfig(omap, reg);
                break;
        }
diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c
index bbdbc50a3cca..73bf76df1044 100644
--- a/drivers/mfd/palmas.c
+++ b/drivers/mfd/palmas.c
@@ -257,9 +257,24 @@ static struct regmap_irq_chip palmas_irq_chip = {
                        PALMAS_INT1_MASK),
 };
-static void palmas_dt_to_pdata(struct device_node *node,
+static int palmas_set_pdata_irq_flag(struct i2c_client *i2c,
                struct palmas_platform_data *pdata)
 {
+        struct irq_data *irq_data = irq_get_irq_data(i2c->irq);
+        if (!irq_data) {
+                dev_err(&i2c->dev, "Invalid IRQ: %d\n", i2c->irq);
+                return -EINVAL;
+        }
+        pdata->irq_flags = irqd_get_trigger_type(irq_data);
+        dev_info(&i2c->dev, "Irq flag is 0x%08x\n", pdata->irq_flags);
+        return 0;
+}
+static void palmas_dt_to_pdata(struct i2c_client *i2c,
+                struct palmas_platform_data *pdata)
+{
+        struct device_node *node = i2c->dev.of_node;
        int ret;
        u32 prop;
@@ -283,6 +298,8 @@ static void palmas_dt_to_pdata(struct device_node *node,
                pdata->power_ctrl = PALMAS_POWER_CTRL_NSLEEP_MASK |
                                        PALMAS_POWER_CTRL_ENABLE1_MASK |
                                        PALMAS_POWER_CTRL_ENABLE2_MASK;
+        if (i2c->irq)
+                palmas_set_pdata_irq_flag(i2c, pdata);
 }
 static int palmas_i2c_probe(struct i2c_client *i2c,
@@ -304,7 +321,7 @@ static int palmas_i2c_probe(struct i2c_client *i2c,
                if (!pdata)
                        return -ENOMEM;
-                palmas_dt_to_pdata(node, pdata);
+                palmas_dt_to_pdata(i2c, pdata);
        }
        if (!pdata)
@@ -344,6 +361,19 @@ static int palmas_i2c_probe(struct i2c_client *i2c,
                }
        }
+        /* Change interrupt line output polarity */
+        if (pdata->irq_flags & IRQ_TYPE_LEVEL_HIGH)
+                reg = PALMAS_POLARITY_CTRL_INT_POLARITY;
+        else
+                reg = 0;
+        ret = palmas_update_bits(palmas, PALMAS_PU_PD_OD_BASE,
+                        PALMAS_POLARITY_CTRL, PALMAS_POLARITY_CTRL_INT_POLARITY,
+                        reg);
+        if (ret < 0) {
+                dev_err(palmas->dev, "POLARITY_CTRL updat failed: %d\n", ret);
+                goto err;
+        }
        /* Change IRQ into clear on read mode for efficiency */
        slave = PALMAS_BASE_TO_SLAVE(PALMAS_INTERRUPT_BASE);
        addr = PALMAS_BASE_TO_REG(PALMAS_INTERRUPT_BASE, PALMAS_INT_CTRL);
@@ -352,7 +382,7 @@ static int palmas_i2c_probe(struct i2c_client *i2c,
        regmap_write(palmas->regmap[slave], addr, reg);
        ret = regmap_add_irq_chip(palmas->regmap[slave], palmas->irq,
-                        IRQF_ONESHOT | IRQF_TRIGGER_LOW, 0, &palmas_irq_chip,
+                        IRQF_ONESHOT | pdata->irq_flags, 0, &palmas_irq_chip,
                        &palmas->irq_data);
        if (ret < 0)
                goto err;
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 4658b5bdcd84..aeb8e40ab424 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -169,6 +169,7 @@ err:
 void tps65912_device_exit(struct tps65912 *tps65912)
 {
        mfd_remove_devices(tps65912->dev);
+        tps65912_irq_exit(tps65912);
        kfree(tps65912);
 }
diff --git a/drivers/mfd/twl4030-audio.c b/drivers/mfd/twl4030-audio.c
index e16edca92670..d2ab222138c2 100644
--- a/drivers/mfd/twl4030-audio.c
+++ b/drivers/mfd/twl4030-audio.c
@@ -118,7 +118,7 @@ EXPORT_SYMBOL_GPL(twl4030_audio_enable_resource);
 * Disable the resource.
 * The function returns with error or the content of the register
 */
-int twl4030_audio_disable_resource(unsigned id)
+int twl4030_audio_disable_resource(enum twl4030_audio_res id)
 {
        struct twl4030_audio *audio = platform_get_drvdata(twl4030_audio_dev);
        int val;
diff --git a/drivers/mfd/twl4030-madc.c b/drivers/mfd/twl4030-madc.c
index 88ff9dc83305..942b666a2a07 100644
--- a/drivers/mfd/twl4030-madc.c
+++ b/drivers/mfd/twl4030-madc.c
@@ -800,7 +800,7 @@ static int twl4030_madc_remove(struct platform_device *pdev)
 static struct platform_driver twl4030_madc_driver = {
        .probe = twl4030_madc_probe,
-        .remove = __exit_p(twl4030_madc_remove),
+        .remove = twl4030_madc_remove,
        .driver = {
                   .name = "twl4030_madc",
                   .owner = THIS_MODULE,
diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c
index 63feb75cc8e0..9279a9174f84 100644
--- a/drivers/mtd/bcm47xxpart.c
+++ b/drivers/mtd/bcm47xxpart.c
@@ -19,6 +19,12 @@
 /* 10 parts were found on sflash on Netgear WNDR4500 */
 #define BCM47XXPART_MAX_PARTS           12
+/*
+ * Amount of bytes we read when analyzing each block of flash memory.
+ * Set it big enough to allow detecting partition and reading important data.
+ */
+#define BCM47XXPART_BYTES_TO_READ       0x404
 /* Magics */
 #define BOARD_DATA_MAGIC                0x5246504D      /* MPFR */
 #define POT_MAGIC1                      0x54544f50      /* POTT */
@@ -57,17 +63,15 @@ static int bcm47xxpart_parse(struct mtd_info *master,
        struct trx_header *trx;
        int trx_part = -1;
        int last_trx_part = -1;
-        int max_bytes_to_read = 0x8004;
+        int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, };
        if (blocksize <= 0x10000)
                blocksize = 0x10000;
-        if (blocksize == 0x20000)
-                max_bytes_to_read = 0x18004;
        /* Alloc */
        parts = kzalloc(sizeof(struct mtd_partition) * BCM47XXPART_MAX_PARTS,
                        GFP_KERNEL);
-        buf = kzalloc(max_bytes_to_read, GFP_KERNEL);
+        buf = kzalloc(BCM47XXPART_BYTES_TO_READ, GFP_KERNEL);
        /* Parse block by block looking for magics */
        for (offset = 0; offset <= master->size - blocksize;
@@ -82,7 +86,7 @@ static int bcm47xxpart_parse(struct mtd_info *master,
                }
                /* Read beginning of the block */
-                if (mtd_read(master, offset, max_bytes_to_read,
+                if (mtd_read(master, offset, BCM47XXPART_BYTES_TO_READ,
                             &bytes_read, (uint8_t *)buf) < 0) {
                        pr_err("mtd_read error while parsing (offset: 0x%X)!\n",
                               offset);
@@ -96,20 +100,6 @@ static int bcm47xxpart_parse(struct mtd_info *master,
                        continue;
                }
-                /* Standard NVRAM */
-                if (buf[0x000 / 4] == NVRAM_HEADER ||
-                    buf[0x1000 / 4] == NVRAM_HEADER ||
-                    buf[0x8000 / 4] == NVRAM_HEADER ||
-                    (blocksize == 0x20000 && (
-                      buf[0x10000 / 4] == NVRAM_HEADER ||
-                      buf[0x11000 / 4] == NVRAM_HEADER ||
-                      buf[0x18000 / 4] == NVRAM_HEADER))) {
-                        bcm47xxpart_add_part(&parts[curr_part++], "nvram",
-                                             offset, 0);
-                        offset = rounddown(offset, blocksize);
-                        continue;
-                }
                /*
                 * board_data starts with board_id which differs across boards,
                 * but we can use 'MPFR' (hopefully) magic at 0x100
@@ -178,6 +168,30 @@ static int bcm47xxpart_parse(struct mtd_info *master,
                        continue;
                }
        }
+        /* Look for NVRAM at the end of the last block. */
+        for (i = 0; i < ARRAY_SIZE(possible_nvram_sizes); i++) {
+                if (curr_part > BCM47XXPART_MAX_PARTS) {
+                        pr_warn("Reached maximum number of partitions, scanning stopped!\n");
+                        break;
+                }
+                offset = master->size - possible_nvram_sizes[i];
+                if (mtd_read(master, offset, 0x4, &bytes_read,
+                             (uint8_t *)buf) < 0) {
+                        pr_err("mtd_read error while reading at offset 0x%X!\n",
+                               offset);
+                        continue;
+                }
+                /* Standard NVRAM */
+                if (buf[0] == NVRAM_HEADER) {
+                        bcm47xxpart_add_part(&parts[curr_part++], "nvram",
+                                             master->size - blocksize, 0);
+                        break;
+                }
+        }
        kfree(buf);
        /*
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 43214151b882..42c63927609d 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1523,6 +1523,14 @@ static int nand_do_read_ops(struct mtd_info *mtd, loff_t from,
                                        oobreadlen -= toread;
                                }
                        }
+                        if (chip->options & NAND_NEED_READRDY) {
+                                /* Apply delay or wait for ready/busy pin */
+                                if (!chip->dev_ready)
+                                        udelay(chip->chip_delay);
+                                else
+                                        nand_wait_ready(mtd);
+                        }
                } else {
                        memcpy(buf, chip->buffers->databuf + col, bytes);
                        buf += bytes;
@@ -1787,6 +1795,14 @@ static int nand_do_read_oob(struct mtd_info *mtd, loff_t from,
                len = min(len, readlen);
                buf = nand_transfer_oob(chip, buf, ops, len);
+                if (chip->options & NAND_NEED_READRDY) {
+                        /* Apply delay or wait for ready/busy pin */
+                        if (!chip->dev_ready)
+                                udelay(chip->chip_delay);
+                        else
+                                nand_wait_ready(mtd);
+                }
                readlen -= len;
                if (!readlen)
                        break;
diff --git a/drivers/mtd/nand/nand_ids.c b/drivers/mtd/nand/nand_ids.c
index e3aa2748a6e7..9c612388e5de 100644
--- a/drivers/mtd/nand/nand_ids.c
+++ b/drivers/mtd/nand/nand_ids.c
@@ -22,49 +22,51 @@
 *       512     512 Byte page size
 */
 struct nand_flash_dev nand_flash_ids[] = {
+#define SP_OPTIONS NAND_NEED_READRDY
+#define SP_OPTIONS16 (SP_OPTIONS | NAND_BUSWIDTH_16)
 #ifdef CONFIG_MTD_NAND_MUSEUM_IDS
-        {"NAND 1MiB 5V 8-bit",          0x6e, 256, 1, 0x1000, 0},
+        {"NAND 1MiB 5V 8-bit",          0x6e, 256, 1, 0x1000, SP_OPTIONS},
-        {"NAND 2MiB 5V 8-bit",          0x64, 256, 2, 0x1000, 0},
+        {"NAND 2MiB 5V 8-bit",          0x64, 256, 2, 0x1000, SP_OPTIONS},
-        {"NAND 4MiB 5V 8-bit",          0x6b, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 5V 8-bit",          0x6b, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 1MiB 3,3V 8-bit",        0xe8, 256, 1, 0x1000, 0},
+        {"NAND 1MiB 3,3V 8-bit",        0xe8, 256, 1, 0x1000, SP_OPTIONS},
-        {"NAND 1MiB 3,3V 8-bit",        0xec, 256, 1, 0x1000, 0},
+        {"NAND 1MiB 3,3V 8-bit",        0xec, 256, 1, 0x1000, SP_OPTIONS},
-        {"NAND 2MiB 3,3V 8-bit",        0xea, 256, 2, 0x1000, 0},
+        {"NAND 2MiB 3,3V 8-bit",        0xea, 256, 2, 0x1000, SP_OPTIONS},
-        {"NAND 4MiB 3,3V 8-bit",        0xd5, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 3,3V 8-bit",        0xd5, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 4MiB 3,3V 8-bit",        0xe3, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 3,3V 8-bit",        0xe3, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 4MiB 3,3V 8-bit",        0xe5, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 3,3V 8-bit",        0xe5, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 3,3V 8-bit",        0xd6, 512, 8, 0x2000, 0},
+        {"NAND 8MiB 3,3V 8-bit",        0xd6, 512, 8, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 1,8V 8-bit",        0x39, 512, 8, 0x2000, 0},
+        {"NAND 8MiB 1,8V 8-bit",        0x39, 512, 8, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 3,3V 8-bit",        0xe6, 512, 8, 0x2000, 0},
+        {"NAND 8MiB 3,3V 8-bit",        0xe6, 512, 8, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 1,8V 16-bit",       0x49, 512, 8, 0x2000, NAND_BUSWIDTH_16},
+        {"NAND 8MiB 1,8V 16-bit",       0x49, 512, 8, 0x2000, SP_OPTIONS16},
-        {"NAND 8MiB 3,3V 16-bit",       0x59, 512, 8, 0x2000, NAND_BUSWIDTH_16},
+        {"NAND 8MiB 3,3V 16-bit",       0x59, 512, 8, 0x2000, SP_OPTIONS16},
 #endif
-        {"NAND 16MiB 1,8V 8-bit",       0x33, 512, 16, 0x4000, 0},
+        {"NAND 16MiB 1,8V 8-bit",       0x33, 512, 16, 0x4000, SP_OPTIONS},
-        {"NAND 16MiB 3,3V 8-bit",       0x73, 512, 16, 0x4000, 0},
+        {"NAND 16MiB 3,3V 8-bit",       0x73, 512, 16, 0x4000, SP_OPTIONS},
-        {"NAND 16MiB 1,8V 16-bit",      0x43, 512, 16, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 16MiB 1,8V 16-bit",      0x43, 512, 16, 0x4000, SP_OPTIONS16},
-        {"NAND 16MiB 3,3V 16-bit",      0x53, 512, 16, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 16MiB 3,3V 16-bit",      0x53, 512, 16, 0x4000, SP_OPTIONS16},
-        {"NAND 32MiB 1,8V 8-bit",       0x35, 512, 32, 0x4000, 0},
+        {"NAND 32MiB 1,8V 8-bit",       0x35, 512, 32, 0x4000, SP_OPTIONS},
-        {"NAND 32MiB 3,3V 8-bit",       0x75, 512, 32, 0x4000, 0},
+        {"NAND 32MiB 3,3V 8-bit",       0x75, 512, 32, 0x4000, SP_OPTIONS},
-        {"NAND 32MiB 1,8V 16-bit",      0x45, 512, 32, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 32MiB 1,8V 16-bit",      0x45, 512, 32, 0x4000, SP_OPTIONS16},
-        {"NAND 32MiB 3,3V 16-bit",      0x55, 512, 32, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 32MiB 3,3V 16-bit",      0x55, 512, 32, 0x4000, SP_OPTIONS16},
-        {"NAND 64MiB 1,8V 8-bit",       0x36, 512, 64, 0x4000, 0},
+        {"NAND 64MiB 1,8V 8-bit",       0x36, 512, 64, 0x4000, SP_OPTIONS},
-        {"NAND 64MiB 3,3V 8-bit",       0x76, 512, 64, 0x4000, 0},
+        {"NAND 64MiB 3,3V 8-bit",       0x76, 512, 64, 0x4000, SP_OPTIONS},
-        {"NAND 64MiB 1,8V 16-bit",      0x46, 512, 64, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 64MiB 1,8V 16-bit",      0x46, 512, 64, 0x4000, SP_OPTIONS16},
-        {"NAND 64MiB 3,3V 16-bit",      0x56, 512, 64, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 64MiB 3,3V 16-bit",      0x56, 512, 64, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 1,8V 8-bit",      0x78, 512, 128, 0x4000, 0},
+        {"NAND 128MiB 1,8V 8-bit",      0x78, 512, 128, 0x4000, SP_OPTIONS},
-        {"NAND 128MiB 1,8V 8-bit",      0x39, 512, 128, 0x4000, 0},
+        {"NAND 128MiB 1,8V 8-bit",      0x39, 512, 128, 0x4000, SP_OPTIONS},
-        {"NAND 128MiB 3,3V 8-bit",      0x79, 512, 128, 0x4000, 0},
+        {"NAND 128MiB 3,3V 8-bit",      0x79, 512, 128, 0x4000, SP_OPTIONS},
-        {"NAND 128MiB 1,8V 16-bit",     0x72, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 1,8V 16-bit",     0x72, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 1,8V 16-bit",     0x49, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 1,8V 16-bit",     0x49, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 3,3V 16-bit",     0x74, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 3,3V 16-bit",     0x74, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 3,3V 16-bit",     0x59, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 3,3V 16-bit",     0x59, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 256MiB 3,3V 8-bit",      0x71, 512, 256, 0x4000, 0},
+        {"NAND 256MiB 3,3V 8-bit",      0x71, 512, 256, 0x4000, SP_OPTIONS},
        /*
         * These are the new chips with large page size. The pagesize and the
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 7bd068a6056a..6bbd90e1123c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1746,6 +1746,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        bond_compute_features(bond);
+        bond_update_speed_duplex(new_slave);
        read_lock(&bond->lock);
        new_slave->last_arp_rx = jiffies -
@@ -1798,8 +1800,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                new_slave->link == BOND_LINK_DOWN ? "DOWN" :
                        (new_slave->link == BOND_LINK_UP ? "UP" : "BACK"));
-        bond_update_speed_duplex(new_slave);
        if (USES_PRIMARY(bond->params.mode) && bond->params.primary[0]) {
                /* if there is a primary slave, remember it */
                if (strcmp(bond->params.primary, new_slave->dev->name) == 0) {
@@ -1964,7 +1964,6 @@ static int __bond_release_one(struct net_device *bond_dev,
        }
        block_netpoll_tx();
-        call_netdevice_notifiers(NETDEV_RELEASE, bond_dev);
        write_lock_bh(&bond->lock);
        slave = bond_get_slave_by_dev(bond, slave_dev);
@@ -2066,8 +2065,10 @@ static int __bond_release_one(struct net_device *bond_dev,
        write_unlock_bh(&bond->lock);
        unblock_netpoll_tx();
-        if (bond->slave_cnt == 0)
+        if (bond->slave_cnt == 0) {
                call_netdevice_notifiers(NETDEV_CHANGEADDR, bond->dev);
+                call_netdevice_notifiers(NETDEV_RELEASE, bond->dev);
+        }
        bond_compute_features(bond);
        if (!(bond_dev->features & NETIF_F_VLAN_CHALLENGED) &&
@@ -2373,8 +2374,6 @@ static void bond_miimon_commit(struct bonding *bond)
                                bond_set_backup_slave(slave);
                        }
-                        bond_update_speed_duplex(slave);
                        pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",
                                bond->dev->name, slave->dev->name,
                                slave->speed, slave->duplex ? "full" : "half");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index a923bc4d5a1f..4046f97378c2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2760,6 +2760,7 @@ load_error2:
        bp->port.pmf = 0;
 load_error1:
        bnx2x_napi_disable(bp);
+        bnx2x_del_all_napi(bp);
        /* clear pf_load status, as it was already set */
        if (IS_PF(bp))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 31c5787970db..77ebae0ac64a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -8647,7 +8647,9 @@ void bnx2x_handle_module_detect_int(struct link_params *params)
                                                MDIO_WC_DEVAD,
                                                MDIO_WC_REG_DIGITAL5_MISC6,
                                                &rx_tx_in_reset);
-                                if (!rx_tx_in_reset) {
+                                if ((!rx_tx_in_reset) &&
+                                    (params->link_flags &
+                                     PHY_INITIALIZED)) {
                                        bnx2x_warpcore_reset_lane(bp, phy, 1);
                                        bnx2x_warpcore_config_sfi(phy, params);
                                        bnx2x_warpcore_reset_lane(bp, phy, 0);
@@ -12527,6 +12529,8 @@ int bnx2x_phy_init(struct link_params *params, struct link_vars *vars)
        vars->flow_ctrl = BNX2X_FLOW_CTRL_NONE;
        vars->mac_type = MAC_TYPE_NONE;
        vars->phy_flags = 0;
+        vars->check_kr2_recovery_cnt = 0;
+        params->link_flags = PHY_INITIALIZED;
        /* Driver opens NIG-BRB filters */
        bnx2x_set_rx_filter(params, 1);
        /* Check if link flap can be avoided */
@@ -12691,6 +12695,7 @@ int bnx2x_lfa_reset(struct link_params *params,
        struct bnx2x *bp = params->bp;
        vars->link_up = 0;
        vars->phy_flags = 0;
+        params->link_flags &= ~PHY_INITIALIZED;
        if (!params->lfa_base)
                return bnx2x_link_reset(params, vars, 1);
        /*
@@ -13411,6 +13416,7 @@ static void bnx2x_disable_kr2(struct link_params *params,
        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
        bnx2x_update_link_attr(params, vars->link_attr_sync);
+        vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
        /* Restart AN on leading lane */
        bnx2x_warpcore_restart_AN_KR(phy, params);
 }
@@ -13439,6 +13445,15 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
                return;
        }
+        /* Once KR2 was disabled, wait 5 seconds before checking KR2 recovery
+         * since some switches tend to reinit the AN process and clear the
+         * advertised BP/NP after ~2 seconds causing the KR2 to be disabled
+         * and recovered many times
+         */
+        if (vars->check_kr2_recovery_cnt > 0) {
+                vars->check_kr2_recovery_cnt--;
+                return;
+        }
        lane = bnx2x_get_warpcore_lane(phy, params);
        CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
                          MDIO_AER_BLOCK_AER_REG, lane);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
index be5c195d03dd..56c2aae4e2c8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
@@ -309,6 +309,7 @@ struct link_params {
                                req_flow_ctrl is set to AUTO */
        u16 link_flags;
 #define LINK_FLAGS_INT_DISABLED         (1<<0)
+#define PHY_INITIALIZED         (1<<1)
        u32 lfa_base;
 };
@@ -342,7 +343,8 @@ struct link_vars {
        u32 link_status;
        u32 eee_status;
        u8 fault_detected;
-        u8 rsrv1;
+        u8 check_kr2_recovery_cnt;
+#define CHECK_KR2_RECOVERY_CNT  5
        u16 periodic_flags;
 #define PERIODIC_FLAGS_LINK_EVENT       0x0001
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index 364e37ecbc5c..198f6f1c9ad5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -459,8 +459,9 @@ struct bnx2x_fw_port_stats_old {
 #define UPDATE_QSTAT(s, t) \
        do { \
-                qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi); \
                qstats->t##_lo = qstats_old->t##_lo + le32_to_cpu(s.lo); \
+                qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi) \
+                        + ((qstats->t##_lo < qstats_old->t##_lo) ? 1 : 0); \
        } while (0)
 #define UPDATE_QSTAT_OLD(f) \
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index fdb9b5655414..67d2663b3974 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -1869,6 +1869,8 @@ static void tg3_link_report(struct tg3 *tp)
                tg3_ump_link_report(tp);
        }
+        tp->link_up = netif_carrier_ok(tp->dev);
 }
 static u16 tg3_advert_flowctrl_1000X(u8 flow_ctrl)
@@ -2522,12 +2524,6 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
        return err;
 }
-static void tg3_carrier_on(struct tg3 *tp)
-{
-        netif_carrier_on(tp->dev);
-        tp->link_up = true;
-}
 static void tg3_carrier_off(struct tg3 *tp)
 {
        netif_carrier_off(tp->dev);
@@ -2553,7 +2549,7 @@ static int tg3_phy_reset(struct tg3 *tp)
                return -EBUSY;
        if (netif_running(tp->dev) && tp->link_up) {
-                tg3_carrier_off(tp);
+                netif_carrier_off(tp->dev);
                tg3_link_report(tp);
        }
@@ -4134,6 +4130,14 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
                tp->link_config.active_speed = tp->link_config.speed;
                tp->link_config.active_duplex = tp->link_config.duplex;
+                if (tg3_asic_rev(tp) == ASIC_REV_5714) {
+                        /* With autoneg disabled, 5715 only links up when the
+                         * advertisement register has the configured speed
+                         * enabled.
+                         */
+                        tg3_writephy(tp, MII_ADVERTISE, ADVERTISE_ALL);
+                }
                bmcr = 0;
                switch (tp->link_config.speed) {
                default:
@@ -4262,9 +4266,9 @@ static bool tg3_test_and_report_link_chg(struct tg3 *tp, int curr_link_up)
 {
        if (curr_link_up != tp->link_up) {
                if (curr_link_up) {
-                        tg3_carrier_on(tp);
+                        netif_carrier_on(tp->dev);
                } else {
-                        tg3_carrier_off(tp);
+                        netif_carrier_off(tp->dev);
                        if (tp->phy_flags & TG3_PHYFLG_MII_SERDES)
                                tp->phy_flags &= ~TG3_PHYFLG_PARALLEL_DETECT;
                }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4ce62031f62f..8049268ce0f2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -497,8 +497,9 @@ int t4_memory_write(struct adapter *adap, int mtype, u32 addr, u32 len,
 }
 #define EEPROM_STAT_ADDR   0x7bfc
-#define VPD_BASE           0
 #define VPD_LEN            512
+#define VPD_BASE           0x400
+#define VPD_BASE_OLD       0
 /**
 *      t4_seeprom_wp - enable/disable EEPROM write protection
@@ -524,7 +525,7 @@ int t4_seeprom_wp(struct adapter *adapter, bool enable)
 int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
 {
        u32 cclk_param, cclk_val;
-        int i, ret;
+        int i, ret, addr;
        int ec, sn;
        u8 *vpd, csum;
        unsigned int vpdr_len, kw_offset, id_len;
@@ -533,7 +534,12 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
        if (!vpd)
                return -ENOMEM;
-        ret = pci_read_vpd(adapter->pdev, VPD_BASE, VPD_LEN, vpd);
+        ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(u32), vpd);
+        if (ret < 0)
+                goto out;
+        addr = *vpd == 0x82 ? VPD_BASE : VPD_BASE_OLD;
+        ret = pci_read_vpd(adapter->pdev, addr, VPD_LEN, vpd);
        if (ret < 0)
                goto out;
diff --git a/drivers/net/ethernet/dec/tulip/Kconfig b/drivers/net/ethernet/dec/tulip/Kconfig
index 0c37fb2cc867..1df33c799c00 100644
--- a/drivers/net/ethernet/dec/tulip/Kconfig
+++ b/drivers/net/ethernet/dec/tulip/Kconfig
@@ -108,6 +108,7 @@ config TULIP_DM910X
 config DE4X5
        tristate "Generic DECchip & DIGITAL EtherWORKS PCI/EISA"
        depends on (PCI || EISA)
+        depends on VIRT_TO_BUS || ALPHA || PPC || SPARC
        select CRC32
        ---help---
          This is support for the DIGITAL series of PCI/EISA Ethernet cards.
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 28ceb8414185..29aff55f2eea 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -349,6 +349,7 @@ struct be_adapter {
        struct pci_dev *pdev;
        struct net_device *netdev;
+        u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
        u8 __iomem *db;         /* Door Bell */
        struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 071aea79d218..3c9b4f12e3e5 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -473,19 +473,17 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
        return 0;
 }
-static int be_POST_stage_get(struct be_adapter *adapter, u16 *stage)
+static u16 be_POST_stage_get(struct be_adapter *adapter)
 {
        u32 sem;
-        u32 reg = skyhawk_chip(adapter) ? SLIPORT_SEMAPHORE_OFFSET_SH :
-                                          SLIPORT_SEMAPHORE_OFFSET_BE;
-        pci_read_config_dword(adapter->pdev, reg, &sem);
+        if (BEx_chip(adapter))
-        *stage = sem & POST_STAGE_MASK;
+                sem  = ioread32(adapter->csr + SLIPORT_SEMAPHORE_OFFSET_BEx);
-        if ((sem >> POST_ERR_SHIFT) & POST_ERR_MASK)
-                return -1;
        else
-                return 0;
+                pci_read_config_dword(adapter->pdev,
+                                      SLIPORT_SEMAPHORE_OFFSET_SH, &sem);
+        return sem & POST_STAGE_MASK;
 }
 int lancer_wait_ready(struct be_adapter *adapter)
@@ -579,19 +577,17 @@ int be_fw_wait_ready(struct be_adapter *adapter)
        }
        do {
-                status = be_POST_stage_get(adapter, &stage);
+                stage = be_POST_stage_get(adapter);
-                if (status) {
+                if (stage == POST_STAGE_ARMFW_RDY)
-                        dev_err(dev, "POST error; stage=0x%x\n", stage);
-                        return -1;
-                } else if (stage != POST_STAGE_ARMFW_RDY) {
-                        if (msleep_interruptible(2000)) {
-                                dev_err(dev, "Waiting for POST aborted\n");
-                                return -EINTR;
-                        }
-                        timeout += 2;
-                } else {
                        return 0;
+                dev_info(dev, "Waiting for POST, %ds elapsed\n",
+                         timeout);
+                if (msleep_interruptible(2000)) {
+                        dev_err(dev, "Waiting for POST aborted\n");
+                        return -EINTR;
                }
+                timeout += 2;
        } while (timeout < 60);
        dev_err(dev, "POST timeout; stage=0x%x\n", stage);
diff --git a/drivers/net/ethernet/emulex/benet/be_hw.h b/drivers/net/ethernet/emulex/benet/be_hw.h
index 541d4530d5bf..62dc220695f7 100644
--- a/drivers/net/ethernet/emulex/benet/be_hw.h
+++ b/drivers/net/ethernet/emulex/benet/be_hw.h
@@ -32,8 +32,8 @@
 #define MPU_EP_CONTROL          0
 /********** MPU semphore: used for SH & BE  *************/
-#define SLIPORT_SEMAPHORE_OFFSET_BE             0x7c
+#define SLIPORT_SEMAPHORE_OFFSET_BEx            0xac  /* CSR BAR offset */
-#define SLIPORT_SEMAPHORE_OFFSET_SH             0x94
+#define SLIPORT_SEMAPHORE_OFFSET_SH             0x94  /* PCI-CFG offset */
 #define POST_STAGE_MASK                         0x0000FFFF
 #define POST_ERR_MASK                           0x1
 #define POST_ERR_SHIFT                          31
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 3860888ac711..08e54f3d288b 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3688,6 +3688,8 @@ static void be_netdev_init(struct net_device *netdev)
 static void be_unmap_pci_bars(struct be_adapter *adapter)
 {
+        if (adapter->csr)
+                pci_iounmap(adapter->pdev, adapter->csr);
        if (adapter->db)
                pci_iounmap(adapter->pdev, adapter->db);
 }
@@ -3721,6 +3723,12 @@ static int be_map_pci_bars(struct be_adapter *adapter)
        adapter->if_type = (sli_intf & SLI_INTF_IF_TYPE_MASK) >>
                                SLI_INTF_IF_TYPE_SHIFT;
+        if (BEx_chip(adapter) && be_physfn(adapter)) {
+                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                if (adapter->csr == NULL)
+                        return -ENOMEM;
+        }
        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
        if (addr == NULL)
                goto pci_map_err;
@@ -4329,6 +4337,8 @@ static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
        pci_restore_state(pdev);
        /* Check if card is ok and fw is ready */
+        dev_info(&adapter->pdev->dev,
+                 "Waiting for FW to be ready after EEH reset\n");
        status = be_fw_wait_ready(adapter);
        if (status)
                return PCI_ERS_RESULT_DISCONNECT;
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index 069a155d16ed..e3f39372ce25 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -934,24 +934,28 @@ static void fec_enet_adjust_link(struct net_device *ndev)
                goto spin_unlock;
        }
-        /* Duplex link change */
        if (phy_dev->link) {
-                if (fep->full_duplex != phy_dev->duplex) {
+                if (!fep->link) {
-                        fec_restart(ndev, phy_dev->duplex);
-                        /* prevent unnecessary second fec_restart() below */
                        fep->link = phy_dev->link;
                        status_change = 1;
                }
-        }
-        /* Link on or off change */
+                if (fep->full_duplex != phy_dev->duplex)
-        if (phy_dev->link != fep->link) {
+                        status_change = 1;
-                fep->link = phy_dev->link;
-                if (phy_dev->link)
+                if (phy_dev->speed != fep->speed) {
+                        fep->speed = phy_dev->speed;
+                        status_change = 1;
+                }
+                /* if any of the above changed restart the FEC */
+                if (status_change)
                        fec_restart(ndev, phy_dev->duplex);
-                else
+        } else {
+                if (fep->link) {
                        fec_stop(ndev);
-                status_change = 1;
+                        status_change = 1;
+                }
        }
 spin_unlock:
@@ -1437,6 +1441,7 @@ fec_enet_close(struct net_device *ndev)
        struct fec_enet_private *fep = netdev_priv(ndev);
        /* Don't know what to do yet. */
+        napi_disable(&fep->napi);
        fep->opened = 0;
        netif_stop_queue(ndev);
        fec_stop(ndev);
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index f5390071efd0..eb4372962839 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -240,6 +240,7 @@ struct fec_enet_private {
        phy_interface_t phy_interface;
        int     link;
        int     full_duplex;
+        int     speed;
        struct  completion mdio_done;
        int     irq[FEC_IRQ_NUM];
        int     bufdesc_ex;
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index 2c1813737f6d..f91a8f3f9d48 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -36,6 +36,7 @@
 #include <linux/delay.h>
 #include <linux/vmalloc.h>
 #include <linux/mdio.h>
+#include <linux/pm_runtime.h>
 #include "e1000.h"
@@ -2229,7 +2230,19 @@ static int e1000e_get_ts_info(struct net_device *netdev,
        return 0;
 }
+static int e1000e_ethtool_begin(struct net_device *netdev)
+{
+        return pm_runtime_get_sync(netdev->dev.parent);
+}
+static void e1000e_ethtool_complete(struct net_device *netdev)
+{
+        pm_runtime_put_sync(netdev->dev.parent);
+}
 static const struct ethtool_ops e1000_ethtool_ops = {
+        .begin                  = e1000e_ethtool_begin,
+        .complete               = e1000e_ethtool_complete,
        .get_settings           = e1000_get_settings,
        .set_settings           = e1000_set_settings,
        .get_drvinfo            = e1000_get_drvinfo,
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index dff7bff8b8e0..121a865c7fbd 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -782,6 +782,59 @@ release:
 }
 /**
+ *  e1000_k1_workaround_lpt_lp - K1 workaround on Lynxpoint-LP
+ *  @hw:   pointer to the HW structure
+ *  @link: link up bool flag
+ *
+ *  When K1 is enabled for 1Gbps, the MAC can miss 2 DMA completion indications
+ *  preventing further DMA write requests.  Workaround the issue by disabling
+ *  the de-assertion of the clock request when in 1Gpbs mode.
+ **/
+static s32 e1000_k1_workaround_lpt_lp(struct e1000_hw *hw, bool link)
+{
+        u32 fextnvm6 = er32(FEXTNVM6);
+        s32 ret_val = 0;
+        if (link && (er32(STATUS) & E1000_STATUS_SPEED_1000)) {
+                u16 kmrn_reg;
+                ret_val = hw->phy.ops.acquire(hw);
+                if (ret_val)
+                        return ret_val;
+                ret_val =
+                    e1000e_read_kmrn_reg_locked(hw, E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                &kmrn_reg);
+                if (ret_val)
+                        goto release;
+                ret_val =
+                    e1000e_write_kmrn_reg_locked(hw,
+                                                 E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                 kmrn_reg &
+                                                 ~E1000_KMRNCTRLSTA_K1_ENABLE);
+                if (ret_val)
+                        goto release;
+                usleep_range(10, 20);
+                ew32(FEXTNVM6, fextnvm6 | E1000_FEXTNVM6_REQ_PLL_CLK);
+                ret_val =
+                    e1000e_write_kmrn_reg_locked(hw,
+                                                 E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                 kmrn_reg);
+release:
+                hw->phy.ops.release(hw);
+        } else {
+                /* clear FEXTNVM6 bit 8 on link down or 10/100 */
+                ew32(FEXTNVM6, fextnvm6 & ~E1000_FEXTNVM6_REQ_PLL_CLK);
+        }
+        return ret_val;
+}
+/**
 *  e1000_check_for_copper_link_ich8lan - Check for link (Copper)
 *  @hw: pointer to the HW structure
 *
@@ -818,6 +871,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                        return ret_val;
        }
+        /* Work-around I218 hang issue */
+        if ((hw->adapter->pdev->device == E1000_DEV_ID_PCH_LPTLP_I218_LM) ||
+            (hw->adapter->pdev->device == E1000_DEV_ID_PCH_LPTLP_I218_V)) {
+                ret_val = e1000_k1_workaround_lpt_lp(hw, link);
+                if (ret_val)
+                        return ret_val;
+        }
        /* Clear link partner's EEE ability */
        hw->dev_spec.ich8lan.eee_lp_ability = 0;
@@ -3954,8 +4015,16 @@ void e1000_suspend_workarounds_ich8lan(struct e1000_hw *hw)
        phy_ctrl = er32(PHY_CTRL);
        phy_ctrl |= E1000_PHY_CTRL_GBE_DISABLE;
        if (hw->phy.type == e1000_phy_i217) {
-                u16 phy_reg;
+                u16 phy_reg, device_id = hw->adapter->pdev->device;
+                if ((device_id == E1000_DEV_ID_PCH_LPTLP_I218_LM) ||
+                    (device_id == E1000_DEV_ID_PCH_LPTLP_I218_V)) {
+                        u32 fextnvm6 = er32(FEXTNVM6);
+                        ew32(FEXTNVM6, fextnvm6 & ~E1000_FEXTNVM6_REQ_PLL_CLK);
+                }
                ret_val = hw->phy.ops.acquire(hw);
                if (ret_val)
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index b6d3174d7d2d..8bf4655c2e17 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -92,6 +92,8 @@
 #define E1000_FEXTNVM4_BEACON_DURATION_8USEC    0x7
 #define E1000_FEXTNVM4_BEACON_DURATION_16USEC   0x3
+#define E1000_FEXTNVM6_REQ_PLL_CLK      0x00000100
 #define PCIE_ICH8_SNOOP_ALL     PCIE_NO_SNOOP_ALL
 #define E1000_ICH_RAR_ENTRIES   7
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index a177b8b65c44..948b86ffa4f0 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4303,6 +4303,7 @@ static int e1000_open(struct net_device *netdev)
        netif_start_queue(netdev);
        adapter->idle_check = true;
+        hw->mac.get_link_status = true;
        pm_runtime_put(&pdev->dev);
        /* fire a link status change interrupt to start the watchdog */
@@ -4662,6 +4663,7 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
            (adapter->hw.phy.media_type == e1000_media_type_copper)) {
                int ret_val;
+                pm_runtime_get_sync(&adapter->pdev->dev);
                ret_val = e1e_rphy(hw, MII_BMCR, &phy->bmcr);
                ret_val |= e1e_rphy(hw, MII_BMSR, &phy->bmsr);
                ret_val |= e1e_rphy(hw, MII_ADVERTISE, &phy->advertise);
@@ -4672,6 +4674,7 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
                ret_val |= e1e_rphy(hw, MII_ESTATUS, &phy->estatus);
                if (ret_val)
                        e_warn("Error reading PHY register\n");
+                pm_runtime_put_sync(&adapter->pdev->dev);
        } else {
                /* Do not read PHY registers if link is not up
                 * Set values to typical power-on defaults
@@ -5887,8 +5890,7 @@ release:
        return retval;
 }
-static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake,
+static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
-                            bool runtime)
 {
        struct net_device *netdev = pci_get_drvdata(pdev);
        struct e1000_adapter *adapter = netdev_priv(netdev);
@@ -5912,10 +5914,6 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake,
        }
        e1000e_reset_interrupt_capability(adapter);
-        retval = pci_save_state(pdev);
-        if (retval)
-                return retval;
        status = er32(STATUS);
        if (status & E1000_STATUS_LU)
                wufc &= ~E1000_WUFC_LNKC;
@@ -5971,13 +5969,6 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake,
                ew32(WUFC, 0);
        }
-        *enable_wake = !!wufc;
-        /* make sure adapter isn't asleep if manageability is enabled */
-        if ((adapter->flags & FLAG_MNG_PT_ENABLED) ||
-            (hw->mac.ops.check_mng_mode(hw)))
-                *enable_wake = true;
        if (adapter->hw.phy.type == e1000_phy_igp_3)
                e1000e_igp3_phy_powerdown_workaround_ich8lan(&adapter->hw);
@@ -5986,27 +5977,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake,
         */
        e1000e_release_hw_control(adapter);
-        pci_disable_device(pdev);
+        pci_clear_master(pdev);
-        return 0;
-}
-static void e1000_power_off(struct pci_dev *pdev, bool sleep, bool wake)
-{
-        if (sleep && wake) {
-                pci_prepare_to_sleep(pdev);
-                return;
-        }
-        pci_wake_from_d3(pdev, wake);
-        pci_set_power_state(pdev, PCI_D3hot);
-}
-static void e1000_complete_shutdown(struct pci_dev *pdev, bool sleep,
-                                    bool wake)
-{
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct e1000_adapter *adapter = netdev_priv(netdev);
        /* The pci-e switch on some quad port adapters will report a
         * correctable error when the MAC transitions from D0 to D3.  To
@@ -6021,12 +5992,13 @@ static void e1000_complete_shutdown(struct pci_dev *pdev, bool sleep,
                pcie_capability_write_word(us_dev, PCI_EXP_DEVCTL,
                                           (devctl & ~PCI_EXP_DEVCTL_CERE));
-                e1000_power_off(pdev, sleep, wake);
+                pci_save_state(pdev);
+                pci_prepare_to_sleep(pdev);
                pcie_capability_write_word(us_dev, PCI_EXP_DEVCTL, devctl);
-        } else {
-                e1000_power_off(pdev, sleep, wake);
        }
+        return 0;
 }
 #ifdef CONFIG_PCIEASPM
@@ -6084,9 +6056,7 @@ static int __e1000_resume(struct pci_dev *pdev)
        if (aspm_disable_flag)
                e1000e_disable_aspm(pdev, aspm_disable_flag);
-        pci_set_power_state(pdev, PCI_D0);
+        pci_set_master(pdev);
-        pci_restore_state(pdev);
-        pci_save_state(pdev);
        e1000e_set_interrupt_capability(adapter);
        if (netif_running(netdev)) {
@@ -6152,14 +6122,8 @@ static int __e1000_resume(struct pci_dev *pdev)
 static int e1000_suspend(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
-        int retval;
-        bool wake;
-        retval = __e1000_shutdown(pdev, &wake, false);
-        if (!retval)
-                e1000_complete_shutdown(pdev, true, wake);
-        return retval;
+        return __e1000_shutdown(pdev, false);
 }
 static int e1000_resume(struct device *dev)
@@ -6182,13 +6146,10 @@ static int e1000_runtime_suspend(struct device *dev)
        struct net_device *netdev = pci_get_drvdata(pdev);
        struct e1000_adapter *adapter = netdev_priv(netdev);
-        if (e1000e_pm_ready(adapter)) {
+        if (!e1000e_pm_ready(adapter))
-                bool wake;
+                return 0;
-                __e1000_shutdown(pdev, &wake, true);
-        }
-        return 0;
+        return __e1000_shutdown(pdev, true);
 }
 static int e1000_idle(struct device *dev)
@@ -6226,12 +6187,7 @@ static int e1000_runtime_resume(struct device *dev)
 static void e1000_shutdown(struct pci_dev *pdev)
 {
-        bool wake = false;
+        __e1000_shutdown(pdev, false);
-        __e1000_shutdown(pdev, &wake, false);
-        if (system_state == SYSTEM_POWER_OFF)
-                e1000_complete_shutdown(pdev, false, wake);
 }
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -6352,9 +6308,9 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
                        "Cannot re-enable PCI device after reset.\n");
                result = PCI_ERS_RESULT_DISCONNECT;
        } else {
-                pci_set_master(pdev);
                pdev->state_saved = true;
                pci_restore_state(pdev);
+                pci_set_master(pdev);
                pci_enable_wake(pdev, PCI_D3hot, 0);
                pci_enable_wake(pdev, PCI_D3cold, 0);
@@ -6783,7 +6739,11 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        /* initialize the wol settings based on the eeprom settings */
        adapter->wol = adapter->eeprom_wol;
-        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
+        /* make sure adapter isn't asleep if manageability is enabled */
+        if (adapter->wol || (adapter->flags & FLAG_MNG_PT_ENABLED) ||
+            (hw->mac.ops.check_mng_mode(hw)))
+                device_wakeup_enable(&pdev->dev);
        /* save off EEPROM version number */
        e1000_read_nvm(&adapter->hw, 5, 1, &adapter->eeprom_vers);
diff --git a/drivers/net/ethernet/intel/e1000e/regs.h b/drivers/net/ethernet/intel/e1000e/regs.h
index 794fe1497666..a7e6a3e37257 100644
--- a/drivers/net/ethernet/intel/e1000e/regs.h
+++ b/drivers/net/ethernet/intel/e1000e/regs.h
@@ -42,6 +42,7 @@
 #define E1000_FEXTNVM   0x00028 /* Future Extended NVM - RW */
 #define E1000_FEXTNVM3  0x0003C /* Future Extended NVM 3 - RW */
 #define E1000_FEXTNVM4  0x00024 /* Future Extended NVM 4 - RW */
+#define E1000_FEXTNVM6  0x00010 /* Future Extended NVM 6 - RW */
 #define E1000_FEXTNVM7  0x000E4 /* Future Extended NVM 7 - RW */
 #define E1000_FCT       0x00030 /* Flow Control Type - RW */
 #define E1000_VET       0x00038 /* VLAN Ether Type - RW */
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 84e7e0909def..b64542acfa34 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1361,11 +1361,16 @@ static s32 igb_setup_copper_link_82575(struct e1000_hw *hw)
        switch (hw->phy.type) {
        case e1000_phy_i210:
        case e1000_phy_m88:
-                if (hw->phy.id == I347AT4_E_PHY_ID ||
+                switch (hw->phy.id) {
-                    hw->phy.id == M88E1112_E_PHY_ID)
+                case I347AT4_E_PHY_ID:
+                case M88E1112_E_PHY_ID:
+                case I210_I_PHY_ID:
                        ret_val = igb_copper_link_setup_m88_gen2(hw);
-                else
+                        break;
+                default:
                        ret_val = igb_copper_link_setup_m88(hw);
+                        break;
+                }
                break;
        case e1000_phy_igp_3:
                ret_val = igb_copper_link_setup_igp(hw);
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index d27edbc63923..25151401c2ab 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -447,7 +447,7 @@ struct igb_adapter {
 #endif
        struct i2c_algo_bit_data i2c_algo;
        struct i2c_adapter i2c_adap;
-        struct igb_i2c_client_list *i2c_clients;
+        struct i2c_client *i2c_client;
 };
 #define IGB_FLAG_HAS_MSI                (1 << 0)
diff --git a/drivers/net/ethernet/intel/igb/igb_hwmon.c b/drivers/net/ethernet/intel/igb/igb_hwmon.c
index 0a9b073d0b03..4623502054d5 100644
--- a/drivers/net/ethernet/intel/igb/igb_hwmon.c
+++ b/drivers/net/ethernet/intel/igb/igb_hwmon.c
@@ -39,6 +39,10 @@
 #include <linux/pci.h>
 #ifdef CONFIG_IGB_HWMON
+struct i2c_board_info i350_sensor_info = {
+        I2C_BOARD_INFO("i350bb", (0Xf8 >> 1)),
+};
 /* hwmon callback functions */
 static ssize_t igb_hwmon_show_location(struct device *dev,
                                         struct device_attribute *attr,
@@ -188,6 +192,7 @@ int igb_sysfs_init(struct igb_adapter *adapter)
        unsigned int i;
        int n_attrs;
        int rc = 0;
+        struct i2c_client *client = NULL;
        /* If this method isn't defined we don't support thermals */
        if (adapter->hw.mac.ops.init_thermal_sensor_thresh == NULL)
@@ -198,6 +203,15 @@ int igb_sysfs_init(struct igb_adapter *adapter)
                if (rc)
                        goto exit;
+        /* init i2c_client */
+        client = i2c_new_device(&adapter->i2c_adap, &i350_sensor_info);
+        if (client == NULL) {
+                dev_info(&adapter->pdev->dev,
+                        "Failed to create new i2c device..\n");
+                goto exit;
+        }
+        adapter->i2c_client = client;
        /* Allocation space for max attributes
         * max num sensors * values (loc, temp, max, caution)
         */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index ed79a1c53b59..4dbd62968c7a 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1923,10 +1923,6 @@ void igb_set_fw_version(struct igb_adapter *adapter)
        return;
 }
-static const struct i2c_board_info i350_sensor_info = {
-        I2C_BOARD_INFO("i350bb", 0Xf8),
-};
 /*  igb_init_i2c - Init I2C interface
 *  @adapter: pointer to adapter structure
 *
@@ -6227,13 +6223,6 @@ static struct sk_buff *igb_build_rx_buffer(struct igb_ring *rx_ring,
        /* If we spanned a buffer we have a huge mess so test for it */
        BUG_ON(unlikely(!igb_test_staterr(rx_desc, E1000_RXD_STAT_EOP)));
-        /* Guarantee this function can be used by verifying buffer sizes */
-        BUILD_BUG_ON(SKB_WITH_OVERHEAD(IGB_RX_BUFSZ) < (NET_SKB_PAD +
-                                                        NET_IP_ALIGN +
-                                                        IGB_TS_HDR_LEN +
-                                                        ETH_FRAME_LEN +
-                                                        ETH_FCS_LEN));
        rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
        page = rx_buffer->page;
        prefetchw(page);
@@ -7724,67 +7713,6 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)
        }
 }
-static DEFINE_SPINLOCK(i2c_clients_lock);
-/*  igb_get_i2c_client - returns matching client
- *  in adapters's client list.
- *  @adapter: adapter struct
- *  @dev_addr: device address of i2c needed.
- */
-static struct i2c_client *
-igb_get_i2c_client(struct igb_adapter *adapter, u8 dev_addr)
-{
-        ulong flags;
-        struct igb_i2c_client_list *client_list;
-        struct i2c_client *client = NULL;
-        struct i2c_board_info client_info = {
-                I2C_BOARD_INFO("igb", 0x00),
-        };
-        spin_lock_irqsave(&i2c_clients_lock, flags);
-        client_list = adapter->i2c_clients;
-        /* See if we already have an i2c_client */
-        while (client_list) {
-                if (client_list->client->addr == (dev_addr >> 1)) {
-                        client = client_list->client;
-                        goto exit;
-                } else {
-                        client_list = client_list->next;
-                }
-        }
-        /* no client_list found, create a new one */
-        client_list = kzalloc(sizeof(*client_list), GFP_ATOMIC);
-        if (client_list == NULL)
-                goto exit;
-        /* dev_addr passed to us is left-shifted by 1 bit
-         * i2c_new_device call expects it to be flush to the right.
-         */
-        client_info.addr = dev_addr >> 1;
-        client_info.platform_data = adapter;
-        client_list->client = i2c_new_device(&adapter->i2c_adap, &client_info);
-        if (client_list->client == NULL) {
-                dev_info(&adapter->pdev->dev,
-                        "Failed to create new i2c device..\n");
-                goto err_no_client;
-        }
-        /* insert new client at head of list */
-        client_list->next = adapter->i2c_clients;
-        adapter->i2c_clients = client_list;
-        client = client_list->client;
-        goto exit;
-err_no_client:
-        kfree(client_list);
-exit:
-        spin_unlock_irqrestore(&i2c_clients_lock, flags);
-        return client;
-}
 /*  igb_read_i2c_byte - Reads 8 bit word over I2C
 *  @hw: pointer to hardware structure
 *  @byte_offset: byte offset to read
@@ -7798,7 +7726,7 @@ s32 igb_read_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
                                u8 dev_addr, u8 *data)
 {
        struct igb_adapter *adapter = container_of(hw, struct igb_adapter, hw);
-        struct i2c_client *this_client = igb_get_i2c_client(adapter, dev_addr);
+        struct i2c_client *this_client = adapter->i2c_client;
        s32 status;
        u16 swfw_mask = 0;
@@ -7835,7 +7763,7 @@ s32 igb_write_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
                                 u8 dev_addr, u8 data)
 {
        struct igb_adapter *adapter = container_of(hw, struct igb_adapter, hw);
-        struct i2c_client *this_client = igb_get_i2c_client(adapter, dev_addr);
+        struct i2c_client *this_client = adapter->i2c_client;
        s32 status;
        u16 swfw_mask = E1000_SWFW_PHY0_SM;
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 29140502b71a..6562c736a1d8 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1081,6 +1081,45 @@ static void txq_set_fixed_prio_mode(struct tx_queue *txq)
 /* mii management interface *************************************************/
+static void mv643xx_adjust_pscr(struct mv643xx_eth_private *mp)
+{
+        u32 pscr = rdlp(mp, PORT_SERIAL_CONTROL);
+        u32 autoneg_disable = FORCE_LINK_PASS |
+                     DISABLE_AUTO_NEG_SPEED_GMII |
+                     DISABLE_AUTO_NEG_FOR_FLOW_CTRL |
+                     DISABLE_AUTO_NEG_FOR_DUPLEX;
+        if (mp->phy->autoneg == AUTONEG_ENABLE) {
+                /* enable auto negotiation */
+                pscr &= ~autoneg_disable;
+                goto out_write;
+        }
+        pscr |= autoneg_disable;
+        if (mp->phy->speed == SPEED_1000) {
+                /* force gigabit, half duplex not supported */
+                pscr |= SET_GMII_SPEED_TO_1000;
+                pscr |= SET_FULL_DUPLEX_MODE;
+                goto out_write;
+        }
+        pscr &= ~SET_GMII_SPEED_TO_1000;
+        if (mp->phy->speed == SPEED_100)
+                pscr |= SET_MII_SPEED_TO_100;
+        else
+                pscr &= ~SET_MII_SPEED_TO_100;
+        if (mp->phy->duplex == DUPLEX_FULL)
+                pscr |= SET_FULL_DUPLEX_MODE;
+        else
+                pscr &= ~SET_FULL_DUPLEX_MODE;
+out_write:
+        wrlp(mp, PORT_SERIAL_CONTROL, pscr);
+}
 static irqreturn_t mv643xx_eth_err_irq(int irq, void *dev_id)
 {
        struct mv643xx_eth_shared_private *msp = dev_id;
@@ -1499,6 +1538,7 @@ static int
 mv643xx_eth_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
        struct mv643xx_eth_private *mp = netdev_priv(dev);
+        int ret;
        if (mp->phy == NULL)
                return -EINVAL;
@@ -1508,7 +1548,10 @@ mv643xx_eth_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         */
        cmd->advertising &= ~ADVERTISED_1000baseT_Half;
-        return phy_ethtool_sset(mp->phy, cmd);
+        ret = phy_ethtool_sset(mp->phy, cmd);
+        if (!ret)
+                mv643xx_adjust_pscr(mp);
+        return ret;
 }
 static void mv643xx_eth_get_drvinfo(struct net_device *dev,
@@ -2442,11 +2485,15 @@ static int mv643xx_eth_stop(struct net_device *dev)
 static int mv643xx_eth_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
        struct mv643xx_eth_private *mp = netdev_priv(dev);
+        int ret;
-        if (mp->phy != NULL)
+        if (mp->phy == NULL)
-                return phy_mii_ioctl(mp->phy, ifr, cmd);
+                return -ENOTSUPP;
-        return -EOPNOTSUPP;
+        ret = phy_mii_ioctl(mp->phy, ifr, cmd);
+        if (!ret)
+                mv643xx_adjust_pscr(mp);
+        return ret;
 }
 static int mv643xx_eth_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index 7e64033d7de3..0706623cfb96 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -226,7 +226,7 @@ void __mlx4_cq_free_icm(struct mlx4_dev *dev, int cqn)
 static void mlx4_cq_free_icm(struct mlx4_dev *dev, int cqn)
 {
-        u64 in_param;
+        u64 in_param = 0;
        int err;
        if (mlx4_is_mfunc(dev)) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index bb4d8d99f36d..995d4b6d5c1e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -565,34 +565,38 @@ static void mlx4_en_put_qp(struct mlx4_en_priv *priv)
        struct mlx4_en_dev *mdev = priv->mdev;
        struct mlx4_dev *dev = mdev->dev;
        int qpn = priv->base_qpn;
-        u64 mac = mlx4_en_mac_to_u64(priv->dev->dev_addr);
+        u64 mac;
-        en_dbg(DRV, priv, "Registering MAC: %pM for deleting\n",
-               priv->dev->dev_addr);
-        mlx4_unregister_mac(dev, priv->port, mac);
-        if (dev->caps.steering_mode != MLX4_STEERING_MODE_A0) {
+        if (dev->caps.steering_mode == MLX4_STEERING_MODE_A0) {
+                mac = mlx4_en_mac_to_u64(priv->dev->dev_addr);
+                en_dbg(DRV, priv, "Registering MAC: %pM for deleting\n",
+                       priv->dev->dev_addr);
+                mlx4_unregister_mac(dev, priv->port, mac);
+        } else {
                struct mlx4_mac_entry *entry;
                struct hlist_node *tmp;
                struct hlist_head *bucket;
-                unsigned int mac_hash;
+                unsigned int i;
-                mac_hash = priv->dev->dev_addr[MLX4_EN_MAC_HASH_IDX];
+                for (i = 0; i < MLX4_EN_MAC_HASH_SIZE; ++i) {
-                bucket = &priv->mac_hash[mac_hash];
+                        bucket = &priv->mac_hash[i];
-                hlist_for_each_entry_safe(entry, tmp, bucket, hlist) {
+                        hlist_for_each_entry_safe(entry, tmp, bucket, hlist) {
-                        if (ether_addr_equal_64bits(entry->mac,
+                                mac = mlx4_en_mac_to_u64(entry->mac);
-                                                    priv->dev->dev_addr)) {
+                                en_dbg(DRV, priv, "Registering MAC: %pM for deleting\n",
-                                en_dbg(DRV, priv, "Releasing qp: port %d, MAC %pM, qpn %d\n",
+                                       entry->mac);
-                                       priv->port, priv->dev->dev_addr, qpn);
                                mlx4_en_uc_steer_release(priv, entry->mac,
                                                         qpn, entry->reg_id);
-                                mlx4_qp_release_range(dev, qpn, 1);
+                                mlx4_unregister_mac(dev, priv->port, mac);
                                hlist_del_rcu(&entry->hlist);
                                kfree_rcu(entry, rcu);
-                                break;
                        }
                }
+                en_dbg(DRV, priv, "Releasing qp: port %d, qpn %d\n",
+                       priv->port, qpn);
+                mlx4_qp_release_range(dev, qpn, 1);
+                priv->flags &= ~MLX4_EN_FLAG_FORCE_PROMISC;
        }
 }
@@ -650,28 +654,10 @@ u64 mlx4_en_mac_to_u64(u8 *addr)
        return mac;
 }
-static int mlx4_en_set_mac(struct net_device *dev, void *addr)
+static int mlx4_en_do_set_mac(struct mlx4_en_priv *priv)
-{
-        struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_dev *mdev = priv->mdev;
-        struct sockaddr *saddr = addr;
-        if (!is_valid_ether_addr(saddr->sa_data))
-                return -EADDRNOTAVAIL;
-        memcpy(dev->dev_addr, saddr->sa_data, ETH_ALEN);
-        queue_work(mdev->workqueue, &priv->mac_task);
-        return 0;
-}
-static void mlx4_en_do_set_mac(struct work_struct *work)
 {
-        struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
-                                                 mac_task);
-        struct mlx4_en_dev *mdev = priv->mdev;
        int err = 0;
-        mutex_lock(&mdev->state_lock);
        if (priv->port_up) {
                /* Remove old MAC and insert the new one */
                err = mlx4_en_replace_mac(priv, priv->base_qpn,
@@ -683,7 +669,26 @@ static void mlx4_en_do_set_mac(struct work_struct *work)
        } else
                en_dbg(HW, priv, "Port is down while registering mac, exiting...\n");
+        return err;
+}
+static int mlx4_en_set_mac(struct net_device *dev, void *addr)
+{
+        struct mlx4_en_priv *priv = netdev_priv(dev);
+        struct mlx4_en_dev *mdev = priv->mdev;
+        struct sockaddr *saddr = addr;
+        int err;
+        if (!is_valid_ether_addr(saddr->sa_data))
+                return -EADDRNOTAVAIL;
+        memcpy(dev->dev_addr, saddr->sa_data, ETH_ALEN);
+        mutex_lock(&mdev->state_lock);
+        err = mlx4_en_do_set_mac(priv);
        mutex_unlock(&mdev->state_lock);
+        return err;
 }
 static void mlx4_en_clear_list(struct net_device *dev)
@@ -1348,7 +1353,7 @@ static void mlx4_en_do_get_stats(struct work_struct *work)
                queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
        }
        if (mdev->mac_removed[MLX4_MAX_PORTS + 1 - priv->port]) {
-                queue_work(mdev->workqueue, &priv->mac_task);
+                mlx4_en_do_set_mac(priv);
                mdev->mac_removed[MLX4_MAX_PORTS + 1 - priv->port] = 0;
        }
        mutex_unlock(&mdev->state_lock);
@@ -1828,9 +1833,11 @@ int mlx4_en_alloc_resources(struct mlx4_en_priv *priv)
        }
 #ifdef CONFIG_RFS_ACCEL
-        priv->dev->rx_cpu_rmap = alloc_irq_cpu_rmap(priv->mdev->dev->caps.comp_pool);
+        if (priv->mdev->dev->caps.comp_pool) {
-        if (!priv->dev->rx_cpu_rmap)
+                priv->dev->rx_cpu_rmap = alloc_irq_cpu_rmap(priv->mdev->dev->caps.comp_pool);
-                goto err;
+                if (!priv->dev->rx_cpu_rmap)
+                        goto err;
+        }
 #endif
        return 0;
@@ -2078,7 +2085,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
        priv->msg_enable = MLX4_EN_MSG_LEVEL;
        spin_lock_init(&priv->stats_lock);
        INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
-        INIT_WORK(&priv->mac_task, mlx4_en_do_set_mac);
        INIT_WORK(&priv->watchdog_task, mlx4_en_restart);
        INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
        INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 50917eb3013e..f6245579962d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -787,6 +787,14 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
        bmme_flags &= ~MLX4_BMME_FLAG_TYPE_2_WIN;
        MLX4_PUT(outbox->buf, bmme_flags, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
+        /* turn off device-managed steering capability if not enabled */
+        if (dev->caps.steering_mode != MLX4_STEERING_MODE_DEVICE_MANAGED) {
+                MLX4_GET(field, outbox->buf,
+                         QUERY_DEV_CAP_FLOW_STEERING_RANGE_EN_OFFSET);
+                field &= 0x7f;
+                MLX4_PUT(outbox->buf, field,
+                         QUERY_DEV_CAP_FLOW_STEERING_RANGE_EN_OFFSET);
+        }
        return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index d180bc46826a..16abde20e1fc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1555,7 +1555,7 @@ void __mlx4_counter_free(struct mlx4_dev *dev, u32 idx)
 void mlx4_counter_free(struct mlx4_dev *dev, u32 idx)
 {
-        u64 in_param;
+        u64 in_param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&in_param, idx);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index cf883345af88..d738454116a0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -1235,7 +1235,7 @@ int mlx4_get_qp_per_mgm(struct mlx4_dev *dev);
 static inline void set_param_l(u64 *arg, u32 val)
 {
-        *((u32 *)arg) = val;
+        *arg = (*arg & 0xffffffff00000000ULL) | (u64) val;
 }
 static inline void set_param_h(u64 *arg, u32 val)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index c313d7e943a9..f710b7ce0dcb 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -509,7 +509,6 @@ struct mlx4_en_priv {
        struct mlx4_en_cq rx_cq[MAX_RX_RINGS];
        struct mlx4_qp drop_qp;
        struct work_struct rx_mode_task;
-        struct work_struct mac_task;
        struct work_struct watchdog_task;
        struct work_struct linkstate_task;
        struct delayed_work stats_task;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 602ca9bf78e4..f91719a08cba 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -183,7 +183,7 @@ u32 __mlx4_alloc_mtt_range(struct mlx4_dev *dev, int order)
 static u32 mlx4_alloc_mtt_range(struct mlx4_dev *dev, int order)
 {
-        u64 in_param;
+        u64 in_param = 0;
        u64 out_param;
        int err;
@@ -240,7 +240,7 @@ void __mlx4_free_mtt_range(struct mlx4_dev *dev, u32 offset, int order)
 static void mlx4_free_mtt_range(struct mlx4_dev *dev, u32 offset, int order)
 {
-        u64 in_param;
+        u64 in_param = 0;
        int err;
        if (mlx4_is_mfunc(dev)) {
@@ -351,7 +351,7 @@ void __mlx4_mpt_release(struct mlx4_dev *dev, u32 index)
 static void mlx4_mpt_release(struct mlx4_dev *dev, u32 index)
 {
-        u64 in_param;
+        u64 in_param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&in_param, index);
@@ -374,7 +374,7 @@ int __mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index)
 static int mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index)
 {
-        u64 param;
+        u64 param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&param, index);
@@ -395,7 +395,7 @@ void __mlx4_mpt_free_icm(struct mlx4_dev *dev, u32 index)
 static void mlx4_mpt_free_icm(struct mlx4_dev *dev, u32 index)
 {
-        u64 in_param;
+        u64 in_param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&in_param, index);
diff --git a/drivers/net/ethernet/mellanox/mlx4/pd.c b/drivers/net/ethernet/mellanox/mlx4/pd.c
index 1ac88637ad9d..00f223acada7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/pd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/pd.c
@@ -101,7 +101,7 @@ void __mlx4_xrcd_free(struct mlx4_dev *dev, u32 xrcdn)
 void mlx4_xrcd_free(struct mlx4_dev *dev, u32 xrcdn)
 {
-        u64 in_param;
+        u64 in_param = 0;
        int err;
        if (mlx4_is_mfunc(dev)) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 719ead15e491..10c57c86388b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -175,7 +175,7 @@ EXPORT_SYMBOL_GPL(__mlx4_register_mac);
 int mlx4_register_mac(struct mlx4_dev *dev, u8 port, u64 mac)
 {
-        u64 out_param;
+        u64 out_param = 0;
        int err;
        if (mlx4_is_mfunc(dev)) {
@@ -222,7 +222,7 @@ EXPORT_SYMBOL_GPL(__mlx4_unregister_mac);
 void mlx4_unregister_mac(struct mlx4_dev *dev, u8 port, u64 mac)
 {
-        u64 out_param;
+        u64 out_param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&out_param, port);
@@ -361,7 +361,7 @@ out:
 int mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index)
 {
-        u64 out_param;
+        u64 out_param = 0;
        int err;
        if (mlx4_is_mfunc(dev)) {
@@ -406,7 +406,7 @@ out:
 void mlx4_unregister_vlan(struct mlx4_dev *dev, u8 port, int index)
 {
-        u64 in_param;
+        u64 in_param = 0;
        int err;
        if (mlx4_is_mfunc(dev)) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 81e2abe07bbb..e891b058c1be 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -222,7 +222,7 @@ int __mlx4_qp_reserve_range(struct mlx4_dev *dev, int cnt, int align,
 int mlx4_qp_reserve_range(struct mlx4_dev *dev, int cnt, int align, int *base)
 {
-        u64 in_param;
+        u64 in_param = 0;
        u64 out_param;
        int err;
@@ -255,7 +255,7 @@ void __mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt)
 void mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt)
 {
-        u64 in_param;
+        u64 in_param = 0;
        int err;
        if (mlx4_is_mfunc(dev)) {
@@ -319,7 +319,7 @@ err_out:
 static int mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn)
 {
-        u64 param;
+        u64 param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&param, qpn);
@@ -344,7 +344,7 @@ void __mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
 static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
 {
-        u64 in_param;
+        u64 in_param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&in_param, qpn);
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 083fb48dc3d7..2995687f1aee 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2990,6 +2990,9 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
        u8 steer_type_mask = 2;
        enum mlx4_steer_type type = (gid[7] & steer_type_mask) >> 1;
+        if (dev->caps.steering_mode != MLX4_STEERING_MODE_B0)
+                return -EINVAL;
        qpn = vhcr->in_modifier & 0xffffff;
        err = get_res(dev, slave, qpn, RES_QP, &rqp);
        if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx4/srq.c b/drivers/net/ethernet/mellanox/mlx4/srq.c
index feda6c00829f..e329fe1f11b7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/srq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/srq.c
@@ -149,7 +149,7 @@ void __mlx4_srq_free_icm(struct mlx4_dev *dev, int srqn)
 static void mlx4_srq_free_icm(struct mlx4_dev *dev, int srqn)
 {
-        u64 in_param;
+        u64 in_param = 0;
        if (mlx4_is_mfunc(dev)) {
                set_param_l(&in_param, srqn);
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index 50247dfe8f57..d2f790df6dcb 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -171,9 +171,9 @@ static inline void efx_device_detach_sync(struct efx_nic *efx)
         * TX scheduler is stopped when we're done and before
         * netif_device_present() becomes false.
         */
-        netif_tx_lock(dev);
+        netif_tx_lock_bh(dev);
        netif_device_detach(dev);
-        netif_tx_unlock(dev);
+        netif_tx_unlock_bh(dev);
 }
 #endif /* EFX_EFX_H */
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index 0ad790cc473c..eaa8e874a3cb 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -376,7 +376,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)
                return false;
        tx_queue->empty_read_count = 0;
-        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
+        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
+                && tx_queue->write_count - write_count == 1;
 }
 /* For each entry inserted into the software descriptor ring, create a
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 879ff5849bbd..bb579a6128c8 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -215,7 +215,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                rx_buf = efx_rx_buffer(rx_queue, index);
                rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
                rx_buf->u.page = page;
-                rx_buf->page_offset = page_offset;
+                rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN;
                rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
                rx_buf->flags = EFX_RX_BUF_PAGE;
                ++rx_queue->added_count;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 01ffbc486982..75c48558e6fd 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -905,7 +905,7 @@ static netdev_tx_t cpsw_ndo_start_xmit(struct sk_buff *skb,
        /* If there is no more tx desc left free then we need to
         * tell the kernel to stop sending us tx frames.
         */
-        if (unlikely(cpdma_check_free_tx_desc(priv->txch)))
+        if (unlikely(!cpdma_check_free_tx_desc(priv->txch)))
                netif_stop_queue(ndev);
        return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 52c05366599a..ae1b77aa199f 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1102,7 +1102,7 @@ static int emac_dev_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* If there is no more tx desc left free then we need to
         * tell the kernel to stop sending us tx frames.
         */
-        if (unlikely(cpdma_check_free_tx_desc(priv->txchan)))
+        if (unlikely(!cpdma_check_free_tx_desc(priv->txchan)))
                netif_stop_queue(ndev);
        return NETDEV_TX_OK;
diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index e5b19b056909..3c4d6274bb9b 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -202,6 +202,9 @@ static int rr_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        return 0;
 out:
+        if (rrpriv->evt_ring)
+                pci_free_consistent(pdev, EVT_RING_SIZE, rrpriv->evt_ring,
+                                    rrpriv->evt_ring_dma);
        if (rrpriv->rx_ring)
                pci_free_consistent(pdev, RX_TOTAL_SIZE, rrpriv->rx_ring,
                                    rrpriv->rx_ring_dma);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 417b2af1aa80..73abbc1655d5 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -660,6 +660,7 @@ void macvlan_common_setup(struct net_device *dev)
        ether_setup(dev);
        dev->priv_flags        &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+        dev->priv_flags        |= IFF_UNICAST_FLT;
        dev->netdev_ops         = &macvlan_netdev_ops;
        dev->destructor         = free_netdev;
        dev->header_ops         = &macvlan_hard_header_ops,
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 37add21a3d7d..59ac143dec25 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -666,6 +666,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
                goto done;
        spin_lock_irqsave(&target_list_lock, flags);
+restart:
        list_for_each_entry(nt, &target_list, list) {
                netconsole_target_get(nt);
                if (nt->np.dev == dev) {
@@ -678,15 +679,17 @@ static int netconsole_netdev_event(struct notifier_block *this,
                        case NETDEV_UNREGISTER:
                                /*
                                 * rtnl_lock already held
+                                 * we might sleep in __netpoll_cleanup()
                                 */
-                                if (nt->np.dev) {
+                                spin_unlock_irqrestore(&target_list_lock, flags);
-                                        __netpoll_cleanup(&nt->np);
+                                __netpoll_cleanup(&nt->np);
-                                        dev_put(nt->np.dev);
+                                spin_lock_irqsave(&target_list_lock, flags);
-                                        nt->np.dev = NULL;
+                                dev_put(nt->np.dev);
-                                }
+                                nt->np.dev = NULL;
                                nt->enabled = 0;
                                stopped = true;
-                                break;
+                                netconsole_target_put(nt);
+                                goto restart;
                        }
                }
                netconsole_target_put(nt);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 05c5efe84591..bf3419297875 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1138,6 +1138,8 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
        netdev_upper_dev_unlink(port_dev, dev);
        team_port_disable_netpoll(port);
        vlan_vids_del_by_dev(port_dev, dev);
+        dev_uc_unsync(port_dev, dev);
+        dev_mc_unsync(port_dev, dev);
        dev_close(port_dev);
        team_port_leave(team, port);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 2c6a22e278ea..b7c457adc0dc 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -747,6 +747,8 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
                goto drop;
        skb_orphan(skb);
+        nf_reset(skb);
        /* Enqueue packet */
        skb_queue_tail(&tfile->socket.sk->sk_receive_queue, skb);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 3b6e9b83342d..7c769d8e25ad 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -268,7 +268,7 @@ config USB_NET_SMSC75XX
        select CRC16
        select CRC32
        help
-          This option adds support for SMSC LAN95XX based USB 2.0
+          This option adds support for SMSC LAN75XX based USB 2.0
          Gigabit Ethernet adapters.
 config USB_NET_SMSC95XX
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 248d2dc765a5..16c842997291 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -68,18 +68,9 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
        struct cdc_ncm_ctx *ctx;
        struct usb_driver *subdriver = ERR_PTR(-ENODEV);
        int ret = -ENODEV;
-        u8 data_altsetting = CDC_NCM_DATA_ALTSETTING_NCM;
+        u8 data_altsetting = cdc_ncm_select_altsetting(dev, intf);
        struct cdc_mbim_state *info = (void *)&dev->data;
-        /* see if interface supports MBIM alternate setting */
-        if (intf->num_altsetting == 2) {
-                if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
-                        usb_set_interface(dev->udev,
-                                          intf->cur_altsetting->desc.bInterfaceNumber,
-                                          CDC_NCM_COMM_ALTSETTING_MBIM);
-                data_altsetting = CDC_NCM_DATA_ALTSETTING_MBIM;
-        }
        /* Probably NCM, defer for cdc_ncm_bind */
        if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
                goto err;
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 61b74a2b89ac..4709fa3497cf 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -55,6 +55,14 @@
 #define DRIVER_VERSION                          "14-Mar-2012"
+#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
+static bool prefer_mbim = true;
+#else
+static bool prefer_mbim;
+#endif
+module_param(prefer_mbim, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(prefer_mbim, "Prefer MBIM setting on dual NCM/MBIM functions");
 static void cdc_ncm_txpath_bh(unsigned long param);
 static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx);
 static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *hr_timer);
@@ -550,9 +558,12 @@ void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
 }
 EXPORT_SYMBOL_GPL(cdc_ncm_unbind);
-static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+/* Select the MBIM altsetting iff it is preferred and available,
+ * returning the number of the corresponding data interface altsetting
+ */
+u8 cdc_ncm_select_altsetting(struct usbnet *dev, struct usb_interface *intf)
 {
-        int ret;
+        struct usb_host_interface *alt;
        /* The MBIM spec defines a NCM compatible default altsetting,
         * which we may have matched:
@@ -568,23 +579,27 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
         *   endpoint descriptors, shall be constructed according to
         *   the rules given in section 6 (USB Device Model) of this
         *   specification."
-         *
-         * Do not bind to such interfaces, allowing cdc_mbim to handle
-         * them
         */
-#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
+        if (prefer_mbim && intf->num_altsetting == 2) {
-        if ((intf->num_altsetting == 2) &&
+                alt = usb_altnum_to_altsetting(intf, CDC_NCM_COMM_ALTSETTING_MBIM);
-            !usb_set_interface(dev->udev,
+                if (alt && cdc_ncm_comm_intf_is_mbim(alt) &&
-                               intf->cur_altsetting->desc.bInterfaceNumber,
+                    !usb_set_interface(dev->udev,
-                               CDC_NCM_COMM_ALTSETTING_MBIM)) {
+                                       intf->cur_altsetting->desc.bInterfaceNumber,
-                if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
+                                       CDC_NCM_COMM_ALTSETTING_MBIM))
-                        return -ENODEV;
+                        return CDC_NCM_DATA_ALTSETTING_MBIM;
-                else
-                        usb_set_interface(dev->udev,
-                                          intf->cur_altsetting->desc.bInterfaceNumber,
-                                          CDC_NCM_COMM_ALTSETTING_NCM);
        }
-#endif
+        return CDC_NCM_DATA_ALTSETTING_NCM;
+}
+EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
+static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int ret;
+        /* MBIM backwards compatible function? */
+        cdc_ncm_select_altsetting(dev, intf);
+        if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
+                return -ENODEV;
        /* NCM data altsetting is always 1 */
        ret = cdc_ncm_bind_common(dev, intf, 1);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index efb5c7c33a28..968d5d50751d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -139,16 +139,9 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
        BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data) < sizeof(struct qmi_wwan_state)));
-        /* control and data is shared? */
+        /* set up initial state */
-        if (intf->cur_altsetting->desc.bNumEndpoints == 3) {
+        info->control = intf;
-                info->control = intf;
+        info->data = intf;
-                info->data = intf;
-                goto shared;
-        }
-        /* else require a single interrupt status endpoint on control intf */
-        if (intf->cur_altsetting->desc.bNumEndpoints != 1)
-                goto err;
        /* and a number of CDC descriptors */
        while (len > 3) {
@@ -207,25 +200,14 @@ next_desc:
                buf += h->bLength;
        }
-        /* did we find all the required ones? */
+        /* Use separate control and data interfaces if we found a CDC Union */
-        if (!(found & (1 << USB_CDC_HEADER_TYPE)) ||
+        if (cdc_union) {
-            !(found & (1 << USB_CDC_UNION_TYPE))) {
+                info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-                dev_err(&intf->dev, "CDC functional descriptors missing\n");
+                if (desc->bInterfaceNumber != cdc_union->bMasterInterface0 || !info->data) {
-                goto err;
+                        dev_err(&intf->dev, "bogus CDC Union: master=%u, slave=%u\n",
-        }
+                                cdc_union->bMasterInterface0, cdc_union->bSlaveInterface0);
+                        goto err;
-        /* verify CDC Union */
+                }
-        if (desc->bInterfaceNumber != cdc_union->bMasterInterface0) {
-                dev_err(&intf->dev, "bogus CDC Union: master=%u\n", cdc_union->bMasterInterface0);
-                goto err;
-        }
-        /* need to save these for unbind */
-        info->control = intf;
-        info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-        if (!info->data) {
-                dev_err(&intf->dev, "bogus CDC Union: slave=%u\n", cdc_union->bSlaveInterface0);
-                goto err;
        }
        /* errors aren't fatal - we can live with the dynamic address */
@@ -235,11 +217,12 @@ next_desc:
        }
        /* claim data interface and set it up */
-        status = usb_driver_claim_interface(driver, info->data, dev);
+        if (info->control != info->data) {
-        if (status < 0)
+                status = usb_driver_claim_interface(driver, info->data, dev);
-                goto err;
+                if (status < 0)
+                        goto err;
+        }
-shared:
        status = qmi_wwan_register_subdriver(dev);
        if (status < 0 && info->control != info->data) {
                usb_set_intfdata(info->data, NULL);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 4aad350e4dae..eae7a03d4f9b 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2958,6 +2958,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
        adapter->num_rx_queues = num_rx_queues;
        adapter->num_tx_queues = num_tx_queues;
+        adapter->rx_buf_per_pkt = 1;
        size = sizeof(struct Vmxnet3_TxQueueDesc) * adapter->num_tx_queues;
        size += sizeof(struct Vmxnet3_RxQueueDesc) * adapter->num_rx_queues;
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index a0feb17a0238..63a124340cbe 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -472,6 +472,12 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                                                VMXNET3_RX_RING_MAX_SIZE)
                return -EINVAL;
+        /* if adapter not yet initialized, do nothing */
+        if (adapter->rx_buf_per_pkt == 0) {
+                netdev_err(netdev, "adapter not completely initialized, "
+                           "ring size cannot be changed yet\n");
+                return -EOPNOTSUPP;
+        }
        /* round it up to a multiple of VMXNET3_RING_SIZE_ALIGN */
        new_tx_ring_size = (param->tx_pending + VMXNET3_RING_SIZE_MASK) &
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 3198384689d9..35418146fa17 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
 * Version numbers
 */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.30.0-k"
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011E00
 #if defined(CONFIG_PCI_MSI)
        /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f10e58ac9c1b..7cee7a3068ec 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -961,6 +961,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
        iph->ttl        = ttl ? : ip4_dst_hoplimit(&rt->dst);
        tunnel_ip_select_ident(skb, old_iph, &rt->dst);
+        nf_reset(skb);
        vxlan_set_owner(dev, skb);
        /* See iptunnel_xmit() */
@@ -1504,6 +1506,14 @@ static __net_init int vxlan_init_net(struct net *net)
 static __net_exit void vxlan_exit_net(struct net *net)
 {
        struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+        struct vxlan_dev *vxlan;
+        unsigned h;
+        rtnl_lock();
+        for (h = 0; h < VNI_HASH_SIZE; ++h)
+                hlist_for_each_entry(vxlan, &vn->vni_list[h], hlist)
+                        dev_close(vxlan->dev);
+        rtnl_unlock();
        if (vn->sock) {
                sk_release_kernel(vn->sock->sk);
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index 94ef33838bc6..b775769f8322 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -151,7 +151,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                       sta_id, sta->sta.addr, flags & CMD_ASYNC ?  "a" : "");
        if (!(flags & CMD_ASYNC)) {
-                cmd.flags |= CMD_WANT_SKB | CMD_WANT_HCMD;
+                cmd.flags |= CMD_WANT_SKB;
                might_sleep();
        }
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 10f01793d7a6..81aa91fab5aa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -363,7 +363,7 @@ TRACE_EVENT(iwlwifi_dev_hcmd,
                __entry->flags = cmd->flags;
                memcpy(__get_dynamic_array(hcmd), hdr, sizeof(*hdr));
-                for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+                for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
                        if (!cmd->len[i])
                                continue;
                        memcpy((u8 *)__get_dynamic_array(hcmd) + offset,
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 6f228bb2b844..fbfd2d137117 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1102,7 +1102,6 @@ void iwl_drv_stop(struct iwl_drv *drv)
 /* shared module parameters */
 struct iwl_mod_params iwlwifi_mod_params = {
-        .amsdu_size_8K = 1,
        .restart_fw = 1,
        .plcp_check = true,
        .bt_coex_active = true,
@@ -1207,7 +1206,7 @@ MODULE_PARM_DESC(11n_disable,
        "disable 11n functionality, bitmap: 1: full, 2: agg TX, 4: agg RX");
 module_param_named(amsdu_size_8K, iwlwifi_mod_params.amsdu_size_8K,
                   int, S_IRUGO);
-MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
+MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0)");
 module_param_named(fw_restart, iwlwifi_mod_params.restart_fw, int, S_IRUGO);
 MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index e5e3a79eae2f..2c2a729092f5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -91,7 +91,7 @@ enum iwl_power_level {
 * @sw_crypto: using hardware encryption, default = 0
 * @disable_11n: disable 11n capabilities, default = 0,
 *      use IWL_DISABLE_HT_* constants
- * @amsdu_size_8K: enable 8K amsdu size, default = 1
+ * @amsdu_size_8K: enable 8K amsdu size, default = 0
 * @restart_fw: restart firmware, default = 1
 * @plcp_check: enable plcp health check, default = true
 * @wd_disable: enable stuck queue check, default = 0
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 8c7bec6b9a0b..0cac2b7af78b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -186,19 +186,13 @@ struct iwl_rx_packet {
 * @CMD_ASYNC: Return right away and don't want for the response
 * @CMD_WANT_SKB: valid only with CMD_SYNC. The caller needs the buffer of the
 *      response. The caller needs to call iwl_free_resp when done.
- * @CMD_WANT_HCMD: The caller needs to get the HCMD that was sent in the
- *      response handler. Chunks flagged by %IWL_HCMD_DFL_NOCOPY won't be
- *      copied. The pointer passed to the response handler is in the transport
- *      ownership and don't need to be freed by the op_mode. This also means
- *      that the pointer is invalidated after the op_mode's handler returns.
 * @CMD_ON_DEMAND: This command is sent by the test mode pipe.
 */
 enum CMD_MODE {
        CMD_SYNC                = 0,
        CMD_ASYNC               = BIT(0),
        CMD_WANT_SKB            = BIT(1),
-        CMD_WANT_HCMD           = BIT(2),
+        CMD_ON_DEMAND           = BIT(2),
-        CMD_ON_DEMAND           = BIT(3),
 };
 #define DEF_CMD_PAYLOAD_SIZE 320
@@ -217,7 +211,11 @@ struct iwl_device_cmd {
 #define TFD_MAX_PAYLOAD_SIZE (sizeof(struct iwl_device_cmd))
-#define IWL_MAX_CMD_TFDS        2
+/*
+ * number of transfer buffers (fragments) per transmit frame descriptor;
+ * this is just the driver's idea, the hardware supports 20
+ */
+#define IWL_MAX_CMD_TBS_PER_TFD 2
 /**
 * struct iwl_hcmd_dataflag - flag for each one of the chunks of the command
@@ -254,15 +252,15 @@ enum iwl_hcmd_dataflag {
 * @id: id of the host command
 */
 struct iwl_host_cmd {
-        const void *data[IWL_MAX_CMD_TFDS];
+        const void *data[IWL_MAX_CMD_TBS_PER_TFD];
        struct iwl_rx_packet *resp_pkt;
        unsigned long _rx_page_addr;
        u32 _rx_page_order;
        int handler_status;
        u32 flags;
-        u16 len[IWL_MAX_CMD_TFDS];
+        u16 len[IWL_MAX_CMD_TBS_PER_TFD];
-        u8 dataflags[IWL_MAX_CMD_TFDS];
+        u8 dataflags[IWL_MAX_CMD_TBS_PER_TFD];
        u8 id;
 };
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 23eebda848b0..2adb61f103f4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -762,18 +762,20 @@ struct iwl_phy_context_cmd {
 #define IWL_RX_INFO_PHY_CNT 8
 #define IWL_RX_INFO_AGC_IDX 1
 #define IWL_RX_INFO_RSSI_AB_IDX 2
-#define IWL_RX_INFO_RSSI_C_IDX 3
+#define IWL_OFDM_AGC_A_MSK 0x0000007f
-#define IWL_OFDM_AGC_DB_MSK 0xfe00
+#define IWL_OFDM_AGC_A_POS 0
-#define IWL_OFDM_AGC_DB_POS 9
+#define IWL_OFDM_AGC_B_MSK 0x00003f80
+#define IWL_OFDM_AGC_B_POS 7
+#define IWL_OFDM_AGC_CODE_MSK 0x3fe00000
+#define IWL_OFDM_AGC_CODE_POS 20
 #define IWL_OFDM_RSSI_INBAND_A_MSK 0x00ff
-#define IWL_OFDM_RSSI_ALLBAND_A_MSK 0xff00
 #define IWL_OFDM_RSSI_A_POS 0
+#define IWL_OFDM_RSSI_ALLBAND_A_MSK 0xff00
+#define IWL_OFDM_RSSI_ALLBAND_A_POS 8
 #define IWL_OFDM_RSSI_INBAND_B_MSK 0xff0000
-#define IWL_OFDM_RSSI_ALLBAND_B_MSK 0xff000000
 #define IWL_OFDM_RSSI_B_POS 16
-#define IWL_OFDM_RSSI_INBAND_C_MSK 0x00ff
+#define IWL_OFDM_RSSI_ALLBAND_B_MSK 0xff000000
-#define IWL_OFDM_RSSI_ALLBAND_C_MSK 0xff00
+#define IWL_OFDM_RSSI_ALLBAND_B_POS 24
-#define IWL_OFDM_RSSI_C_POS 0
 /**
 * struct iwl_rx_phy_info - phy info
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index d3d959db03a9..500f818dba04 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -79,17 +79,8 @@
 #define UCODE_VALID_OK  cpu_to_le32(0x1)
 /* Default calibration values for WkP - set to INIT image w/o running */
-static const u8 wkp_calib_values_bb_filter[] = { 0xbf, 0x00, 0x5f, 0x00, 0x2f,
-                                                 0x00, 0x18, 0x00 };
-static const u8 wkp_calib_values_rx_dc[] = { 0x7f, 0x7f, 0x7f, 0x7f, 0x7f,
-                                             0x7f, 0x7f, 0x7f };
-static const u8 wkp_calib_values_tx_lo[] = { 0x00, 0x00, 0x00, 0x00 };
-static const u8 wkp_calib_values_tx_iq[] = { 0xff, 0x00, 0xff, 0x00, 0x00,
-                                             0x00 };
-static const u8 wkp_calib_values_rx_iq[] = { 0xff, 0x00, 0x00, 0x00 };
 static const u8 wkp_calib_values_rx_iq_skew[] = { 0x00, 0x00, 0x01, 0x00 };
 static const u8 wkp_calib_values_tx_iq_skew[] = { 0x01, 0x00, 0x00, 0x00 };
-static const u8 wkp_calib_values_xtal[] = { 0xd2, 0xd2 };
 struct iwl_calib_default_data {
        u16 size;
@@ -99,12 +90,7 @@ struct iwl_calib_default_data {
 #define CALIB_SIZE_N_DATA(_buf) {.size = sizeof(_buf), .data = &_buf}
 static const struct iwl_calib_default_data wkp_calib_default_data[12] = {
-        [5] = CALIB_SIZE_N_DATA(wkp_calib_values_rx_dc),
-        [6] = CALIB_SIZE_N_DATA(wkp_calib_values_bb_filter),
-        [7] = CALIB_SIZE_N_DATA(wkp_calib_values_tx_lo),
-        [8] = CALIB_SIZE_N_DATA(wkp_calib_values_tx_iq),
        [9] = CALIB_SIZE_N_DATA(wkp_calib_values_tx_iq_skew),
-        [10] = CALIB_SIZE_N_DATA(wkp_calib_values_rx_iq),
        [11] = CALIB_SIZE_N_DATA(wkp_calib_values_rx_iq_skew),
 };
@@ -241,20 +227,6 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
        return 0;
 }
-#define IWL_HW_REV_ID_RAINBOW   0x2
-#define IWL_PROJ_TYPE_LHP       0x5
-static u32 iwl_mvm_build_phy_cfg(struct iwl_mvm *mvm)
-{
-        struct iwl_nvm_data *data = mvm->nvm_data;
-        /* Temp calls to static definitions, will be changed to CSR calls */
-        u8 hw_rev_id = IWL_HW_REV_ID_RAINBOW;
-        u8 project_type = IWL_PROJ_TYPE_LHP;
-        return data->radio_cfg_dash | (data->radio_cfg_step << 2) |
-                (hw_rev_id << 4) | ((project_type & 0x7f) << 6) |
-                (data->valid_tx_ant << 16) | (data->valid_rx_ant << 20);
-}
 static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
 {
@@ -262,7 +234,7 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
        enum iwl_ucode_type ucode_type = mvm->cur_ucode;
        /* Set parameters */
-        phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_build_phy_cfg(mvm));
+        phy_cfg_cmd.phy_cfg = cpu_to_le32(mvm->fw->phy_config);
        phy_cfg_cmd.calib_control.event_trigger =
                mvm->fw->default_calib[ucode_type].event_trigger;
        phy_cfg_cmd.calib_control.flow_trigger =
@@ -275,103 +247,6 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
                                    sizeof(phy_cfg_cmd), &phy_cfg_cmd);
 }
-/* Starting with the new PHY DB implementation - New calibs are enabled */
-/* Value - 0x405e7 */
-#define IWL_CALIB_DEFAULT_FLOW_INIT     (IWL_CALIB_CFG_XTAL_IDX         |\
-                                         IWL_CALIB_CFG_TEMPERATURE_IDX  |\
-                                         IWL_CALIB_CFG_VOLTAGE_READ_IDX |\
-                                         IWL_CALIB_CFG_DC_IDX           |\
-                                         IWL_CALIB_CFG_BB_FILTER_IDX    |\
-                                         IWL_CALIB_CFG_LO_LEAKAGE_IDX   |\
-                                         IWL_CALIB_CFG_TX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_RX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_AGC_IDX)
-#define IWL_CALIB_DEFAULT_EVENT_INIT    0x0
-/* Value 0x41567 */
-#define IWL_CALIB_DEFAULT_FLOW_RUN      (IWL_CALIB_CFG_XTAL_IDX         |\
-                                         IWL_CALIB_CFG_TEMPERATURE_IDX  |\
-                                         IWL_CALIB_CFG_VOLTAGE_READ_IDX |\
-                                         IWL_CALIB_CFG_BB_FILTER_IDX    |\
-                                         IWL_CALIB_CFG_DC_IDX           |\
-                                         IWL_CALIB_CFG_TX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_RX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_SENSITIVITY_IDX  |\
-                                         IWL_CALIB_CFG_AGC_IDX)
-#define IWL_CALIB_DEFAULT_EVENT_RUN     (IWL_CALIB_CFG_XTAL_IDX         |\
-                                         IWL_CALIB_CFG_TEMPERATURE_IDX  |\
-                                         IWL_CALIB_CFG_VOLTAGE_READ_IDX |\
-                                         IWL_CALIB_CFG_TX_PWR_IDX       |\
-                                         IWL_CALIB_CFG_DC_IDX           |\
-                                         IWL_CALIB_CFG_TX_IQ_IDX        |\
-                                         IWL_CALIB_CFG_SENSITIVITY_IDX)
-/*
- * Sets the calibrations trigger values that will be sent to the FW for runtime
- * and init calibrations.
- * The ones given in the FW TLV are not correct.
- */
-static void iwl_set_default_calib_trigger(struct iwl_mvm *mvm)
-{
-        struct iwl_tlv_calib_ctrl default_calib;
-        /*
-         * WkP FW TLV calib bits are wrong, overwrite them.
-         * This defines the dynamic calibrations which are implemented in the
-         * uCode both for init(flow) calculation and event driven calibs.
-         */
-        /* Init Image */
-        default_calib.event_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_EVENT_INIT);
-        default_calib.flow_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_FLOW_INIT);
-        if (default_calib.event_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_INIT].event_trigger)
-                IWL_ERR(mvm,
-                        "Updating the event calib for INIT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_INIT].event_trigger,
-                        default_calib.event_trigger);
-        if (default_calib.flow_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_INIT].flow_trigger)
-                IWL_ERR(mvm,
-                        "Updating the flow calib for INIT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_INIT].flow_trigger,
-                        default_calib.flow_trigger);
-        memcpy((void *)&mvm->fw->default_calib[IWL_UCODE_INIT],
-               &default_calib, sizeof(struct iwl_tlv_calib_ctrl));
-        IWL_ERR(mvm,
-                "Setting uCode init calibrations event 0x%x, trigger 0x%x\n",
-                default_calib.event_trigger,
-                default_calib.flow_trigger);
-        /* Run time image */
-        default_calib.event_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_EVENT_RUN);
-        default_calib.flow_trigger = cpu_to_le32(IWL_CALIB_DEFAULT_FLOW_RUN);
-        if (default_calib.event_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_REGULAR].event_trigger)
-                IWL_ERR(mvm,
-                        "Updating the event calib for RT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_REGULAR].event_trigger,
-                        default_calib.event_trigger);
-        if (default_calib.flow_trigger !=
-            mvm->fw->default_calib[IWL_UCODE_REGULAR].flow_trigger)
-                IWL_ERR(mvm,
-                        "Updating the flow calib for RT image: 0x%x -> 0x%x\n",
-                        mvm->fw->default_calib[IWL_UCODE_REGULAR].flow_trigger,
-                        default_calib.flow_trigger);
-        memcpy((void *)&mvm->fw->default_calib[IWL_UCODE_REGULAR],
-               &default_calib, sizeof(struct iwl_tlv_calib_ctrl));
-        IWL_ERR(mvm,
-                "Setting uCode runtime calibs event 0x%x, trigger 0x%x\n",
-                default_calib.event_trigger,
-                default_calib.flow_trigger);
-}
 static int iwl_set_default_calibrations(struct iwl_mvm *mvm)
 {
        u8 cmd_raw[16]; /* holds the variable size commands */
@@ -446,8 +321,10 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
        ret = iwl_nvm_check_version(mvm->nvm_data, mvm->trans);
        WARN_ON(ret);
-        /* Override the calibrations from TLV and the const of fw */
+        /* Send TX valid antennas before triggering calibrations */
-        iwl_set_default_calib_trigger(mvm);
+        ret = iwl_send_tx_ant_cfg(mvm, mvm->nvm_data->valid_tx_ant);
+        if (ret)
+                goto error;
        /* WkP doesn't have all calibrations, need to set default values */
        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 537711b10478..bdae700c769e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -80,7 +80,8 @@
 #define IWL_INVALID_MAC80211_QUEUE      0xff
 #define IWL_MVM_MAX_ADDRESSES           2
-#define IWL_RSSI_OFFSET 44
+/* RSSI offset for WkP */
+#define IWL_RSSI_OFFSET 50
 enum iwl_mvm_tx_fifo {
        IWL_MVM_TX_FIFO_BK = 0,
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index aa59adf87db3..d0f9c1e0475e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -624,12 +624,8 @@ static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
        ieee80211_free_txskb(mvm->hw, skb);
 }
-static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
+static void iwl_mvm_nic_restart(struct iwl_mvm *mvm)
 {
-        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
-        iwl_mvm_dump_nic_error_log(mvm);
        iwl_abort_notification_waits(&mvm->notif_wait);
        /*
@@ -663,9 +659,21 @@ static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
        }
 }
+static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
+{
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+        iwl_mvm_dump_nic_error_log(mvm);
+        iwl_mvm_nic_restart(mvm);
+}
 static void iwl_mvm_cmd_queue_full(struct iwl_op_mode *op_mode)
 {
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
        WARN_ON(1);
+        iwl_mvm_nic_restart(mvm);
 }
 static const struct iwl_op_mode_ops iwl_mvm_ops = {
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 3f40ab05bbd8..b0b190d0ec23 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -131,33 +131,42 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
 static int iwl_mvm_calc_rssi(struct iwl_mvm *mvm,
                             struct iwl_rx_phy_info *phy_info)
 {
-        u32 rssi_a, rssi_b, rssi_c, max_rssi, agc_db;
+        int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm;
+        int rssi_all_band_a, rssi_all_band_b;
+        u32 agc_a, agc_b, max_agc;
        u32 val;
-        /* Find max rssi among 3 possible receivers.
+        /* Find max rssi among 2 possible receivers.
         * These values are measured by the Digital Signal Processor (DSP).
         * They should stay fairly constant even as the signal strength varies,
         * if the radio's Automatic Gain Control (AGC) is working right.
         * AGC value (see below) will provide the "interesting" info.
         */
+        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_AGC_IDX]);
+        agc_a = (val & IWL_OFDM_AGC_A_MSK) >> IWL_OFDM_AGC_A_POS;
+        agc_b = (val & IWL_OFDM_AGC_B_MSK) >> IWL_OFDM_AGC_B_POS;
+        max_agc = max_t(u32, agc_a, agc_b);
        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_RSSI_AB_IDX]);
        rssi_a = (val & IWL_OFDM_RSSI_INBAND_A_MSK) >> IWL_OFDM_RSSI_A_POS;
        rssi_b = (val & IWL_OFDM_RSSI_INBAND_B_MSK) >> IWL_OFDM_RSSI_B_POS;
-        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_RSSI_C_IDX]);
+        rssi_all_band_a = (val & IWL_OFDM_RSSI_ALLBAND_A_MSK) >>
-        rssi_c = (val & IWL_OFDM_RSSI_INBAND_C_MSK) >> IWL_OFDM_RSSI_C_POS;
+                                IWL_OFDM_RSSI_ALLBAND_A_POS;
+        rssi_all_band_b = (val & IWL_OFDM_RSSI_ALLBAND_B_MSK) >>
-        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_AGC_IDX]);
+                                IWL_OFDM_RSSI_ALLBAND_B_POS;
-        agc_db = (val & IWL_OFDM_AGC_DB_MSK) >> IWL_OFDM_AGC_DB_POS;
-        max_rssi = max_t(u32, rssi_a, rssi_b);
+        /*
-        max_rssi = max_t(u32, max_rssi, rssi_c);
+         * dBm = rssi dB - agc dB - constant.
+         * Higher AGC (higher radio gain) means lower signal.
+         */
+        rssi_a_dbm = rssi_a - IWL_RSSI_OFFSET - agc_a;
+        rssi_b_dbm = rssi_b - IWL_RSSI_OFFSET - agc_b;
+        max_rssi_dbm = max_t(int, rssi_a_dbm, rssi_b_dbm);
-        IWL_DEBUG_STATS(mvm, "Rssi In A %d B %d C %d Max %d AGC dB %d\n",
+        IWL_DEBUG_STATS(mvm, "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n",
-                        rssi_a, rssi_b, rssi_c, max_rssi, agc_db);
+                        rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b);
-        /* dBm = max_rssi dB - agc dB - constant.
+        return max_rssi_dbm;
-         * Higher AGC (higher radio gain) means lower signal. */
-        return max_rssi - agc_db - IWL_RSSI_OFFSET;
 }
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 861a7f9f8e7f..274f44e2ef60 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -770,6 +770,16 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        u16 txq_id;
        int err;
+        /*
+         * If mac80211 is cleaning its state, then say that we finished since
+         * our state has been cleared anyway.
+         */
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                return 0;
+        }
        spin_lock_bh(&mvmsta->lock);
        txq_id = tid_data->txq_id;
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 6b67ce3f679c..6645efe5c03e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -607,12 +607,8 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                /* Single frame failure in an AMPDU queue => send BAR */
                if (txq_id >= IWL_FIRST_AMPDU_QUEUE &&
-                    !(info->flags & IEEE80211_TX_STAT_ACK)) {
+                    !(info->flags & IEEE80211_TX_STAT_ACK))
-                        /* there must be only one skb in the skb_list */
-                        WARN_ON_ONCE(skb_freed > 1 ||
-                                     !skb_queue_empty(&skbs));
                        info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
-                }
                /* W/A FW bug: seq_ctl is wrong when the queue is flushed */
                if (status == TX_STATUS_FAIL_FIFO_FLUSHED) {
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 3d62e8055352..148843e7f34f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -137,10 +137,6 @@ static inline int iwl_queue_dec_wrap(int index, int n_bd)
 struct iwl_cmd_meta {
        /* only for SYNC commands, iff the reply skb is wanted */
        struct iwl_host_cmd *source;
-        DEFINE_DMA_UNMAP_ADDR(mapping);
-        DEFINE_DMA_UNMAP_LEN(len);
        u32 flags;
 };
@@ -185,25 +181,36 @@ struct iwl_queue {
 /*
 * The FH will write back to the first TB only, so we need
 * to copy some data into the buffer regardless of whether
- * it should be mapped or not. This indicates how much to
+ * it should be mapped or not. This indicates how big the
- * copy, even for HCMDs it must be big enough to fit the
+ * first TB must be to include the scratch buffer. Since
- * DRAM scratch from the TX cmd, at least 16 bytes.
+ * the scratch is 4 bytes at offset 12, it's 16 now. If we
+ * make it bigger then allocations will be bigger and copy
+ * slower, so that's probably not useful.
 */
-#define IWL_HCMD_MIN_COPY_SIZE  16
+#define IWL_HCMD_SCRATCHBUF_SIZE        16
 struct iwl_pcie_txq_entry {
        struct iwl_device_cmd *cmd;
-        struct iwl_device_cmd *copy_cmd;
        struct sk_buff *skb;
        /* buffer to free after command completes */
        const void *free_buf;
        struct iwl_cmd_meta meta;
 };
+struct iwl_pcie_txq_scratch_buf {
+        struct iwl_cmd_header hdr;
+        u8 buf[8];
+        __le32 scratch;
+};
 /**
 * struct iwl_txq - Tx Queue for DMA
 * @q: generic Rx/Tx queue descriptor
 * @tfds: transmit frame descriptors (DMA memory)
+ * @scratchbufs: start of command headers, including scratch buffers, for
+ *      the writeback -- this is DMA memory and an array holding one buffer
+ *      for each command on the queue
+ * @scratchbufs_dma: DMA address for the scratchbufs start
 * @entries: transmit entries (driver state)
 * @lock: queue lock
 * @stuck_timer: timer that fires if queue gets stuck
@@ -217,6 +224,8 @@ struct iwl_pcie_txq_entry {
 struct iwl_txq {
        struct iwl_queue q;
        struct iwl_tfd *tfds;
+        struct iwl_pcie_txq_scratch_buf *scratchbufs;
+        dma_addr_t scratchbufs_dma;
        struct iwl_pcie_txq_entry *entries;
        spinlock_t lock;
        struct timer_list stuck_timer;
@@ -225,6 +234,13 @@ struct iwl_txq {
        u8 active;
 };
+static inline dma_addr_t
+iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
+{
+        return txq->scratchbufs_dma +
+               sizeof(struct iwl_pcie_txq_scratch_buf) * idx;
+}
 /**
 * struct iwl_trans_pcie - PCIe transport specific data
 * @rxq: all the RX queue data
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index b0ae06d2456f..567e67ad1f61 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -637,22 +637,14 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                index = SEQ_TO_INDEX(sequence);
                cmd_index = get_cmd_index(&txq->q, index);
-                if (reclaim) {
+                if (reclaim)
-                        struct iwl_pcie_txq_entry *ent;
+                        cmd = txq->entries[cmd_index].cmd;
-                        ent = &txq->entries[cmd_index];
+                else
-                        cmd = ent->copy_cmd;
-                        WARN_ON_ONCE(!cmd && ent->meta.flags & CMD_WANT_HCMD);
-                } else {
                        cmd = NULL;
-                }
                err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);
                if (reclaim) {
-                        /* The original command isn't needed any more */
-                        kfree(txq->entries[cmd_index].copy_cmd);
-                        txq->entries[cmd_index].copy_cmd = NULL;
-                        /* nor is the duplicated part of the command */
                        kfree(txq->entries[cmd_index].free_buf);
                        txq->entries[cmd_index].free_buf = NULL;
                }
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8b625a7f5685..8595c16f74de 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -191,12 +191,9 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
        }
        for (i = q->read_ptr; i != q->write_ptr;
-             i = iwl_queue_inc_wrap(i, q->n_bd)) {
+             i = iwl_queue_inc_wrap(i, q->n_bd))
-                struct iwl_tx_cmd *tx_cmd =
-                        (struct iwl_tx_cmd *)txq->entries[i].cmd->payload;
                IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
-                        get_unaligned_le32(&tx_cmd->scratch));
+                        le32_to_cpu(txq->scratchbufs[i].scratch));
-        }
        iwl_op_mode_nic_error(trans->op_mode);
 }
@@ -367,8 +364,8 @@ static inline u8 iwl_pcie_tfd_get_num_tbs(struct iwl_tfd *tfd)
 }
 static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
-                               struct iwl_cmd_meta *meta, struct iwl_tfd *tfd,
+                               struct iwl_cmd_meta *meta,
-                               enum dma_data_direction dma_dir)
+                               struct iwl_tfd *tfd)
 {
        int i;
        int num_tbs;
@@ -382,17 +379,12 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
                return;
        }
-        /* Unmap tx_cmd */
+        /* first TB is never freed - it's the scratchbuf data */
-        if (num_tbs)
-                dma_unmap_single(trans->dev,
-                                dma_unmap_addr(meta, mapping),
-                                dma_unmap_len(meta, len),
-                                DMA_BIDIRECTIONAL);
-        /* Unmap chunks, if any. */
        for (i = 1; i < num_tbs; i++)
                dma_unmap_single(trans->dev, iwl_pcie_tfd_tb_get_addr(tfd, i),
-                                 iwl_pcie_tfd_tb_get_len(tfd, i), dma_dir);
+                                 iwl_pcie_tfd_tb_get_len(tfd, i),
+                                 DMA_TO_DEVICE);
        tfd->num_tbs = 0;
 }
@@ -406,8 +398,7 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
 * Does NOT advance any TFD circular buffer read/write indexes
 * Does NOT free the TFD itself (which is within circular buffer)
 */
-static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
+static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
-                                  enum dma_data_direction dma_dir)
 {
        struct iwl_tfd *tfd_tmp = txq->tfds;
@@ -418,8 +409,7 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
        lockdep_assert_held(&txq->lock);
        /* We have only q->n_window txq->entries, but we use q->n_bd tfds */
-        iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr],
+        iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr]);
-                           dma_dir);
        /* free SKB */
        if (txq->entries) {
@@ -479,6 +469,7 @@ static int iwl_pcie_txq_alloc(struct iwl_trans *trans,
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        size_t tfd_sz = sizeof(struct iwl_tfd) * TFD_QUEUE_SIZE_MAX;
+        size_t scratchbuf_sz;
        int i;
        if (WARN_ON(txq->entries || txq->tfds))
@@ -514,9 +505,25 @@ static int iwl_pcie_txq_alloc(struct iwl_trans *trans,
                IWL_ERR(trans, "dma_alloc_coherent(%zd) failed\n", tfd_sz);
                goto error;
        }
+        BUILD_BUG_ON(IWL_HCMD_SCRATCHBUF_SIZE != sizeof(*txq->scratchbufs));
+        BUILD_BUG_ON(offsetof(struct iwl_pcie_txq_scratch_buf, scratch) !=
+                        sizeof(struct iwl_cmd_header) +
+                        offsetof(struct iwl_tx_cmd, scratch));
+        scratchbuf_sz = sizeof(*txq->scratchbufs) * slots_num;
+        txq->scratchbufs = dma_alloc_coherent(trans->dev, scratchbuf_sz,
+                                              &txq->scratchbufs_dma,
+                                              GFP_KERNEL);
+        if (!txq->scratchbufs)
+                goto err_free_tfds;
        txq->q.id = txq_id;
        return 0;
+err_free_tfds:
+        dma_free_coherent(trans->dev, tfd_sz, txq->tfds, txq->q.dma_addr);
 error:
        if (txq->entries && txq_id == trans_pcie->cmd_queue)
                for (i = 0; i < slots_num; i++)
@@ -565,22 +572,13 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_txq *txq = &trans_pcie->txq[txq_id];
        struct iwl_queue *q = &txq->q;
-        enum dma_data_direction dma_dir;
        if (!q->n_bd)
                return;
-        /* In the command queue, all the TBs are mapped as BIDI
-         * so unmap them as such.
-         */
-        if (txq_id == trans_pcie->cmd_queue)
-                dma_dir = DMA_BIDIRECTIONAL;
-        else
-                dma_dir = DMA_TO_DEVICE;
        spin_lock_bh(&txq->lock);
        while (q->write_ptr != q->read_ptr) {
-                iwl_pcie_txq_free_tfd(trans, txq, dma_dir);
+                iwl_pcie_txq_free_tfd(trans, txq);
                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
        }
        spin_unlock_bh(&txq->lock);
@@ -610,7 +608,6 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
        if (txq_id == trans_pcie->cmd_queue)
                for (i = 0; i < txq->q.n_window; i++) {
                        kfree(txq->entries[i].cmd);
-                        kfree(txq->entries[i].copy_cmd);
                        kfree(txq->entries[i].free_buf);
                }
@@ -619,6 +616,10 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
                dma_free_coherent(dev, sizeof(struct iwl_tfd) *
                                  txq->q.n_bd, txq->tfds, txq->q.dma_addr);
                txq->q.dma_addr = 0;
+                dma_free_coherent(dev,
+                                  sizeof(*txq->scratchbufs) * txq->q.n_window,
+                                  txq->scratchbufs, txq->scratchbufs_dma);
        }
        kfree(txq->entries);
@@ -962,7 +963,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                iwl_pcie_txq_inval_byte_cnt_tbl(trans, txq);
-                iwl_pcie_txq_free_tfd(trans, txq, DMA_TO_DEVICE);
+                iwl_pcie_txq_free_tfd(trans, txq);
        }
        iwl_pcie_txq_progress(trans_pcie, txq);
@@ -1152,29 +1153,29 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
        void *dup_buf = NULL;
        dma_addr_t phys_addr;
        int idx;
-        u16 copy_size, cmd_size, dma_size;
+        u16 copy_size, cmd_size, scratch_size;
        bool had_nocopy = false;
        int i;
        u32 cmd_pos;
-        const u8 *cmddata[IWL_MAX_CMD_TFDS];
+        const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
-        u16 cmdlen[IWL_MAX_CMD_TFDS];
+        u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
        copy_size = sizeof(out_cmd->hdr);
        cmd_size = sizeof(out_cmd->hdr);
        /* need one for the header if the first is NOCOPY */
-        BUILD_BUG_ON(IWL_MAX_CMD_TFDS > IWL_NUM_OF_TBS - 1);
+        BUILD_BUG_ON(IWL_MAX_CMD_TBS_PER_TFD > IWL_NUM_OF_TBS - 1);
-        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+        for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
                cmddata[i] = cmd->data[i];
                cmdlen[i] = cmd->len[i];
                if (!cmd->len[i])
                        continue;
-                /* need at least IWL_HCMD_MIN_COPY_SIZE copied */
+                /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
-                if (copy_size < IWL_HCMD_MIN_COPY_SIZE) {
+                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
-                        int copy = IWL_HCMD_MIN_COPY_SIZE - copy_size;
+                        int copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
                        if (copy > cmdlen[i])
                                copy = cmdlen[i];
@@ -1260,15 +1261,15 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
        /* and copy the data that needs to be copied */
        cmd_pos = offsetof(struct iwl_device_cmd, payload);
        copy_size = sizeof(out_cmd->hdr);
-        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+        for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
                int copy = 0;
                if (!cmd->len)
                        continue;
-                /* need at least IWL_HCMD_MIN_COPY_SIZE copied */
+                /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
-                if (copy_size < IWL_HCMD_MIN_COPY_SIZE) {
+                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
-                        copy = IWL_HCMD_MIN_COPY_SIZE - copy_size;
+                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
                        if (copy > cmd->len[i])
                                copy = cmd->len[i];
@@ -1286,50 +1287,38 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                }
        }
-        WARN_ON_ONCE(txq->entries[idx].copy_cmd);
-        /*
-         * since out_cmd will be the source address of the FH, it will write
-         * the retry count there. So when the user needs to receivce the HCMD
-         * that corresponds to the response in the response handler, it needs
-         * to set CMD_WANT_HCMD.
-         */
-        if (cmd->flags & CMD_WANT_HCMD) {
-                txq->entries[idx].copy_cmd =
-                        kmemdup(out_cmd, cmd_pos, GFP_ATOMIC);
-                if (unlikely(!txq->entries[idx].copy_cmd)) {
-                        idx = -ENOMEM;
-                        goto out;
-                }
-        }
        IWL_DEBUG_HC(trans,
                     "Sending command %s (#%x), seq: 0x%04X, %d bytes at %d[%d]:%d\n",
                     get_cmd_string(trans_pcie, out_cmd->hdr.cmd),
                     out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence),
                     cmd_size, q->write_ptr, idx, trans_pcie->cmd_queue);
-        /*
+        /* start the TFD with the scratchbuf */
-         * If the entire command is smaller than IWL_HCMD_MIN_COPY_SIZE, we must
+        scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
-         * still map at least that many bytes for the hardware to write back to.
+        memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
-         * We have enough space, so that's not a problem.
+        iwl_pcie_txq_build_tfd(trans, txq,
-         */
+                               iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
-        dma_size = max_t(u16, copy_size, IWL_HCMD_MIN_COPY_SIZE);
+                               scratch_size, 1);
+        /* map first command fragment, if any remains */
+        if (copy_size > scratch_size) {
+                phys_addr = dma_map_single(trans->dev,
+                                           ((u8 *)&out_cmd->hdr) + scratch_size,
+                                           copy_size - scratch_size,
+                                           DMA_TO_DEVICE);
+                if (dma_mapping_error(trans->dev, phys_addr)) {
+                        iwl_pcie_tfd_unmap(trans, out_meta,
+                                           &txq->tfds[q->write_ptr]);
+                        idx = -ENOMEM;
+                        goto out;
+                }
-        phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, dma_size,
+                iwl_pcie_txq_build_tfd(trans, txq, phys_addr,
-                                   DMA_BIDIRECTIONAL);
+                                       copy_size - scratch_size, 0);
-        if (unlikely(dma_mapping_error(trans->dev, phys_addr))) {
-                idx = -ENOMEM;
-                goto out;
        }
-        dma_unmap_addr_set(out_meta, mapping, phys_addr);
-        dma_unmap_len_set(out_meta, len, dma_size);
-        iwl_pcie_txq_build_tfd(trans, txq, phys_addr, copy_size, 1);
        /* map the remaining (adjusted) nocopy/dup fragments */
-        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+        for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
                const void *data = cmddata[i];
                if (!cmdlen[i])
@@ -1340,11 +1329,10 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                if (cmd->dataflags[i] & IWL_HCMD_DFL_DUP)
                        data = dup_buf;
                phys_addr = dma_map_single(trans->dev, (void *)data,
-                                           cmdlen[i], DMA_BIDIRECTIONAL);
+                                           cmdlen[i], DMA_TO_DEVICE);
                if (dma_mapping_error(trans->dev, phys_addr)) {
                        iwl_pcie_tfd_unmap(trans, out_meta,
-                                           &txq->tfds[q->write_ptr],
+                                           &txq->tfds[q->write_ptr]);
-                                           DMA_BIDIRECTIONAL);
                        idx = -ENOMEM;
                        goto out;
                }
@@ -1418,7 +1406,7 @@ void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
        cmd = txq->entries[cmd_index].cmd;
        meta = &txq->entries[cmd_index].meta;
-        iwl_pcie_tfd_unmap(trans, meta, &txq->tfds[index], DMA_BIDIRECTIONAL);
+        iwl_pcie_tfd_unmap(trans, meta, &txq->tfds[index]);
        /* Input error checking is done when commands are added to queue. */
        if (meta->flags & CMD_WANT_SKB) {
@@ -1597,10 +1585,9 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
        struct iwl_cmd_meta *out_meta;
        struct iwl_txq *txq;
        struct iwl_queue *q;
-        dma_addr_t phys_addr = 0;
+        dma_addr_t tb0_phys, tb1_phys, scratch_phys;
-        dma_addr_t txcmd_phys;
+        void *tb1_addr;
-        dma_addr_t scratch_phys;
+        u16 len, tb1_len, tb2_len;
-        u16 len, firstlen, secondlen;
        u8 wait_write_ptr = 0;
        __le16 fc = hdr->frame_control;
        u8 hdr_len = ieee80211_hdrlen(fc);
@@ -1638,85 +1625,80 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
                            INDEX_TO_SEQ(q->write_ptr)));
+        tb0_phys = iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr);
+        scratch_phys = tb0_phys + sizeof(struct iwl_cmd_header) +
+                       offsetof(struct iwl_tx_cmd, scratch);
+        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
+        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
        /* Set up first empty entry in queue's array of Tx/cmd buffers */
        out_meta = &txq->entries[q->write_ptr].meta;
        /*
-         * Use the first empty entry in this queue's command buffer array
+         * The second TB (tb1) points to the remainder of the TX command
-         * to contain the Tx command and MAC header concatenated together
+         * and the 802.11 header - dword aligned size
-         * (payload data will be in another buffer).
+         * (This calculation modifies the TX command, so do it before the
-         * Size of this varies, due to varying MAC header length.
+         * setup of the first TB)
-         * If end is not dword aligned, we'll have 2 extra bytes at the end
-         * of the MAC header (device reads on dword boundaries).
-         * We'll tell device about this padding later.
         */
-        len = sizeof(struct iwl_tx_cmd) +
+        len = sizeof(struct iwl_tx_cmd) + sizeof(struct iwl_cmd_header) +
-                sizeof(struct iwl_cmd_header) + hdr_len;
+              hdr_len - IWL_HCMD_SCRATCHBUF_SIZE;
-        firstlen = (len + 3) & ~3;
+        tb1_len = (len + 3) & ~3;
        /* Tell NIC about any 2-byte padding after MAC header */
-        if (firstlen != len)
+        if (tb1_len != len)
                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
-        /* Physical address of this Tx command's header (not MAC header!),
+        /* The first TB points to the scratchbuf data - min_copy bytes */
-         * within command buffer array. */
+        memcpy(&txq->scratchbufs[q->write_ptr], &dev_cmd->hdr,
-        txcmd_phys = dma_map_single(trans->dev,
+               IWL_HCMD_SCRATCHBUF_SIZE);
-                                    &dev_cmd->hdr, firstlen,
+        iwl_pcie_txq_build_tfd(trans, txq, tb0_phys,
-                                    DMA_BIDIRECTIONAL);
+                               IWL_HCMD_SCRATCHBUF_SIZE, 1);
-        if (unlikely(dma_mapping_error(trans->dev, txcmd_phys)))
-                goto out_err;
-        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, firstlen);
-        if (!ieee80211_has_morefrags(fc)) {
+        /* there must be data left over for TB1 or this code must be changed */
-                txq->need_update = 1;
+        BUILD_BUG_ON(sizeof(struct iwl_tx_cmd) < IWL_HCMD_SCRATCHBUF_SIZE);
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-        /* Set up TFD's 2nd entry to point directly to remainder of skb,
+        /* map the data for TB1 */
-         * if any (802.11 null frames have no payload). */
+        tb1_addr = ((u8 *)&dev_cmd->hdr) + IWL_HCMD_SCRATCHBUF_SIZE;
-        secondlen = skb->len - hdr_len;
+        tb1_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
-        if (secondlen > 0) {
+        if (unlikely(dma_mapping_error(trans->dev, tb1_phys)))
-                phys_addr = dma_map_single(trans->dev, skb->data + hdr_len,
+                goto out_err;
-                                           secondlen, DMA_TO_DEVICE);
+        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, 0);
-                if (unlikely(dma_mapping_error(trans->dev, phys_addr))) {
-                        dma_unmap_single(trans->dev,
+        /*
-                                         dma_unmap_addr(out_meta, mapping),
+         * Set up TFD's third entry to point directly to remainder
-                                         dma_unmap_len(out_meta, len),
+         * of skb, if any (802.11 null frames have no payload).
-                                         DMA_BIDIRECTIONAL);
+         */
+        tb2_len = skb->len - hdr_len;
+        if (tb2_len > 0) {
+                dma_addr_t tb2_phys = dma_map_single(trans->dev,
+                                                     skb->data + hdr_len,
+                                                     tb2_len, DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(trans->dev, tb2_phys))) {
+                        iwl_pcie_tfd_unmap(trans, out_meta,
+                                           &txq->tfds[q->write_ptr]);
                        goto out_err;
                }
+                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, 0);
        }
-        /* Attach buffers to TFD */
-        iwl_pcie_txq_build_tfd(trans, txq, txcmd_phys, firstlen, 1);
-        if (secondlen > 0)
-                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, secondlen, 0);
-        scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
-                                offsetof(struct iwl_tx_cmd, scratch);
-        /* take back ownership of DMA buffer to enable update */
-        dma_sync_single_for_cpu(trans->dev, txcmd_phys, firstlen,
-                                DMA_BIDIRECTIONAL);
-        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
-        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
        /* Set up entry for this TFD in Tx byte-count array */
        iwl_pcie_txq_update_byte_cnt_tbl(trans, txq, le16_to_cpu(tx_cmd->len));
-        dma_sync_single_for_device(trans->dev, txcmd_phys, firstlen,
-                                   DMA_BIDIRECTIONAL);
        trace_iwlwifi_dev_tx(trans->dev, skb,
                             &txq->tfds[txq->q.write_ptr],
                             sizeof(struct iwl_tfd),
-                             &dev_cmd->hdr, firstlen,
+                             &dev_cmd->hdr, IWL_HCMD_SCRATCHBUF_SIZE + tb1_len,
-                             skb->data + hdr_len, secondlen);
+                             skb->data + hdr_len, tb2_len);
        trace_iwlwifi_dev_tx_data(trans->dev, skb,
-                                  skb->data + hdr_len, secondlen);
+                                  skb->data + hdr_len, tb2_len);
+        if (!ieee80211_has_morefrags(fc)) {
+                txq->need_update = 1;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
        /* start timer if queue currently empty */
        if (txq->need_update && q->read_ptr == q->write_ptr &&
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 246aa62a4817..2fe0ceba4400 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1117,10 +1117,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
                adhoc_join->bss_descriptor.bssid,
                adhoc_join->bss_descriptor.ssid);
-        for (i = 0; bss_desc->supported_rates[i] &&
+        for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
-                        i < MWIFIEX_SUPPORTED_RATES;
+                    bss_desc->supported_rates[i]; i++)
-                        i++)
+                ;
-                        ;
        rates_size = i;
        /* Copy Data Rates from the Rates recorded in scan response */
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 44d6ead43341..2bf4efa33186 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -55,10 +55,10 @@ config RT61PCI
 config RT2800PCI
        tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
-        depends on PCI || RALINK_RT288X || RALINK_RT305X
+        depends on PCI || SOC_RT288X || SOC_RT305X
        select RT2800_LIB
        select RT2X00_LIB_PCI if PCI
-        select RT2X00_LIB_SOC if RALINK_RT288X || RALINK_RT305X
+        select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
        select RT2X00_LIB_FIRMWARE
        select RT2X00_LIB_CRYPTO
        select CRC_CCITT
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 48a01aa21f1c..ded73da4de0b 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -89,7 +89,7 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 }
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
        void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
@@ -107,7 +107,7 @@ static inline int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
        return -ENOMEM;
 }
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 #ifdef CONFIG_PCI
 static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
@@ -1177,7 +1177,7 @@ MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
 #endif /* CONFIG_PCI */
 MODULE_LICENSE("GPL");
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800soc_probe(struct platform_device *pdev)
 {
        return rt2x00soc_probe(pdev, &rt2800pci_ops);
@@ -1194,7 +1194,7 @@ static struct platform_driver rt2800soc_driver = {
        .suspend        = rt2x00soc_suspend,
        .resume         = rt2x00soc_resume,
 };
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 #ifdef CONFIG_PCI
 static int rt2800pci_probe(struct pci_dev *pci_dev,
@@ -1217,7 +1217,7 @@ static int __init rt2800pci_init(void)
 {
        int ret = 0;
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
        ret = platform_driver_register(&rt2800soc_driver);
        if (ret)
                return ret;
@@ -1225,7 +1225,7 @@ static int __init rt2800pci_init(void)
 #ifdef CONFIG_PCI
        ret = pci_register_driver(&rt2800pci_driver);
        if (ret) {
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
                platform_driver_unregister(&rt2800soc_driver);
 #endif
                return ret;
@@ -1240,7 +1240,7 @@ static void __exit rt2800pci_exit(void)
 #ifdef CONFIG_PCI
        pci_unregister_driver(&rt2800pci_driver);
 #endif
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
        platform_driver_unregister(&rt2800soc_driver);
 #endif
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index b1ccff474c79..c08d0f4c5f3d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
 {
-        /* dummy routine needed for callback from rtl_op_configure_filter() */
-}
-/*========================================================================== */
-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
-                              enum nl80211_iftype type)
-{
        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
        struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
-        u8 filterout_non_associated_bssid = false;
-        switch (type) {
+        if (rtlpriv->psc.rfpwr_state != ERFON)
-        case NL80211_IFTYPE_ADHOC:
+                return;
-        case NL80211_IFTYPE_STATION:
-                filterout_non_associated_bssid = true;
+        if (check_bssid) {
-                break;
+                u8 tmp;
-        case NL80211_IFTYPE_UNSPECIFIED:
-        case NL80211_IFTYPE_AP:
-        default:
-                break;
-        }
-        if (filterout_non_associated_bssid) {
                if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        switch (rtlphy->current_io_type) {
+                        reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                        case IO_CMD_RESUME_DM_BY_SCAN:
+                        tmp = BIT(4);
-                                reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* enable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
-                                break;
-                        case IO_CMD_PAUSE_DM_BY_SCAN:
-                                reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* disable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
-                                break;
-                        }
                } else {
-                        reg_rcr |= (RCR_CBSSID);
+                        reg_rcr |= RCR_CBSSID;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                        tmp = BIT(4) | BIT(5);
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
                }
-        } else if (filterout_non_associated_bssid == false) {
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                                              (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
+        } else {
+                u8 tmp;
                if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                        reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                        tmp = BIT(4);
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
                } else {
-                        reg_rcr &= (~RCR_CBSSID);
+                        reg_rcr &= ~RCR_CBSSID;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                        tmp = BIT(4) | BIT(5);
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
                }
+                reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                              HW_VAR_RCR, (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
        }
 }
+/*========================================================================== */
 int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
 {
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
        if (_rtl92cu_set_media_status(hw, type))
                return -EOPNOTSUPP;
-        _rtl92cu_set_check_bssid(hw, type);
+        if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
+                if (type != NL80211_IFTYPE_AP)
+                        rtl92cu_set_check_bssid(hw, true);
+        } else {
+                rtl92cu_set_check_bssid(hw, false);
+        }
        return 0;
 }
@@ -2058,8 +2041,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
                               (shortgi_rate << 4) | (shortgi_rate);
        }
        rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
-        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
-                 rtl_read_dword(rtlpriv, REG_ARFR0));
 }
 void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index ab886b7ee327..b41ac7756a4b 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -100,6 +100,27 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
        return min((size_t)(image - rom), size);
 }
+static loff_t pci_find_rom(struct pci_dev *pdev, size_t *size)
+{
+        struct resource *res = &pdev->resource[PCI_ROM_RESOURCE];
+        loff_t start;
+        /* assign the ROM an address if it doesn't have one */
+        if (res->parent == NULL && pci_assign_resource(pdev, PCI_ROM_RESOURCE))
+                return 0;
+        start = pci_resource_start(pdev, PCI_ROM_RESOURCE);
+        *size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
+        if (*size == 0)
+                return 0;
+        /* Enable ROM space decodes */
+        if (pci_enable_rom(pdev))
+                return 0;
+        return start;
+}
 /**
 * pci_map_rom - map a PCI ROM to kernel space
 * @pdev: pointer to pci device struct
@@ -114,21 +135,15 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
 void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
 {
        struct resource *res = &pdev->resource[PCI_ROM_RESOURCE];
-        loff_t start;
+        loff_t start = 0;
        void __iomem *rom;
        /*
-         * Some devices may provide ROMs via a source other than the BAR
-         */
-        if (pdev->rom && pdev->romlen) {
-                *size = pdev->romlen;
-                return phys_to_virt(pdev->rom);
-        /*
         * IORESOURCE_ROM_SHADOW set on x86, x86_64 and IA64 supports legacy
         * memory map if the VGA enable bit of the Bridge Control register is
         * set for embedded VGA.
         */
-        } else if (res->flags & IORESOURCE_ROM_SHADOW) {
+        if (res->flags & IORESOURCE_ROM_SHADOW) {
                /* primary video rom always starts here */
                start = (loff_t)0xC0000;
                *size = 0x20000; /* cover C000:0 through E000:0 */
@@ -139,21 +154,21 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
                        return (void __iomem *)(unsigned long)
                                pci_resource_start(pdev, PCI_ROM_RESOURCE);
                } else {
-                        /* assign the ROM an address if it doesn't have one */
+                        start = pci_find_rom(pdev, size);
-                        if (res->parent == NULL &&
-                            pci_assign_resource(pdev,PCI_ROM_RESOURCE))
-                                return NULL;
-                        start = pci_resource_start(pdev, PCI_ROM_RESOURCE);
-                        *size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
-                        if (*size == 0)
-                                return NULL;
-                        /* Enable ROM space decodes */
-                        if (pci_enable_rom(pdev))
-                                return NULL;
                }
        }
+        /*
+         * Some devices may provide ROMs via a source other than the BAR
+         */
+        if (!start && pdev->rom && pdev->romlen) {
+                *size = pdev->romlen;
+                return phys_to_virt(pdev->rom);
+        }
+        if (!start)
+                return NULL;
        rom = ioremap(start, *size);
        if (!rom) {
                /* restore enable if ioremap fails */
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index 75933a6aa828..efb7f10e902a 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1277,21 +1277,80 @@ static int alt_gpio_irq_type(struct irq_data *d, unsigned type)
 }
 #ifdef CONFIG_PM
+static u32 wakeups[MAX_GPIO_BANKS];
+static u32 backups[MAX_GPIO_BANKS];
 static int gpio_irq_set_wake(struct irq_data *d, unsigned state)
 {
        struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
        unsigned        bank = at91_gpio->pioc_idx;
+        unsigned mask = 1 << d->hwirq;
        if (unlikely(bank >= MAX_GPIO_BANKS))
                return -EINVAL;
+        if (state)
+                wakeups[bank] |= mask;
+        else
+                wakeups[bank] &= ~mask;
        irq_set_irq_wake(at91_gpio->pioc_virq, state);
        return 0;
 }
+void at91_pinctrl_gpio_suspend(void)
+{
+        int i;
+        for (i = 0; i < gpio_banks; i++) {
+                void __iomem  *pio;
+                if (!gpio_chips[i])
+                        continue;
+                pio = gpio_chips[i]->regbase;
+                backups[i] = __raw_readl(pio + PIO_IMR);
+                __raw_writel(backups[i], pio + PIO_IDR);
+                __raw_writel(wakeups[i], pio + PIO_IER);
+                if (!wakeups[i]) {
+                        clk_unprepare(gpio_chips[i]->clock);
+                        clk_disable(gpio_chips[i]->clock);
+                } else {
+                        printk(KERN_DEBUG "GPIO-%c may wake for %08x\n",
+                               'A'+i, wakeups[i]);
+                }
+        }
+}
+void at91_pinctrl_gpio_resume(void)
+{
+        int i;
+        for (i = 0; i < gpio_banks; i++) {
+                void __iomem  *pio;
+                if (!gpio_chips[i])
+                        continue;
+                pio = gpio_chips[i]->regbase;
+                if (!wakeups[i]) {
+                        if (clk_prepare(gpio_chips[i]->clock) == 0)
+                                clk_enable(gpio_chips[i]->clock);
+                }
+                __raw_writel(wakeups[i], pio + PIO_IDR);
+                __raw_writel(backups[i], pio + PIO_IER);
+        }
+}
 #else
 #define gpio_irq_set_wake       NULL
-#endif
+#endif /* CONFIG_PM */
 static struct irq_chip gpio_irqchip = {
        .name           = "GPIO",
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 434ebc3a99dc..0a9f27e094ea 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -44,6 +44,7 @@ static DECLARE_COMPLETION(at91_rtc_updated);
 static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
 static void __iomem *at91_rtc_regs;
 static int irq;
+static u32 at91_rtc_imr;
 /*
 * Decode time/date into rtc_time structure
@@ -108,9 +109,11 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
        cr = at91_rtc_read(AT91_RTC_CR);
        at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
+        at91_rtc_imr |= AT91_RTC_ACKUPD;
        at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
        wait_for_completion(&at91_rtc_updated); /* wait for ACKUPD interrupt */
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
+        at91_rtc_imr &= ~AT91_RTC_ACKUPD;
        at91_rtc_write(AT91_RTC_TIMR,
                          bin2bcd(tm->tm_sec) << 0
@@ -142,7 +145,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
        tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
        tm->tm_year = at91_alarm_year - 1900;
-        alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
+        alrm->enabled = (at91_rtc_imr & AT91_RTC_ALARM)
                        ? 1 : 0;
        dev_dbg(dev, "%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
@@ -168,6 +171,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        tm.tm_sec = alrm->time.tm_sec;
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+        at91_rtc_imr &= ~AT91_RTC_ALARM;
        at91_rtc_write(AT91_RTC_TIMALR,
                  bin2bcd(tm.tm_sec) << 0
                | bin2bcd(tm.tm_min) << 8
@@ -180,6 +184,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        if (alrm->enabled) {
                at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
+                at91_rtc_imr |= AT91_RTC_ALARM;
                at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
        }
@@ -196,9 +201,12 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
        if (enabled) {
                at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
+                at91_rtc_imr |= AT91_RTC_ALARM;
                at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
-        } else
+        } else {
                at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+                at91_rtc_imr &= ~AT91_RTC_ALARM;
+        }
        return 0;
 }
@@ -207,12 +215,10 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 */
 static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
 {
-        unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
        seq_printf(seq, "update_IRQ\t: %s\n",
-                        (imr & AT91_RTC_ACKUPD) ? "yes" : "no");
+                        (at91_rtc_imr & AT91_RTC_ACKUPD) ? "yes" : "no");
        seq_printf(seq, "periodic_IRQ\t: %s\n",
-                        (imr & AT91_RTC_SECEV) ? "yes" : "no");
+                        (at91_rtc_imr & AT91_RTC_SECEV) ? "yes" : "no");
        return 0;
 }
@@ -227,7 +233,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
        unsigned int rtsr;
        unsigned long events = 0;
-        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
+        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_imr;
        if (rtsr) {             /* this interrupt is shared!  Is it ours? */
                if (rtsr & AT91_RTC_ALARM)
                        events |= (RTC_AF | RTC_IRQF);
@@ -291,6 +297,7 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                        AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                        AT91_RTC_CALEV);
+        at91_rtc_imr = 0;
        ret = request_irq(irq, at91_rtc_interrupt,
                                IRQF_SHARED,
@@ -329,6 +336,7 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                        AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                        AT91_RTC_CALEV);
+        at91_rtc_imr = 0;
        free_irq(irq, pdev);
        rtc_device_unregister(rtc);
@@ -341,31 +349,35 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
 /* AT91RM9200 RTC Power management control */
-static u32 at91_rtc_imr;
+static u32 at91_rtc_bkpimr;
 static int at91_rtc_suspend(struct device *dev)
 {
        /* this IRQ is shared with DBGU and other hardware which isn't
         * necessarily doing PM like we are...
         */
-        at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
+        at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM|AT91_RTC_SECEV);
-                        & (AT91_RTC_ALARM|AT91_RTC_SECEV);
+        if (at91_rtc_bkpimr) {
-        if (at91_rtc_imr) {
+                if (device_may_wakeup(dev)) {
-                if (device_may_wakeup(dev))
                        enable_irq_wake(irq);
-                else
+                } else {
-                        at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
+                        at91_rtc_write(AT91_RTC_IDR, at91_rtc_bkpimr);
-        }
+                        at91_rtc_imr &= ~at91_rtc_bkpimr;
+                }
+}
        return 0;
 }
 static int at91_rtc_resume(struct device *dev)
 {
-        if (at91_rtc_imr) {
+        if (at91_rtc_bkpimr) {
-                if (device_may_wakeup(dev))
+                if (device_may_wakeup(dev)) {
                        disable_irq_wake(irq);
-                else
+                } else {
-                        at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
+                        at91_rtc_imr |= at91_rtc_bkpimr;
+                        at91_rtc_write(AT91_RTC_IER, at91_rtc_bkpimr);
+                }
        }
        return 0;
 }
diff --git a/drivers/rtc/rtc-at91rm9200.h b/drivers/rtc/rtc-at91rm9200.h
index da1945e5f714..5f940b6844cb 100644
--- a/drivers/rtc/rtc-at91rm9200.h
+++ b/drivers/rtc/rtc-at91rm9200.h
@@ -64,7 +64,6 @@
 #define AT91_RTC_SCCR           0x1c                    /* Status Clear Command Register */
 #define AT91_RTC_IER            0x20                    /* Interrupt Enable Register */
 #define AT91_RTC_IDR            0x24                    /* Interrupt Disable Register */
-#define AT91_RTC_IMR            0x28                    /* Interrupt Mask Register */
 #define AT91_RTC_VER            0x2c                    /* Valid Entry Register */
 #define         AT91_RTC_NVTIM          (1 <<  0)               /* Non valid Time */
diff --git a/drivers/rtc/rtc-da9052.c b/drivers/rtc/rtc-da9052.c
index 0dde688ca09b..969abbad7fe3 100644
--- a/drivers/rtc/rtc-da9052.c
+++ b/drivers/rtc/rtc-da9052.c
@@ -239,11 +239,9 @@ static int da9052_rtc_probe(struct platform_device *pdev)
        rtc->da9052 = dev_get_drvdata(pdev->dev.parent);
        platform_set_drvdata(pdev, rtc);
-        rtc->irq = platform_get_irq_byname(pdev, "ALM");
+        rtc->irq =  DA9052_IRQ_ALARM;
-        ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL,
+        ret = da9052_request_irq(rtc->da9052, rtc->irq, "ALM",
-                                da9052_rtc_irq,
+                                da9052_rtc_irq, rtc);
-                                IRQF_TRIGGER_LOW | IRQF_ONESHOT,
-                                "ALM", rtc);
        if (ret != 0) {
                rtc_err(rtc->da9052, "irq registration failed: %d\n", ret);
                return ret;
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 9978ad4433cb..5ac9c935c151 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -135,6 +135,11 @@ static const struct block_device_operations scm_blk_devops = {
        .release = scm_release,
 };
+static bool scm_permit_request(struct scm_blk_dev *bdev, struct request *req)
+{
+        return rq_data_dir(req) != WRITE || bdev->state != SCM_WR_PROHIBIT;
+}
 static void scm_request_prepare(struct scm_request *scmrq)
 {
        struct scm_blk_dev *bdev = scmrq->bdev;
@@ -195,14 +200,18 @@ void scm_request_requeue(struct scm_request *scmrq)
        scm_release_cluster(scmrq);
        blk_requeue_request(bdev->rq, scmrq->request);
+        atomic_dec(&bdev->queued_reqs);
        scm_request_done(scmrq);
        scm_ensure_queue_restart(bdev);
 }
 void scm_request_finish(struct scm_request *scmrq)
 {
+        struct scm_blk_dev *bdev = scmrq->bdev;
        scm_release_cluster(scmrq);
        blk_end_request_all(scmrq->request, scmrq->error);
+        atomic_dec(&bdev->queued_reqs);
        scm_request_done(scmrq);
 }
@@ -218,6 +227,10 @@ static void scm_blk_request(struct request_queue *rq)
                if (req->cmd_type != REQ_TYPE_FS)
                        continue;
+                if (!scm_permit_request(bdev, req)) {
+                        scm_ensure_queue_restart(bdev);
+                        return;
+                }
                scmrq = scm_request_fetch();
                if (!scmrq) {
                        SCM_LOG(5, "no request");
@@ -231,11 +244,13 @@ static void scm_blk_request(struct request_queue *rq)
                        return;
                }
                if (scm_need_cluster_request(scmrq)) {
+                        atomic_inc(&bdev->queued_reqs);
                        blk_start_request(req);
                        scm_initiate_cluster_request(scmrq);
                        return;
                }
                scm_request_prepare(scmrq);
+                atomic_inc(&bdev->queued_reqs);
                blk_start_request(req);
                ret = scm_start_aob(scmrq->aob);
@@ -244,7 +259,6 @@ static void scm_blk_request(struct request_queue *rq)
                        scm_request_requeue(scmrq);
                        return;
                }
-                atomic_inc(&bdev->queued_reqs);
        }
 }
@@ -280,6 +294,38 @@ void scm_blk_irq(struct scm_device *scmdev, void *data, int error)
        tasklet_hi_schedule(&bdev->tasklet);
 }
+static void scm_blk_handle_error(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        unsigned long flags;
+        if (scmrq->error != -EIO)
+                goto restart;
+        /* For -EIO the response block is valid. */
+        switch (scmrq->aob->response.eqc) {
+        case EQC_WR_PROHIBIT:
+                spin_lock_irqsave(&bdev->lock, flags);
+                if (bdev->state != SCM_WR_PROHIBIT)
+                        pr_info("%lu: Write access to the SCM increment is suspended\n",
+                                (unsigned long) bdev->scmdev->address);
+                bdev->state = SCM_WR_PROHIBIT;
+                spin_unlock_irqrestore(&bdev->lock, flags);
+                goto requeue;
+        default:
+                break;
+        }
+restart:
+        if (!scm_start_aob(scmrq->aob))
+                return;
+requeue:
+        spin_lock_irqsave(&bdev->rq_lock, flags);
+        scm_request_requeue(scmrq);
+        spin_unlock_irqrestore(&bdev->rq_lock, flags);
+}
 static void scm_blk_tasklet(struct scm_blk_dev *bdev)
 {
        struct scm_request *scmrq;
@@ -293,11 +339,8 @@ static void scm_blk_tasklet(struct scm_blk_dev *bdev)
                spin_unlock_irqrestore(&bdev->lock, flags);
                if (scmrq->error && scmrq->retries-- > 0) {
-                        if (scm_start_aob(scmrq->aob)) {
+                        scm_blk_handle_error(scmrq);
-                                spin_lock_irqsave(&bdev->rq_lock, flags);
-                                scm_request_requeue(scmrq);
-                                spin_unlock_irqrestore(&bdev->rq_lock, flags);
-                        }
                        /* Request restarted or requeued, handle next. */
                        spin_lock_irqsave(&bdev->lock, flags);
                        continue;
@@ -310,7 +353,6 @@ static void scm_blk_tasklet(struct scm_blk_dev *bdev)
                }
                scm_request_finish(scmrq);
-                atomic_dec(&bdev->queued_reqs);
                spin_lock_irqsave(&bdev->lock, flags);
        }
        spin_unlock_irqrestore(&bdev->lock, flags);
@@ -332,6 +374,7 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
        }
        bdev->scmdev = scmdev;
+        bdev->state = SCM_OPER;
        spin_lock_init(&bdev->rq_lock);
        spin_lock_init(&bdev->lock);
        INIT_LIST_HEAD(&bdev->finished_requests);
@@ -396,6 +439,18 @@ void scm_blk_dev_cleanup(struct scm_blk_dev *bdev)
        put_disk(bdev->gendisk);
 }
+void scm_blk_set_available(struct scm_blk_dev *bdev)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&bdev->lock, flags);
+        if (bdev->state == SCM_WR_PROHIBIT)
+                pr_info("%lu: Write access to the SCM increment is restored\n",
+                        (unsigned long) bdev->scmdev->address);
+        bdev->state = SCM_OPER;
+        spin_unlock_irqrestore(&bdev->lock, flags);
+}
 static int __init scm_blk_init(void)
 {
        int ret = -EINVAL;
diff --git a/drivers/s390/block/scm_blk.h b/drivers/s390/block/scm_blk.h
index 3c1ccf494647..8b387b32fd62 100644
--- a/drivers/s390/block/scm_blk.h
+++ b/drivers/s390/block/scm_blk.h
@@ -21,6 +21,7 @@ struct scm_blk_dev {
        spinlock_t rq_lock;     /* guard the request queue */
        spinlock_t lock;        /* guard the rest of the blockdev */
        atomic_t queued_reqs;
+        enum {SCM_OPER, SCM_WR_PROHIBIT} state;
        struct list_head finished_requests;
 #ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
        struct list_head cluster_list;
@@ -48,6 +49,7 @@ struct scm_request {
 int scm_blk_dev_setup(struct scm_blk_dev *, struct scm_device *);
 void scm_blk_dev_cleanup(struct scm_blk_dev *);
+void scm_blk_set_available(struct scm_blk_dev *);
 void scm_blk_irq(struct scm_device *, void *, int);
 void scm_request_finish(struct scm_request *);
diff --git a/drivers/s390/block/scm_drv.c b/drivers/s390/block/scm_drv.c
index 9fa0a908607b..5f6180d6ff08 100644
--- a/drivers/s390/block/scm_drv.c
+++ b/drivers/s390/block/scm_drv.c
@@ -13,12 +13,23 @@
 #include <asm/eadm.h>
 #include "scm_blk.h"
-static void notify(struct scm_device *scmdev)
+static void scm_notify(struct scm_device *scmdev, enum scm_event event)
 {
-        pr_info("%lu: The capabilities of the SCM increment changed\n",
+        struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
-                (unsigned long) scmdev->address);
-        SCM_LOG(2, "State changed");
+        switch (event) {
-        SCM_LOG_STATE(2, scmdev);
+        case SCM_CHANGE:
+                pr_info("%lu: The capabilities of the SCM increment changed\n",
+                        (unsigned long) scmdev->address);
+                SCM_LOG(2, "State changed");
+                SCM_LOG_STATE(2, scmdev);
+                break;
+        case SCM_AVAIL:
+                SCM_LOG(2, "Increment available");
+                SCM_LOG_STATE(2, scmdev);
+                scm_blk_set_available(bdev);
+                break;
+        }
 }
 static int scm_probe(struct scm_device *scmdev)
@@ -64,7 +75,7 @@ static struct scm_driver scm_drv = {
                .name = "scm_block",
                .owner = THIS_MODULE,
        },
-        .notify = notify,
+        .notify = scm_notify,
        .probe = scm_probe,
        .remove = scm_remove,
        .handler = scm_blk_irq,
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 30a2255389e5..cd798386b622 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -627,6 +627,8 @@ static int __init sclp_detect_standby_memory(void)
        struct read_storage_sccb *sccb;
        int i, id, assigned, rc;
+        if (OLDMEM_BASE) /* No standby memory in kdump mode */
+                return 0;
        if (!early_read_info_sccb_valid)
                return 0;
        if ((sclp_facilities & 0xe00000000000ULL) != 0xe00000000000ULL)
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 31ceef1beb8b..e16c553f6556 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -433,6 +433,20 @@ static void chsc_process_sei_scm_change(struct chsc_sei_nt0_area *sei_area)
                              " failed (rc=%d).\n", ret);
 }
+static void chsc_process_sei_scm_avail(struct chsc_sei_nt0_area *sei_area)
+{
+        int ret;
+        CIO_CRW_EVENT(4, "chsc: scm available information\n");
+        if (sei_area->rs != 7)
+                return;
+        ret = scm_process_availability_information();
+        if (ret)
+                CIO_CRW_EVENT(0, "chsc: process availability information"
+                              " failed (rc=%d).\n", ret);
+}
 static void chsc_process_sei_nt2(struct chsc_sei_nt2_area *sei_area)
 {
        switch (sei_area->cc) {
@@ -468,6 +482,9 @@ static void chsc_process_sei_nt0(struct chsc_sei_nt0_area *sei_area)
        case 12: /* scm change notification */
                chsc_process_sei_scm_change(sei_area);
                break;
+        case 14: /* scm available notification */
+                chsc_process_sei_scm_avail(sei_area);
+                break;
        default: /* other stuff */
                CIO_CRW_EVENT(2, "chsc: sei nt0 unhandled cc=%d\n",
                              sei_area->cc);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 227e05f674b3..349d5fc47196 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -156,8 +156,10 @@ int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token);
 #ifdef CONFIG_SCM_BUS
 int scm_update_information(void);
+int scm_process_availability_information(void);
 #else /* CONFIG_SCM_BUS */
 static inline int scm_update_information(void) { return 0; }
+static inline int scm_process_availability_information(void) { return 0; }
 #endif /* CONFIG_SCM_BUS */
diff --git a/drivers/s390/cio/scm.c b/drivers/s390/cio/scm.c
index bcf20f3aa51b..46ec25632e8b 100644
--- a/drivers/s390/cio/scm.c
+++ b/drivers/s390/cio/scm.c
@@ -211,7 +211,7 @@ static void scmdev_update(struct scm_device *scmdev, struct sale *sale)
                goto out;
        scmdrv = to_scm_drv(scmdev->dev.driver);
        if (changed && scmdrv->notify)
-                scmdrv->notify(scmdev);
+                scmdrv->notify(scmdev, SCM_CHANGE);
 out:
        device_unlock(&scmdev->dev);
        if (changed)
@@ -297,6 +297,22 @@ int scm_update_information(void)
        return ret;
 }
+static int scm_dev_avail(struct device *dev, void *unused)
+{
+        struct scm_driver *scmdrv = to_scm_drv(dev->driver);
+        struct scm_device *scmdev = to_scm_dev(dev);
+        if (dev->driver && scmdrv->notify)
+                scmdrv->notify(scmdev, SCM_AVAIL);
+        return 0;
+}
+int scm_process_availability_information(void)
+{
+        return bus_for_each_dev(&scm_bus_type, NULL, NULL, scm_dev_avail);
+}
 static int __init scm_init(void)
 {
        int ret;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index d87961d4c0de..8c0622399fcd 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -916,6 +916,7 @@ int qeth_send_control_data(struct qeth_card *, int, struct qeth_cmd_buffer *,
        void *reply_param);
 int qeth_get_priority_queue(struct qeth_card *, struct sk_buff *, int, int);
 int qeth_get_elements_no(struct qeth_card *, void *, struct sk_buff *, int);
+int qeth_get_elements_for_frags(struct sk_buff *);
 int qeth_do_send_packet_fast(struct qeth_card *, struct qeth_qdio_out_q *,
                        struct sk_buff *, struct qeth_hdr *, int, int, int);
 int qeth_do_send_packet(struct qeth_card *, struct qeth_qdio_out_q *,
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 0d8cdff81813..0d73a999983d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3679,6 +3679,25 @@ int qeth_get_priority_queue(struct qeth_card *card, struct sk_buff *skb,
 }
 EXPORT_SYMBOL_GPL(qeth_get_priority_queue);
+int qeth_get_elements_for_frags(struct sk_buff *skb)
+{
+        int cnt, length, e, elements = 0;
+        struct skb_frag_struct *frag;
+        char *data;
+        for (cnt = 0; cnt < skb_shinfo(skb)->nr_frags; cnt++) {
+                frag = &skb_shinfo(skb)->frags[cnt];
+                data = (char *)page_to_phys(skb_frag_page(frag)) +
+                        frag->page_offset;
+                length = frag->size;
+                e = PFN_UP((unsigned long)data + length - 1) -
+                        PFN_DOWN((unsigned long)data);
+                elements += e;
+        }
+        return elements;
+}
+EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
 int qeth_get_elements_no(struct qeth_card *card, void *hdr,
                     struct sk_buff *skb, int elems)
 {
@@ -3686,7 +3705,8 @@ int qeth_get_elements_no(struct qeth_card *card, void *hdr,
        int elements_needed = PFN_UP((unsigned long)skb->data + dlen - 1) -
                PFN_DOWN((unsigned long)skb->data);
-        elements_needed += skb_shinfo(skb)->nr_frags;
+        elements_needed += qeth_get_elements_for_frags(skb);
        if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)) {
                QETH_DBF_MESSAGE(2, "Invalid size of IP packet "
                        "(Number=%d / Length=%d). Discarded.\n",
@@ -3771,12 +3791,23 @@ static inline void __qeth_fill_buffer(struct sk_buff *skb,
        for (cnt = 0; cnt < skb_shinfo(skb)->nr_frags; cnt++) {
                frag = &skb_shinfo(skb)->frags[cnt];
-                buffer->element[element].addr = (char *)
+                data = (char *)page_to_phys(skb_frag_page(frag)) +
-                        page_to_phys(skb_frag_page(frag))
+                        frag->page_offset;
-                        + frag->page_offset;
+                length = frag->size;
-                buffer->element[element].length = frag->size;
+                while (length > 0) {
-                buffer->element[element].eflags = SBAL_EFLAGS_MIDDLE_FRAG;
+                        length_here = PAGE_SIZE -
-                element++;
+                                ((unsigned long) data % PAGE_SIZE);
+                        if (length < length_here)
+                                length_here = length;
+                        buffer->element[element].addr = data;
+                        buffer->element[element].length = length_here;
+                        buffer->element[element].eflags =
+                                SBAL_EFLAGS_MIDDLE_FRAG;
+                        length -= length_here;
+                        data += length_here;
+                        element++;
+                }
        }
        if (buffer->element[element - 1].eflags)
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 091ca0efa1c5..8710337dab3e 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -623,7 +623,7 @@ static int qeth_l3_send_setrouting(struct qeth_card *card,
        return rc;
 }
-static void qeth_l3_correct_routing_type(struct qeth_card *card,
+static int qeth_l3_correct_routing_type(struct qeth_card *card,
                enum qeth_routing_types *type, enum qeth_prot_versions prot)
 {
        if (card->info.type == QETH_CARD_TYPE_IQD) {
@@ -632,7 +632,7 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                case PRIMARY_CONNECTOR:
                case SECONDARY_CONNECTOR:
                case MULTICAST_ROUTER:
-                        return;
+                        return 0;
                default:
                        goto out_inval;
                }
@@ -641,17 +641,18 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                case NO_ROUTER:
                case PRIMARY_ROUTER:
                case SECONDARY_ROUTER:
-                        return;
+                        return 0;
                case MULTICAST_ROUTER:
                        if (qeth_is_ipafunc_supported(card, prot,
                                                      IPA_OSA_MC_ROUTER))
-                                return;
+                                return 0;
                default:
                        goto out_inval;
                }
        }
 out_inval:
        *type = NO_ROUTER;
+        return -EINVAL;
 }
 int qeth_l3_setrouting_v4(struct qeth_card *card)
@@ -660,8 +661,10 @@ int qeth_l3_setrouting_v4(struct qeth_card *card)
        QETH_CARD_TEXT(card, 3, "setrtg4");
-        qeth_l3_correct_routing_type(card, &card->options.route4.type,
+        rc = qeth_l3_correct_routing_type(card, &card->options.route4.type,
                                  QETH_PROT_IPV4);
+        if (rc)
+                return rc;
        rc = qeth_l3_send_setrouting(card, card->options.route4.type,
                                  QETH_PROT_IPV4);
@@ -683,8 +686,10 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
        if (!qeth_is_supported(card, IPA_IPV6))
                return 0;
-        qeth_l3_correct_routing_type(card, &card->options.route6.type,
+        rc = qeth_l3_correct_routing_type(card, &card->options.route6.type,
                                  QETH_PROT_IPV6);
+        if (rc)
+                return rc;
        rc = qeth_l3_send_setrouting(card, card->options.route6.type,
                                  QETH_PROT_IPV6);
@@ -2898,7 +2903,9 @@ static inline int qeth_l3_tso_elements(struct sk_buff *skb)
                tcp_hdr(skb)->doff * 4;
        int tcpd_len = skb->len - (tcpd - (unsigned long)skb->data);
        int elements = PFN_UP(tcpd + tcpd_len - 1) - PFN_DOWN(tcpd);
-        elements += skb_shinfo(skb)->nr_frags;
+        elements += qeth_get_elements_for_frags(skb);
        return elements;
 }
@@ -3348,7 +3355,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                rc = -ENODEV;
                goto out_remove;
        }
-        qeth_trace_features(card);
        if (!card->dev && qeth_l3_setup_netdev(card)) {
                rc = -ENODEV;
@@ -3425,6 +3431,7 @@ contin:
                qeth_l3_set_multicast_list(card->dev);
                rtnl_unlock();
        }
+        qeth_trace_features(card);
        /* let user_space know that device is online */
        kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
        mutex_unlock(&card->conf_mutex);
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index ebc379486267..e70af2406ff9 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -87,6 +87,8 @@ static ssize_t qeth_l3_dev_route_store(struct qeth_card *card,
                        rc = qeth_l3_setrouting_v6(card);
        }
 out:
+        if (rc)
+                route->type = old_route_type;
        mutex_unlock(&card->conf_mutex);
        return rc ? rc : count;
 }
diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c
index 192cf088f834..57b451904791 100644
--- a/drivers/staging/comedi/drivers/dt9812.c
+++ b/drivers/staging/comedi/drivers/dt9812.c
@@ -947,12 +947,13 @@ static int dt9812_di_rinsn(struct comedi_device *dev,
                           unsigned int *data)
 {
        struct comedi_dt9812 *devpriv = dev->private;
+        unsigned int channel = CR_CHAN(insn->chanspec);
        int n;
        u8 bits = 0;
        dt9812_digital_in(devpriv->slot, &bits);
        for (n = 0; n < insn->n; n++)
-                data[n] = ((1 << insn->chanspec) & bits) != 0;
+                data[n] = ((1 << channel) & bits) != 0;
        return n;
 }
@@ -961,12 +962,13 @@ static int dt9812_do_winsn(struct comedi_device *dev,
                           unsigned int *data)
 {
        struct comedi_dt9812 *devpriv = dev->private;
+        unsigned int channel = CR_CHAN(insn->chanspec);
        int n;
        u8 bits = 0;
        dt9812_digital_out_shadow(devpriv->slot, &bits);
        for (n = 0; n < insn->n; n++) {
-                u8 mask = 1 << insn->chanspec;
+                u8 mask = 1 << channel;
                bits &= ~mask;
                if (data[n])
@@ -981,13 +983,13 @@ static int dt9812_ai_rinsn(struct comedi_device *dev,
                           unsigned int *data)
 {
        struct comedi_dt9812 *devpriv = dev->private;
+        unsigned int channel = CR_CHAN(insn->chanspec);
        int n;
        for (n = 0; n < insn->n; n++) {
                u16 value = 0;
-                dt9812_analog_in(devpriv->slot, insn->chanspec, &value,
+                dt9812_analog_in(devpriv->slot, channel, &value, DT9812_GAIN_1);
-                                 DT9812_GAIN_1);
                data[n] = value;
        }
        return n;
@@ -998,12 +1000,13 @@ static int dt9812_ao_rinsn(struct comedi_device *dev,
                           unsigned int *data)
 {
        struct comedi_dt9812 *devpriv = dev->private;
+        unsigned int channel = CR_CHAN(insn->chanspec);
        int n;
        u16 value;
        for (n = 0; n < insn->n; n++) {
                value = 0;
-                dt9812_analog_out_shadow(devpriv->slot, insn->chanspec, &value);
+                dt9812_analog_out_shadow(devpriv->slot, channel, &value);
                data[n] = value;
        }
        return n;
@@ -1014,10 +1017,11 @@ static int dt9812_ao_winsn(struct comedi_device *dev,
                           unsigned int *data)
 {
        struct comedi_dt9812 *devpriv = dev->private;
+        unsigned int channel = CR_CHAN(insn->chanspec);
        int n;
        for (n = 0; n < insn->n; n++)
-                dt9812_analog_out(devpriv->slot, insn->chanspec, data[n]);
+                dt9812_analog_out(devpriv->slot, channel, data[n]);
        return n;
 }
diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index 1a0062a04456..6aac1f60bc42 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -730,10 +730,14 @@ static void usbduxsub_ao_IsocIrq(struct urb *urb)
 static int usbduxsub_start(struct usbduxsub *usbduxsub)
 {
        int errcode = 0;
-        uint8_t local_transfer_buffer[16];
+        uint8_t *local_transfer_buffer;
+        local_transfer_buffer = kmalloc(1, GFP_KERNEL);
+        if (!local_transfer_buffer)
+                return -ENOMEM;
        /* 7f92 to zero */
-        local_transfer_buffer[0] = 0;
+        *local_transfer_buffer = 0;
        errcode = usb_control_msg(usbduxsub->usbdev,
                                  /* create a pipe for a control transfer */
                                  usb_sndctrlpipe(usbduxsub->usbdev, 0),
@@ -751,22 +755,25 @@ static int usbduxsub_start(struct usbduxsub *usbduxsub)
                                  1,
                                  /* Timeout */
                                  BULK_TIMEOUT);
-        if (errcode < 0) {
+        if (errcode < 0)
                dev_err(&usbduxsub->interface->dev,
                        "comedi_: control msg failed (start)\n");
-                return errcode;
-        }
+        kfree(local_transfer_buffer);
-        return 0;
+        return errcode;
 }
 static int usbduxsub_stop(struct usbduxsub *usbduxsub)
 {
        int errcode = 0;
+        uint8_t *local_transfer_buffer;
-        uint8_t local_transfer_buffer[16];
+        local_transfer_buffer = kmalloc(1, GFP_KERNEL);
+        if (!local_transfer_buffer)
+                return -ENOMEM;
        /* 7f92 to one */
-        local_transfer_buffer[0] = 1;
+        *local_transfer_buffer = 1;
        errcode = usb_control_msg(usbduxsub->usbdev,
                                  usb_sndctrlpipe(usbduxsub->usbdev, 0),
                                  /* bRequest, "Firmware" */
@@ -781,12 +788,12 @@ static int usbduxsub_stop(struct usbduxsub *usbduxsub)
                                  1,
                                  /* Timeout */
                                  BULK_TIMEOUT);
-        if (errcode < 0) {
+        if (errcode < 0)
                dev_err(&usbduxsub->interface->dev,
                        "comedi_: control msg failed (stop)\n");
-                return errcode;
-        }
+        kfree(local_transfer_buffer);
-        return 0;
+        return errcode;
 }
 static int usbduxsub_upload(struct usbduxsub *usbduxsub,
diff --git a/drivers/staging/comedi/drivers/usbduxfast.c b/drivers/staging/comedi/drivers/usbduxfast.c
index 4bf5dd094dc9..1ba0e3df492d 100644
--- a/drivers/staging/comedi/drivers/usbduxfast.c
+++ b/drivers/staging/comedi/drivers/usbduxfast.c
@@ -436,10 +436,14 @@ static void usbduxfastsub_ai_Irq(struct urb *urb)
 static int usbduxfastsub_start(struct usbduxfastsub_s *udfs)
 {
        int ret;
-        unsigned char local_transfer_buffer[16];
+        unsigned char *local_transfer_buffer;
+        local_transfer_buffer = kmalloc(1, GFP_KERNEL);
+        if (!local_transfer_buffer)
+                return -ENOMEM;
        /* 7f92 to zero */
-        local_transfer_buffer[0] = 0;
+        *local_transfer_buffer = 0;
        /* bRequest, "Firmware" */
        ret = usb_control_msg(udfs->usbdev, usb_sndctrlpipe(udfs->usbdev, 0),
                              USBDUXFASTSUB_FIRMWARE,
@@ -450,22 +454,25 @@ static int usbduxfastsub_start(struct usbduxfastsub_s *udfs)
                              local_transfer_buffer,
                              1,      /* Length */
                              EZTIMEOUT);    /* Timeout */
-        if (ret < 0) {
+        if (ret < 0)
                dev_err(&udfs->interface->dev,
                        "control msg failed (start)\n");
-                return ret;
-        }
-        return 0;
+        kfree(local_transfer_buffer);
+        return ret;
 }
 static int usbduxfastsub_stop(struct usbduxfastsub_s *udfs)
 {
        int ret;
-        unsigned char local_transfer_buffer[16];
+        unsigned char *local_transfer_buffer;
+        local_transfer_buffer = kmalloc(1, GFP_KERNEL);
+        if (!local_transfer_buffer)
+                return -ENOMEM;
        /* 7f92 to one */
-        local_transfer_buffer[0] = 1;
+        *local_transfer_buffer = 1;
        /* bRequest, "Firmware" */
        ret = usb_control_msg(udfs->usbdev, usb_sndctrlpipe(udfs->usbdev, 0),
                              USBDUXFASTSUB_FIRMWARE,
@@ -474,13 +481,12 @@ static int usbduxfastsub_stop(struct usbduxfastsub_s *udfs)
                              0x0000,   /* Index */
                              local_transfer_buffer, 1, /* Length */
                              EZTIMEOUT);       /* Timeout */
-        if (ret < 0) {
+        if (ret < 0)
                dev_err(&udfs->interface->dev,
                        "control msg failed (stop)\n");
-                return ret;
-        }
-        return 0;
+        kfree(local_transfer_buffer);
+        return ret;
 }
 static int usbduxfastsub_upload(struct usbduxfastsub_s *udfs,
diff --git a/drivers/staging/comedi/drivers/usbduxsigma.c b/drivers/staging/comedi/drivers/usbduxsigma.c
index d066351a71b2..a728c8fc32a2 100644
--- a/drivers/staging/comedi/drivers/usbduxsigma.c
+++ b/drivers/staging/comedi/drivers/usbduxsigma.c
@@ -681,7 +681,11 @@ static void usbduxsub_ao_IsocIrq(struct urb *urb)
 static int usbduxsub_start(struct usbduxsub *usbduxsub)
 {
        int errcode = 0;
-        uint8_t local_transfer_buffer[16];
+        uint8_t *local_transfer_buffer;
+        local_transfer_buffer = kmalloc(16, GFP_KERNEL);
+        if (!local_transfer_buffer)
+                return -ENOMEM;
        /* 7f92 to zero */
        local_transfer_buffer[0] = 0;
@@ -702,19 +706,22 @@ static int usbduxsub_start(struct usbduxsub *usbduxsub)
                                  1,
                                  /* Timeout */
                                  BULK_TIMEOUT);
-        if (errcode < 0) {
+        if (errcode < 0)
                dev_err(&usbduxsub->interface->dev,
                        "comedi_: control msg failed (start)\n");
-                return errcode;
-        }
+        kfree(local_transfer_buffer);
-        return 0;
+        return errcode;
 }
 static int usbduxsub_stop(struct usbduxsub *usbduxsub)
 {
        int errcode = 0;
+        uint8_t *local_transfer_buffer;
-        uint8_t local_transfer_buffer[16];
+        local_transfer_buffer = kmalloc(16, GFP_KERNEL);
+        if (!local_transfer_buffer)
+                return -ENOMEM;
        /* 7f92 to one */
        local_transfer_buffer[0] = 1;
@@ -732,12 +739,12 @@ static int usbduxsub_stop(struct usbduxsub *usbduxsub)
                                  1,
                                  /* Timeout */
                                  BULK_TIMEOUT);
-        if (errcode < 0) {
+        if (errcode < 0)
                dev_err(&usbduxsub->interface->dev,
                        "comedi_: control msg failed (stop)\n");
-                return errcode;
-        }
+        kfree(local_transfer_buffer);
-        return 0;
+        return errcode;
 }
 static int usbduxsub_upload(struct usbduxsub *usbduxsub,
diff --git a/drivers/staging/imx-drm/ipuv3-crtc.c b/drivers/staging/imx-drm/ipuv3-crtc.c
index 4b3a019409b5..b028b0d1317b 100644
--- a/drivers/staging/imx-drm/ipuv3-crtc.c
+++ b/drivers/staging/imx-drm/ipuv3-crtc.c
@@ -483,17 +483,6 @@ static int ipu_get_resources(struct ipu_crtc *ipu_crtc,
                goto err_out;
        }
-        ipu_crtc->irq = ipu_idmac_channel_irq(ipu, ipu_crtc->ipu_ch,
-                        IPU_IRQ_EOF);
-        ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, 0,
-                        "imx_drm", ipu_crtc);
-        if (ret < 0) {
-                dev_err(ipu_crtc->dev, "irq request failed with %d.\n", ret);
-                goto err_out;
-        }
-        disable_irq(ipu_crtc->irq);
        return 0;
 err_out:
        ipu_put_resources(ipu_crtc);
@@ -504,6 +493,7 @@ err_out:
 static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
                struct ipu_client_platformdata *pdata)
 {
+        struct ipu_soc *ipu = dev_get_drvdata(ipu_crtc->dev->parent);
        int ret;
        ret = ipu_get_resources(ipu_crtc, pdata);
@@ -522,6 +512,17 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
                goto err_put_resources;
        }
+        ipu_crtc->irq = ipu_idmac_channel_irq(ipu, ipu_crtc->ipu_ch,
+                        IPU_IRQ_EOF);
+        ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, 0,
+                        "imx_drm", ipu_crtc);
+        if (ret < 0) {
+                dev_err(ipu_crtc->dev, "irq request failed with %d.\n", ret);
+                goto err_put_resources;
+        }
+        disable_irq(ipu_crtc->irq);
        return 0;
 err_put_resources:
diff --git a/drivers/staging/tidspbridge/rmgr/drv.c b/drivers/staging/tidspbridge/rmgr/drv.c
index db1da28cecba..be26917a6896 100644
--- a/drivers/staging/tidspbridge/rmgr/drv.c
+++ b/drivers/staging/tidspbridge/rmgr/drv.c
@@ -76,37 +76,28 @@ int drv_insert_node_res_element(void *hnode, void *node_resource,
        struct node_res_object **node_res_obj =
            (struct node_res_object **)node_resource;
        struct process_context *ctxt = (struct process_context *)process_ctxt;
-        int status = 0;
        int retval;
        *node_res_obj = kzalloc(sizeof(struct node_res_object), GFP_KERNEL);
-        if (!*node_res_obj) {
+        if (!*node_res_obj)
-                status = -ENOMEM;
+                return -ENOMEM;
-                goto func_end;
-        }
        (*node_res_obj)->node = hnode;
-        retval = idr_get_new(ctxt->node_id, *node_res_obj,
+        retval = idr_alloc(ctxt->node_id, *node_res_obj, 0, 0, GFP_KERNEL);
-                                                &(*node_res_obj)->id);
+        if (retval >= 0) {
-        if (retval == -EAGAIN) {
+                (*node_res_obj)->id = retval;
-                if (!idr_pre_get(ctxt->node_id, GFP_KERNEL)) {
+                return 0;
-                        pr_err("%s: OUT OF MEMORY\n", __func__);
-                        status = -ENOMEM;
-                        goto func_end;
-                }
-                retval = idr_get_new(ctxt->node_id, *node_res_obj,
-                                                &(*node_res_obj)->id);
        }
-        if (retval) {
+        kfree(*node_res_obj);
+        if (retval == -ENOSPC) {
                pr_err("%s: FAILED, IDR is FULL\n", __func__);
-                status = -EFAULT;
+                return -EFAULT;
+        } else {
+                pr_err("%s: OUT OF MEMORY\n", __func__);
+                return -ENOMEM;
        }
-func_end:
-        if (status)
-                kfree(*node_res_obj);
-        return status;
 }
 /* Release all Node resources and its context
@@ -201,35 +192,26 @@ int drv_proc_insert_strm_res_element(void *stream_obj,
        struct strm_res_object **pstrm_res =
            (struct strm_res_object **)strm_res;
        struct process_context *ctxt = (struct process_context *)process_ctxt;
-        int status = 0;
        int retval;
        *pstrm_res = kzalloc(sizeof(struct strm_res_object), GFP_KERNEL);
-        if (*pstrm_res == NULL) {
+        if (*pstrm_res == NULL)
-                status = -EFAULT;
+                return -EFAULT;
-                goto func_end;
-        }
        (*pstrm_res)->stream = stream_obj;
-        retval = idr_get_new(ctxt->stream_id, *pstrm_res,
+        retval = idr_alloc(ctxt->stream_id, *pstrm_res, 0, 0, GFP_KERNEL);
-                                                &(*pstrm_res)->id);
+        if (retval >= 0) {
-        if (retval == -EAGAIN) {
+                (*pstrm_res)->id = retval;
-                if (!idr_pre_get(ctxt->stream_id, GFP_KERNEL)) {
+                return 0;
-                        pr_err("%s: OUT OF MEMORY\n", __func__);
-                        status = -ENOMEM;
-                        goto func_end;
-                }
-                retval = idr_get_new(ctxt->stream_id, *pstrm_res,
-                                                &(*pstrm_res)->id);
        }
-        if (retval) {
+        if (retval == -ENOSPC) {
                pr_err("%s: FAILED, IDR is FULL\n", __func__);
-                status = -EPERM;
+                return -EPERM;
+        } else {
+                pr_err("%s: OUT OF MEMORY\n", __func__);
+                return -ENOMEM;
        }
-func_end:
-        return status;
 }
 static int drv_proc_free_strm_res(int id, void *p, void *process_ctxt)
diff --git a/drivers/staging/vt6656/card.c b/drivers/staging/vt6656/card.c
index 22918a106d73..d2479b766450 100644
--- a/drivers/staging/vt6656/card.c
+++ b/drivers/staging/vt6656/card.c
@@ -790,7 +790,7 @@ u64 CARDqGetNextTBTT(u64 qwTSF, WORD wBeaconInterval)
        if ((~uLowNextTBTT) < uLowRemain)
                qwTSF = ((qwTSF >> 32) + 1) << 32;
-        qwTSF = (qwTSF & 0xffffffff00000000UL) |
+        qwTSF = (qwTSF & 0xffffffff00000000ULL) |
                (u64)(uLowNextTBTT + uLowRemain);
    return (qwTSF);
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index d5f53e1a74a2..a5063a6f64d9 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -669,8 +669,6 @@ static int vt6656_suspend(struct usb_interface *intf, pm_message_t message)
        if (device->flags & DEVICE_FLAGS_OPENED)
                device_close(device->dev);
-        usb_put_dev(interface_to_usbdev(intf));
        return 0;
 }
@@ -681,8 +679,6 @@ static int vt6656_resume(struct usb_interface *intf)
        if (!device || !device->dev)
                return -ENODEV;
-        usb_get_dev(interface_to_usbdev(intf));
        if (!(device->flags & DEVICE_FLAGS_OPENED))
                device_open(device->dev);
diff --git a/drivers/staging/zcache/ramster/tcp.c b/drivers/staging/zcache/ramster/tcp.c
index aa2a1a763aa4..f6e1e5209d88 100644
--- a/drivers/staging/zcache/ramster/tcp.c
+++ b/drivers/staging/zcache/ramster/tcp.c
@@ -300,27 +300,22 @@ static u8 r2net_num_from_nn(struct r2net_node *nn)
 static int r2net_prep_nsw(struct r2net_node *nn, struct r2net_status_wait *nsw)
 {
-        int ret = 0;
+        int ret;
-        do {
+        spin_lock(&nn->nn_lock);
-                if (!idr_pre_get(&nn->nn_status_idr, GFP_ATOMIC)) {
+        ret = idr_alloc(&nn->nn_status_idr, nsw, 0, 0, GFP_ATOMIC);
-                        ret = -EAGAIN;
+        if (ret >= 0) {
-                        break;
+                nsw->ns_id = ret;
-                }
+                list_add_tail(&nsw->ns_node_item, &nn->nn_status_list);
-                spin_lock(&nn->nn_lock);
+        }
-                ret = idr_get_new(&nn->nn_status_idr, nsw, &nsw->ns_id);
+        spin_unlock(&nn->nn_lock);
-                if (ret == 0)
-                        list_add_tail(&nsw->ns_node_item,
-                                      &nn->nn_status_list);
-                spin_unlock(&nn->nn_lock);
-        } while (ret == -EAGAIN);
-        if (ret == 0)  {
+        if (ret >= 0) {
                init_waitqueue_head(&nsw->ns_wq);
                nsw->ns_sys_status = R2NET_ERR_NONE;
                nsw->ns_status = 0;
+                return 0;
        }
        return ret;
 }
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index db0cf7c8adde..a0fc7b9eea65 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -166,6 +166,7 @@ static int chap_server_compute_md5(
 {
        char *endptr;
        unsigned long id;
+        unsigned char id_as_uchar;
        unsigned char digest[MD5_SIGNATURE_SIZE];
        unsigned char type, response[MD5_SIGNATURE_SIZE * 2 + 2];
        unsigned char identifier[10], *challenge = NULL;
@@ -355,7 +356,9 @@ static int chap_server_compute_md5(
                goto out;
        }
-        sg_init_one(&sg, &id, 1);
+        /* To handle both endiannesses */
+        id_as_uchar = id;
+        sg_init_one(&sg, &id_as_uchar, 1);
        ret = crypto_hash_update(&desc, &sg, 1);
        if (ret < 0) {
                pr_err("crypto_hash_update() failed for id\n");
diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
index bc02b018ae46..37ffc5bd2399 100644
--- a/drivers/target/target_core_file.h
+++ b/drivers/target/target_core_file.h
@@ -7,7 +7,7 @@
 #define FD_DEVICE_QUEUE_DEPTH   32
 #define FD_MAX_DEVICE_QUEUE_DEPTH 128
 #define FD_BLOCKSIZE            512
-#define FD_MAX_SECTORS          1024
+#define FD_MAX_SECTORS          2048
 #define RRF_EMULATE_CDB         0x01
 #define RRF_GOT_LBA             0x02
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 82e78d72fdb6..e992b27aa090 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -883,7 +883,14 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                pr_debug("PSCSI: i: %d page: %p len: %d off: %d\n", i,
                        page, len, off);
-                while (len > 0 && data_len > 0) {
+                /*
+                 * We only have one page of data in each sg element,
+                 * we can not cross a page boundary.
+                 */
+                if (off + len > PAGE_SIZE)
+                        goto fail;
+                if (len > 0 && data_len > 0) {
                        bytes = min_t(unsigned int, len, PAGE_SIZE - off);
                        bytes = min(bytes, data_len);
@@ -940,9 +947,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                                bio = NULL;
                        }
-                        len -= bytes;
                        data_len -= bytes;
-                        off = 0;
                }
        }
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 290230de2c53..60d4b5185f32 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -464,8 +464,11 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
                break;
        case SYNCHRONIZE_CACHE:
        case SYNCHRONIZE_CACHE_16:
-                if (!ops->execute_sync_cache)
+                if (!ops->execute_sync_cache) {
-                        return TCM_UNSUPPORTED_SCSI_OPCODE;
+                        size = 0;
+                        cmd->execute_cmd = sbc_emulate_noop;
+                        break;
+                }
                /*
                 * Extract LBA and range to be flushed for emulated SYNCHRONIZE_CACHE
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 9169d6a5d7e4..aac9d2727e3c 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -711,7 +711,8 @@ int core_tpg_register(
        if (se_tpg->se_tpg_type == TRANSPORT_TPG_TYPE_NORMAL) {
                if (core_tpg_setup_virtual_lun0(se_tpg) < 0) {
-                        kfree(se_tpg);
+                        array_free(se_tpg->tpg_lun_list,
+                                   TRANSPORT_MAX_LUNS_PER_TPG);
                        return -ENOMEM;
                }
        }
diff --git a/drivers/thermal/dove_thermal.c b/drivers/thermal/dove_thermal.c
index 7b0bfa0e7a9c..3078c403b42d 100644
--- a/drivers/thermal/dove_thermal.c
+++ b/drivers/thermal/dove_thermal.c
@@ -143,22 +143,18 @@ static int dove_thermal_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
-        priv->sensor = devm_request_and_ioremap(&pdev->dev, res);
+        priv->sensor = devm_ioremap_resource(&pdev->dev, res);
-        if (!priv->sensor) {
+        if (IS_ERR(priv->sensor))
-                dev_err(&pdev->dev, "Failed to request_ioremap memory\n");
+                return PTR_ERR(priv->sensor);
-                return -EADDRNOTAVAIL;
-        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
        if (!res) {
                dev_err(&pdev->dev, "Failed to get platform resource\n");
                return -ENODEV;
        }
-        priv->control = devm_request_and_ioremap(&pdev->dev, res);
+        priv->control = devm_ioremap_resource(&pdev->dev, res);
-        if (!priv->control) {
+        if (IS_ERR(priv->control))
-                dev_err(&pdev->dev, "Failed to request_ioremap memory\n");
+                return PTR_ERR(priv->control);
-                return -EADDRNOTAVAIL;
-        }
        ret = dove_init_sensor(priv);
        if (ret) {
diff --git a/drivers/thermal/exynos_thermal.c b/drivers/thermal/exynos_thermal.c
index e04ebd8671ac..46568c078dee 100644
--- a/drivers/thermal/exynos_thermal.c
+++ b/drivers/thermal/exynos_thermal.c
@@ -476,7 +476,7 @@ static int exynos_register_thermal(struct thermal_sensor_conf *sensor_conf)
        if (IS_ERR(th_zone->therm_dev)) {
                pr_err("Failed to register thermal zone device\n");
-                ret = -EINVAL;
+                ret = PTR_ERR(th_zone->therm_dev);
                goto err_unregister;
        }
        th_zone->mode = THERMAL_DEVICE_ENABLED;
diff --git a/drivers/thermal/kirkwood_thermal.c b/drivers/thermal/kirkwood_thermal.c
index 65cb4f09e8f6..e5500edb5285 100644
--- a/drivers/thermal/kirkwood_thermal.c
+++ b/drivers/thermal/kirkwood_thermal.c
@@ -85,11 +85,9 @@ static int kirkwood_thermal_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
-        priv->sensor = devm_request_and_ioremap(&pdev->dev, res);
+        priv->sensor = devm_ioremap_resource(&pdev->dev, res);
-        if (!priv->sensor) {
+        if (IS_ERR(priv->sensor))
-                dev_err(&pdev->dev, "Failed to request_ioremap memory\n");
+                return PTR_ERR(priv->sensor);
-                return -EADDRNOTAVAIL;
-        }
        thermal = thermal_zone_device_register("kirkwood_thermal", 0, 0,
                                               priv, &ops, NULL, 0, 0);
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 28f091994013..2cc5b6115e3e 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -145,6 +145,7 @@ static int rcar_thermal_update_temp(struct rcar_thermal_priv *priv)
        struct device *dev = rcar_priv_to_dev(priv);
        int i;
        int ctemp, old, new;
+        int ret = -EINVAL;
        mutex_lock(&priv->lock);
@@ -174,7 +175,7 @@ static int rcar_thermal_update_temp(struct rcar_thermal_priv *priv)
        if (!ctemp) {
                dev_err(dev, "thermal sensor was broken\n");
-                return -EINVAL;
+                goto err_out_unlock;
        }
        /*
@@ -192,10 +193,10 @@ static int rcar_thermal_update_temp(struct rcar_thermal_priv *priv)
        dev_dbg(dev, "thermal%d  %d -> %d\n", priv->id, priv->ctemp, ctemp);
        priv->ctemp = ctemp;
+        ret = 0;
+err_out_unlock:
        mutex_unlock(&priv->lock);
+        return ret;
-        return 0;
 }
 static int rcar_thermal_get_temp(struct thermal_zone_device *zone,
@@ -363,6 +364,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
        struct resource *res, *irq;
        int mres = 0;
        int i;
+        int ret = -ENODEV;
        int idle = IDLE_INTERVAL;
        common = devm_kzalloc(dev, sizeof(*common), GFP_KERNEL);
@@ -399,11 +401,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                /*
                 * rcar_has_irq_support() will be enabled
                 */
-                common->base = devm_request_and_ioremap(dev, res);
+                common->base = devm_ioremap_resource(dev, res);
-                if (!common->base) {
+                if (IS_ERR(common->base))
-                        dev_err(dev, "Unable to ioremap thermal register\n");
+                        return PTR_ERR(common->base);
-                        return -ENOMEM;
-                }
                /* enable temperature comparation */
                rcar_thermal_common_write(common, ENR, 0x00030303);
@@ -422,11 +422,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                        return -ENOMEM;
                }
-                priv->base = devm_request_and_ioremap(dev, res);
+                priv->base = devm_ioremap_resource(dev, res);
-                if (!priv->base) {
+                if (IS_ERR(priv->base))
-                        dev_err(dev, "Unable to ioremap priv register\n");
+                        return PTR_ERR(priv->base);
-                        return -ENOMEM;
-                }
                priv->common = common;
                priv->id = i;
@@ -441,6 +439,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                                                idle);
                if (IS_ERR(priv->zone)) {
                        dev_err(dev, "can't register thermal zone\n");
+                        ret = PTR_ERR(priv->zone);
                        goto error_unregister;
                }
@@ -460,7 +459,7 @@ error_unregister:
        rcar_thermal_for_each_priv(priv, common)
                thermal_zone_device_unregister(priv->zone);
-        return -ENODEV;
+        return ret;
 }
 static int rcar_thermal_remove(struct platform_device *pdev)
diff --git a/drivers/tty/serial/8250/8250.c b/drivers/tty/serial/8250/8250.c
index 0efc815a4968..cf6a5383748a 100644
--- a/drivers/tty/serial/8250/8250.c
+++ b/drivers/tty/serial/8250/8250.c
@@ -301,7 +301,28 @@ static const struct serial8250_config uart_config[] = {
        },
        [PORT_8250_CIR] = {
                .name           = "CIR port"
-        }
+        },
+        [PORT_ALTR_16550_F32] = {
+                .name           = "Altera 16550 FIFO32",
+                .fifo_size      = 32,
+                .tx_loadsz      = 32,
+                .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+                .flags          = UART_CAP_FIFO | UART_CAP_AFE,
+        },
+        [PORT_ALTR_16550_F64] = {
+                .name           = "Altera 16550 FIFO64",
+                .fifo_size      = 64,
+                .tx_loadsz      = 64,
+                .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+                .flags          = UART_CAP_FIFO | UART_CAP_AFE,
+        },
+        [PORT_ALTR_16550_F128] = {
+                .name           = "Altera 16550 FIFO128",
+                .fifo_size      = 128,
+                .tx_loadsz      = 128,
+                .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+                .flags          = UART_CAP_FIFO | UART_CAP_AFE,
+        },
 };
 /* Uart divisor latch read */
@@ -3396,3 +3417,32 @@ module_param_array(probe_rsa, ulong, &probe_rsa_count, 0444);
 MODULE_PARM_DESC(probe_rsa, "Probe I/O ports for RSA");
 #endif
 MODULE_ALIAS_CHARDEV_MAJOR(TTY_MAJOR);
+#ifndef MODULE
+/* This module was renamed to 8250_core in 3.7.  Keep the old "8250" name
+ * working as well for the module options so we don't break people.  We
+ * need to keep the names identical and the convenient macros will happily
+ * refuse to let us do that by failing the build with redefinition errors
+ * of global variables.  So we stick them inside a dummy function to avoid
+ * those conflicts.  The options still get parsed, and the redefined
+ * MODULE_PARAM_PREFIX lets us keep the "8250." syntax alive.
+ *
+ * This is hacky.  I'm sorry.
+ */
+static void __used s8250_options(void)
+{
+#undef MODULE_PARAM_PREFIX
+#define MODULE_PARAM_PREFIX "8250."
+        module_param_cb(share_irqs, &param_ops_uint, &share_irqs, 0644);
+        module_param_cb(nr_uarts, &param_ops_uint, &nr_uarts, 0644);
+        module_param_cb(skip_txen_test, &param_ops_uint, &skip_txen_test, 0644);
+#ifdef CONFIG_SERIAL_8250_RSA
+        __module_param_call(MODULE_PARAM_PREFIX, probe_rsa,
+                &param_array_ops, .arr = &__param_arr_probe_rsa,
+                0444, -1);
+#endif
+}
+#else
+MODULE_ALIAS("8250");
+#endif
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 791c5a77ec61..aa76825229dc 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1571,6 +1571,7 @@ pci_wch_ch353_setup(struct serial_private *priv,
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
+#define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
 /*
 * Master list of serial port init/setup/exit quirks.
@@ -1852,15 +1853,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
        },
        {
                .vendor         = PCI_VENDOR_ID_PLX,
-                .device         = PCI_DEVICE_ID_PLX_9050,
-                .subvendor      = PCI_VENDOR_ID_PLX,
-                .subdevice      = PCI_SUBDEVICE_ID_UNKNOWN_0x1584,
-                .init           = pci_plx9050_init,
-                .setup          = pci_default_setup,
-                .exit           = pci_plx9050_exit,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_PLX,
                .device         = PCI_DEVICE_ID_PLX_ROMULUS,
                .subvendor      = PCI_VENDOR_ID_PLX,
                .subdevice      = PCI_DEVICE_ID_PLX_ROMULUS,
@@ -3733,7 +3725,12 @@ static struct pci_device_id serial_pci_tbl[] = {
        {       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9050,
                PCI_VENDOR_ID_PLX,
                PCI_SUBDEVICE_ID_UNKNOWN_0x1584, 0, 0,
-                pbn_b0_4_115200 },
+                pbn_b2_4_115200 },
+        /* Unknown card - subdevice 0x1588 */
+        {       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9050,
+                PCI_VENDOR_ID_PLX,
+                PCI_SUBDEVICE_ID_UNKNOWN_0x1588, 0, 0,
+                pbn_b2_8_115200 },
        {       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9050,
                PCI_SUBVENDOR_ID_KEYSPAN,
                PCI_SUBDEVICE_ID_KEYSPAN_SX2, 0, 0,
@@ -4791,6 +4788,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                PCI_VENDOR_ID_IBM, 0x0299,
                0, 0, pbn_b0_bt_2_115200 },
+        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,
+                0x1000, 0x0012,
+                0, 0, pbn_b0_bt_2_115200 },
        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9901,
                0xA000, 0x1000,
                0, 0, pbn_b0_1_115200 },
diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
index 35d9ab95c5cb..b3455a970a1d 100644
--- a/drivers/tty/serial/8250/8250_pnp.c
+++ b/drivers/tty/serial/8250/8250_pnp.c
@@ -429,6 +429,7 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
 {
        struct uart_8250_port uart;
        int ret, line, flags = dev_id->driver_data;
+        struct resource *res = NULL;
        if (flags & UNKNOWN_DEV) {
                ret = serial_pnp_guess_board(dev);
@@ -439,11 +440,12 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
        memset(&uart, 0, sizeof(uart));
        if (pnp_irq_valid(dev, 0))
                uart.port.irq = pnp_irq(dev, 0);
-        if ((flags & CIR_PORT) && pnp_port_valid(dev, 2)) {
+        if ((flags & CIR_PORT) && pnp_port_valid(dev, 2))
-                uart.port.iobase = pnp_port_start(dev, 2);
+                res = pnp_get_resource(dev, IORESOURCE_IO, 2);
-                uart.port.iotype = UPIO_PORT;
+        else if (pnp_port_valid(dev, 0))
-        } else if (pnp_port_valid(dev, 0)) {
+                res = pnp_get_resource(dev, IORESOURCE_IO, 0);
-                uart.port.iobase = pnp_port_start(dev, 0);
+        if (pnp_resource_enabled(res)) {
+                uart.port.iobase = res->start;
                uart.port.iotype = UPIO_PORT;
        } else if (pnp_mem_valid(dev, 0)) {
                uart.port.mapbase = pnp_mem_start(dev, 0);
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index cf9210db9fa9..7e7006fd404e 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -211,14 +211,14 @@ config SERIAL_SAMSUNG
 config SERIAL_SAMSUNG_UARTS_4
        bool
        depends on PLAT_SAMSUNG
-        default y if !(CPU_S3C2410 || SERIAL_S3C2412 || CPU_S3C2440 || CPU_S3C2442)
+        default y if !(CPU_S3C2410 || CPU_S3C2412 || CPU_S3C2440 || CPU_S3C2442)
        help
          Internal node for the common case of 4 Samsung compatible UARTs
 config SERIAL_SAMSUNG_UARTS
        int
        depends on PLAT_SAMSUNG
-        default 6 if ARCH_S5P6450
+        default 6 if CPU_S5P6450
        default 4 if SERIAL_SAMSUNG_UARTS_4 || CPU_S3C2416
        default 3
        help
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index 719594e5fc21..52a3ecd40421 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -235,7 +235,7 @@ static const char *bcm_uart_type(struct uart_port *port)
 */
 static void bcm_uart_do_rx(struct uart_port *port)
 {
-        struct tty_port *port = &port->state->port;
+        struct tty_port *tty_port = &port->state->port;
        unsigned int max_count;
        /* limit number of char read in interrupt, should not be
@@ -260,7 +260,7 @@ static void bcm_uart_do_rx(struct uart_port *port)
                        bcm_uart_writel(port, val, UART_CTL_REG);
                        port->icount.overrun++;
-                        tty_insert_flip_char(port, 0, TTY_OVERRUN);
+                        tty_insert_flip_char(tty_port, 0, TTY_OVERRUN);
                }
                if (!(iestat & UART_IR_STAT(UART_IR_RXNOTEMPTY)))
@@ -299,11 +299,11 @@ static void bcm_uart_do_rx(struct uart_port *port)
                if ((cstat & port->ignore_status_mask) == 0)
-                        tty_insert_flip_char(port, c, flag);
+                        tty_insert_flip_char(tty_port, c, flag);
        } while (--max_count);
-        tty_flip_buffer_push(port);
+        tty_flip_buffer_push(tty_port);
 }
 /*
diff --git a/drivers/tty/serial/mpc52xx_uart.c b/drivers/tty/serial/mpc52xx_uart.c
index c0e1fad51be7..018bad922554 100644
--- a/drivers/tty/serial/mpc52xx_uart.c
+++ b/drivers/tty/serial/mpc52xx_uart.c
@@ -550,7 +550,7 @@ static int mpc512x_psc_clock(struct uart_port *port, int enable)
                return 0;
        psc_num = (port->mapbase & 0xf00) >> 8;
-        snprintf(clk_name, sizeof(clk_name), "psc%d_clk", psc_num);
+        snprintf(clk_name, sizeof(clk_name), "psc%d_mclk", psc_num);
        psc_clk = clk_get(port->dev, clk_name);
        if (IS_ERR(psc_clk)) {
                dev_err(port->dev, "Failed to get PSC clock entry!\n");
diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index d5874605682b..b025d5438275 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -241,6 +241,12 @@ static struct of_device_id of_platform_serial_table[] = {
        { .compatible = "ns16850",  .data = (void *)PORT_16850, },
        { .compatible = "nvidia,tegra20-uart", .data = (void *)PORT_TEGRA, },
        { .compatible = "nxp,lpc3220-uart", .data = (void *)PORT_LPC3220, },
+        { .compatible = "altr,16550-FIFO32",
+                .data = (void *)PORT_ALTR_16550_F32, },
+        { .compatible = "altr,16550-FIFO64",
+                .data = (void *)PORT_ALTR_16550_F64, },
+        { .compatible = "altr,16550-FIFO128",
+                .data = (void *)PORT_ALTR_16550_F128, },
 #ifdef CONFIG_SERIAL_OF_PLATFORM_NWPSERIAL
        { .compatible = "ibm,qpace-nwp-serial",
                .data = (void *)PORT_NWPSERIAL, },
diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
index e343d6670854..451687cb9685 100644
--- a/drivers/tty/serial/sunsu.c
+++ b/drivers/tty/serial/sunsu.c
@@ -968,6 +968,7 @@ static struct uart_ops sunsu_pops = {
 #define UART_NR 4
 static struct uart_sunsu_port sunsu_ports[UART_NR];
+static int nr_inst; /* Number of already registered ports */
 #ifdef CONFIG_SERIO
@@ -1337,13 +1338,8 @@ static int __init sunsu_console_setup(struct console *co, char *options)
        printk("Console: ttyS%d (SU)\n",
               (sunsu_reg.minor - 64) + co->index);
-        /*
+        if (co->index > nr_inst)
-         * Check whether an invalid uart number has been specified, and
+                return -ENODEV;
-         * if so, search for the first available port that does have
-         * console support.
-         */
-        if (co->index >= UART_NR)
-                co->index = 0;
        port = &sunsu_ports[co->index].port;
        /*
@@ -1408,7 +1404,6 @@ static enum su_type su_get_type(struct device_node *dp)
 static int su_probe(struct platform_device *op)
 {
-        static int inst;
        struct device_node *dp = op->dev.of_node;
        struct uart_sunsu_port *up;
        struct resource *rp;
@@ -1418,16 +1413,16 @@ static int su_probe(struct platform_device *op)
        type = su_get_type(dp);
        if (type == SU_PORT_PORT) {
-                if (inst >= UART_NR)
+                if (nr_inst >= UART_NR)
                        return -EINVAL;
-                up = &sunsu_ports[inst];
+                up = &sunsu_ports[nr_inst];
        } else {
                up = kzalloc(sizeof(*up), GFP_KERNEL);
                if (!up)
                        return -ENOMEM;
        }
-        up->port.line = inst;
+        up->port.line = nr_inst;
        spin_lock_init(&up->port.lock);
@@ -1461,6 +1456,8 @@ static int su_probe(struct platform_device *op)
                }
                dev_set_drvdata(&op->dev, up);
+                nr_inst++;
                return 0;
        }
@@ -1488,7 +1485,7 @@ static int su_probe(struct platform_device *op)
        dev_set_drvdata(&op->dev, up);
-        inst++;
+        nr_inst++;
        return 0;
diff --git a/drivers/tty/serial/vt8500_serial.c b/drivers/tty/serial/vt8500_serial.c
index a3f9dd5c9dff..705240e6c4ec 100644
--- a/drivers/tty/serial/vt8500_serial.c
+++ b/drivers/tty/serial/vt8500_serial.c
@@ -611,14 +611,7 @@ static int vt8500_serial_probe(struct platform_device *pdev)
        vt8500_port->uart.dev = &pdev->dev;
        vt8500_port->uart.flags = UPF_IOREMAP | UPF_BOOT_AUTOCONF;
-        vt8500_port->clk = of_clk_get(pdev->dev.of_node, 0);
+        vt8500_port->uart.uartclk = clk_get_rate(vt8500_port->clk);
-        if (!IS_ERR(vt8500_port->clk)) {
-                vt8500_port->uart.uartclk = clk_get_rate(vt8500_port->clk);
-        } else {
-                /* use the default of 24Mhz if not specified and warn */
-                pr_warn("%s: serial clock source not specified\n", __func__);
-                vt8500_port->uart.uartclk = 24000000;
-        }
        snprintf(vt8500_port->name, sizeof(vt8500_port->name),
                 "VT8500 UART%d", pdev->id);
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index bb119934e76c..578aa7594b11 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -425,7 +425,7 @@ static void flush_to_ldisc(struct work_struct *work)
        struct tty_ldisc *disc;
        tty = port->itty;
-        if (WARN_RATELIMIT(tty == NULL, "tty is NULL\n"))
+        if (tty == NULL)
                return;
        disc = tty_ldisc_ref(tty);
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index f5ed3d75fa5a..8f5ebced5df0 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -46,7 +46,7 @@ obj-$(CONFIG_USB_MICROTEK)	+= image/
 obj-$(CONFIG_USB_SERIAL)        += serial/
 obj-$(CONFIG_USB)               += misc/
-obj-$(CONFIG_USB_COMMON)        += phy/
+obj-$(CONFIG_USB_OTG_UTILS)     += phy/
 obj-$(CONFIG_EARLY_PRINTK_DBGP) += early/
 obj-$(CONFIG_USB_ATM)           += atm/
diff --git a/drivers/usb/c67x00/c67x00-sched.c b/drivers/usb/c67x00/c67x00-sched.c
index a03fbc15fa9c..aa491627a45b 100644
--- a/drivers/usb/c67x00/c67x00-sched.c
+++ b/drivers/usb/c67x00/c67x00-sched.c
@@ -100,7 +100,7 @@ struct c67x00_urb_priv {
 #define TD_PIDEP_OFFSET         0x04
 #define TD_PIDEPMASK_PID        0xF0
 #define TD_PIDEPMASK_EP         0x0F
-#define TD_PORTLENMASK_DL       0x02FF
+#define TD_PORTLENMASK_DL       0x03FF
 #define TD_PORTLENMASK_PN       0xC000
 #define TD_STATUS_OFFSET        0x07
@@ -590,7 +590,7 @@ static int c67x00_create_td(struct c67x00_hcd *c67x00, struct urb *urb,
 {
        struct c67x00_td *td;
        struct c67x00_urb_priv *urbp = urb->hcpriv;
-        const __u8 active_flag = 1, retry_cnt = 1;
+        const __u8 active_flag = 1, retry_cnt = 3;
        __u8 cmd = 0;
        int tt = 0;
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 2f45bba8561d..f64fbea1cf20 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1767,7 +1767,7 @@ static int udc_start(struct ci13xxx *ci)
                goto put_transceiver;
        }
-        retval = dbg_create_files(&ci->gadget.dev);
+        retval = dbg_create_files(ci->dev);
        if (retval)
                goto unreg_device;
@@ -1796,7 +1796,7 @@ remove_trans:
        dev_err(dev, "error = %i\n", retval);
 remove_dbg:
-        dbg_remove_files(&ci->gadget.dev);
+        dbg_remove_files(ci->dev);
 unreg_device:
        device_unregister(&ci->gadget.dev);
 put_transceiver:
@@ -1836,7 +1836,7 @@ static void udc_stop(struct ci13xxx *ci)
                if (ci->global_phy)
                        usb_put_phy(ci->transceiver);
        }
-        dbg_remove_files(&ci->gadget.dev);
+        dbg_remove_files(ci->dev);
        device_unregister(&ci->gadget.dev);
        /* my kobject is dynamic, I swear! */
        memset(&ci->gadget, 0, sizeof(ci->gadget));
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 8ac25adf31b4..387dc6c8ad25 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -593,7 +593,6 @@ static void acm_port_destruct(struct tty_port *port)
        dev_dbg(&acm->control->dev, "%s\n", __func__);
-        tty_unregister_device(acm_tty_driver, acm->minor);
        acm_release_minor(acm);
        usb_put_intf(acm->control);
        kfree(acm->country_codes);
@@ -977,6 +976,8 @@ static int acm_probe(struct usb_interface *intf,
        int num_rx_buf;
        int i;
        int combined_interfaces = 0;
+        struct device *tty_dev;
+        int rv = -ENOMEM;
        /* normal quirks */
        quirks = (unsigned long)id->driver_info;
@@ -1339,11 +1340,24 @@ skip_countries:
        usb_set_intfdata(data_interface, acm);
        usb_get_intf(control_interface);
-        tty_port_register_device(&acm->port, acm_tty_driver, minor,
+        tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
                        &control_interface->dev);
+        if (IS_ERR(tty_dev)) {
+                rv = PTR_ERR(tty_dev);
+                goto alloc_fail8;
+        }
        return 0;
+alloc_fail8:
+        if (acm->country_codes) {
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_wCountryCodes);
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_iCountryCodeRelDate);
+        }
+        device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
 alloc_fail7:
+        usb_set_intfdata(intf, NULL);
        for (i = 0; i < ACM_NW; i++)
                usb_free_urb(acm->wb[i].urb);
 alloc_fail6:
@@ -1359,7 +1373,7 @@ alloc_fail2:
        acm_release_minor(acm);
        kfree(acm);
 alloc_fail:
-        return -ENOMEM;
+        return rv;
 }
 static void stop_data_traffic(struct acm *acm)
@@ -1411,6 +1425,8 @@ static void acm_disconnect(struct usb_interface *intf)
        stop_data_traffic(acm);
+        tty_unregister_device(acm_tty_driver, acm->minor);
        usb_free_urb(acm->ctrlurb);
        for (i = 0; i < ACM_NW; i++)
                usb_free_urb(acm->wb[i].urb);
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 5f0cb417b736..122d056d96d5 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -56,6 +56,7 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
 #define WDM_RESPONDING          7
 #define WDM_SUSPENDING          8
 #define WDM_RESETTING           9
+#define WDM_OVERFLOW            10
 #define WDM_MAX                 16
@@ -155,6 +156,7 @@ static void wdm_in_callback(struct urb *urb)
 {
        struct wdm_device *desc = urb->context;
        int status = urb->status;
+        int length = urb->actual_length;
        spin_lock(&desc->iuspin);
        clear_bit(WDM_RESPONDING, &desc->flags);
@@ -185,9 +187,17 @@ static void wdm_in_callback(struct urb *urb)
        }
        desc->rerr = status;
-        desc->reslength = urb->actual_length;
+        if (length + desc->length > desc->wMaxCommand) {
-        memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength);
+                /* The buffer would overflow */
-        desc->length += desc->reslength;
+                set_bit(WDM_OVERFLOW, &desc->flags);
+        } else {
+                /* we may already be in overflow */
+                if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
+                        memmove(desc->ubuf + desc->length, desc->inbuf, length);
+                        desc->length += length;
+                        desc->reslength = length;
+                }
+        }
 skip_error:
        wake_up(&desc->wait);
@@ -435,6 +445,11 @@ retry:
                        rv = -ENODEV;
                        goto err;
                }
+                if (test_bit(WDM_OVERFLOW, &desc->flags)) {
+                        clear_bit(WDM_OVERFLOW, &desc->flags);
+                        rv = -ENOBUFS;
+                        goto err;
+                }
                i++;
                if (file->f_flags & O_NONBLOCK) {
                        if (!test_bit(WDM_READ, &desc->flags)) {
@@ -478,6 +493,7 @@ retry:
                        spin_unlock_irq(&desc->iuspin);
                        goto retry;
                }
                if (!desc->reslength) { /* zero length read */
                        dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
                        clear_bit(WDM_READ, &desc->flags);
@@ -1004,6 +1020,7 @@ static int wdm_post_reset(struct usb_interface *intf)
        struct wdm_device *desc = wdm_find_device(intf);
        int rv;
+        clear_bit(WDM_OVERFLOW, &desc->flags);
        clear_bit(WDM_RESETTING, &desc->flags);
        rv = recover_from_urb_loss(desc);
        mutex_unlock(&desc->wlock);
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 622b4a48e732..2b487d4797bd 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
        struct hc_driver        *driver;
        struct usb_hcd          *hcd;
        int                     retval;
+        int                     hcd_irq = 0;
        if (usb_disabled())
                return -ENODEV;
@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                return -ENODEV;
        dev->current_state = PCI_D0;
-        /* The xHCI driver supports MSI and MSI-X,
+        /*
-         * so don't fail if the BIOS doesn't provide a legacy IRQ.
+         * The xHCI driver has its own irq management
+         * make sure irq setup is not touched for xhci in generic hcd code
         */
-        if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
+        if ((driver->flags & HCD_MASK) != HCD_USB3) {
-                dev_err(&dev->dev,
+                if (!dev->irq) {
-                        "Found HC with no IRQ.  Check BIOS/PCI %s setup!\n",
+                        dev_err(&dev->dev,
-                        pci_name(dev));
+                        "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
-                retval = -ENODEV;
+                                pci_name(dev));
-                goto disable_pci;
+                        retval = -ENODEV;
+                        goto disable_pci;
+                }
+                hcd_irq = dev->irq;
        }
        hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));
@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
        pci_set_master(dev);
-        retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);
        if (retval != 0)
                goto unmap_registers;
        set_hs_companion(dev, hcd);
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 999909451e37..ffa6b004a84b 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -583,6 +583,7 @@ static int dwc3_remove(struct platform_device *pdev)
                break;
        }
+        dwc3_free_event_buffers(dwc);
        dwc3_core_exit(dwc);
        return 0;
diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
index b50da53e9a52..b082bec7343e 100644
--- a/drivers/usb/dwc3/dwc3-exynos.c
+++ b/drivers/usb/dwc3/dwc3-exynos.c
@@ -23,8 +23,6 @@
 #include <linux/usb/nop-usb-xceiv.h>
 #include <linux/of.h>
-#include "core.h"
 struct dwc3_exynos {
        struct platform_device  *dwc3;
        struct platform_device  *usb2_phy;
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 22f337f57219..afa05e3c9cf4 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -54,8 +54,6 @@
 #include <linux/usb/otg.h>
 #include <linux/usb/nop-usb-xceiv.h>
-#include "core.h"
 /*
 * All these registers belong to OMAP's Wrapper around the
 * DesignWare USB3 Core.
@@ -465,20 +463,20 @@ static int dwc3_omap_remove(struct platform_device *pdev)
        return 0;
 }
-static const struct of_device_id of_dwc3_matach[] = {
+static const struct of_device_id of_dwc3_match[] = {
        {
                "ti,dwc3",
        },
        { },
 };
-MODULE_DEVICE_TABLE(of, of_dwc3_matach);
+MODULE_DEVICE_TABLE(of, of_dwc3_match);
 static struct platform_driver dwc3_omap_driver = {
        .probe          = dwc3_omap_probe,
        .remove         = dwc3_omap_remove,
        .driver         = {
                .name   = "omap-dwc3",
-                .of_match_table = of_dwc3_matach,
+                .of_match_table = of_dwc3_match,
        },
 };
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 7d70f44567d2..e8d77689a322 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -45,8 +45,6 @@
 #include <linux/usb/otg.h>
 #include <linux/usb/nop-usb-xceiv.h>
-#include "core.h"
 /* FIXME define these in <linux/pci_ids.h> */
 #define PCI_VENDOR_ID_SYNOPSYS          0x16c3
 #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index d7da073a23fe..1d139ca05ef1 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -891,7 +891,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                DWC3_TRBCTL_CONTROL_DATA);
        } else if (!IS_ALIGNED(req->request.length, dep->endpoint.maxpacket)
                        && (dep->number == 0)) {
-                u32             transfer_size;
+                u32     transfer_size;
+                u32     maxpacket;
                ret = usb_gadget_map_request(&dwc->gadget, &req->request,
                                dep->number);
@@ -902,8 +903,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
-                transfer_size = roundup(req->request.length,
+                maxpacket = dep->endpoint.maxpacket;
-                                (u32) dep->endpoint.maxpacket);
+                transfer_size = roundup(req->request.length, maxpacket);
                dwc->ep0_bounced = true;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index a04342f6cbfa..82e160e96fca 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2159,7 +2159,6 @@ static void dwc3_gadget_phy_suspend(struct dwc3 *dwc, u8 speed)
 static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
 {
-        struct dwc3_gadget_ep_cmd_params params;
        struct dwc3_ep          *dep;
        int                     ret;
        u32                     reg;
@@ -2167,8 +2166,6 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
        dev_vdbg(dwc->dev, "%s\n", __func__);
-        memset(&params, 0x00, sizeof(params));
        reg = dwc3_readl(dwc->regs, DWC3_DSTS);
        speed = reg & DWC3_DSTS_CONNECTSPD;
        dwc->speed = speed;
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index 97a13c349cc5..82fb22511356 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -35,6 +35,12 @@ mv_udc-y			:= mv_udc_core.o
 obj-$(CONFIG_USB_FUSB300)       += fusb300_udc.o
 obj-$(CONFIG_USB_MV_U3D)        += mv_u3d_core.o
+# USB Functions
+obj-$(CONFIG_USB_F_ACM)         += f_acm.o
+f_ss_lb-y                       := f_loopback.o f_sourcesink.o
+obj-$(CONFIG_USB_F_SS_LB)       += f_ss_lb.o
+obj-$(CONFIG_USB_U_SERIAL)      += u_serial.o
 #
 # USB gadget drivers
 #
@@ -74,9 +80,3 @@ obj-$(CONFIG_USB_G_WEBCAM)	+= g_webcam.o
 obj-$(CONFIG_USB_G_NCM)         += g_ncm.o
 obj-$(CONFIG_USB_G_ACM_MS)      += g_acm_ms.o
 obj-$(CONFIG_USB_GADGET_TARGET) += tcm_usb_gadget.o
-# USB Functions
-obj-$(CONFIG_USB_F_ACM)         += f_acm.o
-f_ss_lb-y                       := f_loopback.o f_sourcesink.o
-obj-$(CONFIG_USB_F_SS_LB)       += f_ss_lb.o
-obj-$(CONFIG_USB_U_SERIAL)      += u_serial.o
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 7c821de8ce3d..c0d62b278610 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1757,10 +1757,7 @@ static const struct usb_gadget_driver composite_driver_template = {
 /**
 * usb_composite_probe() - register a composite driver
 * @driver: the driver to register
- * @bind: the callback used to allocate resources that are shared across the
+ *
- *      whole device, such as string IDs, and add its configurations using
- *      @usb_add_config().  This may fail by returning a negative errno
- *      value; it should return zero on successful initialization.
 * Context: single threaded during gadget setup
 *
 * This function is used to register drivers using the composite driver
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 71beeb833558..cc9c49c57c80 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -447,14 +447,13 @@ static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req)
 static void rndis_command_complete(struct usb_ep *ep, struct usb_request *req)
 {
        struct f_rndis                  *rndis = req->context;
-        struct usb_composite_dev        *cdev = rndis->port.func.config->cdev;
        int                             status;
        /* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
 //      spin_lock(&dev->lock);
        status = rndis_msg_parser(rndis->config, (u8 *) req->buf);
        if (status < 0)
-                ERROR(cdev, "RNDIS command error %d, %d/%d\n",
+                pr_err("RNDIS command error %d, %d/%d\n",
                        status, req->actual, req->length);
 //      spin_unlock(&dev->lock);
 }
diff --git a/drivers/usb/gadget/f_uac1.c b/drivers/usb/gadget/f_uac1.c
index f570e667a640..fa8ea4ea00c1 100644
--- a/drivers/usb/gadget/f_uac1.c
+++ b/drivers/usb/gadget/f_uac1.c
@@ -418,6 +418,7 @@ static int audio_get_intf_req(struct usb_function *f,
        req->context = audio;
        req->complete = f_audio_complete;
+        len = min_t(size_t, sizeof(value), len);
        memcpy(req->buf, &value, len);
        return len;
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 3953dd4d7186..3b343b23e4b0 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -357,7 +357,7 @@ static int gfs_bind(struct usb_composite_dev *cdev)
                goto error;
        gfs_dev_desc.iProduct = gfs_strings[USB_GADGET_PRODUCT_IDX].id;
-        for (i = func_num; --i; ) {
+        for (i = func_num; i--; ) {
                ret = functionfs_bind(ffs_tab[i].ffs_data, cdev);
                if (unlikely(ret < 0)) {
                        while (++i < func_num)
@@ -413,7 +413,7 @@ static int gfs_unbind(struct usb_composite_dev *cdev)
                gether_cleanup();
        gfs_ether_setup = false;
-        for (i = func_num; --i; )
+        for (i = func_num; i--; )
                if (ffs_tab[i].ffs_data)
                        functionfs_unbind(ffs_tab[i].ffs_data);
diff --git a/drivers/usb/gadget/imx_udc.c b/drivers/usb/gadget/imx_udc.c
index 8efd7555fa21..5bd930d779b9 100644
--- a/drivers/usb/gadget/imx_udc.c
+++ b/drivers/usb/gadget/imx_udc.c
@@ -1334,27 +1334,18 @@ static int imx_udc_start(struct usb_gadget *gadget,
                struct usb_gadget_driver *driver)
 {
        struct imx_udc_struct *imx_usb;
-        int retval;
        imx_usb = container_of(gadget, struct imx_udc_struct, gadget);
        /* first hook up the driver ... */
        imx_usb->driver = driver;
        imx_usb->gadget.dev.driver = &driver->driver;
-        retval = device_add(&imx_usb->gadget.dev);
-        if (retval)
-                goto fail;
        D_INI(imx_usb->dev, "<%s> registered gadget driver '%s'\n",
                __func__, driver->driver.name);
        imx_udc_enable(imx_usb);
        return 0;
-fail:
-        imx_usb->driver = NULL;
-        imx_usb->gadget.dev.driver = NULL;
-        return retval;
 }
 static int imx_udc_stop(struct usb_gadget *gadget,
@@ -1370,8 +1361,6 @@ static int imx_udc_stop(struct usb_gadget *gadget,
        imx_usb->gadget.dev.driver = NULL;
        imx_usb->driver = NULL;
-        device_del(&imx_usb->gadget.dev);
        D_INI(imx_usb->dev, "<%s> unregistered gadget driver '%s'\n",
                __func__, driver->driver.name);
@@ -1477,6 +1466,10 @@ static int __init imx_udc_probe(struct platform_device *pdev)
        imx_usb->gadget.dev.parent = &pdev->dev;
        imx_usb->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        ret = device_add(&imx_usb->gadget.dev);
+        if (retval)
+                goto fail4;
        platform_set_drvdata(pdev, imx_usb);
        usb_init_data(imx_usb);
@@ -1488,9 +1481,11 @@ static int __init imx_udc_probe(struct platform_device *pdev)
        ret = usb_add_gadget_udc(&pdev->dev, &imx_usb->gadget);
        if (ret)
-                goto fail4;
+                goto fail5;
        return 0;
+fail5:
+        device_unregister(&imx_usb->gadget.dev);
 fail4:
        for (i = 0; i < IMX_USB_NB_EP + 1; i++)
                free_irq(imx_usb->usbd_int[i], imx_usb);
@@ -1514,6 +1509,7 @@ static int __exit imx_udc_remove(struct platform_device *pdev)
        int i;
        usb_del_gadget_udc(&imx_usb->gadget);
+        device_unregister(&imx_usb->gadget.dev);
        imx_udc_disable(imx_usb);
        del_timer(&imx_usb->timer);
diff --git a/drivers/usb/gadget/net2272.c b/drivers/usb/gadget/net2272.c
index d226058e3b88..32524b631959 100644
--- a/drivers/usb/gadget/net2272.c
+++ b/drivers/usb/gadget/net2272.c
@@ -59,7 +59,7 @@ static const char * const ep_name[] = {
 };
 #define DMA_ADDR_INVALID        (~(dma_addr_t)0)
-#ifdef CONFIG_USB_GADGET_NET2272_DMA
+#ifdef CONFIG_USB_NET2272_DMA
 /*
 * use_dma: the NET2272 can use an external DMA controller.
 * Note that since there is no generic DMA api, some functions,
@@ -1495,6 +1495,13 @@ stop_activity(struct net2272 *dev, struct usb_gadget_driver *driver)
        for (i = 0; i < 4; ++i)
                net2272_dequeue_all(&dev->ep[i]);
+        /* report disconnect; the driver is already quiesced */
+        if (driver) {
+                spin_unlock(&dev->lock);
+                driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
        net2272_usb_reinit(dev);
 }
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index a1b650e11339..3bd0f992fb49 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -1924,7 +1924,6 @@ static int net2280_start(struct usb_gadget *_gadget,
 err_func:
        device_remove_file (&dev->pdev->dev, &dev_attr_function);
 err_unbind:
-        driver->unbind (&dev->gadget);
        dev->gadget.dev.driver = NULL;
        dev->driver = NULL;
        return retval;
@@ -1946,6 +1945,13 @@ stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
        for (i = 0; i < 7; i++)
                nuke (&dev->ep [i]);
+        /* report disconnect; the driver is already quiesced */
+        if (driver) {
+                spin_unlock(&dev->lock);
+                driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
        usb_reinit (dev);
 }
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 06be85c2b233..f8445653577f 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -62,6 +62,7 @@
 #define DRIVER_VERSION  "4 October 2004"
 #define OMAP_DMA_USB_W2FC_TX0           29
+#define OMAP_DMA_USB_W2FC_RX0           26
 /*
 * The OMAP UDC needs _very_ early endpoint setup:  before enabling the
@@ -1310,7 +1311,7 @@ static int omap_pullup(struct usb_gadget *gadget, int is_on)
 }
 static int omap_udc_start(struct usb_gadget *g,
-                struct usb_gadget_driver *driver)
+                struct usb_gadget_driver *driver);
 static int omap_udc_stop(struct usb_gadget *g,
                struct usb_gadget_driver *driver);
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index 2bbcdce942dc..d0f37484b6b0 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -1266,13 +1266,6 @@ static int pxa25x_udc_start(struct usb_gadget *g,
        dev->gadget.dev.driver = &driver->driver;
        dev->pullup = 1;
-        retval = device_add (&dev->gadget.dev);
-        if (retval) {
-                dev->driver = NULL;
-                dev->gadget.dev.driver = NULL;
-                return retval;
-        }
        /* ... then enable host detection and ep0; and we're ready
         * for set_configuration as well as eventual disconnect.
         */
@@ -1310,6 +1303,10 @@ stop_activity(struct pxa25x_udc *dev, struct usb_gadget_driver *driver)
        }
        del_timer_sync(&dev->timer);
+        /* report disconnect; the driver is already quiesced */
+        if (driver)
+                driver->disconnect(&dev->gadget);
        /* re-init driver-visible data structures */
        udc_reinit(dev);
 }
@@ -1331,7 +1328,6 @@ static int pxa25x_udc_stop(struct usb_gadget*g,
        dev->gadget.dev.driver = NULL;
        dev->driver = NULL;
-        device_del (&dev->gadget.dev);
        dump_state(dev);
        return 0;
@@ -2146,6 +2142,13 @@ static int __init pxa25x_udc_probe(struct platform_device *pdev)
        dev->gadget.dev.parent = &pdev->dev;
        dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        retval = device_add(&dev->gadget.dev);
+        if (retval) {
+                dev->driver = NULL;
+                dev->gadget.dev.driver = NULL;
+                goto err_device_add;
+        }
        the_controller = dev;
        platform_set_drvdata(pdev, dev);
@@ -2196,6 +2199,8 @@ lubbock_fail0:
        free_irq(irq, dev);
 #endif
 err_irq1:
+        device_unregister(&dev->gadget.dev);
+ err_device_add:
        if (gpio_is_valid(dev->mach->gpio_pullup))
                gpio_free(dev->mach->gpio_pullup);
 err_gpio_pullup:
@@ -2217,10 +2222,11 @@ static int __exit pxa25x_udc_remove(struct platform_device *pdev)
 {
        struct pxa25x_udc *dev = platform_get_drvdata(pdev);
-        usb_del_gadget_udc(&dev->gadget);
        if (dev->driver)
                return -EBUSY;
+        usb_del_gadget_udc(&dev->gadget);
+        device_unregister(&dev->gadget.dev);
        dev->pullup = 0;
        pullup(dev);
diff --git a/drivers/usb/gadget/pxa27x_udc.c b/drivers/usb/gadget/pxa27x_udc.c
index f7d25795821a..2fc867652ef5 100644
--- a/drivers/usb/gadget/pxa27x_udc.c
+++ b/drivers/usb/gadget/pxa27x_udc.c
@@ -1814,11 +1814,6 @@ static int pxa27x_udc_start(struct usb_gadget *g,
        udc->gadget.dev.driver = &driver->driver;
        dplus_pullup(udc, 1);
-        retval = device_add(&udc->gadget.dev);
-        if (retval) {
-                dev_err(udc->dev, "device_add error %d\n", retval);
-                goto fail;
-        }
        if (!IS_ERR_OR_NULL(udc->transceiver)) {
                retval = otg_set_peripheral(udc->transceiver->otg,
                                                &udc->gadget);
@@ -1876,7 +1871,6 @@ static int pxa27x_udc_stop(struct usb_gadget *g,
        udc->driver = NULL;
-        device_del(&udc->gadget.dev);
        if (!IS_ERR_OR_NULL(udc->transceiver))
                return otg_set_peripheral(udc->transceiver->otg, NULL);
@@ -2480,13 +2474,24 @@ static int __init pxa_udc_probe(struct platform_device *pdev)
                        driver_name, udc->irq, retval);
                goto err_irq;
        }
+        retval = device_add(&udc->gadget.dev);
+        if (retval) {
+                dev_err(udc->dev, "device_add error %d\n", retval);
+                goto err_dev_add;
+        }
        retval = usb_add_gadget_udc(&pdev->dev, &udc->gadget);
        if (retval)
                goto err_add_udc;
        pxa_init_debugfs(udc);
        return 0;
 err_add_udc:
+        device_unregister(&udc->gadget.dev);
+err_dev_add:
        free_irq(udc->irq, udc);
 err_irq:
        iounmap(udc->regs);
@@ -2507,6 +2512,7 @@ static int __exit pxa_udc_remove(struct platform_device *_dev)
        int gpio = udc->mach->gpio_pullup;
        usb_del_gadget_udc(&udc->gadget);
+        device_del(&udc->gadget.dev);
        usb_gadget_unregister_driver(udc->driver);
        free_irq(udc->irq, udc);
        pxa_cleanup_debugfs(udc);
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index fc07b4381286..08f89652533b 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1668,8 +1668,7 @@ static void s3c2410_udc_enable(struct s3c2410_udc *dev)
 static int s3c2410_udc_start(struct usb_gadget *g,
                struct usb_gadget_driver *driver)
 {
-        struct s3c2410_udc *udc = to_s3c2410(g)
+        struct s3c2410_udc *udc = to_s3c2410(g);
-        int             retval;
        dprintk(DEBUG_NORMAL, "%s() '%s'\n", __func__, driver->driver.name);
@@ -1677,22 +1676,10 @@ static int s3c2410_udc_start(struct usb_gadget *g,
        udc->driver = driver;
        udc->gadget.dev.driver = &driver->driver;
-        /* Bind the driver */
-        retval = device_add(&udc->gadget.dev);
-        if (retval) {
-                dev_err(&udc->gadget.dev, "Error in device_add() : %d\n", retval);
-                goto register_error;
-        }
        /* Enable udc */
        s3c2410_udc_enable(udc);
        return 0;
-register_error:
-        udc->driver = NULL;
-        udc->gadget.dev.driver = NULL;
-        return retval;
 }
 static int s3c2410_udc_stop(struct usb_gadget *g,
@@ -1700,7 +1687,6 @@ static int s3c2410_udc_stop(struct usb_gadget *g,
 {
        struct s3c2410_udc *udc = to_s3c2410(g);
-        device_del(&udc->gadget.dev);
        udc->driver = NULL;
        /* Disable udc */
@@ -1842,6 +1828,13 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
        udc->gadget.dev.parent = &pdev->dev;
        udc->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        /* Bind the driver */
+        retval = device_add(&udc->gadget.dev);
+        if (retval) {
+                dev_err(&udc->gadget.dev, "Error in device_add() : %d\n", retval);
+                goto err_device_add;
+        }
        the_controller = udc;
        platform_set_drvdata(pdev, udc);
@@ -1930,6 +1923,8 @@ err_gpio_claim:
 err_int:
        free_irq(IRQ_USBD, udc);
 err_map:
+        device_unregister(&udc->gadget.dev);
+err_device_add:
        iounmap(base_addr);
 err_mem:
        release_mem_region(rsrc_start, rsrc_len);
@@ -1947,10 +1942,11 @@ static int s3c2410_udc_remove(struct platform_device *pdev)
        dev_dbg(&pdev->dev, "%s()\n", __func__);
-        usb_del_gadget_udc(&udc->gadget);
        if (udc->driver)
                return -EBUSY;
+        usb_del_gadget_udc(&udc->gadget);
+        device_unregister(&udc->gadget.dev);
        debugfs_remove(udc->regs_info);
        if (udc_info && !udc_info->udc_command &&
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index c5034d9c946b..b369292d4b90 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -136,7 +136,7 @@ static struct portmaster {
        pr_debug(fmt, ##arg)
 #endif /* pr_vdebug */
 #else
-#ifndef pr_vdebig
+#ifndef pr_vdebug
 #define pr_vdebug(fmt, arg...) \
        ({ if (0) pr_debug(fmt, ##arg); })
 #endif /* pr_vdebug */
diff --git a/drivers/usb/gadget/u_uac1.c b/drivers/usb/gadget/u_uac1.c
index e0c5e88e03ed..c7d460f43390 100644
--- a/drivers/usb/gadget/u_uac1.c
+++ b/drivers/usb/gadget/u_uac1.c
@@ -240,8 +240,11 @@ static int gaudio_open_snd_dev(struct gaudio *card)
        snd = &card->playback;
        snd->filp = filp_open(fn_play, O_WRONLY, 0);
        if (IS_ERR(snd->filp)) {
+                int ret = PTR_ERR(snd->filp);
                ERROR(card, "No such PCM playback device: %s\n", fn_play);
                snd->filp = NULL;
+                return ret;
        }
        pcm_file = snd->filp->private_data;
        snd->substream = pcm_file->substream;
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index 2a9cd369f71c..f8f62c3ed65e 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -216,7 +216,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
        usb_gadget_disconnect(udc->gadget);
        udc->driver->disconnect(udc->gadget);
        udc->driver->unbind(udc->gadget);
-        usb_gadget_udc_stop(udc->gadget, udc->driver);
+        usb_gadget_udc_stop(udc->gadget, NULL);
        udc->driver = NULL;
        udc->dev.driver = NULL;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index b416a3fc9959..416a6dce5e11 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -302,6 +302,7 @@ static void ehci_quiesce (struct ehci_hcd *ehci)
 static void end_unlink_async(struct ehci_hcd *ehci);
 static void unlink_empty_async(struct ehci_hcd *ehci);
+static void unlink_empty_async_suspended(struct ehci_hcd *ehci);
 static void ehci_work(struct ehci_hcd *ehci);
 static void start_unlink_intr(struct ehci_hcd *ehci, struct ehci_qh *qh);
 static void end_unlink_intr(struct ehci_hcd *ehci, struct ehci_qh *qh);
@@ -748,11 +749,9 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                /* guard against (alleged) silicon errata */
                if (cmd & CMD_IAAD)
                        ehci_dbg(ehci, "IAA with IAAD still set?\n");
-                if (ehci->async_iaa) {
+                if (ehci->async_iaa)
                        COUNT(ehci->stats.iaa);
-                        end_unlink_async(ehci);
+                end_unlink_async(ehci);
-                } else
-                        ehci_dbg(ehci, "IAA with nothing unlinked?\n");
        }
        /* remote wakeup [4.3.1] */
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 4d3b294f203e..7d06e77f6c4f 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -328,7 +328,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
        ehci->rh_state = EHCI_RH_SUSPENDED;
        end_unlink_async(ehci);
-        unlink_empty_async(ehci);
+        unlink_empty_async_suspended(ehci);
        ehci_handle_intr_unlinks(ehci);
        end_free_itds(ehci);
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index fd252f0cfb3a..23d136904285 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -135,7 +135,7 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 * qtd is updated in qh_completions(). Update the QH
                 * overlay here.
                 */
-                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
+                if (qh->hw->hw_token & ACTIVE_BIT(ehci)) {
                        qh->hw->hw_qtd_next = qtd->hw_next;
                        qtd = NULL;
                }
@@ -449,11 +449,19 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                        else if (last_status == -EINPROGRESS && !urb->unlinked)
                                continue;
-                        /* qh unlinked; token in overlay may be most current */
+                        /*
-                        if (state == QH_STATE_IDLE
+                         * If this was the active qtd when the qh was unlinked
-                                        && cpu_to_hc32(ehci, qtd->qtd_dma)
+                         * and the overlay's token is active, then the overlay
-                                                == hw->hw_current) {
+                         * hasn't been written back to the qtd yet so use its
+                         * token instead of the qtd's.  After the qtd is
+                         * processed and removed, the overlay won't be valid
+                         * any more.
+                         */
+                        if (state == QH_STATE_IDLE &&
+                                        qh->qtd_list.next == &qtd->qtd_list &&
+                                        (hw->hw_token & ACTIVE_BIT(ehci))) {
                                token = hc32_to_cpu(ehci, hw->hw_token);
+                                hw->hw_token &= ~ACTIVE_BIT(ehci);
                                /* An unlink may leave an incomplete
                                 * async transaction in the TT buffer.
@@ -1170,7 +1178,7 @@ static void single_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh)
        struct ehci_qh          *prev;
        /* Add to the end of the list of QHs waiting for the next IAAD */
-        qh->qh_state = QH_STATE_UNLINK;
+        qh->qh_state = QH_STATE_UNLINK_WAIT;
        if (ehci->async_unlink)
                ehci->async_unlink_last->unlink_next = qh;
        else
@@ -1213,9 +1221,19 @@ static void start_iaa_cycle(struct ehci_hcd *ehci, bool nested)
                /* Do only the first waiting QH (nVidia bug?) */
                qh = ehci->async_unlink;
-                ehci->async_iaa = qh;
-                ehci->async_unlink = qh->unlink_next;
+                /*
-                qh->unlink_next = NULL;
+                 * Intel (?) bug: The HC can write back the overlay region
+                 * even after the IAA interrupt occurs.  In self-defense,
+                 * always go through two IAA cycles for each QH.
+                 */
+                if (qh->qh_state == QH_STATE_UNLINK_WAIT) {
+                        qh->qh_state = QH_STATE_UNLINK;
+                } else {
+                        ehci->async_iaa = qh;
+                        ehci->async_unlink = qh->unlink_next;
+                        qh->unlink_next = NULL;
+                }
                /* Make sure the unlinks are all visible to the hardware */
                wmb();
@@ -1298,6 +1316,19 @@ static void unlink_empty_async(struct ehci_hcd *ehci)
        }
 }
+/* The root hub is suspended; unlink all the async QHs */
+static void unlink_empty_async_suspended(struct ehci_hcd *ehci)
+{
+        struct ehci_qh          *qh;
+        while (ehci->async->qh_next.qh) {
+                qh = ehci->async->qh_next.qh;
+                WARN_ON(!list_empty(&qh->qtd_list));
+                single_unlink_async(ehci, qh);
+        }
+        start_iaa_cycle(ehci, false);
+}
 /* makes sure the async qh will become idle */
 /* caller must own ehci->lock */
diff --git a/drivers/usb/host/ehci-timer.c b/drivers/usb/host/ehci-timer.c
index 20dbdcbe9b0f..c3fa1305f830 100644
--- a/drivers/usb/host/ehci-timer.c
+++ b/drivers/usb/host/ehci-timer.c
@@ -304,7 +304,7 @@ static void ehci_iaa_watchdog(struct ehci_hcd *ehci)
         * (a) SMP races against real IAA firing and retriggering, and
         * (b) clean HC shutdown, when IAA watchdog was pending.
         */
-        if (ehci->async_iaa) {
+        if (1) {
                u32 cmd, status;
                /* If we get here, IAA is *REALLY* late.  It's barely
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index f1f01a834ba7..849470b18831 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -350,7 +350,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
         * generate interrupts.  Don't even try to enable MSI.
         */
        if (xhci->quirks & XHCI_BROKEN_MSI)
-                return 0;
+                goto legacy_irq;
        /* unregister the legacy interrupt */
        if (hcd->irq)
@@ -371,6 +371,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                return -EINVAL;
        }
+ legacy_irq:
        /* fall back to legacy interrupt*/
        ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
                        hcd->irq_descr, hcd);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index f791bd0aee6c..2c510e4a7d4c 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -206,8 +206,8 @@ struct xhci_op_regs {
 /* bits 12:31 are reserved (and should be preserved on writes). */
 /* IMAN - Interrupt Management Register */
-#define IMAN_IP         (1 << 1)
+#define IMAN_IE         (1 << 1)
-#define IMAN_IE         (1 << 0)
+#define IMAN_IP         (1 << 0)
 /* USBSTS - USB status - status bitmasks */
 /* HC not running - set to 1 when run/stop bit is cleared. */
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 45b19e2c60ba..05e51432dd2f 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -7,11 +7,6 @@
 config USB_MUSB_HDRC
        tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
        depends on USB && USB_GADGET
-        select NOP_USB_XCEIV if (ARCH_DAVINCI || MACH_OMAP3EVM || BLACKFIN)
-        select NOP_USB_XCEIV if (SOC_TI81XX || SOC_AM33XX)
-        select TWL4030_USB if MACH_OMAP_3430SDP
-        select TWL6030_USB if MACH_OMAP_4430SDP || MACH_OMAP4_PANDA
-        select OMAP_CONTROL_USB if MACH_OMAP_4430SDP || MACH_OMAP4_PANDA
        select USB_OTG_UTILS
        help
          Say Y here if your system has a dual role high speed USB
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index 7c71769d71ff..41613a2b35e8 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -327,7 +327,7 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci)
                u8 devctl = musb_readb(mregs, MUSB_DEVCTL);
                int err;
-                err = musb->int_usb & USB_INTR_VBUSERROR;
+                err = musb->int_usb & MUSB_INTR_VBUSERROR;
                if (err) {
                        /*
                         * The Mentor core doesn't debounce VBUS as needed
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 60b41cc28da4..daec6e0f7e38 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1624,8 +1624,6 @@ EXPORT_SYMBOL_GPL(musb_dma_completion);
 /*-------------------------------------------------------------------------*/
-#ifdef CONFIG_SYSFS
 static ssize_t
 musb_mode_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
@@ -1742,8 +1740,6 @@ static const struct attribute_group musb_attr_group = {
        .attrs = musb_attributes,
 };
-#endif  /* sysfs */
 /* Only used to provide driver mode change events */
 static void musb_irq_work(struct work_struct *data)
 {
@@ -1968,11 +1964,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        if (status < 0)
                goto fail4;
-#ifdef CONFIG_SYSFS
        status = sysfs_create_group(&musb->controller->kobj, &musb_attr_group);
        if (status)
                goto fail5;
-#endif
        pm_runtime_put(musb->controller);
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index be18537c5f14..83eddedcd9be 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -141,7 +141,9 @@ static inline void map_dma_buffer(struct musb_request *request,
 static inline void unmap_dma_buffer(struct musb_request *request,
                                struct musb *musb)
 {
-        if (!is_buffer_mapped(request))
+        struct musb_ep *musb_ep = request->ep;
+        if (!is_buffer_mapped(request) || !musb_ep->dma)
                return;
        if (request->request.dma == DMA_ADDR_INVALID) {
@@ -195,7 +197,10 @@ __acquires(ep->musb->lock)
        ep->busy = 1;
        spin_unlock(&musb->lock);
-        unmap_dma_buffer(req, musb);
+        if (!dma_mapping_error(&musb->g.dev, request->dma))
+                unmap_dma_buffer(req, musb);
        if (request->status == 0)
                dev_dbg(musb->controller, "%s done request %p,  %d/%d\n",
                                ep->end_point.name, request,
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 1762354fe793..1a42a458f2c4 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -51,7 +51,7 @@ struct omap2430_glue {
 };
 #define glue_to_musb(g)         platform_get_drvdata(g->musb)
-struct omap2430_glue            *_glue;
+static struct omap2430_glue     *_glue;
 static struct timer_list musb_idle_timer;
@@ -237,9 +237,13 @@ void omap_musb_mailbox(enum omap_musb_vbus_id_status status)
 {
        struct omap2430_glue    *glue = _glue;
-        if (glue && glue_to_musb(glue)) {
+        if (!glue) {
-                glue->status = status;
+                pr_err("%s: musb core is not yet initialized\n", __func__);
-        } else {
+                return;
+        }
+        glue->status = status;
+        if (!glue_to_musb(glue)) {
                pr_err("%s: musb core is not yet ready\n", __func__);
                return;
        }
diff --git a/drivers/usb/otg/otg.c b/drivers/usb/otg/otg.c
index e1814397ca3a..2bd03d261a50 100644
--- a/drivers/usb/otg/otg.c
+++ b/drivers/usb/otg/otg.c
@@ -130,7 +130,7 @@ struct usb_phy *usb_get_phy(enum usb_phy_type type)
        spin_lock_irqsave(&phy_lock, flags);
        phy = __usb_find_phy(&phy_list, type);
-        if (IS_ERR(phy)) {
+        if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
                pr_err("unable to find transceiver of type %s\n",
                        usb_phy_type_string(type));
                goto err0;
@@ -228,7 +228,7 @@ struct usb_phy *usb_get_phy_dev(struct device *dev, u8 index)
        spin_lock_irqsave(&phy_lock, flags);
        phy = __usb_find_phy_dev(dev, &phy_bind_list, index);
-        if (IS_ERR(phy)) {
+        if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
                pr_err("unable to find transceiver\n");
                goto err0;
        }
@@ -301,8 +301,12 @@ EXPORT_SYMBOL(devm_usb_put_phy);
 */
 void usb_put_phy(struct usb_phy *x)
 {
-        if (x)
+        if (x) {
+                struct module *owner = x->dev->driver->owner;
                put_device(x->dev);
+                module_put(owner);
+        }
 }
 EXPORT_SYMBOL(usb_put_phy);
diff --git a/drivers/usb/phy/omap-control-usb.c b/drivers/usb/phy/omap-control-usb.c
index 5323b71c3521..1419ceda9759 100644
--- a/drivers/usb/phy/omap-control-usb.c
+++ b/drivers/usb/phy/omap-control-usb.c
@@ -219,32 +219,26 @@ static int omap_control_usb_probe(struct platform_device *pdev)
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                "control_dev_conf");
-        control_usb->dev_conf = devm_request_and_ioremap(&pdev->dev, res);
+        control_usb->dev_conf = devm_ioremap_resource(&pdev->dev, res);
-        if (!control_usb->dev_conf) {
+        if (IS_ERR(control_usb->dev_conf))
-                dev_err(&pdev->dev, "Failed to obtain io memory\n");
+                return PTR_ERR(control_usb->dev_conf);
-                return -EADDRNOTAVAIL;
-        }
        if (control_usb->type == OMAP_CTRL_DEV_TYPE1) {
                res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                        "otghs_control");
-                control_usb->otghs_control = devm_request_and_ioremap(
+                control_usb->otghs_control = devm_ioremap_resource(
                        &pdev->dev, res);
-                if (!control_usb->otghs_control) {
+                if (IS_ERR(control_usb->otghs_control))
-                        dev_err(&pdev->dev, "Failed to obtain io memory\n");
+                        return PTR_ERR(control_usb->otghs_control);
-                        return -EADDRNOTAVAIL;
-                }
        }
        if (control_usb->type == OMAP_CTRL_DEV_TYPE2) {
                res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                        "phy_power_usb");
-                control_usb->phy_power = devm_request_and_ioremap(
+                control_usb->phy_power = devm_ioremap_resource(
                        &pdev->dev, res);
-                if (!control_usb->phy_power) {
+                if (IS_ERR(control_usb->phy_power))
-                        dev_dbg(&pdev->dev, "Failed to obtain io memory\n");
+                        return PTR_ERR(control_usb->phy_power);
-                        return -EADDRNOTAVAIL;
-                }
                control_usb->sys_clk = devm_clk_get(control_usb->dev,
                        "sys_clkin");
diff --git a/drivers/usb/phy/omap-usb3.c b/drivers/usb/phy/omap-usb3.c
index fadc0c2b65bb..a6e60b1e102e 100644
--- a/drivers/usb/phy/omap-usb3.c
+++ b/drivers/usb/phy/omap-usb3.c
@@ -212,11 +212,9 @@ static int omap_usb3_probe(struct platform_device *pdev)
        }
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pll_ctrl");
-        phy->pll_ctrl_base = devm_request_and_ioremap(&pdev->dev, res);
+        phy->pll_ctrl_base = devm_ioremap_resource(&pdev->dev, res);
-        if (!phy->pll_ctrl_base) {
+        if (IS_ERR(phy->pll_ctrl_base))
-                dev_err(&pdev->dev, "ioremap of pll_ctrl failed\n");
+                return PTR_ERR(phy->pll_ctrl_base);
-                return -ENOMEM;
-        }
        phy->dev                = &pdev->dev;
diff --git a/drivers/usb/phy/samsung-usbphy.c b/drivers/usb/phy/samsung-usbphy.c
index 6ea553733832..967101ec15fd 100644
--- a/drivers/usb/phy/samsung-usbphy.c
+++ b/drivers/usb/phy/samsung-usbphy.c
@@ -787,11 +787,9 @@ static int samsung_usbphy_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        phy_base = devm_request_and_ioremap(dev, phy_mem);
+        phy_base = devm_ioremap_resource(dev, phy_mem);
-        if (!phy_base) {
+        if (IS_ERR(phy_base))
-                dev_err(dev, "%s: register mapping failed\n", __func__);
+                return PTR_ERR(phy_base);
-                return -ENXIO;
-        }
        sphy = devm_kzalloc(dev, sizeof(*sphy), GFP_KERNEL);
        if (!sphy)
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index cbd904b8fba5..4775f8209e55 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -62,7 +62,6 @@ static int is_irda(struct usb_serial *serial)
 }
 struct ark3116_private {
-        wait_queue_head_t       delta_msr_wait;
        struct async_icount     icount;
        int                     irda;   /* 1 for irda device */
@@ -146,7 +145,6 @@ static int ark3116_port_probe(struct usb_serial_port *port)
        if (!priv)
                return -ENOMEM;
-        init_waitqueue_head(&priv->delta_msr_wait);
        mutex_init(&priv->hw_lock);
        spin_lock_init(&priv->status_lock);
@@ -456,10 +454,14 @@ static int ark3116_ioctl(struct tty_struct *tty,
        case TIOCMIWAIT:
                for (;;) {
                        struct async_icount prev = priv->icount;
-                        interruptible_sleep_on(&priv->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        if ((prev.rng == priv->icount.rng) &&
                            (prev.dsr == priv->icount.dsr) &&
                            (prev.dcd == priv->icount.dcd) &&
@@ -580,7 +582,7 @@ static void ark3116_update_msr(struct usb_serial_port *port, __u8 msr)
                        priv->icount.dcd++;
                if (msr & UART_MSR_TERI)
                        priv->icount.rng++;
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 }
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index d255f66e708e..07d4650a32ab 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -80,7 +80,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
 struct ch341_private {
        spinlock_t lock; /* access lock */
-        wait_queue_head_t delta_msr_wait; /* wait queue for modem status */
        unsigned baud_rate; /* set baud rate */
        u8 line_control; /* set line control value RTS/DTR */
        u8 line_status; /* active status of modem control inputs */
@@ -252,7 +251,6 @@ static int ch341_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        priv->baud_rate = DEFAULT_BAUD_RATE;
        priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
@@ -298,7 +296,7 @@ static void ch341_dtr_rts(struct usb_serial_port *port, int on)
                priv->line_control &= ~(CH341_BIT_RTS | CH341_BIT_DTR);
        spin_unlock_irqrestore(&priv->lock, flags);
        ch341_set_handshake(port->serial->dev, priv->line_control);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
 }
 static void ch341_close(struct usb_serial_port *port)
@@ -491,7 +489,7 @@ static void ch341_read_int_callback(struct urb *urb)
                        tty_kref_put(tty);
                }
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 exit:
@@ -517,11 +515,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (!multi_change) {
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                multi_change = priv->multi_status_change;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index edc0f0dcad83..4747d1c328ff 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -85,6 +85,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
        { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
        { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
+        { USB_DEVICE(0x2405, 0x0003) }, /* West Mountain Radio RIGblaster Advantage */
        { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
        { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
        { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */
@@ -150,6 +151,25 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
        { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
        { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
+        { USB_DEVICE(0x1FB9, 0x0100) }, /* Lake Shore Model 121 Current Source */
+        { USB_DEVICE(0x1FB9, 0x0200) }, /* Lake Shore Model 218A Temperature Monitor */
+        { USB_DEVICE(0x1FB9, 0x0201) }, /* Lake Shore Model 219 Temperature Monitor */
+        { USB_DEVICE(0x1FB9, 0x0202) }, /* Lake Shore Model 233 Temperature Transmitter */
+        { USB_DEVICE(0x1FB9, 0x0203) }, /* Lake Shore Model 235 Temperature Transmitter */
+        { USB_DEVICE(0x1FB9, 0x0300) }, /* Lake Shore Model 335 Temperature Controller */
+        { USB_DEVICE(0x1FB9, 0x0301) }, /* Lake Shore Model 336 Temperature Controller */
+        { USB_DEVICE(0x1FB9, 0x0302) }, /* Lake Shore Model 350 Temperature Controller */
+        { USB_DEVICE(0x1FB9, 0x0303) }, /* Lake Shore Model 371 AC Bridge */
+        { USB_DEVICE(0x1FB9, 0x0400) }, /* Lake Shore Model 411 Handheld Gaussmeter */
+        { USB_DEVICE(0x1FB9, 0x0401) }, /* Lake Shore Model 425 Gaussmeter */
+        { USB_DEVICE(0x1FB9, 0x0402) }, /* Lake Shore Model 455A Gaussmeter */
+        { USB_DEVICE(0x1FB9, 0x0403) }, /* Lake Shore Model 475A Gaussmeter */
+        { USB_DEVICE(0x1FB9, 0x0404) }, /* Lake Shore Model 465 Three Axis Gaussmeter */
+        { USB_DEVICE(0x1FB9, 0x0600) }, /* Lake Shore Model 625A Superconducting MPS */
+        { USB_DEVICE(0x1FB9, 0x0601) }, /* Lake Shore Model 642A Magnet Power Supply */
+        { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
+        { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
+        { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
        { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
        { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
        { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 8efa19d0e9fb..ba7352e4187e 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -111,7 +111,6 @@ struct cypress_private {
        int baud_rate;                     /* stores current baud rate in
                                              integer form */
        int isthrottled;                   /* if throttled, discard reads */
-        wait_queue_head_t delta_msr_wait;  /* used for TIOCMIWAIT */
        char prev_status, diff_status;     /* used for TIOCMIWAIT */
        /* we pass a pointer to this as the argument sent to
           cypress_set_termios old_termios */
@@ -449,7 +448,6 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
                kfree(priv);
                return -ENOMEM;
        }
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_reset_configuration(serial->dev);
@@ -868,12 +866,16 @@ static int cypress_ioctl(struct tty_struct *tty,
        switch (cmd) {
        /* This code comes from drivers/char/serial.c and ftdi_sio.c */
        case TIOCMIWAIT:
-                while (priv != NULL) {
+                for (;;) {
-                        interruptible_sleep_on(&priv->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
-                        else {
+                        if (port->serial->disconnected)
+                                return -EIO;
+                        {
                                char diff = priv->diff_status;
                                if (diff == 0)
                                        return -EIO; /* no change => error */
@@ -1187,7 +1189,7 @@ static void cypress_read_int_callback(struct urb *urb)
        if (priv->current_status != priv->prev_status) {
                priv->diff_status |= priv->current_status ^
                        priv->prev_status;
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
                priv->prev_status = priv->current_status;
        }
        spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/f81232.c b/drivers/usb/serial/f81232.c
index b1b2dc64b50b..a172ad5c5ce8 100644
--- a/drivers/usb/serial/f81232.c
+++ b/drivers/usb/serial/f81232.c
@@ -47,7 +47,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
 struct f81232_private {
        spinlock_t lock;
-        wait_queue_head_t delta_msr_wait;
        u8 line_control;
        u8 line_status;
 };
@@ -111,7 +110,7 @@ static void f81232_process_read_urb(struct urb *urb)
        line_status = priv->line_status;
        priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
        spin_unlock_irqrestore(&priv->lock, flags);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        if (!urb->actual_length)
                return;
@@ -256,11 +255,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -322,7 +324,6 @@ static int f81232_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_set_serial_port_data(port, priv);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index edd162df49ca..d4809d551473 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -69,9 +69,7 @@ struct ftdi_private {
        int flags;              /* some ASYNC_xxxx flags are supported */
        unsigned long last_dtr_rts;     /* saved modem control outputs */
        struct async_icount     icount;
-        wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
        char prev_status;        /* Used for TIOCMIWAIT */
-        bool dev_gone;        /* Used to abort TIOCMIWAIT */
        char transmit_empty;    /* If transmitter is empty or not */
        __u16 interface;        /* FT2232C, FT2232H or FT4232H port interface
                                   (0 for FT232/245) */
@@ -1691,10 +1689,8 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
        kref_init(&priv->kref);
        mutex_init(&priv->cfg_lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        priv->flags = ASYNC_LOW_LATENCY;
-        priv->dev_gone = false;
        if (quirk && quirk->port_probe)
                quirk->port_probe(priv);
@@ -1840,8 +1836,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
 {
        struct ftdi_private *priv = usb_get_serial_port_data(port);
-        priv->dev_gone = true;
+        wake_up_interruptible(&port->delta_msr_wait);
-        wake_up_interruptible_all(&priv->delta_msr_wait);
        remove_sysfs_attrs(port);
@@ -1989,7 +1984,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
                if (diff_status & FTDI_RS0_RLSD)
                        priv->icount.dcd++;
-                wake_up_interruptible_all(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
                priv->prev_status = status;
        }
@@ -2440,11 +2435,15 @@ static int ftdi_ioctl(struct tty_struct *tty,
         */
        case TIOCMIWAIT:
                cprev = priv->icount;
-                while (!priv->dev_gone) {
+                for (;;) {
-                        interruptible_sleep_on(&priv->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = priv->icount;
                        if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
                            ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
@@ -2454,8 +2453,6 @@ static int ftdi_ioctl(struct tty_struct *tty,
                        }
                        cprev = cnow;
                }
-                return -EIO;
-                break;
        case TIOCSERGETLSR:
                return get_lsr_info(port, (struct serial_struct __user *)arg);
                break;
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 1a07b12ef341..81caf5623ee2 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -956,10 +956,7 @@ static void garmin_close(struct usb_serial_port *port)
        if (!serial)
                return;
-        mutex_lock(&port->serial->disc_mutex);
+        garmin_clear(garmin_data_p);
-        if (!port->serial->disconnected)
-                garmin_clear(garmin_data_p);
        /* shutdown our urbs */
        usb_kill_urb(port->read_urb);
@@ -968,8 +965,6 @@ static void garmin_close(struct usb_serial_port *port)
        /* keep reset state so we know that we must start a new session */
        if (garmin_data_p->state != STATE_RESET)
                garmin_data_p->state = STATE_DISCONNECTED;
-        mutex_unlock(&port->serial->disc_mutex);
 }
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index b00e5cbf741f..efd8b978128c 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -110,7 +110,6 @@ struct edgeport_port {
        wait_queue_head_t       wait_chase;             /* for handling sleeping while waiting for chase to finish */
        wait_queue_head_t       wait_open;              /* for handling sleeping while waiting for open to finish */
        wait_queue_head_t       wait_command;           /* for handling sleeping while waiting for command to finish */
-        wait_queue_head_t       delta_msr_wait;         /* for handling sleeping while waiting for msr change to happen */
        struct async_icount     icount;
        struct usb_serial_port  *port;                  /* loop back to the owner of this object */
@@ -884,7 +883,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
        /* initialize our wait queues */
        init_waitqueue_head(&edge_port->wait_open);
        init_waitqueue_head(&edge_port->wait_chase);
-        init_waitqueue_head(&edge_port->delta_msr_wait);
        init_waitqueue_head(&edge_port->wait_command);
        /* initialize our icount structure */
@@ -1669,13 +1667,17 @@ static int edge_ioctl(struct tty_struct *tty,
                dev_dbg(&port->dev, "%s (%d) TIOCMIWAIT\n", __func__,  port->number);
                cprev = edge_port->icount;
                while (1) {
-                        prepare_to_wait(&edge_port->delta_msr_wait,
+                        prepare_to_wait(&port->delta_msr_wait,
                                                &wait, TASK_INTERRUPTIBLE);
                        schedule();
-                        finish_wait(&edge_port->delta_msr_wait, &wait);
+                        finish_wait(&port->delta_msr_wait, &wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = edge_port->icount;
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -2051,7 +2053,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 newMsr)
                        icount->dcd++;
                if (newMsr & EDGEPORT_MSR_DELTA_RI)
                        icount->rng++;
-                wake_up_interruptible(&edge_port->delta_msr_wait);
+                wake_up_interruptible(&edge_port->port->delta_msr_wait);
        }
        /* Save the new modem status */
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index c23776679f70..7777172206de 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -87,9 +87,6 @@ struct edgeport_port {
        int close_pending;
        int lsr_event;
        struct async_icount     icount;
-        wait_queue_head_t       delta_msr_wait; /* for handling sleeping while
-                                                   waiting for msr change to
-                                                   happen */
        struct edgeport_serial  *edge_serial;
        struct usb_serial_port  *port;
        __u8 bUartMode;         /* Port type, 0: RS232, etc. */
@@ -1459,7 +1456,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
                        icount->dcd++;
                if (msr & EDGEPORT_MSR_DELTA_RI)
                        icount->rng++;
-                wake_up_interruptible(&edge_port->delta_msr_wait);
+                wake_up_interruptible(&edge_port->port->delta_msr_wait);
        }
        /* Save the new modem status */
@@ -1754,7 +1751,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
        dev = port->serial->dev;
        memset(&(edge_port->icount), 0x00, sizeof(edge_port->icount));
-        init_waitqueue_head(&edge_port->delta_msr_wait);
        /* turn off loopback */
        status = ti_do_config(edge_port, UMPC_SET_CLR_LOOPBACK, 0);
@@ -2434,10 +2430,14 @@ static int edge_ioctl(struct tty_struct *tty,
                dev_dbg(&port->dev, "%s - TIOCMIWAIT\n", __func__);
                cprev = edge_port->icount;
                while (1) {
-                        interruptible_sleep_on(&edge_port->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = edge_port->icount;
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -2649,6 +2649,7 @@ static struct usb_serial_driver edgeport_2port_device = {
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,
        .tiocmset               = edge_tiocmset,
+        .get_icount             = edge_get_icount,
        .write                  = edge_write,
        .write_room             = edge_write_room,
        .chars_in_buffer        = edge_chars_in_buffer,
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index a64d420f687b..06d5a60be2c4 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -114,8 +114,6 @@ struct mct_u232_private {
        unsigned char        last_msr;      /* Modem Status Register */
        unsigned int         rx_flags;      /* Throttling flags */
        struct async_icount  icount;
-        wait_queue_head_t    msr_wait;  /* for handling sleeping while waiting
-                                                for msr change to happen */
 };
 #define THROTTLED               0x01
@@ -409,7 +407,6 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->msr_wait);
        usb_set_serial_port_data(port, priv);
@@ -601,7 +598,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
                tty_kref_put(tty);
        }
 #endif
-        wake_up_interruptible(&priv->msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        spin_unlock_irqrestore(&priv->lock, flags);
 exit:
        retval = usb_submit_urb(urb, GFP_ATOMIC);
@@ -810,13 +807,17 @@ static int  mct_u232_ioctl(struct tty_struct *tty,
                cprev = mct_u232_port->icount;
                spin_unlock_irqrestore(&mct_u232_port->lock, flags);
                for ( ; ; ) {
-                        prepare_to_wait(&mct_u232_port->msr_wait,
+                        prepare_to_wait(&port->delta_msr_wait,
                                        &wait, TASK_INTERRUPTIBLE);
                        schedule();
-                        finish_wait(&mct_u232_port->msr_wait, &wait);
+                        finish_wait(&port->delta_msr_wait, &wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        spin_lock_irqsave(&mct_u232_port->lock, flags);
                        cnow = mct_u232_port->icount;
                        spin_unlock_irqrestore(&mct_u232_port->lock, flags);
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 809fb329eca5..b8051fa61911 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -219,7 +219,6 @@ struct moschip_port {
        char open;
        char open_ports;
        wait_queue_head_t wait_chase;   /* for handling sleeping while waiting for chase to finish */
-        wait_queue_head_t delta_msr_wait;       /* for handling sleeping while waiting for msr change to happen */
        int delta_msr_cond;
        struct async_icount icount;
        struct usb_serial_port *port;   /* loop back to the owner of this object */
@@ -423,6 +422,9 @@ static void mos7840_handle_new_msr(struct moschip_port *port, __u8 new_msr)
                        icount->rng++;
                        smp_wmb();
                }
+                mos7840_port->delta_msr_cond = 1;
+                wake_up_interruptible(&port->port->delta_msr_wait);
        }
 }
@@ -1127,7 +1129,6 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        /* initialize our wait queues */
        init_waitqueue_head(&mos7840_port->wait_chase);
-        init_waitqueue_head(&mos7840_port->delta_msr_wait);
        /* initialize our icount structure */
        memset(&(mos7840_port->icount), 0x00, sizeof(mos7840_port->icount));
@@ -2017,8 +2018,6 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
                        mos7840_port->read_urb_busy = false;
                }
        }
-        wake_up(&mos7840_port->delta_msr_wait);
-        mos7840_port->delta_msr_cond = 1;
        dev_dbg(&port->dev, "%s - mos7840_port->shadowLCR is End %x\n", __func__,
                mos7840_port->shadowLCR);
 }
@@ -2219,13 +2218,18 @@ static int mos7840_ioctl(struct tty_struct *tty,
                while (1) {
                        /* interruptible_sleep_on(&mos7840_port->delta_msr_wait); */
                        mos7840_port->delta_msr_cond = 0;
-                        wait_event_interruptible(mos7840_port->delta_msr_wait,
+                        wait_event_interruptible(port->delta_msr_wait,
-                                                 (mos7840_port->
+                                                 (port->serial->disconnected ||
+                                                  mos7840_port->
                                                  delta_msr_cond == 1));
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = mos7840_port->icount;
                        smp_rmb();
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f7d339d8187b..558adfc05007 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -341,6 +341,8 @@ static void option_instat_callback(struct urb *urb);
 #define CINTERION_PRODUCT_EU3_E                 0x0051
 #define CINTERION_PRODUCT_EU3_P                 0x0052
 #define CINTERION_PRODUCT_PH8                   0x0053
+#define CINTERION_PRODUCT_AH6                   0x0055
+#define CINTERION_PRODUCT_PLS8                  0x0060
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID                      0x0b3c
@@ -579,6 +581,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42),
                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c1f, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
@@ -1260,6 +1263,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AH6) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLS8) },
        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, 
        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index a958fd41b5b3..87c71ccfee87 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -188,7 +188,6 @@ struct oti6858_private {
        u8 setup_done;
        struct delayed_work delayed_setup_work;
-        wait_queue_head_t intr_wait;
        struct usb_serial_port *port;   /* USB port with which associated */
 };
@@ -339,7 +338,6 @@ static int oti6858_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->intr_wait);
        priv->port = port;
        INIT_DELAYED_WORK(&priv->delayed_setup_work, setup_line);
        INIT_DELAYED_WORK(&priv->delayed_write_work, send_data);
@@ -664,11 +662,15 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                wait_event_interruptible(priv->intr_wait,
+                wait_event_interruptible(port->delta_msr_wait,
+                                        port->serial->disconnected ||
                                        priv->status.pin_state != prev);
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->status.pin_state & PIN_MASK;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -763,7 +765,7 @@ static void oti6858_read_int_callback(struct urb *urb)
                if (!priv->transient) {
                        if (xs->pin_state != priv->status.pin_state)
-                                wake_up_interruptible(&priv->intr_wait);
+                                wake_up_interruptible(&port->delta_msr_wait);
                        memcpy(&priv->status, xs, OTI6858_CTRL_PKT_SIZE);
                }
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 54adc9125e5c..3b10018d89a3 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -139,7 +139,6 @@ struct pl2303_serial_private {
 struct pl2303_private {
        spinlock_t lock;
-        wait_queue_head_t delta_msr_wait;
        u8 line_control;
        u8 line_status;
 };
@@ -233,7 +232,6 @@ static int pl2303_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_set_serial_port_data(port, priv);
@@ -607,11 +605,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -719,7 +720,7 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
        spin_unlock_irqrestore(&priv->lock, flags);
        if (priv->line_status & UART_BREAK_ERROR)
                usb_serial_handle_break(port);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        tty = tty_port_tty_get(&port->port);
        if (!tty)
@@ -783,7 +784,7 @@ static void pl2303_process_read_urb(struct urb *urb)
        line_status = priv->line_status;
        priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
        spin_unlock_irqrestore(&priv->lock, flags);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        if (!urb->actual_length)
                return;
diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
index 9b1b96f2d095..31f81c3c15eb 100644
--- a/drivers/usb/serial/qcaux.c
+++ b/drivers/usb/serial/qcaux.c
@@ -69,6 +69,7 @@ static struct usb_device_id id_table[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfd, 0xff) },  /* NMEA */
        { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfe, 0xff) },  /* WMC */
        { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xff, 0xff) },  /* DIAG */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1fac, 0x0151, 0xff, 0xff, 0xff) },
        { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 24662547dc5b..59b32b782126 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -197,12 +197,15 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
        if (is_gobi1k) {
                /* Gobi 1K USB layout:
-                 * 0: serial port (doesn't respond)
+                 * 0: DM/DIAG (use libqcdm from ModemManager for communication)
                 * 1: serial port (doesn't respond)
                 * 2: AT-capable modem port
                 * 3: QMI/net
                 */
-                if (ifnum == 2)
+                if (ifnum == 0) {
+                        dev_dbg(dev, "Gobi 1K DM/DIAG interface found\n");
+                        altsetting = 1;
+                } else if (ifnum == 2)
                        dev_dbg(dev, "Modem port found\n");
                else
                        altsetting = -1;
diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
index 00e6c9bac8a3..75f125ddb0c9 100644
--- a/drivers/usb/serial/quatech2.c
+++ b/drivers/usb/serial/quatech2.c
@@ -128,7 +128,6 @@ struct qt2_port_private {
        u8          shadowLSR;
        u8          shadowMSR;
-        wait_queue_head_t   delta_msr_wait; /* Used for TIOCMIWAIT */
        struct async_icount icount;
        struct usb_serial_port *port;
@@ -506,8 +505,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                wait_event_interruptible(priv->delta_msr_wait,
+                wait_event_interruptible(port->delta_msr_wait,
-                                         ((priv->icount.rng != prev.rng) ||
+                                         (port->serial->disconnected ||
+                                          (priv->icount.rng != prev.rng) ||
                                          (priv->icount.dsr != prev.dsr) ||
                                          (priv->icount.dcd != prev.dcd) ||
                                          (priv->icount.cts != prev.cts)));
@@ -515,6 +515,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                cur = priv->icount;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -661,7 +664,9 @@ void qt2_process_read_urb(struct urb *urb)
                                                 __func__);
                                        break;
                                }
-                                tty_flip_buffer_push(&port->port);
+                                if (port_priv->is_open)
+                                        tty_flip_buffer_push(&port->port);
                                newport = *(ch + 3);
@@ -704,7 +709,8 @@ void qt2_process_read_urb(struct urb *urb)
                tty_insert_flip_string(&port->port, ch, 1);
        }
-        tty_flip_buffer_push(&port->port);
+        if (port_priv->is_open)
+                tty_flip_buffer_push(&port->port);
 }
 static void qt2_write_bulk_callback(struct urb *urb)
@@ -824,7 +830,6 @@ static int qt2_port_probe(struct usb_serial_port *port)
        spin_lock_init(&port_priv->lock);
        spin_lock_init(&port_priv->urb_lock);
-        init_waitqueue_head(&port_priv->delta_msr_wait);
        port_priv->port = port;
        port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -967,7 +972,7 @@ static void qt2_update_msr(struct usb_serial_port *port, unsigned char *ch)
                if (newMSR & UART_MSR_TERI)
                        port_priv->icount.rng++;
-                wake_up_interruptible(&port_priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 }
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 91ff8e3bddbd..549ef68ff5fa 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -149,7 +149,6 @@ enum spcp8x5_type {
 struct spcp8x5_private {
        spinlock_t      lock;
        enum spcp8x5_type       type;
-        wait_queue_head_t       delta_msr_wait;
        u8                      line_control;
        u8                      line_status;
 };
@@ -179,7 +178,6 @@ static int spcp8x5_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        priv->type = type;
        usb_set_serial_port_data(port , priv);
@@ -475,7 +473,7 @@ static void spcp8x5_process_read_urb(struct urb *urb)
        priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
        spin_unlock_irqrestore(&priv->lock, flags);
        /* wake up the wait for termios */
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        if (!urb->actual_length)
                return;
@@ -526,12 +524,15 @@ static int spcp8x5_wait_modem_info(struct usb_serial_port *port,
        while (1) {
                /* wake up in bulk read */
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
index b57cf841c5b6..4b2a19757b4d 100644
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -61,7 +61,6 @@ struct ssu100_port_private {
        spinlock_t status_lock;
        u8 shadowLSR;
        u8 shadowMSR;
-        wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
        struct async_icount icount;
 };
@@ -355,8 +354,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->status_lock, flags);
        while (1) {
-                wait_event_interruptible(priv->delta_msr_wait,
+                wait_event_interruptible(port->delta_msr_wait,
-                                         ((priv->icount.rng != prev.rng) ||
+                                         (port->serial->disconnected ||
+                                          (priv->icount.rng != prev.rng) ||
                                          (priv->icount.dsr != prev.dsr) ||
                                          (priv->icount.dcd != prev.dcd) ||
                                          (priv->icount.cts != prev.cts)));
@@ -364,6 +364,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->status_lock, flags);
                cur = priv->icount;
                spin_unlock_irqrestore(&priv->status_lock, flags);
@@ -445,7 +448,6 @@ static int ssu100_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->status_lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_set_serial_port_data(port, priv);
@@ -537,7 +539,7 @@ static void ssu100_update_msr(struct usb_serial_port *port, u8 msr)
                        priv->icount.dcd++;
                if (msr & UART_MSR_TERI)
                        priv->icount.rng++;
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 }
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 39cb9b807c3c..73deb029fc05 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -74,7 +74,6 @@ struct ti_port {
        int                     tp_flags;
        int                     tp_closing_wait;/* in .01 secs */
        struct async_icount     tp_icount;
-        wait_queue_head_t       tp_msr_wait;    /* wait for msr change */
        wait_queue_head_t       tp_write_wait;
        struct ti_device        *tp_tdev;
        struct usb_serial_port  *tp_port;
@@ -432,7 +431,6 @@ static int ti_port_probe(struct usb_serial_port *port)
        else
                tport->tp_uart_base_addr = TI_UART2_BASE_ADDR;
        tport->tp_closing_wait = closing_wait;
-        init_waitqueue_head(&tport->tp_msr_wait);
        init_waitqueue_head(&tport->tp_write_wait);
        if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE, GFP_KERNEL)) {
                kfree(tport);
@@ -784,9 +782,13 @@ static int ti_ioctl(struct tty_struct *tty,
                dev_dbg(&port->dev, "%s - TIOCMIWAIT\n", __func__);
                cprev = tport->tp_icount;
                while (1) {
-                        interruptible_sleep_on(&tport->tp_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = tport->tp_icount;
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -1392,7 +1394,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
                        icount->dcd++;
                if (msr & TI_MSR_DELTA_RI)
                        icount->rng++;
-                wake_up_interruptible(&tport->tp_msr_wait);
+                wake_up_interruptible(&tport->tp_port->delta_msr_wait);
                spin_unlock_irqrestore(&tport->tp_lock, flags);
        }
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index a19ed74d770d..2e70efa08b77 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -151,6 +151,7 @@ static void destroy_serial(struct kref *kref)
                }
        }
+        usb_put_intf(serial->interface);
        usb_put_dev(serial->dev);
        kfree(serial);
 }
@@ -620,7 +621,7 @@ static struct usb_serial *create_serial(struct usb_device *dev,
        }
        serial->dev = usb_get_dev(dev);
        serial->type = driver;
-        serial->interface = interface;
+        serial->interface = usb_get_intf(interface);
        kref_init(&serial->kref);
        mutex_init(&serial->disc_mutex);
        serial->minor = SERIAL_TTY_NO_MINOR;
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 7ab9046ae0ec..105d900150c1 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -92,8 +92,8 @@ int usb_stor_ucr61s2b_init(struct us_data *us)
        return 0;
 }
-/* This places the HUAWEI usb dongles in multi-port mode */
+/* This places the HUAWEI E220 devices in multi-port mode */
-static int usb_stor_huawei_feature_init(struct us_data *us)
+int usb_stor_huawei_e220_init(struct us_data *us)
 {
        int result;
@@ -104,75 +104,3 @@ static int usb_stor_huawei_feature_init(struct us_data *us)
        US_DEBUGP("Huawei mode set result is %d\n", result);
        return 0;
 }
-/*
- * It will send a scsi switch command called rewind' to huawei dongle.
- * When the dongle receives this command at the first time,
- * it will reboot immediately. After rebooted, it will ignore this command.
- * So it is  unnecessary to read its response.
- */
-static int usb_stor_huawei_scsi_init(struct us_data *us)
-{
-        int result = 0;
-        int act_len = 0;
-        struct bulk_cb_wrap *bcbw = (struct bulk_cb_wrap *) us->iobuf;
-        char rewind_cmd[] = {0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 0x01, 0x00,
-                        0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-        bcbw->Signature = cpu_to_le32(US_BULK_CB_SIGN);
-        bcbw->Tag = 0;
-        bcbw->DataTransferLength = 0;
-        bcbw->Flags = bcbw->Lun = 0;
-        bcbw->Length = sizeof(rewind_cmd);
-        memset(bcbw->CDB, 0, sizeof(bcbw->CDB));
-        memcpy(bcbw->CDB, rewind_cmd, sizeof(rewind_cmd));
-        result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, bcbw,
-                                        US_BULK_CB_WRAP_LEN, &act_len);
-        US_DEBUGP("transfer actual length=%d, result=%d\n", act_len, result);
-        return result;
-}
-/*
- * It tries to find the supported Huawei USB dongles.
- * In Huawei, they assign the following product IDs
- * for all of their mobile broadband dongles,
- * including the new dongles in the future.
- * So if the product ID is not included in this list,
- * it means it is not Huawei's mobile broadband dongles.
- */
-static int usb_stor_huawei_dongles_pid(struct us_data *us)
-{
-        struct usb_interface_descriptor *idesc;
-        int idProduct;
-        idesc = &us->pusb_intf->cur_altsetting->desc;
-        idProduct = le16_to_cpu(us->pusb_dev->descriptor.idProduct);
-        /* The first port is CDROM,
-         * means the dongle in the single port mode,
-         * and a switch command is required to be sent. */
-        if (idesc && idesc->bInterfaceNumber == 0) {
-                if ((idProduct == 0x1001)
-                        || (idProduct == 0x1003)
-                        || (idProduct == 0x1004)
-                        || (idProduct >= 0x1401 && idProduct <= 0x1500)
-                        || (idProduct >= 0x1505 && idProduct <= 0x1600)
-                        || (idProduct >= 0x1c02 && idProduct <= 0x2202)) {
-                        return 1;
-                }
-        }
-        return 0;
-}
-int usb_stor_huawei_init(struct us_data *us)
-{
-        int result = 0;
-        if (usb_stor_huawei_dongles_pid(us)) {
-                if (le16_to_cpu(us->pusb_dev->descriptor.idProduct) >= 0x1446)
-                        result = usb_stor_huawei_scsi_init(us);
-                else
-                        result = usb_stor_huawei_feature_init(us);
-        }
-        return result;
-}
diff --git a/drivers/usb/storage/initializers.h b/drivers/usb/storage/initializers.h
index 5376d4fc76f0..529327fbb06b 100644
--- a/drivers/usb/storage/initializers.h
+++ b/drivers/usb/storage/initializers.h
@@ -46,5 +46,5 @@ int usb_stor_euscsi_init(struct us_data *us);
 * flash reader */
 int usb_stor_ucr61s2b_init(struct us_data *us);
-/* This places the HUAWEI usb dongles in multi-port mode */
+/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_init(struct us_data *us);
+int usb_stor_huawei_e220_init(struct us_data *us);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 72923b56bbf6..1799335288bd 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -53,6 +53,14 @@
 * as opposed to devices that do something strangely or wrongly.
 */
+/* In-kernel mode switching is deprecated.  Do not add new devices to
+ * this list for the sole purpose of switching them to a different
+ * mode.  Existing userspace solutions are superior.
+ *
+ * New mode switching devices should instead be added to the database
+ * maintained at http://www.draisberghof.de/usb_modeswitch/
+ */
 #if !defined(CONFIG_USB_STORAGE_SDDR09) && \
                !defined(CONFIG_USB_STORAGE_SDDR09_MODULE)
 #define NO_SDDR09
@@ -488,6 +496,13 @@ UNUSUAL_DEV(  0x04e8, 0x5122, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+/* Added by Dmitry Artamonow <mad_soft@inbox.ru> */
+UNUSUAL_DEV(  0x04e8, 0x5136, 0x0000, 0x9999,
+                "Samsung",
+                "YP-Z3",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64),
 /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
 * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
 * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
@@ -1527,10 +1542,335 @@ UNUSUAL_DEV(  0x1210, 0x0003, 0x0100, 0x0100,
 /* Reported by fangxiaozhi <huananhu@huawei.com>
 * This brings the HUAWEI data card devices into multi-port mode
 */
-UNUSUAL_VENDOR_INTF(0x12d1, 0x08, 0x06, 0x50,
+UNUSUAL_DEV(  0x12d1, 0x1001, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1003, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1004, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1401, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1402, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1403, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1404, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1405, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1406, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1407, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1408, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1409, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x140A, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x140B, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x140C, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x140D, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x140E, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x140F, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1410, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1411, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1412, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1413, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1414, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1415, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1416, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1417, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1418, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1419, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x141A, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x141B, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x141C, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x141D, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x141E, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x141F, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1420, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1421, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1422, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1423, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1424, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1425, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1426, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1427, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1428, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1429, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x142A, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x142B, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x142C, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x142D, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x142E, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x142F, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1430, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1431, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1432, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1433, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1434, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1435, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1436, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1437, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1438, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x1439, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x143A, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x143B, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x143C, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x143D, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x143E, 0x0000, 0x0000,
+                "HUAWEI MOBILE",
+                "Mass Storage",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                0),
+UNUSUAL_DEV(  0x12d1, 0x143F, 0x0000, 0x0000,
                "HUAWEI MOBILE",
                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_init,
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
                0),
 /* Reported by Vilius Bilinkevicius <vilisas AT xxx DOT lt) */
diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 964ff22bf281..aeb00fc2d3be 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -27,6 +27,7 @@
 #include <linux/pci.h>
 #include <linux/uaccess.h>
 #include <linux/vfio.h>
+#include <linux/slab.h>
 #include "vfio_pci_private.h"
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 3639371fa697..a96509187deb 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -22,6 +22,7 @@
 #include <linux/vfio.h>
 #include <linux/wait.h>
 #include <linux/workqueue.h>
+#include <linux/slab.h>
 #include "vfio_pci_private.h"
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 959b1cd89e6a..ec6fb3fa59bb 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -339,7 +339,8 @@ static void handle_tx(struct vhost_net *net)
                                msg.msg_controllen = 0;
                                ubufs = NULL;
                        } else {
-                                struct ubuf_info *ubuf = &vq->ubuf_info[head];
+                                struct ubuf_info *ubuf;
+                                ubuf = vq->ubuf_info + vq->upend_idx;
                                vq->heads[vq->upend_idx].len =
                                        VHOST_DMA_IN_PROGRESS;
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 9951297b2427..43fb11ee2e8d 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -850,7 +850,7 @@ static int vhost_scsi_clear_endpoint(
        for (index = 0; index < vs->dev.nvqs; ++index) {
                if (!vhost_vq_access_ok(&vs->vqs[index])) {
                        ret = -EFAULT;
-                        goto err;
+                        goto err_dev;
                }
        }
        for (i = 0; i < VHOST_SCSI_MAX_TARGET; i++) {
@@ -860,10 +860,11 @@ static int vhost_scsi_clear_endpoint(
                if (!tv_tpg)
                        continue;
+                mutex_lock(&tv_tpg->tv_tpg_mutex);
                tv_tport = tv_tpg->tport;
                if (!tv_tport) {
                        ret = -ENODEV;
-                        goto err;
+                        goto err_tpg;
                }
                if (strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
@@ -872,16 +873,19 @@ static int vhost_scsi_clear_endpoint(
                                tv_tport->tport_name, tv_tpg->tport_tpgt,
                                t->vhost_wwpn, t->vhost_tpgt);
                        ret = -EINVAL;
-                        goto err;
+                        goto err_tpg;
                }
                tv_tpg->tv_tpg_vhost_count--;
                vs->vs_tpg[target] = NULL;
                vs->vs_endpoint = false;
+                mutex_unlock(&tv_tpg->tv_tpg_mutex);
        }
        mutex_unlock(&vs->dev.mutex);
        return 0;
-err:
+err_tpg:
+        mutex_unlock(&tv_tpg->tv_tpg_mutex);
+err_dev:
        mutex_unlock(&vs->dev.mutex);
        return ret;
 }
@@ -937,6 +941,7 @@ static void vhost_scsi_flush(struct vhost_scsi *vs)
        for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
                vhost_scsi_flush_vq(vs, i);
+        vhost_work_flush(&vs->dev, &vs->vs_completion_work);
 }
 static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 12cf5f31ee8f..025428e04c33 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -422,17 +422,22 @@ static int atmel_lcdfb_check_var(struct fb_var_screeninfo *var,
                        = var->bits_per_pixel;
                break;
        case 16:
+                /* Older SOCs use IBGR:555 rather than BGR:565. */
+                if (sinfo->have_intensity_bit)
+                        var->green.length = 5;
+                else
+                        var->green.length = 6;
                if (sinfo->lcd_wiring_mode == ATMEL_LCDC_WIRING_RGB) {
-                        /* RGB:565 mode */
+                        /* RGB:5X5 mode */
-                        var->red.offset = 11;
+                        var->red.offset = var->green.length + 5;
                        var->blue.offset = 0;
                } else {
-                        /* BGR:565 mode */
+                        /* BGR:5X5 mode */
                        var->red.offset = 0;
-                        var->blue.offset = 11;
+                        var->blue.offset = var->green.length + 5;
                }
                var->green.offset = 5;
-                var->green.length = 6;
                var->red.length = var->blue.length = 5;
                break;
        case 32:
@@ -679,8 +684,7 @@ static int atmel_lcdfb_setcolreg(unsigned int regno, unsigned int red,
        case FB_VISUAL_PSEUDOCOLOR:
                if (regno < 256) {
-                        if (cpu_is_at91sam9261() || cpu_is_at91sam9263()
+                        if (sinfo->have_intensity_bit) {
-                            || cpu_is_at91sam9rl()) {
                                /* old style I+BGR:555 */
                                val  = ((red   >> 11) & 0x001f);
                                val |= ((green >>  6) & 0x03e0);
@@ -870,6 +874,10 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
        }
        sinfo->info = info;
        sinfo->pdev = pdev;
+        if (cpu_is_at91sam9261() || cpu_is_at91sam9263() ||
+                                                        cpu_is_at91sam9rl()) {
+                sinfo->have_intensity_bit = true;
+        }
        strcpy(info->fix.id, sinfo->pdev->name);
        info->flags = ATMEL_LCDFB_FBINFO_DEFAULT;
diff --git a/drivers/video/ep93xx-fb.c b/drivers/video/ep93xx-fb.c
index 3f2519d30715..e06cd5d90c97 100644
--- a/drivers/video/ep93xx-fb.c
+++ b/drivers/video/ep93xx-fb.c
@@ -23,6 +23,7 @@
 #include <linux/slab.h>
 #include <linux/clk.h>
 #include <linux/fb.h>
+#include <linux/io.h>
 #include <linux/platform_data/video-ep93xx.h>
diff --git a/drivers/video/omap/lcd_ams_delta.c b/drivers/video/omap/lcd_ams_delta.c
index ed4cad87fbcd..4a5f2cd3d3bf 100644
--- a/drivers/video/omap/lcd_ams_delta.c
+++ b/drivers/video/omap/lcd_ams_delta.c
@@ -27,6 +27,7 @@
 #include <linux/lcd.h>
 #include <linux/gpio.h>
+#include <mach/hardware.h>
 #include <mach/board-ams-delta.h>
 #include "omapfb.h"
diff --git a/drivers/video/omap/lcd_osk.c b/drivers/video/omap/lcd_osk.c
index 3aa62da89195..7fbe04bce0ed 100644
--- a/drivers/video/omap/lcd_osk.c
+++ b/drivers/video/omap/lcd_osk.c
@@ -24,7 +24,10 @@
 #include <linux/platform_device.h>
 #include <asm/gpio.h>
+#include <mach/hardware.h>
 #include <mach/mux.h>
 #include "omapfb.h"
 static int osk_panel_init(struct lcd_panel *panel, struct omapfb_device *fbdev)
diff --git a/drivers/w1/masters/w1-gpio.c b/drivers/w1/masters/w1-gpio.c
index d39dfa4cc235..46d97014342e 100644
--- a/drivers/w1/masters/w1-gpio.c
+++ b/drivers/w1/masters/w1-gpio.c
@@ -47,11 +47,13 @@ static u8 w1_gpio_read_bit(void *data)
        return gpio_get_value(pdata->pin) ? 1 : 0;
 }
+#if defined(CONFIG_OF)
 static struct of_device_id w1_gpio_dt_ids[] = {
        { .compatible = "w1-gpio" },
        {}
 };
 MODULE_DEVICE_TABLE(of, w1_gpio_dt_ids);
+#endif
 static int w1_gpio_probe_dt(struct platform_device *pdev)
 {
@@ -158,7 +160,7 @@ static int w1_gpio_probe(struct platform_device *pdev)
        return err;
 }
-static int __exit w1_gpio_remove(struct platform_device *pdev)
+static int w1_gpio_remove(struct platform_device *pdev)
 {
        struct w1_bus_master *master = platform_get_drvdata(pdev);
        struct w1_gpio_platform_data *pdata = pdev->dev.platform_data;
@@ -210,7 +212,7 @@ static struct platform_driver w1_gpio_driver = {
                .of_match_table = of_match_ptr(w1_gpio_dt_ids),
        },
        .probe = w1_gpio_probe,
-        .remove = __exit_p(w1_gpio_remove),
+        .remove = w1_gpio_remove,
        .suspend = w1_gpio_suspend,
        .resume = w1_gpio_resume,
 };
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 7994d933f040..7ce277d2bb67 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -924,7 +924,8 @@ void w1_search(struct w1_master *dev, u8 search_type, w1_slave_found_callback cb
                        tmp64 = (triplet_ret >> 2);
                        rn |= (tmp64 << i);
-                        if (kthread_should_stop()) {
+                        /* ensure we're called from kthread and not by netlink callback */
+                        if (!dev->priv && kthread_should_stop()) {
                                mutex_unlock(&dev->bus_mutex);
                                dev_dbg(&dev->dev, "Abort w1_search\n");
                                return;
diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
index e3b8f757d2d3..0e9d8c479c35 100644
--- a/drivers/watchdog/sp5100_tco.c
+++ b/drivers/watchdog/sp5100_tco.c
@@ -40,13 +40,12 @@
 #include "sp5100_tco.h"
 /* Module and version information */
-#define TCO_VERSION "0.03"
+#define TCO_VERSION "0.05"
 #define TCO_MODULE_NAME "SP5100 TCO timer"
 #define TCO_DRIVER_NAME   TCO_MODULE_NAME ", v" TCO_VERSION
 /* internal variables */
 static u32 tcobase_phys;
-static u32 resbase_phys;
 static u32 tco_wdt_fired;
 static void __iomem *tcobase;
 static unsigned int pm_iobase;
@@ -54,10 +53,6 @@ static DEFINE_SPINLOCK(tco_lock);	/* Guards the hardware */
 static unsigned long timer_alive;
 static char tco_expect_close;
 static struct pci_dev *sp5100_tco_pci;
-static struct resource wdt_res = {
-        .name = "Watchdog Timer",
-        .flags = IORESOURCE_MEM,
-};
 /* the watchdog platform device */
 static struct platform_device *sp5100_tco_platform_device;
@@ -75,12 +70,6 @@ module_param(nowayout, bool, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started."
                " (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
-static unsigned int force_addr;
-module_param(force_addr, uint, 0);
-MODULE_PARM_DESC(force_addr, "Force the use of specified MMIO address."
-                " ONLY USE THIS PARAMETER IF YOU REALLY KNOW"
-                " WHAT YOU ARE DOING (default=none)");
 /*
 * Some TCO specific functions
 */
@@ -176,39 +165,6 @@ static void tco_timer_enable(void)
        }
 }
-static void tco_timer_disable(void)
-{
-        int val;
-        if (sp5100_tco_pci->revision >= 0x40) {
-                /* For SB800 or later */
-                /* Enable watchdog decode bit and Disable watchdog timer */
-                outb(SB800_PM_WATCHDOG_CONTROL, SB800_IO_PM_INDEX_REG);
-                val = inb(SB800_IO_PM_DATA_REG);
-                val |= SB800_PCI_WATCHDOG_DECODE_EN;
-                val |= SB800_PM_WATCHDOG_DISABLE;
-                outb(val, SB800_IO_PM_DATA_REG);
-        } else {
-                /* For SP5100 or SB7x0 */
-                /* Enable watchdog decode bit */
-                pci_read_config_dword(sp5100_tco_pci,
-                                      SP5100_PCI_WATCHDOG_MISC_REG,
-                                      &val);
-                val |= SP5100_PCI_WATCHDOG_DECODE_EN;
-                pci_write_config_dword(sp5100_tco_pci,
-                                       SP5100_PCI_WATCHDOG_MISC_REG,
-                                       val);
-                /* Disable Watchdog timer */
-                outb(SP5100_PM_WATCHDOG_CONTROL, SP5100_IO_PM_INDEX_REG);
-                val = inb(SP5100_IO_PM_DATA_REG);
-                val |= SP5100_PM_WATCHDOG_DISABLE;
-                outb(val, SP5100_IO_PM_DATA_REG);
-        }
-}
 /*
 *      /dev/watchdog handling
 */
@@ -361,7 +317,7 @@ static unsigned char sp5100_tco_setupdevice(void)
 {
        struct pci_dev *dev = NULL;
        const char *dev_name = NULL;
-        u32 val, tmp_val;
+        u32 val;
        u32 index_reg, data_reg, base_addr;
        /* Match the PCI device */
@@ -459,63 +415,8 @@ static unsigned char sp5100_tco_setupdevice(void)
        } else
                pr_debug("SBResource_MMIO is disabled(0x%04x)\n", val);
-        /*
+        pr_notice("failed to find MMIO address, giving up.\n");
-         * Lastly re-programming the watchdog timer MMIO address,
+        goto  unreg_region;
-         * This method is a last resort...
-         *
-         * Before re-programming, to ensure that the watchdog timer
-         * is disabled, disable the watchdog timer.
-         */
-        tco_timer_disable();
-        if (force_addr) {
-                /*
-                 * Force the use of watchdog timer MMIO address, and aligned to
-                 * 8byte boundary.
-                 */
-                force_addr &= ~0x7;
-                val = force_addr;
-                pr_info("Force the use of 0x%04x as MMIO address\n", val);
-        } else {
-                /*
-                 * Get empty slot into the resource tree for watchdog timer.
-                 */
-                if (allocate_resource(&iomem_resource,
-                                      &wdt_res,
-                                      SP5100_WDT_MEM_MAP_SIZE,
-                                      0xf0000000,
-                                      0xfffffff8,
-                                      0x8,
-                                      NULL,
-                                      NULL)) {
-                        pr_err("MMIO allocation failed\n");
-                        goto unreg_region;
-                }
-                val = resbase_phys = wdt_res.start;
-                pr_debug("Got 0x%04x from resource tree\n", val);
-        }
-        /* Restore to the low three bits */
-        outb(base_addr+0, index_reg);
-        tmp_val = val | (inb(data_reg) & 0x7);
-        /* Re-programming the watchdog timer base address */
-        outb(base_addr+0, index_reg);
-        outb((tmp_val >>  0) & 0xff, data_reg);
-        outb(base_addr+1, index_reg);
-        outb((tmp_val >>  8) & 0xff, data_reg);
-        outb(base_addr+2, index_reg);
-        outb((tmp_val >> 16) & 0xff, data_reg);
-        outb(base_addr+3, index_reg);
-        outb((tmp_val >> 24) & 0xff, data_reg);
-        if (!request_mem_region_exclusive(val, SP5100_WDT_MEM_MAP_SIZE,
-                                                                   dev_name)) {
-                pr_err("MMIO address 0x%04x already in use\n", val);
-                goto unreg_resource;
-        }
 setup_wdt:
        tcobase_phys = val;
@@ -555,9 +456,6 @@ setup_wdt:
 unreg_mem_region:
        release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-unreg_resource:
-        if (resbase_phys)
-                release_resource(&wdt_res);
 unreg_region:
        release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
 exit:
@@ -567,7 +465,6 @@ exit:
 static int sp5100_tco_init(struct platform_device *dev)
 {
        int ret;
-        char addr_str[16];
        /*
         * Check whether or not the hardware watchdog is there. If found, then
@@ -599,23 +496,14 @@ static int sp5100_tco_init(struct platform_device *dev)
        clear_bit(0, &timer_alive);
        /* Show module parameters */
-        if (force_addr == tcobase_phys)
+        pr_info("initialized (0x%p). heartbeat=%d sec (nowayout=%d)\n",
-                /* The force_addr is vaild */
+                tcobase, heartbeat, nowayout);
-                sprintf(addr_str, "0x%04x", force_addr);
-        else
-                strcpy(addr_str, "none");
-        pr_info("initialized (0x%p). heartbeat=%d sec (nowayout=%d, "
-                "force_addr=%s)\n",
-                tcobase, heartbeat, nowayout, addr_str);
        return 0;
 exit:
        iounmap(tcobase);
        release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-        if (resbase_phys)
-                release_resource(&wdt_res);
        release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
        return ret;
 }
@@ -630,8 +518,6 @@ static void sp5100_tco_cleanup(void)
        misc_deregister(&sp5100_tco_miscdev);
        iounmap(tcobase);
        release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-        if (resbase_phys)
-                release_resource(&wdt_res);
        release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
 }
diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h
index 71594a0c14b7..2b28c00da0df 100644
--- a/drivers/watchdog/sp5100_tco.h
+++ b/drivers/watchdog/sp5100_tco.h
@@ -57,7 +57,7 @@
 #define SB800_PM_WATCHDOG_DISABLE       (1 << 2)
 #define SB800_PM_WATCHDOG_SECOND_RES    (3 << 0)
 #define SB800_ACPI_MMIO_DECODE_EN       (1 << 0)
-#define SB800_ACPI_MMIO_SEL             (1 << 2)
+#define SB800_ACPI_MMIO_SEL             (1 << 1)
 #define SB800_PM_WDT_MMIO_OFFSET        0xB00
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index 316df65163cf..f3278a6603ca 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -500,16 +500,16 @@ static int __init xen_acpi_processor_init(void)
        (void)acpi_processor_preregister_performance(acpi_perf_data);
        for_each_possible_cpu(i) {
+                struct acpi_processor *pr;
                struct acpi_processor_performance *perf;
+                pr = per_cpu(processors, i);
                perf = per_cpu_ptr(acpi_perf_data, i);
-                rc = acpi_processor_register_performance(perf, i);
+                pr->performance = perf;
+                rc = acpi_processor_get_performance_info(pr);
                if (rc)
                        goto err_out;
        }
-        rc = acpi_processor_notify_smm(THIS_MODULE);
-        if (rc)
-                goto err_unregister;
        for_each_possible_cpu(i) {
                struct acpi_processor *_pr;
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 37c1f825f513..b98cf0c35725 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -113,7 +113,8 @@ void xen_pcibk_reset_device(struct pci_dev *dev)
                if (dev->msi_enabled)
                        pci_disable_msi(dev);
 #endif
-                pci_disable_device(dev);
+                if (pci_is_enabled(dev))
+                        pci_disable_device(dev);
                pci_write_config_word(dev, PCI_COMMAND, 0);
diff --git a/drivers/xen/xen-stub.c b/drivers/xen/xen-stub.c
index d85e411cbf89..bbef194c5b01 100644
--- a/drivers/xen/xen-stub.c
+++ b/drivers/xen/xen-stub.c
@@ -25,7 +25,6 @@
 #include <linux/export.h>
 #include <linux/types.h>
 #include <linux/acpi.h>
-#include <acpi/acpi_drivers.h>
 #include <xen/acpi.h>
 #ifdef CONFIG_ACPI
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 3e074dab2d57..9ac2eca681eb 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1467,8 +1467,11 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
        if (ret && !insert) {
                err = -ENOENT;
                goto out;
+        } else if (ret) {
+                err = -EIO;
+                WARN_ON(1);
+                goto out;
        }
-        BUG_ON(ret); /* Corruption */
        leaf = path->nodes[0];
        item_size = btrfs_item_size_nr(leaf, path->slots[0]);
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index af1d0605a5c1..5b4ea5f55b8f 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -591,6 +591,7 @@ void btrfs_drop_extent_cache(struct inode *inode, u64 start, u64 end,
                }
                compressed = test_bit(EXTENT_FLAG_COMPRESSED, &em->flags);
                clear_bit(EXTENT_FLAG_PINNED, &em->flags);
+                clear_bit(EXTENT_FLAG_LOGGING, &flags);
                remove_extent_mapping(em_tree, em);
                if (no_splits)
                        goto next;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index d1470adca8f8..ca1b767d51f7 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2312,6 +2312,7 @@ again:
        key.type = BTRFS_EXTENT_DATA_KEY;
        key.offset = start;
+        path->leave_spinning = 1;
        if (merge) {
                struct btrfs_file_extent_item *fi;
                u64 extent_len;
@@ -2368,6 +2369,7 @@ again:
        btrfs_mark_buffer_dirty(leaf);
        inode_add_bytes(inode, len);
+        btrfs_release_path(path);
        ret = btrfs_inc_extent_ref(trans, root, new->bytenr,
                        new->disk_len, 0,
@@ -2381,6 +2383,7 @@ again:
        ret = 1;
 out_free_path:
        btrfs_release_path(path);
+        path->leave_spinning = 0;
        btrfs_end_transaction(trans, root);
 out_unlock:
        unlock_extent_cached(&BTRFS_I(inode)->io_tree, lock_start, lock_end,
diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
index ca52681e5f40..b81e0e9a4894 100644
--- a/fs/btrfs/locking.h
+++ b/fs/btrfs/locking.h
@@ -26,7 +26,6 @@
 void btrfs_tree_lock(struct extent_buffer *eb);
 void btrfs_tree_unlock(struct extent_buffer *eb);
-int btrfs_try_spin_lock(struct extent_buffer *eb);
 void btrfs_tree_read_lock(struct extent_buffer *eb);
 void btrfs_tree_read_unlock(struct extent_buffer *eb);
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index aee4b1cc3d98..5471e47d6559 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1525,21 +1525,23 @@ int btrfs_qgroup_reserve(struct btrfs_root *root, u64 num_bytes)
                if ((qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_RFER) &&
                    qg->reserved + qg->rfer + num_bytes >
-                    qg->max_rfer)
+                    qg->max_rfer) {
                        ret = -EDQUOT;
+                        goto out;
+                }
                if ((qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_EXCL) &&
                    qg->reserved + qg->excl + num_bytes >
-                    qg->max_excl)
+                    qg->max_excl) {
                        ret = -EDQUOT;
+                        goto out;
+                }
                list_for_each_entry(glist, &qg->groups, next_group) {
                        ulist_add(ulist, glist->group->qgroupid,
                                  (uintptr_t)glist->group, GFP_ATOMIC);
                }
        }
-        if (ret)
-                goto out;
        /*
         * no limits exceeded, now record the reservation into all qgroups
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 9250b9c4f01e..50767bbaad6c 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -625,14 +625,13 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
        btrfs_trans_release_metadata(trans, root);
        trans->block_rsv = NULL;
-        /*
-         * the same root has to be passed to start_transaction and
-         * end_transaction. Subvolume quota depends on this.
-         */
-        WARN_ON(trans->root != root);
        if (trans->qgroup_reserved) {
-                btrfs_qgroup_free(root, trans->qgroup_reserved);
+                /*
+                 * the same root has to be passed here between start_transaction
+                 * and end_transaction. Subvolume quota depends on this.
+                 */
+                btrfs_qgroup_free(trans->root, trans->qgroup_reserved);
                trans->qgroup_reserved = 0;
        }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 6b9cff42265d..5989a92236f7 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -684,6 +684,12 @@ int btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                __btrfs_close_devices(fs_devices);
                free_fs_devices(fs_devices);
        }
+        /*
+         * Wait for rcu kworkers under __btrfs_close_devices
+         * to finish all blkdev_puts so device is really
+         * free when umount is done.
+         */
+        rcu_barrier();
        return ret;
 }
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cfd1ce34e0bc..1d36db114772 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
                }
        }
-        /* mechlistMIC */
+        /*
-        if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+         * We currently ignore anything at the end of the SPNEGO blob after
-                /* Check if we have reached the end of the blob, but with
+         * the mechTypes have been parsed, since none of that info is
-                   no mechListMic (e.g. NTLMSSP instead of KRB5) */
+         * used at the moment.
-                if (ctx.error == ASN1_ERR_DEC_EMPTY)
+         */
-                        goto decode_negtoken_exit;
-                cFYI(1, "Error decoding last part negTokenInit exit3");
-                return 0;
-        } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-                /* tag = 3 indicating mechListMIC */
-                cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
-                        cls, con, tag, end, *end);
-                return 0;
-        }
-        /* sequence */
-        if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-                cFYI(1, "Error decoding last part negTokenInit exit5");
-                return 0;
-        } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
-                   || (tag != ASN1_SEQ)) {
-                cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
-                        cls, con, tag, end, *end);
-        }
-        /* sequence of */
-        if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-                cFYI(1, "Error decoding last part negTokenInit exit 7");
-                return 0;
-        } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-                cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
-                        cls, con, tag, end, *end);
-                return 0;
-        }
-        /* general string */
-        if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-                cFYI(1, "Error decoding last part negTokenInit exit9");
-                return 0;
-        } else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
-                   || (tag != ASN1_GENSTR)) {
-                cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
-                        cls, con, tag, end, *end);
-                return 0;
-        }
-        cFYI(1, "Need to call asn1_octets_decode() function for %s",
-                ctx.pointer);   /* is this UTF-8 or ASCII? */
-decode_negtoken_exit:
        return 1;
 }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 1a052c0eee8e..345fc89c4286 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -91,6 +91,30 @@ struct workqueue_struct	*cifsiod_wq;
 __u8 cifs_client_guid[SMB2_CLIENT_GUID_SIZE];
 #endif
+/*
+ * Bumps refcount for cifs super block.
+ * Note that it should be only called if a referece to VFS super block is
+ * already held, e.g. in open-type syscalls context. Otherwise it can race with
+ * atomic_dec_and_test in deactivate_locked_super.
+ */
+void
+cifs_sb_active(struct super_block *sb)
+{
+        struct cifs_sb_info *server = CIFS_SB(sb);
+        if (atomic_inc_return(&server->active) == 1)
+                atomic_inc(&sb->s_active);
+}
+void
+cifs_sb_deactive(struct super_block *sb)
+{
+        struct cifs_sb_info *server = CIFS_SB(sb);
+        if (atomic_dec_and_test(&server->active))
+                deactivate_super(sb);
+}
 static int
 cifs_read_super(struct super_block *sb)
 {
@@ -777,6 +801,7 @@ struct file_system_type cifs_fs_type = {
        .kill_sb = cifs_kill_sb,
        /*  .fs_flags */
 };
+MODULE_ALIAS_FS("cifs");
 const struct inode_operations cifs_dir_inode_ops = {
        .create = cifs_create,
        .atomic_open = cifs_atomic_open,
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 7163419cecd9..0e32c3446ce9 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_type;
 extern const struct address_space_operations cifs_addr_ops;
 extern const struct address_space_operations cifs_addr_ops_smallbuf;
+/* Functions related to super block operations */
+extern void cifs_sb_active(struct super_block *sb);
+extern void cifs_sb_deactive(struct super_block *sb);
 /* Functions related to inodes */
 extern const struct inode_operations cifs_dir_inode_ops;
 extern struct inode *cifs_root_iget(struct super_block *);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 8c0d85577314..7a0dd99e4507 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -300,6 +300,8 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
        INIT_WORK(&cfile->oplock_break, cifs_oplock_break);
        mutex_init(&cfile->fh_mutex);
+        cifs_sb_active(inode->i_sb);
        /*
         * If the server returned a read oplock and we have mandatory brlocks,
         * set oplock level to None.
@@ -349,7 +351,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
        struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
        struct TCP_Server_Info *server = tcon->ses->server;
        struct cifsInodeInfo *cifsi = CIFS_I(inode);
-        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        struct super_block *sb = inode->i_sb;
+        struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
        struct cifsLockInfo *li, *tmp;
        struct cifs_fid fid;
        struct cifs_pending_open open;
@@ -414,6 +417,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
        cifs_put_tlink(cifs_file->tlink);
        dput(cifs_file->dentry);
+        cifs_sb_deactive(sb);
        kfree(cifs_file);
 }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 0079696305c9..20887bf63121 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1043,7 +1043,7 @@ cifs_rename_pending_delete(const char *full_path, struct dentry *dentry,
                                   cifs_sb->mnt_cifs_flags &
                                            CIFS_MOUNT_MAP_SPECIAL_CHR);
        if (rc != 0) {
-                rc = -ETXTBSY;
+                rc = -EBUSY;
                goto undo_setattr;
        }
@@ -1062,7 +1062,7 @@ cifs_rename_pending_delete(const char *full_path, struct dentry *dentry,
                if (rc == -ENOENT)
                        rc = 0;
                else if (rc != 0) {
-                        rc = -ETXTBSY;
+                        rc = -EBUSY;
                        goto undo_rename;
                }
                cifsInode->delete_pending = true;
@@ -1169,15 +1169,13 @@ psx_del_no_retry:
                        cifs_drop_nlink(inode);
        } else if (rc == -ENOENT) {
                d_drop(dentry);
-        } else if (rc == -ETXTBSY) {
+        } else if (rc == -EBUSY) {
                if (server->ops->rename_pending_delete) {
                        rc = server->ops->rename_pending_delete(full_path,
                                                                dentry, xid);
                        if (rc == 0)
                                cifs_drop_nlink(inode);
                }
-                if (rc == -ETXTBSY)
-                        rc = -EBUSY;
        } else if ((rc == -EACCES) && (dosattr == 0) && inode) {
                attrs = kzalloc(sizeof(*attrs), GFP_KERNEL);
                if (attrs == NULL) {
@@ -1518,7 +1516,7 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry,
         * source. Note that cross directory moves do not work with
         * rename by filehandle to various Windows servers.
         */
-        if (rc == 0 || rc != -ETXTBSY)
+        if (rc == 0 || rc != -EBUSY)
                goto do_rename_exit;
        /* open-file renames don't work across directories */
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index a82bc51fdc82..c0b25b28be6c 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -62,7 +62,7 @@ static const struct smb_to_posix_error mapping_table_ERRDOS[] = {
        {ERRdiffdevice, -EXDEV},
        {ERRnofiles, -ENOENT},
        {ERRwriteprot, -EROFS},
-        {ERRbadshare, -ETXTBSY},
+        {ERRbadshare, -EBUSY},
        {ERRlock, -EACCES},
        {ERRunsup, -EINVAL},
        {ERRnosuchshare, -ENXIO},
diff --git a/fs/compat.c b/fs/compat.c
index fe40fde29111..d487985dd0ea 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -558,6 +558,10 @@ ssize_t compat_rw_copy_check_uvector(int type,
        }
        *ret_pointer = iov;
+        ret = -EFAULT;
+        if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
+                goto out;
        /*
         * Single unix specification:
         * We should -EINVAL if an element length is not >= 0 and fitting an
@@ -1080,17 +1084,12 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
        if (!file->f_op)
                goto out;
-        ret = -EFAULT;
+        ret = compat_rw_copy_check_uvector(type, uvector, nr_segs,
-        if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
-                goto out;
-        tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs,
                                               UIO_FASTIOV, iovstack, &iov);
-        if (tot_len == 0) {
+        if (ret <= 0)
-                ret = 0;
                goto out;
-        }
+        tot_len = ret;
        ret = rw_verify_area(type, file, pos, tot_len);
        if (ret < 0)
                goto out;
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index 8f370e012e61..7cadd823bb31 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -118,7 +118,6 @@ void ext2_free_inode (struct inode * inode)
         * as writing the quota to disk may need the lock as well.
         */
        /* Quota is already initialized in iput() */
-        ext2_xattr_delete_inode(inode);
        dquot_free_inode(inode);
        dquot_drop(inode);
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index c3881e56662e..fe60cc1117d8 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -34,6 +34,7 @@
 #include "ext2.h"
 #include "acl.h"
 #include "xip.h"
+#include "xattr.h"
 static int __ext2_write_inode(struct inode *inode, int do_sync);
@@ -88,6 +89,7 @@ void ext2_evict_inode(struct inode * inode)
                inode->i_size = 0;
                if (inode->i_blocks)
                        ext2_truncate_blocks(inode, 0);
+                ext2_xattr_delete_inode(inode);
        }
        invalidate_inode_buffers(inode);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 1d6e2ed85322..fb5120a5505c 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -353,7 +353,7 @@ static struct block_device *ext3_blkdev_get(dev_t dev, struct super_block *sb)
        return bdev;
 fail:
-        ext3_msg(sb, "error: failed to open journal device %s: %ld",
+        ext3_msg(sb, KERN_ERR, "error: failed to open journal device %s: %ld",
                __bdevname(dev, b), PTR_ERR(bdev));
        return NULL;
@@ -887,7 +887,7 @@ static ext3_fsblk_t get_sb_block(void **data, struct super_block *sb)
        /*todo: use simple_strtoll with >32bit ext3 */
        sb_block = simple_strtoul(options, &options, 0);
        if (*options && *options != ',') {
-                ext3_msg(sb, "error: invalid sb specification: %s",
+                ext3_msg(sb, KERN_ERR, "error: invalid sb specification: %s",
                       (char *) *data);
                return 1;
        }
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 4a01ba315262..3b83cd604796 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -335,9 +335,9 @@ struct ext4_group_desc
 */
 struct flex_groups {
-        atomic_t free_inodes;
+        atomic64_t      free_clusters;
-        atomic_t free_clusters;
+        atomic_t        free_inodes;
-        atomic_t used_dirs;
+        atomic_t        used_dirs;
 };
 #define EXT4_BG_INODE_UNINIT    0x0001 /* Inode table/bitmap not in use */
@@ -2617,7 +2617,7 @@ extern int ext4_move_extents(struct file *o_filp, struct file *d_filp,
 extern int __init ext4_init_pageio(void);
 extern void ext4_add_complete_io(ext4_io_end_t *io_end);
 extern void ext4_exit_pageio(void);
-extern void ext4_ioend_wait(struct inode *);
+extern void ext4_ioend_shutdown(struct inode *);
 extern void ext4_free_io_end(ext4_io_end_t *io);
 extern ext4_io_end_t *ext4_init_io_end(struct inode *inode, gfp_t flags);
 extern void ext4_end_io_work(struct work_struct *work);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 28dd8eeea6a9..56efcaadf848 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1584,10 +1584,12 @@ ext4_can_extents_be_merged(struct inode *inode, struct ext4_extent *ex1,
        unsigned short ext1_ee_len, ext2_ee_len, max_len;
        /*
-         * Make sure that either both extents are uninitialized, or
+         * Make sure that both extents are initialized. We don't merge
-         * both are _not_.
+         * uninitialized extents so that we can be sure that end_io code has
+         * the extent that was written properly split out and conversion to
+         * initialized is trivial.
         */
-        if (ext4_ext_is_uninitialized(ex1) ^ ext4_ext_is_uninitialized(ex2))
+        if (ext4_ext_is_uninitialized(ex1) || ext4_ext_is_uninitialized(ex2))
                return 0;
        if (ext4_ext_is_uninitialized(ex1))
@@ -2923,7 +2925,7 @@ static int ext4_split_extent_at(handle_t *handle,
 {
        ext4_fsblk_t newblock;
        ext4_lblk_t ee_block;
-        struct ext4_extent *ex, newex, orig_ex;
+        struct ext4_extent *ex, newex, orig_ex, zero_ex;
        struct ext4_extent *ex2 = NULL;
        unsigned int ee_len, depth;
        int err = 0;
@@ -2943,6 +2945,10 @@ static int ext4_split_extent_at(handle_t *handle,
        newblock = split - ee_block + ext4_ext_pblock(ex);
        BUG_ON(split < ee_block || split >= (ee_block + ee_len));
+        BUG_ON(!ext4_ext_is_uninitialized(ex) &&
+               split_flag & (EXT4_EXT_MAY_ZEROOUT |
+                             EXT4_EXT_MARK_UNINIT1 |
+                             EXT4_EXT_MARK_UNINIT2));
        err = ext4_ext_get_access(handle, inode, path + depth);
        if (err)
@@ -2990,12 +2996,26 @@ static int ext4_split_extent_at(handle_t *handle,
        err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
        if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
                if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
-                        if (split_flag & EXT4_EXT_DATA_VALID1)
+                        if (split_flag & EXT4_EXT_DATA_VALID1) {
                                err = ext4_ext_zeroout(inode, ex2);
-                        else
+                                zero_ex.ee_block = ex2->ee_block;
+                                zero_ex.ee_len = ext4_ext_get_actual_len(ex2);
+                                ext4_ext_store_pblock(&zero_ex,
+                                                      ext4_ext_pblock(ex2));
+                        } else {
                                err = ext4_ext_zeroout(inode, ex);
-                } else
+                                zero_ex.ee_block = ex->ee_block;
+                                zero_ex.ee_len = ext4_ext_get_actual_len(ex);
+                                ext4_ext_store_pblock(&zero_ex,
+                                                      ext4_ext_pblock(ex));
+                        }
+                } else {
                        err = ext4_ext_zeroout(inode, &orig_ex);
+                        zero_ex.ee_block = orig_ex.ee_block;
+                        zero_ex.ee_len = ext4_ext_get_actual_len(&orig_ex);
+                        ext4_ext_store_pblock(&zero_ex,
+                                              ext4_ext_pblock(&orig_ex));
+                }
                if (err)
                        goto fix_extent_len;
@@ -3003,6 +3023,12 @@ static int ext4_split_extent_at(handle_t *handle,
                ex->ee_len = cpu_to_le16(ee_len);
                ext4_ext_try_to_merge(handle, inode, path, ex);
                err = ext4_ext_dirty(handle, inode, path + path->p_depth);
+                if (err)
+                        goto fix_extent_len;
+                /* update extent status tree */
+                err = ext4_es_zeroout(inode, &zero_ex);
                goto out;
        } else if (err)
                goto fix_extent_len;
@@ -3041,6 +3067,7 @@ static int ext4_split_extent(handle_t *handle,
        int err = 0;
        int uninitialized;
        int split_flag1, flags1;
+        int allocated = map->m_len;
        depth = ext_depth(inode);
        ex = path[depth].p_ext;
@@ -3060,20 +3087,29 @@ static int ext4_split_extent(handle_t *handle,
                                map->m_lblk + map->m_len, split_flag1, flags1);
                if (err)
                        goto out;
+        } else {
+                allocated = ee_len - (map->m_lblk - ee_block);
        }
+        /*
+         * Update path is required because previous ext4_split_extent_at() may
+         * result in split of original leaf or extent zeroout.
+         */
        ext4_ext_drop_refs(path);
        path = ext4_ext_find_extent(inode, map->m_lblk, path);
        if (IS_ERR(path))
                return PTR_ERR(path);
+        depth = ext_depth(inode);
+        ex = path[depth].p_ext;
+        uninitialized = ext4_ext_is_uninitialized(ex);
+        split_flag1 = 0;
        if (map->m_lblk >= ee_block) {
-                split_flag1 = split_flag & (EXT4_EXT_MAY_ZEROOUT |
+                split_flag1 = split_flag & EXT4_EXT_DATA_VALID2;
-                                            EXT4_EXT_DATA_VALID2);
+                if (uninitialized) {
-                if (uninitialized)
                        split_flag1 |= EXT4_EXT_MARK_UNINIT1;
-                if (split_flag & EXT4_EXT_MARK_UNINIT2)
+                        split_flag1 |= split_flag & (EXT4_EXT_MAY_ZEROOUT |
-                        split_flag1 |= EXT4_EXT_MARK_UNINIT2;
+                                                     EXT4_EXT_MARK_UNINIT2);
+                }
                err = ext4_split_extent_at(handle, inode, path,
                                map->m_lblk, split_flag1, flags);
                if (err)
@@ -3082,7 +3118,7 @@ static int ext4_split_extent(handle_t *handle,
        ext4_ext_show_leaf(inode, path);
 out:
-        return err ? err : map->m_len;
+        return err ? err : allocated;
 }
 /*
@@ -3137,6 +3173,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
        ee_block = le32_to_cpu(ex->ee_block);
        ee_len = ext4_ext_get_actual_len(ex);
        allocated = ee_len - (map->m_lblk - ee_block);
+        zero_ex.ee_len = 0;
        trace_ext4_ext_convert_to_initialized_enter(inode, map, ex);
@@ -3227,13 +3264,16 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
        if (EXT4_EXT_MAY_ZEROOUT & split_flag)
                max_zeroout = sbi->s_extent_max_zeroout_kb >>
-                        inode->i_sb->s_blocksize_bits;
+                        (inode->i_sb->s_blocksize_bits - 10);
        /* If extent is less than s_max_zeroout_kb, zeroout directly */
        if (max_zeroout && (ee_len <= max_zeroout)) {
                err = ext4_ext_zeroout(inode, ex);
                if (err)
                        goto out;
+                zero_ex.ee_block = ex->ee_block;
+                zero_ex.ee_len = ext4_ext_get_actual_len(ex);
+                ext4_ext_store_pblock(&zero_ex, ext4_ext_pblock(ex));
                err = ext4_ext_get_access(handle, inode, path + depth);
                if (err)
@@ -3292,6 +3332,9 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                err = allocated;
 out:
+        /* If we have gotten a failure, don't zero out status tree */
+        if (!err)
+                err = ext4_es_zeroout(inode, &zero_ex);
        return err ? err : allocated;
 }
@@ -3374,8 +3417,19 @@ static int ext4_convert_unwritten_extents_endio(handle_t *handle,
                "block %llu, max_blocks %u\n", inode->i_ino,
                  (unsigned long long)ee_block, ee_len);
-        /* If extent is larger than requested then split is required */
+        /* If extent is larger than requested it is a clear sign that we still
+         * have some extent state machine issues left. So extent_split is still
+         * required.
+         * TODO: Once all related issues will be fixed this situation should be
+         * illegal.
+         */
        if (ee_block != map->m_lblk || ee_len > map->m_len) {
+#ifdef EXT4_DEBUG
+                ext4_warning("Inode (%ld) finished: extent logical block %llu,"
+                             " len %u; IO logical block %llu, len %u\n",
+                             inode->i_ino, (unsigned long long)ee_block, ee_len,
+                             (unsigned long long)map->m_lblk, map->m_len);
+#endif
                err = ext4_split_unwritten_extents(handle, inode, map, path,
                                                   EXT4_GET_BLOCKS_CONVERT);
                if (err < 0)
@@ -3626,6 +3680,10 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                                                 path, map->m_len);
                } else
                        err = ret;
+                map->m_flags |= EXT4_MAP_MAPPED;
+                if (allocated > map->m_len)
+                        allocated = map->m_len;
+                map->m_len = allocated;
                goto out2;
        }
        /* buffered IO case */
@@ -3675,6 +3733,7 @@ out:
                                        allocated - map->m_len);
                allocated = map->m_len;
        }
+        map->m_len = allocated;
        /*
         * If we have done fallocate with the offset that is already
@@ -4106,9 +4165,6 @@ got_allocated_blocks:
                        }
                } else {
                        BUG_ON(allocated_clusters < reserved_clusters);
-                        /* We will claim quota for all newly allocated blocks.*/
-                        ext4_da_update_reserve_space(inode, allocated_clusters,
-                                                        1);
                        if (reserved_clusters < allocated_clusters) {
                                struct ext4_inode_info *ei = EXT4_I(inode);
                                int reservation = allocated_clusters -
@@ -4159,6 +4215,15 @@ got_allocated_blocks:
                                ei->i_reserved_data_blocks += reservation;
                                spin_unlock(&ei->i_block_reservation_lock);
                        }
+                        /*
+                         * We will claim quota for all newly allocated blocks.
+                         * We're updating the reserved space *after* the
+                         * correction above so we do not accidentally free
+                         * all the metadata reservation because we might
+                         * actually need it later on.
+                         */
+                        ext4_da_update_reserve_space(inode, allocated_clusters,
+                                                        1);
                }
        }
@@ -4368,8 +4433,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
        if (len <= EXT_UNINIT_MAX_LEN << blkbits)
                flags |= EXT4_GET_BLOCKS_NO_NORMALIZE;
-        /* Prevent race condition between unwritten */
-        ext4_flush_unwritten_io(inode);
 retry:
        while (ret >= 0 && ret < max_blocks) {
                map.m_lblk = map.m_lblk + ret;
diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 95796a1b7522..fe3337a85ede 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -333,17 +333,27 @@ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
 static int ext4_es_can_be_merged(struct extent_status *es1,
                                 struct extent_status *es2)
 {
-        if (es1->es_lblk + es1->es_len != es2->es_lblk)
+        if (ext4_es_status(es1) != ext4_es_status(es2))
                return 0;
-        if (ext4_es_status(es1) != ext4_es_status(es2))
+        if (((__u64) es1->es_len) + es2->es_len > 0xFFFFFFFFULL)
                return 0;
-        if ((ext4_es_is_written(es1) || ext4_es_is_unwritten(es1)) &&
+        if (((__u64) es1->es_lblk) + es1->es_len != es2->es_lblk)
-            (ext4_es_pblock(es1) + es1->es_len != ext4_es_pblock(es2)))
                return 0;
-        return 1;
+        if ((ext4_es_is_written(es1) || ext4_es_is_unwritten(es1)) &&
+            (ext4_es_pblock(es1) + es1->es_len == ext4_es_pblock(es2)))
+                return 1;
+        if (ext4_es_is_hole(es1))
+                return 1;
+        /* we need to check delayed extent is without unwritten status */
+        if (ext4_es_is_delayed(es1) && !ext4_es_is_unwritten(es1))
+                return 1;
+        return 0;
 }
 static struct extent_status *
@@ -389,6 +399,179 @@ ext4_es_try_to_merge_right(struct inode *inode, struct extent_status *es)
        return es;
 }
+#ifdef ES_AGGRESSIVE_TEST
+static void ext4_es_insert_extent_ext_check(struct inode *inode,
+                                            struct extent_status *es)
+{
+        struct ext4_ext_path *path = NULL;
+        struct ext4_extent *ex;
+        ext4_lblk_t ee_block;
+        ext4_fsblk_t ee_start;
+        unsigned short ee_len;
+        int depth, ee_status, es_status;
+        path = ext4_ext_find_extent(inode, es->es_lblk, NULL);
+        if (IS_ERR(path))
+                return;
+        depth = ext_depth(inode);
+        ex = path[depth].p_ext;
+        if (ex) {
+                ee_block = le32_to_cpu(ex->ee_block);
+                ee_start = ext4_ext_pblock(ex);
+                ee_len = ext4_ext_get_actual_len(ex);
+                ee_status = ext4_ext_is_uninitialized(ex) ? 1 : 0;
+                es_status = ext4_es_is_unwritten(es) ? 1 : 0;
+                /*
+                 * Make sure ex and es are not overlap when we try to insert
+                 * a delayed/hole extent.
+                 */
+                if (!ext4_es_is_written(es) && !ext4_es_is_unwritten(es)) {
+                        if (in_range(es->es_lblk, ee_block, ee_len)) {
+                                pr_warn("ES insert assertation failed for "
+                                        "inode: %lu we can find an extent "
+                                        "at block [%d/%d/%llu/%c], but we "
+                                        "want to add an delayed/hole extent "
+                                        "[%d/%d/%llu/%llx]\n",
+                                        inode->i_ino, ee_block, ee_len,
+                                        ee_start, ee_status ? 'u' : 'w',
+                                        es->es_lblk, es->es_len,
+                                        ext4_es_pblock(es), ext4_es_status(es));
+                        }
+                        goto out;
+                }
+                /*
+                 * We don't check ee_block == es->es_lblk, etc. because es
+                 * might be a part of whole extent, vice versa.
+                 */
+                if (es->es_lblk < ee_block ||
+                    ext4_es_pblock(es) != ee_start + es->es_lblk - ee_block) {
+                        pr_warn("ES insert assertation failed for inode: %lu "
+                                "ex_status [%d/%d/%llu/%c] != "
+                                "es_status [%d/%d/%llu/%c]\n", inode->i_ino,
+                                ee_block, ee_len, ee_start,
+                                ee_status ? 'u' : 'w', es->es_lblk, es->es_len,
+                                ext4_es_pblock(es), es_status ? 'u' : 'w');
+                        goto out;
+                }
+                if (ee_status ^ es_status) {
+                        pr_warn("ES insert assertation failed for inode: %lu "
+                                "ex_status [%d/%d/%llu/%c] != "
+                                "es_status [%d/%d/%llu/%c]\n", inode->i_ino,
+                                ee_block, ee_len, ee_start,
+                                ee_status ? 'u' : 'w', es->es_lblk, es->es_len,
+                                ext4_es_pblock(es), es_status ? 'u' : 'w');
+                }
+        } else {
+                /*
+                 * We can't find an extent on disk.  So we need to make sure
+                 * that we don't want to add an written/unwritten extent.
+                 */
+                if (!ext4_es_is_delayed(es) && !ext4_es_is_hole(es)) {
+                        pr_warn("ES insert assertation failed for inode: %lu "
+                                "can't find an extent at block %d but we want "
+                                "to add an written/unwritten extent "
+                                "[%d/%d/%llu/%llx]\n", inode->i_ino,
+                                es->es_lblk, es->es_lblk, es->es_len,
+                                ext4_es_pblock(es), ext4_es_status(es));
+                }
+        }
+out:
+        if (path) {
+                ext4_ext_drop_refs(path);
+                kfree(path);
+        }
+}
+static void ext4_es_insert_extent_ind_check(struct inode *inode,
+                                            struct extent_status *es)
+{
+        struct ext4_map_blocks map;
+        int retval;
+        /*
+         * Here we call ext4_ind_map_blocks to lookup a block mapping because
+         * 'Indirect' structure is defined in indirect.c.  So we couldn't
+         * access direct/indirect tree from outside.  It is too dirty to define
+         * this function in indirect.c file.
+         */
+        map.m_lblk = es->es_lblk;
+        map.m_len = es->es_len;
+        retval = ext4_ind_map_blocks(NULL, inode, &map, 0);
+        if (retval > 0) {
+                if (ext4_es_is_delayed(es) || ext4_es_is_hole(es)) {
+                        /*
+                         * We want to add a delayed/hole extent but this
+                         * block has been allocated.
+                         */
+                        pr_warn("ES insert assertation failed for inode: %lu "
+                                "We can find blocks but we want to add a "
+                                "delayed/hole extent [%d/%d/%llu/%llx]\n",
+                                inode->i_ino, es->es_lblk, es->es_len,
+                                ext4_es_pblock(es), ext4_es_status(es));
+                        return;
+                } else if (ext4_es_is_written(es)) {
+                        if (retval != es->es_len) {
+                                pr_warn("ES insert assertation failed for "
+                                        "inode: %lu retval %d != es_len %d\n",
+                                        inode->i_ino, retval, es->es_len);
+                                return;
+                        }
+                        if (map.m_pblk != ext4_es_pblock(es)) {
+                                pr_warn("ES insert assertation failed for "
+                                        "inode: %lu m_pblk %llu != "
+                                        "es_pblk %llu\n",
+                                        inode->i_ino, map.m_pblk,
+                                        ext4_es_pblock(es));
+                                return;
+                        }
+                } else {
+                        /*
+                         * We don't need to check unwritten extent because
+                         * indirect-based file doesn't have it.
+                         */
+                        BUG_ON(1);
+                }
+        } else if (retval == 0) {
+                if (ext4_es_is_written(es)) {
+                        pr_warn("ES insert assertation failed for inode: %lu "
+                                "We can't find the block but we want to add "
+                                "an written extent [%d/%d/%llu/%llx]\n",
+                                inode->i_ino, es->es_lblk, es->es_len,
+                                ext4_es_pblock(es), ext4_es_status(es));
+                        return;
+                }
+        }
+}
+static inline void ext4_es_insert_extent_check(struct inode *inode,
+                                               struct extent_status *es)
+{
+        /*
+         * We don't need to worry about the race condition because
+         * caller takes i_data_sem locking.
+         */
+        BUG_ON(!rwsem_is_locked(&EXT4_I(inode)->i_data_sem));
+        if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+                ext4_es_insert_extent_ext_check(inode, es);
+        else
+                ext4_es_insert_extent_ind_check(inode, es);
+}
+#else
+static inline void ext4_es_insert_extent_check(struct inode *inode,
+                                               struct extent_status *es)
+{
+}
+#endif
 static int __es_insert_extent(struct inode *inode, struct extent_status *newes)
 {
        struct ext4_es_tree *tree = &EXT4_I(inode)->i_es_tree;
@@ -471,6 +654,8 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
        ext4_es_store_status(&newes, status);
        trace_ext4_es_insert_extent(inode, &newes);
+        ext4_es_insert_extent_check(inode, &newes);
        write_lock(&EXT4_I(inode)->i_es_lock);
        err = __es_remove_extent(inode, lblk, end);
        if (err != 0)
@@ -669,6 +854,23 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
        return err;
 }
+int ext4_es_zeroout(struct inode *inode, struct ext4_extent *ex)
+{
+        ext4_lblk_t  ee_block;
+        ext4_fsblk_t ee_pblock;
+        unsigned int ee_len;
+        ee_block  = le32_to_cpu(ex->ee_block);
+        ee_len    = ext4_ext_get_actual_len(ex);
+        ee_pblock = ext4_ext_pblock(ex);
+        if (ee_len == 0)
+                return 0;
+        return ext4_es_insert_extent(inode, ee_block, ee_len, ee_pblock,
+                                     EXTENT_STATUS_WRITTEN);
+}
 static int ext4_es_shrink(struct shrinker *shrink, struct shrink_control *sc)
 {
        struct ext4_sb_info *sbi = container_of(shrink,
diff --git a/fs/ext4/extents_status.h b/fs/ext4/extents_status.h
index f190dfe969da..d8e2d4dc311e 100644
--- a/fs/ext4/extents_status.h
+++ b/fs/ext4/extents_status.h
@@ -21,6 +21,12 @@
 #endif
 /*
+ * With ES_AGGRESSIVE_TEST defined, the result of es caching will be
+ * checked with old map_block's result.
+ */
+#define ES_AGGRESSIVE_TEST__
+/*
 * These flags live in the high bits of extent_status.es_pblk
 */
 #define EXTENT_STATUS_WRITTEN   (1ULL << 63)
@@ -33,6 +39,8 @@
                                 EXTENT_STATUS_DELAYED | \
                                 EXTENT_STATUS_HOLE)
+struct ext4_extent;
 struct extent_status {
        struct rb_node rb_node;
        ext4_lblk_t es_lblk;    /* first logical block extent covers */
@@ -58,6 +66,7 @@ extern void ext4_es_find_delayed_extent(struct inode *inode, ext4_lblk_t lblk,
                                        struct extent_status *es);
 extern int ext4_es_lookup_extent(struct inode *inode, ext4_lblk_t lblk,
                                 struct extent_status *es);
+extern int ext4_es_zeroout(struct inode *inode, struct ext4_extent *ex);
 static inline int ext4_es_is_written(struct extent_status *es)
 {
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 32fd2b9075dd..6c5bb8d993fe 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -324,8 +324,8 @@ error_return:
 }
 struct orlov_stats {
+        __u64 free_clusters;
        __u32 free_inodes;
-        __u32 free_clusters;
        __u32 used_dirs;
 };
@@ -342,7 +342,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
        if (flex_size > 1) {
                stats->free_inodes = atomic_read(&flex_group[g].free_inodes);
-                stats->free_clusters = atomic_read(&flex_group[g].free_clusters);
+                stats->free_clusters = atomic64_read(&flex_group[g].free_clusters);
                stats->used_dirs = atomic_read(&flex_group[g].used_dirs);
                return;
        }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 9ea0cde3fa9e..b3a5213bc73e 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -185,8 +185,6 @@ void ext4_evict_inode(struct inode *inode)
        trace_ext4_evict_inode(inode);
-        ext4_ioend_wait(inode);
        if (inode->i_nlink) {
                /*
                 * When journalling data dirty buffers are tracked only in the
@@ -207,7 +205,8 @@ void ext4_evict_inode(struct inode *inode)
                 * don't use page cache.
                 */
                if (ext4_should_journal_data(inode) &&
-                    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
+                    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
+                    inode->i_ino != EXT4_JOURNAL_INO) {
                        journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
                        tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
@@ -216,6 +215,7 @@ void ext4_evict_inode(struct inode *inode)
                        filemap_write_and_wait(&inode->i_data);
                }
                truncate_inode_pages(&inode->i_data, 0);
+                ext4_ioend_shutdown(inode);
                goto no_delete;
        }
@@ -225,6 +225,7 @@ void ext4_evict_inode(struct inode *inode)
        if (ext4_should_order_data(inode))
                ext4_begin_ordered_truncate(inode, 0);
        truncate_inode_pages(&inode->i_data, 0);
+        ext4_ioend_shutdown(inode);
        if (is_bad_inode(inode))
                goto no_delete;
@@ -482,6 +483,58 @@ static pgoff_t ext4_num_dirty_pages(struct inode *inode, pgoff_t idx,
        return num;
 }
+#ifdef ES_AGGRESSIVE_TEST
+static void ext4_map_blocks_es_recheck(handle_t *handle,
+                                       struct inode *inode,
+                                       struct ext4_map_blocks *es_map,
+                                       struct ext4_map_blocks *map,
+                                       int flags)
+{
+        int retval;
+        map->m_flags = 0;
+        /*
+         * There is a race window that the result is not the same.
+         * e.g. xfstests #223 when dioread_nolock enables.  The reason
+         * is that we lookup a block mapping in extent status tree with
+         * out taking i_data_sem.  So at the time the unwritten extent
+         * could be converted.
+         */
+        if (!(flags & EXT4_GET_BLOCKS_NO_LOCK))
+                down_read((&EXT4_I(inode)->i_data_sem));
+        if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+                retval = ext4_ext_map_blocks(handle, inode, map, flags &
+                                             EXT4_GET_BLOCKS_KEEP_SIZE);
+        } else {
+                retval = ext4_ind_map_blocks(handle, inode, map, flags &
+                                             EXT4_GET_BLOCKS_KEEP_SIZE);
+        }
+        if (!(flags & EXT4_GET_BLOCKS_NO_LOCK))
+                up_read((&EXT4_I(inode)->i_data_sem));
+        /*
+         * Clear EXT4_MAP_FROM_CLUSTER and EXT4_MAP_BOUNDARY flag
+         * because it shouldn't be marked in es_map->m_flags.
+         */
+        map->m_flags &= ~(EXT4_MAP_FROM_CLUSTER | EXT4_MAP_BOUNDARY);
+        /*
+         * We don't check m_len because extent will be collpased in status
+         * tree.  So the m_len might not equal.
+         */
+        if (es_map->m_lblk != map->m_lblk ||
+            es_map->m_flags != map->m_flags ||
+            es_map->m_pblk != map->m_pblk) {
+                printk("ES cache assertation failed for inode: %lu "
+                       "es_cached ex [%d/%d/%llu/%x] != "
+                       "found ex [%d/%d/%llu/%x] retval %d flags %x\n",
+                       inode->i_ino, es_map->m_lblk, es_map->m_len,
+                       es_map->m_pblk, es_map->m_flags, map->m_lblk,
+                       map->m_len, map->m_pblk, map->m_flags,
+                       retval, flags);
+        }
+}
+#endif /* ES_AGGRESSIVE_TEST */
 /*
 * The ext4_map_blocks() function tries to look up the requested blocks,
 * and returns if the blocks are already mapped.
@@ -509,6 +562,11 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
 {
        struct extent_status es;
        int retval;
+#ifdef ES_AGGRESSIVE_TEST
+        struct ext4_map_blocks orig_map;
+        memcpy(&orig_map, map, sizeof(*map));
+#endif
        map->m_flags = 0;
        ext_debug("ext4_map_blocks(): inode %lu, flag %d, max_blocks %u,"
@@ -531,6 +589,10 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
                } else {
                        BUG_ON(1);
                }
+#ifdef ES_AGGRESSIVE_TEST
+                ext4_map_blocks_es_recheck(handle, inode, map,
+                                           &orig_map, flags);
+#endif
                goto found;
        }
@@ -551,6 +613,15 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
                int ret;
                unsigned long long status;
+#ifdef ES_AGGRESSIVE_TEST
+                if (retval != map->m_len) {
+                        printk("ES len assertation failed for inode: %lu "
+                               "retval %d != map->m_len %d "
+                               "in %s (lookup)\n", inode->i_ino, retval,
+                               map->m_len, __func__);
+                }
+#endif
                status = map->m_flags & EXT4_MAP_UNWRITTEN ?
                                EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
                if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
@@ -643,6 +714,24 @@ found:
                int ret;
                unsigned long long status;
+#ifdef ES_AGGRESSIVE_TEST
+                if (retval != map->m_len) {
+                        printk("ES len assertation failed for inode: %lu "
+                               "retval %d != map->m_len %d "
+                               "in %s (allocation)\n", inode->i_ino, retval,
+                               map->m_len, __func__);
+                }
+#endif
+                /*
+                 * If the extent has been zeroed out, we don't need to update
+                 * extent status tree.
+                 */
+                if ((flags & EXT4_GET_BLOCKS_PRE_IO) &&
+                    ext4_es_lookup_extent(inode, map->m_lblk, &es)) {
+                        if (ext4_es_is_written(&es))
+                                goto has_zeroout;
+                }
                status = map->m_flags & EXT4_MAP_UNWRITTEN ?
                                EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
                if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
@@ -655,6 +744,7 @@ found:
                        retval = ret;
        }
+has_zeroout:
        up_write((&EXT4_I(inode)->i_data_sem));
        if (retval > 0 && map->m_flags & EXT4_MAP_MAPPED) {
                int ret = check_block_validity(inode, map);
@@ -1216,6 +1306,55 @@ static int ext4_journalled_write_end(struct file *file,
 }
 /*
+ * Reserve a metadata for a single block located at lblock
+ */
+static int ext4_da_reserve_metadata(struct inode *inode, ext4_lblk_t lblock)
+{
+        int retries = 0;
+        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned int md_needed;
+        ext4_lblk_t save_last_lblock;
+        int save_len;
+        /*
+         * recalculate the amount of metadata blocks to reserve
+         * in order to allocate nrblocks
+         * worse case is one extent per block
+         */
+repeat:
+        spin_lock(&ei->i_block_reservation_lock);
+        /*
+         * ext4_calc_metadata_amount() has side effects, which we have
+         * to be prepared undo if we fail to claim space.
+         */
+        save_len = ei->i_da_metadata_calc_len;
+        save_last_lblock = ei->i_da_metadata_calc_last_lblock;
+        md_needed = EXT4_NUM_B2C(sbi,
+                                 ext4_calc_metadata_amount(inode, lblock));
+        trace_ext4_da_reserve_space(inode, md_needed);
+        /*
+         * We do still charge estimated metadata to the sb though;
+         * we cannot afford to run out of free blocks.
+         */
+        if (ext4_claim_free_clusters(sbi, md_needed, 0)) {
+                ei->i_da_metadata_calc_len = save_len;
+                ei->i_da_metadata_calc_last_lblock = save_last_lblock;
+                spin_unlock(&ei->i_block_reservation_lock);
+                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
+                        cond_resched();
+                        goto repeat;
+                }
+                return -ENOSPC;
+        }
+        ei->i_reserved_meta_blocks += md_needed;
+        spin_unlock(&ei->i_block_reservation_lock);
+        return 0;       /* success */
+}
+/*
 * Reserve a single cluster located at lblock
 */
 static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock)
@@ -1263,7 +1402,7 @@ repeat:
                ei->i_da_metadata_calc_last_lblock = save_last_lblock;
                spin_unlock(&ei->i_block_reservation_lock);
                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
-                        yield();
+                        cond_resched();
                        goto repeat;
                }
                dquot_release_reservation_block(inode, EXT4_C2B(sbi, 1));
@@ -1768,6 +1907,11 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock,
        struct extent_status es;
        int retval;
        sector_t invalid_block = ~((sector_t) 0xffff);
+#ifdef ES_AGGRESSIVE_TEST
+        struct ext4_map_blocks orig_map;
+        memcpy(&orig_map, map, sizeof(*map));
+#endif
        if (invalid_block < ext4_blocks_count(EXT4_SB(inode->i_sb)->s_es))
                invalid_block = ~0;
@@ -1809,6 +1953,9 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock,
                else
                        BUG_ON(1);
+#ifdef ES_AGGRESSIVE_TEST
+                ext4_map_blocks_es_recheck(NULL, inode, map, &orig_map, 0);
+#endif
                return retval;
        }
@@ -1843,8 +1990,11 @@ add_delayed:
                 * XXX: __block_prepare_write() unmaps passed block,
                 * is it OK?
                 */
-                /* If the block was allocated from previously allocated cluster,
+                /*
-                 * then we dont need to reserve it again. */
+                 * If the block was allocated from previously allocated cluster,
+                 * then we don't need to reserve it again. However we still need
+                 * to reserve metadata for every block we're going to write.
+                 */
                if (!(map->m_flags & EXT4_MAP_FROM_CLUSTER)) {
                        ret = ext4_da_reserve_space(inode, iblock);
                        if (ret) {
@@ -1852,6 +2002,13 @@ add_delayed:
                                retval = ret;
                                goto out_unlock;
                        }
+                } else {
+                        ret = ext4_da_reserve_metadata(inode, iblock);
+                        if (ret) {
+                                /* not enough space to reserve */
+                                retval = ret;
+                                goto out_unlock;
+                        }
                }
                ret = ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
@@ -1873,6 +2030,15 @@ add_delayed:
                int ret;
                unsigned long long status;
+#ifdef ES_AGGRESSIVE_TEST
+                if (retval != map->m_len) {
+                        printk("ES len assertation failed for inode: %lu "
+                               "retval %d != map->m_len %d "
+                               "in %s (lookup)\n", inode->i_ino, retval,
+                               map->m_len, __func__);
+                }
+#endif
                status = map->m_flags & EXT4_MAP_UNWRITTEN ?
                                EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
                ret = ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
@@ -2908,8 +3074,8 @@ static int ext4_releasepage(struct page *page, gfp_t wait)
        trace_ext4_releasepage(page);
-        WARN_ON(PageChecked(page));
+        /* Page has dirty journalled data -> cannot release */
-        if (!page_has_buffers(page))
+        if (PageChecked(page))
                return 0;
        if (journal)
                return jbd2_journal_try_to_free_buffers(journal, page, wait);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 7bb713a46fe4..ee6614bdb639 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2804,8 +2804,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
        if (sbi->s_log_groups_per_flex) {
                ext4_group_t flex_group = ext4_flex_group(sbi,
                                                          ac->ac_b_ex.fe_group);
-                atomic_sub(ac->ac_b_ex.fe_len,
+                atomic64_sub(ac->ac_b_ex.fe_len,
-                           &sbi->s_flex_groups[flex_group].free_clusters);
+                             &sbi->s_flex_groups[flex_group].free_clusters);
        }
        err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
@@ -3692,11 +3692,7 @@ repeat:
        if (free < needed && busy) {
                busy = 0;
                ext4_unlock_group(sb, group);
-                /*
+                cond_resched();
-                 * Yield the CPU here so that we don't get soft lockup
-                 * in non preempt case.
-                 */
-                yield();
                goto repeat;
        }
@@ -4246,7 +4242,7 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle,
                        ext4_claim_free_clusters(sbi, ar->len, ar->flags)) {
                        /* let others to free the space */
-                        yield();
+                        cond_resched();
                        ar->len = ar->len >> 1;
                }
                if (!ar->len) {
@@ -4464,7 +4460,6 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
        struct buffer_head *bitmap_bh = NULL;
        struct super_block *sb = inode->i_sb;
        struct ext4_group_desc *gdp;
-        unsigned long freed = 0;
        unsigned int overflow;
        ext4_grpblk_t bit;
        struct buffer_head *gd_bh;
@@ -4666,14 +4661,12 @@ do_more:
        if (sbi->s_log_groups_per_flex) {
                ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
-                atomic_add(count_clusters,
+                atomic64_add(count_clusters,
-                           &sbi->s_flex_groups[flex_group].free_clusters);
+                             &sbi->s_flex_groups[flex_group].free_clusters);
        }
        ext4_mb_unload_buddy(&e4b);
-        freed += count;
        if (!(flags & EXT4_FREE_BLOCKS_NO_QUOT_UPDATE))
                dquot_free_block(inode, EXT4_C2B(sbi, count_clusters));
@@ -4811,8 +4804,8 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
        if (sbi->s_log_groups_per_flex) {
                ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
-                atomic_add(EXT4_NUM_B2C(sbi, blocks_freed),
+                atomic64_add(EXT4_NUM_B2C(sbi, blocks_freed),
-                           &sbi->s_flex_groups[flex_group].free_clusters);
+                             &sbi->s_flex_groups[flex_group].free_clusters);
        }
        ext4_mb_unload_buddy(&e4b);
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 4e81d47aa8cb..33e1c086858b 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -32,16 +32,18 @@
 */
 static inline int
 get_ext_path(struct inode *inode, ext4_lblk_t lblock,
-                struct ext4_ext_path **path)
+                struct ext4_ext_path **orig_path)
 {
        int ret = 0;
+        struct ext4_ext_path *path;
-        *path = ext4_ext_find_extent(inode, lblock, *path);
+        path = ext4_ext_find_extent(inode, lblock, *orig_path);
-        if (IS_ERR(*path)) {
+        if (IS_ERR(path))
-                ret = PTR_ERR(*path);
+                ret = PTR_ERR(path);
-                *path = NULL;
+        else if (path[ext_depth(inode)].p_ext == NULL)
-        } else if ((*path)[ext_depth(inode)].p_ext == NULL)
                ret = -ENODATA;
+        else
+                *orig_path = path;
        return ret;
 }
@@ -611,24 +613,25 @@ mext_check_coverage(struct inode *inode, ext4_lblk_t from, ext4_lblk_t count,
 {
        struct ext4_ext_path *path = NULL;
        struct ext4_extent *ext;
+        int ret = 0;
        ext4_lblk_t last = from + count;
        while (from < last) {
                *err = get_ext_path(inode, from, &path);
                if (*err)
-                        return 0;
+                        goto out;
                ext = path[ext_depth(inode)].p_ext;
-                if (!ext) {
+                if (uninit != ext4_ext_is_uninitialized(ext))
-                        ext4_ext_drop_refs(path);
+                        goto out;
-                        return 0;
-                }
-                if (uninit != ext4_ext_is_uninitialized(ext)) {
-                        ext4_ext_drop_refs(path);
-                        return 0;
-                }
                from += ext4_ext_get_actual_len(ext);
                ext4_ext_drop_refs(path);
        }
-        return 1;
+        ret = 1;
+out:
+        if (path) {
+                ext4_ext_drop_refs(path);
+                kfree(path);
+        }
+        return ret;
 }
 /**
@@ -666,6 +669,14 @@ mext_replace_branches(handle_t *handle, struct inode *orig_inode,
        int replaced_count = 0;
        int dext_alen;
+        *err = ext4_es_remove_extent(orig_inode, from, count);
+        if (*err)
+                goto out;
+        *err = ext4_es_remove_extent(donor_inode, from, count);
+        if (*err)
+                goto out;
        /* Get the original extent for the block "orig_off" */
        *err = get_ext_path(orig_inode, orig_off, &orig_path);
        if (*err)
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index 809b31003ecc..047a6de04a0a 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -50,11 +50,21 @@ void ext4_exit_pageio(void)
        kmem_cache_destroy(io_page_cachep);
 }
-void ext4_ioend_wait(struct inode *inode)
+/*
+ * This function is called by ext4_evict_inode() to make sure there is
+ * no more pending I/O completion work left to do.
+ */
+void ext4_ioend_shutdown(struct inode *inode)
 {
        wait_queue_head_t *wq = ext4_ioend_wq(inode);
        wait_event(*wq, (atomic_read(&EXT4_I(inode)->i_ioend_count) == 0));
+        /*
+         * We need to make sure the work structure is finished being
+         * used before we let the inode get destroyed.
+         */
+        if (work_pending(&EXT4_I(inode)->i_unwritten_work))
+                cancel_work_sync(&EXT4_I(inode)->i_unwritten_work);
 }
 static void put_io_page(struct ext4_io_page *io_page)
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index b2c8ee56eb98..c169477a62c9 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1360,8 +1360,8 @@ static void ext4_update_super(struct super_block *sb,
            sbi->s_log_groups_per_flex) {
                ext4_group_t flex_group;
                flex_group = ext4_flex_group(sbi, group_data[0].group);
-                atomic_add(EXT4_NUM_B2C(sbi, free_blocks),
+                atomic64_add(EXT4_NUM_B2C(sbi, free_blocks),
-                           &sbi->s_flex_groups[flex_group].free_clusters);
+                             &sbi->s_flex_groups[flex_group].free_clusters);
                atomic_add(EXT4_INODES_PER_GROUP(sb) * flex_gd->count,
                           &sbi->s_flex_groups[flex_group].free_inodes);
        }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 34e855219231..5d6d53578124 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -91,6 +91,7 @@ static struct file_system_type ext2_fs_type = {
        .fs_flags       = FS_REQUIRES_DEV,
 };
 MODULE_ALIAS_FS("ext2");
+MODULE_ALIAS("ext2");
 #define IS_EXT2_SB(sb) ((sb)->s_bdev->bd_holder == &ext2_fs_type)
 #else
 #define IS_EXT2_SB(sb) (0)
@@ -106,6 +107,7 @@ static struct file_system_type ext3_fs_type = {
        .fs_flags       = FS_REQUIRES_DEV,
 };
 MODULE_ALIAS_FS("ext3");
+MODULE_ALIAS("ext3");
 #define IS_EXT3_SB(sb) ((sb)->s_bdev->bd_holder == &ext3_fs_type)
 #else
 #define IS_EXT3_SB(sb) (0)
@@ -1925,8 +1927,8 @@ static int ext4_fill_flex_info(struct super_block *sb)
                flex_group = ext4_flex_group(sbi, i);
                atomic_add(ext4_free_inodes_count(sb, gdp),
                           &sbi->s_flex_groups[flex_group].free_inodes);
-                atomic_add(ext4_free_group_clusters(sb, gdp),
+                atomic64_add(ext4_free_group_clusters(sb, gdp),
-                           &sbi->s_flex_groups[flex_group].free_clusters);
+                             &sbi->s_flex_groups[flex_group].free_clusters);
                atomic_add(ext4_used_dirs_count(sb, gdp),
                           &sbi->s_flex_groups[flex_group].used_dirs);
        }
diff --git a/fs/freevxfs/vxfs_super.c b/fs/freevxfs/vxfs_super.c
index 455074308069..e37eb274e492 100644
--- a/fs/freevxfs/vxfs_super.c
+++ b/fs/freevxfs/vxfs_super.c
@@ -258,6 +258,7 @@ static struct file_system_type vxfs_fs_type = {
        .fs_flags       = FS_REQUIRES_DEV,
 };
 MODULE_ALIAS_FS("vxfs"); /* makes mount -t vxfs autoload the module */
+MODULE_ALIAS("vxfs");
 static int __init
 vxfs_init(void)
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index fbabb906066f..0f6e52d22b84 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -845,15 +845,8 @@ int hostfs_setattr(struct dentry *dentry, struct iattr *attr)
                return err;
        if ((attr->ia_valid & ATTR_SIZE) &&
-            attr->ia_size != i_size_read(inode)) {
+            attr->ia_size != i_size_read(inode))
-                int error;
-                error = inode_newsize_ok(inode, attr->ia_size);
-                if (error)
-                        return error;
                truncate_setsize(inode, attr->ia_size);
-        }
        setattr_copy(inode, attr);
        mark_inode_dirty(inode);
@@ -993,6 +986,7 @@ static struct file_system_type hostfs_type = {
        .kill_sb        = hostfs_kill_sb,
        .fs_flags       = 0,
 };
+MODULE_ALIAS_FS("hostfs");
 static int __init init_hostfs(void)
 {
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index a3076228523d..a0617e706957 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -688,6 +688,7 @@ static struct file_system_type hpfs_fs_type = {
        .kill_sb        = kill_block_super,
        .fs_flags       = FS_REQUIRES_DEV,
 };
+MODULE_ALIAS_FS("hpfs");
 static int __init init_hpfs_fs(void)
 {
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index a67f16e846a2..d9b8aebdeb22 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -1557,6 +1557,7 @@ static struct file_system_type iso9660_fs_type = {
        .fs_flags       = FS_REQUIRES_DEV,
 };
 MODULE_ALIAS_FS("iso9660");
+MODULE_ALIAS("iso9660");
 static int __init init_iso9660_fs(void)
 {
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index d6ee5aed56b1..325bc019ed88 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1065,9 +1065,12 @@ out:
 void jbd2_journal_set_triggers(struct buffer_head *bh,
                               struct jbd2_buffer_trigger_type *type)
 {
-        struct journal_head *jh = bh2jh(bh);
+        struct journal_head *jh = jbd2_journal_grab_journal_head(bh);
+        if (WARN_ON(!jh))
+                return;
        jh->b_triggers = type;
+        jbd2_journal_put_journal_head(jh);
 }
 void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
@@ -1119,17 +1122,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
 {
        transaction_t *transaction = handle->h_transaction;
        journal_t *journal = transaction->t_journal;
-        struct journal_head *jh = bh2jh(bh);
+        struct journal_head *jh;
        int ret = 0;
-        jbd_debug(5, "journal_head %p\n", jh);
-        JBUFFER_TRACE(jh, "entry");
        if (is_handle_aborted(handle))
                goto out;
-        if (!buffer_jbd(bh)) {
+        jh = jbd2_journal_grab_journal_head(bh);
+        if (!jh) {
                ret = -EUCLEAN;
                goto out;
        }
+        jbd_debug(5, "journal_head %p\n", jh);
+        JBUFFER_TRACE(jh, "entry");
        jbd_lock_bh_state(bh);
@@ -1220,6 +1224,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
        spin_unlock(&journal->j_list_lock);
 out_unlock_bh:
        jbd_unlock_bh_state(bh);
+        jbd2_journal_put_journal_head(jh);
 out:
        JBUFFER_TRACE(jh, "exit");
        WARN_ON(ret);   /* All errors are bugs, so dump the stack */
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 95cdcb208dfb..2f8a29db0f1b 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -335,6 +335,7 @@ struct file_system_type nfs4_fs_type = {
        .fs_flags       = FS_RENAME_DOES_D_MOVE|FS_BINARY_MOUNTDATA,
 };
 MODULE_ALIAS_FS("nfs4");
+MODULE_ALIAS("nfs4");
 EXPORT_SYMBOL_GPL(nfs4_fs_type);
 static int __init register_nfs4_fs(void)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 16d39c6c4fbb..2e27430b9070 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -230,37 +230,6 @@ static void nfs4_file_put_access(struct nfs4_file *fp, int oflag)
                __nfs4_file_put_access(fp, oflag);
 }
-static inline int get_new_stid(struct nfs4_stid *stid)
-{
-        static int min_stateid = 0;
-        struct idr *stateids = &stid->sc_client->cl_stateids;
-        int new_stid;
-        int error;
-        error = idr_get_new_above(stateids, stid, min_stateid, &new_stid);
-        /*
-         * Note: the necessary preallocation was done in
-         * nfs4_alloc_stateid().  The idr code caps the number of
-         * preallocations that can exist at a time, but the state lock
-         * prevents anyone from using ours before we get here:
-         */
-        WARN_ON_ONCE(error);
-        /*
-         * It shouldn't be a problem to reuse an opaque stateid value.
-         * I don't think it is for 4.1.  But with 4.0 I worry that, for
-         * example, a stray write retransmission could be accepted by
-         * the server when it should have been rejected.  Therefore,
-         * adopt a trick from the sctp code to attempt to maximize the
-         * amount of time until an id is reused, by ensuring they always
-         * "increase" (mod INT_MAX):
-         */
-        min_stateid = new_stid+1;
-        if (min_stateid == INT_MAX)
-                min_stateid = 0;
-        return new_stid;
-}
 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct
 kmem_cache *slab)
 {
@@ -273,9 +242,8 @@ kmem_cache *slab)
        if (!stid)
                return NULL;
-        if (!idr_pre_get(stateids, GFP_KERNEL))
+        new_id = idr_alloc(stateids, stid, min_stateid, 0, GFP_KERNEL);
-                goto out_free;
+        if (new_id < 0)
-        if (idr_get_new_above(stateids, stid, min_stateid, &new_id))
                goto out_free;
        stid->sc_client = cl;
        stid->sc_type = 0;
diff --git a/fs/pipe.c b/fs/pipe.c
index 64a494cef0a0..2234f3f61f8d 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -863,6 +863,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
 {
        int ret = -ENOENT;
+        if (!(filp->f_mode & (FMODE_READ|FMODE_WRITE)))
+                return -EINVAL;
        mutex_lock(&inode->i_mutex);
        if (inode->i_pipe) {
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index a86aebc9ba7c..869116c2afbe 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -446,9 +446,10 @@ static const struct file_operations proc_reg_file_ops_no_compat = {
 struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
 {
-        struct inode *inode = iget_locked(sb, de->low_ino);
+        struct inode *inode = new_inode_pseudo(sb);
-        if (inode && (inode->i_state & I_NEW)) {
+        if (inode) {
+                inode->i_ino = de->low_ino;
                inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
                PROC_I(inode)->pde = de;
@@ -476,7 +477,6 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
                                inode->i_fop = de->proc_fops;
                        }
                }
-                unlock_new_inode(inode);
        } else
               pde_put(de);
        return inode;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 05ae3c97f7a5..3e64169ef527 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1439,8 +1439,11 @@ static void __dquot_initialize(struct inode *inode, int type)
                         * did a write before quota was turned on
                         */
                        rsv = inode_get_rsv_space(inode);
-                        if (unlikely(rsv))
+                        if (unlikely(rsv)) {
+                                spin_lock(&dq_data_lock);
                                dquot_resv_space(inode->i_dquot[cnt], rsv);
+                                spin_unlock(&dq_data_lock);
+                        }
                }
        }
 out_err:
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 194113b1b11b..f8a23c3078f8 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1147,8 +1147,7 @@ static int reiserfs_parse_options(struct super_block *s, char *options,	/* strin
                                                         "on filesystem root.");
                                        return 0;
                                }
-                                qf_names[qtype] =
+                                qf_names[qtype] = kstrdup(arg, GFP_KERNEL);
-                                    kmalloc(strlen(arg) + 1, GFP_KERNEL);
                                if (!qf_names[qtype]) {
                                        reiserfs_warning(s, "reiserfs-2502",
                                                         "not enough memory "
@@ -1156,7 +1155,6 @@ static int reiserfs_parse_options(struct super_block *s, char *options,	/* strin
                                                         "quotafile name.");
                                        return 0;
                                }
-                                strcpy(qf_names[qtype], arg);
                                if (qtype == USRQUOTA)
                                        *mount_options |= 1 << REISERFS_USRQUOTA;
                                else
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 260e3928d4f5..60553a9053ca 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -489,6 +489,7 @@ static struct file_system_type squashfs_fs_type = {
        .kill_sb = kill_block_super,
        .fs_flags = FS_REQUIRES_DEV
 };
+MODULE_ALIAS_FS("squashfs");
 static const struct super_operations squashfs_super_ops = {
        .alloc_inode = squashfs_alloc_inode,
diff --git a/fs/sysv/super.c b/fs/sysv/super.c
index a39938b1feea..d0c6a007ce83 100644
--- a/fs/sysv/super.c
+++ b/fs/sysv/super.c
@@ -555,6 +555,7 @@ static struct file_system_type v7_fs_type = {
        .fs_flags       = FS_REQUIRES_DEV,
 };
 MODULE_ALIAS_FS("v7");
+MODULE_ALIAS("v7");
 static int __init init_sysv_fs(void)
 {
diff --git a/fs/udf/super.c b/fs/udf/super.c
index bc5b30a819e8..9ac4057a86c9 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -118,6 +118,7 @@ static struct file_system_type udf_fstype = {
        .kill_sb        = kill_block_super,
        .fs_flags       = FS_REQUIRES_DEV,
 };
+MODULE_ALIAS_FS("udf");
 static struct kmem_cache *udf_inode_cachep;
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 4e8f0df82d02..8459b5d8cb71 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1334,6 +1334,12 @@ _xfs_buf_ioapply(
        int             size;
        int             i;
+        /*
+         * Make sure we capture only current IO errors rather than stale errors
+         * left over from previous use of the buffer (e.g. failed readahead).
+         */
+        bp->b_error = 0;
        if (bp->b_flags & XBF_WRITE) {
                if (bp->b_flags & XBF_SYNCIO)
                        rw = WRITE_SYNC;
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 912d83d8860a..5a30dd899d2b 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -325,7 +325,7 @@ xfs_iomap_eof_want_preallocate(
 * rather than falling short due to things like stripe unit/width alignment of
 * real extents.
 */
-STATIC int
+STATIC xfs_fsblock_t
 xfs_iomap_eof_prealloc_initial_size(
        struct xfs_mount        *mp,
        struct xfs_inode        *ip,
@@ -413,7 +413,7 @@ xfs_iomap_prealloc_size(
                 * have a large file on a small filesystem and the above
                 * lowspace thresholds are smaller than MAXEXTLEN.
                 */
-                while (alloc_blocks >= freesp)
+                while (alloc_blocks && alloc_blocks >= freesp)
                        alloc_blocks >>= 4;
        }
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 555d0337ad95..b327b5a9296d 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -235,6 +235,9 @@ extern void acpi_processor_unregister_performance(struct
         if a _PPC object exists, rmmod is disallowed then */
 int acpi_processor_notify_smm(struct module *calling_module);
+/* parsing the _P* objects. */
+extern int acpi_processor_get_performance_info(struct acpi_processor *pr);
 /* for communication between multiple parts of the processor kernel module */
 DECLARE_PER_CPU(struct acpi_processor *, processors);
 extern struct acpi_processor_errata errata;
diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
index 1ced6413ea03..33bd2de3bc1e 100644
--- a/include/asm-generic/atomic.h
+++ b/include/asm-generic/atomic.h
@@ -136,12 +136,6 @@ static inline void atomic_dec(atomic_t *v)
 #define atomic_xchg(ptr, v)             (xchg(&(ptr)->counter, (v)))
 #define atomic_cmpxchg(v, old, new)     (cmpxchg(&((v)->counter), (old), (new)))
-#define cmpxchg_local(ptr, o, n)                                               \
-        ((__typeof__(*(ptr)))__cmpxchg_local_generic((ptr), (unsigned long)(o),\
-                        (unsigned long)(n), sizeof(*(ptr))))
-#define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
 {
  int c, old;
diff --git a/include/asm-generic/cmpxchg.h b/include/asm-generic/cmpxchg.h
index 14883026015d..811fb1e9b061 100644
--- a/include/asm-generic/cmpxchg.h
+++ b/include/asm-generic/cmpxchg.h
@@ -92,6 +92,16 @@ unsigned long __xchg(unsigned long x, volatile void *ptr, int size)
 */
 #include <asm-generic/cmpxchg-local.h>
+#ifndef cmpxchg_local
+#define cmpxchg_local(ptr, o, n)                                               \
+        ((__typeof__(*(ptr)))__cmpxchg_local_generic((ptr), (unsigned long)(o),\
+                        (unsigned long)(n), sizeof(*(ptr))))
+#endif
+#ifndef cmpxchg64_local
+#define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
+#endif
 #define cmpxchg(ptr, o, n)      cmpxchg_local((ptr), (o), (n))
 #define cmpxchg64(ptr, o, n)    cmpxchg64_local((ptr), (o), (n))
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index a386b0b654cc..918e8fe2f5e9 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -581,7 +581,11 @@
        {0x1002, 0x9908, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-        {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x990B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x990C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x990D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x990E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
@@ -592,6 +596,13 @@
        {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9996, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9998, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
diff --git a/include/linux/edac.h b/include/linux/edac.h
index 4fd4999ccb5b..0b763276f619 100644
--- a/include/linux/edac.h
+++ b/include/linux/edac.h
@@ -561,7 +561,6 @@ struct csrow_info {
        u32 ue_count;           /* Uncorrectable Errors for this csrow */
        u32 ce_count;           /* Correctable Errors for this csrow */
-        u32 nr_pages;           /* combined pages count of all channels */
        struct mem_ctl_info *mci;       /* the parent */
@@ -676,11 +675,11 @@ struct mem_ctl_info {
         * sees memory sticks ("dimms"), and the ones that sees memory ranks.
         * All old memory controllers enumerate memories per rank, but most
         * of the recent drivers enumerate memories per DIMM, instead.
-         * When the memory controller is per rank, mem_is_per_rank is true.
+         * When the memory controller is per rank, csbased is true.
         */
        unsigned n_layers;
        struct edac_mc_layer *layers;
-        bool mem_is_per_rank;
+        bool csbased;
        /*
         * DIMM info. Will eventually remove the entire csrows_info some day
@@ -741,8 +740,6 @@ struct mem_ctl_info {
        u32 fake_inject_ue;
        u16 fake_inject_count;
 #endif
-        __u8 csbased : 1,       /* csrow-based memory controller */
-             __resv  : 7;
 };
 #endif
diff --git a/include/linux/hash.h b/include/linux/hash.h
index 61c97ae22e01..f09a0ae4d858 100644
--- a/include/linux/hash.h
+++ b/include/linux/hash.h
@@ -15,6 +15,7 @@
 */
 #include <asm/types.h>
+#include <linux/compiler.h>
 /* 2^31 + 2^29 - 2^25 + 2^22 - 2^19 - 2^16 + 1 */
 #define GOLDEN_RATIO_PRIME_32 0x9e370001UL
@@ -31,7 +32,7 @@
 #error Wordsize not 32 or 64
 #endif
-static inline u64 hash_64(u64 val, unsigned int bits)
+static __always_inline u64 hash_64(u64 val, unsigned int bits)
 {
        u64 hash = val;
diff --git a/include/linux/idr.h b/include/linux/idr.h
index a6f38b5c34e4..2640c7e99e51 100644
--- a/include/linux/idr.h
+++ b/include/linux/idr.h
@@ -73,8 +73,6 @@ struct idr {
 */
 void *idr_find_slowpath(struct idr *idp, int id);
-int idr_pre_get(struct idr *idp, gfp_t gfp_mask);
-int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id);
 void idr_preload(gfp_t gfp_mask);
 int idr_alloc(struct idr *idp, void *ptr, int start, int end, gfp_t gfp_mask);
 int idr_for_each(struct idr *idp,
@@ -99,7 +97,7 @@ static inline void idr_preload_end(void)
 /**
 * idr_find - return pointer for given id
- * @idp: idr handle
+ * @idr: idr handle
 * @id: lookup key
 *
 * Return the pointer given the id it has been registered with.  A %NULL
@@ -120,19 +118,6 @@ static inline void *idr_find(struct idr *idr, int id)
 }
 /**
- * idr_get_new - allocate new idr entry
- * @idp: idr handle
- * @ptr: pointer you want associated with the id
- * @id: pointer to the allocated handle
- *
- * Simple wrapper around idr_get_new_above() w/ @starting_id of zero.
- */
-static inline int idr_get_new(struct idr *idp, void *ptr, int *id)
-{
-        return idr_get_new_above(idp, ptr, 0, id);
-}
-/**
 * idr_for_each_entry - iterate over an idr's elements of a given type
 * @idp:     idr handle
 * @entry:   the type * to use as cursor
@@ -143,7 +128,56 @@ static inline int idr_get_new(struct idr *idp, void *ptr, int *id)
             entry != NULL;                                             \
             ++id, entry = (typeof(entry))idr_get_next((idp), &(id)))
-void __idr_remove_all(struct idr *idp); /* don't use */
+/*
+ * Don't use the following functions.  These exist only to suppress
+ * deprecated warnings on EXPORT_SYMBOL()s.
+ */
+int __idr_pre_get(struct idr *idp, gfp_t gfp_mask);
+int __idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id);
+void __idr_remove_all(struct idr *idp);
+/**
+ * idr_pre_get - reserve resources for idr allocation
+ * @idp:        idr handle
+ * @gfp_mask:   memory allocation flags
+ *
+ * Part of old alloc interface.  This is going away.  Use
+ * idr_preload[_end]() and idr_alloc() instead.
+ */
+static inline int __deprecated idr_pre_get(struct idr *idp, gfp_t gfp_mask)
+{
+        return __idr_pre_get(idp, gfp_mask);
+}
+/**
+ * idr_get_new_above - allocate new idr entry above or equal to a start id
+ * @idp: idr handle
+ * @ptr: pointer you want associated with the id
+ * @starting_id: id to start search at
+ * @id: pointer to the allocated handle
+ *
+ * Part of old alloc interface.  This is going away.  Use
+ * idr_preload[_end]() and idr_alloc() instead.
+ */
+static inline int __deprecated idr_get_new_above(struct idr *idp, void *ptr,
+                                                 int starting_id, int *id)
+{
+        return __idr_get_new_above(idp, ptr, starting_id, id);
+}
+/**
+ * idr_get_new - allocate new idr entry
+ * @idp: idr handle
+ * @ptr: pointer you want associated with the id
+ * @id: pointer to the allocated handle
+ *
+ * Part of old alloc interface.  This is going away.  Use
+ * idr_preload[_end]() and idr_alloc() instead.
+ */
+static inline int __deprecated idr_get_new(struct idr *idp, void *ptr, int *id)
+{
+        return __idr_get_new_above(idp, ptr, 0, id);
+}
 /**
 * idr_remove_all - remove all ids from the given idr tree
diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
index 1f86a97ab2e2..8bd12be0b02f 100644
--- a/include/linux/iio/common/st_sensors.h
+++ b/include/linux/iio/common/st_sensors.h
@@ -227,14 +227,17 @@ struct st_sensor_data {
 };
 #ifdef CONFIG_IIO_BUFFER
+irqreturn_t st_sensors_trigger_handler(int irq, void *p);
+int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf);
+#endif
+#ifdef CONFIG_IIO_TRIGGER
 int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
                                const struct iio_trigger_ops *trigger_ops);
 void st_sensors_deallocate_trigger(struct iio_dev *indio_dev);
-irqreturn_t st_sensors_trigger_handler(int irq, void *p);
-int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf);
 #else
 static inline int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
                                const struct iio_trigger_ops *trigger_ops)
diff --git a/include/linux/irq_work.h b/include/linux/irq_work.h
index f5dbce50466e..66017028dcb3 100644
--- a/include/linux/irq_work.h
+++ b/include/linux/irq_work.h
@@ -37,7 +37,7 @@ void irq_work_sync(struct irq_work *work);
 #ifdef CONFIG_IRQ_WORK
 bool irq_work_needs_cpu(void);
 #else
-static bool irq_work_needs_cpu(void) { return false; }
+static inline bool irq_work_needs_cpu(void) { return false; }
 #endif
 #endif /* _LINUX_IRQ_WORK_H */
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 80d36874689b..79fdd80a42d4 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -390,7 +390,6 @@ extern struct pid *session_of_pgrp(struct pid *pgrp);
 unsigned long int_sqrt(unsigned long);
 extern void bust_spinlocks(int yes);
-extern void wake_up_klogd(void);
 extern int oops_in_progress;            /* If set, an oops, panic(), BUG() or die() is in progress */
 extern int panic_timeout;
 extern int panic_on_oops;
diff --git a/include/linux/list.h b/include/linux/list.h
index d991cc147c98..6a1f8df9144b 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -667,7 +667,9 @@ static inline void hlist_move_list(struct hlist_head *old,
             pos = n)
 #define hlist_entry_safe(ptr, type, member) \
-        (ptr) ? hlist_entry(ptr, type, member) : NULL
+        ({ typeof(ptr) ____ptr = (ptr); \
+           ____ptr ? hlist_entry(____ptr, type, member) : NULL; \
+        })
 /**
 * hlist_for_each_entry - iterate over list of given type
diff --git a/include/linux/mbus.h b/include/linux/mbus.h
index efa1a6d7aca8..dba482e31a13 100644
--- a/include/linux/mbus.h
+++ b/include/linux/mbus.h
@@ -32,6 +32,20 @@ struct mbus_dram_target_info
        } cs[4];
 };
+/* Flags for PCI/PCIe address decoding regions */
+#define MVEBU_MBUS_PCI_IO  0x1
+#define MVEBU_MBUS_PCI_MEM 0x2
+#define MVEBU_MBUS_PCI_WA  0x3
+/*
+ * Magic value that explicits that we don't need a remapping-capable
+ * address decoding window.
+ */
+#define MVEBU_MBUS_NO_REMAP (0xffffffff)
+/* Maximum size of a mbus window name */
+#define MVEBU_MBUS_MAX_WINNAME_SZ 32
 /*
 * The Marvell mbus is to be found only on SOCs from the Orion family
 * at the moment.  Provide a dummy stub for other architectures.
@@ -44,4 +58,15 @@ static inline const struct mbus_dram_target_info *mv_mbus_dram_info(void)
        return NULL;
 }
 #endif
-#endif
+int mvebu_mbus_add_window_remap_flags(const char *devname, phys_addr_t base,
+                                      size_t size, phys_addr_t remap,
+                                      unsigned int flags);
+int mvebu_mbus_add_window(const char *devname, phys_addr_t base,
+                          size_t size);
+int mvebu_mbus_del_window(phys_addr_t base, size_t size);
+int mvebu_mbus_init(const char *soc, phys_addr_t mbus_phys_base,
+                    size_t mbus_size, phys_addr_t sdram_phys_base,
+                    size_t sdram_size);
+#endif /* __LINUX_MBUS_H */
diff --git a/include/linux/mfd/palmas.h b/include/linux/mfd/palmas.h
index a4d13d7cd001..3bbda22721ea 100644
--- a/include/linux/mfd/palmas.h
+++ b/include/linux/mfd/palmas.h
@@ -221,6 +221,7 @@ struct palmas_clk_platform_data {
 };
 struct palmas_platform_data {
+        int irq_flags;
        int gpio_base;
        /* bit value to be loaded to the POWER_CTRL register */
diff --git a/include/linux/mfd/tps65912.h b/include/linux/mfd/tps65912.h
index aaceab402ec5..6d309032dc0d 100644
--- a/include/linux/mfd/tps65912.h
+++ b/include/linux/mfd/tps65912.h
@@ -323,5 +323,6 @@ int tps65912_device_init(struct tps65912 *tps65912);
 void tps65912_device_exit(struct tps65912 *tps65912);
 int tps65912_irq_init(struct tps65912 *tps65912, int irq,
                        struct tps65912_platform_data *pdata);
+int tps65912_irq_exit(struct tps65912 *tps65912);
 #endif /*  __LINUX_MFD_TPS65912_H */
diff --git a/include/linux/mfd/wm831x/auxadc.h b/include/linux/mfd/wm831x/auxadc.h
index b132067e9e99..867aa23f9370 100644
--- a/include/linux/mfd/wm831x/auxadc.h
+++ b/include/linux/mfd/wm831x/auxadc.h
@@ -15,6 +15,8 @@
 #ifndef __MFD_WM831X_AUXADC_H__
 #define __MFD_WM831X_AUXADC_H__
+struct wm831x;
 /*
 * R16429 (0x402D) - AuxADC Data
 */
diff --git a/include/linux/mfd/wm831x/core.h b/include/linux/mfd/wm831x/core.h
index 4a3b83a77614..76c22648436f 100644
--- a/include/linux/mfd/wm831x/core.h
+++ b/include/linux/mfd/wm831x/core.h
@@ -20,6 +20,7 @@
 #include <linux/irqdomain.h>
 #include <linux/list.h>
 #include <linux/regmap.h>
+#include <linux/mfd/wm831x/auxadc.h>
 /*
 * Register values.
@@ -355,7 +356,6 @@ enum wm831x_parent {
 };
 struct wm831x;
-enum wm831x_auxadc;
 typedef int (*wm831x_auxadc_read_fn)(struct wm831x *wm831x,
                                     enum wm831x_auxadc input);
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index ede274957e05..c74092eebf5c 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -527,7 +527,7 @@ static inline int zone_is_oom_locked(const struct zone *zone)
        return test_bit(ZONE_OOM_LOCKED, &zone->flags);
 }
-static inline unsigned zone_end_pfn(const struct zone *zone)
+static inline unsigned long zone_end_pfn(const struct zone *zone)
 {
        return zone->zone_start_pfn + zone->spanned_pages;
 }
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index 7ccb3c59ed60..ef52d9c91459 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -187,6 +187,13 @@ typedef enum {
 * This happens with the Renesas AG-AND chips, possibly others.
 */
 #define BBT_AUTO_REFRESH        0x00000080
+/*
+ * Chip requires ready check on read (for auto-incremented sequential read).
+ * True only for small page devices; large page devices do not support
+ * autoincrement.
+ */
+#define NAND_NEED_READRDY       0x00000100
 /* Chip does not allow subpage writes */
 #define NAND_NO_SUBPAGE_WRITE   0x00000200
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index c25cccaa555a..4fa3b0b9b071 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -137,6 +137,34 @@ enum {
        NVME_LBAF_RP_DEGRADED   = 3,
 };
+struct nvme_smart_log {
+        __u8                    critical_warning;
+        __u8                    temperature[2];
+        __u8                    avail_spare;
+        __u8                    spare_thresh;
+        __u8                    percent_used;
+        __u8                    rsvd6[26];
+        __u8                    data_units_read[16];
+        __u8                    data_units_written[16];
+        __u8                    host_reads[16];
+        __u8                    host_writes[16];
+        __u8                    ctrl_busy_time[16];
+        __u8                    power_cycles[16];
+        __u8                    power_on_hours[16];
+        __u8                    unsafe_shutdowns[16];
+        __u8                    media_errors[16];
+        __u8                    num_err_log_entries[16];
+        __u8                    rsvd192[320];
+};
+enum {
+        NVME_SMART_CRIT_SPARE           = 1 << 0,
+        NVME_SMART_CRIT_TEMPERATURE     = 1 << 1,
+        NVME_SMART_CRIT_RELIABILITY     = 1 << 2,
+        NVME_SMART_CRIT_MEDIA           = 1 << 3,
+        NVME_SMART_CRIT_VOLATILE_MEMORY = 1 << 4,
+};
 struct nvme_lba_range_type {
        __u8                    type;
        __u8                    attributes;
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index e47ee462c2f2..1d795df6f4cf 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -799,6 +799,12 @@ static inline int __perf_event_disable(void *info)			{ return -1; }
 static inline void perf_event_task_tick(void)                           { }
 #endif
+#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_INTEL)
+extern void perf_restore_debug_store(void);
+#else
+static inline void perf_restore_debug_store(void)                       { }
+#endif
 #define perf_output_put(handle, x) perf_output_copy((handle), &(x), sizeof(x))
 /*
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 1249a54d17e0..822171fcb1c8 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -134,6 +134,8 @@ extern int printk_delay_msec;
 extern int dmesg_restrict;
 extern int kptr_restrict;
+extern void wake_up_klogd(void);
 void log_buf_kexec_setup(void);
 void __init setup_log_buf(int early);
 #else
@@ -162,6 +164,10 @@ static inline bool printk_timed_ratelimit(unsigned long *caller_jiffies,
        return false;
 }
+static inline void wake_up_klogd(void)
+{
+}
 static inline void log_buf_kexec_setup(void)
 {
 }
diff --git a/include/linux/res_counter.h b/include/linux/res_counter.h
index 5ae8456d9670..c23099413ad6 100644
--- a/include/linux/res_counter.h
+++ b/include/linux/res_counter.h
@@ -14,6 +14,7 @@
 */
 #include <linux/cgroup.h>
+#include <linux/errno.h>
 /*
 * The core object. the cgroup that wishes to account for some
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 821c7f45d2a7..441f5bfdab8e 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -500,7 +500,7 @@ struct sk_buff {
        union {
                __u32           mark;
                __u32           dropcount;
-                __u32           avail_size;
+                __u32           reserved_tailroom;
        };
        sk_buff_data_t          inner_transport_header;
@@ -1288,11 +1288,13 @@ static inline void __skb_fill_page_desc(struct sk_buff *skb, int i,
         * do not lose pfmemalloc information as the pages would not be
         * allocated using __GFP_MEMALLOC.
         */
-        if (page->pfmemalloc && !page->mapping)
-                skb->pfmemalloc = true;
        frag->page.p              = page;
        frag->page_offset         = off;
        skb_frag_size_set(frag, size);
+        page = compound_head(page);
+        if (page->pfmemalloc && !page->mapping)
+                skb->pfmemalloc = true;
 }
 /**
@@ -1447,7 +1449,10 @@ static inline int skb_tailroom(const struct sk_buff *skb)
 */
 static inline int skb_availroom(const struct sk_buff *skb)
 {
-        return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
+        if (skb_is_nonlinear(skb))
+                return 0;
+        return skb->end - skb->tail - skb->reserved_tailroom;
 }
 /**
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index 3b8f9d4fc3fe..cc25b70af33c 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -127,6 +127,7 @@ struct cdc_ncm_ctx {
        u16 connected;
 };
+extern u8 cdc_ncm_select_altsetting(struct usbnet *dev, struct usb_interface *intf);
 extern int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting);
 extern void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
 extern struct sk_buff *cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign);
diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h
index 3c671c1b37f6..8860594d6364 100644
--- a/include/linux/usb/composite.h
+++ b/include/linux/usb/composite.h
@@ -60,7 +60,7 @@ struct usb_configuration;
 * @name: For diagnostics, identifies the function.
 * @strings: tables of strings, keyed by identifiers assigned during bind()
 *      and by language IDs provided in control requests
- * @descriptors: Table of full (or low) speed descriptors, using interface and
+ * @fs_descriptors: Table of full (or low) speed descriptors, using interface and
 *      string identifiers assigned during @bind().  If this pointer is null,
 *      the function will not be available at full speed (or at low speed).
 * @hs_descriptors: Table of high speed descriptors, using interface and
@@ -290,6 +290,7 @@ enum {
 *      after function notifications
 * @resume: Notifies configuration when the host restarts USB traffic,
 *      before function notifications
+ * @gadget_driver: Gadget driver controlling this driver
 *
 * Devices default to reporting self powered operation.  Devices which rely
 * on bus powered operation should report this in their @bind method.
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index ef9be7e1e190..1819b59aab2a 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -66,6 +66,7 @@
 *      port.
 * @flags: usb serial port flags
 * @write_wait: a wait_queue_head_t used by the port.
+ * @delta_msr_wait: modem-status-change wait queue
 * @work: work queue entry for the line discipline waking up.
 * @throttled: nonzero if the read urb is inactive to throttle the device
 * @throttle_req: nonzero if the tty wants to throttle us
@@ -112,6 +113,7 @@ struct usb_serial_port {
        unsigned long           flags;
        wait_queue_head_t       write_wait;
+        wait_queue_head_t       delta_msr_wait;
        struct work_struct      work;
        char                    throttled;
        char                    throttle_req;
diff --git a/include/linux/usb/ulpi.h b/include/linux/usb/ulpi.h
index 6f033a415ecb..5c295c26ad37 100644
--- a/include/linux/usb/ulpi.h
+++ b/include/linux/usb/ulpi.h
@@ -181,8 +181,16 @@
 /*-------------------------------------------------------------------------*/
+#if IS_ENABLED(CONFIG_USB_ULPI)
 struct usb_phy *otg_ulpi_create(struct usb_phy_io_ops *ops,
                                        unsigned int flags);
+#else
+static inline struct usb_phy *otg_ulpi_create(struct usb_phy_io_ops *ops,
+                                              unsigned int flags)
+{
+        return NULL;
+}
+#endif
 #ifdef CONFIG_USB_ULPI_VIEWPORT
 /* access ops for controllers with a viewport register */
diff --git a/include/net/dst.h b/include/net/dst.h
index 853cda11e518..1f8fd109e225 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -413,13 +413,15 @@ static inline int dst_neigh_output(struct dst_entry *dst, struct neighbour *n,
 static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, const void *daddr)
 {
-        return dst->ops->neigh_lookup(dst, NULL, daddr);
+        struct neighbour *n = dst->ops->neigh_lookup(dst, NULL, daddr);
+        return IS_ERR(n) ? NULL : n;
 }
 static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst,
                                                     struct sk_buff *skb)
 {
-        return dst->ops->neigh_lookup(dst, skb, NULL);
+        struct neighbour *n =  dst->ops->neigh_lookup(dst, skb, NULL);
+        return IS_ERR(n) ? NULL : n;
 }
 static inline void dst_link_failure(struct sk_buff *skb)
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index 76c3fe5ecc2e..0a1dcc2fa2f5 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -43,6 +43,13 @@ struct inet_frag_queue {
 #define INETFRAGS_HASHSZ                64
+/* averaged:
+ * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ /
+ *             rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or
+ *             struct frag_queue))
+ */
+#define INETFRAGS_MAXDEPTH              128
 struct inet_frags {
        struct hlist_head       hash[INETFRAGS_HASHSZ];
        /* This rwlock is a global lock (seperate per IPv4, IPv6 and
@@ -76,6 +83,8 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f, bool force);
 struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
                struct inet_frags *f, void *key, unsigned int hash)
        __releases(&f->lock);
+void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
+                                   const char *prefix);
 static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f)
 {
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 9497be1ad4c0..e49db91593a9 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -152,18 +152,16 @@ struct fib_result_nl {
 };
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
 #define FIB_RES_NH(res)         ((res).fi->fib_nh[(res).nh_sel])
-#define FIB_TABLE_HASHSZ 2
 #else /* CONFIG_IP_ROUTE_MULTIPATH */
 #define FIB_RES_NH(res)         ((res).fi->fib_nh[0])
+#endif /* CONFIG_IP_ROUTE_MULTIPATH */
+#ifdef CONFIG_IP_MULTIPLE_TABLES
 #define FIB_TABLE_HASHSZ 256
+#else
-#endif /* CONFIG_IP_ROUTE_MULTIPATH */
+#define FIB_TABLE_HASHSZ 2
+#endif
 extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
diff --git a/include/uapi/linux/acct.h b/include/uapi/linux/acct.h
index 11b6ca3e0873..df2f9a0bba6a 100644
--- a/include/uapi/linux/acct.h
+++ b/include/uapi/linux/acct.h
@@ -107,10 +107,12 @@ struct acct_v3
 #define ACORE           0x08    /* ... dumped core */
 #define AXSIG           0x10    /* ... was killed by a signal */
-#ifdef __BIG_ENDIAN
+#if defined(__BYTE_ORDER) ? __BYTE_ORDER == __BIG_ENDIAN : defined(__BIG_ENDIAN)
 #define ACCT_BYTEORDER  0x80    /* accounting file is big endian */
-#else
+#elif defined(__BYTE_ORDER) ? __BYTE_ORDER == __LITTLE_ENDIAN : defined(__LITTLE_ENDIAN)
 #define ACCT_BYTEORDER  0x00    /* accounting file is little endian */
+#else
+#error unspecified endianness
 #endif
 #ifndef __KERNEL__
diff --git a/include/uapi/linux/aio_abi.h b/include/uapi/linux/aio_abi.h
index 86fa7a71336a..bb2554f7fbd1 100644
--- a/include/uapi/linux/aio_abi.h
+++ b/include/uapi/linux/aio_abi.h
@@ -62,9 +62,9 @@ struct io_event {
        __s64           res2;           /* secondary result */
 };
-#if defined(__LITTLE_ENDIAN)
+#if defined(__BYTE_ORDER) ? __BYTE_ORDER == __LITTLE_ENDIAN : defined(__LITTLE_ENDIAN)
 #define PADDED(x,y)     x, y
-#elif defined(__BIG_ENDIAN)
+#elif defined(__BYTE_ORDER) ? __BYTE_ORDER == __BIG_ENDIAN : defined(__BIG_ENDIAN)
 #define PADDED(x,y)     y, x
 #else
 #error edit for your odd byteorder.
diff --git a/include/uapi/linux/raid/md_p.h b/include/uapi/linux/raid/md_p.h
index ee753536ab70..fe1a5406d4d9 100644
--- a/include/uapi/linux/raid/md_p.h
+++ b/include/uapi/linux/raid/md_p.h
@@ -145,16 +145,18 @@ typedef struct mdp_superblock_s {
        __u32 failed_disks;     /*  4 Number of failed disks                  */
        __u32 spare_disks;      /*  5 Number of spare disks                   */
        __u32 sb_csum;          /*  6 checksum of the whole superblock        */
-#ifdef __BIG_ENDIAN
+#if defined(__BYTE_ORDER) ? __BYTE_ORDER == __BIG_ENDIAN : defined(__BIG_ENDIAN)
        __u32 events_hi;        /*  7 high-order of superblock update count   */
        __u32 events_lo;        /*  8 low-order of superblock update count    */
        __u32 cp_events_hi;     /*  9 high-order of checkpoint update count   */
        __u32 cp_events_lo;     /* 10 low-order of checkpoint update count    */
-#else
+#elif defined(__BYTE_ORDER) ? __BYTE_ORDER == __LITTLE_ENDIAN : defined(__LITTLE_ENDIAN)
        __u32 events_lo;        /*  7 low-order of superblock update count    */
        __u32 events_hi;        /*  8 high-order of superblock update count   */
        __u32 cp_events_lo;     /*  9 low-order of checkpoint update count    */
        __u32 cp_events_hi;     /* 10 high-order of checkpoint update count   */
+#else
+#error unspecified endianness
 #endif
        __u32 recovery_cp;      /* 11 recovery checkpoint sector count        */
        /* There are only valid for minor_version > 90 */
diff --git a/include/uapi/linux/serial_core.h b/include/uapi/linux/serial_core.h
index b6a23a483d74..74c2bf7211f8 100644
--- a/include/uapi/linux/serial_core.h
+++ b/include/uapi/linux/serial_core.h
@@ -51,7 +51,10 @@
 #define PORT_8250_CIR   23      /* CIR infrared port, has its own driver */
 #define PORT_XR17V35X   24      /* Exar XR17V35x UARTs */
 #define PORT_BRCM_TRUMANAGE     25
-#define PORT_MAX_8250   25      /* max port ID */
+#define PORT_ALTR_16550_F32 26  /* Altera 16550 UART with 32 FIFOs */
+#define PORT_ALTR_16550_F64 27  /* Altera 16550 UART with 64 FIFOs */
+#define PORT_ALTR_16550_F128 28 /* Altera 16550 UART with 128 FIFOs */
+#define PORT_MAX_8250   28      /* max port ID */
 /*
 * ARM specific type numbers.  These are not currently guaranteed
diff --git a/include/video/atmel_lcdc.h b/include/video/atmel_lcdc.h
index 28447f1594fa..8deb22672ada 100644
--- a/include/video/atmel_lcdc.h
+++ b/include/video/atmel_lcdc.h
@@ -30,7 +30,6 @@
 */
 #define ATMEL_LCDC_WIRING_BGR   0
 #define ATMEL_LCDC_WIRING_RGB   1
-#define ATMEL_LCDC_WIRING_RGB555        2
 /* LCD Controller info data structure, stored in device platform_data */
@@ -62,6 +61,7 @@ struct atmel_lcdfb_info {
        void (*atmel_lcdfb_power_control)(int on);
        struct fb_monspecs      *default_monspecs;
        u32                     pseudo_palette[16];
+        bool                    have_intensity_bit;
 };
 #define ATMEL_LCDC_DMABADDR1    0x00
diff --git a/init/Kconfig b/init/Kconfig
index 22616cd434bc..5341d7232c3a 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -28,10 +28,6 @@ config BUILDTIME_EXTABLE_SORT
 menu "General setup"
-config EXPERIMENTAL
-        bool
-        default y
 config BROKEN
        bool
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index e5c4f609f22c..3953fda2e8bd 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -840,7 +840,8 @@ out_putfd:
                fd = error;
        }
        mutex_unlock(&root->d_inode->i_mutex);
-        mnt_drop_write(mnt);
+        if (!ro)
+                mnt_drop_write(mnt);
 out_putname:
        putname(name);
        return fd;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b0cd86501c30..59412d037eed 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4434,12 +4434,15 @@ static void perf_event_task_event(struct perf_task_event *task_event)
                        if (ctxn < 0)
                                goto next;
                        ctx = rcu_dereference(current->perf_event_ctxp[ctxn]);
+                        if (ctx)
+                                perf_event_task_ctx(ctx, task_event);
                }
-                if (ctx)
-                        perf_event_task_ctx(ctx, task_event);
 next:
                put_cpu_ptr(pmu->pmu_cpu_context);
        }
+        if (task_event->task_ctx)
+                perf_event_task_ctx(task_event->task_ctx, task_event);
        rcu_read_unlock();
 }
@@ -5647,6 +5650,7 @@ static void perf_swevent_init_hrtimer(struct perf_event *event)
                event->attr.sample_period = NSEC_PER_SEC / freq;
                hwc->sample_period = event->attr.sample_period;
                local64_set(&hwc->period_left, hwc->sample_period);
+                hwc->last_period = hwc->sample_period;
                event->attr.freq = 0;
        }
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 8d932b1c9056..1766d324d5e3 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1141,6 +1141,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
                return ERR_PTR(-EINVAL);
+        if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
+                return ERR_PTR(-EINVAL);
        /*
         * Thread groups must share signals as well, and detached threads
         * can only be started up within the thread group.
@@ -1807,7 +1810,7 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
         * If unsharing a user namespace must also unshare the thread.
         */
        if (unshare_flags & CLONE_NEWUSER)
-                unshare_flags |= CLONE_THREAD;
+                unshare_flags |= CLONE_THREAD | CLONE_FS;
        /*
         * If unsharing a pid namespace must also unshare the thread.
         */
diff --git a/kernel/futex.c b/kernel/futex.c
index f0090a993dab..b26dcfc02c94 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -223,7 +223,8 @@ static void drop_futex_key_refs(union futex_key *key)
 * @rw:         mapping needs to be read/write (values: VERIFY_READ,
 *              VERIFY_WRITE)
 *
- * Returns a negative error code or 0
+ * Return: a negative error code or 0
+ *
 * The key words are stored in *key on success.
 *
 * For shared mappings, it's (page->index, file_inode(vma->vm_file),
@@ -705,9 +706,9 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 *                      be "current" except in the case of requeue pi.
 * @set_waiters:        force setting the FUTEX_WAITERS bit (1) or not (0)
 *
- * Returns:
+ * Return:
- *  0 - ready to wait
+ *  0 - ready to wait;
- *  1 - acquired the lock
+ *  1 - acquired the lock;
 * <0 - error
 *
 * The hb->lock and futex_key refs shall be held by the caller.
@@ -1191,9 +1192,9 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
 * then direct futex_lock_pi_atomic() to force setting the FUTEX_WAITERS bit.
 * hb1 and hb2 must be held by the caller.
 *
- * Returns:
+ * Return:
- *  0 - failed to acquire the lock atomicly
+ *  0 - failed to acquire the lock atomically;
- *  1 - acquired the lock
+ *  1 - acquired the lock;
 * <0 - error
 */
 static int futex_proxy_trylock_atomic(u32 __user *pifutex,
@@ -1254,8 +1255,8 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
 * Requeue waiters on uaddr1 to uaddr2. In the requeue_pi case, try to acquire
 * uaddr2 atomically on behalf of the top waiter.
 *
- * Returns:
+ * Return:
- * >=0 - on success, the number of tasks requeued or woken
+ * >=0 - on success, the number of tasks requeued or woken;
 *  <0 - on error
 */
 static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
@@ -1536,8 +1537,8 @@ static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
 * The q->lock_ptr must not be held by the caller. A call to unqueue_me() must
 * be paired with exactly one earlier call to queue_me().
 *
- * Returns:
+ * Return:
- *   1 - if the futex_q was still queued (and we removed unqueued it)
+ *   1 - if the futex_q was still queued (and we removed unqueued it);
 *   0 - if the futex_q was already removed by the waking thread
 */
 static int unqueue_me(struct futex_q *q)
@@ -1707,9 +1708,9 @@ static long futex_wait_restart(struct restart_block *restart);
 * the pi_state owner as well as handle race conditions that may allow us to
 * acquire the lock. Must be called with the hb lock held.
 *
- * Returns:
+ * Return:
- *  1 - success, lock taken
+ *  1 - success, lock taken;
- *  0 - success, lock not taken
+ *  0 - success, lock not taken;
 * <0 - on error (-EFAULT)
 */
 static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
@@ -1824,8 +1825,8 @@ static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
 * Return with the hb lock held and a q.key reference on success, and unlocked
 * with no q.key reference on failure.
 *
- * Returns:
+ * Return:
- *  0 - uaddr contains val and hb has been locked
+ *  0 - uaddr contains val and hb has been locked;
 * <1 - -EFAULT or -EWOULDBLOCK (uaddr does not contain val) and hb is unlocked
 */
 static int futex_wait_setup(u32 __user *uaddr, u32 val, unsigned int flags,
@@ -2203,9 +2204,9 @@ pi_faulted:
 * the wakeup and return the appropriate error code to the caller.  Must be
 * called with the hb lock held.
 *
- * Returns
+ * Return:
- *  0 - no early wakeup detected
+ *  0 = no early wakeup detected;
- * <0 - -ETIMEDOUT or -ERESTARTNOINTR
+ * <0 = -ETIMEDOUT or -ERESTARTNOINTR
 */
 static inline
 int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
@@ -2247,7 +2248,6 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
 * @val:        the expected value of uaddr
 * @abs_time:   absolute timeout
 * @bitset:     32 bit wakeup bitset set by userspace, defaults to all
- * @clockrt:    whether to use CLOCK_REALTIME (1) or CLOCK_MONOTONIC (0)
 * @uaddr2:     the pi futex we will take prior to returning to user-space
 *
 * The caller will wait on uaddr and will be requeued by futex_requeue() to
@@ -2258,7 +2258,7 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
 * there was a need to.
 *
 * We call schedule in futex_wait_queue_me() when we enqueue and return there
- * via the following:
+ * via the following--
 * 1) wakeup on uaddr2 after an atomic lock acquisition by futex_requeue()
 * 2) wakeup on uaddr2 after a requeue
 * 3) signal
@@ -2276,8 +2276,8 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
 *
 * If 4 or 7, we cleanup and return with -ETIMEDOUT.
 *
- * Returns:
+ * Return:
- *  0 - On success
+ *  0 - On success;
 * <0 - On error
 */
 static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
diff --git a/kernel/printk.c b/kernel/printk.c
index 0b31715f335a..abbdd9e2ac82 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -63,8 +63,6 @@ void asmlinkage __attribute__((weak)) early_printk(const char *fmt, ...)
 #define MINIMUM_CONSOLE_LOGLEVEL 1 /* Minimum loglevel we let people use */
 #define DEFAULT_CONSOLE_LOGLEVEL 7 /* anything MORE serious than KERN_DEBUG */
-DECLARE_WAIT_QUEUE_HEAD(log_wait);
 int console_printk[4] = {
        DEFAULT_CONSOLE_LOGLEVEL,       /* console_loglevel */
        DEFAULT_MESSAGE_LOGLEVEL,       /* default_message_loglevel */
@@ -224,6 +222,7 @@ struct log {
 static DEFINE_RAW_SPINLOCK(logbuf_lock);
 #ifdef CONFIG_PRINTK
+DECLARE_WAIT_QUEUE_HEAD(log_wait);
 /* the next printk record to read by syslog(READ) or /proc/kmsg */
 static u64 syslog_seq;
 static u32 syslog_idx;
@@ -1957,45 +1956,6 @@ int is_console_locked(void)
        return console_locked;
 }
-/*
- * Delayed printk version, for scheduler-internal messages:
- */
-#define PRINTK_BUF_SIZE         512
-#define PRINTK_PENDING_WAKEUP   0x01
-#define PRINTK_PENDING_SCHED    0x02
-static DEFINE_PER_CPU(int, printk_pending);
-static DEFINE_PER_CPU(char [PRINTK_BUF_SIZE], printk_sched_buf);
-static void wake_up_klogd_work_func(struct irq_work *irq_work)
-{
-        int pending = __this_cpu_xchg(printk_pending, 0);
-        if (pending & PRINTK_PENDING_SCHED) {
-                char *buf = __get_cpu_var(printk_sched_buf);
-                printk(KERN_WARNING "[sched_delayed] %s", buf);
-        }
-        if (pending & PRINTK_PENDING_WAKEUP)
-                wake_up_interruptible(&log_wait);
-}
-static DEFINE_PER_CPU(struct irq_work, wake_up_klogd_work) = {
-        .func = wake_up_klogd_work_func,
-        .flags = IRQ_WORK_LAZY,
-};
-void wake_up_klogd(void)
-{
-        preempt_disable();
-        if (waitqueue_active(&log_wait)) {
-                this_cpu_or(printk_pending, PRINTK_PENDING_WAKEUP);
-                irq_work_queue(&__get_cpu_var(wake_up_klogd_work));
-        }
-        preempt_enable();
-}
 static void console_cont_flush(char *text, size_t size)
 {
        unsigned long flags;
@@ -2458,6 +2418,44 @@ static int __init printk_late_init(void)
 late_initcall(printk_late_init);
 #if defined CONFIG_PRINTK
+/*
+ * Delayed printk version, for scheduler-internal messages:
+ */
+#define PRINTK_BUF_SIZE         512
+#define PRINTK_PENDING_WAKEUP   0x01
+#define PRINTK_PENDING_SCHED    0x02
+static DEFINE_PER_CPU(int, printk_pending);
+static DEFINE_PER_CPU(char [PRINTK_BUF_SIZE], printk_sched_buf);
+static void wake_up_klogd_work_func(struct irq_work *irq_work)
+{
+        int pending = __this_cpu_xchg(printk_pending, 0);
+        if (pending & PRINTK_PENDING_SCHED) {
+                char *buf = __get_cpu_var(printk_sched_buf);
+                printk(KERN_WARNING "[sched_delayed] %s", buf);
+        }
+        if (pending & PRINTK_PENDING_WAKEUP)
+                wake_up_interruptible(&log_wait);
+}
+static DEFINE_PER_CPU(struct irq_work, wake_up_klogd_work) = {
+        .func = wake_up_klogd_work_func,
+        .flags = IRQ_WORK_LAZY,
+};
+void wake_up_klogd(void)
+{
+        preempt_disable();
+        if (waitqueue_active(&log_wait)) {
+                this_cpu_or(printk_pending, PRINTK_PENDING_WAKEUP);
+                irq_work_queue(&__get_cpu_var(wake_up_klogd_work));
+        }
+        preempt_enable();
+}
 int printk_sched(const char *fmt, ...)
 {
diff --git a/kernel/signal.c b/kernel/signal.c
index 2ec870a4c3c4..dd72567767d9 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -485,6 +485,9 @@ flush_signal_handlers(struct task_struct *t, int force_default)
                if (force_default || ka->sa.sa_handler != SIG_IGN)
                        ka->sa.sa_handler = SIG_DFL;
                ka->sa.sa_flags = 0;
+#ifdef __ARCH_HAS_SA_RESTORER
+                ka->sa.sa_restorer = NULL;
+#endif
                sigemptyset(&ka->sa.sa_mask);
                ka++;
        }
@@ -2682,7 +2685,7 @@ static int do_sigpending(void *set, unsigned long sigsetsize)
 /**
 *  sys_rt_sigpending - examine a pending signal that has been raised
 *                      while blocked
- *  @set: stores pending signals
+ *  @uset: stores pending signals
 *  @sigsetsize: size of sigset_t type or larger
 */
 SYSCALL_DEFINE2(rt_sigpending, sigset_t __user *, uset, size_t, sigsetsize)
diff --git a/kernel/sys.c b/kernel/sys.c
index 81f56445fba9..39c9c4a2949f 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2185,9 +2185,8 @@ SYSCALL_DEFINE3(getcpu, unsigned __user *, cpup, unsigned __user *, nodep,
 char poweroff_cmd[POWEROFF_CMD_PATH_LEN] = "/sbin/poweroff";
-static int __orderly_poweroff(void)
+static int __orderly_poweroff(bool force)
 {
-        int argc;
        char **argv;
        static char *envp[] = {
                "HOME=/",
@@ -2196,20 +2195,40 @@ static int __orderly_poweroff(void)
        };
        int ret;
-        argv = argv_split(GFP_ATOMIC, poweroff_cmd, &argc);
+        argv = argv_split(GFP_KERNEL, poweroff_cmd, NULL);
-        if (argv == NULL) {
+        if (argv) {
+                ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
+                argv_free(argv);
+        } else {
                printk(KERN_WARNING "%s failed to allocate memory for \"%s\"\n",
-                       __func__, poweroff_cmd);
+                                         __func__, poweroff_cmd);
-                return -ENOMEM;
+                ret = -ENOMEM;
        }
-        ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_WAIT_EXEC,
+        if (ret && force) {
-                                      NULL, NULL, NULL);
+                printk(KERN_WARNING "Failed to start orderly shutdown: "
-        argv_free(argv);
+                                        "forcing the issue\n");
+                /*
+                 * I guess this should try to kick off some daemon to sync and
+                 * poweroff asap.  Or not even bother syncing if we're doing an
+                 * emergency shutdown?
+                 */
+                emergency_sync();
+                kernel_power_off();
+        }
        return ret;
 }
+static bool poweroff_force;
+static void poweroff_work_func(struct work_struct *work)
+{
+        __orderly_poweroff(poweroff_force);
+}
+static DECLARE_WORK(poweroff_work, poweroff_work_func);
 /**
 * orderly_poweroff - Trigger an orderly system poweroff
 * @force: force poweroff if command execution fails
@@ -2219,21 +2238,9 @@ static int __orderly_poweroff(void)
 */
 int orderly_poweroff(bool force)
 {
-        int ret = __orderly_poweroff();
+        if (force) /* do not override the pending "true" */
+                poweroff_force = true;
-        if (ret && force) {
+        schedule_work(&poweroff_work);
-                printk(KERN_WARNING "Failed to start orderly shutdown: "
+        return 0;
-                       "forcing the issue\n");
-                /*
-                 * I guess this should try to kick off some daemon to sync and
-                 * poweroff asap.  Or not even bother syncing if we're doing an
-                 * emergency shutdown?
-                 */
-                emergency_sync();
-                kernel_power_off();
-        }
-        return ret;
 }
 EXPORT_SYMBOL_GPL(orderly_poweroff);
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 192473b22799..fc382d6e2765 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -414,24 +414,28 @@ config PROBE_EVENTS
        def_bool n
 config DYNAMIC_FTRACE
-        bool "enable/disable ftrace tracepoints dynamically"
+        bool "enable/disable function tracing dynamically"
        depends on FUNCTION_TRACER
        depends on HAVE_DYNAMIC_FTRACE
        default y
        help
-          This option will modify all the calls to ftrace dynamically
+          This option will modify all the calls to function tracing
-          (will patch them out of the binary image and replace them
+          dynamically (will patch them out of the binary image and
-          with a No-Op instruction) as they are called. A table is
+          replace them with a No-Op instruction) on boot up. During
-          created to dynamically enable them again.
+          compile time, a table is made of all the locations that ftrace
+          can function trace, and this table is linked into the kernel
+          image. When this is enabled, functions can be individually
+          enabled, and the functions not enabled will not affect
+          performance of the system.
+          See the files in /sys/kernel/debug/tracing:
+            available_filter_functions
+            set_ftrace_filter
+            set_ftrace_notrace
          This way a CONFIG_FUNCTION_TRACER kernel is slightly larger, but
          otherwise has native performance as long as no tracing is active.
-          The changes to the code are done by a kernel thread that
-          wakes up once a second and checks to see if any ftrace calls
-          were made. If so, it runs stop_machine (stops all CPUS)
-          and modifies the code to jump over the call to ftrace.
 config DYNAMIC_FTRACE_WITH_REGS
        def_bool y
        depends on DYNAMIC_FTRACE
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index ab25b88aae56..6893d5a2bf08 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3104,8 +3104,8 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                                        continue;
                        }
-                        hlist_del(&entry->node);
+                        hlist_del_rcu(&entry->node);
-                        call_rcu(&entry->rcu, ftrace_free_entry_rcu);
+                        call_rcu_sched(&entry->rcu, ftrace_free_entry_rcu);
                }
        }
        __disable_ftrace_function_probe();
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c2e2c2310374..4f1dade56981 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -704,7 +704,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 void
 update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 {
-        struct ring_buffer *buf = tr->buffer;
+        struct ring_buffer *buf;
        if (trace_stop_count)
                return;
@@ -719,6 +719,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
        arch_spin_lock(&ftrace_max_lock);
+        buf = tr->buffer;
        tr->buffer = max_tr.buffer;
        max_tr.buffer = buf;
@@ -2400,6 +2401,27 @@ static void test_ftrace_alive(struct seq_file *m)
        seq_printf(m, "#          MAY BE MISSING FUNCTION EVENTS\n");
 }
+#ifdef CONFIG_TRACER_MAX_TRACE
+static void print_snapshot_help(struct seq_file *m, struct trace_iterator *iter)
+{
+        if (iter->trace->allocated_snapshot)
+                seq_printf(m, "#\n# * Snapshot is allocated *\n#\n");
+        else
+                seq_printf(m, "#\n# * Snapshot is freed *\n#\n");
+        seq_printf(m, "# Snapshot commands:\n");
+        seq_printf(m, "# echo 0 > snapshot : Clears and frees snapshot buffer\n");
+        seq_printf(m, "# echo 1 > snapshot : Allocates snapshot buffer, if not already allocated.\n");
+        seq_printf(m, "#                      Takes a snapshot of the main buffer.\n");
+        seq_printf(m, "# echo 2 > snapshot : Clears snapshot buffer (but does not allocate)\n");
+        seq_printf(m, "#                      (Doesn't have to be '2' works with any number that\n");
+        seq_printf(m, "#                       is not a '0' or '1')\n");
+}
+#else
+/* Should never be called */
+static inline void print_snapshot_help(struct seq_file *m, struct trace_iterator *iter) { }
+#endif
 static int s_show(struct seq_file *m, void *v)
 {
        struct trace_iterator *iter = v;
@@ -2411,7 +2433,9 @@ static int s_show(struct seq_file *m, void *v)
                        seq_puts(m, "#\n");
                        test_ftrace_alive(m);
                }
-                if (iter->trace && iter->trace->print_header)
+                if (iter->snapshot && trace_empty(iter))
+                        print_snapshot_help(m, iter);
+                else if (iter->trace && iter->trace->print_header)
                        iter->trace->print_header(m);
                else
                        trace_default_header(m);
@@ -2857,11 +2881,25 @@ static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
        return -EINVAL;
 }
-static void set_tracer_flags(unsigned int mask, int enabled)
+/* Some tracers require overwrite to stay enabled */
+int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
+{
+        if (tracer->enabled && (mask & TRACE_ITER_OVERWRITE) && !set)
+                return -1;
+        return 0;
+}
+int set_tracer_flag(unsigned int mask, int enabled)
 {
        /* do nothing if flag is already set */
        if (!!(trace_flags & mask) == !!enabled)
-                return;
+                return 0;
+        /* Give the tracer a chance to approve the change */
+        if (current_trace->flag_changed)
+                if (current_trace->flag_changed(current_trace, mask, !!enabled))
+                        return -EINVAL;
        if (enabled)
                trace_flags |= mask;
@@ -2871,18 +2909,24 @@ static void set_tracer_flags(unsigned int mask, int enabled)
        if (mask == TRACE_ITER_RECORD_CMD)
                trace_event_enable_cmd_record(enabled);
-        if (mask == TRACE_ITER_OVERWRITE)
+        if (mask == TRACE_ITER_OVERWRITE) {
                ring_buffer_change_overwrite(global_trace.buffer, enabled);
+#ifdef CONFIG_TRACER_MAX_TRACE
+                ring_buffer_change_overwrite(max_tr.buffer, enabled);
+#endif
+        }
        if (mask == TRACE_ITER_PRINTK)
                trace_printk_start_stop_comm(enabled);
+        return 0;
 }
 static int trace_set_options(char *option)
 {
        char *cmp;
        int neg = 0;
-        int ret = 0;
+        int ret = -ENODEV;
        int i;
        cmp = strstrip(option);
@@ -2892,19 +2936,20 @@ static int trace_set_options(char *option)
                cmp += 2;
        }
+        mutex_lock(&trace_types_lock);
        for (i = 0; trace_options[i]; i++) {
                if (strcmp(cmp, trace_options[i]) == 0) {
-                        set_tracer_flags(1 << i, !neg);
+                        ret = set_tracer_flag(1 << i, !neg);
                        break;
                }
        }
        /* If no option could be set, test the specific tracer options */
-        if (!trace_options[i]) {
+        if (!trace_options[i])
-                mutex_lock(&trace_types_lock);
                ret = set_tracer_option(current_trace, cmp, neg);
-                mutex_unlock(&trace_types_lock);
-        }
+        mutex_unlock(&trace_types_lock);
        return ret;
 }
@@ -2914,6 +2959,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
                        size_t cnt, loff_t *ppos)
 {
        char buf[64];
+        int ret;
        if (cnt >= sizeof(buf))
                return -EINVAL;
@@ -2923,7 +2969,9 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
        buf[cnt] = 0;
-        trace_set_options(buf);
+        ret = trace_set_options(buf);
+        if (ret < 0)
+                return ret;
        *ppos += cnt;
@@ -3227,6 +3275,9 @@ static int tracing_set_tracer(const char *buf)
                goto out;
        trace_branch_disable();
+        current_trace->enabled = false;
        if (current_trace->reset)
                current_trace->reset(tr);
@@ -3271,6 +3322,7 @@ static int tracing_set_tracer(const char *buf)
        }
        current_trace = t;
+        current_trace->enabled = true;
        trace_branch_enable(tr);
 out:
        mutex_unlock(&trace_types_lock);
@@ -4144,8 +4196,6 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
        default:
                if (current_trace->allocated_snapshot)
                        tracing_reset_online_cpus(&max_tr);
-                else
-                        ret = -EINVAL;
                break;
        }
@@ -4759,7 +4809,13 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
        if (val != 0 && val != 1)
                return -EINVAL;
-        set_tracer_flags(1 << index, val);
+        mutex_lock(&trace_types_lock);
+        ret = set_tracer_flag(1 << index, val);
+        mutex_unlock(&trace_types_lock);
+        if (ret < 0)
+                return ret;
        *ppos += cnt;
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 57d7e5397d56..2081971367ea 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -283,11 +283,15 @@ struct tracer {
        enum print_line_t       (*print_line)(struct trace_iterator *iter);
        /* If you handled the flag setting, return 0 */
        int                     (*set_flag)(u32 old_flags, u32 bit, int set);
+        /* Return 0 if OK with change, else return non-zero */
+        int                     (*flag_changed)(struct tracer *tracer,
+                                                u32 mask, int set);
        struct tracer           *next;
        struct tracer_flags     *flags;
        bool                    print_max;
        bool                    use_max_tr;
        bool                    allocated_snapshot;
+        bool                    enabled;
 };
@@ -943,6 +947,8 @@ extern const char *__stop___trace_bprintk_fmt[];
 void trace_printk_init_buffers(void);
 void trace_printk_start_comm(void);
+int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set);
+int set_tracer_flag(unsigned int mask, int enabled);
 #undef FTRACE_ENTRY
 #define FTRACE_ENTRY(call, struct_name, id, tstruct, print, filter)     \
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 713a2cac4881..443b25b43b4f 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -32,7 +32,7 @@ enum {
 static int trace_type __read_mostly;
-static int save_lat_flag;
+static int save_flags;
 static void stop_irqsoff_tracer(struct trace_array *tr, int graph);
 static int start_irqsoff_tracer(struct trace_array *tr, int graph);
@@ -558,8 +558,11 @@ static void stop_irqsoff_tracer(struct trace_array *tr, int graph)
 static void __irqsoff_tracer_init(struct trace_array *tr)
 {
-        save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT;
+        save_flags = trace_flags;
-        trace_flags |= TRACE_ITER_LATENCY_FMT;
+        /* non overwrite screws up the latency tracers */
+        set_tracer_flag(TRACE_ITER_OVERWRITE, 1);
+        set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1);
        tracing_max_latency = 0;
        irqsoff_trace = tr;
@@ -573,10 +576,13 @@ static void __irqsoff_tracer_init(struct trace_array *tr)
 static void irqsoff_tracer_reset(struct trace_array *tr)
 {
+        int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
+        int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE;
        stop_irqsoff_tracer(tr, is_graph());
-        if (!save_lat_flag)
+        set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag);
-                trace_flags &= ~TRACE_ITER_LATENCY_FMT;
+        set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag);
 }
 static void irqsoff_tracer_start(struct trace_array *tr)
@@ -609,6 +615,7 @@ static struct tracer irqsoff_tracer __read_mostly =
        .print_line     = irqsoff_print_line,
        .flags          = &tracer_flags,
        .set_flag       = irqsoff_set_flag,
+        .flag_changed   = trace_keep_overwrite,
 #ifdef CONFIG_FTRACE_SELFTEST
        .selftest    = trace_selftest_startup_irqsoff,
 #endif
@@ -642,6 +649,7 @@ static struct tracer preemptoff_tracer __read_mostly =
        .print_line     = irqsoff_print_line,
        .flags          = &tracer_flags,
        .set_flag       = irqsoff_set_flag,
+        .flag_changed   = trace_keep_overwrite,
 #ifdef CONFIG_FTRACE_SELFTEST
        .selftest    = trace_selftest_startup_preemptoff,
 #endif
@@ -677,6 +685,7 @@ static struct tracer preemptirqsoff_tracer __read_mostly =
        .print_line     = irqsoff_print_line,
        .flags          = &tracer_flags,
        .set_flag       = irqsoff_set_flag,
+        .flag_changed   = trace_keep_overwrite,
 #ifdef CONFIG_FTRACE_SELFTEST
        .selftest    = trace_selftest_startup_preemptirqsoff,
 #endif
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index 75aa97fbe1a1..fde652c9a511 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -36,7 +36,7 @@ static void __wakeup_reset(struct trace_array *tr);
 static int wakeup_graph_entry(struct ftrace_graph_ent *trace);
 static void wakeup_graph_return(struct ftrace_graph_ret *trace);
-static int save_lat_flag;
+static int save_flags;
 #define TRACE_DISPLAY_GRAPH     1
@@ -540,8 +540,11 @@ static void stop_wakeup_tracer(struct trace_array *tr)
 static int __wakeup_tracer_init(struct trace_array *tr)
 {
-        save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT;
+        save_flags = trace_flags;
-        trace_flags |= TRACE_ITER_LATENCY_FMT;
+        /* non overwrite screws up the latency tracers */
+        set_tracer_flag(TRACE_ITER_OVERWRITE, 1);
+        set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1);
        tracing_max_latency = 0;
        wakeup_trace = tr;
@@ -563,12 +566,15 @@ static int wakeup_rt_tracer_init(struct trace_array *tr)
 static void wakeup_tracer_reset(struct trace_array *tr)
 {
+        int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
+        int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE;
        stop_wakeup_tracer(tr);
        /* make sure we put back any tasks we are tracing */
        wakeup_reset(tr);
-        if (!save_lat_flag)
+        set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag);
-                trace_flags &= ~TRACE_ITER_LATENCY_FMT;
+        set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag);
 }
 static void wakeup_tracer_start(struct trace_array *tr)
@@ -594,6 +600,7 @@ static struct tracer wakeup_tracer __read_mostly =
        .print_line     = wakeup_print_line,
        .flags          = &tracer_flags,
        .set_flag       = wakeup_set_flag,
+        .flag_changed   = trace_keep_overwrite,
 #ifdef CONFIG_FTRACE_SELFTEST
        .selftest    = trace_selftest_startup_wakeup,
 #endif
@@ -615,6 +622,7 @@ static struct tracer wakeup_rt_tracer __read_mostly =
        .print_line     = wakeup_print_line,
        .flags          = &tracer_flags,
        .set_flag       = wakeup_set_flag,
+        .flag_changed   = trace_keep_overwrite,
 #ifdef CONFIG_FTRACE_SELFTEST
        .selftest    = trace_selftest_startup_wakeup,
 #endif
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 8b650837083e..b14f4d342043 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -21,6 +21,7 @@
 #include <linux/uaccess.h>
 #include <linux/ctype.h>
 #include <linux/projid.h>
+#include <linux/fs_struct.h>
 static struct kmem_cache *user_ns_cachep __read_mostly;
@@ -837,6 +838,9 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
        if (atomic_read(&current->mm->mm_users) > 1)
                return -EINVAL;
+        if (current->fs->users != 1)
+                return -EINVAL;
        if (!ns_capable(user_ns, CAP_SYS_ADMIN))
                return -EPERM;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 81f2457811eb..b48cd597145d 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -457,11 +457,12 @@ static int worker_pool_assign_id(struct worker_pool *pool)
        int ret;
        mutex_lock(&worker_pool_idr_mutex);
-        idr_pre_get(&worker_pool_idr, GFP_KERNEL);
+        ret = idr_alloc(&worker_pool_idr, pool, 0, 0, GFP_KERNEL);
-        ret = idr_get_new(&worker_pool_idr, pool, &pool->id);
+        if (ret >= 0)
+                pool->id = ret;
        mutex_unlock(&worker_pool_idr_mutex);
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 /*
@@ -3446,28 +3447,34 @@ static void wq_unbind_fn(struct work_struct *work)
                spin_unlock_irq(&pool->lock);
                mutex_unlock(&pool->assoc_mutex);
-        }
-        /*
+                /*
-         * Call schedule() so that we cross rq->lock and thus can guarantee
+                 * Call schedule() so that we cross rq->lock and thus can
-         * sched callbacks see the %WORKER_UNBOUND flag.  This is necessary
+                 * guarantee sched callbacks see the %WORKER_UNBOUND flag.
-         * as scheduler callbacks may be invoked from other cpus.
+                 * This is necessary as scheduler callbacks may be invoked
-         */
+                 * from other cpus.
-        schedule();
+                 */
+                schedule();
-        /*
+                /*
-         * Sched callbacks are disabled now.  Zap nr_running.  After this,
+                 * Sched callbacks are disabled now.  Zap nr_running.
-         * nr_running stays zero and need_more_worker() and keep_working()
+                 * After this, nr_running stays zero and need_more_worker()
-         * are always true as long as the worklist is not empty.  Pools on
+                 * and keep_working() are always true as long as the
-         * @cpu now behave as unbound (in terms of concurrency management)
+                 * worklist is not empty.  This pool now behaves as an
-         * pools which are served by workers tied to the CPU.
+                 * unbound (in terms of concurrency management) pool which
-         *
+                 * are served by workers tied to the pool.
-         * On return from this function, the current worker would trigger
+                 */
-         * unbound chain execution of pending work items if other workers
-         * didn't already.
-         */
-        for_each_std_worker_pool(pool, cpu)
                atomic_set(&pool->nr_running, 0);
+                /*
+                 * With concurrency management just turned off, a busy
+                 * worker blocking could lead to lengthy stalls.  Kick off
+                 * unbound chain execution of currently pending work items.
+                 */
+                spin_lock_irq(&pool->lock);
+                wake_up_worker(pool);
+                spin_unlock_irq(&pool->lock);
+        }
 }
 /*
diff --git a/lib/bust_spinlocks.c b/lib/bust_spinlocks.c
index 9681d54b95d1..f8e0e5367398 100644
--- a/lib/bust_spinlocks.c
+++ b/lib/bust_spinlocks.c
@@ -8,6 +8,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/printk.h>
 #include <linux/spinlock.h>
 #include <linux/tty.h>
 #include <linux/wait.h>
@@ -28,5 +29,3 @@ void __attribute__((weak)) bust_spinlocks(int yes)
                        wake_up_klogd();
        }
 }
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 5e396accd3d0..d87a17a819d0 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -862,17 +862,21 @@ static void check_unmap(struct dma_debug_entry *ref)
        entry = bucket_find_exact(bucket, ref);
        if (!entry) {
+                /* must drop lock before calling dma_mapping_error */
+                put_hash_bucket(bucket, &flags);
                if (dma_mapping_error(ref->dev, ref->dev_addr)) {
                        err_printk(ref->dev, NULL,
-                                   "DMA-API: device driver tries "
+                                   "DMA-API: device driver tries to free an "
-                                   "to free an invalid DMA memory address\n");
+                                   "invalid DMA memory address\n");
-                        return;
+                } else {
+                        err_printk(ref->dev, NULL,
+                                   "DMA-API: device driver tries to free DMA "
+                                   "memory it has not allocated [device "
+                                   "address=0x%016llx] [size=%llu bytes]\n",
+                                   ref->dev_addr, ref->size);
                }
-                err_printk(ref->dev, NULL, "DMA-API: device driver tries "
+                return;
-                           "to free DMA memory it has not allocated "
-                           "[device address=0x%016llx] [size=%llu bytes]\n",
-                           ref->dev_addr, ref->size);
-                goto out;
        }
        if (ref->size != entry->size) {
@@ -936,7 +940,6 @@ static void check_unmap(struct dma_debug_entry *ref)
        hash_bucket_del(entry);
        dma_entry_free(entry);
-out:
        put_hash_bucket(bucket, &flags);
 }
@@ -1082,13 +1085,27 @@ void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
        ref.dev = dev;
        ref.dev_addr = dma_addr;
        bucket = get_hash_bucket(&ref, &flags);
-        entry = bucket_find_exact(bucket, &ref);
-        if (!entry)
+        list_for_each_entry(entry, &bucket->list, list) {
-                goto out;
+                if (!exact_match(&ref, entry))
+                        continue;
+                /*
+                 * The same physical address can be mapped multiple
+                 * times. Without a hardware IOMMU this results in the
+                 * same device addresses being put into the dma-debug
+                 * hash multiple times too. This can result in false
+                 * positives being reported. Therefore we implement a
+                 * best-fit algorithm here which updates the first entry
+                 * from the hash which fits the reference value and is
+                 * not currently listed as being checked.
+                 */
+                if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
+                        entry->map_err_type = MAP_ERR_CHECKED;
+                        break;
+                }
+        }
-        entry->map_err_type = MAP_ERR_CHECKED;
-out:
        put_hash_bucket(bucket, &flags);
 }
 EXPORT_SYMBOL(debug_dma_mapping_error);
diff --git a/lib/idr.c b/lib/idr.c
index 00739aaf95a2..322e2816f2fb 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -106,8 +106,14 @@ static struct idr_layer *idr_layer_alloc(gfp_t gfp_mask, struct idr *layer_idr)
        if (layer_idr)
                return get_from_free_list(layer_idr);
-        /* try to allocate directly from kmem_cache */
+        /*
-        new = kmem_cache_zalloc(idr_layer_cache, gfp_mask);
+         * Try to allocate directly from kmem_cache.  We want to try this
+         * before preload buffer; otherwise, non-preloading idr_alloc()
+         * users will end up taking advantage of preloading ones.  As the
+         * following is allowed to fail for preloaded cases, suppress
+         * warning this time.
+         */
+        new = kmem_cache_zalloc(idr_layer_cache, gfp_mask | __GFP_NOWARN);
        if (new)
                return new;
@@ -115,18 +121,24 @@ static struct idr_layer *idr_layer_alloc(gfp_t gfp_mask, struct idr *layer_idr)
         * Try to fetch one from the per-cpu preload buffer if in process
         * context.  See idr_preload() for details.
         */
-        if (in_interrupt())
+        if (!in_interrupt()) {
-                return NULL;
+                preempt_disable();
+                new = __this_cpu_read(idr_preload_head);
-        preempt_disable();
+                if (new) {
-        new = __this_cpu_read(idr_preload_head);
+                        __this_cpu_write(idr_preload_head, new->ary[0]);
-        if (new) {
+                        __this_cpu_dec(idr_preload_cnt);
-                __this_cpu_write(idr_preload_head, new->ary[0]);
+                        new->ary[0] = NULL;
-                __this_cpu_dec(idr_preload_cnt);
+                }
-                new->ary[0] = NULL;
+                preempt_enable();
+                if (new)
+                        return new;
        }
-        preempt_enable();
-        return new;
+        /*
+         * Both failed.  Try kmem_cache again w/o adding __GFP_NOWARN so
+         * that memory allocation failure warning is printed as intended.
+         */
+        return kmem_cache_zalloc(idr_layer_cache, gfp_mask);
 }
 static void idr_layer_rcu_free(struct rcu_head *head)
@@ -184,20 +196,7 @@ static void idr_mark_full(struct idr_layer **pa, int id)
        }
 }
-/**
+int __idr_pre_get(struct idr *idp, gfp_t gfp_mask)
- * idr_pre_get - reserve resources for idr allocation
- * @idp:        idr handle
- * @gfp_mask:   memory allocation flags
- *
- * This function should be called prior to calling the idr_get_new* functions.
- * It preallocates enough memory to satisfy the worst possible allocation. The
- * caller should pass in GFP_KERNEL if possible.  This of course requires that
- * no spinning locks be held.
- *
- * If the system is REALLY out of memory this function returns %0,
- * otherwise %1.
- */
-int idr_pre_get(struct idr *idp, gfp_t gfp_mask)
 {
        while (idp->id_free_cnt < MAX_IDR_FREE) {
                struct idr_layer *new;
@@ -208,13 +207,12 @@ int idr_pre_get(struct idr *idp, gfp_t gfp_mask)
        }
        return 1;
 }
-EXPORT_SYMBOL(idr_pre_get);
+EXPORT_SYMBOL(__idr_pre_get);
 /**
 * sub_alloc - try to allocate an id without growing the tree depth
 * @idp: idr handle
 * @starting_id: id to start search at
- * @id: pointer to the allocated handle
 * @pa: idr_layer[MAX_IDR_LEVEL] used as backtrack buffer
 * @gfp_mask: allocation mask for idr_layer_alloc()
 * @layer_idr: optional idr passed to idr_layer_alloc()
@@ -376,25 +374,7 @@ static void idr_fill_slot(struct idr *idr, void *ptr, int id,
        idr_mark_full(pa, id);
 }
-/**
+int __idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id)
- * idr_get_new_above - allocate new idr entry above or equal to a start id
- * @idp: idr handle
- * @ptr: pointer you want associated with the id
- * @starting_id: id to start search at
- * @id: pointer to the allocated handle
- *
- * This is the allocate id function.  It should be called with any
- * required locks.
- *
- * If allocation from IDR's private freelist fails, idr_get_new_above() will
- * return %-EAGAIN.  The caller should retry the idr_pre_get() call to refill
- * IDR's preallocation and then retry the idr_get_new_above() call.
- *
- * If the idr is full idr_get_new_above() will return %-ENOSPC.
- *
- * @id returns a value in the range @starting_id ... %0x7fffffff
- */
-int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id)
 {
        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
        int rv;
@@ -407,7 +387,7 @@ int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id)
        *id = rv;
        return 0;
 }
-EXPORT_SYMBOL(idr_get_new_above);
+EXPORT_SYMBOL(__idr_get_new_above);
 /**
 * idr_preload - preload for idr_alloc()
@@ -908,7 +888,7 @@ static void free_bitmap(struct ida *ida, struct ida_bitmap *bitmap)
 int ida_pre_get(struct ida *ida, gfp_t gfp_mask)
 {
        /* allocate idr_layers */
-        if (!idr_pre_get(&ida->idr, gfp_mask))
+        if (!__idr_pre_get(&ida->idr, gfp_mask))
                return 0;
        /* allocate free_bitmap */
diff --git a/lib/xz/Kconfig b/lib/xz/Kconfig
index 82a04d7ba99e..08837db52d94 100644
--- a/lib/xz/Kconfig
+++ b/lib/xz/Kconfig
@@ -15,7 +15,7 @@ config XZ_DEC_X86
 config XZ_DEC_POWERPC
        bool "PowerPC BCJ filter decoder"
-        default y if POWERPC
+        default y if PPC
        select XZ_DEC_BCJ
 config XZ_DEC_IA64
diff --git a/mm/Kconfig b/mm/Kconfig
index ae55c1e04d10..3bea74f1ccfe 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -286,8 +286,12 @@ config NR_QUICK
        default "1"
 config VIRT_TO_BUS
-        def_bool y
+        bool
-        depends on HAVE_VIRT_TO_BUS
+        help
+          An architecture should select this if it implements the
+          deprecated interface virt_to_bus().  All new architectures
+          should probably not select this.
 config MMU_NOTIFIER
        bool
diff --git a/mm/fremap.c b/mm/fremap.c
index 0cd4c11488ed..4723ac8d2fc2 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -129,7 +129,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
        struct vm_area_struct *vma;
        int err = -EINVAL;
        int has_write_lock = 0;
-        vm_flags_t vm_flags;
+        vm_flags_t vm_flags = 0;
        if (prot)
                return err;
@@ -254,7 +254,8 @@ get_write_lock:
         */
 out:
-        vm_flags = vma->vm_flags;
+        if (vma)
+                vm_flags = vma->vm_flags;
        if (likely(!has_write_lock))
                up_read(&mm->mmap_sem);
        else
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 0a0be33bb199..ca9a7c6d7e97 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2124,8 +2124,12 @@ int hugetlb_report_node_meminfo(int nid, char *buf)
 /* Return the number pages of memory we physically have, in PAGE_SIZE units. */
 unsigned long hugetlb_total_pages(void)
 {
-        struct hstate *h = &default_hstate;
+        struct hstate *h;
-        return h->nr_huge_pages * pages_per_huge_page(h);
+        unsigned long nr_total_pages = 0;
+        for_each_hstate(h)
+                nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h);
+        return nr_total_pages;
 }
 static int hugetlb_acct_memory(struct hstate *h, long delta)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index b81a367b9f39..ee3765760818 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1779,7 +1779,11 @@ void try_offline_node(int nid)
        for (i = 0; i < MAX_NR_ZONES; i++) {
                struct zone *zone = pgdat->node_zones + i;
-                if (zone->wait_table)
+                /*
+                 * wait_table may be allocated from boot memory,
+                 * here only free if it's allocated by vmalloc.
+                 */
+                if (is_vmalloc_addr(zone->wait_table))
                        vfree(zone->wait_table);
        }
@@ -1801,7 +1805,7 @@ int __ref remove_memory(int nid, u64 start, u64 size)
        int retry = 1;
        start_pfn = PFN_DOWN(start);
-        end_pfn = start_pfn + PFN_DOWN(size);
+        end_pfn = PFN_UP(start + size - 1);
        /*
         * When CONFIG_MEMCG is on, one memory block may be used by other
diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
index 926b46649749..fd26d0433509 100644
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -429,12 +429,6 @@ compat_process_vm_rw(compat_pid_t pid,
        if (flags != 0)
                return -EINVAL;
-        if (!access_ok(VERIFY_READ, lvec, liovcnt * sizeof(*lvec)))
-                goto out;
-        if (!access_ok(VERIFY_READ, rvec, riovcnt * sizeof(*rvec)))
-                goto out;
        if (vm_write)
                rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt,
                                                  UIO_FASTIOV, iovstack_l,
@@ -459,8 +453,6 @@ free_iovecs:
                kfree(iov_r);
        if (iov_l != iovstack_l)
                kfree(iov_l);
-out:
        return rc;
 }
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index a0b253ecadaf..a5bb0a769eb9 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -1288,7 +1288,8 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
        batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;
        /* unpack the aggregated packets and process them one by one */
-        do {
+        while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
+                                         batadv_ogm_packet->tt_num_changes)) {
                tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN;
                batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff,
@@ -1299,8 +1300,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
                packet_pos = packet_buff + buff_pos;
                batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;
-        } while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
+        }
-                                           batadv_ogm_packet->tt_num_changes));
        kfree_skb(skb);
        return NET_RX_SUCCESS;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index d5f1d3fd4b28..314c73ed418f 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -66,7 +66,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                        goto out;
                }
-                mdst = br_mdb_get(br, skb);
+                mdst = br_mdb_get(br, skb, vid);
                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
                        br_multicast_deliver(mdst, skb);
                else
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 480330151898..828e2bcc1f52 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -97,7 +97,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
        if (is_broadcast_ether_addr(dest))
                skb2 = skb;
        else if (is_multicast_ether_addr(dest)) {
-                mdst = br_mdb_get(br, skb);
+                mdst = br_mdb_get(br, skb, vid);
                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
                        if ((mdst && mdst->mglist) ||
                            br_multicast_is_router(br))
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 9f97b850fc65..ee79f3f20383 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -80,6 +80,7 @@ static int br_mdb_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
                                port = p->port;
                                if (port) {
                                        struct br_mdb_entry e;
+                                        memset(&e, 0, sizeof(e));
                                        e.ifindex = port->dev->ifindex;
                                        e.state = p->state;
                                        if (p->addr.proto == htons(ETH_P_IP))
@@ -136,6 +137,7 @@ static int br_mdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                break;
                        bpm = nlmsg_data(nlh);
+                        memset(bpm, 0, sizeof(*bpm));
                        bpm->ifindex = dev->ifindex;
                        if (br_mdb_fill_info(skb, cb, dev) < 0)
                                goto out;
@@ -171,6 +173,7 @@ static int nlmsg_populate_mdb_fill(struct sk_buff *skb,
                return -EMSGSIZE;
        bpm = nlmsg_data(nlh);
+        memset(bpm, 0, sizeof(*bpm));
        bpm->family  = AF_BRIDGE;
        bpm->ifindex = dev->ifindex;
        nest = nla_nest_start(skb, MDBA_MDB);
@@ -228,6 +231,7 @@ void br_mdb_notify(struct net_device *dev, struct net_bridge_port *port,
 {
        struct br_mdb_entry entry;
+        memset(&entry, 0, sizeof(entry));
        entry.ifindex = port->dev->ifindex;
        entry.addr.proto = group->proto;
        entry.addr.u.ip4 = group->u.ip4;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 10e6fce1bb62..923fbeaf7afd 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -132,7 +132,7 @@ static struct net_bridge_mdb_entry *br_mdb_ip6_get(
 #endif
 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
-                                        struct sk_buff *skb)
+                                        struct sk_buff *skb, u16 vid)
 {
        struct net_bridge_mdb_htable *mdb = rcu_dereference(br->mdb);
        struct br_ip ip;
@@ -144,6 +144,7 @@ struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                return NULL;
        ip.proto = skb->protocol;
+        ip.vid = vid;
        switch (skb->protocol) {
        case htons(ETH_P_IP):
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 27aa3ee517ce..299fc5f40a26 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -29,6 +29,7 @@ static inline size_t br_port_info_size(void)
                + nla_total_size(1)     /* IFLA_BRPORT_MODE */
                + nla_total_size(1)     /* IFLA_BRPORT_GUARD */
                + nla_total_size(1)     /* IFLA_BRPORT_PROTECT */
+                + nla_total_size(1)     /* IFLA_BRPORT_FAST_LEAVE */
                + 0;
 }
@@ -329,6 +330,7 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[])
        br_set_port_flag(p, tb, IFLA_BRPORT_MODE, BR_HAIRPIN_MODE);
        br_set_port_flag(p, tb, IFLA_BRPORT_GUARD, BR_BPDU_GUARD);
        br_set_port_flag(p, tb, IFLA_BRPORT_FAST_LEAVE, BR_MULTICAST_FAST_LEAVE);
+        br_set_port_flag(p, tb, IFLA_BRPORT_PROTECT, BR_ROOT_BLOCK);
        if (tb[IFLA_BRPORT_COST]) {
                err = br_stp_set_path_cost(p, nla_get_u32(tb[IFLA_BRPORT_COST]));
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 6d314c4e6bcb..3cbf5beb3d4b 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -442,7 +442,7 @@ extern int br_multicast_rcv(struct net_bridge *br,
                            struct net_bridge_port *port,
                            struct sk_buff *skb);
 extern struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
-                                               struct sk_buff *skb);
+                                               struct sk_buff *skb, u16 vid);
 extern void br_multicast_add_port(struct net_bridge_port *port);
 extern void br_multicast_del_port(struct net_bridge_port *port);
 extern void br_multicast_enable_port(struct net_bridge_port *port);
@@ -504,7 +504,7 @@ static inline int br_multicast_rcv(struct net_bridge *br,
 }
 static inline struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
-                                                      struct sk_buff *skb)
+                                                      struct sk_buff *skb, u16 vid)
 {
        return NULL;
 }
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 69bc4bf89e3e..4543b9aba40c 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -654,6 +654,24 @@ static int osdmap_set_max_osd(struct ceph_osdmap *map, int max)
        return 0;
 }
+static int __decode_pgid(void **p, void *end, struct ceph_pg *pg)
+{
+        u8 v;
+        ceph_decode_need(p, end, 1+8+4+4, bad);
+        v = ceph_decode_8(p);
+        if (v != 1)
+                goto bad;
+        pg->pool = ceph_decode_64(p);
+        pg->seed = ceph_decode_32(p);
+        *p += 4; /* skip preferred */
+        return 0;
+bad:
+        dout("error decoding pgid\n");
+        return -EINVAL;
+}
 /*
 * decode a full map.
 */
@@ -745,13 +763,12 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
        for (i = 0; i < len; i++) {
                int n, j;
                struct ceph_pg pgid;
-                struct ceph_pg_v1 pgid_v1;
                struct ceph_pg_mapping *pg;
-                ceph_decode_need(p, end, sizeof(u32) + sizeof(u64), bad);
+                err = __decode_pgid(p, end, &pgid);
-                ceph_decode_copy(p, &pgid_v1, sizeof(pgid_v1));
+                if (err)
-                pgid.pool = le32_to_cpu(pgid_v1.pool);
+                        goto bad;
-                pgid.seed = le16_to_cpu(pgid_v1.ps);
+                ceph_decode_need(p, end, sizeof(u32), bad);
                n = ceph_decode_32(p);
                err = -EINVAL;
                if (n > (UINT_MAX - sizeof(*pg)) / sizeof(u32))
@@ -818,8 +835,8 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        u16 version;
        ceph_decode_16_safe(p, end, version, bad);
-        if (version > 6) {
+        if (version != 6) {
-                pr_warning("got unknown v %d > %d of inc osdmap\n", version, 6);
+                pr_warning("got unknown v %d != 6 of inc osdmap\n", version);
                goto bad;
        }
@@ -963,15 +980,14 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        while (len--) {
                struct ceph_pg_mapping *pg;
                int j;
-                struct ceph_pg_v1 pgid_v1;
                struct ceph_pg pgid;
                u32 pglen;
-                ceph_decode_need(p, end, sizeof(u64) + sizeof(u32), bad);
-                ceph_decode_copy(p, &pgid_v1, sizeof(pgid_v1));
-                pgid.pool = le32_to_cpu(pgid_v1.pool);
-                pgid.seed = le16_to_cpu(pgid_v1.ps);
-                pglen = ceph_decode_32(p);
+                err = __decode_pgid(p, end, &pgid);
+                if (err)
+                        goto bad;
+                ceph_decode_need(p, end, sizeof(u32), bad);
+                pglen = ceph_decode_32(p);
                if (pglen) {
                        ceph_decode_need(p, end, pglen*sizeof(u32), bad);
diff --git a/net/core/dev.c b/net/core/dev.c
index a06a7a58dd11..d540ced1f6c6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2219,9 +2219,9 @@ struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
        struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
        struct packet_offload *ptype;
        __be16 type = skb->protocol;
+        int vlan_depth = ETH_HLEN;
        while (type == htons(ETH_P_8021Q)) {
-                int vlan_depth = ETH_HLEN;
                struct vlan_hdr *vh;
                if (unlikely(!pskb_may_pull(skb, vlan_depth + VLAN_HLEN)))
@@ -3444,6 +3444,7 @@ ncls:
                }
                switch (rx_handler(&skb)) {
                case RX_HANDLER_CONSUMED:
+                        ret = NET_RX_SUCCESS;
                        goto unlock;
                case RX_HANDLER_ANOTHER:
                        goto another_round;
@@ -4103,7 +4104,7 @@ static void net_rx_action(struct softirq_action *h)
                 * Allow this to run for 2 jiffies since which will allow
                 * an average latency of 1.5/HZ.
                 */
-                if (unlikely(budget <= 0 || time_after(jiffies, time_limit)))
+                if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
                        goto softnet_break;
                local_irq_enable();
@@ -4780,7 +4781,7 @@ EXPORT_SYMBOL(dev_set_mac_address);
 /**
 *      dev_change_carrier - Change device carrier
 *      @dev: device
- *      @new_carries: new value
+ *      @new_carrier: new value
 *
 *      Change device carrier
 */
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b376410ff259..5fb8d7e47294 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -979,6 +979,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                         * report anything.
                         */
                        ivi.spoofchk = -1;
+                        memset(ivi.mac, 0, sizeof(ivi.mac));
                        if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
                                break;
                        vf_mac.vf =
@@ -2620,7 +2621,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
                while (RTA_OK(attr, attrlen)) {
-                        unsigned int flavor = attr->rta_type;
+                        unsigned int flavor = attr->rta_type & NLA_TYPE_MASK;
                        if (flavor) {
                                if (flavor > rta_max[sz_idx])
                                        return -EINVAL;
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 1b588e23cf80..21291f1abcd6 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -284,6 +284,7 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlmsghdr *nlh,
        if (!netdev->dcbnl_ops->getpermhwaddr)
                return -EOPNOTSUPP;
+        memset(perm_addr, 0, sizeof(perm_addr));
        netdev->dcbnl_ops->getpermhwaddr(netdev, perm_addr);
        return nla_put(skb, DCB_ATTR_PERM_HWADDR, sizeof(perm_addr), perm_addr);
@@ -1042,6 +1043,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
        if (ops->ieee_getets) {
                struct ieee_ets ets;
+                memset(&ets, 0, sizeof(ets));
                err = ops->ieee_getets(netdev, &ets);
                if (!err &&
                    nla_put(skb, DCB_ATTR_IEEE_ETS, sizeof(ets), &ets))
@@ -1050,6 +1052,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
        if (ops->ieee_getmaxrate) {
                struct ieee_maxrate maxrate;
+                memset(&maxrate, 0, sizeof(maxrate));
                err = ops->ieee_getmaxrate(netdev, &maxrate);
                if (!err) {
                        err = nla_put(skb, DCB_ATTR_IEEE_MAXRATE,
@@ -1061,6 +1064,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
        if (ops->ieee_getpfc) {
                struct ieee_pfc pfc;
+                memset(&pfc, 0, sizeof(pfc));
                err = ops->ieee_getpfc(netdev, &pfc);
                if (!err &&
                    nla_put(skb, DCB_ATTR_IEEE_PFC, sizeof(pfc), &pfc))
@@ -1094,6 +1098,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
        /* get peer info if available */
        if (ops->ieee_peer_getets) {
                struct ieee_ets ets;
+                memset(&ets, 0, sizeof(ets));
                err = ops->ieee_peer_getets(netdev, &ets);
                if (!err &&
                    nla_put(skb, DCB_ATTR_IEEE_PEER_ETS, sizeof(ets), &ets))
@@ -1102,6 +1107,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
        if (ops->ieee_peer_getpfc) {
                struct ieee_pfc pfc;
+                memset(&pfc, 0, sizeof(pfc));
                err = ops->ieee_peer_getpfc(netdev, &pfc);
                if (!err &&
                    nla_put(skb, DCB_ATTR_IEEE_PEER_PFC, sizeof(pfc), &pfc))
@@ -1280,6 +1286,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
        /* peer info if available */
        if (ops->cee_peer_getpg) {
                struct cee_pg pg;
+                memset(&pg, 0, sizeof(pg));
                err = ops->cee_peer_getpg(netdev, &pg);
                if (!err &&
                    nla_put(skb, DCB_ATTR_CEE_PEER_PG, sizeof(pg), &pg))
@@ -1288,6 +1295,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
        if (ops->cee_peer_getpfc) {
                struct cee_pfc pfc;
+                memset(&pfc, 0, sizeof(pfc));
                err = ops->cee_peer_getpfc(netdev, &pfc);
                if (!err &&
                    nla_put(skb, DCB_ATTR_CEE_PEER_PFC, sizeof(pfc), &pfc))
diff --git a/net/ieee802154/6lowpan.h b/net/ieee802154/6lowpan.h
index 8c2251fb0a3f..bba5f8336317 100644
--- a/net/ieee802154/6lowpan.h
+++ b/net/ieee802154/6lowpan.h
@@ -84,7 +84,7 @@
        (memcmp(addr1, addr2, length >> 3) == 0)
 /* local link, i.e. FE80::/10 */
-#define is_addr_link_local(a) (((a)->s6_addr16[0]) == 0x80FE)
+#define is_addr_link_local(a) (((a)->s6_addr16[0]) == htons(0xFE80))
 /*
 * check whether we can compress the IID to 16 bits,
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 7d1874be1df3..786d97aee751 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -735,6 +735,7 @@ EXPORT_SYMBOL(inet_csk_destroy_sock);
 * tcp/dccp_create_openreq_child().
 */
 void inet_csk_prepare_forced_close(struct sock *sk)
+        __releases(&sk->sk_lock.slock)
 {
        /* sk_clone_lock locked the socket and set refcnt to 2 */
        bh_unlock_sock(sk);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 245ae078a07f..f4fd23de9b13 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -21,6 +21,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/slab.h>
+#include <net/sock.h>
 #include <net/inet_frag.h>
 static void inet_frag_secret_rebuild(unsigned long dummy)
@@ -277,6 +278,7 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
        __releases(&f->lock)
 {
        struct inet_frag_queue *q;
+        int depth = 0;
        hlist_for_each_entry(q, &f->hash[hash], list) {
                if (q->net == nf && f->match(q, key)) {
@@ -284,9 +286,25 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
                        read_unlock(&f->lock);
                        return q;
                }
+                depth++;
        }
        read_unlock(&f->lock);
-        return inet_frag_create(nf, f, key);
+        if (depth <= INETFRAGS_MAXDEPTH)
+                return inet_frag_create(nf, f, key);
+        else
+                return ERR_PTR(-ENOBUFS);
 }
 EXPORT_SYMBOL(inet_frag_find);
+void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
+                                   const char *prefix)
+{
+        static const char msg[] = "inet_frag_find: Fragment hash bucket"
+                " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH)
+                ". Dropping fragment.\n";
+        if (PTR_ERR(q) == -ENOBUFS)
+                LIMIT_NETDEBUG(KERN_WARNING "%s%s", prefix, msg);
+}
+EXPORT_SYMBOL(inet_frag_maybe_warn_overflow);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index b6d30acb600c..a6445b843ef4 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -292,14 +292,11 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
        hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);
        q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);
-        if (q == NULL)
+        if (IS_ERR_OR_NULL(q)) {
-                goto out_nomem;
+                inet_frag_maybe_warn_overflow(q, pr_fmt());
+                return NULL;
+        }
        return container_of(q, struct ipq, q);
-out_nomem:
-        LIMIT_NETDEBUG(KERN_ERR pr_fmt("ip_frag_create: no memory left !\n"));
-        return NULL;
 }
 /* Is the fragment too far ahead to be part of ipq? */
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d0ef0e674ec5..91d66dbde9c0 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -798,10 +798,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
        if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
                gre_hlen = 0;
-                if (skb->protocol == htons(ETH_P_IP))
+                tiph = (const struct iphdr *)skb->data;
-                        tiph = (const struct iphdr *)skb->data;
-                else
-                        tiph = &tunnel->parms.iph;
        } else {
                gre_hlen = tunnel->hlen;
                tiph = &tunnel->parms.iph;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index f6289bf6f332..ec7264514a82 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -370,7 +370,6 @@ int ip_options_compile(struct net *net,
                                }
                                switch (optptr[3]&0xF) {
                                      case IPOPT_TS_TSONLY:
-                                        opt->ts = optptr - iph;
                                        if (skb)
                                                timeptr = &optptr[optptr[2]-1];
                                        opt->ts_needtime = 1;
@@ -381,7 +380,6 @@ int ip_options_compile(struct net *net,
                                                pp_ptr = optptr + 2;
                                                goto error;
                                        }
-                                        opt->ts = optptr - iph;
                                        if (rt)  {
                                                spec_dst_fill(&spec_dst, skb);
                                                memcpy(&optptr[optptr[2]-1], &spec_dst, 4);
@@ -396,7 +394,6 @@ int ip_options_compile(struct net *net,
                                                pp_ptr = optptr + 2;
                                                goto error;
                                        }
-                                        opt->ts = optptr - iph;
                                        {
                                                __be32 addr;
                                                memcpy(&addr, &optptr[optptr[2]-1], 4);
@@ -423,18 +420,18 @@ int ip_options_compile(struct net *net,
                                        put_unaligned_be32(midtime, timeptr);
                                        opt->is_changed = 1;
                                }
-                        } else {
+                        } else if ((optptr[3]&0xF) != IPOPT_TS_PRESPEC) {
                                unsigned int overflow = optptr[3]>>4;
                                if (overflow == 15) {
                                        pp_ptr = optptr + 3;
                                        goto error;
                                }
-                                opt->ts = optptr - iph;
                                if (skb) {
                                        optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4);
                                        opt->is_changed = 1;
                                }
                        }
+                        opt->ts = optptr - iph;
                        break;
                      case IPOPT_RA:
                        if (optlen < 4) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 47e854fcae24..e22020790709 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -775,7 +775,7 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
                         * Make sure that we have exactly size bytes
                         * available to the caller, no more, no less.
                         */
-                        skb->avail_size = size;
+                        skb->reserved_tailroom = skb->end - skb->tail - size;
                        return skb;
                }
                __kfree_skb(skb);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 4a8ec457310f..d09203c63264 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -274,13 +274,6 @@ static void tcp_v4_mtu_reduced(struct sock *sk)
        struct inet_sock *inet = inet_sk(sk);
        u32 mtu = tcp_sk(sk)->mtu_info;
-        /* We are not interested in TCP_LISTEN and open_requests (SYN-ACKs
-         * send out by Linux are always <576bytes so they should go through
-         * unfragmented).
-         */
-        if (sk->sk_state == TCP_LISTEN)
-                return;
        dst = inet_csk_update_pmtu(sk, mtu);
        if (!dst)
                return;
@@ -408,6 +401,13 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                        goto out;
                if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
+                        /* We are not interested in TCP_LISTEN and open_requests
+                         * (SYN-ACKs send out by Linux are always <576bytes so
+                         * they should go through unfragmented).
+                         */
+                        if (sk->sk_state == TCP_LISTEN)
+                                goto out;
                        tp->mtu_info = info;
                        if (!sock_owned_by_user(sk)) {
                                tcp_v4_mtu_reduced(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e2b4461074da..817fbb396bc8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1298,7 +1298,6 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
        eat = min_t(int, len, skb_headlen(skb));
        if (eat) {
                __skb_pull(skb, eat);
-                skb->avail_size -= eat;
                len -= eat;
                if (!len)
                        return;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index b1876e52091e..e33fe0ab2568 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -281,7 +281,8 @@ int ip6_mc_input(struct sk_buff *skb)
         *      IPv6 multicast router mode is now supported ;)
         */
        if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding &&
-            !(ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) &&
+            !(ipv6_addr_type(&hdr->daddr) &
+              (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) &&
            likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
                /*
                 * Okay, we try to forward - split and duplicate
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 54087e96d7b8..6700069949dd 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -14,6 +14,8 @@
 * 2 of the License, or (at your option) any later version.
 */
+#define pr_fmt(fmt) "IPv6-nf: " fmt
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/string.h>
@@ -180,13 +182,11 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id,
        q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash);
        local_bh_enable();
-        if (q == NULL)
+        if (IS_ERR_OR_NULL(q)) {
-                goto oom;
+                inet_frag_maybe_warn_overflow(q, pr_fmt());
+                return NULL;
+        }
        return container_of(q, struct frag_queue, q);
-oom:
-        return NULL;
 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 3c6a77290c6e..196ab9347ad1 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -26,6 +26,9 @@
 *      YOSHIFUJI,H. @USAGI     Always remove fragment header to
 *                              calculate ICV correctly.
 */
+#define pr_fmt(fmt) "IPv6: " fmt
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/string.h>
@@ -185,9 +188,10 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6
        hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
        q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
-        if (q == NULL)
+        if (IS_ERR_OR_NULL(q)) {
+                inet_frag_maybe_warn_overflow(q, pr_fmt());
                return NULL;
+        }
        return container_of(q, struct frag_queue, q);
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9b6460055df5..f6d629fd6aee 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -389,6 +389,13 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        }
        if (type == ICMPV6_PKT_TOOBIG) {
+                /* We are not interested in TCP_LISTEN and open_requests
+                 * (SYN-ACKs send out by Linux are always <576bytes so
+                 * they should go through unfragmented).
+                 */
+                if (sk->sk_state == TCP_LISTEN)
+                        goto out;
                tp->mtu_info = ntohl(info);
                if (!sock_owned_by_user(sk))
                        tcp_v6_mtu_reduced(sk);
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 9a5fd3c3e530..362ba47968e4 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -280,7 +280,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
        struct tty_port *port = &self->port;
        DECLARE_WAITQUEUE(wait, current);
        int             retval;
-        int             do_clocal = 0, extra_count = 0;
+        int             do_clocal = 0;
        unsigned long   flags;
        IRDA_DEBUG(2, "%s()\n", __func__ );
@@ -289,8 +289,15 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
         * If non-blocking mode is set, or the port is not enabled,
         * then make the check up front and then exit.
         */
-        if (filp->f_flags & O_NONBLOCK || tty->flags & (1 << TTY_IO_ERROR)){
+        if (test_bit(TTY_IO_ERROR, &tty->flags)) {
-                /* nonblock mode is set or port is not enabled */
+                port->flags |= ASYNC_NORMAL_ACTIVE;
+                return 0;
+        }
+        if (filp->f_flags & O_NONBLOCK) {
+                /* nonblock mode is set */
+                if (tty->termios.c_cflag & CBAUD)
+                        tty_port_raise_dtr_rts(port);
                port->flags |= ASYNC_NORMAL_ACTIVE;
                IRDA_DEBUG(1, "%s(), O_NONBLOCK requested!\n", __func__ );
                return 0;
@@ -315,18 +322,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
              __FILE__, __LINE__, tty->driver->name, port->count);
        spin_lock_irqsave(&port->lock, flags);
-        if (!tty_hung_up_p(filp)) {
+        if (!tty_hung_up_p(filp))
-                extra_count = 1;
                port->count--;
-        }
-        spin_unlock_irqrestore(&port->lock, flags);
        port->blocked_open++;
+        spin_unlock_irqrestore(&port->lock, flags);
        while (1) {
                if (tty->termios.c_cflag & CBAUD)
                        tty_port_raise_dtr_rts(port);
-                current->state = TASK_INTERRUPTIBLE;
+                set_current_state(TASK_INTERRUPTIBLE);
                if (tty_hung_up_p(filp) ||
                    !test_bit(ASYNCB_INITIALIZED, &port->flags)) {
@@ -361,13 +366,11 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
        __set_current_state(TASK_RUNNING);
        remove_wait_queue(&port->open_wait, &wait);
-        if (extra_count) {
+        spin_lock_irqsave(&port->lock, flags);
-                /* ++ is not atomic, so this should be protected - Jean II */
+        if (!tty_hung_up_p(filp))
-                spin_lock_irqsave(&port->lock, flags);
                port->count++;
-                spin_unlock_irqrestore(&port->lock, flags);
-        }
        port->blocked_open--;
+        spin_unlock_irqrestore(&port->lock, flags);
        IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
              __FILE__, __LINE__, tty->driver->name, port->count);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 556fdafdd1ea..8555f331ea60 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2201,7 +2201,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
                      XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);
        xp->priority = pol->sadb_x_policy_priority;
-        sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
+        sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
        xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr);
        if (!xp->family) {
                err = -EINVAL;
@@ -2214,7 +2214,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
        if (xp->selector.sport)
                xp->selector.sport_mask = htons(0xffff);
-        sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1],
+        sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1];
        pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr);
        xp->selector.prefixlen_d = sa->sadb_address_prefixlen;
@@ -2315,7 +2315,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
        memset(&sel, 0, sizeof(sel));
-        sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
+        sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1];
        sel.family = pfkey_sadb_addr2xfrm_addr(sa, &sel.saddr);
        sel.prefixlen_s = sa->sadb_address_prefixlen;
        sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
@@ -2323,7 +2323,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
        if (sel.sport)
                sel.sport_mask = htons(0xffff);
-        sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1],
+        sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1];
        pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr);
        sel.prefixlen_d = sa->sadb_address_prefixlen;
        sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 808f5fcd1ced..fb306814576a 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3290,14 +3290,19 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
        int ret = -ENODATA;
        rcu_read_lock();
-        if (local->use_chanctx) {
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (chanctx_conf) {
-                if (chanctx_conf) {
+                *chandef = chanctx_conf->def;
-                        *chandef = chanctx_conf->def;
+                ret = 0;
-                        ret = 0;
+        } else if (local->open_count > 0 &&
-                }
+                   local->open_count == local->monitors &&
-        } else if (local->open_count == local->monitors) {
+                   sdata->vif.type == NL80211_IFTYPE_MONITOR) {
-                *chandef = local->monitor_chandef;
+                if (local->use_chanctx)
+                        *chandef = local->monitor_chandef;
+                else
+                        cfg80211_chandef_create(chandef,
+                                                local->_oper_channel,
+                                                local->_oper_channel_type);
                ret = 0;
        }
        rcu_read_unlock();
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 640afab304d7..baaa8608e52d 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -541,6 +541,9 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                ieee80211_adjust_monitor_flags(sdata, 1);
                ieee80211_configure_filter(local);
+                mutex_lock(&local->mtx);
+                ieee80211_recalc_idle(local);
+                mutex_unlock(&local->mtx);
                netif_carrier_on(dev);
                break;
@@ -812,6 +815,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                ieee80211_adjust_monitor_flags(sdata, -1);
                ieee80211_configure_filter(local);
+                mutex_lock(&local->mtx);
+                ieee80211_recalc_idle(local);
+                mutex_unlock(&local->mtx);
                break;
        case NL80211_IFTYPE_P2P_DEVICE:
                /* relies on synchronize_rcu() below */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 9f6464f3e05f..141577412d84 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -647,6 +647,9 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
                our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
                                                                mask) >> shift;
+                if (our_mcs == IEEE80211_VHT_MCS_NOT_SUPPORTED)
+                        continue;
                switch (ap_mcs) {
                default:
                        if (our_mcs <= ap_mcs)
@@ -3503,6 +3506,14 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        /*
+         * Stop timers before deleting work items, as timers
+         * could race and re-add the work-items. They will be
+         * re-established on connection.
+         */
+        del_timer_sync(&ifmgd->conn_mon_timer);
+        del_timer_sync(&ifmgd->bcn_mon_timer);
+        /*
         * we need to use atomic bitops for the running bits
         * only because both timers might fire at the same
         * time -- the code here is properly synchronised.
@@ -3516,13 +3527,9 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
        if (del_timer_sync(&ifmgd->timer))
                set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
-        cancel_work_sync(&ifmgd->chswitch_work);
        if (del_timer_sync(&ifmgd->chswitch_timer))
                set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
+        cancel_work_sync(&ifmgd->chswitch_work);
-        /* these will just be re-established on connection */
-        del_timer_sync(&ifmgd->conn_mon_timer);
-        del_timer_sync(&ifmgd->bcn_mon_timer);
 }
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
@@ -4315,6 +4322,17 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        /*
+         * Make sure some work items will not run after this,
+         * they will not do anything but might not have been
+         * cancelled when disconnecting.
+         */
+        cancel_work_sync(&ifmgd->monitor_work);
+        cancel_work_sync(&ifmgd->beacon_connection_loss_work);
+        cancel_work_sync(&ifmgd->request_smps_work);
+        cancel_work_sync(&ifmgd->csa_connection_drop_work);
+        cancel_work_sync(&ifmgd->chswitch_work);
        mutex_lock(&ifmgd->mtx);
        if (ifmgd->assoc_data)
                ieee80211_destroy_assoc_data(sdata, false);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ce78d1149f1d..8914d2d2881a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2745,7 +2745,8 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                }
-                sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                if (!ieee80211_tx_prepare(sdata, &tx, skb))
                        break;
                dev_kfree_skb_any(skb);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index a9740bd6fe54..94b4b9853f60 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -339,6 +339,13 @@ void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct,
 {
        const struct nf_conn_help *help;
        const struct nf_conntrack_helper *helper;
+        struct va_format vaf;
+        va_list args;
+        va_start(args, fmt);
+        vaf.fmt = fmt;
+        vaf.va = &args;
        /* Called from the helper function, this call never fails */
        help = nfct_help(ct);
@@ -347,7 +354,9 @@ void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct,
        helper = rcu_dereference(help->helper);
        nf_log_packet(nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL,
-                      "nf_ct_%s: dropping packet: %s ", helper->name, fmt);
+                      "nf_ct_%s: dropping packet: %pV ", helper->name, &vaf);
+        va_end(args);
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_log);
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index d578ec251712..0b1b32cda307 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -62,11 +62,6 @@ void nfnl_unlock(__u8 subsys_id)
 }
 EXPORT_SYMBOL_GPL(nfnl_unlock);
-static struct mutex *nfnl_get_lock(__u8 subsys_id)
-{
-        return &table[subsys_id].mutex;
-}
 int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n)
 {
        nfnl_lock(n->subsys_id);
@@ -199,7 +194,7 @@ replay:
                        rcu_read_unlock();
                        nfnl_lock(subsys_id);
                        if (rcu_dereference_protected(table[subsys_id].subsys,
-                                lockdep_is_held(nfnl_get_lock(subsys_id))) != ss ||
+                                lockdep_is_held(&table[subsys_id].mutex)) != ss ||
                            nfnetlink_find_client(type, ss) != nc)
                                err = -EAGAIN;
                        else if (nc->call)
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index ba92824086f3..3228d7f24eb4 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -124,6 +124,9 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
        const struct xt_audit_info *info = par->targinfo;
        struct audit_buffer *ab;
+        if (audit_enabled == 0)
+                goto errout;
        ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
        if (ab == NULL)
                goto errout;
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 847d495cd4de..8a6c6ea466d8 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1189,8 +1189,6 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
        struct netlbl_unlhsh_walk_arg cb_arg;
        u32 skip_bkt = cb->args[0];
        u32 skip_chain = cb->args[1];
-        u32 skip_addr4 = cb->args[2];
-        u32 skip_addr6 = cb->args[3];
        u32 iter_bkt;
        u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
        struct netlbl_unlhsh_iface *iface;
@@ -1215,7 +1213,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
                                continue;
                        netlbl_af4list_foreach_rcu(addr4,
                                                   &iface->addr4_list) {
-                                if (iter_addr4++ < skip_addr4)
+                                if (iter_addr4++ < cb->args[2])
                                        continue;
                                if (netlbl_unlabel_staticlist_gen(
                                              NLBL_UNLABEL_C_STATICLIST,
@@ -1231,7 +1229,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 #if IS_ENABLED(CONFIG_IPV6)
                        netlbl_af6list_foreach_rcu(addr6,
                                                   &iface->addr6_list) {
-                                if (iter_addr6++ < skip_addr6)
+                                if (iter_addr6++ < cb->args[3])
                                        continue;
                                if (netlbl_unlabel_staticlist_gen(
                                              NLBL_UNLABEL_C_STATICLIST,
@@ -1250,10 +1248,10 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 unlabel_staticlist_return:
        rcu_read_unlock();
-        cb->args[0] = skip_bkt;
+        cb->args[0] = iter_bkt;
-        cb->args[1] = skip_chain;
+        cb->args[1] = iter_chain;
-        cb->args[2] = skip_addr4;
+        cb->args[2] = iter_addr4;
-        cb->args[3] = skip_addr6;
+        cb->args[3] = iter_addr6;
        return skb->len;
 }
@@ -1273,12 +1271,9 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
 {
        struct netlbl_unlhsh_walk_arg cb_arg;
        struct netlbl_unlhsh_iface *iface;
-        u32 skip_addr4 = cb->args[0];
+        u32 iter_addr4 = 0, iter_addr6 = 0;
-        u32 skip_addr6 = cb->args[1];
-        u32 iter_addr4 = 0;
        struct netlbl_af4list *addr4;
 #if IS_ENABLED(CONFIG_IPV6)
-        u32 iter_addr6 = 0;
        struct netlbl_af6list *addr6;
 #endif
@@ -1292,7 +1287,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
                goto unlabel_staticlistdef_return;
        netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
-                if (iter_addr4++ < skip_addr4)
+                if (iter_addr4++ < cb->args[0])
                        continue;
                if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
                                              iface,
@@ -1305,7 +1300,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
        }
 #if IS_ENABLED(CONFIG_IPV6)
        netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
-                if (iter_addr6++ < skip_addr6)
+                if (iter_addr6++ < cb->args[1])
                        continue;
                if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
                                              iface,
@@ -1320,8 +1315,8 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
 unlabel_staticlistdef_return:
        rcu_read_unlock();
-        cb->args[0] = skip_addr4;
+        cb->args[0] = iter_addr4;
-        cb->args[1] = skip_addr6;
+        cb->args[1] = iter_addr6;
        return skb->len;
 }
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 7f8266dd14cb..b530afadd76c 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -68,7 +68,8 @@ static void nfc_llcp_socket_purge(struct nfc_llcp_sock *sock)
        }
 }
-static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
+static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen,
+                                    int err)
 {
        struct sock *sk;
        struct hlist_node *tmp;
@@ -100,7 +101,10 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
                                nfc_llcp_accept_unlink(accept_sk);
+                                if (err)
+                                        accept_sk->sk_err = err;
                                accept_sk->sk_state = LLCP_CLOSED;
+                                accept_sk->sk_state_change(sk);
                                bh_unlock_sock(accept_sk);
@@ -123,7 +127,10 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
                        continue;
                }
+                if (err)
+                        sk->sk_err = err;
                sk->sk_state = LLCP_CLOSED;
+                sk->sk_state_change(sk);
                bh_unlock_sock(sk);
@@ -133,6 +140,36 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
        }
        write_unlock(&local->sockets.lock);
+        /*
+         * If we want to keep the listening sockets alive,
+         * we don't touch the RAW ones.
+         */
+        if (listen == true)
+                return;
+        write_lock(&local->raw_sockets.lock);
+        sk_for_each_safe(sk, tmp, &local->raw_sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
+                bh_lock_sock(sk);
+                nfc_llcp_socket_purge(llcp_sock);
+                if (err)
+                        sk->sk_err = err;
+                sk->sk_state = LLCP_CLOSED;
+                sk->sk_state_change(sk);
+                bh_unlock_sock(sk);
+                sock_orphan(sk);
+                sk_del_node_init(sk);
+        }
+        write_unlock(&local->raw_sockets.lock);
 }
 struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
@@ -142,20 +179,25 @@ struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
        return local;
 }
-static void local_release(struct kref *ref)
+static void local_cleanup(struct nfc_llcp_local *local, bool listen)
 {
-        struct nfc_llcp_local *local;
+        nfc_llcp_socket_release(local, listen, ENXIO);
-        local = container_of(ref, struct nfc_llcp_local, ref);
-        list_del(&local->list);
-        nfc_llcp_socket_release(local, false);
        del_timer_sync(&local->link_timer);
        skb_queue_purge(&local->tx_queue);
        cancel_work_sync(&local->tx_work);
        cancel_work_sync(&local->rx_work);
        cancel_work_sync(&local->timeout_work);
        kfree_skb(local->rx_pending);
+}
+static void local_release(struct kref *ref)
+{
+        struct nfc_llcp_local *local;
+        local = container_of(ref, struct nfc_llcp_local, ref);
+        list_del(&local->list);
+        local_cleanup(local, false);
        kfree(local);
 }
@@ -1348,7 +1390,7 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev)
                return;
        /* Close and purge all existing sockets */
-        nfc_llcp_socket_release(local, true);
+        nfc_llcp_socket_release(local, true, 0);
 }
 void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
@@ -1427,6 +1469,8 @@ void nfc_llcp_unregister_device(struct nfc_dev *dev)
                return;
        }
+        local_cleanup(local, false);
        nfc_llcp_local_put(local);
 }
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 5332751943a9..5c7cdf3f2a83 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -278,6 +278,8 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
                        pr_debug("Returning sk state %d\n", sk->sk_state);
+                        sk_acceptq_removed(parent);
                        return sk;
                }
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index ac2defeeba83..d4d5363c7ba7 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -58,7 +58,7 @@ static int __pop_vlan_tci(struct sk_buff *skb, __be16 *current_tci)
        if (skb->ip_summed == CHECKSUM_COMPLETE)
                skb->csum = csum_sub(skb->csum, csum_partial(skb->data
-                                        + ETH_HLEN, VLAN_HLEN, 0));
+                                        + (2 * ETH_ALEN), VLAN_HLEN, 0));
        vhdr = (struct vlan_hdr *)(skb->data + ETH_HLEN);
        *current_tci = vhdr->h_vlan_TCI;
@@ -115,7 +115,7 @@ static int push_vlan(struct sk_buff *skb, const struct ovs_action_push_vlan *vla
                if (skb->ip_summed == CHECKSUM_COMPLETE)
                        skb->csum = csum_add(skb->csum, csum_partial(skb->data
-                                        + ETH_HLEN, VLAN_HLEN, 0));
+                                        + (2 * ETH_ALEN), VLAN_HLEN, 0));
        }
        __vlan_hwaccel_put_tag(skb, ntohs(vlan->vlan_tci) & ~VLAN_TAG_PRESENT);
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index e87a26506dba..a4b724708a1a 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -394,6 +394,7 @@ static int queue_userspace_packet(struct net *net, int dp_ifindex,
        skb_copy_and_csum_dev(skb, nla_data(nla));
+        genlmsg_end(user_skb, upcall);
        err = genlmsg_unicast(net, user_skb, upcall_info->portid);
 out:
@@ -1690,6 +1691,7 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)
        if (IS_ERR(vport))
                goto exit_unlock;
+        err = 0;
        reply = ovs_vport_cmd_build_info(vport, info->snd_portid, info->snd_seq,
                                         OVS_VPORT_CMD_NEW);
        if (IS_ERR(reply)) {
@@ -1771,6 +1773,7 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
        if (IS_ERR(reply))
                goto exit_unlock;
+        err = 0;
        ovs_dp_detach_port(vport);
        genl_notify(reply, genl_info_net(info), info->snd_portid,
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 20605ecf100b..fe0e4215c73d 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -482,7 +482,11 @@ static __be16 parse_ethertype(struct sk_buff *skb)
                return htons(ETH_P_802_2);
        __skb_pull(skb, sizeof(struct llc_snap_hdr));
-        return llc->ethertype;
+        if (ntohs(llc->ethertype) >= 1536)
+                return llc->ethertype;
+        return htons(ETH_P_802_2);
 }
 static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 670cbc3518de..2130d61c384a 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -43,8 +43,7 @@ static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
        /* Make our own copy of the packet.  Otherwise we will mangle the
         * packet for anyone who came before us (e.g. tcpdump via AF_PACKET).
-         * (No one comes after us, since we tell handle_bridge() that we took
+         */
-         * the packet.) */
        skb = skb_share_check(skb, GFP_ATOMIC);
        if (unlikely(!skb))
                return;
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index ba717cc038b3..f6b8132ce4cb 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -325,8 +325,7 @@ int ovs_vport_get_options(const struct vport *vport, struct sk_buff *skb)
 * @skb: skb that was received
 *
 * Must be called with rcu_read_lock.  The packet cannot be shared and
- * skb->data should point to the Ethernet header.  The caller must have already
+ * skb->data should point to the Ethernet header.
- * called compute_ip_summed() to initialize the checksumming fields.
 */
 void ovs_vport_receive(struct vport *vport, struct sk_buff *skb)
 {
diff --git a/net/rds/stats.c b/net/rds/stats.c
index 7be790d60b90..73be187d389e 100644
--- a/net/rds/stats.c
+++ b/net/rds/stats.c
@@ -87,6 +87,7 @@ void rds_stats_info_copy(struct rds_info_iterator *iter,
        for (i = 0; i < nr; i++) {
                BUG_ON(strlen(names[i]) >= sizeof(ctr.name));
                strncpy(ctr.name, names[i], sizeof(ctr.name) - 1);
+                ctr.name[sizeof(ctr.name) - 1] = '\0';
                ctr.value = values[i];
                rds_info_copy(iter, &ctr, sizeof(ctr));
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index e9a77f621c3d..d51852bba01c 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -298,6 +298,10 @@ static void qfq_update_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
            new_num_classes == q->max_agg_classes - 1) /* agg no more full */
                hlist_add_head(&agg->nonfull_next, &q->nonfull_aggs);
+        /* The next assignment may let
+         * agg->initial_budget > agg->budgetmax
+         * hold, we will take it into account in charge_actual_service().
+         */
        agg->budgetmax = new_num_classes * agg->lmax;
        new_agg_weight = agg->class_weight * new_num_classes;
        agg->inv_w = ONE_FP/new_agg_weight;
@@ -817,7 +821,7 @@ static void qfq_make_eligible(struct qfq_sched *q)
        unsigned long old_vslot = q->oldV >> q->min_slot_shift;
        if (vslot != old_vslot) {
-                unsigned long mask = (1UL << fls(vslot ^ old_vslot)) - 1;
+                unsigned long mask = (1ULL << fls(vslot ^ old_vslot)) - 1;
                qfq_move_groups(q, mask, IR, ER);
                qfq_move_groups(q, mask, IB, EB);
        }
@@ -988,12 +992,23 @@ static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
 /* Update F according to the actual service received by the aggregate. */
 static inline void charge_actual_service(struct qfq_aggregate *agg)
 {
-        /* compute the service received by the aggregate */
+        /* Compute the service received by the aggregate, taking into
-        u32 service_received = agg->initial_budget - agg->budget;
+         * account that, after decreasing the number of classes in
+         * agg, it may happen that
+         * agg->initial_budget - agg->budget > agg->bugdetmax
+         */
+        u32 service_received = min(agg->budgetmax,
+                                   agg->initial_budget - agg->budget);
        agg->F = agg->S + (u64)service_received * agg->inv_w;
 }
+static inline void qfq_update_agg_ts(struct qfq_sched *q,
+                                     struct qfq_aggregate *agg,
+                                     enum update_reason reason);
+static void qfq_schedule_agg(struct qfq_sched *q, struct qfq_aggregate *agg);
 static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
 {
        struct qfq_sched *q = qdisc_priv(sch);
@@ -1021,7 +1036,7 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
                in_serv_agg->initial_budget = in_serv_agg->budget =
                        in_serv_agg->budgetmax;
-                if (!list_empty(&in_serv_agg->active))
+                if (!list_empty(&in_serv_agg->active)) {
                        /*
                         * Still active: reschedule for
                         * service. Possible optimization: if no other
@@ -1032,8 +1047,9 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
                         * handle it, we would need to maintain an
                         * extra num_active_aggs field.
                        */
-                        qfq_activate_agg(q, in_serv_agg, requeue);
+                        qfq_update_agg_ts(q, in_serv_agg, requeue);
-                else if (sch->q.qlen == 0) { /* no aggregate to serve */
+                        qfq_schedule_agg(q, in_serv_agg);
+                } else if (sch->q.qlen == 0) { /* no aggregate to serve */
                        q->in_serv_agg = NULL;
                        return NULL;
                }
@@ -1052,7 +1068,15 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
        qdisc_bstats_update(sch, skb);
        agg_dequeue(in_serv_agg, cl, len);
-        in_serv_agg->budget -= len;
+        /* If lmax is lowered, through qfq_change_class, for a class
+         * owning pending packets with larger size than the new value
+         * of lmax, then the following condition may hold.
+         */
+        if (unlikely(in_serv_agg->budget < len))
+                in_serv_agg->budget = 0;
+        else
+                in_serv_agg->budget -= len;
        q->V += (u64)len * IWSUM;
        pr_debug("qfq dequeue: len %u F %lld now %lld\n",
                 len, (unsigned long long) in_serv_agg->F,
@@ -1217,17 +1241,11 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        cl->deficit = agg->lmax;
        list_add_tail(&cl->alist, &agg->active);
-        if (list_first_entry(&agg->active, struct qfq_class, alist) != cl)
+        if (list_first_entry(&agg->active, struct qfq_class, alist) != cl ||
-                return err; /* aggregate was not empty, nothing else to do */
+            q->in_serv_agg == agg)
+                return err; /* non-empty or in service, nothing else to do */
-        /* recharge budget */
+        qfq_activate_agg(q, agg, enqueue);
-        agg->initial_budget = agg->budget = agg->budgetmax;
-        qfq_update_agg_ts(q, agg, enqueue);
-        if (q->in_serv_agg == NULL)
-                q->in_serv_agg = agg;
-        else if (agg != q->in_serv_agg)
-                qfq_schedule_agg(q, agg);
        return err;
 }
@@ -1261,7 +1279,8 @@ static void qfq_schedule_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
                /* group was surely ineligible, remove */
                __clear_bit(grp->index, &q->bitmaps[IR]);
                __clear_bit(grp->index, &q->bitmaps[IB]);
-        } else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V))
+        } else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V) &&
+                   q->in_serv_agg == NULL)
                q->V = roundedS;
        grp->S = roundedS;
@@ -1284,8 +1303,15 @@ skip_update:
 static void qfq_activate_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
                             enum update_reason reason)
 {
+        agg->initial_budget = agg->budget = agg->budgetmax; /* recharge budg. */
        qfq_update_agg_ts(q, agg, reason);
-        qfq_schedule_agg(q, agg);
+        if (q->in_serv_agg == NULL) { /* no aggr. in service or scheduled */
+                q->in_serv_agg = agg; /* start serving this aggregate */
+                 /* update V: to be in service, agg must be eligible */
+                q->oldV = q->V = agg->S;
+        } else if (agg != q->in_serv_agg)
+                qfq_schedule_agg(q, agg);
 }
 static void qfq_slot_remove(struct qfq_sched *q, struct qfq_group *grp,
@@ -1357,8 +1383,6 @@ static void qfq_deactivate_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
                        __set_bit(grp->index, &q->bitmaps[s]);
                }
        }
-        qfq_update_eligible(q);
 }
 static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg)
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 43cd0dd9149d..d2709e2b7be6 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1079,7 +1079,7 @@ struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *asoc,
                        transports) {
                if (transport == active)
-                        break;
+                        continue;
                list_for_each_entry(chunk, &transport->transmitted,
                                transmitted_list) {
                        if (key == chunk->subh.data_hdr->tsn) {
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 5131fcfedb03..de1a0138317f 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2082,7 +2082,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
        }
        /* Delete the tempory new association. */
-        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
        /* Restore association pointer to provide SCTP command interpeter
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index f7d34e7b6f81..5ead60550895 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -447,17 +447,21 @@ static int rsc_parse(struct cache_detail *cd,
        else {
                int N, i;
+                /*
+                 * NOTE: we skip uid_valid()/gid_valid() checks here:
+                 * instead, * -1 id's are later mapped to the
+                 * (export-specific) anonymous id by nfsd_setuser.
+                 *
+                 * (But supplementary gid's get no such special
+                 * treatment so are checked for validity here.)
+                 */
                /* uid */
                rsci.cred.cr_uid = make_kuid(&init_user_ns, id);
-                if (!uid_valid(rsci.cred.cr_uid))
-                        goto out;
                /* gid */
                if (get_int(&mesg, &id))
                        goto out;
                rsci.cred.cr_gid = make_kgid(&init_user_ns, id);
-                if (!gid_valid(rsci.cred.cr_gid))
-                        goto out;
                /* number of additional gid's */
                if (get_int(&mesg, &N))
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index a0f48a51e14e..a9129f8d7070 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1175,6 +1175,7 @@ static struct file_system_type rpc_pipe_fs_type = {
        .kill_sb        = rpc_kill_sb,
 };
 MODULE_ALIAS_FS("rpc_pipefs");
+MODULE_ALIAS("rpc_pipefs");
 static void
 init_once(void *foo)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index c1d8476b7692..3d02130828da 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -849,6 +849,14 @@ static void xs_tcp_close(struct rpc_xprt *xprt)
                xs_tcp_shutdown(xprt);
 }
+static void xs_local_destroy(struct rpc_xprt *xprt)
+{
+        xs_close(xprt);
+        xs_free_peer_addresses(xprt);
+        xprt_free(xprt);
+        module_put(THIS_MODULE);
+}
 /**
 * xs_destroy - prepare to shutdown a transport
 * @xprt: doomed transport
@@ -862,10 +870,7 @@ static void xs_destroy(struct rpc_xprt *xprt)
        cancel_delayed_work_sync(&transport->connect_worker);
-        xs_close(xprt);
+        xs_local_destroy(xprt);
-        xs_free_peer_addresses(xprt);
-        xprt_free(xprt);
-        module_put(THIS_MODULE);
 }
 static inline struct rpc_xprt *xprt_from_sock(struct sock *sk)
@@ -2482,7 +2487,7 @@ static struct rpc_xprt_ops xs_local_ops = {
        .send_request           = xs_local_send_request,
        .set_retrans_timeout    = xprt_set_retrans_timeout_def,
        .close                  = xs_close,
-        .destroy                = xs_destroy,
+        .destroy                = xs_local_destroy,
        .print_stats            = xs_local_print_stats,
 };
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 5ffff039b017..ea4155fe9733 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -367,8 +367,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
        rdev->wiphy.rts_threshold = (u32) -1;
        rdev->wiphy.coverage_class = 0;
-        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH |
+        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH;
-                               NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
        return &rdev->wiphy;
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e652d05ff712..d44ab216c0ec 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -557,18 +557,6 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
        if ((chan->flags & IEEE80211_CHAN_RADAR) &&
            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
                goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
-                goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
-                goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
-                goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
-                goto nla_put_failure;
        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
                        DBM_TO_MBM(chan->max_power)))
@@ -1310,15 +1298,6 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                        dev->wiphy.max_acl_mac_addrs))
                goto nla_put_failure;
-        if (dev->wiphy.extended_capabilities &&
-            (nla_put(msg, NL80211_ATTR_EXT_CAPA,
-                     dev->wiphy.extended_capabilities_len,
-                     dev->wiphy.extended_capabilities) ||
-             nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
-                     dev->wiphy.extended_capabilities_len,
-                     dev->wiphy.extended_capabilities_mask)))
-                goto nla_put_failure;
        return genlmsg_end(msg, hdr);
 nla_put_failure:
@@ -1328,7 +1307,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        int idx = 0;
+        int idx = 0, ret;
        int start = cb->args[0];
        struct cfg80211_registered_device *dev;
@@ -1338,9 +1317,29 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                        continue;
                if (++idx <= start)
                        continue;
-                if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
+                ret = nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
-                                       cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                         cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                       dev) < 0) {
+                                         dev);
+                if (ret < 0) {
+                        /*
+                         * If sending the wiphy data didn't fit (ENOBUFS or
+                         * EMSGSIZE returned), this SKB is still empty (so
+                         * it's not too big because another wiphy dataset is
+                         * already in the skb) and we've not tried to adjust
+                         * the dump allocation yet ... then adjust the alloc
+                         * size to be bigger, and return 1 but with the empty
+                         * skb. This results in an empty message being RX'ed
+                         * in userspace, but that is ignored.
+                         *
+                         * We can then retry with the larger buffer.
+                         */
+                        if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
+                            !skb->len &&
+                            cb->min_dump_alloc < 4096) {
+                                cb->min_dump_alloc = 4096;
+                                mutex_unlock(&cfg80211_mutex);
+                                return 1;
+                        }
                        idx--;
                        break;
                }
@@ -1357,7 +1356,7 @@ static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
        struct sk_buff *msg;
        struct cfg80211_registered_device *dev = info->user_ptr[0];
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        msg = nlmsg_new(4096, GFP_KERNEL);
        if (!msg)
                return -ENOMEM;
diff --git a/scripts/Makefile.headersinst b/scripts/Makefile.headersinst
index 25f216a841d5..477d137c0557 100644
--- a/scripts/Makefile.headersinst
+++ b/scripts/Makefile.headersinst
@@ -14,7 +14,7 @@ kbuild-file := $(srctree)/$(obj)/Kbuild
 include $(kbuild-file)
 # called may set destination dir (when installing to asm/)
-_dst := $(or $(destination-y),$(dst),$(obj))
+_dst := $(if $(destination-y),$(destination-y),$(if $(dst),$(dst),$(obj)))
 old-kbuild-file := $(srctree)/$(subst uapi/,,$(obj))/Kbuild
 ifneq ($(wildcard $(old-kbuild-file)),)
@@ -48,13 +48,14 @@ all-files     := $(header-y) $(genhdr-y) $(wrapper-files)
 output-files  := $(addprefix $(installdir)/, $(all-files))
 input-files   := $(foreach hdr, $(header-y), \
-                   $(or \
+                   $(if $(wildcard $(srcdir)/$(hdr)), \
                        $(wildcard $(srcdir)/$(hdr)), \
-                        $(wildcard $(oldsrcdir)/$(hdr)), \
+                        $(if $(wildcard $(oldsrcdir)/$(hdr)), \
-                        $(error Missing UAPI file $(srcdir)/$(hdr)) \
+                                $(wildcard $(oldsrcdir)/$(hdr)), \
+                                $(error Missing UAPI file $(srcdir)/$(hdr))) \
                   )) \
                 $(foreach hdr, $(genhdr-y), \
-                   $(or \
+                   $(if $(wildcard $(gendir)/$(hdr)), \
                        $(wildcard $(gendir)/$(hdr)), \
                        $(error Missing generated UAPI file $(gendir)/$(hdr)) \
                   ))
diff --git a/security/keys/compat.c b/security/keys/compat.c
index 1c261763f479..d65fa7fa29ba 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -40,12 +40,12 @@ static long compat_keyctl_instantiate_key_iov(
                                           ARRAY_SIZE(iovstack),
                                           iovstack, &iov);
        if (ret < 0)
-                return ret;
+                goto err;
        if (ret == 0)
                goto no_payload_free;
        ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+err:
        if (iov != iovstack)
                kfree(iov);
        return ret;
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index a571fad91010..42defae1e161 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -57,7 +57,7 @@ int install_user_keyrings(void)
        kenter("%p{%u}", user, uid);
-        if (user->uid_keyring) {
+        if (user->uid_keyring && user->session_keyring) {
                kleave(" = 0 [exist]");
                return 0;
        }
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 48665ecd1197..8ab295154517 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -310,7 +310,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
        if (old_ctx) {
                new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len,
-                                  GFP_KERNEL);
+                                  GFP_ATOMIC);
                if (!new_ctx)
                        return -ENOMEM;
diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
index 160b1bd0cd62..24d44b2f61ac 100644
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -290,10 +290,10 @@ int snd_seq_timer_open(struct snd_seq_queue *q)
                        tid.device = SNDRV_TIMER_GLOBAL_SYSTEM;
                        err = snd_timer_open(&t, str, &tid, q->queue);
                }
-                if (err < 0) {
+        }
-                        snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
+        if (err < 0) {
-                        return err;
+                snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
-                }
+                return err;
        }
        t->callback = snd_seq_timer_interrupt;
        t->callback_data = q;
diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
index 30bcfe470f83..4ff60a6427d9 100644
--- a/sound/oss/sequencer.c
+++ b/sound/oss/sequencer.c
@@ -545,6 +545,9 @@ static void seq_chn_common_event(unsigned char *event_rec)
                case MIDI_PGM_CHANGE:
                        if (seq_mode == SEQ_2)
                        {
+                                if (chn > 15)
+                                        break;
                                synth_devs[dev]->chn_info[chn].pgm_num = p1;
                                if ((int) dev >= num_synths)
                                        synth_devs[dev]->set_instr(dev, chn, p1);
@@ -596,6 +599,9 @@ static void seq_chn_common_event(unsigned char *event_rec)
                case MIDI_PITCH_BEND:
                        if (seq_mode == SEQ_2)
                        {
+                                if (chn > 15)
+                                        break;
                                synth_devs[dev]->chn_info[chn].bender_value = w14;
                                if ((int) dev < num_synths)
diff --git a/sound/pci/asihpi/asihpi.c b/sound/pci/asihpi/asihpi.c
index 3536b076b529..0aabfedeecba 100644
--- a/sound/pci/asihpi/asihpi.c
+++ b/sound/pci/asihpi/asihpi.c
@@ -2549,7 +2549,7 @@ static int snd_asihpi_sampleclock_add(struct snd_card_asihpi *asihpi,
 static int snd_card_asihpi_mixer_new(struct snd_card_asihpi *asihpi)
 {
-        struct snd_card *card = asihpi->card;
+        struct snd_card *card;
        unsigned int idx = 0;
        unsigned int subindex = 0;
        int err;
@@ -2557,6 +2557,7 @@ static int snd_card_asihpi_mixer_new(struct snd_card_asihpi *asihpi)
        if (snd_BUG_ON(!asihpi))
                return -EINVAL;
+        card = asihpi->card;
        strcpy(card->mixername, "Asihpi Mixer");
        err =
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 97c68dd24ef5..ecdf30eb5879 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -494,7 +494,7 @@ static unsigned int get_num_conns(struct hda_codec *codec, hda_nid_t nid)
 int snd_hda_get_num_raw_conns(struct hda_codec *codec, hda_nid_t nid)
 {
-        return get_num_conns(codec, nid) & AC_CLIST_LENGTH;
+        return snd_hda_get_raw_connections(codec, nid, NULL, 0);
 }
 /**
@@ -517,9 +517,6 @@ int snd_hda_get_raw_connections(struct hda_codec *codec, hda_nid_t nid,
        hda_nid_t prev_nid;
        int null_count = 0;
-        if (snd_BUG_ON(!conn_list || max_conns <= 0))
-                return -EINVAL;
        parm = get_num_conns(codec, nid);
        if (!parm)
                return 0;
@@ -545,7 +542,8 @@ int snd_hda_get_raw_connections(struct hda_codec *codec, hda_nid_t nid,
                                          AC_VERB_GET_CONNECT_LIST, 0);
                if (parm == -1 && codec->bus->rirb_error)
                        return -EIO;
-                conn_list[0] = parm & mask;
+                if (conn_list)
+                        conn_list[0] = parm & mask;
                return 1;
        }
@@ -580,14 +578,20 @@ int snd_hda_get_raw_connections(struct hda_codec *codec, hda_nid_t nid,
                                continue;
                        }
                        for (n = prev_nid + 1; n <= val; n++) {
+                                if (conn_list) {
+                                        if (conns >= max_conns)
+                                                return -ENOSPC;
+                                        conn_list[conns] = n;
+                                }
+                                conns++;
+                        }
+                } else {
+                        if (conn_list) {
                                if (conns >= max_conns)
                                        return -ENOSPC;
-                                conn_list[conns++] = n;
+                                conn_list[conns] = val;
                        }
-                } else {
+                        conns++;
-                        if (conns >= max_conns)
-                                return -ENOSPC;
-                        conn_list[conns++] = val;
                }
                prev_nid = val;
        }
@@ -3140,7 +3144,7 @@ static unsigned int convert_to_spdif_status(unsigned short val)
        if (val & AC_DIG1_PROFESSIONAL)
                sbits |= IEC958_AES0_PROFESSIONAL;
        if (sbits & IEC958_AES0_PROFESSIONAL) {
-                if (sbits & AC_DIG1_EMPHASIS)
+                if (val & AC_DIG1_EMPHASIS)
                        sbits |= IEC958_AES0_PRO_EMPHASIS_5015;
        } else {
                if (val & AC_DIG1_EMPHASIS)
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 78897d05d80f..43c2ea539561 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -995,6 +995,8 @@ enum {
        BAD_NO_EXTRA_SURR_DAC = 0x101,
        /* Primary DAC shared with main surrounds */
        BAD_SHARED_SURROUND = 0x100,
+        /* No independent HP possible */
+        BAD_NO_INDEP_HP = 0x40,
        /* Primary DAC shared with main CLFE */
        BAD_SHARED_CLFE = 0x10,
        /* Primary DAC shared with extra surrounds */
@@ -1392,6 +1394,43 @@ static int check_aamix_out_path(struct hda_codec *codec, int path_idx)
        return snd_hda_get_path_idx(codec, path);
 }
+/* check whether the independent HP is available with the current config */
+static bool indep_hp_possible(struct hda_codec *codec)
+{
+        struct hda_gen_spec *spec = codec->spec;
+        struct auto_pin_cfg *cfg = &spec->autocfg;
+        struct nid_path *path;
+        int i, idx;
+        if (cfg->line_out_type == AUTO_PIN_HP_OUT)
+                idx = spec->out_paths[0];
+        else
+                idx = spec->hp_paths[0];
+        path = snd_hda_get_path_from_idx(codec, idx);
+        if (!path)
+                return false;
+        /* assume no path conflicts unless aamix is involved */
+        if (!spec->mixer_nid || !is_nid_contained(path, spec->mixer_nid))
+                return true;
+        /* check whether output paths contain aamix */
+        for (i = 0; i < cfg->line_outs; i++) {
+                if (spec->out_paths[i] == idx)
+                        break;
+                path = snd_hda_get_path_from_idx(codec, spec->out_paths[i]);
+                if (path && is_nid_contained(path, spec->mixer_nid))
+                        return false;
+        }
+        for (i = 0; i < cfg->speaker_outs; i++) {
+                path = snd_hda_get_path_from_idx(codec, spec->speaker_paths[i]);
+                if (path && is_nid_contained(path, spec->mixer_nid))
+                        return false;
+        }
+        return true;
+}
 /* fill the empty entries in the dac array for speaker/hp with the
 * shared dac pointed by the paths
 */
@@ -1545,6 +1584,9 @@ static int fill_and_eval_dacs(struct hda_codec *codec,
                badness += BAD_MULTI_IO;
        }
+        if (spec->indep_hp && !indep_hp_possible(codec))
+                badness += BAD_NO_INDEP_HP;
        /* re-fill the shared DAC for speaker / headphone */
        if (cfg->line_out_type != AUTO_PIN_HP_OUT)
                refill_shared_dacs(codec, cfg->hp_outs,
@@ -1758,6 +1800,10 @@ static int parse_output_paths(struct hda_codec *codec)
                                cfg->speaker_pins, val);
        }
+        /* clear indep_hp flag if not available */
+        if (spec->indep_hp && !indep_hp_possible(codec))
+                spec->indep_hp = 0;
        kfree(best_cfg);
        return 0;
 }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 4cea6bb6fade..418bfc0eb0a3 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -415,6 +415,8 @@ struct azx_dev {
        unsigned int opened :1;
        unsigned int running :1;
        unsigned int irq_pending :1;
+        unsigned int prepared:1;
+        unsigned int locked:1;
        /*
         * For VIA:
         *  A flag to ensure DMA position is 0
@@ -426,8 +428,25 @@ struct azx_dev {
        struct timecounter  azx_tc;
        struct cyclecounter azx_cc;
+#ifdef CONFIG_SND_HDA_DSP_LOADER
+        struct mutex dsp_mutex;
+#endif
 };
+/* DSP lock helpers */
+#ifdef CONFIG_SND_HDA_DSP_LOADER
+#define dsp_lock_init(dev)      mutex_init(&(dev)->dsp_mutex)
+#define dsp_lock(dev)           mutex_lock(&(dev)->dsp_mutex)
+#define dsp_unlock(dev)         mutex_unlock(&(dev)->dsp_mutex)
+#define dsp_is_locked(dev)      ((dev)->locked)
+#else
+#define dsp_lock_init(dev)      do {} while (0)
+#define dsp_lock(dev)           do {} while (0)
+#define dsp_unlock(dev)         do {} while (0)
+#define dsp_is_locked(dev)      0
+#endif
 /* CORB/RIRB */
 struct azx_rb {
        u32 *buf;               /* CORB/RIRB buffer
@@ -527,6 +546,10 @@ struct azx {
        /* card list (for power_save trigger) */
        struct list_head list;
+#ifdef CONFIG_SND_HDA_DSP_LOADER
+        struct azx_dev saved_azx_dev;
+#endif
 };
 #define CREATE_TRACE_POINTS
@@ -1793,15 +1816,25 @@ azx_assign_device(struct azx *chip, struct snd_pcm_substream *substream)
                dev = chip->capture_index_offset;
                nums = chip->capture_streams;
        }
-        for (i = 0; i < nums; i++, dev++)
+        for (i = 0; i < nums; i++, dev++) {
-                if (!chip->azx_dev[dev].opened) {
+                struct azx_dev *azx_dev = &chip->azx_dev[dev];
-                        res = &chip->azx_dev[dev];
+                dsp_lock(azx_dev);
-                        if (res->assigned_key == key)
+                if (!azx_dev->opened && !dsp_is_locked(azx_dev)) {
-                                break;
+                        res = azx_dev;
+                        if (res->assigned_key == key) {
+                                res->opened = 1;
+                                res->assigned_key = key;
+                                dsp_unlock(azx_dev);
+                                return azx_dev;
+                        }
                }
+                dsp_unlock(azx_dev);
+        }
        if (res) {
+                dsp_lock(res);
                res->opened = 1;
                res->assigned_key = key;
+                dsp_unlock(res);
        }
        return res;
 }
@@ -2009,6 +2042,12 @@ static int azx_pcm_hw_params(struct snd_pcm_substream *substream,
        struct azx_dev *azx_dev = get_azx_dev(substream);
        int ret;
+        dsp_lock(azx_dev);
+        if (dsp_is_locked(azx_dev)) {
+                ret = -EBUSY;
+                goto unlock;
+        }
        mark_runtime_wc(chip, azx_dev, substream, false);
        azx_dev->bufsize = 0;
        azx_dev->period_bytes = 0;
@@ -2016,8 +2055,10 @@ static int azx_pcm_hw_params(struct snd_pcm_substream *substream,
        ret = snd_pcm_lib_malloc_pages(substream,
                                        params_buffer_bytes(hw_params));
        if (ret < 0)
-                return ret;
+                goto unlock;
        mark_runtime_wc(chip, azx_dev, substream, true);
+ unlock:
+        dsp_unlock(azx_dev);
        return ret;
 }
@@ -2029,16 +2070,21 @@ static int azx_pcm_hw_free(struct snd_pcm_substream *substream)
        struct hda_pcm_stream *hinfo = apcm->hinfo[substream->stream];
        /* reset BDL address */
-        azx_sd_writel(azx_dev, SD_BDLPL, 0);
+        dsp_lock(azx_dev);
-        azx_sd_writel(azx_dev, SD_BDLPU, 0);
+        if (!dsp_is_locked(azx_dev)) {
-        azx_sd_writel(azx_dev, SD_CTL, 0);
+                azx_sd_writel(azx_dev, SD_BDLPL, 0);
-        azx_dev->bufsize = 0;
+                azx_sd_writel(azx_dev, SD_BDLPU, 0);
-        azx_dev->period_bytes = 0;
+                azx_sd_writel(azx_dev, SD_CTL, 0);
-        azx_dev->format_val = 0;
+                azx_dev->bufsize = 0;
+                azx_dev->period_bytes = 0;
+                azx_dev->format_val = 0;
+        }
        snd_hda_codec_cleanup(apcm->codec, hinfo, substream);
        mark_runtime_wc(chip, azx_dev, substream, false);
+        azx_dev->prepared = 0;
+        dsp_unlock(azx_dev);
        return snd_pcm_lib_free_pages(substream);
 }
@@ -2055,6 +2101,12 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
                snd_hda_spdif_out_of_nid(apcm->codec, hinfo->nid);
        unsigned short ctls = spdif ? spdif->ctls : 0;
+        dsp_lock(azx_dev);
+        if (dsp_is_locked(azx_dev)) {
+                err = -EBUSY;
+                goto unlock;
+        }
        azx_stream_reset(chip, azx_dev);
        format_val = snd_hda_calc_stream_format(runtime->rate,
                                                runtime->channels,
@@ -2065,7 +2117,8 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
                snd_printk(KERN_ERR SFX
                           "%s: invalid format_val, rate=%d, ch=%d, format=%d\n",
                           pci_name(chip->pci), runtime->rate, runtime->channels, runtime->format);
-                return -EINVAL;
+                err = -EINVAL;
+                goto unlock;
        }
        bufsize = snd_pcm_lib_buffer_bytes(substream);
@@ -2084,7 +2137,7 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
                azx_dev->no_period_wakeup = runtime->no_period_wakeup;
                err = azx_setup_periods(chip, substream, azx_dev);
                if (err < 0)
-                        return err;
+                        goto unlock;
        }
        /* wallclk has 24Mhz clock source */
@@ -2101,8 +2154,14 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
        if ((chip->driver_caps & AZX_DCAPS_CTX_WORKAROUND) &&
            stream_tag > chip->capture_streams)
                stream_tag -= chip->capture_streams;
-        return snd_hda_codec_prepare(apcm->codec, hinfo, stream_tag,
+        err = snd_hda_codec_prepare(apcm->codec, hinfo, stream_tag,
                                     azx_dev->format_val, substream);
+ unlock:
+        if (!err)
+                azx_dev->prepared = 1;
+        dsp_unlock(azx_dev);
+        return err;
 }
 static int azx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
@@ -2117,6 +2176,9 @@ static int azx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
        azx_dev = get_azx_dev(substream);
        trace_azx_pcm_trigger(chip, azx_dev, cmd);
+        if (dsp_is_locked(azx_dev) || !azx_dev->prepared)
+                return -EPIPE;
        switch (cmd) {
        case SNDRV_PCM_TRIGGER_START:
                rstart = 1;
@@ -2621,17 +2683,27 @@ static int azx_load_dsp_prepare(struct hda_bus *bus, unsigned int format,
        struct azx_dev *azx_dev;
        int err;
-        if (snd_hda_lock_devices(bus))
+        azx_dev = azx_get_dsp_loader_dev(chip);
-                return -EBUSY;
+        dsp_lock(azx_dev);
+        spin_lock_irq(&chip->reg_lock);
+        if (azx_dev->running || azx_dev->locked) {
+                spin_unlock_irq(&chip->reg_lock);
+                err = -EBUSY;
+                goto unlock;
+        }
+        azx_dev->prepared = 0;
+        chip->saved_azx_dev = *azx_dev;
+        azx_dev->locked = 1;
+        spin_unlock_irq(&chip->reg_lock);
        err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG,
                                  snd_dma_pci_data(chip->pci),
                                  byte_size, bufp);
        if (err < 0)
-                goto unlock;
+                goto err_alloc;
        mark_pages_wc(chip, bufp, true);
-        azx_dev = azx_get_dsp_loader_dev(chip);
        azx_dev->bufsize = byte_size;
        azx_dev->period_bytes = byte_size;
        azx_dev->format_val = format;
@@ -2649,13 +2721,20 @@ static int azx_load_dsp_prepare(struct hda_bus *bus, unsigned int format,
                goto error;
        azx_setup_controller(chip, azx_dev);
+        dsp_unlock(azx_dev);
        return azx_dev->stream_tag;
 error:
        mark_pages_wc(chip, bufp, false);
        snd_dma_free_pages(bufp);
-unlock:
+ err_alloc:
-        snd_hda_unlock_devices(bus);
+        spin_lock_irq(&chip->reg_lock);
+        if (azx_dev->opened)
+                *azx_dev = chip->saved_azx_dev;
+        azx_dev->locked = 0;
+        spin_unlock_irq(&chip->reg_lock);
+ unlock:
+        dsp_unlock(azx_dev);
        return err;
 }
@@ -2677,9 +2756,10 @@ static void azx_load_dsp_cleanup(struct hda_bus *bus,
        struct azx *chip = bus->private_data;
        struct azx_dev *azx_dev = azx_get_dsp_loader_dev(chip);
-        if (!dmab->area)
+        if (!dmab->area || !azx_dev->locked)
                return;
+        dsp_lock(azx_dev);
        /* reset BDL address */
        azx_sd_writel(azx_dev, SD_BDLPL, 0);
        azx_sd_writel(azx_dev, SD_BDLPU, 0);
@@ -2692,7 +2772,12 @@ static void azx_load_dsp_cleanup(struct hda_bus *bus,
        snd_dma_free_pages(dmab);
        dmab->area = NULL;
-        snd_hda_unlock_devices(bus);
+        spin_lock_irq(&chip->reg_lock);
+        if (azx_dev->opened)
+                *azx_dev = chip->saved_azx_dev;
+        azx_dev->locked = 0;
+        spin_unlock_irq(&chip->reg_lock);
+        dsp_unlock(azx_dev);
 }
 #endif /* CONFIG_SND_HDA_DSP_LOADER */
@@ -3481,6 +3566,7 @@ static int azx_first_init(struct azx *chip)
        }
        for (i = 0; i < chip->num_streams; i++) {
+                dsp_lock_init(&chip->azx_dev[i]);
                /* allocate memory for the BDL for each stream */
                err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV,
                                          snd_dma_pci_data(chip->pci),
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index eefc4563b2f9..0792b5725f9c 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -3239,7 +3239,7 @@ static int ca0132_set_vipsource(struct hda_codec *codec, int val)
        struct ca0132_spec *spec = codec->spec;
        unsigned int tmp;
-        if (!dspload_is_loaded(codec))
+        if (spec->dsp_state != DSP_DOWNLOADED)
                return 0;
        /* if CrystalVoice if off, vipsource should be 0 */
@@ -4267,11 +4267,12 @@ static void ca0132_refresh_widget_caps(struct hda_codec *codec)
 */
 static void ca0132_setup_defaults(struct hda_codec *codec)
 {
+        struct ca0132_spec *spec = codec->spec;
        unsigned int tmp;
        int num_fx;
        int idx, i;
-        if (!dspload_is_loaded(codec))
+        if (spec->dsp_state != DSP_DOWNLOADED)
                return;
        /* out, in effects + voicefx */
@@ -4351,12 +4352,16 @@ static bool ca0132_download_dsp_images(struct hda_codec *codec)
                return false;
        dsp_os_image = (struct dsp_image_seg *)(fw_entry->data);
-        dspload_image(codec, dsp_os_image, 0, 0, true, 0);
+        if (dspload_image(codec, dsp_os_image, 0, 0, true, 0)) {
+                pr_err("ca0132 dspload_image failed.\n");
+                goto exit_download;
+        }
        dsp_loaded = dspload_wait_loaded(codec);
+exit_download:
        release_firmware(fw_entry);
        return dsp_loaded;
 }
@@ -4367,16 +4372,13 @@ static void ca0132_download_dsp(struct hda_codec *codec)
 #ifndef CONFIG_SND_HDA_CODEC_CA0132_DSP
        return; /* NOP */
 #endif
-        spec->dsp_state = DSP_DOWNLOAD_INIT;
-        if (spec->dsp_state == DSP_DOWNLOAD_INIT) {
+        chipio_enable_clocks(codec);
-                chipio_enable_clocks(codec);
+        spec->dsp_state = DSP_DOWNLOADING;
-                spec->dsp_state = DSP_DOWNLOADING;
+        if (!ca0132_download_dsp_images(codec))
-                if (!ca0132_download_dsp_images(codec))
+                spec->dsp_state = DSP_DOWNLOAD_FAILED;
-                        spec->dsp_state = DSP_DOWNLOAD_FAILED;
+        else
-                else
+                spec->dsp_state = DSP_DOWNLOADED;
-                        spec->dsp_state = DSP_DOWNLOADED;
-        }
        if (spec->dsp_state == DSP_DOWNLOADED)
                ca0132_set_dsp_msr(codec, true);
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 72ebb8a36b13..0d9c58f13560 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -168,10 +168,10 @@ static void cs_automute(struct hda_codec *codec)
        snd_hda_gen_update_outputs(codec);
        if (spec->gpio_eapd_hp) {
-                unsigned int gpio = spec->gen.hp_jack_present ?
+                spec->gpio_data = spec->gen.hp_jack_present ?
                        spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
                snd_hda_codec_write(codec, 0x01, 0,
-                                    AC_VERB_SET_GPIO_DATA, gpio);
+                                    AC_VERB_SET_GPIO_DATA, spec->gpio_data);
        }
 }
@@ -506,6 +506,8 @@ static int patch_cs420x(struct hda_codec *codec)
        if (!spec)
                return -ENOMEM;
+        spec->gen.automute_hook = cs_automute;
        snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
                           cs420x_fixups);
        snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
@@ -893,6 +895,8 @@ static int patch_cs4210(struct hda_codec *codec)
        if (!spec)
                return -ENOMEM;
+        spec->gen.automute_hook = cs_automute;
        snd_hda_pick_fixup(codec, cs421x_models, cs421x_fixup_tbl,
                           cs421x_fixups);
        snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 941bf6c766ec..2a89d1eefeb6 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1142,7 +1142,7 @@ static int patch_cxt5045(struct hda_codec *codec)
        }
        if (spec->beep_amp)
-                snd_hda_attach_beep_device(codec, spec->beep_amp);
+                snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
        return 0;
 }
@@ -1921,7 +1921,7 @@ static int patch_cxt5051(struct hda_codec *codec)
        }
        if (spec->beep_amp)
-                snd_hda_attach_beep_device(codec, spec->beep_amp);
+                snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
        return 0;
 }
@@ -3099,7 +3099,7 @@ static int patch_cxt5066(struct hda_codec *codec)
        }
        if (spec->beep_amp)
-                snd_hda_attach_beep_device(codec, spec->beep_amp);
+                snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
        return 0;
 }
@@ -3191,11 +3191,17 @@ static int cx_auto_build_controls(struct hda_codec *codec)
        return 0;
 }
+static void cx_auto_free(struct hda_codec *codec)
+{
+        snd_hda_detach_beep_device(codec);
+        snd_hda_gen_free(codec);
+}
 static const struct hda_codec_ops cx_auto_patch_ops = {
        .build_controls = cx_auto_build_controls,
        .build_pcms = snd_hda_gen_build_pcms,
        .init = snd_hda_gen_init,
-        .free = snd_hda_gen_free,
+        .free = cx_auto_free,
        .unsol_event = snd_hda_jack_unsol_event,
 #ifdef CONFIG_PM
        .check_power_status = snd_hda_gen_check_power_status,
@@ -3391,7 +3397,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
        codec->patch_ops = cx_auto_patch_ops;
        if (spec->beep_amp)
-                snd_hda_attach_beep_device(codec, spec->beep_amp);
+                snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
        /* Some laptops with Conexant chips show stalls in S3 resume,
         * which falls into the single-cmd mode.
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 83d5335ac348..dafe04ae8c72 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -815,6 +815,29 @@ static int find_mute_led_cfg(struct hda_codec *codec, int default_polarity)
        return 0;
 }
+/* check whether a built-in speaker is included in parsed pins */
+static bool has_builtin_speaker(struct hda_codec *codec)
+{
+        struct sigmatel_spec *spec = codec->spec;
+        hda_nid_t *nid_pin;
+        int nids, i;
+        if (spec->gen.autocfg.line_out_type == AUTO_PIN_SPEAKER_OUT) {
+                nid_pin = spec->gen.autocfg.line_out_pins;
+                nids = spec->gen.autocfg.line_outs;
+        } else {
+                nid_pin = spec->gen.autocfg.speaker_pins;
+                nids = spec->gen.autocfg.speaker_outs;
+        }
+        for (i = 0; i < nids; i++) {
+                unsigned int def_conf = snd_hda_codec_get_pincfg(codec, nid_pin[i]);
+                if (snd_hda_get_input_pin_attr(def_conf) == INPUT_PIN_ATTR_INT)
+                        return true;
+        }
+        return false;
+}
 /*
 * PC beep controls
 */
@@ -3890,6 +3913,12 @@ static int patch_stac92hd73xx(struct hda_codec *codec)
                return err;
        }
+        /* Don't GPIO-mute speakers if there are no internal speakers, because
+         * the GPIO might be necessary for Headphone
+         */
+        if (spec->eapd_switch && !has_builtin_speaker(codec))
+                spec->eapd_switch = 0;
        codec->proc_widget_hook = stac92hd7x_proc_hook;
        snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PROBE);
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 803953a9bff3..2da8ad75fd96 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -244,6 +244,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
                        usb_ifnum_to_if(dev, ctrlif)->intf_assoc;
                if (!assoc) {
+                        /*
+                         * Firmware writers cannot count to three.  So to find
+                         * the IAD on the NuForce UDH-100, also check the next
+                         * interface.
+                         */
+                        struct usb_interface *iface =
+                                usb_ifnum_to_if(dev, ctrlif + 1);
+                        if (iface &&
+                            iface->intf_assoc &&
+                            iface->intf_assoc->bFunctionClass == USB_CLASS_AUDIO &&
+                            iface->intf_assoc->bFunctionProtocol == UAC_VERSION_2)
+                                assoc = iface->intf_assoc;
+                }
+                if (!assoc) {
                        snd_printk(KERN_ERR "Audio class v2 interfaces need an interface association\n");
                        return -EINVAL;
                }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 638e7f738018..ca4739c3f650 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -715,8 +715,9 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
                case UAC2_CLOCK_SELECTOR: {
                        struct uac_selector_unit_descriptor *d = p1;
                        /* call recursively to retrieve the channel info */
-                        if (check_input_term(state, d->baSourceID[0], term) < 0)
+                        err = check_input_term(state, d->baSourceID[0], term);
-                                return -ENODEV;
+                        if (err < 0)
+                                return err;
                        term->type = d->bDescriptorSubtype << 16; /* virtual type */
                        term->id = id;
                        term->name = uac_selector_unit_iSelector(d);
@@ -725,7 +726,8 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
                case UAC1_PROCESSING_UNIT:
                case UAC1_EXTENSION_UNIT:
                /* UAC2_PROCESSING_UNIT_V2 */
-                /* UAC2_EFFECT_UNIT */ {
+                /* UAC2_EFFECT_UNIT */
+                case UAC2_EXTENSION_UNIT_V2: {
                        struct uac_processing_unit_descriptor *d = p1;
                        if (state->mixer->protocol == UAC_VERSION_2 &&
@@ -1356,8 +1358,9 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
                return err;
        /* determine the input source type and name */
-        if (check_input_term(state, hdr->bSourceID, &iterm) < 0)
+        err = check_input_term(state, hdr->bSourceID, &iterm);
-                return -EINVAL;
+        if (err < 0)
+                return err;
        master_bits = snd_usb_combine_bytes(bmaControls, csize);
        /* master configuration quirks */
@@ -2052,6 +2055,8 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
                        return parse_audio_extension_unit(state, unitid, p1);
                else /* UAC_VERSION_2 */
                        return parse_audio_processing_unit(state, unitid, p1);
+        case UAC2_EXTENSION_UNIT_V2:
+                return parse_audio_extension_unit(state, unitid, p1);
        default:
                snd_printk(KERN_ERR "usbaudio: unit %u: unexpected type 0x%02x\n", unitid, p1[2]);
                return -EINVAL;
@@ -2118,7 +2123,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
                        state.oterm.type = le16_to_cpu(desc->wTerminalType);
                        state.oterm.name = desc->iTerminal;
                        err = parse_audio_unit(&state, desc->bSourceID);
-                        if (err < 0)
+                        if (err < 0 && err != -EINVAL)
                                return err;
                } else { /* UAC_VERSION_2 */
                        struct uac2_output_terminal_descriptor *desc = p;
@@ -2130,12 +2135,12 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
                        state.oterm.type = le16_to_cpu(desc->wTerminalType);
                        state.oterm.name = desc->iTerminal;
                        err = parse_audio_unit(&state, desc->bSourceID);
-                        if (err < 0)
+                        if (err < 0 && err != -EINVAL)
                                return err;
                        /* for UAC2, use the same approach to also add the clock selectors */
                        err = parse_audio_unit(&state, desc->bCSourceID);
-                        if (err < 0)
+                        if (err < 0 && err != -EINVAL)
                                return err;
                }
        }
diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
index a20e32033431..0b0a90787db6 100644
--- a/tools/lib/traceevent/Makefile
+++ b/tools/lib/traceevent/Makefile
@@ -122,7 +122,7 @@ export Q VERBOSE
 EVENT_PARSE_VERSION = $(EP_VERSION).$(EP_PATCHLEVEL).$(EP_EXTRAVERSION)
-INCLUDES = -I. -I/usr/local/include $(CONFIG_INCLUDES)
+INCLUDES = -I. $(CONFIG_INCLUDES)
 # Set compile option CFLAGS if not set elsewhere
 CFLAGS ?= -g -Wall
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index a2108ca1cc17..bb74c79cd16e 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -95,7 +95,7 @@ ifeq ("$(origin DEBUG)", "command line")
  PERF_DEBUG = $(DEBUG)
 endif
 ifndef PERF_DEBUG
-  CFLAGS_OPTIMIZE = -O6 -D_FORTIFY_SOURCE=2
+  CFLAGS_OPTIMIZE = -O6
 endif
 ifdef PARSER_DEBUG
@@ -180,6 +180,12 @@ ifeq ($(call try-cc,$(SOURCE_HELLO),$(CFLAGS) -Werror -Wvolatile-register-var,-W
       CFLAGS := $(CFLAGS) -Wvolatile-register-var
 endif
+ifndef PERF_DEBUG
+        ifeq ($(call try-cc,$(SOURCE_HELLO),$(CFLAGS) -D_FORTIFY_SOURCE=2,-D_FORTIFY_SOURCE=2),y)
+                CFLAGS := $(CFLAGS) -D_FORTIFY_SOURCE=2
+        endif
+endif
 ### --- END CONFIGURATION SECTION ---
 ifeq ($(srctree),)
diff --git a/tools/perf/bench/bench.h b/tools/perf/bench/bench.h
index a5223e6a7b43..0fdc85269c4d 100644
--- a/tools/perf/bench/bench.h
+++ b/tools/perf/bench/bench.h
@@ -1,6 +1,30 @@
 #ifndef BENCH_H
 #define BENCH_H
+/*
+ * The madvise transparent hugepage constants were added in glibc
+ * 2.13. For compatibility with older versions of glibc, define these
+ * tokens if they are not already defined.
+ *
+ * PA-RISC uses different madvise values from other architectures and
+ * needs to be special-cased.
+ */
+#ifdef __hppa__
+# ifndef MADV_HUGEPAGE
+#  define MADV_HUGEPAGE         67
+# endif
+# ifndef MADV_NOHUGEPAGE
+#  define MADV_NOHUGEPAGE       68
+# endif
+#else
+# ifndef MADV_HUGEPAGE
+#  define MADV_HUGEPAGE         14
+# endif
+# ifndef MADV_NOHUGEPAGE
+#  define MADV_NOHUGEPAGE       15
+# endif
+#endif
 extern int bench_numa(int argc, const char **argv, const char *prefix);
 extern int bench_sched_messaging(int argc, const char **argv, const char *prefix);
 extern int bench_sched_pipe(int argc, const char **argv, const char *prefix);
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 774c90713a53..f1a939ebc19c 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -573,13 +573,15 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                                         perf_event__synthesize_guest_os, tool);
        }
-        if (!opts->target.system_wide)
+        if (perf_target__has_task(&opts->target))
                err = perf_event__synthesize_thread_map(tool, evsel_list->threads,
                                                  process_synthesized_event,
                                                  machine);
-        else
+        else if (perf_target__has_cpu(&opts->target))
                err = perf_event__synthesize_threads(tool, process_synthesized_event,
                                               machine);
+        else /* command specified */
+                err = 0;
        if (err != 0)
                goto out_delete_session;
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index 38624686ee9a..226a4ae2f936 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -208,8 +208,9 @@ static inline int script_browse(const char *script_opt __maybe_unused)
        return 0;
 }
-#define K_LEFT -1
+#define K_LEFT  -1000
-#define K_RIGHT -2
+#define K_RIGHT -2000
+#define K_SWITCH_INPUT_DATA -3000
 #endif
 #ifdef GTK2_SUPPORT
diff --git a/tools/perf/util/strlist.c b/tools/perf/util/strlist.c
index 55433aa42c8f..eabdce0a2daa 100644
--- a/tools/perf/util/strlist.c
+++ b/tools/perf/util/strlist.c
@@ -143,7 +143,7 @@ struct strlist *strlist__new(bool dupstr, const char *list)
                slist->rblist.node_delete = strlist__node_delete;
                slist->dupstr    = dupstr;
-                if (slist && strlist__parse_list(slist, list) != 0)
+                if (list && strlist__parse_list(slist, list) != 0)
                        goto out_error;
        }
diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
index 8674b9ec14f6..fe1e66b6ef40 100644
--- a/tools/usb/ffs-test.c
+++ b/tools/usb/ffs-test.c
@@ -38,7 +38,7 @@
 #include <unistd.h>
 #include <tools/le_byteshift.h>
-#include "../../include/linux/usb/functionfs.h"
+#include "../../include/uapi/linux/usb/functionfs.h"
 /******************** Little Endian Handling ********************************/
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index ce82b9401958..5ba005c00e2f 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -74,9 +74,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
                        u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
                        u64 redir_content;
-                        ASSERT(redir_index < IOAPIC_NUM_PINS);
+                        if (redir_index < IOAPIC_NUM_PINS)
+                                redir_content =
+                                        ioapic->redirtbl[redir_index].bits;
+                        else
+                                redir_content = ~0ULL;
-                        redir_content = ioapic->redirtbl[redir_index].bits;
                        result = (ioapic->ioregsel & 0x1) ?
                            (redir_content >> 32) & 0xffffffff :
                            redir_content & 0xffffffff;
author	Jason Cooper <jason@lakedaemon.net>	2013-04-15 10:55:23 -0400
committer	Jason Cooper <jason@lakedaemon.net>	2013-04-15 10:55:23 -0400
commit	b757f17e9184b65428c48a281d82f9acb3e96f0e (patch)
tree	7dc22c9f82f78c20caeff00fdd68a2e92e40504a
parent	3c76a8a95daeecd881718f88324041f6a5faab86 (diff)
parent	da497f6fbaa190d34907ecc9dd85cfc62ba9f5a2 (diff)