Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

694 files changed, 6360 insertions, 3445 deletions

diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 0a523c9a5ff4..482c74947de0 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -794,6 +794,7 @@ Greg Kroah-Hartman, "How to piss off a kernel subsystem maintainer".
   <http://www.kroah.com/log/linux/maintainer-03.html>
   <http://www.kroah.com/log/linux/maintainer-04.html>
   <http://www.kroah.com/log/linux/maintainer-05.html>
+  <http://www.kroah.com/log/linux/maintainer-06.html>
 
 NO!!!! No more huge patch bombs to linux-kernel@vger.kernel.org people!
   <https://lkml.org/lkml/2005/7/11/336>
diff --git a/Documentation/devicetree/bindings/input/atmel,maxtouch.txt b/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
index baef432e8369..0ac23f2ed104 100644
--- a/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
+++ b/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
@@ -15,6 +15,17 @@ Optional properties for main touchpad device:
     keycode generated by each GPIO. Linux keycodes are defined in
     <dt-bindings/input/input.h>.
 
+- linux,gpio-keymap: When enabled, the SPT_GPIOPWN_T19 object sends messages
+    on GPIO bit changes. An array of up to 8 entries can be provided
+    indicating the Linux keycode mapped to each bit of the status byte,
+    starting at the LSB. Linux keycodes are defined in
+    <dt-bindings/input/input.h>.
+
+    Note: the numbering of the GPIOs and the bit they start at varies between
+    maXTouch devices. You must either refer to the documentation, or
+    experiment to determine which bit corresponds to which input. Use
+    KEY_RESERVED for unused padding values.
+
 Example:
 
         touch@4b {
diff --git a/Documentation/devicetree/bindings/mfd/tc3589x.txt b/Documentation/devicetree/bindings/mfd/tc3589x.txt
new file mode 100644
index 000000000000..6fcedba46ae9
--- /dev/null
+++ b/Documentation/devicetree/bindings/mfd/tc3589x.txt
@@ -0,0 +1,107 @@
+* Toshiba TC3589x multi-purpose expander
+
+The Toshiba TC3589x series are I2C-based MFD devices which may expose the
+following built-in devices: gpio, keypad, rotator (vibrator), PWM (for
+e.g. LEDs or vibrators) The included models are:
+
+- TC35890
+- TC35892
+- TC35893
+- TC35894
+- TC35895
+- TC35896
+
+Required properties:
+ - compatible : must be "toshiba,tc35890", "toshiba,tc35892", "toshiba,tc35893",
+   "toshiba,tc35894", "toshiba,tc35895" or "toshiba,tc35896"
+ - reg : I2C address of the device
+ - interrupt-parent : specifies which IRQ controller we're connected to
+ - interrupts : the interrupt on the parent the controller is connected to
+ - interrupt-controller : marks the device node as an interrupt controller
+ - #interrupt-cells : should be <1>, the first cell is the IRQ offset on this
+   TC3589x interrupt controller.
+
+Optional nodes:
+
+- GPIO
+  This GPIO module inside the TC3589x has 24 (TC35890, TC35892) or 20
+  (other models) GPIO lines.
+ - compatible : must be "toshiba,tc3589x-gpio"
+ - interrupts : interrupt on the parent, which must be the tc3589x MFD device
+ - interrupt-controller : marks the device node as an interrupt controller
+ - #interrupt-cells : should be <2>, the first cell is the IRQ offset on this
+   TC3589x GPIO interrupt controller, the second cell is the interrupt flags
+   in accordance with <dt-bindings/interrupt-controller/irq.h>. The following
+   flags are valid:
+   - IRQ_TYPE_LEVEL_LOW
+   - IRQ_TYPE_LEVEL_HIGH
+   - IRQ_TYPE_EDGE_RISING
+   - IRQ_TYPE_EDGE_FALLING
+   - IRQ_TYPE_EDGE_BOTH
+ - gpio-controller : marks the device node as a GPIO controller
+ - #gpio-cells : should be <2>, the first cell is the GPIO offset on this
+   GPIO controller, the second cell is the flags.
+
+- Keypad
+  This keypad is the same on all variants, supporting up to 96 different
+  keys. The linux-specific properties are modeled on those already existing
+  in other input drivers.
+ - compatible : must be "toshiba,tc3589x-keypad"
+ - debounce-delay-ms : debounce interval in milliseconds
+ - keypad,num-rows : number of rows in the matrix, see
+   bindings/input/matrix-keymap.txt
+ - keypad,num-columns : number of columns in the matrix, see
+   bindings/input/matrix-keymap.txt
+ - linux,keymap: the definition can be found in
+   bindings/input/matrix-keymap.txt
+ - linux,no-autorepeat: do no enable autorepeat feature.
+ - linux,wakeup: use any event on keypad as wakeup event.
+
+Example:
+
+tc35893@44 {
+        compatible = "toshiba,tc35893";
+        reg = <0x44>;
+        interrupt-parent = <&gpio6>;
+        interrupts = <26 IRQ_TYPE_EDGE_RISING>;
+
+        interrupt-controller;
+        #interrupt-cells = <1>;
+
+        tc3589x_gpio {
+                compatible = "toshiba,tc3589x-gpio";
+                interrupts = <0>;
+
+                interrupt-controller;
+                #interrupt-cells = <2>;
+                gpio-controller;
+                #gpio-cells = <2>;
+        };
+        tc3589x_keypad {
+                compatible = "toshiba,tc3589x-keypad";
+                interrupts = <6>;
+                debounce-delay-ms = <4>;
+                keypad,num-columns = <8>;
+                keypad,num-rows = <8>;
+                linux,no-autorepeat;
+                linux,wakeup;
+                linux,keymap = <0x0301006b
+                                0x04010066
+                                0x06040072
+                                0x040200d7
+                                0x0303006a
+                                0x0205000e
+                                0x0607008b
+                                0x0500001c
+                                0x0403000b
+                                0x03040034
+                                0x05020067
+                                0x0305006c
+                                0x040500e7
+                                0x0005009e
+                                0x06020073
+                                0x01030039
+                                0x07060069
+                                0x050500d9>;
+        };
+};
diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
index 65f4f7c43136..ee654e95d8ad 100644
--- a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
+++ b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
@@ -22,7 +22,7 @@ Optional properties:
                                 width of 8 is assumed.
 
  - ti,nand-ecc-opt:             A string setting the ECC layout to use. One of:
-                "sw"            <deprecated> use "ham1" instead
+                "sw"            1-bit Hamming ecc code via software
                 "hw"            <deprecated> use "ham1" instead
                 "hw-romcode"    <deprecated> use "ham1" instead
                 "ham1"          1-bit Hamming ecc code
diff --git a/Documentation/devicetree/bindings/net/stmmac.txt b/Documentation/devicetree/bindings/net/stmmac.txt
index 9b03c57563a4..e45ac3f926b1 100644
--- a/Documentation/devicetree/bindings/net/stmmac.txt
+++ b/Documentation/devicetree/bindings/net/stmmac.txt
@@ -39,6 +39,10 @@ Optional properties:
   further clocks may be specified in derived bindings.
 - clock-names: One name for each entry in the clocks property, the
   first one should be "stmmaceth".
+- clk_ptp_ref: this is the PTP reference clock; in case of the PTP is
+  available this clock is used for programming the Timestamp Addend Register.
+  If not passed then the system clock will be used and this is fine on some
+  platforms.
 
 Examples:
 
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt
index 0211c6d8a522..92fae82f35f2 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,apq8064-pinctrl.txt
@@ -62,7 +62,7 @@ Example:
                 #gpio-cells = <2>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
-                interrupts = <0 32 0x4>;
+                interrupts = <0 16 0x4>;
 
                 pinctrl-names = "default";
                 pinctrl-0 = <&gsbi5_uart_default>;
diff --git a/Documentation/devicetree/bindings/regulator/tps65090.txt b/Documentation/devicetree/bindings/regulator/tps65090.txt
index 340980239ea9..ca69f5e3040c 100644
--- a/Documentation/devicetree/bindings/regulator/tps65090.txt
+++ b/Documentation/devicetree/bindings/regulator/tps65090.txt
@@ -45,8 +45,8 @@ Example:
                 infet5-supply = <&some_reg>;
                 infet6-supply = <&some_reg>;
                 infet7-supply = <&some_reg>;
-                vsys_l1-supply = <&some_reg>;
-                vsys_l2-supply = <&some_reg>;
+                vsys-l1-supply = <&some_reg>;
+                vsys-l2-supply = <&some_reg>;
 
                 regulators {
                         dcdc1 {
diff --git a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
index 46f344965313..4eb7997674a0 100644
--- a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
+++ b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
@@ -1,7 +1,7 @@
 ADI AXI-SPDIF controller
 
 Required properties:
- - compatible : Must be "adi,axi-spdif-1.00.a"
+ - compatible : Must be "adi,axi-spdif-tx-1.00.a"
  - reg : Must contain SPDIF core's registers location and length
  - clocks : Pairs of phandle and specifier referencing the controller's clocks.
    The controller expects two clocks, the clock used for the AXI interface and
diff --git a/Documentation/dma-buf-sharing.txt b/Documentation/dma-buf-sharing.txt
index 67a4087d53f9..bb9753b635a3 100644
--- a/Documentation/dma-buf-sharing.txt
+++ b/Documentation/dma-buf-sharing.txt
@@ -56,10 +56,10 @@ The dma_buf buffer sharing API usage contains the following steps:
                                      size_t size, int flags,
                                      const char *exp_name)
 
-   If this succeeds, dma_buf_export allocates a dma_buf structure, and returns a
-   pointer to the same. It also associates an anonymous file with this buffer,
-   so it can be exported. On failure to allocate the dma_buf object, it returns
-   NULL.
+   If this succeeds, dma_buf_export_named allocates a dma_buf structure, and
+   returns a pointer to the same. It also associates an anonymous file with this
+   buffer, so it can be exported. On failure to allocate the dma_buf object,
+   it returns NULL.
 
    'exp_name' is the name of exporter - to facilitate information while
    debugging.
@@ -76,7 +76,7 @@ The dma_buf buffer sharing API usage contains the following steps:
    drivers and/or processes.
 
    Interface:
-      int dma_buf_fd(struct dma_buf *dmabuf)
+      int dma_buf_fd(struct dma_buf *dmabuf, int flags)
 
    This API installs an fd for the anonymous file associated with this buffer;
    returns either 'fd', or error.
@@ -157,7 +157,9 @@ to request use of buffer for allocation.
    "dma_buf->ops->" indirection from the users of this interface.
 
    In struct dma_buf_ops, unmap_dma_buf is defined as
-      void (*unmap_dma_buf)(struct dma_buf_attachment *, struct sg_table *);
+      void (*unmap_dma_buf)(struct dma_buf_attachment *,
+                            struct sg_table *,
+                            enum dma_data_direction);
 
    unmap_dma_buf signifies the end-of-DMA for the attachment provided. Like
    map_dma_buf, this API also must be implemented by the exporter.
diff --git a/Documentation/filesystems/nfs/nfs-rdma.txt b/Documentation/filesystems/nfs/nfs-rdma.txt
index e386f7e4bcee..724043858b08 100644
--- a/Documentation/filesystems/nfs/nfs-rdma.txt
+++ b/Documentation/filesystems/nfs/nfs-rdma.txt
@@ -138,9 +138,9 @@ Installation
   - Build, install, reboot
 
     The NFS/RDMA code will be enabled automatically if NFS and RDMA
-    are turned on. The NFS/RDMA client and server are configured via the hidden
-    SUNRPC_XPRT_RDMA config option that depends on SUNRPC and INFINIBAND. The
-    value of SUNRPC_XPRT_RDMA will be:
+    are turned on. The NFS/RDMA client and server are configured via the
+    SUNRPC_XPRT_RDMA_CLIENT and SUNRPC_XPRT_RDMA_SERVER config options that both
+    depend on SUNRPC and INFINIBAND. The default value of both options will be:
 
      - N if either SUNRPC or INFINIBAND are N, in this case the NFS/RDMA client
        and server will not be built
@@ -235,8 +235,9 @@ NFS/RDMA Setup
 
   - Start the NFS server
 
-    If the NFS/RDMA server was built as a module (CONFIG_SUNRPC_XPRT_RDMA=m in
-    kernel config), load the RDMA transport module:
+    If the NFS/RDMA server was built as a module
+    (CONFIG_SUNRPC_XPRT_RDMA_SERVER=m in kernel config), load the RDMA
+    transport module:
 
     $ modprobe svcrdma
 
@@ -255,8 +256,9 @@ NFS/RDMA Setup
 
   - On the client system
 
-    If the NFS/RDMA client was built as a module (CONFIG_SUNRPC_XPRT_RDMA=m in
-    kernel config), load the RDMA client module:
+    If the NFS/RDMA client was built as a module
+    (CONFIG_SUNRPC_XPRT_RDMA_CLIENT=m in kernel config), load the RDMA client
+    module:
 
     $ modprobe xprtrdma.ko
 
diff --git a/Documentation/filesystems/seq_file.txt b/Documentation/filesystems/seq_file.txt
index 1fe0ccb1af55..8ea3e90ace07 100644
--- a/Documentation/filesystems/seq_file.txt
+++ b/Documentation/filesystems/seq_file.txt
@@ -235,6 +235,39 @@ be used for more than one file, you can store an arbitrary pointer in the
 private field of the seq_file structure; that value can then be retrieved
 by the iterator functions.
 
+There is also a wrapper function to seq_open() called seq_open_private(). It
+kmallocs a zero filled block of memory and stores a pointer to it in the
+private field of the seq_file structure, returning 0 on success. The
+block size is specified in a third parameter to the function, e.g.:
+
+        static int ct_open(struct inode *inode, struct file *file)
+        {
+                return seq_open_private(file, &ct_seq_ops,
+                                        sizeof(struct mystruct));
+        }
+
+There is also a variant function, __seq_open_private(), which is functionally
+identical except that, if successful, it returns the pointer to the allocated
+memory block, allowing further initialisation e.g.:
+
+        static int ct_open(struct inode *inode, struct file *file)
+        {
+                struct mystruct *p =
+                        __seq_open_private(file, &ct_seq_ops, sizeof(*p));
+
+                if (!p)
+                        return -ENOMEM;
+
+                p->foo = bar; /* initialize my stuff */
+                        ...
+                p->baz = true;
+
+                return 0;
+        }
+
+A corresponding close function, seq_release_private() is available which
+frees the memory allocated in the corresponding open.
+
 The other operations of interest - read(), llseek(), and release() - are
 all implemented by the seq_file code itself. So a virtual file's
 file_operations structure will look like:
diff --git a/Documentation/gpio/consumer.txt b/Documentation/gpio/consumer.txt
index 76546324e968..6ce544191ca6 100644
--- a/Documentation/gpio/consumer.txt
+++ b/Documentation/gpio/consumer.txt
@@ -53,7 +53,20 @@ with IS_ERR() (they will never return a NULL pointer). -ENOENT will be returned
 if and only if no GPIO has been assigned to the device/function/index triplet,
 other error codes are used for cases where a GPIO has been assigned but an error
 occurred while trying to acquire it. This is useful to discriminate between mere
-errors and an absence of GPIO for optional GPIO parameters.
+errors and an absence of GPIO for optional GPIO parameters. For the common
+pattern where a GPIO is optional, the gpiod_get_optional() and
+gpiod_get_index_optional() functions can be used. These functions return NULL
+instead of -ENOENT if no GPIO has been assigned to the requested function:
+
+
+        struct gpio_desc *gpiod_get_optional(struct device *dev,
+                                             const char *con_id,
+                                             enum gpiod_flags flags)
+
+        struct gpio_desc *gpiod_get_index_optional(struct device *dev,
+                                                   const char *con_id,
+                                                   unsigned int index,
+                                                   enum gpiod_flags flags)
 
 Device-managed variants of these functions are also defined:
 
@@ -65,6 +78,15 @@ Device-managed variants of these functions are also defined:
                                                unsigned int idx,
                                                enum gpiod_flags flags)
 
+        struct gpio_desc *devm_gpiod_get_optional(struct device *dev,
+                                                  const char *con_id,
+                                                  enum gpiod_flags flags)
+
+        struct gpio_desc * devm_gpiod_get_index_optional(struct device *dev,
+                                                        const char *con_id,
+                                                        unsigned int index,
+                                                        enum gpiod_flags flags)
+
 A GPIO descriptor can be disposed of using the gpiod_put() function:
 
         void gpiod_put(struct gpio_desc *desc)
diff --git a/Documentation/i2c/dev-interface b/Documentation/i2c/dev-interface
index 3e742ba25536..2ac78ae1039d 100644
--- a/Documentation/i2c/dev-interface
+++ b/Documentation/i2c/dev-interface
@@ -57,12 +57,12 @@ Well, you are all set up now. You can now use SMBus commands or plain
 I2C to communicate with your device. SMBus commands are preferred if
 the device supports them. Both are illustrated below.
 
-  __u8 register = 0x10; /* Device register to access */
+  __u8 reg = 0x10; /* Device register to access */
   __s32 res;
   char buf[10];
 
   /* Using SMBus commands */
-  res = i2c_smbus_read_word_data(file, register);
+  res = i2c_smbus_read_word_data(file, reg);
   if (res < 0) {
     /* ERROR HANDLING: i2c transaction failed */
   } else {
@@ -70,11 +70,11 @@ the device supports them. Both are illustrated below.
   }
 
   /* Using I2C Write, equivalent of 
-     i2c_smbus_write_word_data(file, register, 0x6543) */
-  buf[0] = register;
+     i2c_smbus_write_word_data(file, reg, 0x6543) */
+  buf[0] = reg;
   buf[1] = 0x43;
   buf[2] = 0x65;
-  if (write(file, buf, 3) ! =3) {
+  if (write(file, buf, 3) != 3) {
     /* ERROR HANDLING: i2c transaction failed */
   }
 
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 88d5a863712a..6c0b9f27e465 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -18,7 +18,7 @@ memory image to a dump file on the local disk, or across the network to
 a remote system.
 
 Kdump and kexec are currently supported on the x86, x86_64, ppc64, ia64,
-and s390x architectures.
+s390x and arm architectures.
 
 When the system kernel boots, it reserves a small section of memory for
 the dump-capture kernel. This ensures that ongoing Direct Memory Access
@@ -112,7 +112,7 @@ There are two possible methods of using Kdump.
 2) Or use the system kernel binary itself as dump-capture kernel and there is
    no need to build a separate dump-capture kernel. This is possible
    only with the architectures which support a relocatable kernel. As
-   of today, i386, x86_64, ppc64 and ia64 architectures support relocatable
+   of today, i386, x86_64, ppc64, ia64 and arm architectures support relocatable
    kernel.
 
 Building a relocatable kernel is advantageous from the point of view that
@@ -241,6 +241,13 @@ Dump-capture kernel config options (Arch Dependent, ia64)
   kernel will be aligned to 64Mb, so if the start address is not then
   any space below the alignment point will be wasted.
 
+Dump-capture kernel config options (Arch Dependent, arm)
+----------------------------------------------------------
+
+-   To use a relocatable kernel,
+    Enable "AUTO_ZRELADDR" support under "Boot" options:
+
+    AUTO_ZRELADDR=y
 
 Extended crashkernel syntax
 ===========================
@@ -256,6 +263,10 @@ The syntax is:
     crashkernel=<range1>:<size1>[,<range2>:<size2>,...][@offset]
     range=start-[end]
 
+Please note, on arm, the offset is required.
+    crashkernel=<range1>:<size1>[,<range2>:<size2>,...]@offset
+    range=start-[end]
+
     'start' is inclusive and 'end' is exclusive.
 
 For example:
@@ -296,6 +307,12 @@ Boot into System Kernel
    on the memory consumption of the kdump system. In general this is not
    dependent on the memory size of the production system.
 
+   On arm, use "crashkernel=Y@X". Note that the start address of the kernel
+   will be aligned to 128MiB (0x08000000), so if the start address is not then
+   any space below the alignment point may be overwritten by the dump-capture kernel,
+   which means it is possible that the vmcore is not that precise as expected.
+
+
 Load the Dump-capture Kernel
 ============================
 
@@ -315,7 +332,8 @@ For ia64:
         - Use vmlinux or vmlinuz.gz
 For s390x:
         - Use image or bzImage
-
+For arm:
+        - Use zImage
 
 If you are using a uncompressed vmlinux image then use following command
 to load dump-capture kernel.
@@ -331,6 +349,15 @@ to load dump-capture kernel.
    --initrd=<initrd-for-dump-capture-kernel> \
    --append="root=<root-dev> <arch-specific-options>"
 
+If you are using a compressed zImage, then use following command
+to load dump-capture kernel.
+
+   kexec --type zImage -p <dump-capture-kernel-bzImage> \
+   --initrd=<initrd-for-dump-capture-kernel> \
+   --dtb=<dtb-for-dump-capture-kernel> \
+   --append="root=<root-dev> <arch-specific-options>"
+
+
 Please note, that --args-linux does not need to be specified for ia64.
 It is planned to make this a no-op on that architecture, but for now
 it should be omitted
@@ -347,6 +374,9 @@ For ppc64:
 For s390x:
         "1 maxcpus=1 cgroup_disable=memory"
 
+For arm:
+        "1 maxcpus=1 reset_devices"
+
 Notes on loading the dump-capture kernel:
 
 * By default, the ELF headers are stored in ELF64 format to support
diff --git a/Documentation/misc-devices/lis3lv02d b/Documentation/misc-devices/lis3lv02d
index af815b9ba413..f89960a0ff95 100644
--- a/Documentation/misc-devices/lis3lv02d
+++ b/Documentation/misc-devices/lis3lv02d
@@ -59,7 +59,7 @@ acts similar to /dev/rtc and reacts on free-fall interrupts received
 from the device. It supports blocking operations, poll/select and
 fasync operation modes. You must read 1 bytes from the device.  The
 result is number of free-fall interrupts since the last successful
-read (or 255 if number of interrupts would not fit). See the hpfall.c
+read (or 255 if number of interrupts would not fit). See the freefall.c
 file for an example on using the device.
 
 
diff --git a/Documentation/power/regulator/consumer.txt b/Documentation/power/regulator/consumer.txt
index 81c0e2b49cd8..8afb236ca765 100644
--- a/Documentation/power/regulator/consumer.txt
+++ b/Documentation/power/regulator/consumer.txt
@@ -143,8 +143,9 @@ This will cause the core to recalculate the total load on the regulator (based
 on all its consumers) and change operating mode (if necessary and permitted)
 to best match the current operating load.
 
-The load_uA value can be determined from the consumers datasheet. e.g.most
-datasheets have tables showing the max current consumed in certain situations.
+The load_uA value can be determined from the consumer's datasheet. e.g. most
+datasheets have tables showing the maximum current consumed in certain
+situations.
 
 Most consumers will use indirect operating mode control since they have no
 knowledge of the regulator or whether the regulator is shared with other
@@ -173,7 +174,7 @@ Consumers can register interest in regulator events by calling :-
 int regulator_register_notifier(struct regulator *regulator,
                               struct notifier_block *nb);
 
-Consumers can uregister interest by calling :-
+Consumers can unregister interest by calling :-
 
 int regulator_unregister_notifier(struct regulator *regulator,
                                 struct notifier_block *nb);
diff --git a/Documentation/power/regulator/design.txt b/Documentation/power/regulator/design.txt
index f9b56b72b782..fdd919b96830 100644
--- a/Documentation/power/regulator/design.txt
+++ b/Documentation/power/regulator/design.txt
@@ -9,14 +9,14 @@ Safety
 
  - Errors in regulator configuration can have very serious consequences
    for the system, potentially including lasting hardware damage.
- - It is not possible to automatically determine the power confugration
+ - It is not possible to automatically determine the power configuration
    of the system - software-equivalent variants of the same chip may
-   have different power requirments, and not all components with power
+   have different power requirements, and not all components with power
    requirements are visible to software.
 
   => The API should make no changes to the hardware state unless it has
-     specific knowledge that these changes are safe to do perform on
-     this particular system.
+     specific knowledge that these changes are safe to perform on this
+     particular system.
 
 Consumer use cases
 ------------------
diff --git a/Documentation/power/regulator/machine.txt b/Documentation/power/regulator/machine.txt
index ce63af0a8e35..757e3b53dc11 100644
--- a/Documentation/power/regulator/machine.txt
+++ b/Documentation/power/regulator/machine.txt
@@ -11,7 +11,7 @@ Consider the following machine :-
                +-> [Consumer B @ 3.3V]
 
 The drivers for consumers A & B must be mapped to the correct regulator in
-order to control their power supply. This mapping can be achieved in machine
+order to control their power supplies. This mapping can be achieved in machine
 initialisation code by creating a struct regulator_consumer_supply for
 each regulator.
 
@@ -39,7 +39,7 @@ to the 'Vcc' supply for Consumer A.
 
 Constraints can now be registered by defining a struct regulator_init_data
 for each regulator power domain. This structure also maps the consumers
-to their supply regulator :-
+to their supply regulators :-
 
 static struct regulator_init_data regulator1_data = {
         .constraints = {
diff --git a/Documentation/power/regulator/overview.txt b/Documentation/power/regulator/overview.txt
index 8ed17587a74b..40ca2d6e2742 100644
--- a/Documentation/power/regulator/overview.txt
+++ b/Documentation/power/regulator/overview.txt
@@ -36,11 +36,11 @@ Some terms used in this document:-
                    Consumers can be classified into two types:-
 
                    Static: consumer does not change its supply voltage or
-                   current limit. It only needs to enable or disable it's
+                   current limit. It only needs to enable or disable its
                    power supply. Its supply voltage is set by the hardware,
                    bootloader, firmware or kernel board initialisation code.
 
-                   Dynamic: consumer needs to change it's supply voltage or
+                   Dynamic: consumer needs to change its supply voltage or
                    current limit to meet operation demands.
 
 
@@ -156,7 +156,7 @@ relevant to non SoC devices and is split into the following four interfaces:-
       This interface is for machine specific code and allows the creation of
       voltage/current domains (with constraints) for each regulator. It can
       provide regulator constraints that will prevent device damage through
-      overvoltage or over current caused by buggy client drivers. It also
+      overvoltage or overcurrent caused by buggy client drivers. It also
       allows the creation of a regulator tree whereby some regulators are
       supplied by others (similar to a clock tree).
 
diff --git a/Documentation/power/regulator/regulator.txt b/Documentation/power/regulator/regulator.txt
index 13902778ae44..b17e5833ce21 100644
--- a/Documentation/power/regulator/regulator.txt
+++ b/Documentation/power/regulator/regulator.txt
@@ -13,7 +13,7 @@ Drivers can register a regulator by calling :-
 struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
                                          const struct regulator_config *config);
 
-This will register the regulators capabilities and operations to the regulator
+This will register the regulator's capabilities and operations to the regulator
 core.
 
 Regulators can be unregistered by calling :-
@@ -23,8 +23,8 @@ void regulator_unregister(struct regulator_dev *rdev);
 
 Regulator Events
 ================
-Regulators can send events (e.g. over temp, under voltage, etc) to consumer
-drivers by calling :-
+Regulators can send events (e.g. overtemperature, undervoltage, etc) to
+consumer drivers by calling :-
 
 int regulator_notifier_call_chain(struct regulator_dev *rdev,
                                   unsigned long event, void *data);
diff --git a/Documentation/this_cpu_ops.txt b/Documentation/this_cpu_ops.txt
index 1a4ce7e3e05f..0ec995712176 100644
--- a/Documentation/this_cpu_ops.txt
+++ b/Documentation/this_cpu_ops.txt
@@ -2,26 +2,26 @@ this_cpu operations
 -------------------
 
 this_cpu operations are a way of optimizing access to per cpu
-variables associated with the *currently* executing processor through
-the use of segment registers (or a dedicated register where the cpu
-permanently stored the beginning of the per cpu area for a specific
-processor).
+variables associated with the *currently* executing processor. This is
+done through the use of segment registers (or a dedicated register where
+the cpu permanently stored the beginning of the per cpu area for a
+specific processor).
 
-The this_cpu operations add a per cpu variable offset to the processor
-specific percpu base and encode that operation in the instruction
+this_cpu operations add a per cpu variable offset to the processor
+specific per cpu base and encode that operation in the instruction
 operating on the per cpu variable.
 
-This means there are no atomicity issues between the calculation of
+This means that there are no atomicity issues between the calculation of
 the offset and the operation on the data. Therefore it is not
-necessary to disable preempt or interrupts to ensure that the
+necessary to disable preemption or interrupts to ensure that the
 processor is not changed between the calculation of the address and
 the operation on the data.
 
 Read-modify-write operations are of particular interest. Frequently
 processors have special lower latency instructions that can operate
-without the typical synchronization overhead but still provide some
-sort of relaxed atomicity guarantee. The x86 for example can execute
-RMV (Read Modify Write) instructions like inc/dec/cmpxchg without the
+without the typical synchronization overhead, but still provide some
+sort of relaxed atomicity guarantees. The x86, for example, can execute
+RMW (Read Modify Write) instructions like inc/dec/cmpxchg without the
 lock prefix and the associated latency penalty.
 
 Access to the variable without the lock prefix is not synchronized but
@@ -30,6 +30,38 @@ data specific to the currently executing processor. Only the current
 processor should be accessing that variable and therefore there are no
 concurrency issues with other processors in the system.
 
+Please note that accesses by remote processors to a per cpu area are
+exceptional situations and may impact performance and/or correctness
+(remote write operations) of local RMW operations via this_cpu_*.
+
+The main use of the this_cpu operations has been to optimize counter
+operations.
+
+The following this_cpu() operations with implied preemption protection
+are defined. These operations can be used without worrying about
+preemption and interrupts.
+
+        this_cpu_add()
+        this_cpu_read(pcp)
+        this_cpu_write(pcp, val)
+        this_cpu_add(pcp, val)
+        this_cpu_and(pcp, val)
+        this_cpu_or(pcp, val)
+        this_cpu_add_return(pcp, val)
+        this_cpu_xchg(pcp, nval)
+        this_cpu_cmpxchg(pcp, oval, nval)
+        this_cpu_cmpxchg_double(pcp1, pcp2, oval1, oval2, nval1, nval2)
+        this_cpu_sub(pcp, val)
+        this_cpu_inc(pcp)
+        this_cpu_dec(pcp)
+        this_cpu_sub_return(pcp, val)
+        this_cpu_inc_return(pcp)
+        this_cpu_dec_return(pcp)
+
+
+Inner working of this_cpu operations
+------------------------------------
+
 On x86 the fs: or the gs: segment registers contain the base of the
 per cpu area. It is then possible to simply use the segment override
 to relocate a per cpu relative address to the proper per cpu area for
@@ -48,22 +80,21 @@ results in a single instruction
         mov ax, gs:[x]
 
 instead of a sequence of calculation of the address and then a fetch
-from that address which occurs with the percpu operations. Before
+from that address which occurs with the per cpu operations. Before
 this_cpu_ops such sequence also required preempt disable/enable to
 prevent the kernel from moving the thread to a different processor
 while the calculation is performed.
 
-The main use of the this_cpu operations has been to optimize counter
-operations.
+Consider the following this_cpu operation:
 
         this_cpu_inc(x)
 
-results in the following single instruction (no lock prefix!)
+The above results in the following single instruction (no lock prefix!)
 
         inc gs:[x]
 
 instead of the following operations required if there is no segment
-register.
+register:
 
         int *y;
         int cpu;
@@ -73,10 +104,10 @@ register.
         (*y)++;
         put_cpu();
 
-Note that these operations can only be used on percpu data that is
+Note that these operations can only be used on per cpu data that is
 reserved for a specific processor. Without disabling preemption in the
 surrounding code this_cpu_inc() will only guarantee that one of the
-percpu counters is correctly incremented. However, there is no
+per cpu counters is correctly incremented. However, there is no
 guarantee that the OS will not move the process directly before or
 after the this_cpu instruction is executed. In general this means that
 the value of the individual counters for each processor are
@@ -86,9 +117,9 @@ that is of interest.
 Per cpu variables are used for performance reasons. Bouncing cache
 lines can be avoided if multiple processors concurrently go through
 the same code paths.  Since each processor has its own per cpu
-variables no concurrent cacheline updates take place. The price that
+variables no concurrent cache line updates take place. The price that
 has to be paid for this optimization is the need to add up the per cpu
-counters when the value of the counter is needed.
+counters when the value of a counter is needed.
 
 
 Special operations:
@@ -100,33 +131,39 @@ Takes the offset of a per cpu variable (&x !) and returns the address
 of the per cpu variable that belongs to the currently executing
 processor.  this_cpu_ptr avoids multiple steps that the common
 get_cpu/put_cpu sequence requires. No processor number is
-available. Instead the offset of the local per cpu area is simply
-added to the percpu offset.
+available. Instead, the offset of the local per cpu area is simply
+added to the per cpu offset.
 
+Note that this operation is usually used in a code segment when
+preemption has been disabled. The pointer is then used to
+access local per cpu data in a critical section. When preemption
+is re-enabled this pointer is usually no longer useful since it may
+no longer point to per cpu data of the current processor.
 
 
 Per cpu variables and offsets
 -----------------------------
 
-Per cpu variables have *offsets* to the beginning of the percpu
+Per cpu variables have *offsets* to the beginning of the per cpu
 area. They do not have addresses although they look like that in the
 code. Offsets cannot be directly dereferenced. The offset must be
-added to a base pointer of a percpu area of a processor in order to
+added to a base pointer of a per cpu area of a processor in order to
 form a valid address.
 
 Therefore the use of x or &x outside of the context of per cpu
 operations is invalid and will generally be treated like a NULL
 pointer dereference.
 
-In the context of per cpu operations
+        DEFINE_PER_CPU(int, x);
 
-        x is a per cpu variable. Most this_cpu operations take a cpu
-        variable.
+In the context of per cpu operations the above implies that x is a per
+cpu variable. Most this_cpu operations take a cpu variable.
 
-        &x is the *offset* a per cpu variable. this_cpu_ptr() takes
-        the offset of a per cpu variable which makes this look a bit
-        strange.
+        int __percpu *p = &x;
 
+&x and hence p is the *offset* of a per cpu variable. this_cpu_ptr()
+takes the offset of a per cpu variable which makes this look a bit
+strange.
 
 
 Operations on a field of a per cpu structure
@@ -152,7 +189,7 @@ If we have an offset to struct s:
 
         struct s __percpu *ps = &p;
 
-        z = this_cpu_dec(ps->m);
+        this_cpu_dec(ps->m);
 
         z = this_cpu_inc_return(ps->n);
 
@@ -172,29 +209,52 @@ if we do not make use of this_cpu ops later to manipulate fields:
 Variants of this_cpu ops
 -------------------------
 
-this_cpu ops are interrupt safe. Some architecture do not support
+this_cpu ops are interrupt safe. Some architectures do not support
 these per cpu local operations. In that case the operation must be
 replaced by code that disables interrupts, then does the operations
-that are guaranteed to be atomic and then reenable interrupts. Doing
+that are guaranteed to be atomic and then re-enable interrupts. Doing
 so is expensive. If there are other reasons why the scheduler cannot
 change the processor we are executing on then there is no reason to
-disable interrupts. For that purpose the __this_cpu operations are
-provided. For example.
-
-        __this_cpu_inc(x);
-
-Will increment x and will not fallback to code that disables
+disable interrupts. For that purpose the following __this_cpu operations
+are provided.
+
+These operations have no guarantee against concurrent interrupts or
+preemption. If a per cpu variable is not used in an interrupt context
+and the scheduler cannot preempt, then they are safe. If any interrupts
+still occur while an operation is in progress and if the interrupt too
+modifies the variable, then RMW actions can not be guaranteed to be
+safe.
+
+        __this_cpu_add()
+        __this_cpu_read(pcp)
+        __this_cpu_write(pcp, val)
+        __this_cpu_add(pcp, val)
+        __this_cpu_and(pcp, val)
+        __this_cpu_or(pcp, val)
+        __this_cpu_add_return(pcp, val)
+        __this_cpu_xchg(pcp, nval)
+        __this_cpu_cmpxchg(pcp, oval, nval)
+        __this_cpu_cmpxchg_double(pcp1, pcp2, oval1, oval2, nval1, nval2)
+        __this_cpu_sub(pcp, val)
+        __this_cpu_inc(pcp)
+        __this_cpu_dec(pcp)
+        __this_cpu_sub_return(pcp, val)
+        __this_cpu_inc_return(pcp)
+        __this_cpu_dec_return(pcp)
+
+
+Will increment x and will not fall-back to code that disables
 interrupts on platforms that cannot accomplish atomicity through
 address relocation and a Read-Modify-Write operation in the same
 instruction.
 
 
-
 &this_cpu_ptr(pp)->n vs this_cpu_ptr(&pp->n)
 --------------------------------------------
 
 The first operation takes the offset and forms an address and then
-adds the offset of the n field.
+adds the offset of the n field. This may result in two add
+instructions emitted by the compiler.
 
 The second one first adds the two offsets and then does the
 relocation.  IMHO the second form looks cleaner and has an easier time
@@ -202,4 +262,73 @@ with (). The second form also is consistent with the way
 this_cpu_read() and friends are used.
 
 
-Christoph Lameter, April 3rd, 2013
+Remote access to per cpu data
+------------------------------
+
+Per cpu data structures are designed to be used by one cpu exclusively.
+If you use the variables as intended, this_cpu_ops() are guaranteed to
+be "atomic" as no other CPU has access to these data structures.
+
+There are special cases where you might need to access per cpu data
+structures remotely. It is usually safe to do a remote read access
+and that is frequently done to summarize counters. Remote write access
+something which could be problematic because this_cpu ops do not
+have lock semantics. A remote write may interfere with a this_cpu
+RMW operation.
+
+Remote write accesses to percpu data structures are highly discouraged
+unless absolutely necessary. Please consider using an IPI to wake up
+the remote CPU and perform the update to its per cpu area.
+
+To access per-cpu data structure remotely, typically the per_cpu_ptr()
+function is used:
+
+
+        DEFINE_PER_CPU(struct data, datap);
+
+        struct data *p = per_cpu_ptr(&datap, cpu);
+
+This makes it explicit that we are getting ready to access a percpu
+area remotely.
+
+You can also do the following to convert the datap offset to an address
+
+        struct data *p = this_cpu_ptr(&datap);
+
+but, passing of pointers calculated via this_cpu_ptr to other cpus is
+unusual and should be avoided.
+
+Remote access are typically only for reading the status of another cpus
+per cpu data. Write accesses can cause unique problems due to the
+relaxed synchronization requirements for this_cpu operations.
+
+One example that illustrates some concerns with write operations is
+the following scenario that occurs because two per cpu variables
+share a cache-line but the relaxed synchronization is applied to
+only one process updating the cache-line.
+
+Consider the following example
+
+
+        struct test {
+                atomic_t a;
+                int b;
+        };
+
+        DEFINE_PER_CPU(struct test, onecacheline);
+
+There is some concern about what would happen if the field 'a' is updated
+remotely from one processor and the local processor would use this_cpu ops
+to update field b. Care should be taken that such simultaneous accesses to
+data within the same cache line are avoided. Also costly synchronization
+may be necessary. IPIs are generally recommended in such scenarios instead
+of a remote write to the per cpu area of another processor.
+
+Even in cases where the remote writes are rare, please bear in
+mind that a remote write will evict the cache line from the processor
+that most likely will access it. If the processor wakes up and finds a
+missing local cache line of a per cpu area, its performance and hence
+the wake up times will be affected.
+
+Christoph Lameter, August 4th, 2014
+Pranith Kumar, Aug 2nd, 2014
diff --git a/Documentation/x86/tlb.txt b/Documentation/x86/tlb.txt
index 2b3a82e69151..39d172326703 100644
--- a/Documentation/x86/tlb.txt
+++ b/Documentation/x86/tlb.txt
@@ -35,7 +35,7 @@ invlpg instruction (or instructions _near_ it) show up high in
 profiles.  If you believe that individual invalidations being
 called too often, you can lower the tunable:
 
-        /sys/debug/kernel/x86/tlb_single_page_flush_ceiling
+        /sys/kernel/debug/x86/tlb_single_page_flush_ceiling
 
 This will cause us to do the global flush for more cases.
 Lowering it to 0 will disable the use of the individual flushes.
diff --git a/MAINTAINERS b/MAINTAINERS
index c9b4b55bcbb3..fd86604f3a9c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1277,9 +1277,15 @@ F:	drivers/scsi/arm/
 ARM/Rockchip SoC support
 M:      Heiko Stuebner <heiko@sntech.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-rockchip@lists.infradead.org
 S:      Maintained
+F:      arch/arm/boot/dts/rk3*
 F:      arch/arm/mach-rockchip/
+F:      drivers/clk/rockchip/
+F:      drivers/i2c/busses/i2c-rk3x.c
 F:      drivers/*/*rockchip*
+F:      drivers/*/*/*rockchip*
+F:      sound/soc/rockchip/
 
 ARM/SAMSUNG ARM ARCHITECTURES
 M:      Ben Dooks <ben-linux@fluff.org>
@@ -2065,7 +2071,7 @@ S:	Supported
 F:      drivers/scsi/bnx2i/
 
 BROADCOM KONA GPIO DRIVER
-M:      Markus Mayer <markus.mayer@linaro.org>
+M:      Ray Jui <rjui@broadcom.com>
 L:      bcm-kernel-feedback-list@broadcom.com
 S:      Supported
 F:      drivers/gpio/gpio-bcm-kona.c
@@ -3121,6 +3127,17 @@ F:	include/linux/host1x.h
 F:      include/uapi/drm/tegra_drm.h
 F:      Documentation/devicetree/bindings/gpu/nvidia,tegra20-host1x.txt
 
+DRM DRIVERS FOR RENESAS
+M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+L:      dri-devel@lists.freedesktop.org
+L:      linux-sh@vger.kernel.org
+T:      git git://people.freedesktop.org/~airlied/linux
+S:      Supported
+F:      drivers/gpu/drm/rcar-du/
+F:      drivers/gpu/drm/shmobile/
+F:      include/linux/platform_data/rcar-du.h
+F:      include/linux/platform_data/shmob_drm.h
+
 DSBR100 USB FM RADIO DRIVER
 M:      Alexey Klimov <klimov.linux@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -9545,6 +9562,14 @@ S:	Maintained
 F:      Documentation/usb/ohci.txt
 F:      drivers/usb/host/ohci*
 
+USB OVER IP DRIVER
+M:      Valentina Manea <valentina.manea.m@gmail.com>
+M:      Shuah Khan <shuah.kh@samsung.com>
+L:      linux-usb@vger.kernel.org
+S:      Maintained
+F:      drivers/usb/usbip/
+F:      tools/usb/usbip/
+
 USB PEGASUS DRIVER
 M:      Petko Manolov <petkan@nucleusys.com>
 L:      linux-usb@vger.kernel.org
@@ -10045,9 +10070,9 @@ F:	Documentation/x86/
 F:      arch/x86/
 
 X86 PLATFORM DRIVERS
-M:      Matthew Garrett <matthew.garrett@nebula.com>
+M:      Darren Hart <dvhart@infradead.org>
 L:      platform-driver-x86@vger.kernel.org
-T:      git git://cavan.codon.org.uk/platform-drivers-x86.git
+T:      git git://git.infradead.org/users/dvhart/linux-platform-drivers-x86.git
 S:      Maintained
 F:      drivers/platform/x86/
 
diff --git a/Makefile b/Makefile
index e43244263306..1a60bdd05c9a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 17
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc4
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
index 5ebab5895edb..f05bdb4b1cb9 100644
--- a/arch/alpha/include/asm/io.h
+++ b/arch/alpha/include/asm/io.h
@@ -500,10 +500,14 @@ extern inline void writeq(u64 b, volatile void __iomem *addr)
 #define outb_p          outb
 #define outw_p          outw
 #define outl_p          outl
-#define readb_relaxed(addr) __raw_readb(addr)
-#define readw_relaxed(addr) __raw_readw(addr)
-#define readl_relaxed(addr) __raw_readl(addr)
-#define readq_relaxed(addr) __raw_readq(addr)
+#define readb_relaxed(addr)     __raw_readb(addr)
+#define readw_relaxed(addr)     __raw_readw(addr)
+#define readl_relaxed(addr)     __raw_readl(addr)
+#define readq_relaxed(addr)     __raw_readq(addr)
+#define writeb_relaxed(b, addr) __raw_writeb(b, addr)
+#define writew_relaxed(b, addr) __raw_writew(b, addr)
+#define writel_relaxed(b, addr) __raw_writel(b, addr)
+#define writeq_relaxed(b, addr) __raw_writeq(b, addr)
 
 #define mmiowb()
 
diff --git a/arch/alpha/include/asm/unistd.h b/arch/alpha/include/asm/unistd.h
index f2c94402e2c8..c509d306db45 100644
--- a/arch/alpha/include/asm/unistd.h
+++ b/arch/alpha/include/asm/unistd.h
@@ -3,7 +3,7 @@
 
 #include <uapi/asm/unistd.h>
 
-#define NR_SYSCALLS                     508
+#define NR_SYSCALLS                     511
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
diff --git a/arch/alpha/include/uapi/asm/unistd.h b/arch/alpha/include/uapi/asm/unistd.h
index 53ae7bb1bfd1..d214a0358100 100644
--- a/arch/alpha/include/uapi/asm/unistd.h
+++ b/arch/alpha/include/uapi/asm/unistd.h
@@ -469,5 +469,8 @@
 #define __NR_process_vm_writev          505
 #define __NR_kcmp                       506
 #define __NR_finit_module               507
+#define __NR_sched_setattr              508
+#define __NR_sched_getattr              509
+#define __NR_renameat2                  510
 
 #endif /* _UAPI_ALPHA_UNISTD_H */
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index dca9b3fb0071..24789713f1ea 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -526,6 +526,9 @@ sys_call_table:
         .quad sys_process_vm_writev             /* 505 */
         .quad sys_kcmp
         .quad sys_finit_module
+        .quad sys_sched_setattr
+        .quad sys_sched_getattr
+        .quad sys_renameat2                     /* 510 */
 
         .size sys_call_table, . - sys_call_table
         .type sys_call_table, @object
diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c
index 4670afc3b971..9e1142729fd1 100644
--- a/arch/arc/mm/cache_arc700.c
+++ b/arch/arc/mm/cache_arc700.c
@@ -427,7 +427,7 @@ struct ic_inv_args {
 
 static void __ic_line_inv_vaddr_helper(void *info)
 {
-        struct ic_inv *ic_inv_args = (struct ic_inv_args *) info;
+        struct ic_inv_args *ic_inv = info;
 
         __ic_line_inv_vaddr_local(ic_inv->paddr, ic_inv->vaddr, ic_inv->sz);
 }
@@ -581,6 +581,7 @@ void flush_icache_range(unsigned long kstart, unsigned long kend)
                 tot_sz -= sz;
         }
 }
+EXPORT_SYMBOL(flush_icache_range);
 
 /*
  * General purpose helper to make I and D cache lines consistent.
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index c49a775937db..32cbbd565902 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1983,8 +1983,6 @@ config XIP_PHYS_ADDR
 config KEXEC
         bool "Kexec system call (EXPERIMENTAL)"
         depends on (!SMP || PM_SLEEP_SMP)
-        select CRYPTO
-        select CRYPTO_SHA256
         help
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
index 9b3d2ba82f13..8689949bdba3 100644
--- a/arch/arm/boot/dts/am4372.dtsi
+++ b/arch/arm/boot/dts/am4372.dtsi
@@ -804,7 +804,7 @@
 
                         usb1: usb@48390000 {
                                 compatible = "synopsys,dwc3";
-                                reg = <0x48390000 0x17000>;
+                                reg = <0x48390000 0x10000>;
                                 interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
                                 phys = <&usb2_phy1>;
                                 phy-names = "usb2-phy";
@@ -826,7 +826,7 @@
 
                         usb2: usb@483d0000 {
                                 compatible = "synopsys,dwc3";
-                                reg = <0x483d0000 0x17000>;
+                                reg = <0x483d0000 0x10000>;
                                 interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
                                 phys = <&usb2_phy2>;
                                 phy-names = "usb2-phy";
diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts
index 646a6eade788..e7ac47fa6615 100644
--- a/arch/arm/boot/dts/am437x-gp-evm.dts
+++ b/arch/arm/boot/dts/am437x-gp-evm.dts
@@ -260,7 +260,7 @@
         status = "okay";
         pinctrl-names = "default";
         pinctrl-0 = <&i2c0_pins>;
-        clock-frequency = <400000>;
+        clock-frequency = <100000>;
 
         tps65218: tps65218@24 {
                 reg = <0x24>;
@@ -424,7 +424,7 @@
         ranges = <0 0 0 0x01000000>;    /* minimum GPMC partition = 16MB */
         nand@0,0 {
                 reg = <0 0 4>;          /* device IO registers */
-                ti,nand-ecc-opt = "bch8";
+                ti,nand-ecc-opt = "bch16";
                 ti,elm-id = <&elm>;
                 nand-bus-width = <8>;
                 gpmc,device-width = <1>;
@@ -443,8 +443,6 @@
                 gpmc,rd-cycle-ns = <40>;
                 gpmc,wr-cycle-ns = <40>;
                 gpmc,wait-pin = <0>;
-                gpmc,wait-on-read;
-                gpmc,wait-on-write;
                 gpmc,bus-turnaround-ns = <0>;
                 gpmc,cycle2cycle-delay-ns = <0>;
                 gpmc,clk-activation-ns = <0>;
diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
index ed7dd2395915..ac3e4859935f 100644
--- a/arch/arm/boot/dts/am43x-epos-evm.dts
+++ b/arch/arm/boot/dts/am43x-epos-evm.dts
@@ -435,13 +435,13 @@
 };
 
 &gpmc {
-        status = "okay";
+        status = "okay";        /* Disable QSPI when enabling GPMC (NAND) */
         pinctrl-names = "default";
         pinctrl-0 = <&nand_flash_x8>;
         ranges = <0 0 0x08000000 0x10000000>;   /* CS0: NAND */
         nand@0,0 {
                 reg = <0 0 0>; /* CS0, offset 0 */
-                ti,nand-ecc-opt = "bch8";
+                ti,nand-ecc-opt = "bch16";
                 ti,elm-id = <&elm>;
                 nand-bus-width = <8>;
                 gpmc,device-width = <1>;
@@ -459,8 +459,7 @@
                 gpmc,access-ns = <30>; /* tCEA + 4*/
                 gpmc,rd-cycle-ns = <40>;
                 gpmc,wr-cycle-ns = <40>;
-                gpmc,wait-on-read = "true";
-                gpmc,wait-on-write = "true";
+                gpmc,wait-pin = <0>;
                 gpmc,bus-turnaround-ns = <0>;
                 gpmc,cycle2cycle-delay-ns = <0>;
                 gpmc,clk-activation-ns = <0>;
@@ -557,7 +556,7 @@
 };
 
 &qspi {
-        status = "okay";
+        status = "disabled";    /* Disable GPMC (NAND) when enabling QSPI */
         pinctrl-names = "default";
         pinctrl-0 = <&qspi1_default>;
 
diff --git a/arch/arm/boot/dts/at91rm9200.dtsi b/arch/arm/boot/dts/at91rm9200.dtsi
index 65ccf564b9a5..6c97d4af61ee 100644
--- a/arch/arm/boot/dts/at91rm9200.dtsi
+++ b/arch/arm/boot/dts/at91rm9200.dtsi
@@ -149,7 +149,7 @@
                                 usb: usbck {
                                         compatible = "atmel,at91rm9200-clk-usb";
                                         #clock-cells = <0>;
-                                        atmel,clk-divisors = <1 2>;
+                                        atmel,clk-divisors = <1 2 0 0>;
                                         clocks = <&pllb>;
                                 };
 
diff --git a/arch/arm/boot/dts/at91sam9g20.dtsi b/arch/arm/boot/dts/at91sam9g20.dtsi
index 31f7652612fc..4e0abbd9d655 100644
--- a/arch/arm/boot/dts/at91sam9g20.dtsi
+++ b/arch/arm/boot/dts/at91sam9g20.dtsi
@@ -40,6 +40,7 @@
                                 };
 
                                 pllb: pllbck {
+                                        compatible = "atmel,at91sam9g20-clk-pllb";
                                         atmel,clk-input-range = <2000000 32000000>;
                                         atmel,pll-clk-output-ranges = <30000000 100000000 0 0>;
                                 };
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 50f8022905a1..e03fbf3c6889 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -8,6 +8,7 @@
 /dts-v1/;
 
 #include "dra74x.dtsi"
+#include <dt-bindings/gpio/gpio.h>
 
 / {
         model = "TI DRA742";
@@ -24,9 +25,29 @@
                 regulator-min-microvolt = <3300000>;
                 regulator-max-microvolt = <3300000>;
         };
+
+        vtt_fixed: fixedregulator-vtt {
+                compatible = "regulator-fixed";
+                regulator-name = "vtt_fixed";
+                regulator-min-microvolt = <1350000>;
+                regulator-max-microvolt = <1350000>;
+                regulator-always-on;
+                regulator-boot-on;
+                enable-active-high;
+                gpio = <&gpio7 11 GPIO_ACTIVE_HIGH>;
+        };
 };
 
 &dra7_pmx_core {
+        pinctrl-names = "default";
+        pinctrl-0 = <&vtt_pin>;
+
+        vtt_pin: pinmux_vtt_pin {
+                pinctrl-single,pins = <
+                        0x3b4 (PIN_OUTPUT | MUX_MODE14) /* spi1_cs1.gpio7_11 */
+                >;
+        };
+
         i2c1_pins: pinmux_i2c1_pins {
                 pinctrl-single,pins = <
                         0x400 (PIN_INPUT | MUX_MODE0) /* i2c1_sda */
@@ -43,20 +64,19 @@
 
         i2c3_pins: pinmux_i2c3_pins {
                 pinctrl-single,pins = <
-                        0x410 (PIN_INPUT | MUX_MODE0) /* i2c3_sda */
-                        0x414 (PIN_INPUT | MUX_MODE0) /* i2c3_scl */
+                        0x288 (PIN_INPUT | MUX_MODE9) /* gpio6_14.i2c3_sda */
+                        0x28c (PIN_INPUT | MUX_MODE9) /* gpio6_15.i2c3_scl */
                 >;
         };
 
         mcspi1_pins: pinmux_mcspi1_pins {
                 pinctrl-single,pins = <
-                        0x3a4 (PIN_INPUT | MUX_MODE0) /* spi2_clk */
-                        0x3a8 (PIN_INPUT | MUX_MODE0) /* spi2_d1 */
-                        0x3ac (PIN_INPUT | MUX_MODE0) /* spi2_d0 */
-                        0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs0 */
-                        0x3b4 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs1 */
-                        0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs2 */
-                        0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs3 */
+                        0x3a4 (PIN_INPUT | MUX_MODE0) /* spi1_sclk */
+                        0x3a8 (PIN_INPUT | MUX_MODE0) /* spi1_d1 */
+                        0x3ac (PIN_INPUT | MUX_MODE0) /* spi1_d0 */
+                        0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi1_cs0 */
+                        0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs2.hdmi1_hpd */
+                        0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs3.hdmi1_cec */
                 >;
         };
 
@@ -284,7 +304,7 @@
         status = "okay";
         pinctrl-names = "default";
         pinctrl-0 = <&i2c3_pins>;
-        clock-frequency = <3400000>;
+        clock-frequency = <400000>;
 };
 
 &mcspi1 {
@@ -483,7 +503,7 @@
                         reg = <0x001c0000 0x00020000>;
                 };
                 partition@7 {
-                        label = "NAND.u-boot-env";
+                        label = "NAND.u-boot-env.backup1";
                         reg = <0x001e0000 0x00020000>;
                 };
                 partition@8 {
@@ -504,3 +524,8 @@
 &usb2_phy2 {
         phy-supply = <&ldousb_reg>;
 };
+
+&gpio7 {
+        ti,no-reset-on-init;
+        ti,no-idle-on-init;
+};
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 97f603c4483d..d678152db4cb 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -245,7 +245,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio2: gpio@48055000 {
@@ -256,7 +256,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio3: gpio@48057000 {
@@ -267,7 +267,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio4: gpio@48059000 {
@@ -278,7 +278,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio5: gpio@4805b000 {
@@ -289,7 +289,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio6: gpio@4805d000 {
@@ -300,7 +300,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio7: gpio@48051000 {
@@ -311,7 +311,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio8: gpio@48053000 {
@@ -322,7 +322,7 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         interrupt-controller;
-                        #interrupt-cells = <1>;
+                        #interrupt-cells = <2>;
                 };
 
                 uart1: serial@4806a000 {
diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
index 6d6d23c83d30..adadaf97ac01 100644
--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
@@ -134,6 +134,8 @@
         i2c@13860000 {
                 pinctrl-0 = <&i2c0_bus>;
                 pinctrl-names = "default";
+                samsung,i2c-sda-delay = <100>;
+                samsung,i2c-max-bus-freq = <400000>;
                 status = "okay";
 
                 usb3503: usb3503@08 {
@@ -148,6 +150,10 @@
 
                 max77686: pmic@09 {
                         compatible = "maxim,max77686";
+                        interrupt-parent = <&gpx3>;
+                        interrupts = <2 0>;
+                        pinctrl-names = "default";
+                        pinctrl-0 = <&max77686_irq>;
                         reg = <0x09>;
                         #clock-cells = <1>;
 
@@ -368,4 +374,11 @@
                 samsung,pins = "gpx1-3";
                 samsung,pin-pud = <0>;
         };
+
+        max77686_irq: max77686-irq {
+                samsung,pins = "gpx3-2";
+                samsung,pin-function = <0>;
+                samsung,pin-pud = <0>;
+                samsung,pin-drv = <0>;
+        };
 };
diff --git a/arch/arm/boot/dts/imx53-qsrb.dts b/arch/arm/boot/dts/imx53-qsrb.dts
index f1bbf9a32991..82d623d05915 100644
--- a/arch/arm/boot/dts/imx53-qsrb.dts
+++ b/arch/arm/boot/dts/imx53-qsrb.dts
@@ -28,6 +28,12 @@
                                 MX53_PAD_CSI0_DAT9__I2C1_SCL      0x400001ec
                         >;
                 };
+
+                pinctrl_pmic: pmicgrp {
+                        fsl,pins = <
+                                MX53_PAD_CSI0_DAT5__GPIO5_23    0x1e4 /* IRQ */
+                        >;
+                };
         };
 };
 
@@ -38,6 +44,8 @@
 
         pmic: mc34708@8 {
                 compatible = "fsl,mc34708";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_pmic>;
                 reg = <0x08>;
                 interrupt-parent = <&gpio5>;
                 interrupts = <23 0x8>;
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index 64fa27b36be0..c6c58c1c00e3 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -731,7 +731,7 @@
                                 compatible = "fsl,imx53-vpu";
                                 reg = <0x63ff4000 0x1000>;
                                 interrupts = <9>;
-                                clocks = <&clks IMX5_CLK_VPU_GATE>,
+                                clocks = <&clks IMX5_CLK_VPU_REFERENCE_GATE>,
                                          <&clks IMX5_CLK_VPU_GATE>;
                                 clock-names = "per", "ahb";
                                 resets = <&src 1>;
diff --git a/arch/arm/boot/dts/imx6dl-hummingboard.dts b/arch/arm/boot/dts/imx6dl-hummingboard.dts
index c8e51dd41b8f..71598546087f 100644
--- a/arch/arm/boot/dts/imx6dl-hummingboard.dts
+++ b/arch/arm/boot/dts/imx6dl-hummingboard.dts
@@ -58,7 +58,7 @@
 
         sound-spdif {
                 compatible = "fsl,imx-audio-spdif";
-                model = "imx-spdif";
+                model = "On-board SPDIF";
                 /* IMX6 doesn't implement this yet */
                 spdif-controller = <&spdif>;
                 spdif-out;
@@ -181,11 +181,13 @@
 };
 
 &usbh1 {
+        disable-over-current;
         vbus-supply = <&reg_usbh1_vbus>;
         status = "okay";
 };
 
 &usbotg {
+        disable-over-current;
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_hummingboard_usbotg_id>;
         vbus-supply = <&reg_usbotg_vbus>;
diff --git a/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts b/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts
index 8c1cb53464a0..4fa254347798 100644
--- a/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts
+++ b/arch/arm/boot/dts/imx6q-dmo-edmqmx6.dts
@@ -119,7 +119,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet>;
         phy-mode = "rgmii";
-        phy-reset-gpios = <&gpio3 23 0>;
+        phy-reset-gpios = <&gpio1 25 0>;
         phy-supply = <&vgen2_1v2_eth>;
         status = "okay";
 };
@@ -339,6 +339,7 @@
                                 MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK    0x1b0b0
                                 MX6QDL_PAD_ENET_MDIO__ENET_MDIO         0x1b0b0
                                 MX6QDL_PAD_ENET_MDC__ENET_MDC           0x1b0b0
+                                MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25      0x1b0b0
                                 MX6QDL_PAD_GPIO_16__ENET_REF_CLK        0x4001b0a8
                         >;
                 };
diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
index e8e781656b3f..6a524ca011e7 100644
--- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
@@ -61,7 +61,7 @@
 
         sound-spdif {
                 compatible = "fsl,imx-audio-spdif";
-                model = "imx-spdif";
+                model = "Integrated SPDIF";
                 /* IMX6 doesn't implement this yet */
                 spdif-controller = <&spdif>;
                 spdif-out;
@@ -130,16 +130,23 @@
                         fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x13091>;
                 };
 
+                pinctrl_cubox_i_usbh1: cubox-i-usbh1 {
+                        fsl,pins = <MX6QDL_PAD_GPIO_3__USB_H1_OC 0x1b0b0>;
+                };
+
                 pinctrl_cubox_i_usbh1_vbus: cubox-i-usbh1-vbus {
                         fsl,pins = <MX6QDL_PAD_GPIO_0__GPIO1_IO00 0x4001b0b0>;
                 };
 
-                pinctrl_cubox_i_usbotg_id: cubox-i-usbotg-id {
+                pinctrl_cubox_i_usbotg: cubox-i-usbotg {
                         /*
-                         * The Cubox-i pulls this low, but as it's pointless
+                         * The Cubox-i pulls ID low, but as it's pointless
                          * leaving it as a pull-up, even if it is just 10uA.
                          */
-                        fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
+                        fsl,pins = <
+                                MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059
+                                MX6QDL_PAD_KEY_COL4__USB_OTG_OC 0x1b0b0
+                        >;
                 };
 
                 pinctrl_cubox_i_usbotg_vbus: cubox-i-usbotg-vbus {
@@ -173,13 +180,15 @@
 };
 
 &usbh1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_cubox_i_usbh1>;
         vbus-supply = <&reg_usbh1_vbus>;
         status = "okay";
 };
 
 &usbotg {
         pinctrl-names = "default";
-        pinctrl-0 = <&pinctrl_cubox_i_usbotg_id>;
+        pinctrl-0 = <&pinctrl_cubox_i_usbotg>;
         vbus-supply = <&reg_usbotg_vbus>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi b/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi
index d16066608e21..db9f45b2c573 100644
--- a/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-microsom-ar8035.dtsi
@@ -17,7 +17,7 @@
         enet {
                 pinctrl_microsom_enet_ar8035: microsom-enet-ar8035 {
                         fsl,pins = <
-                                MX6QDL_PAD_ENET_MDIO__ENET_MDIO         0x1b0b0
+                                MX6QDL_PAD_ENET_MDIO__ENET_MDIO         0x1b8b0
                                 MX6QDL_PAD_ENET_MDC__ENET_MDC           0x1b0b0
                                 /* AR8035 reset */
                                 MX6QDL_PAD_KEY_ROW4__GPIO4_IO15         0x130b0
diff --git a/arch/arm/boot/dts/imx6sx-pinfunc.h b/arch/arm/boot/dts/imx6sx-pinfunc.h
index 3e0b816dac08..bb9c6b78cb97 100644
--- a/arch/arm/boot/dts/imx6sx-pinfunc.h
+++ b/arch/arm/boot/dts/imx6sx-pinfunc.h
@@ -78,7 +78,7 @@
 #define MX6SX_PAD_GPIO1_IO07__USDHC2_WP                           0x0030 0x0378 0x0870 0x1 0x1
 #define MX6SX_PAD_GPIO1_IO07__ENET2_MDIO                          0x0030 0x0378 0x0770 0x2 0x0
 #define MX6SX_PAD_GPIO1_IO07__AUDMUX_MCLK                         0x0030 0x0378 0x0000 0x3 0x0
-#define MX6SX_PAD_GPIO1_IO07__UART1_CTS_B                         0x0030 0x0378 0x082C 0x4 0x1
+#define MX6SX_PAD_GPIO1_IO07__UART1_CTS_B                         0x0030 0x0378 0x0000 0x4 0x0
 #define MX6SX_PAD_GPIO1_IO07__GPIO1_IO_7                          0x0030 0x0378 0x0000 0x5 0x0
 #define MX6SX_PAD_GPIO1_IO07__SRC_EARLY_RESET                     0x0030 0x0378 0x0000 0x6 0x0
 #define MX6SX_PAD_GPIO1_IO07__DCIC2_OUT                           0x0030 0x0378 0x0000 0x7 0x0
@@ -96,7 +96,7 @@
 #define MX6SX_PAD_GPIO1_IO09__WDOG2_WDOG_B                        0x0038 0x0380 0x0000 0x1 0x0
 #define MX6SX_PAD_GPIO1_IO09__SDMA_EXT_EVENT_1                    0x0038 0x0380 0x0820 0x2 0x0
 #define MX6SX_PAD_GPIO1_IO09__CCM_OUT0                            0x0038 0x0380 0x0000 0x3 0x0
-#define MX6SX_PAD_GPIO1_IO09__UART2_CTS_B                         0x0038 0x0380 0x0834 0x4 0x1
+#define MX6SX_PAD_GPIO1_IO09__UART2_CTS_B                         0x0038 0x0380 0x0000 0x4 0x0
 #define MX6SX_PAD_GPIO1_IO09__GPIO1_IO_9                          0x0038 0x0380 0x0000 0x5 0x0
 #define MX6SX_PAD_GPIO1_IO09__SRC_INT_BOOT                        0x0038 0x0380 0x0000 0x6 0x0
 #define MX6SX_PAD_GPIO1_IO09__OBSERVE_MUX_OUT_4                   0x0038 0x0380 0x0000 0x7 0x0
@@ -213,7 +213,7 @@
 #define MX6SX_PAD_CSI_DATA07__ESAI_TX3_RX2                        0x0068 0x03B0 0x079C 0x1 0x1
 #define MX6SX_PAD_CSI_DATA07__I2C4_SDA                            0x0068 0x03B0 0x07C4 0x2 0x2
 #define MX6SX_PAD_CSI_DATA07__KPP_ROW_7                           0x0068 0x03B0 0x07DC 0x3 0x0
-#define MX6SX_PAD_CSI_DATA07__UART6_CTS_B                         0x0068 0x03B0 0x0854 0x4 0x1
+#define MX6SX_PAD_CSI_DATA07__UART6_CTS_B                         0x0068 0x03B0 0x0000 0x4 0x0
 #define MX6SX_PAD_CSI_DATA07__GPIO1_IO_21                         0x0068 0x03B0 0x0000 0x5 0x0
 #define MX6SX_PAD_CSI_DATA07__WEIM_DATA_16                        0x0068 0x03B0 0x0000 0x6 0x0
 #define MX6SX_PAD_CSI_DATA07__DCIC1_OUT                           0x0068 0x03B0 0x0000 0x7 0x0
@@ -254,7 +254,7 @@
 #define MX6SX_PAD_CSI_VSYNC__CSI1_VSYNC                           0x0078 0x03C0 0x0708 0x0 0x0
 #define MX6SX_PAD_CSI_VSYNC__ESAI_TX5_RX0                         0x0078 0x03C0 0x07A4 0x1 0x1
 #define MX6SX_PAD_CSI_VSYNC__AUDMUX_AUD6_RXD                      0x0078 0x03C0 0x0674 0x2 0x1
-#define MX6SX_PAD_CSI_VSYNC__UART4_CTS_B                          0x0078 0x03C0 0x0844 0x3 0x3
+#define MX6SX_PAD_CSI_VSYNC__UART4_CTS_B                          0x0078 0x03C0 0x0000 0x3 0x0
 #define MX6SX_PAD_CSI_VSYNC__MQS_RIGHT                            0x0078 0x03C0 0x0000 0x4 0x0
 #define MX6SX_PAD_CSI_VSYNC__GPIO1_IO_25                          0x0078 0x03C0 0x0000 0x5 0x0
 #define MX6SX_PAD_CSI_VSYNC__WEIM_DATA_24                         0x0078 0x03C0 0x0000 0x6 0x0
@@ -352,7 +352,7 @@
 #define MX6SX_PAD_ENET2_TX_CLK__ENET2_TX_CLK                      0x00A0 0x03E8 0x0000 0x0 0x0
 #define MX6SX_PAD_ENET2_TX_CLK__ENET2_REF_CLK2                    0x00A0 0x03E8 0x076C 0x1 0x1
 #define MX6SX_PAD_ENET2_TX_CLK__I2C3_SDA                          0x00A0 0x03E8 0x07BC 0x2 0x1
-#define MX6SX_PAD_ENET2_TX_CLK__UART1_CTS_B                       0x00A0 0x03E8 0x082C 0x3 0x3
+#define MX6SX_PAD_ENET2_TX_CLK__UART1_CTS_B                       0x00A0 0x03E8 0x0000 0x3 0x0
 #define MX6SX_PAD_ENET2_TX_CLK__MLB_CLK                           0x00A0 0x03E8 0x07E8 0x4 0x1
 #define MX6SX_PAD_ENET2_TX_CLK__GPIO2_IO_9                        0x00A0 0x03E8 0x0000 0x5 0x0
 #define MX6SX_PAD_ENET2_TX_CLK__USB_OTG2_PWR                      0x00A0 0x03E8 0x0000 0x6 0x0
@@ -404,7 +404,7 @@
 #define MX6SX_PAD_KEY_COL4__SAI2_RX_BCLK                          0x00B4 0x03FC 0x0808 0x7 0x0
 #define MX6SX_PAD_KEY_ROW0__KPP_ROW_0                             0x00B8 0x0400 0x0000 0x0 0x0
 #define MX6SX_PAD_KEY_ROW0__USDHC3_WP                             0x00B8 0x0400 0x0000 0x1 0x0
-#define MX6SX_PAD_KEY_ROW0__UART6_CTS_B                           0x00B8 0x0400 0x0854 0x2 0x3
+#define MX6SX_PAD_KEY_ROW0__UART6_CTS_B                           0x00B8 0x0400 0x0000 0x2 0x0
 #define MX6SX_PAD_KEY_ROW0__ECSPI1_MOSI                           0x00B8 0x0400 0x0718 0x3 0x0
 #define MX6SX_PAD_KEY_ROW0__AUDMUX_AUD5_TXD                       0x00B8 0x0400 0x0660 0x4 0x0
 #define MX6SX_PAD_KEY_ROW0__GPIO2_IO_15                           0x00B8 0x0400 0x0000 0x5 0x0
@@ -423,7 +423,7 @@
 #define MX6SX_PAD_KEY_ROW1__M4_NMI                                0x00BC 0x0404 0x0000 0x8 0x0
 #define MX6SX_PAD_KEY_ROW2__KPP_ROW_2                             0x00C0 0x0408 0x0000 0x0 0x0
 #define MX6SX_PAD_KEY_ROW2__USDHC4_WP                             0x00C0 0x0408 0x0878 0x1 0x1
-#define MX6SX_PAD_KEY_ROW2__UART5_CTS_B                           0x00C0 0x0408 0x084C 0x2 0x3
+#define MX6SX_PAD_KEY_ROW2__UART5_CTS_B                           0x00C0 0x0408 0x0000 0x2 0x0
 #define MX6SX_PAD_KEY_ROW2__CAN1_RX                               0x00C0 0x0408 0x068C 0x3 0x1
 #define MX6SX_PAD_KEY_ROW2__CANFD_RX1                             0x00C0 0x0408 0x0694 0x4 0x1
 #define MX6SX_PAD_KEY_ROW2__GPIO2_IO_17                           0x00C0 0x0408 0x0000 0x5 0x0
@@ -815,7 +815,7 @@
 #define MX6SX_PAD_NAND_DATA05__RAWNAND_DATA05                     0x0164 0x04AC 0x0000 0x0 0x0
 #define MX6SX_PAD_NAND_DATA05__USDHC2_DATA5                       0x0164 0x04AC 0x0000 0x1 0x0
 #define MX6SX_PAD_NAND_DATA05__QSPI2_B_DQS                        0x0164 0x04AC 0x0000 0x2 0x0
-#define MX6SX_PAD_NAND_DATA05__UART3_CTS_B                        0x0164 0x04AC 0x083C 0x3 0x1
+#define MX6SX_PAD_NAND_DATA05__UART3_CTS_B                        0x0164 0x04AC 0x0000 0x3 0x0
 #define MX6SX_PAD_NAND_DATA05__AUDMUX_AUD4_RXC                    0x0164 0x04AC 0x064C 0x4 0x0
 #define MX6SX_PAD_NAND_DATA05__GPIO4_IO_9                         0x0164 0x04AC 0x0000 0x5 0x0
 #define MX6SX_PAD_NAND_DATA05__WEIM_AD_5                          0x0164 0x04AC 0x0000 0x6 0x0
@@ -957,7 +957,7 @@
 #define MX6SX_PAD_QSPI1A_SS1_B__SIM_M_HADDR_12                    0x019C 0x04E4 0x0000 0x7 0x0
 #define MX6SX_PAD_QSPI1A_SS1_B__SDMA_DEBUG_PC_3                   0x019C 0x04E4 0x0000 0x9 0x0
 #define MX6SX_PAD_QSPI1B_DATA0__QSPI1_B_DATA_0                    0x01A0 0x04E8 0x0000 0x0 0x0
-#define MX6SX_PAD_QSPI1B_DATA0__UART3_CTS_B                       0x01A0 0x04E8 0x083C 0x1 0x4
+#define MX6SX_PAD_QSPI1B_DATA0__UART3_CTS_B                       0x01A0 0x04E8 0x0000 0x1 0x0
 #define MX6SX_PAD_QSPI1B_DATA0__ECSPI3_MOSI                       0x01A0 0x04E8 0x0738 0x2 0x1
 #define MX6SX_PAD_QSPI1B_DATA0__ESAI_RX_FS                        0x01A0 0x04E8 0x0778 0x3 0x2
 #define MX6SX_PAD_QSPI1B_DATA0__CSI1_DATA_22                      0x01A0 0x04E8 0x06F4 0x4 0x1
@@ -1236,7 +1236,7 @@
 #define MX6SX_PAD_SD1_DATA2__AUDMUX_AUD5_TXFS                     0x0230 0x0578 0x0670 0x1 0x1
 #define MX6SX_PAD_SD1_DATA2__PWM3_OUT                             0x0230 0x0578 0x0000 0x2 0x0
 #define MX6SX_PAD_SD1_DATA2__GPT_COMPARE2                         0x0230 0x0578 0x0000 0x3 0x0
-#define MX6SX_PAD_SD1_DATA2__UART2_CTS_B                          0x0230 0x0578 0x0834 0x4 0x2
+#define MX6SX_PAD_SD1_DATA2__UART2_CTS_B                          0x0230 0x0578 0x0000 0x4 0x0
 #define MX6SX_PAD_SD1_DATA2__GPIO6_IO_4                           0x0230 0x0578 0x0000 0x5 0x0
 #define MX6SX_PAD_SD1_DATA2__ECSPI4_RDY                           0x0230 0x0578 0x0000 0x6 0x0
 #define MX6SX_PAD_SD1_DATA2__CCM_OUT0                             0x0230 0x0578 0x0000 0x7 0x0
@@ -1315,7 +1315,7 @@
 #define MX6SX_PAD_SD2_DATA3__VADC_CLAMP_CURRENT_3                 0x024C 0x0594 0x0000 0x8 0x0
 #define MX6SX_PAD_SD2_DATA3__MMDC_DEBUG_31                        0x024C 0x0594 0x0000 0x9 0x0
 #define MX6SX_PAD_SD3_CLK__USDHC3_CLK                             0x0250 0x0598 0x0000 0x0 0x0
-#define MX6SX_PAD_SD3_CLK__UART4_CTS_B                            0x0250 0x0598 0x0844 0x1 0x0
+#define MX6SX_PAD_SD3_CLK__UART4_CTS_B                            0x0250 0x0598 0x0000 0x1 0x0
 #define MX6SX_PAD_SD3_CLK__ECSPI4_SCLK                            0x0250 0x0598 0x0740 0x2 0x0
 #define MX6SX_PAD_SD3_CLK__AUDMUX_AUD6_RXFS                       0x0250 0x0598 0x0680 0x3 0x0
 #define MX6SX_PAD_SD3_CLK__LCDIF2_VSYNC                           0x0250 0x0598 0x0000 0x4 0x0
@@ -1409,7 +1409,7 @@
 #define MX6SX_PAD_SD3_DATA7__USDHC3_DATA7                         0x0274 0x05BC 0x0000 0x0 0x0
 #define MX6SX_PAD_SD3_DATA7__CAN1_RX                              0x0274 0x05BC 0x068C 0x1 0x0
 #define MX6SX_PAD_SD3_DATA7__CANFD_RX1                            0x0274 0x05BC 0x0694 0x2 0x0
-#define MX6SX_PAD_SD3_DATA7__UART3_CTS_B                          0x0274 0x05BC 0x083C 0x3 0x3
+#define MX6SX_PAD_SD3_DATA7__UART3_CTS_B                          0x0274 0x05BC 0x0000 0x3 0x0
 #define MX6SX_PAD_SD3_DATA7__LCDIF2_DATA_5                        0x0274 0x05BC 0x0000 0x4 0x0
 #define MX6SX_PAD_SD3_DATA7__GPIO7_IO_9                           0x0274 0x05BC 0x0000 0x5 0x0
 #define MX6SX_PAD_SD3_DATA7__ENET1_1588_EVENT0_IN                 0x0274 0x05BC 0x0000 0x6 0x0
@@ -1510,7 +1510,7 @@
 #define MX6SX_PAD_SD4_DATA6__SDMA_DEBUG_EVENT_CHANNEL_1           0x0298 0x05E0 0x0000 0x9 0x0
 #define MX6SX_PAD_SD4_DATA7__USDHC4_DATA7                         0x029C 0x05E4 0x0000 0x0 0x0
 #define MX6SX_PAD_SD4_DATA7__RAWNAND_DATA08                       0x029C 0x05E4 0x0000 0x1 0x0
-#define MX6SX_PAD_SD4_DATA7__UART5_CTS_B                          0x029C 0x05E4 0x084C 0x2 0x1
+#define MX6SX_PAD_SD4_DATA7__UART5_CTS_B                          0x029C 0x05E4 0x0000 0x2 0x0
 #define MX6SX_PAD_SD4_DATA7__ECSPI3_SS0                           0x029C 0x05E4 0x073C 0x3 0x0
 #define MX6SX_PAD_SD4_DATA7__LCDIF2_DATA_15                       0x029C 0x05E4 0x0000 0x4 0x0
 #define MX6SX_PAD_SD4_DATA7__GPIO6_IO_21                          0x029C 0x05E4 0x0000 0x5 0x0
diff --git a/arch/arm/boot/dts/omap3-beagle.dts b/arch/arm/boot/dts/omap3-beagle.dts
index 3c3e6da1deac..a9aae88b74f5 100644
--- a/arch/arm/boot/dts/omap3-beagle.dts
+++ b/arch/arm/boot/dts/omap3-beagle.dts
@@ -292,6 +292,7 @@
 &uart3 {
         pinctrl-names = "default";
         pinctrl-0 = <&uart3_pins>;
+        interrupts-extended = <&intc 74 &omap3_pmx_core OMAP3_UART3_RX>;
 };
 
 &gpio1 {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index b15f1a77d684..1fe45d1f75ec 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -353,7 +353,7 @@
         };
 
         twl_power: power {
-                compatible = "ti,twl4030-power-n900";
+                compatible = "ti,twl4030-power-n900", "ti,twl4030-power-idle-osc-off";
                 ti,use_poweroff;
         };
 };
diff --git a/arch/arm/boot/dts/omap3430-sdp.dts b/arch/arm/boot/dts/omap3430-sdp.dts
index 02f69f4a8fd3..9bad94efe1c8 100644
--- a/arch/arm/boot/dts/omap3430-sdp.dts
+++ b/arch/arm/boot/dts/omap3430-sdp.dts
@@ -107,7 +107,7 @@
                 #address-cells = <1>;
                 #size-cells = <1>;
                 reg = <1 0 0x08000000>;
-                ti,nand-ecc-opt = "ham1";
+                ti,nand-ecc-opt = "sw";
                 nand-bus-width = <8>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <36>;
diff --git a/arch/arm/boot/dts/omap3xxx-clocks.dtsi b/arch/arm/boot/dts/omap3xxx-clocks.dtsi
index e47ff69dcf70..5c375003bad1 100644
--- a/arch/arm/boot/dts/omap3xxx-clocks.dtsi
+++ b/arch/arm/boot/dts/omap3xxx-clocks.dtsi
@@ -467,6 +467,7 @@
                 ti,bit-shift = <0x1e>;
                 reg = <0x0d00>;
                 ti,set-bit-to-disable;
+                ti,set-rate-parent;
         };
 
         dpll4_m6_ck: dpll4_m6_ck {
diff --git a/arch/arm/boot/dts/omap54xx-clocks.dtsi b/arch/arm/boot/dts/omap54xx-clocks.dtsi
index e67a23b5d788..58c27466f012 100644
--- a/arch/arm/boot/dts/omap54xx-clocks.dtsi
+++ b/arch/arm/boot/dts/omap54xx-clocks.dtsi
@@ -367,10 +367,12 @@
 
         l3_iclk_div: l3_iclk_div {
                 #clock-cells = <0>;
-                compatible = "fixed-factor-clock";
+                compatible = "ti,divider-clock";
+                ti,max-div = <2>;
+                ti,bit-shift = <4>;
+                reg = <0x100>;
                 clocks = <&dpll_core_h12x2_ck>;
-                clock-mult = <1>;
-                clock-div = <1>;
+                ti,index-power-of-two;
         };
 
         gpu_l3_iclk: gpu_l3_iclk {
@@ -383,10 +385,12 @@
 
         l4_root_clk_div: l4_root_clk_div {
                 #clock-cells = <0>;
-                compatible = "fixed-factor-clock";
+                compatible = "ti,divider-clock";
+                ti,max-div = <2>;
+                ti,bit-shift = <8>;
+                reg = <0x100>;
                 clocks = <&l3_iclk_div>;
-                clock-mult = <1>;
-                clock-div = <1>;
+                ti,index-power-of-two;
         };
 
         slimbus1_slimbus_clk: slimbus1_slimbus_clk {
diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts
index 23486c081a69..be59014474b2 100644
--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
+++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
@@ -275,11 +275,6 @@
                 renesas,function = "msiof0";
         };
 
-        i2c6_pins: i2c6 {
-                renesas,groups = "i2c6";
-                renesas,function = "i2c6";
-        };
-
         usb0_pins: usb0 {
                 renesas,groups = "usb0";
                 renesas,function = "usb0";
@@ -420,8 +415,6 @@
 };
 
 &i2c6 {
-        pinctrl-names = "default";
-        pinctrl-0 = <&i2c6_pins>;
         status = "okay";
         clock-frequency = <100000>;
 
diff --git a/arch/arm/boot/dts/rk3066a-bqcurie2.dts b/arch/arm/boot/dts/rk3066a-bqcurie2.dts
index 042f821d9e4d..c9d912da6141 100644
--- a/arch/arm/boot/dts/rk3066a-bqcurie2.dts
+++ b/arch/arm/boot/dts/rk3066a-bqcurie2.dts
@@ -149,6 +149,8 @@
 &mmc0 { /* sdmmc */
         num-slots = <1>;
         status = "okay";
+        pinctrl-names = "default";
+        pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>;
         vmmc-supply = <&vcc_sd0>;
 
         slot@0 {
diff --git a/arch/arm/boot/dts/rk3188-radxarock.dts b/arch/arm/boot/dts/rk3188-radxarock.dts
index 171b610db709..5e4e3c238b2d 100644
--- a/arch/arm/boot/dts/rk3188-radxarock.dts
+++ b/arch/arm/boot/dts/rk3188-radxarock.dts
@@ -179,6 +179,8 @@
 &mmc0 {
         num-slots = <1>;
         status = "okay";
+        pinctrl-names = "default";
+        pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>;
         vmmc-supply = <&vcc_sd0>;
 
         slot@0 {
diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
index 4a2000c620ad..3e97a669f15e 100644
--- a/arch/arm/boot/dts/ste-snowball.dts
+++ b/arch/arm/boot/dts/ste-snowball.dts
@@ -116,7 +116,6 @@
                 msp2: msp@80117000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp2_default_mode>;
-                        status = "okay";
                 };
 
                 msp3: msp@80125000 {
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index 44b07e512c24..e06fbfc55bb7 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -660,6 +660,8 @@
                         clock-frequency = <100000>;
                         resets = <&apb2_rst 0>;
                         status = "disabled";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
                 };
 
                 i2c1: i2c@01c2b000 {
@@ -670,6 +672,8 @@
                         clock-frequency = <100000>;
                         resets = <&apb2_rst 1>;
                         status = "disabled";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
                 };
 
                 i2c2: i2c@01c2b400 {
@@ -680,6 +684,8 @@
                         clock-frequency = <100000>;
                         resets = <&apb2_rst 2>;
                         status = "disabled";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
                 };
 
                 i2c3: i2c@01c2b800 {
@@ -690,6 +696,8 @@
                         clock-frequency = <100000>;
                         resets = <&apb2_rst 3>;
                         status = "disabled";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
                 };
 
                 gmac: ethernet@01c30000 {
diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi
index 8adaa7871dd3..a5446cba9804 100644
--- a/arch/arm/boot/dts/tegra30-apalis.dtsi
+++ b/arch/arm/boot/dts/tegra30-apalis.dtsi
@@ -423,7 +423,7 @@
                         vcc4-supply = <&sys_3v3_reg>;
                         vcc5-supply = <&sys_3v3_reg>;
                         vcc6-supply = <&vio_reg>;
-                        vcc7-supply = <&sys_5v0_reg>;
+                        vcc7-supply = <&charge_pump_5v0_reg>;
                         vccio-supply = <&sys_3v3_reg>;
 
                         regulators {
@@ -674,5 +674,14 @@
                         regulator-max-microvolt = <3300000>;
                         regulator-always-on;
                 };
+
+                charge_pump_5v0_reg: regulator@101 {
+                        compatible = "regulator-fixed";
+                        reg = <101>;
+                        regulator-name = "5v0";
+                        regulator-min-microvolt = <5000000>;
+                        regulator-max-microvolt = <5000000>;
+                        regulator-always-on;
+                };
         };
 };
diff --git a/arch/arm/boot/dts/tegra30-colibri.dtsi b/arch/arm/boot/dts/tegra30-colibri.dtsi
index bf16f8e65627..c4ed1bec4d92 100644
--- a/arch/arm/boot/dts/tegra30-colibri.dtsi
+++ b/arch/arm/boot/dts/tegra30-colibri.dtsi
@@ -201,7 +201,7 @@
                         vcc4-supply = <&sys_3v3_reg>;
                         vcc5-supply = <&sys_3v3_reg>;
                         vcc6-supply = <&vio_reg>;
-                        vcc7-supply = <&sys_5v0_reg>;
+                        vcc7-supply = <&charge_pump_5v0_reg>;
                         vccio-supply = <&sys_3v3_reg>;
 
                         regulators {
@@ -373,5 +373,14 @@
                         regulator-max-microvolt = <3300000>;
                         regulator-always-on;
                 };
+
+                charge_pump_5v0_reg: regulator@101 {
+                        compatible = "regulator-fixed";
+                        reg = <101>;
+                        regulator-name = "5v0";
+                        regulator-min-microvolt = <5000000>;
+                        regulator-max-microvolt = <5000000>;
+                        regulator-always-on;
+                };
         };
 };
diff --git a/arch/arm/boot/dts/twl6030.dtsi b/arch/arm/boot/dts/twl6030.dtsi
index 2e3bd3172b23..55eb35f068fb 100644
--- a/arch/arm/boot/dts/twl6030.dtsi
+++ b/arch/arm/boot/dts/twl6030.dtsi
@@ -83,10 +83,6 @@
                 regulator-always-on;
         };
 
-        clk32kg: regulator-clk32kg {
-                compatible = "ti,twl6030-clk32kg";
-        };
-
         twl_usb_comparator: usb-comparator {
                 compatible = "ti,twl6030-usb";
                 interrupts = <4>, <10>;
diff --git a/arch/arm/boot/dts/vf610-twr.dts b/arch/arm/boot/dts/vf610-twr.dts
index 11d733406c7e..b8a5e8c68f06 100644
--- a/arch/arm/boot/dts/vf610-twr.dts
+++ b/arch/arm/boot/dts/vf610-twr.dts
@@ -168,7 +168,7 @@
                 };
 
                 pinctrl_esdhc1: esdhc1grp {
-                        fsl,fsl,pins = <
+                        fsl,pins = <
                                 VF610_PAD_PTA24__ESDHC1_CLK     0x31ef
                                 VF610_PAD_PTA25__ESDHC1_CMD     0x31ef
                                 VF610_PAD_PTA26__ESDHC1_DAT0    0x31ef
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index 88099175fc56..d86771abbf57 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -1443,14 +1443,14 @@ void edma_assign_channel_eventq(unsigned channel, enum dma_event_q eventq_no)
 EXPORT_SYMBOL(edma_assign_channel_eventq);
 
 static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
-                              struct edma *edma_cc)
+                              struct edma *edma_cc, int cc_id)
 {
         int i;
         u32 value, cccfg;
         s8 (*queue_priority_map)[2];
 
         /* Decode the eDMA3 configuration from CCCFG register */
-        cccfg = edma_read(0, EDMA_CCCFG);
+        cccfg = edma_read(cc_id, EDMA_CCCFG);
 
         value = GET_NUM_REGN(cccfg);
         edma_cc->num_region = BIT(value);
@@ -1464,7 +1464,8 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
         value = GET_NUM_EVQUE(cccfg);
         edma_cc->num_tc = value + 1;
 
-        dev_dbg(dev, "eDMA3 HW configuration (cccfg: 0x%08x):\n", cccfg);
+        dev_dbg(dev, "eDMA3 CC%d HW configuration (cccfg: 0x%08x):\n", cc_id,
+                cccfg);
         dev_dbg(dev, "num_region: %u\n", edma_cc->num_region);
         dev_dbg(dev, "num_channel: %u\n", edma_cc->num_channels);
         dev_dbg(dev, "num_slot: %u\n", edma_cc->num_slots);
@@ -1684,7 +1685,7 @@ static int edma_probe(struct platform_device *pdev)
                         return -ENOMEM;
 
                 /* Get eDMA3 configuration from IP */
-                ret = edma_setup_from_hw(dev, info[j], edma_cc[j]);
+                ret = edma_setup_from_hw(dev, info[j], edma_cc[j], j);
                 if (ret)
                         return ret;
 
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index fd43f7f55b70..79ecb4f34ffb 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -472,7 +472,6 @@ static inline void __sync_cache_range_r(volatile void *p, size_t size)
         "mcr    p15, 0, r0, c1, c0, 0   @ set SCTLR \n\t" \
         "isb    \n\t" \
         "bl     v7_flush_dcache_"__stringify(level)" \n\t" \
-        "clrex  \n\t" \
         "mrc    p15, 0, r0, c1, c0, 1   @ get ACTLR \n\t" \
         "bic    r0, r0, #(1 << 6)       @ disable local coherency \n\t" \
         "mcr    p15, 0, r0, c1, c0, 1   @ set ACTLR \n\t" \
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 963a2515906d..819777d0e91f 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -74,6 +74,7 @@
 #define ARM_CPU_PART_CORTEX_A12         0x4100c0d0
 #define ARM_CPU_PART_CORTEX_A17         0x4100c0e0
 #define ARM_CPU_PART_CORTEX_A15         0x4100c0f0
+#define ARM_CPU_PART_MASK               0xff00fff0
 
 #define ARM_CPU_XSCALE_ARCH_MASK        0xe000
 #define ARM_CPU_XSCALE_ARCH_V1          0x2000
@@ -179,7 +180,7 @@ static inline unsigned int __attribute_const__ read_cpuid_implementor(void)
  */
 static inline unsigned int __attribute_const__ read_cpuid_part(void)
 {
-        return read_cpuid_id() & 0xff00fff0;
+        return read_cpuid_id() & ARM_CPU_PART_MASK;
 }
 
 static inline unsigned int __attribute_const__ __deprecated read_cpuid_part_number(void)
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index f4b46d39b9cf..afb9cafd3786 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -50,6 +50,7 @@ typedef struct user_fp elf_fpregset_t;
 #define R_ARM_ABS32             2
 #define R_ARM_CALL              28
 #define R_ARM_JUMP24            29
+#define R_ARM_TARGET1           38
 #define R_ARM_V4BX              40
 #define R_ARM_PREL31            42
 #define R_ARM_MOVW_ABS_NC       43
diff --git a/arch/arm/include/asm/smp_plat.h b/arch/arm/include/asm/smp_plat.h
index a252c0bfacf5..0ad7d490ee6f 100644
--- a/arch/arm/include/asm/smp_plat.h
+++ b/arch/arm/include/asm/smp_plat.h
@@ -8,6 +8,7 @@
 #include <linux/cpumask.h>
 #include <linux/err.h>
 
+#include <asm/cpu.h>
 #include <asm/cputype.h>
 
 /*
@@ -25,6 +26,20 @@ static inline bool is_smp(void)
 #endif
 }
 
+/**
+ * smp_cpuid_part() - return part id for a given cpu
+ * @cpu:        logical cpu id.
+ *
+ * Return: part id of logical cpu passed as argument.
+ */
+static inline unsigned int smp_cpuid_part(int cpu)
+{
+        struct cpuinfo_arm *cpu_info = &per_cpu(cpu_data, cpu);
+
+        return is_smp() ? cpu_info->cpuid & ARM_CPU_PART_MASK :
+                          read_cpuid_part();
+}
+
 /* all SMP configurations have the extended CPUID registers */
 #ifndef CONFIG_MMU
 #define tlb_ops_need_broadcast()        0
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 8db307d0954b..2fdf8679b46e 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -208,26 +208,21 @@
 #endif
         .endif
         msr     spsr_cxsf, \rpsr
-#if defined(CONFIG_CPU_V6)
-        ldr     r0, [sp]
-        strex   r1, r2, [sp]                    @ clear the exclusive monitor
-        ldmib   sp, {r1 - pc}^                  @ load r1 - pc, cpsr
-#elif defined(CONFIG_CPU_32v6K)
-        clrex                                   @ clear the exclusive monitor
-        ldmia   sp, {r0 - pc}^                  @ load r0 - pc, cpsr
-#else
-        ldmia   sp, {r0 - pc}^                  @ load r0 - pc, cpsr
+#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
+        @ We must avoid clrex due to Cortex-A15 erratum #830321
+        sub     r0, sp, #4                      @ uninhabited address
+        strex   r1, r2, [r0]                    @ clear the exclusive monitor
 #endif
+        ldmia   sp, {r0 - pc}^                  @ load r0 - pc, cpsr
         .endm
 
         .macro  restore_user_regs, fast = 0, offset = 0
         ldr     r1, [sp, #\offset + S_PSR]      @ get calling cpsr
         ldr     lr, [sp, #\offset + S_PC]!      @ get pc
         msr     spsr_cxsf, r1                   @ save in spsr_svc
-#if defined(CONFIG_CPU_V6)
+#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
+        @ We must avoid clrex due to Cortex-A15 erratum #830321
         strex   r1, r2, [sp]                    @ clear the exclusive monitor
-#elif defined(CONFIG_CPU_32v6K)
-        clrex                                   @ clear the exclusive monitor
 #endif
         .if     \fast
         ldmdb   sp, {r1 - lr}^                  @ get calling r1 - lr
@@ -261,7 +256,10 @@
         .endif
         ldr     lr, [sp, #S_SP]                 @ top of the stack
         ldrd    r0, r1, [sp, #S_LR]             @ calling lr and pc
-        clrex                                   @ clear the exclusive monitor
+
+        @ We must avoid clrex due to Cortex-A15 erratum #830321
+        strex   r2, r1, [sp, #S_LR]             @ clear the exclusive monitor
+
         stmdb   lr!, {r0, r1, \rpsr}            @ calling lr and rfe context
         ldmia   sp, {r0 - r12}
         mov     sp, lr
@@ -282,13 +280,16 @@
         .endm
 #else   /* ifdef CONFIG_CPU_V7M */
         .macro  restore_user_regs, fast = 0, offset = 0
-        clrex                                   @ clear the exclusive monitor
         mov     r2, sp
         load_user_sp_lr r2, r3, \offset + S_SP  @ calling sp, lr
         ldr     r1, [sp, #\offset + S_PSR]      @ get calling cpsr
         ldr     lr, [sp, #\offset + S_PC]       @ get pc
         add     sp, sp, #\offset + S_SP
         msr     spsr_cxsf, r1                   @ save in spsr_svc
+
+        @ We must avoid clrex due to Cortex-A15 erratum #830321
+        strex   r1, r2, [sp]                    @ clear the exclusive monitor
+
         .if     \fast
         ldmdb   sp, {r1 - r12}                  @ get calling r1 - r12
         .else
diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
index 45e478157278..6a4dffefd357 100644
--- a/arch/arm/kernel/module.c
+++ b/arch/arm/kernel/module.c
@@ -91,6 +91,7 @@ apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex,
                         break;
 
                 case R_ARM_ABS32:
+                case R_ARM_TARGET1:
                         *(u32 *)loc += sym->st_value;
                         break;
 
diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c
index 4c979d466cc1..a96a8043277c 100644
--- a/arch/arm/kvm/handle_exit.c
+++ b/arch/arm/kvm/handle_exit.c
@@ -93,6 +93,8 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run)
         else
                 kvm_vcpu_block(vcpu);
 
+        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+
         return 1;
 }
 
diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S
index 991415d978b6..3988e72d16ff 100644
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -99,6 +99,10 @@ __do_hyp_init:
         mrc     p15, 0, r0, c10, c2, 1
         mcr     p15, 4, r0, c10, c2, 1
 
+        @ Invalidate the stale TLBs from Bootloader
+        mcr     p15, 4, r0, c8, c7, 0   @ TLBIALLH
+        dsb     ish
+
         @ Set the HSCTLR to:
         @  - ARM/THUMB exceptions: Kernel config (Thumb-2 kernel)
         @  - Endianness: Kernel config
diff --git a/arch/arm/mach-at91/board-dt-rm9200.c b/arch/arm/mach-at91/board-dt-rm9200.c
index 3a185faee795..f4b6e91843e4 100644
--- a/arch/arm/mach-at91/board-dt-rm9200.c
+++ b/arch/arm/mach-at91/board-dt-rm9200.c
@@ -14,6 +14,7 @@
 #include <linux/gpio.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
+#include <linux/clk-provider.h>
 
 #include <asm/setup.h>
 #include <asm/irq.h>
@@ -35,13 +36,21 @@ static void __init at91rm9200_dt_init_irq(void)
         of_irq_init(irq_of_match);
 }
 
+static void __init at91rm9200_dt_timer_init(void)
+{
+#if defined(CONFIG_COMMON_CLK)
+        of_clk_init(NULL);
+#endif
+        at91rm9200_timer_init();
+}
+
 static const char *at91rm9200_dt_board_compat[] __initdata = {
         "atmel,at91rm9200",
         NULL
 };
 
 DT_MACHINE_START(at91rm9200_dt, "Atmel AT91RM9200 (Device Tree)")
-        .init_time      = at91rm9200_timer_init,
+        .init_time      = at91rm9200_dt_timer_init,
         .map_io         = at91_map_io,
         .handle_irq     = at91_aic_handle_irq,
         .init_early     = at91rm9200_dt_initialize,
diff --git a/arch/arm/mach-bcm/Makefile b/arch/arm/mach-bcm/Makefile
index 67c492aabf4d..b19a39652545 100644
--- a/arch/arm/mach-bcm/Makefile
+++ b/arch/arm/mach-bcm/Makefile
@@ -36,5 +36,4 @@ obj-$(CONFIG_ARCH_BCM_5301X)	+= bcm_5301x.o
 
 ifeq ($(CONFIG_ARCH_BRCMSTB),y)
 obj-y                           += brcmstb.o
-obj-$(CONFIG_SMP)               += headsmp-brcmstb.o platsmp-brcmstb.o
 endif
diff --git a/arch/arm/mach-bcm/brcmstb.h b/arch/arm/mach-bcm/brcmstb.h
deleted file mode 100644
index ec0c3d112b36..000000000000
--- a/arch/arm/mach-bcm/brcmstb.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright (C) 2013-2014 Broadcom Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation version 2.
- *
- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
- * kind, whether express or implied; without even the implied warranty
- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#ifndef __BRCMSTB_H__
-#define __BRCMSTB_H__
-
-void brcmstb_secondary_startup(void);
-
-#endif /* __BRCMSTB_H__ */
diff --git a/arch/arm/mach-bcm/headsmp-brcmstb.S b/arch/arm/mach-bcm/headsmp-brcmstb.S
deleted file mode 100644
index 199c1ea58248..000000000000
--- a/arch/arm/mach-bcm/headsmp-brcmstb.S
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * SMP boot code for secondary CPUs
- * Based on arch/arm/mach-tegra/headsmp.S
- *
- * Copyright (C) 2010 NVIDIA, Inc.
- * Copyright (C) 2013-2014 Broadcom Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation version 2.
- *
- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
- * kind, whether express or implied; without even the implied warranty
- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <asm/assembler.h>
-#include <linux/linkage.h>
-#include <linux/init.h>
-
-        .section ".text.head", "ax"
-
-ENTRY(brcmstb_secondary_startup)
-        /*
-         * Ensure CPU is in a sane state by disabling all IRQs and switching
-         * into SVC mode.
-         */
-        setmode PSR_I_BIT | PSR_F_BIT | SVC_MODE, r0
-
-        bl      v7_invalidate_l1
-        b       secondary_startup
-ENDPROC(brcmstb_secondary_startup)
diff --git a/arch/arm/mach-bcm/platsmp-brcmstb.c b/arch/arm/mach-bcm/platsmp-brcmstb.c
deleted file mode 100644
index af780e9c23a6..000000000000
--- a/arch/arm/mach-bcm/platsmp-brcmstb.c
+++ /dev/null
@@ -1,363 +0,0 @@
-/*
- * Broadcom STB CPU SMP and hotplug support for ARM
- *
- * Copyright (C) 2013-2014 Broadcom Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation version 2.
- *
- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
- * kind, whether express or implied; without even the implied warranty
- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/delay.h>
-#include <linux/errno.h>
-#include <linux/init.h>
-#include <linux/io.h>
-#include <linux/of_address.h>
-#include <linux/of_platform.h>
-#include <linux/printk.h>
-#include <linux/regmap.h>
-#include <linux/smp.h>
-#include <linux/mfd/syscon.h>
-#include <linux/spinlock.h>
-
-#include <asm/cacheflush.h>
-#include <asm/cp15.h>
-#include <asm/mach-types.h>
-#include <asm/smp_plat.h>
-
-#include "brcmstb.h"
-
-enum {
-        ZONE_MAN_CLKEN_MASK             = BIT(0),
-        ZONE_MAN_RESET_CNTL_MASK        = BIT(1),
-        ZONE_MAN_MEM_PWR_MASK           = BIT(4),
-        ZONE_RESERVED_1_MASK            = BIT(5),
-        ZONE_MAN_ISO_CNTL_MASK          = BIT(6),
-        ZONE_MANUAL_CONTROL_MASK        = BIT(7),
-        ZONE_PWR_DN_REQ_MASK            = BIT(9),
-        ZONE_PWR_UP_REQ_MASK            = BIT(10),
-        ZONE_BLK_RST_ASSERT_MASK        = BIT(12),
-        ZONE_PWR_OFF_STATE_MASK         = BIT(25),
-        ZONE_PWR_ON_STATE_MASK          = BIT(26),
-        ZONE_DPG_PWR_STATE_MASK         = BIT(28),
-        ZONE_MEM_PWR_STATE_MASK         = BIT(29),
-        ZONE_RESET_STATE_MASK           = BIT(31),
-        CPU0_PWR_ZONE_CTRL_REG          = 1,
-        CPU_RESET_CONFIG_REG            = 2,
-};
-
-static void __iomem *cpubiuctrl_block;
-static void __iomem *hif_cont_block;
-static u32 cpu0_pwr_zone_ctrl_reg;
-static u32 cpu_rst_cfg_reg;
-static u32 hif_cont_reg;
-
-#ifdef CONFIG_HOTPLUG_CPU
-static DEFINE_PER_CPU_ALIGNED(int, per_cpu_sw_state);
-
-static int per_cpu_sw_state_rd(u32 cpu)
-{
-        sync_cache_r(SHIFT_PERCPU_PTR(&per_cpu_sw_state, per_cpu_offset(cpu)));
-        return per_cpu(per_cpu_sw_state, cpu);
-}
-
-static void per_cpu_sw_state_wr(u32 cpu, int val)
-{
-        per_cpu(per_cpu_sw_state, cpu) = val;
-        dmb();
-        sync_cache_w(SHIFT_PERCPU_PTR(&per_cpu_sw_state, per_cpu_offset(cpu)));
-        dsb_sev();
-}
-#else
-static inline void per_cpu_sw_state_wr(u32 cpu, int val) { }
-#endif
-
-static void __iomem *pwr_ctrl_get_base(u32 cpu)
-{
-        void __iomem *base = cpubiuctrl_block + cpu0_pwr_zone_ctrl_reg;
-        base += (cpu_logical_map(cpu) * 4);
-        return base;
-}
-
-static u32 pwr_ctrl_rd(u32 cpu)
-{
-        void __iomem *base = pwr_ctrl_get_base(cpu);
-        return readl_relaxed(base);
-}
-
-static void pwr_ctrl_wr(u32 cpu, u32 val)
-{
-        void __iomem *base = pwr_ctrl_get_base(cpu);
-        writel(val, base);
-}
-
-static void cpu_rst_cfg_set(u32 cpu, int set)
-{
-        u32 val;
-        val = readl_relaxed(cpubiuctrl_block + cpu_rst_cfg_reg);
-        if (set)
-                val |= BIT(cpu_logical_map(cpu));
-        else
-                val &= ~BIT(cpu_logical_map(cpu));
-        writel_relaxed(val, cpubiuctrl_block + cpu_rst_cfg_reg);
-}
-
-static void cpu_set_boot_addr(u32 cpu, unsigned long boot_addr)
-{
-        const int reg_ofs = cpu_logical_map(cpu) * 8;
-        writel_relaxed(0, hif_cont_block + hif_cont_reg + reg_ofs);
-        writel_relaxed(boot_addr, hif_cont_block + hif_cont_reg + 4 + reg_ofs);
-}
-
-static void brcmstb_cpu_boot(u32 cpu)
-{
-        pr_info("SMP: Booting CPU%d...\n", cpu);
-
-        /*
-         * set the reset vector to point to the secondary_startup
-         * routine
-         */
-        cpu_set_boot_addr(cpu, virt_to_phys(brcmstb_secondary_startup));
-
-        /* unhalt the cpu */
-        cpu_rst_cfg_set(cpu, 0);
-}
-
-static void brcmstb_cpu_power_on(u32 cpu)
-{
-        /*
-         * The secondary cores power was cut, so we must go through
-         * power-on initialization.
-         */
-        u32 tmp;
-
-        pr_info("SMP: Powering up CPU%d...\n", cpu);
-
-        /* Request zone power up */
-        pwr_ctrl_wr(cpu, ZONE_PWR_UP_REQ_MASK);
-
-        /* Wait for the power up FSM to complete */
-        do {
-                tmp = pwr_ctrl_rd(cpu);
-        } while (!(tmp & ZONE_PWR_ON_STATE_MASK));
-
-        per_cpu_sw_state_wr(cpu, 1);
-}
-
-static int brcmstb_cpu_get_power_state(u32 cpu)
-{
-        int tmp = pwr_ctrl_rd(cpu);
-        return (tmp & ZONE_RESET_STATE_MASK) ? 0 : 1;
-}
-
-#ifdef CONFIG_HOTPLUG_CPU
-
-static void brcmstb_cpu_die(u32 cpu)
-{
-        v7_exit_coherency_flush(all);
-
-        /* Prevent all interrupts from reaching this CPU. */
-        arch_local_irq_disable();
-
-        /*
-         * Final full barrier to ensure everything before this instruction has
-         * quiesced.
-         */
-        isb();
-        dsb();
-
-        per_cpu_sw_state_wr(cpu, 0);
-
-        /* Sit and wait to die */
-        wfi();
-
-        /* We should never get here... */
-        panic("Spurious interrupt on CPU %d received!\n", cpu);
-}
-
-static int brcmstb_cpu_kill(u32 cpu)
-{
-        u32 tmp;
-
-        pr_info("SMP: Powering down CPU%d...\n", cpu);
-
-        while (per_cpu_sw_state_rd(cpu))
-                ;
-
-        /* Program zone reset */
-        pwr_ctrl_wr(cpu, ZONE_RESET_STATE_MASK | ZONE_BLK_RST_ASSERT_MASK |
-                              ZONE_PWR_DN_REQ_MASK);
-
-        /* Verify zone reset */
-        tmp = pwr_ctrl_rd(cpu);
-        if (!(tmp & ZONE_RESET_STATE_MASK))
-                pr_err("%s: Zone reset bit for CPU %d not asserted!\n",
-                        __func__, cpu);
-
-        /* Wait for power down */
-        do {
-                tmp = pwr_ctrl_rd(cpu);
-        } while (!(tmp & ZONE_PWR_OFF_STATE_MASK));
-
-        /* Settle-time from Broadcom-internal DVT reference code */
-        udelay(7);
-
-        /* Assert reset on the CPU */
-        cpu_rst_cfg_set(cpu, 1);
-
-        return 1;
-}
-
-#endif /* CONFIG_HOTPLUG_CPU */
-
-static int __init setup_hifcpubiuctrl_regs(struct device_node *np)
-{
-        int rc = 0;
-        char *name;
-        struct device_node *syscon_np = NULL;
-
-        name = "syscon-cpu";
-
-        syscon_np = of_parse_phandle(np, name, 0);
-        if (!syscon_np) {
-                pr_err("can't find phandle %s\n", name);
-                rc = -EINVAL;
-                goto cleanup;
-        }
-
-        cpubiuctrl_block = of_iomap(syscon_np, 0);
-        if (!cpubiuctrl_block) {
-                pr_err("iomap failed for cpubiuctrl_block\n");
-                rc = -EINVAL;
-                goto cleanup;
-        }
-
-        rc = of_property_read_u32_index(np, name, CPU0_PWR_ZONE_CTRL_REG,
-                                        &cpu0_pwr_zone_ctrl_reg);
-        if (rc) {
-                pr_err("failed to read 1st entry from %s property (%d)\n", name,
-                        rc);
-                rc = -EINVAL;
-                goto cleanup;
-        }
-
-        rc = of_property_read_u32_index(np, name, CPU_RESET_CONFIG_REG,
-                                        &cpu_rst_cfg_reg);
-        if (rc) {
-                pr_err("failed to read 2nd entry from %s property (%d)\n", name,
-                        rc);
-                rc = -EINVAL;
-                goto cleanup;
-        }
-
-cleanup:
-        if (syscon_np)
-                of_node_put(syscon_np);
-
-        return rc;
-}
-
-static int __init setup_hifcont_regs(struct device_node *np)
-{
-        int rc = 0;
-        char *name;
-        struct device_node *syscon_np = NULL;
-
-        name = "syscon-cont";
-
-        syscon_np = of_parse_phandle(np, name, 0);
-        if (!syscon_np) {
-                pr_err("can't find phandle %s\n", name);
-                rc = -EINVAL;
-                goto cleanup;
-        }
-
-        hif_cont_block = of_iomap(syscon_np, 0);
-        if (!hif_cont_block) {
-                pr_err("iomap failed for hif_cont_block\n");
-                rc = -EINVAL;
-                goto cleanup;
-        }
-
-        /* offset is at top of hif_cont_block */
-        hif_cont_reg = 0;
-
-cleanup:
-        if (syscon_np)
-                of_node_put(syscon_np);
-
-        return rc;
-}
-
-static void __init brcmstb_cpu_ctrl_setup(unsigned int max_cpus)
-{
-        int rc;
-        struct device_node *np;
-        char *name;
-
-        name = "brcm,brcmstb-smpboot";
-        np = of_find_compatible_node(NULL, NULL, name);
-        if (!np) {
-                pr_err("can't find compatible node %s\n", name);
-                return;
-        }
-
-        rc = setup_hifcpubiuctrl_regs(np);
-        if (rc)
-                return;
-
-        rc = setup_hifcont_regs(np);
-        if (rc)
-                return;
-}
-
-static DEFINE_SPINLOCK(boot_lock);
-
-static void brcmstb_secondary_init(unsigned int cpu)
-{
-        /*
-         * Synchronise with the boot thread.
-         */
-        spin_lock(&boot_lock);
-        spin_unlock(&boot_lock);
-}
-
-static int brcmstb_boot_secondary(unsigned int cpu, struct task_struct *idle)
-{
-        /*
-         * set synchronisation state between this boot processor
-         * and the secondary one
-         */
-        spin_lock(&boot_lock);
-
-        /* Bring up power to the core if necessary */
-        if (brcmstb_cpu_get_power_state(cpu) == 0)
-                brcmstb_cpu_power_on(cpu);
-
-        brcmstb_cpu_boot(cpu);
-
-        /*
-         * now the secondary core is starting up let it run its
-         * calibrations, then wait for it to finish
-         */
-        spin_unlock(&boot_lock);
-
-        return 0;
-}
-
-static struct smp_operations brcmstb_smp_ops __initdata = {
-        .smp_prepare_cpus       = brcmstb_cpu_ctrl_setup,
-        .smp_secondary_init     = brcmstb_secondary_init,
-        .smp_boot_secondary     = brcmstb_boot_secondary,
-#ifdef CONFIG_HOTPLUG_CPU
-        .cpu_kill               = brcmstb_cpu_kill,
-        .cpu_die                = brcmstb_cpu_die,
-#endif
-};
-
-CPU_METHOD_OF_DECLARE(brcmstb_smp, "brcm,brahma-b15", &brcmstb_smp_ops);
diff --git a/arch/arm/mach-exynos/mcpm-exynos.c b/arch/arm/mach-exynos/mcpm-exynos.c
index b2f8b60cf0e9..dc9a764a7c37 100644
--- a/arch/arm/mach-exynos/mcpm-exynos.c
+++ b/arch/arm/mach-exynos/mcpm-exynos.c
@@ -43,7 +43,6 @@
         "mcr    p15, 0, r0, c1, c0, 0   @ set SCTLR\n\t" \
         "isb\n\t"\
         "bl     v7_flush_dcache_"__stringify(level)"\n\t" \
-        "clrex\n\t"\
         "mrc    p15, 0, r0, c1, c0, 1   @ get ACTLR\n\t" \
         "bic    r0, r0, #(1 << 6)       @ disable local coherency\n\t" \
         /* Dummy Load of a device register to avoid Erratum 799270 */ \
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 9de84a215abd..be9a51afe05a 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -85,7 +85,6 @@ config SOC_IMX25
 
 config SOC_IMX27
         bool
-        select ARCH_HAS_OPP
         select CPU_ARM926T
         select IMX_HAVE_IOMUX_V1
         select MXC_AVIC
@@ -659,7 +658,6 @@ comment "Device tree only"
 
 config SOC_IMX5
         bool
-        select ARCH_HAS_OPP
         select HAVE_IMX_SRC
         select MXC_TZIC
 
diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index ac88599ca080..23c02932bf84 100644
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -93,9 +93,11 @@ obj-$(CONFIG_HAVE_IMX_ANATOP) += anatop.o
 obj-$(CONFIG_HAVE_IMX_GPC) += gpc.o
 obj-$(CONFIG_HAVE_IMX_MMDC) += mmdc.o
 obj-$(CONFIG_HAVE_IMX_SRC) += src.o
+ifdef CONFIG_SOC_IMX6
 AFLAGS_headsmp.o :=-Wa,-march=armv7-a
 obj-$(CONFIG_SMP) += headsmp.o platsmp.o
 obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o
+endif
 obj-$(CONFIG_SOC_IMX6Q) += clk-imx6q.o mach-imx6q.o
 obj-$(CONFIG_SOC_IMX6SL) += clk-imx6sl.o mach-imx6sl.o
 obj-$(CONFIG_SOC_IMX6SX) += clk-imx6sx.o mach-imx6sx.o
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 6cceb7765c14..29d412975aff 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -194,6 +194,10 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
         clk[IMX6QDL_CLK_PLL3_80M]  = imx_clk_fixed_factor("pll3_80m",  "pll3_usb_otg",   1, 6);
         clk[IMX6QDL_CLK_PLL3_60M]  = imx_clk_fixed_factor("pll3_60m",  "pll3_usb_otg",   1, 8);
         clk[IMX6QDL_CLK_TWD]       = imx_clk_fixed_factor("twd",       "arm",            1, 2);
+        if (cpu_is_imx6dl()) {
+                clk[IMX6QDL_CLK_GPU2D_AXI] = imx_clk_fixed_factor("gpu2d_axi", "mmdc_ch0_axi_podf", 1, 1);
+                clk[IMX6QDL_CLK_GPU3D_AXI] = imx_clk_fixed_factor("gpu3d_axi", "mmdc_ch0_axi_podf", 1, 1);
+        }
 
         clk[IMX6QDL_CLK_PLL4_POST_DIV] = clk_register_divider_table(NULL, "pll4_post_div", "pll4_audio", CLK_SET_RATE_PARENT, base + 0x70, 19, 2, 0, post_div_table, &imx_ccm_lock);
         clk[IMX6QDL_CLK_PLL4_AUDIO_DIV] = clk_register_divider(NULL, "pll4_audio_div", "pll4_post_div", CLK_SET_RATE_PARENT, base + 0x170, 15, 1, 0, &imx_ccm_lock);
@@ -217,8 +221,10 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
         clk[IMX6QDL_CLK_ESAI_SEL]         = imx_clk_mux("esai_sel",         base + 0x20, 19, 2, audio_sels,        ARRAY_SIZE(audio_sels));
         clk[IMX6QDL_CLK_ASRC_SEL]         = imx_clk_mux("asrc_sel",         base + 0x30, 7,  2, audio_sels,        ARRAY_SIZE(audio_sels));
         clk[IMX6QDL_CLK_SPDIF_SEL]        = imx_clk_mux("spdif_sel",        base + 0x30, 20, 2, audio_sels,        ARRAY_SIZE(audio_sels));
-        clk[IMX6QDL_CLK_GPU2D_AXI]        = imx_clk_mux("gpu2d_axi",        base + 0x18, 0,  1, gpu_axi_sels,      ARRAY_SIZE(gpu_axi_sels));
-        clk[IMX6QDL_CLK_GPU3D_AXI]        = imx_clk_mux("gpu3d_axi",        base + 0x18, 1,  1, gpu_axi_sels,      ARRAY_SIZE(gpu_axi_sels));
+        if (cpu_is_imx6q()) {
+                clk[IMX6QDL_CLK_GPU2D_AXI]        = imx_clk_mux("gpu2d_axi",        base + 0x18, 0,  1, gpu_axi_sels,      ARRAY_SIZE(gpu_axi_sels));
+                clk[IMX6QDL_CLK_GPU3D_AXI]        = imx_clk_mux("gpu3d_axi",        base + 0x18, 1,  1, gpu_axi_sels,      ARRAY_SIZE(gpu_axi_sels));
+        }
         clk[IMX6QDL_CLK_GPU2D_CORE_SEL]   = imx_clk_mux("gpu2d_core_sel",   base + 0x18, 16, 2, gpu2d_core_sels,   ARRAY_SIZE(gpu2d_core_sels));
         clk[IMX6QDL_CLK_GPU3D_CORE_SEL]   = imx_clk_mux("gpu3d_core_sel",   base + 0x18, 4,  2, gpu3d_core_sels,   ARRAY_SIZE(gpu3d_core_sels));
         clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8,  2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
index 74b50f1982db..ca4ea2daf25b 100644
--- a/arch/arm/mach-imx/suspend-imx6.S
+++ b/arch/arm/mach-imx/suspend-imx6.S
@@ -173,6 +173,8 @@ ENTRY(imx6_suspend)
         ldr     r6, [r11, #0x0]
         ldr     r11, [r0, #PM_INFO_MX6Q_GPC_V_OFFSET]
         ldr     r6, [r11, #0x0]
+        ldr     r11, [r0, #PM_INFO_MX6Q_IOMUXC_V_OFFSET]
+        ldr     r6, [r11, #0x0]
 
         /* use r11 to store the IO address */
         ldr     r11, [r0, #PM_INFO_MX6Q_SRC_V_OFFSET]
diff --git a/arch/arm/mach-omap2/board-flash.c b/arch/arm/mach-omap2/board-flash.c
index e87f2a83d6bf..2d245c2e641c 100644
--- a/arch/arm/mach-omap2/board-flash.c
+++ b/arch/arm/mach-omap2/board-flash.c
@@ -142,7 +142,7 @@ __init board_nand_init(struct mtd_partition *nand_parts, u8 nr_parts, u8 cs,
         board_nand_data.nr_parts        = nr_parts;
         board_nand_data.devsize         = nand_type;
 
-        board_nand_data.ecc_opt = OMAP_ECC_HAM1_CODE_HW;
+        board_nand_data.ecc_opt = OMAP_ECC_HAM1_CODE_SW;
         gpmc_nand_init(&board_nand_data, gpmc_t);
 }
 #endif /* CONFIG_MTD_NAND_OMAP2 || CONFIG_MTD_NAND_OMAP2_MODULE */
diff --git a/arch/arm/mach-omap2/gpmc-nand.c b/arch/arm/mach-omap2/gpmc-nand.c
index 8897ad7035fd..cb7764314f17 100644
--- a/arch/arm/mach-omap2/gpmc-nand.c
+++ b/arch/arm/mach-omap2/gpmc-nand.c
@@ -49,7 +49,8 @@ static bool gpmc_hwecc_bch_capable(enum omap_ecc ecc_opt)
                 return 0;
 
         /* legacy platforms support only HAM1 (1-bit Hamming) ECC scheme */
-        if (ecc_opt == OMAP_ECC_HAM1_CODE_HW)
+        if (ecc_opt == OMAP_ECC_HAM1_CODE_HW ||
+            ecc_opt == OMAP_ECC_HAM1_CODE_SW)
                 return 1;
         else
                 return 0;
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index 8bc13380f0a0..2f97228f188a 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -1207,8 +1207,7 @@ int gpmc_cs_program_settings(int cs, struct gpmc_settings *p)
                 }
         }
 
-        if ((p->wait_on_read || p->wait_on_write) &&
-            (p->wait_pin > gpmc_nr_waitpins)) {
+        if (p->wait_pin > gpmc_nr_waitpins) {
                 pr_err("%s: invalid wait-pin (%d)\n", __func__, p->wait_pin);
                 return -EINVAL;
         }
@@ -1288,8 +1287,8 @@ void gpmc_read_settings_dt(struct device_node *np, struct gpmc_settings *p)
                 p->wait_on_write = of_property_read_bool(np,
                                                          "gpmc,wait-on-write");
                 if (!p->wait_on_read && !p->wait_on_write)
-                        pr_warn("%s: read/write wait monitoring not enabled!\n",
-                                __func__);
+                        pr_debug("%s: rd/wr wait monitoring not enabled!\n",
+                                 __func__);
         }
 }
 
@@ -1403,8 +1402,11 @@ static int gpmc_probe_nand_child(struct platform_device *pdev,
                 pr_err("%s: ti,nand-ecc-opt not found\n", __func__);
                 return -ENODEV;
         }
-        if (!strcmp(s, "ham1") || !strcmp(s, "sw") ||
-                !strcmp(s, "hw") || !strcmp(s, "hw-romcode"))
+
+        if (!strcmp(s, "sw"))
+                gpmc_nand_data->ecc_opt = OMAP_ECC_HAM1_CODE_SW;
+        else if (!strcmp(s, "ham1") ||
+                 !strcmp(s, "hw") || !strcmp(s, "hw-romcode"))
                 gpmc_nand_data->ecc_opt =
                                 OMAP_ECC_HAM1_CODE_HW;
         else if (!strcmp(s, "bch4"))
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index d42022f2a71e..53841dea80ea 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -663,7 +663,7 @@ void __init dra7xxx_check_revision(void)
 
         default:
                 /* Unknown default to latest silicon rev as default*/
-                pr_warn("%s: unknown idcode=0x%08x (hawkeye=0x%08x,rev=0x%d)\n",
+                pr_warn("%s: unknown idcode=0x%08x (hawkeye=0x%08x,rev=0x%x)\n",
                         __func__, idcode, hawkeye, rev);
                 omap_revision = DRA752_REV_ES1_1;
         }
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index 01ef59def44b..d22c30d3ccfa 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -56,7 +56,7 @@ static void _add_clkdev(struct omap_device *od, const char *clk_alias,
 
         r = clk_get_sys(dev_name(&od->pdev->dev), clk_alias);
         if (!IS_ERR(r)) {
-                dev_warn(&od->pdev->dev,
+                dev_dbg(&od->pdev->dev,
                          "alias %s already exists\n", clk_alias);
                 clk_put(r);
                 return;
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 6c074f37cdd2..8fd87a3055bf 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2185,6 +2185,8 @@ static int _enable(struct omap_hwmod *oh)
                          oh->mux->pads_dynamic))) {
                 omap_hwmod_mux(oh->mux, _HWMOD_STATE_ENABLED);
                 _reconfigure_io_chain();
+        } else if (oh->flags & HWMOD_FORCE_MSTANDBY) {
+                _reconfigure_io_chain();
         }
 
         _add_initiator_dep(oh, mpu_oh);
@@ -2291,6 +2293,8 @@ static int _idle(struct omap_hwmod *oh)
         if (oh->mux && oh->mux->pads_dynamic) {
                 omap_hwmod_mux(oh->mux, _HWMOD_STATE_IDLE);
                 _reconfigure_io_chain();
+        } else if (oh->flags & HWMOD_FORCE_MSTANDBY) {
+                _reconfigure_io_chain();
         }
 
         oh->_state = _HWMOD_STATE_IDLE;
@@ -3345,6 +3349,9 @@ int __init omap_hwmod_register_links(struct omap_hwmod_ocp_if **ois)
         if (!ois)
                 return 0;
 
+        if (ois[0] == NULL) /* Empty list */
+                return 0;
+
         if (!linkspace) {
                 if (_alloc_linkspace(ois)) {
                         pr_err("omap_hwmod: could not allocate link space\n");
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index 2757abf87fbc..5684f112654b 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -35,6 +35,7 @@
 #include "i2c.h"
 #include "mmc.h"
 #include "wd_timer.h"
+#include "soc.h"
 
 /* Base offset for all DRA7XX interrupts external to MPUSS */
 #define DRA7XX_IRQ_GIC_START    32
@@ -3261,7 +3262,6 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = {
         &dra7xx_l4_per3__usb_otg_ss1,
         &dra7xx_l4_per3__usb_otg_ss2,
         &dra7xx_l4_per3__usb_otg_ss3,
-        &dra7xx_l4_per3__usb_otg_ss4,
         &dra7xx_l3_main_1__vcp1,
         &dra7xx_l4_per2__vcp1,
         &dra7xx_l3_main_1__vcp2,
@@ -3270,8 +3270,26 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = {
         NULL,
 };
 
+static struct omap_hwmod_ocp_if *dra74x_hwmod_ocp_ifs[] __initdata = {
+        &dra7xx_l4_per3__usb_otg_ss4,
+        NULL,
+};
+
+static struct omap_hwmod_ocp_if *dra72x_hwmod_ocp_ifs[] __initdata = {
+        NULL,
+};
+
 int __init dra7xx_hwmod_init(void)
 {
+        int ret;
+
         omap_hwmod_init();
-        return omap_hwmod_register_links(dra7xx_hwmod_ocp_ifs);
+        ret = omap_hwmod_register_links(dra7xx_hwmod_ocp_ifs);
+
+        if (!ret && soc_is_dra74x())
+                return omap_hwmod_register_links(dra74x_hwmod_ocp_ifs);
+        else if (!ret && soc_is_dra72x())
+                return omap_hwmod_register_links(dra72x_hwmod_ocp_ifs);
+
+        return ret;
 }
diff --git a/arch/arm/mach-omap2/soc.h b/arch/arm/mach-omap2/soc.h
index 01ca8086fb6c..4376f59626d1 100644
--- a/arch/arm/mach-omap2/soc.h
+++ b/arch/arm/mach-omap2/soc.h
@@ -245,6 +245,8 @@ IS_AM_SUBCLASS(437x, 0x437)
 #define soc_is_omap54xx()               0
 #define soc_is_omap543x()               0
 #define soc_is_dra7xx()                 0
+#define soc_is_dra74x()                 0
+#define soc_is_dra72x()                 0
 
 #if defined(MULTI_OMAP2)
 # if defined(CONFIG_ARCH_OMAP2)
@@ -393,7 +395,11 @@ IS_OMAP_TYPE(3430, 0x3430)
 
 #if defined(CONFIG_SOC_DRA7XX)
 #undef soc_is_dra7xx
+#undef soc_is_dra74x
+#undef soc_is_dra72x
 #define soc_is_dra7xx() (of_machine_is_compatible("ti,dra7"))
+#define soc_is_dra74x() (of_machine_is_compatible("ti,dra74"))
+#define soc_is_dra72x() (of_machine_is_compatible("ti,dra72"))
 #endif
 
 /* Various silicon revisions for omap2 */
diff --git a/arch/arm/mach-shmobile/Kconfig b/arch/arm/mach-shmobile/Kconfig
index e15dff790dbb..1e6c51c7c2d5 100644
--- a/arch/arm/mach-shmobile/Kconfig
+++ b/arch/arm/mach-shmobile/Kconfig
@@ -75,6 +75,7 @@ config ARCH_SH7372
         select ARM_CPU_SUSPEND if PM || CPU_IDLE
         select CPU_V7
         select SH_CLK_CPG
+        select SH_INTC
         select SYS_SUPPORTS_SH_CMT
         select SYS_SUPPORTS_SH_TMU
 
@@ -85,6 +86,7 @@ config ARCH_SH73A0
         select CPU_V7
         select I2C
         select SH_CLK_CPG
+        select SH_INTC
         select RENESAS_INTC_IRQPIN
         select SYS_SUPPORTS_SH_CMT
         select SYS_SUPPORTS_SH_TMU
diff --git a/arch/arm/mach-shmobile/clock-r8a7790.c b/arch/arm/mach-shmobile/clock-r8a7790.c
index 17435c1aa2fe..126ddafad526 100644
--- a/arch/arm/mach-shmobile/clock-r8a7790.c
+++ b/arch/arm/mach-shmobile/clock-r8a7790.c
@@ -183,8 +183,8 @@ enum {
 
 static struct clk div4_clks[DIV4_NR] = {
         [DIV4_SDH] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 8, 0x0dff, CLK_ENABLE_ON_INIT),
-        [DIV4_SD0] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 4, 0x1de0, CLK_ENABLE_ON_INIT),
-        [DIV4_SD1] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 0, 0x1de0, CLK_ENABLE_ON_INIT),
+        [DIV4_SD0] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 4, 0x1df0, CLK_ENABLE_ON_INIT),
+        [DIV4_SD1] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 0, 0x1df0, CLK_ENABLE_ON_INIT),
 };
 
 /* DIV6 clocks */
diff --git a/arch/arm/mach-shmobile/clock-r8a7791.c b/arch/arm/mach-shmobile/clock-r8a7791.c
index 10e193d707f5..453b23129cfa 100644
--- a/arch/arm/mach-shmobile/clock-r8a7791.c
+++ b/arch/arm/mach-shmobile/clock-r8a7791.c
@@ -152,7 +152,7 @@ enum {
 
 static struct clk div4_clks[DIV4_NR] = {
         [DIV4_SDH] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 8, 0x0dff, CLK_ENABLE_ON_INIT),
-        [DIV4_SD0] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 4, 0x1de0, CLK_ENABLE_ON_INIT),
+        [DIV4_SD0] = SH_CLK_DIV4(&pll1_clk, SDCKCR, 4, 0x1df0, CLK_ENABLE_ON_INIT),
 };
 
 /* DIV6 clocks */
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index d8c4048b9e33..02a6f45a0b9e 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -644,7 +644,7 @@ static struct clk_lookup lookups[] = {
         CLKDEV_DEV_ID("sh-sci.5", &mstp_clks[MSTP207]), /* SCIFA5 */
         CLKDEV_DEV_ID("e6cb0000.serial", &mstp_clks[MSTP207]), /* SCIFA5 */
         CLKDEV_DEV_ID("sh-sci.8", &mstp_clks[MSTP206]), /* SCIFB */
-        CLKDEV_DEV_ID("0xe6c3000.serial", &mstp_clks[MSTP206]), /* SCIFB */
+        CLKDEV_DEV_ID("e6c3000.serial", &mstp_clks[MSTP206]), /* SCIFB */
         CLKDEV_DEV_ID("sh-sci.0", &mstp_clks[MSTP204]), /* SCIFA0 */
         CLKDEV_DEV_ID("e6c40000.serial", &mstp_clks[MSTP204]), /* SCIFA0 */
         CLKDEV_DEV_ID("sh-sci.1", &mstp_clks[MSTP203]), /* SCIFA1 */
diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
index 2c2754e79cb3..f61158c6ce71 100644
--- a/arch/arm/mach-vexpress/spc.c
+++ b/arch/arm/mach-vexpress/spc.c
@@ -426,9 +426,15 @@ static int ve_spc_populate_opps(uint32_t cluster)
 
 static int ve_init_opp_table(struct device *cpu_dev)
 {
-        int cluster = topology_physical_package_id(cpu_dev->id);
-        int idx, ret = 0, max_opp = info->num_opps[cluster];
-        struct ve_spc_opp *opps = info->opps[cluster];
+        int cluster;
+        int idx, ret = 0, max_opp;
+        struct ve_spc_opp *opps;
+
+        cluster = topology_physical_package_id(cpu_dev->id);
+        cluster = cluster < 0 ? 0 : cluster;
+
+        max_opp = info->num_opps[cluster];
+        opps = info->opps[cluster];
 
         for (idx = 0; idx < max_opp; idx++, opps++) {
                 ret = dev_pm_opp_add(cpu_dev, opps->freq * 1000, opps->u_volt);
@@ -537,6 +543,8 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev)
         spc->hw.init = &init;
         spc->cluster = topology_physical_package_id(cpu_dev->id);
 
+        spc->cluster = spc->cluster < 0 ? 0 : spc->cluster;
+
         init.name = dev_name(cpu_dev);
         init.ops = &clk_spc_ops;
         init.flags = CLK_IS_ROOT | CLK_GET_RATE_NOCACHE;
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index 3815a8262af0..8c48c5c22a33 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -17,12 +17,6 @@
  */
         .align  5
 ENTRY(v6_early_abort)
-#ifdef CONFIG_CPU_V6
-        sub     r1, sp, #4                      @ Get unused stack location
-        strex   r0, r1, [r1]                    @ Clear the exclusive monitor
-#elif defined(CONFIG_CPU_32v6K)
-        clrex
-#endif
         mrc     p15, 0, r1, c5, c0, 0           @ get FSR
         mrc     p15, 0, r0, c6, c0, 0           @ get FAR
 /*
diff --git a/arch/arm/mm/abort-ev7.S b/arch/arm/mm/abort-ev7.S
index 703375277ba6..4812ad054214 100644
--- a/arch/arm/mm/abort-ev7.S
+++ b/arch/arm/mm/abort-ev7.S
@@ -13,12 +13,6 @@
  */
         .align  5
 ENTRY(v7_early_abort)
-        /*
-         * The effect of data aborts on on the exclusive access monitor are
-         * UNPREDICTABLE. Do a CLREX to clear the state
-         */
-        clrex
-
         mrc     p15, 0, r1, c5, c0, 0           @ get FSR
         mrc     p15, 0, r0, c6, c0, 0           @ get FAR
 
diff --git a/arch/arm64/crypto/sha2-ce-glue.c b/arch/arm64/crypto/sha2-ce-glue.c
index c294e67d3925..ae67e88c28b9 100644
--- a/arch/arm64/crypto/sha2-ce-glue.c
+++ b/arch/arm64/crypto/sha2-ce-glue.c
@@ -150,7 +150,6 @@ static void sha2_finup(struct shash_desc *desc, const u8 *data,
         kernel_neon_begin_partial(28);
         sha2_ce_transform(blocks, data, sctx->state, NULL, len);
         kernel_neon_end();
-        data += blocks * SHA256_BLOCK_SIZE;
 }
 
 static int sha224_finup(struct shash_desc *desc, const u8 *data,
diff --git a/arch/arm64/include/asm/hw_breakpoint.h b/arch/arm64/include/asm/hw_breakpoint.h
index d064047612b1..52b484b6aa1a 100644
--- a/arch/arm64/include/asm/hw_breakpoint.h
+++ b/arch/arm64/include/asm/hw_breakpoint.h
@@ -79,7 +79,6 @@ static inline void decode_ctrl_reg(u32 reg,
  */
 #define ARM_MAX_BRP             16
 #define ARM_MAX_WRP             16
-#define ARM_MAX_HBP_SLOTS       (ARM_MAX_BRP + ARM_MAX_WRP)
 
 /* Virtual debug register bases. */
 #define AARCH64_DBG_REG_BVR     0
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 3df21feeabdd..286b1bec547c 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -139,7 +139,7 @@ extern struct task_struct *cpu_switch_to(struct task_struct *prev,
         ((struct pt_regs *)(THREAD_START_SP + task_stack_page(p)) - 1)
 
 #define KSTK_EIP(tsk)   ((unsigned long)task_pt_regs(tsk)->pc)
-#define KSTK_ESP(tsk)   ((unsigned long)task_pt_regs(tsk)->sp)
+#define KSTK_ESP(tsk)   user_stack_pointer(task_pt_regs(tsk))
 
 /*
  * Prefetching support
diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
index 501000fadb6f..41ed9e13795e 100644
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -137,7 +137,7 @@ struct pt_regs {
         (!((regs)->pstate & PSR_F_BIT))
 
 #define user_stack_pointer(regs) \
-        (!compat_user_mode(regs)) ? ((regs)->sp) : ((regs)->compat_sp)
+        (!compat_user_mode(regs) ? (regs)->sp : (regs)->compat_sp)
 
 static inline unsigned long regs_return_value(struct pt_regs *regs)
 {
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 24f0c6fb61d8..03aaa99e1ea0 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -465,6 +465,8 @@ static int __init arm64_enter_virtual_mode(void)
         efi_native_runtime_setup();
         set_bit(EFI_RUNTIME_SERVICES, &efi.flags);
 
+        efi.runtime_version = efi.systab->hdr.revision;
+
         return 0;
 
 err_unmap:
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index ad8aebb1cdef..3dca15634e69 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -270,6 +270,7 @@ static int fpsimd_cpu_pm_notifier(struct notifier_block *self,
         case CPU_PM_ENTER:
                 if (current->mm && !test_thread_flag(TIF_FOREIGN_FPSTATE))
                         fpsimd_save_state(&current->thread.fpsimd_state);
+                this_cpu_write(fpsimd_last_state, NULL);
                 break;
         case CPU_PM_EXIT:
                 if (current->mm)
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index bed028364a93..873069056229 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -373,10 +373,6 @@ ENTRY(__boot_cpu_mode)
         .long   0
         .popsection
 
-        .align  3
-2:      .quad   .
-        .quad   PAGE_OFFSET
-
 #ifdef CONFIG_SMP
         .align  3
 1:      .quad   .
diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c
index 422ebd63b619..6762ad705587 100644
--- a/arch/arm64/kernel/perf_regs.c
+++ b/arch/arm64/kernel/perf_regs.c
@@ -24,6 +24,12 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
                         return regs->compat_lr;
         }
 
+        if ((u32)idx == PERF_REG_ARM64_SP)
+                return regs->sp;
+
+        if ((u32)idx == PERF_REG_ARM64_PC)
+                return regs->pc;
+
         return regs->regs[idx];
 }
 
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 70526cfda056..fe63ac5e9bf5 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -87,7 +87,8 @@ static void ptrace_hbptriggered(struct perf_event *bp,
                         break;
                 }
         }
-        for (i = ARM_MAX_BRP; i < ARM_MAX_HBP_SLOTS && !bp; ++i) {
+
+        for (i = 0; i < ARM_MAX_WRP; ++i) {
                 if (current->thread.debug.hbp_watch[i] == bp) {
                         info.si_errno = -((i << 1) + 1);
                         break;
@@ -662,8 +663,10 @@ static int compat_gpr_get(struct task_struct *target,
                         kbuf += sizeof(reg);
                 } else {
                         ret = copy_to_user(ubuf, &reg, sizeof(reg));
-                        if (ret)
+                        if (ret) {
+                                ret = -EFAULT;
                                 break;
+                        }
 
                         ubuf += sizeof(reg);
                 }
@@ -701,8 +704,10 @@ static int compat_gpr_set(struct task_struct *target,
                         kbuf += sizeof(reg);
                 } else {
                         ret = copy_from_user(&reg, ubuf, sizeof(reg));
-                        if (ret)
-                                return ret;
+                        if (ret) {
+                                ret = -EFAULT;
+                                break;
+                        }
 
                         ubuf += sizeof(reg);
                 }
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index f6f0ccf35ae6..edb146d01857 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -78,6 +78,7 @@ unsigned int compat_elf_hwcap2 __read_mostly;
 #endif
 
 static const char *cpu_name;
+static const char *machine_name;
 phys_addr_t __fdt_pointer __initdata;
 
 /*
@@ -309,6 +310,8 @@ static void __init setup_machine_fdt(phys_addr_t dt_phys)
                 while (true)
                         cpu_relax();
         }
+
+        machine_name = of_flat_dt_get_machine_name();
 }
 
 /*
@@ -447,21 +450,10 @@ static int c_show(struct seq_file *m, void *v)
 {
         int i;
 
-        /*
-         * Dump out the common processor features in a single line. Userspace
-         * should read the hwcaps with getauxval(AT_HWCAP) rather than
-         * attempting to parse this.
-         */
-        seq_puts(m, "features\t:");
-        for (i = 0; hwcap_str[i]; i++)
-                if (elf_hwcap & (1 << i))
-                        seq_printf(m, " %s", hwcap_str[i]);
-        seq_puts(m, "\n\n");
+        seq_printf(m, "Processor\t: %s rev %d (%s)\n",
+                   cpu_name, read_cpuid_id() & 15, ELF_PLATFORM);
 
         for_each_online_cpu(i) {
-                struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i);
-                u32 midr = cpuinfo->reg_midr;
-
                 /*
                  * glibc reads /proc/cpuinfo to determine the number of
                  * online processors, looking for lines beginning with
@@ -470,13 +462,25 @@ static int c_show(struct seq_file *m, void *v)
 #ifdef CONFIG_SMP
                 seq_printf(m, "processor\t: %d\n", i);
 #endif
-                seq_printf(m, "implementer\t: 0x%02x\n",
-                           MIDR_IMPLEMENTOR(midr));
-                seq_printf(m, "variant\t\t: 0x%x\n", MIDR_VARIANT(midr));
-                seq_printf(m, "partnum\t\t: 0x%03x\n", MIDR_PARTNUM(midr));
-                seq_printf(m, "revision\t: 0x%x\n\n", MIDR_REVISION(midr));
         }
 
+        /* dump out the processor features */
+        seq_puts(m, "Features\t: ");
+
+        for (i = 0; hwcap_str[i]; i++)
+                if (elf_hwcap & (1 << i))
+                        seq_printf(m, "%s ", hwcap_str[i]);
+
+        seq_printf(m, "\nCPU implementer\t: 0x%02x\n", read_cpuid_id() >> 24);
+        seq_printf(m, "CPU architecture: AArch64\n");
+        seq_printf(m, "CPU variant\t: 0x%x\n", (read_cpuid_id() >> 20) & 15);
+        seq_printf(m, "CPU part\t: 0x%03x\n", (read_cpuid_id() >> 4) & 0xfff);
+        seq_printf(m, "CPU revision\t: %d\n", read_cpuid_id() & 15);
+
+        seq_puts(m, "\n");
+
+        seq_printf(m, "Hardware\t: %s\n", machine_name);
+
         return 0;
 }
 
diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c
index e28be510380c..34b8bd0711e9 100644
--- a/arch/arm64/kvm/handle_exit.c
+++ b/arch/arm64/kvm/handle_exit.c
@@ -66,6 +66,8 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run)
         else
                 kvm_vcpu_block(vcpu);
 
+        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+
         return 1;
 }
 
diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S
index d968796f4b2d..c3191168a994 100644
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -80,6 +80,10 @@ __do_hyp_init:
         msr     mair_el2, x4
         isb
 
+        /* Invalidate the stale TLBs from Bootloader */
+        tlbi    alle2
+        dsb     sy
+
         mrs     x4, sctlr_el2
         and     x4, x4, #SCTLR_EL2_EE   // preserve endianness of EL2
         ldr     x5, =SCTLR_EL2_FLAGS
diff --git a/arch/hexagon/mm/cache.c b/arch/hexagon/mm/cache.c
index fe14ccf28561..0c76c802e31c 100644
--- a/arch/hexagon/mm/cache.c
+++ b/arch/hexagon/mm/cache.c
@@ -68,6 +68,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
         );
         local_irq_restore(flags);
 }
+EXPORT_SYMBOL(flush_icache_range);
 
 void hexagon_clean_dcache_range(unsigned long start, unsigned long end)
 {
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 64aefb76bd69..c84c88bbbbd7 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -549,8 +549,6 @@ source "drivers/sn/Kconfig"
 config KEXEC
         bool "kexec system call"
         depends on !IA64_HP_SIM && (!SMP || HOTPLUG_CPU)
-        select CRYPTO
-        select CRYPTO_SHA256
         help
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 3ff8c9a25335..87b7c7581b1d 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -91,8 +91,6 @@ config MMU_SUN3
 config KEXEC
         bool "kexec system call"
         depends on M68KCLASSIC
-        select CRYPTO
-        select CRYPTO_SHA256
         help
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 1fcdd344c7ad..4ef7a54813e6 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             352
+#define NR_syscalls             354
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 9cd82fbc7817..b419c6b7ac37 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -357,5 +357,7 @@
 #define __NR_sched_setattr      349
 #define __NR_sched_getattr      350
 #define __NR_renameat2          351
+#define __NR_getrandom          352
+#define __NR_memfd_create       353
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 501e10212789..05b46c2b08b8 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -372,4 +372,6 @@ ENTRY(sys_call_table)
         .long sys_sched_setattr
         .long sys_sched_getattr         /* 350 */
         .long sys_renameat2
+        .long sys_getrandom
+        .long sys_memfd_create
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index df51e78a72cc..900c7e5333b6 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2396,8 +2396,6 @@ source "kernel/Kconfig.preempt"
 
 config KEXEC
         bool "Kexec system call"
-        select CRYPTO
-        select CRYPTO_SHA256
         help
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/mips/alchemy/devboards/db1200.c b/arch/mips/alchemy/devboards/db1200.c
index 776188908dfc..8c13675a12e7 100644
--- a/arch/mips/alchemy/devboards/db1200.c
+++ b/arch/mips/alchemy/devboards/db1200.c
@@ -847,6 +847,7 @@ int __init db1200_dev_setup(void)
                         pr_warn("DB1200: cant get I2C close to 50MHz\n");
                 else
                         clk_set_rate(c, pfc);
+                clk_prepare_enable(c);
                 clk_put(c);
         }
 
@@ -922,11 +923,6 @@ int __init db1200_dev_setup(void)
         }
 
         /* Audio PSC clock is supplied externally. (FIXME: platdata!!) */
-        c = clk_get(NULL, "psc1_intclk");
-        if (!IS_ERR(c)) {
-                clk_prepare_enable(c);
-                clk_put(c);
-        }
         __raw_writel(PSC_SEL_CLK_SERCLK,
             (void __iomem *)KSEG1ADDR(AU1550_PSC1_PHYS_ADDR) + PSC_SEL_OFFSET);
         wmb();
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index 2b63e7e7d3d3..ad439c273003 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -59,12 +59,21 @@ static void bcm47xx_machine_restart(char *command)
         switch (bcm47xx_bus_type) {
 #ifdef CONFIG_BCM47XX_SSB
         case BCM47XX_BUS_TYPE_SSB:
-                ssb_watchdog_timer_set(&bcm47xx_bus.ssb, 3);
+                if (bcm47xx_bus.ssb.chip_id == 0x4785)
+                        write_c0_diag4(1 << 22);
+                ssb_watchdog_timer_set(&bcm47xx_bus.ssb, 1);
+                if (bcm47xx_bus.ssb.chip_id == 0x4785) {
+                        __asm__ __volatile__(
+                                ".set\tmips3\n\t"
+                                "sync\n\t"
+                                "wait\n\t"
+                                ".set\tmips0");
+                }
                 break;
 #endif
 #ifdef CONFIG_BCM47XX_BCMA
         case BCM47XX_BUS_TYPE_BCMA:
-                bcma_chipco_watchdog_timer_set(&bcm47xx_bus.bcma.bus.drv_cc, 3);
+                bcma_chipco_watchdog_timer_set(&bcm47xx_bus.bcma.bus.drv_cc, 1);
                 break;
 #endif
         }
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index 008e9c8b8eac..38f4c32e2816 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -263,7 +263,6 @@ static uint64_t crashk_size, crashk_base;
 static int octeon_uart;
 
 extern asmlinkage void handle_int(void);
-extern asmlinkage void plat_irq_dispatch(void);
 
 /**
  * Return non zero if we are currently running in the Octeon simulator
@@ -458,6 +457,18 @@ static void octeon_halt(void)
         octeon_kill_core(NULL);
 }
 
+static char __read_mostly octeon_system_type[80];
+
+static int __init init_octeon_system_type(void)
+{
+        snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
+                cvmx_board_type_to_string(octeon_bootinfo->board_type),
+                octeon_model_get_string(read_c0_prid()));
+
+        return 0;
+}
+early_initcall(init_octeon_system_type);
+
 /**
  * Return a string representing the system type
  *
@@ -465,11 +476,7 @@ static void octeon_halt(void)
  */
 const char *octeon_board_type_string(void)
 {
-        static char name[80];
-        sprintf(name, "%s (%s)",
-                cvmx_board_type_to_string(octeon_bootinfo->board_type),
-                octeon_model_get_string(read_c0_prid()));
-        return name;
+        return octeon_system_type;
 }
 
 const char *get_system_type(void)
diff --git a/arch/mips/include/asm/eva.h b/arch/mips/include/asm/eva.h
new file mode 100644
index 000000000000..a3d1807f227c
--- /dev/null
+++ b/arch/mips/include/asm/eva.h
@@ -0,0 +1,43 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2014, Imagination Technologies Ltd.
+ *
+ * EVA functions for generic code
+ */
+
+#ifndef _ASM_EVA_H
+#define _ASM_EVA_H
+
+#include <kernel-entry-init.h>
+
+#ifdef __ASSEMBLY__
+
+#ifdef CONFIG_EVA
+
+/*
+ * EVA early init code
+ *
+ * Platforms must define their own 'platform_eva_init' macro in
+ * their kernel-entry-init.h header. This macro usually does the
+ * platform specific configuration of the segmentation registers,
+ * and it is normally called from assembly code.
+ *
+ */
+
+.macro eva_init
+platform_eva_init
+.endm
+
+#else
+
+.macro eva_init
+.endm
+
+#endif /* CONFIG_EVA */
+
+#endif /* __ASSEMBLY__ */
+
+#endif
diff --git a/arch/mips/include/asm/gic.h b/arch/mips/include/asm/gic.h
index 3f20b2111d56..d7699cf7e135 100644
--- a/arch/mips/include/asm/gic.h
+++ b/arch/mips/include/asm/gic.h
@@ -49,7 +49,7 @@
 #endif
 #define GICBIS(reg, mask, bits)                 \
         do { u32 data;                          \
-                GICREAD((reg), data);           \
+                GICREAD(reg, data);             \
                 data &= ~(mask);                \
                 data |= ((bits) & (mask));      \
                 GICWRITE((reg), data);          \
diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index ae1f7b24dd1a..39f07aec640c 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -26,6 +26,8 @@ static inline int irq_canonicalize(int irq)
 #define irq_canonicalize(irq) (irq)     /* Sane hardware, sane code ... */
 #endif
 
+asmlinkage void plat_irq_dispatch(void);
+
 extern void do_IRQ(unsigned int irq);
 
 extern void arch_init_irq(void);
diff --git a/arch/mips/include/asm/mach-malta/kernel-entry-init.h b/arch/mips/include/asm/mach-malta/kernel-entry-init.h
index 77eeda77e73c..0cf8622db27f 100644
--- a/arch/mips/include/asm/mach-malta/kernel-entry-init.h
+++ b/arch/mips/include/asm/mach-malta/kernel-entry-init.h
@@ -10,14 +10,15 @@
 #ifndef __ASM_MACH_MIPS_KERNEL_ENTRY_INIT_H
 #define __ASM_MACH_MIPS_KERNEL_ENTRY_INIT_H
 
+#include <asm/regdef.h>
+#include <asm/mipsregs.h>
+
         /*
          * Prepare segments for EVA boot:
          *
          * This is in case the processor boots in legacy configuration
          * (SI_EVAReset is de-asserted and CONFIG5.K == 0)
          *
-         * On entry, t1 is loaded with CP0_CONFIG
-         *
          * ========================= Mappings =============================
          * Virtual memory           Physical memory           Mapping
          * 0x00000000 - 0x7fffffff  0x80000000 - 0xfffffffff   MUSUK (kuseg)
@@ -30,12 +31,20 @@
          *
          *
          * Lowmem is expanded to 2GB
+         *
+         * The following code uses the t0, t1, t2 and ra registers without
+         * previously preserving them.
+         *
          */
-        .macro  eva_entry
+        .macro  platform_eva_init
+
+        .set    push
+        .set    reorder
         /*
          * Get Config.K0 value and use it to program
          * the segmentation registers
          */
+        mfc0    t1, CP0_CONFIG
         andi    t1, 0x7 /* CCA */
         move    t2, t1
         ins     t2, t1, 16, 3
@@ -77,6 +86,8 @@
         mtc0    t0, $16, 5
         sync
         jal     mips_ihb
+
+        .set    pop
         .endm
 
         .macro  kernel_entry_setup
@@ -95,7 +106,7 @@
         sll     t0, t0, 6   /* SC bit */
         bgez    t0, 9f
 
-        eva_entry
+        platform_eva_init
         b       0f
 9:
         /* Assume we came from YAMON... */
@@ -127,8 +138,7 @@ nonsc_processor:
 #ifdef CONFIG_EVA
         sync
         ehb
-        mfc0    t1, CP0_CONFIG
-        eva_entry
+        platform_eva_init
 #endif
         .endm
 
diff --git a/arch/mips/include/asm/mach-netlogic/topology.h b/arch/mips/include/asm/mach-netlogic/topology.h
index ceeb1f5e7129..0eb43c832b25 100644
--- a/arch/mips/include/asm/mach-netlogic/topology.h
+++ b/arch/mips/include/asm/mach-netlogic/topology.h
@@ -10,13 +10,6 @@
 
 #include <asm/mach-netlogic/multi-node.h>
 
-#ifdef CONFIG_SMP
-#define topology_physical_package_id(cpu)       cpu_to_node(cpu)
-#define topology_core_id(cpu)   (cpu_logical_map(cpu) / NLM_THREADS_PER_CORE)
-#define topology_thread_cpumask(cpu)            (&cpu_sibling_map[cpu])
-#define topology_core_cpumask(cpu)      cpumask_of_node(cpu_to_node(cpu))
-#endif
-
 #include <asm-generic/topology.h>
 
 #endif /* _ASM_MACH_NETLOGIC_TOPOLOGY_H */
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index 027c74db13f9..df49a308085c 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -122,6 +122,9 @@ do {									\
         }                                                               \
 } while(0)
 
+extern void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep,
+        pte_t pteval);
+
 #if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
 
 #define pte_none(pte)           (!(((pte).pte_low | (pte).pte_high) & ~_PAGE_GLOBAL))
@@ -145,7 +148,6 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
                 }
         }
 }
-#define set_pte_at(mm, addr, ptep, pteval) set_pte(ptep, pteval)
 
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
@@ -183,7 +185,6 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
         }
 #endif
 }
-#define set_pte_at(mm, addr, ptep, pteval) set_pte(ptep, pteval)
 
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
@@ -390,15 +391,12 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 
 extern void __update_tlb(struct vm_area_struct *vma, unsigned long address,
         pte_t pte);
-extern void __update_cache(struct vm_area_struct *vma, unsigned long address,
-        pte_t pte);
 
 static inline void update_mmu_cache(struct vm_area_struct *vma,
         unsigned long address, pte_t *ptep)
 {
         pte_t pte = *ptep;
         __update_tlb(vma, address, pte);
-        __update_cache(vma, address, pte);
 }
 
 static inline void update_mmu_cache_pmd(struct vm_area_struct *vma,
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 17960fe7a8ce..cdf68b33bd65 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -131,10 +131,12 @@ static inline int syscall_get_arch(void)
 {
         int arch = EM_MIPS;
 #ifdef CONFIG_64BIT
-        if (!test_thread_flag(TIF_32BIT_REGS))
+        if (!test_thread_flag(TIF_32BIT_REGS)) {
                 arch |= __AUDIT_ARCH_64BIT;
-        if (test_thread_flag(TIF_32BIT_ADDR))
-                arch |= __AUDIT_ARCH_CONVENTION_MIPS64_N32;
+                /* N32 sets only TIF_32BIT_ADDR */
+                if (test_thread_flag(TIF_32BIT_ADDR))
+                        arch |= __AUDIT_ARCH_CONVENTION_MIPS64_N32;
+        }
 #endif
 #if defined(__LITTLE_ENDIAN)
         arch |=  __AUDIT_ARCH_LE;
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index 6f4f739dad96..e6e97d2a5c9e 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -13,6 +13,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/asmmacro.h>
 #include <asm/cacheops.h>
+#include <asm/eva.h>
 #include <asm/mipsregs.h>
 #include <asm/mipsmtregs.h>
 #include <asm/pm.h>
@@ -166,6 +167,9 @@ dcache_done:
 1:      jal     mips_cps_core_init
          nop
 
+        /* Do any EVA initialization if necessary */
+        eva_init
+
         /*
          * Boot any other VPEs within this core that should be online, and
          * deactivate this VPE if it should be offline.
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 14bf74b0f51c..b63f2482f288 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -558,7 +558,7 @@ static int mipspmu_get_irq(void)
         if (mipspmu.irq >= 0) {
                 /* Request my own irq handler. */
                 err = request_irq(mipspmu.irq, mipsxx_pmu_handle_irq,
-                        IRQF_PERCPU | IRQF_NOBALANCING,
+                        IRQF_PERCPU | IRQF_NOBALANCING | IRQF_NO_THREAD,
                         "mips_perf_pmu", NULL);
                 if (err) {
                         pr_warning("Unable to request IRQ%d for MIPS "
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 13b964fddc4a..25bb8400156d 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -113,15 +113,19 @@ trace_a_syscall:
         move    s0, t2                  # Save syscall pointer
         move    a0, sp
         /*
-         * syscall number is in v0 unless we called syscall(__NR_###)
+         * absolute syscall number is in v0 unless we called syscall(__NR_###)
          * where the real syscall number is in a0
          * note: NR_syscall is the first O32 syscall but the macro is
          * only defined when compiling with -mabi=32 (CONFIG_32BIT)
          * therefore __NR_O32_Linux is used (4000)
          */
-        addiu   a1, v0,  __NR_O32_Linux
-        bnez    v0, 1f /* __NR_syscall at offset 0 */
-        lw      a1, PT_R4(sp)
+        .set    push
+        .set    reorder
+        subu    t1, v0,  __NR_O32_Linux
+        move    a1, v0
+        bnez    t1, 1f /* __NR_syscall at offset 0 */
+        lw      a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
+        .set    pop
 
 1:      jal     syscall_trace_enter
 
diff --git a/arch/mips/loongson/loongson-3/cop2-ex.c b/arch/mips/loongson/loongson-3/cop2-ex.c
index 9182e8d2967c..b03e37d2071a 100644
--- a/arch/mips/loongson/loongson-3/cop2-ex.c
+++ b/arch/mips/loongson/loongson-3/cop2-ex.c
@@ -22,13 +22,13 @@
 static int loongson_cu2_call(struct notifier_block *nfb, unsigned long action,
         void *data)
 {
-        int fpu_enabled;
+        int fpu_owned;
         int fr = !test_thread_flag(TIF_32BIT_FPREGS);
 
         switch (action) {
         case CU2_EXCEPTION:
                 preempt_disable();
-                fpu_enabled = read_c0_status() & ST0_CU1;
+                fpu_owned = __is_fpu_owner();
                 if (!fr)
                         set_c0_status(ST0_CU1 | ST0_CU2);
                 else
@@ -39,8 +39,8 @@ static int loongson_cu2_call(struct notifier_block *nfb, unsigned long action,
                         KSTK_STATUS(current) |= ST0_FR;
                 else
                         KSTK_STATUS(current) &= ~ST0_FR;
-                /* If FPU is enabled, we needn't init or restore fp */
-                if(!fpu_enabled) {
+                /* If FPU is owned, we needn't init or restore fp */
+                if (!fpu_owned) {
                         set_thread_flag(TIF_USEDFPU);
                         if (!used_math()) {
                                 _init_fpu();
diff --git a/arch/mips/loongson/loongson-3/numa.c b/arch/mips/loongson/loongson-3/numa.c
index ca025a6ba559..37ed184398c6 100644
--- a/arch/mips/loongson/loongson-3/numa.c
+++ b/arch/mips/loongson/loongson-3/numa.c
@@ -24,8 +24,6 @@
 #include <asm/page.h>
 #include <asm/pgalloc.h>
 #include <asm/sections.h>
-#include <linux/bootmem.h>
-#include <linux/init.h>
 #include <linux/irq.h>
 #include <asm/bootinfo.h>
 #include <asm/mc146818-time.h>
diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
index f7b91d3a371d..7e3ea7766822 100644
--- a/arch/mips/mm/cache.c
+++ b/arch/mips/mm/cache.c
@@ -119,25 +119,36 @@ void __flush_anon_page(struct page *page, unsigned long vmaddr)
 
 EXPORT_SYMBOL(__flush_anon_page);
 
-void __update_cache(struct vm_area_struct *vma, unsigned long address,
-        pte_t pte)
+static void mips_flush_dcache_from_pte(pte_t pteval, unsigned long address)
 {
         struct page *page;
-        unsigned long pfn, addr;
-        int exec = (vma->vm_flags & VM_EXEC) && !cpu_has_ic_fills_f_dc;
+        unsigned long pfn = pte_pfn(pteval);
 
-        pfn = pte_pfn(pte);
         if (unlikely(!pfn_valid(pfn)))
                 return;
+
         page = pfn_to_page(pfn);
         if (page_mapping(page) && Page_dcache_dirty(page)) {
-                addr = (unsigned long) page_address(page);
-                if (exec || pages_do_alias(addr, address & PAGE_MASK))
-                        flush_data_cache_page(addr);
+                unsigned long page_addr = (unsigned long) page_address(page);
+
+                if (!cpu_has_ic_fills_f_dc ||
+                    pages_do_alias(page_addr, address & PAGE_MASK))
+                        flush_data_cache_page(page_addr);
                 ClearPageDcacheDirty(page);
         }
 }
 
+void set_pte_at(struct mm_struct *mm, unsigned long addr,
+        pte_t *ptep, pte_t pteval)
+{
+        if (cpu_has_dc_aliases || !cpu_has_ic_fills_f_dc) {
+                if (pte_present(pteval))
+                        mips_flush_dcache_from_pte(pteval, addr);
+        }
+
+        set_pte(ptep, pteval);
+}
+
 unsigned long _page_cachable_default;
 EXPORT_SYMBOL(_page_cachable_default);
 
diff --git a/arch/mips/mti-malta/malta-memory.c b/arch/mips/mti-malta/malta-memory.c
index 0c35dee0a215..8fddd2cdbff7 100644
--- a/arch/mips/mti-malta/malta-memory.c
+++ b/arch/mips/mti-malta/malta-memory.c
@@ -35,13 +35,19 @@ fw_memblock_t * __init fw_getmdesc(int eva)
         /* otherwise look in the environment */
 
         memsize_str = fw_getenv("memsize");
-        if (memsize_str)
-                tmp = kstrtol(memsize_str, 0, &memsize);
+        if (memsize_str) {
+                tmp = kstrtoul(memsize_str, 0, &memsize);
+                if (tmp)
+                        pr_warn("Failed to read the 'memsize' env variable.\n");
+        }
         if (eva) {
         /* Look for ememsize for EVA */
                 ememsize_str = fw_getenv("ememsize");
-                if (ememsize_str)
-                        tmp = kstrtol(ememsize_str, 0, &ememsize);
+                if (ememsize_str) {
+                        tmp = kstrtoul(ememsize_str, 0, &ememsize);
+                        if (tmp)
+                                pr_warn("Failed to read the 'ememsize' env variable.\n");
+                }
         }
         if (!memsize && !ememsize) {
                 pr_warn("memsize not set in YAMON, set to default (32Mb)\n");
diff --git a/arch/mips/pmcs-msp71xx/msp_irq.c b/arch/mips/pmcs-msp71xx/msp_irq.c
index 941744aabb51..f914c753de21 100644
--- a/arch/mips/pmcs-msp71xx/msp_irq.c
+++ b/arch/mips/pmcs-msp71xx/msp_irq.c
@@ -51,7 +51,7 @@ static inline void sec_int_dispatch(void)  { do_IRQ(MSP_INT_SEC);  }
  * the range 40-71.
  */
 
-asmlinkage void plat_irq_dispatch(struct pt_regs *regs)
+asmlinkage void plat_irq_dispatch(void)
 {
         u32 pending;
 
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index a577609f8ed6..4bc7b62fb4b6 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -399,8 +399,6 @@ config PPC64_SUPPORTS_MEMORY_FAILURE
 config KEXEC
         bool "kexec system call"
         depends on (PPC_BOOK3S || FSL_BOOKE || (44x && !SMP))
-        select CRYPTO
-        select CRYPTO_SHA256
         help
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 72c20bb16d26..79294c4c5015 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -62,10 +62,10 @@ long kvmppc_alloc_hpt(struct kvm *kvm, u32 *htab_orderp)
         }
 
         kvm->arch.hpt_cma_alloc = 0;
-        page = kvm_alloc_hpt(1 << (order - PAGE_SHIFT));
+        page = kvm_alloc_hpt(1ul << (order - PAGE_SHIFT));
         if (page) {
                 hpt = (unsigned long)pfn_to_kaddr(page_to_pfn(page));
-                memset((void *)hpt, 0, (1 << order));
+                memset((void *)hpt, 0, (1ul << order));
                 kvm->arch.hpt_cma_alloc = 1;
         }
 
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index ab39ceb89ecf..05c78bb5f570 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -48,8 +48,6 @@ config ARCH_SUPPORTS_DEBUG_PAGEALLOC
 
 config KEXEC
         def_bool y
-        select CRYPTO
-        select CRYPTO_SHA256
 
 config AUDIT_ARCH
         def_bool y
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index b76317c1f3eb..5efb2fe186e7 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1127,7 +1127,7 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma,
                                             unsigned long addr, pte_t *ptep)
 {
         pgste_t pgste;
-        pte_t pte;
+        pte_t pte, oldpte;
         int young;
 
         if (mm_has_pgste(vma->vm_mm)) {
@@ -1135,12 +1135,13 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma,
                 pgste = pgste_ipte_notify(vma->vm_mm, ptep, pgste);
         }
 
-        pte = *ptep;
+        oldpte = pte = *ptep;
         ptep_flush_direct(vma->vm_mm, addr, ptep);
         young = pte_young(pte);
         pte = pte_mkold(pte);
 
         if (mm_has_pgste(vma->vm_mm)) {
+                pgste = pgste_update_all(&oldpte, pgste, vma->vm_mm);
                 pgste = pgste_set_pte(ptep, pgste, pte);
                 pgste_set_unlock(ptep, pgste);
         } else
@@ -1330,6 +1331,7 @@ static inline int ptep_set_access_flags(struct vm_area_struct *vma,
         ptep_flush_direct(vma->vm_mm, address, ptep);
 
         if (mm_has_pgste(vma->vm_mm)) {
+                pgste_set_key(ptep, pgste, entry, vma->vm_mm);
                 pgste = pgste_set_pte(ptep, pgste, entry);
                 pgste_set_unlock(ptep, pgste);
         } else
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index 3802d2d3a18d..940ac49198db 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -283,7 +283,10 @@
 #define __NR_sched_setattr      345
 #define __NR_sched_getattr      346
 #define __NR_renameat2          347
-#define NR_syscalls 348
+#define __NR_seccomp            348
+#define __NR_getrandom          349
+#define __NR_memfd_create       350
+#define NR_syscalls 351
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/compat_wrapper.c b/arch/s390/kernel/compat_wrapper.c
index 45cdb37aa6f8..faf6caa510dc 100644
--- a/arch/s390/kernel/compat_wrapper.c
+++ b/arch/s390/kernel/compat_wrapper.c
@@ -214,3 +214,6 @@ COMPAT_SYSCALL_WRAP3(finit_module, int, fd, const char __user *, uargs, int, fla
 COMPAT_SYSCALL_WRAP3(sched_setattr, pid_t, pid, struct sched_attr __user *, attr, unsigned int, flags);
 COMPAT_SYSCALL_WRAP4(sched_getattr, pid_t, pid, struct sched_attr __user *, attr, unsigned int, size, unsigned int, flags);
 COMPAT_SYSCALL_WRAP5(renameat2, int, olddfd, const char __user *, oldname, int, newdfd, const char __user *, newname, unsigned int, flags);
+COMPAT_SYSCALL_WRAP3(seccomp, unsigned int, op, unsigned int, flags, const char __user *, uargs)
+COMPAT_SYSCALL_WRAP3(getrandom, char __user *, buf, size_t, count, unsigned int, flags)
+COMPAT_SYSCALL_WRAP2(memfd_create, const char __user *, uname, unsigned int, flags)
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 633ca7504536..22aac5885ba2 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -2060,6 +2060,13 @@ void s390_reset_system(void (*func)(void *), void *data)
         S390_lowcore.program_new_psw.addr =
                 PSW_ADDR_AMODE | (unsigned long) s390_base_pgm_handler;
 
+        /*
+         * Clear subchannel ID and number to signal new kernel that no CCW or
+         * SCSI IPL has been done (for kexec and kdump)
+         */
+        S390_lowcore.subchannel_id = 0;
+        S390_lowcore.subchannel_nr = 0;
+
         /* Store status at absolute zero */
         store_status();
 
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index ae1d5be7dd88..82bc113e8c1d 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -24,6 +24,7 @@
 #include <linux/stddef.h>
 #include <linux/unistd.h>
 #include <linux/ptrace.h>
+#include <linux/random.h>
 #include <linux/user.h>
 #include <linux/tty.h>
 #include <linux/ioport.h>
@@ -61,6 +62,7 @@
 #include <asm/diag.h>
 #include <asm/os_info.h>
 #include <asm/sclp.h>
+#include <asm/sysinfo.h>
 #include "entry.h"
 
 /*
@@ -766,6 +768,7 @@ static void __init setup_hwcaps(void)
 #endif
 
         get_cpu_id(&cpu_id);
+        add_device_randomness(&cpu_id, sizeof(cpu_id));
         switch (cpu_id.machine) {
         case 0x9672:
 #if !defined(CONFIG_64BIT)
@@ -804,6 +807,19 @@ static void __init setup_hwcaps(void)
 }
 
 /*
+ * Add system information as device randomness
+ */
+static void __init setup_randomness(void)
+{
+        struct sysinfo_3_2_2 *vmms;
+
+        vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL);
+        if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count)
+                add_device_randomness(&vmms, vmms->count);
+        free_page((unsigned long) vmms);
+}
+
+/*
  * Setup function called from init/main.c just after the banner
  * was printed.
  */
@@ -901,6 +917,9 @@ void __init setup_arch(char **cmdline_p)
 
         /* Setup zfcpdump support */
         setup_zfcpdump();
+
+        /* Add system specific data to the random pool */
+        setup_randomness();
 }
 
 #ifdef CONFIG_32BIT
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index fe5cdf29a001..6fe886ac2db5 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -356,3 +356,6 @@ SYSCALL(sys_finit_module,sys_finit_module,compat_sys_finit_module)
 SYSCALL(sys_sched_setattr,sys_sched_setattr,compat_sys_sched_setattr) /* 345 */
 SYSCALL(sys_sched_getattr,sys_sched_getattr,compat_sys_sched_getattr)
 SYSCALL(sys_renameat2,sys_renameat2,compat_sys_renameat2)
+SYSCALL(sys_seccomp,sys_seccomp,compat_sys_seccomp)
+SYSCALL(sys_getrandom,sys_getrandom,compat_sys_getrandom)
+SYSCALL(sys_memfd_create,sys_memfd_create,compat_sys_memfd_create) /* 350 */
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index ce81eb2ab76a..81b0e11521e4 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1317,19 +1317,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                 return -EINVAL;
         }
 
-        switch (kvm_run->exit_reason) {
-        case KVM_EXIT_S390_SIEIC:
-        case KVM_EXIT_UNKNOWN:
-        case KVM_EXIT_INTR:
-        case KVM_EXIT_S390_RESET:
-        case KVM_EXIT_S390_UCONTROL:
-        case KVM_EXIT_S390_TSCH:
-        case KVM_EXIT_DEBUG:
-                break;
-        default:
-                BUG();
-        }
-
         vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
         vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
         if (kvm_run->kvm_dirty_regs & KVM_SYNC_PREFIX) {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 19daa53a3da4..5404a6261db9 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -986,11 +986,21 @@ int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
         pte_t *ptep;
 
         down_read(&mm->mmap_sem);
+retry:
         ptep = get_locked_pte(current->mm, addr, &ptl);
         if (unlikely(!ptep)) {
                 up_read(&mm->mmap_sem);
                 return -EFAULT;
         }
+        if (!(pte_val(*ptep) & _PAGE_INVALID) &&
+             (pte_val(*ptep) & _PAGE_PROTECT)) {
+                        pte_unmap_unlock(*ptep, ptl);
+                        if (fixup_user_fault(current, mm, addr, FAULT_FLAG_WRITE)) {
+                                up_read(&mm->mmap_sem);
+                                return -EFAULT;
+                        }
+                        goto retry;
+                }
 
         new = old = pgste_get_lock(ptep);
         pgste_val(new) &= ~(PGSTE_GR_BIT | PGSTE_GC_BIT |
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 453fa5c09550..244fb4c81e25 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -172,6 +172,7 @@ menu "System type"
 #
 config CPU_SH2
         bool
+        select SH_INTC
 
 config CPU_SH2A
         bool
@@ -182,6 +183,7 @@ config CPU_SH3
         bool
         select CPU_HAS_INTEVT
         select CPU_HAS_SR_RB
+        select SH_INTC
         select SYS_SUPPORTS_SH_TMU
 
 config CPU_SH4
@@ -189,6 +191,7 @@ config CPU_SH4
         select CPU_HAS_INTEVT
         select CPU_HAS_SR_RB
         select CPU_HAS_FPU if !CPU_SH4AL_DSP
+        select SH_INTC
         select SYS_SUPPORTS_SH_TMU
         select SYS_SUPPORTS_HUGETLBFS if MMU
 
@@ -595,8 +598,6 @@ source kernel/Kconfig.hz
 config KEXEC
         bool "kexec system call (EXPERIMENTAL)"
         depends on SUPERH32 && MMU
-        select CRYPTO
-        select CRYPTO_SHA256
         help
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/sh/mm/cache.c b/arch/sh/mm/cache.c
index 097c2cdd117f..f770e3992620 100644
--- a/arch/sh/mm/cache.c
+++ b/arch/sh/mm/cache.c
@@ -229,6 +229,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
 
         cacheop_on_each_cpu(local_flush_icache_range, (void *)&data, 1);
 }
+EXPORT_SYMBOL(flush_icache_range);
 
 void flush_icache_page(struct vm_area_struct *vma, struct page *page)
 {
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index a3ffe2dd4832..7fcd492adbfc 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -191,8 +191,6 @@ source "kernel/Kconfig.hz"
 
 config KEXEC
         bool "kexec system call"
-        select CRYPTO
-        select CRYPTO_SHA256
         ---help---
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/tile/kernel/smp.c b/arch/tile/kernel/smp.c
index 01e8ab29f43a..19eaa62d456a 100644
--- a/arch/tile/kernel/smp.c
+++ b/arch/tile/kernel/smp.c
@@ -183,6 +183,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
                 preempt_enable();
         }
 }
+EXPORT_SYMBOL(flush_icache_range);
 
 
 /* Called when smp_send_reschedule() triggers IRQ_RESCHEDULE. */
diff --git a/arch/unicore32/kernel/signal.c b/arch/unicore32/kernel/signal.c
index 780d77388dec..7c8fb7018dc6 100644
--- a/arch/unicore32/kernel/signal.c
+++ b/arch/unicore32/kernel/signal.c
@@ -254,7 +254,8 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
 
         err |= setup_sigframe(frame, regs, set);
         if (err == 0)
-                err |= setup_return(regs, &ksig->ka, frame->retcode, frame, usig);
+                err |= setup_return(regs, &ksig->ka, frame->retcode, frame,
+                                    ksig->sig);
 
         return err;
 }
@@ -276,7 +277,8 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
         err |= __save_altstack(&frame->sig.uc.uc_stack, regs->UCreg_sp);
         err |= setup_sigframe(&frame->sig, regs, set);
         if (err == 0)
-                err |= setup_return(regs, &ksig->ka, frame->sig.retcode, frame, usig);
+                err |= setup_return(regs, &ksig->ka, frame->sig.retcode, frame,
+                                    ksig->sig);
 
         if (err == 0) {
                 /*
@@ -303,7 +305,6 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs,
                           int syscall)
 {
         struct thread_info *thread = current_thread_info();
-        struct task_struct *tsk = current;
         sigset_t *oldset = sigmask_to_save();
         int usig = ksig->sig;
         int ret;
@@ -373,7 +374,7 @@ static void do_signal(struct pt_regs *regs, int syscall)
         if (!user_mode(regs))
                 return;
 
-        if (get_signsl(&ksig)) {
+        if (get_signal(&ksig)) {
                 handle_signal(&ksig, regs, syscall);
                 return;
         }
diff --git a/arch/x86/Kbuild b/arch/x86/Kbuild
index 61b6d51866f8..3942f74c92d7 100644
--- a/arch/x86/Kbuild
+++ b/arch/x86/Kbuild
@@ -17,6 +17,4 @@ obj-$(CONFIG_IA32_EMULATION) += ia32/
 obj-y += platform/
 obj-y += net/
 
-ifeq ($(CONFIG_X86_64),y)
-obj-$(CONFIG_KEXEC) += purgatory/
-endif
+obj-$(CONFIG_KEXEC_FILE) += purgatory/
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 5d0bf1aa9dcb..778178f4c7d1 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1585,9 +1585,6 @@ source kernel/Kconfig.hz
 
 config KEXEC
         bool "kexec system call"
-        select BUILD_BIN2C
-        select CRYPTO
-        select CRYPTO_SHA256
         ---help---
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
@@ -1602,9 +1599,22 @@ config KEXEC
           interface is strongly in flux, so no good recommendation can be
           made.
 
+config KEXEC_FILE
+        bool "kexec file based system call"
+        select BUILD_BIN2C
+        depends on KEXEC
+        depends on X86_64
+        depends on CRYPTO=y
+        depends on CRYPTO_SHA256=y
+        ---help---
+          This is new version of kexec system call. This system call is
+          file based and takes file descriptors as system call argument
+          for kernel and initramfs as opposed to list of segments as
+          accepted by previous system call.
+
 config KEXEC_VERIFY_SIG
         bool "Verify kernel signature during kexec_file_load() syscall"
-        depends on KEXEC
+        depends on KEXEC_FILE
         ---help---
           This option makes kernel signature verification mandatory for
           kexec_file_load() syscall. If kernel is signature can not be
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index c1aa36887843..60087ca37679 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -184,11 +184,8 @@ archheaders:
         $(Q)$(MAKE) $(build)=arch/x86/syscalls all
 
 archprepare:
-ifeq ($(CONFIG_KEXEC),y)
-# Build only for 64bit. No loaders for 32bit yet.
- ifeq ($(CONFIG_X86_64),y)
+ifeq ($(CONFIG_KEXEC_FILE),y)
         $(Q)$(MAKE) $(build)=arch/x86/purgatory arch/x86/purgatory/kexec-purgatory.c
- endif
 endif
 
 ###
@@ -254,6 +251,7 @@ archclean:
         $(Q)rm -rf $(objtree)/arch/x86_64
         $(Q)$(MAKE) $(clean)=$(boot)
         $(Q)$(MAKE) $(clean)=arch/x86/tools
+        $(Q)$(MAKE) $(clean)=arch/x86/purgatory
 
 PHONY += kvmconfig
 kvmconfig:
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index 0aeed5ca356e..478c490f3654 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -227,6 +227,8 @@ static inline void io_apic_modify(unsigned int apic, unsigned int reg, unsigned
 
 extern void io_apic_eoi(unsigned int apic, unsigned int vector);
 
+extern bool mp_should_keep_irq(struct device *dev);
+
 #else  /* !CONFIG_X86_IO_APIC */
 
 #define io_apic_assign_pci_irqs 0
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 0ec056012618..aa97a070f09f 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -131,8 +131,13 @@ static inline int pte_exec(pte_t pte)
 
 static inline int pte_special(pte_t pte)
 {
-        return (pte_flags(pte) & (_PAGE_PRESENT|_PAGE_SPECIAL)) ==
-                                 (_PAGE_PRESENT|_PAGE_SPECIAL);
+        /*
+         * See CONFIG_NUMA_BALANCING pte_numa in include/asm-generic/pgtable.h.
+         * On x86 we have _PAGE_BIT_NUMA == _PAGE_BIT_GLOBAL+1 ==
+         * __PAGE_BIT_SOFTW1 == _PAGE_BIT_SPECIAL.
+         */
+        return (pte_flags(pte) & _PAGE_SPECIAL) &&
+                (pte_flags(pte) & (_PAGE_PRESENT|_PAGE_PROTNONE));
 }
 
 static inline unsigned long pte_pfn(pte_t pte)
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index b5ea75c4a4b4..ada2e2d6be3e 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -71,6 +71,7 @@ obj-$(CONFIG_FTRACE_SYSCALLS)	+= ftrace.o
 obj-$(CONFIG_X86_TSC)           += trace_clock.o
 obj-$(CONFIG_KEXEC)             += machine_kexec_$(BITS).o
 obj-$(CONFIG_KEXEC)             += relocate_kernel_$(BITS).o crash.o
+obj-$(CONFIG_KEXEC_FILE)        += kexec-bzimage64.o
 obj-$(CONFIG_CRASH_DUMP)        += crash_dump_$(BITS).o
 obj-y                           += kprobes/
 obj-$(CONFIG_MODULES)           += module.o
@@ -118,5 +119,4 @@ ifeq ($(CONFIG_X86_64),y)
 
         obj-$(CONFIG_PCI_MMCONFIG)      += mmconf-fam10h_64.o
         obj-y                           += vsmp_64.o
-        obj-$(CONFIG_KEXEC)             += kexec-bzimage64.o
 endif
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 29290f554e79..337ce5a9b15c 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1070,6 +1070,11 @@ static int mp_map_pin_to_irq(u32 gsi, int idx, int ioapic, int pin,
         }
 
         if (flags & IOAPIC_MAP_ALLOC) {
+                /* special handling for legacy IRQs */
+                if (irq < nr_legacy_irqs() && info->count == 1 &&
+                    mp_irqdomain_map(domain, irq, pin) != 0)
+                        irq = -1;
+
                 if (irq > 0)
                         info->count++;
                 else if (info->count == 0)
@@ -3896,7 +3901,15 @@ int mp_irqdomain_map(struct irq_domain *domain, unsigned int virq,
                         info->polarity = 1;
                 }
                 info->node = NUMA_NO_NODE;
-                info->set = 1;
+
+                /*
+                 * setup_IO_APIC_irqs() programs all legacy IRQs with default
+                 * trigger and polarity attributes. Don't set the flag for that
+                 * case so the first legacy IRQ user could reprogram the pin
+                 * with real trigger and polarity attributes.
+                 */
+                if (virq >= nr_legacy_irqs() || info->count)
+                        info->set = 1;
         }
         set_io_apic_irq_attr(&attr, ioapic, hwirq, info->trigger,
                              info->polarity);
@@ -3946,6 +3959,18 @@ int mp_set_gsi_attr(u32 gsi, int trigger, int polarity, int node)
         return ret;
 }
 
+bool mp_should_keep_irq(struct device *dev)
+{
+        if (dev->power.is_prepared)
+                return true;
+#ifdef  CONFIG_PM_RUNTIME
+        if (dev->power.runtime_status == RPM_SUSPENDING)
+                return true;
+#endif
+
+        return false;
+}
+
 /* Enable IOAPIC early just for system timer */
 void __init pre_init_apic_IRQ0(void)
 {
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index 0553a34fa0df..a618fcd2c07d 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -182,8 +182,7 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
         crash_save_cpu(regs, safe_smp_processor_id());
 }
 
-#ifdef CONFIG_X86_64
-
+#ifdef CONFIG_KEXEC_FILE
 static int get_nr_ram_ranges_callback(unsigned long start_pfn,
                                 unsigned long nr_pfn, void *arg)
 {
@@ -696,5 +695,4 @@ int crash_load_segments(struct kimage *image)
 
         return ret;
 }
-
-#endif /* CONFIG_X86_64 */
+#endif /* CONFIG_KEXEC_FILE */
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 47c410d99f5d..4b0e1dfa2226 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -683,7 +683,7 @@ END(syscall_badsys)
 sysenter_badsys:
         movl $-ENOSYS,%eax
         jmp sysenter_after_call
-END(syscall_badsys)
+END(sysenter_badsys)
         CFI_ENDPROC
 
 .macro FIXUP_ESPFIX_STACK
diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
index 1e6cff5814fa..44f1ed42fdf2 100644
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -203,7 +203,7 @@ void __init native_init_IRQ(void)
                 set_intr_gate(i, interrupt[i - FIRST_EXTERNAL_VECTOR]);
         }
 
-        if (!acpi_ioapic && !of_ioapic)
+        if (!acpi_ioapic && !of_ioapic && nr_legacy_irqs())
                 setup_irq(2, &irq2);
 
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 8b04018e5d1f..485981059a40 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -25,9 +25,11 @@
 #include <asm/debugreg.h>
 #include <asm/kexec-bzimage64.h>
 
+#ifdef CONFIG_KEXEC_FILE
 static struct kexec_file_ops *kexec_file_loaders[] = {
                 &kexec_bzImage64_ops,
 };
+#endif
 
 static void free_transition_pgtable(struct kimage *image)
 {
@@ -178,6 +180,7 @@ static void load_segments(void)
                 );
 }
 
+#ifdef CONFIG_KEXEC_FILE
 /* Update purgatory as needed after various image segments have been prepared */
 static int arch_update_purgatory(struct kimage *image)
 {
@@ -209,6 +212,12 @@ static int arch_update_purgatory(struct kimage *image)
 
         return ret;
 }
+#else /* !CONFIG_KEXEC_FILE */
+static inline int arch_update_purgatory(struct kimage *image)
+{
+        return 0;
+}
+#endif /* CONFIG_KEXEC_FILE */
 
 int machine_kexec_prepare(struct kimage *image)
 {
@@ -329,6 +338,7 @@ void arch_crash_save_vmcoreinfo(void)
 
 /* arch-dependent functionality related to kexec file-based syscall */
 
+#ifdef CONFIG_KEXEC_FILE
 int arch_kexec_kernel_image_probe(struct kimage *image, void *buf,
                                   unsigned long buf_len)
 {
@@ -522,3 +532,4 @@ overflow:
                (int)ELF64_R_TYPE(rel[i].r_info), value);
         return -ENOEXEC;
 }
+#endif /* CONFIG_KEXEC_FILE */
diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
index bf7ef5ce29df..0fa29609b2c4 100644
--- a/arch/x86/kernel/time.c
+++ b/arch/x86/kernel/time.c
@@ -68,6 +68,8 @@ static struct irqaction irq0  = {
 
 void __init setup_default_timer_irq(void)
 {
+        if (!nr_legacy_irqs())
+                return;
         setup_irq(0, &irq0);
 }
 
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 1fe33987de02..ee61c36d64f8 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -49,7 +49,13 @@ void leave_mm(int cpu)
         if (cpumask_test_cpu(cpu, mm_cpumask(active_mm))) {
                 cpumask_clear_cpu(cpu, mm_cpumask(active_mm));
                 load_cr3(swapper_pg_dir);
-                trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
+                /*
+                 * This gets called in the idle path where RCU
+                 * functions differently.  Tracing normally
+                 * uses RCU, so we have to call the tracepoint
+                 * specially here.
+                 */
+                trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
         }
 }
 EXPORT_SYMBOL_GPL(leave_mm);
@@ -174,7 +180,7 @@ void flush_tlb_current_task(void)
  *
  * This is in units of pages.
  */
-unsigned long tlb_single_page_flush_ceiling = 33;
+static unsigned long tlb_single_page_flush_ceiling __read_mostly = 33;
 
 void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
                                 unsigned long end, unsigned long vmflag)
diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
index 3865116c51fb..b9958c364075 100644
--- a/arch/x86/pci/intel_mid_pci.c
+++ b/arch/x86/pci/intel_mid_pci.c
@@ -229,7 +229,7 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
 
 static void intel_mid_pci_irq_disable(struct pci_dev *dev)
 {
-        if (!dev->dev.power.is_prepared && dev->irq > 0)
+        if (!mp_should_keep_irq(&dev->dev) && dev->irq > 0)
                 mp_unmap_irq(dev->irq);
 }
 
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index bc1a2c341891..eb500c2592ad 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -1256,7 +1256,7 @@ static int pirq_enable_irq(struct pci_dev *dev)
 
 static void pirq_disable_irq(struct pci_dev *dev)
 {
-        if (io_apic_assign_pci_irqs && !dev->dev.power.is_prepared &&
+        if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) &&
             dev->irq) {
                 mp_unmap_irq(dev->irq);
                 dev->irq = 0;
diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index 7fde9ee438a4..899dd2454256 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -11,6 +11,7 @@ targets += purgatory.ro
 # sure how to relocate those. Like kexec-tools, use custom flags.
 
 KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large
+KBUILD_CFLAGS += -m$(BITS)
 
 $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
                 $(call if_changed,ld)
@@ -24,7 +25,4 @@ $(obj)/kexec-purgatory.c: $(obj)/purgatory.ro FORCE
         $(call if_changed,bin2c)
 
 
-# No loaders for 32bits yet.
-ifeq ($(CONFIG_X86_64),y)
- obj-$(CONFIG_KEXEC)            += kexec-purgatory.o
-endif
+obj-$(CONFIG_KEXEC_FILE)        += kexec-purgatory.o
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 3a617af60d46..49c6c3d94449 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -4,24 +4,23 @@ config ZONE_DMA
 config XTENSA
         def_bool y
         select ARCH_WANT_FRAME_POINTERS
-        select HAVE_IDE
-        select GENERIC_ATOMIC64
-        select GENERIC_CLOCKEVENTS
-        select VIRT_TO_BUS
-        select GENERIC_IRQ_SHOW
-        select GENERIC_SCHED_CLOCK
-        select MODULES_USE_ELF_RELA
-        select GENERIC_PCI_IOMAP
         select ARCH_WANT_IPC_PARSE_VERSION
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select BUILDTIME_EXTABLE_SORT
         select CLONE_BACKWARDS
-        select IRQ_DOMAIN
-        select HAVE_OPROFILE
+        select COMMON_CLK
+        select GENERIC_ATOMIC64
+        select GENERIC_CLOCKEVENTS
+        select GENERIC_IRQ_SHOW
+        select GENERIC_PCI_IOMAP
+        select GENERIC_SCHED_CLOCK
         select HAVE_FUNCTION_TRACER
         select HAVE_IRQ_TIME_ACCOUNTING
+        select HAVE_OPROFILE
         select HAVE_PERF_EVENTS
-        select COMMON_CLK
+        select IRQ_DOMAIN
+        select MODULES_USE_ELF_RELA
+        select VIRT_TO_BUS
         help
           Xtensa processors are 32-bit RISC machines designed by Tensilica
           primarily for embedded systems.  These processors are both
@@ -62,7 +61,9 @@ config TRACE_IRQFLAGS_SUPPORT
         def_bool y
 
 config MMU
-        def_bool n
+        bool
+        default n if !XTENSA_VARIANT_CUSTOM
+        default XTENSA_VARIANT_MMU if XTENSA_VARIANT_CUSTOM
 
 config VARIANT_IRQ_SWITCH
         def_bool n
@@ -102,8 +103,40 @@ config XTENSA_VARIANT_S6000
         select VARIANT_IRQ_SWITCH
         select ARCH_REQUIRE_GPIOLIB
         select XTENSA_CALIBRATE_CCOUNT
+
+config XTENSA_VARIANT_CUSTOM
+        bool "Custom Xtensa processor configuration"
+        select MAY_HAVE_SMP
+        select HAVE_XTENSA_GPIO32
+        help
+          Select this variant to use a custom Xtensa processor configuration.
+          You will be prompted for a processor variant CORENAME.
 endchoice
 
+config XTENSA_VARIANT_CUSTOM_NAME
+        string "Xtensa Processor Custom Core Variant Name"
+        depends on XTENSA_VARIANT_CUSTOM
+        help
+          Provide the name of a custom Xtensa processor variant.
+          This CORENAME selects arch/xtensa/variant/CORENAME.
+          Dont forget you have to select MMU if you have one.
+
+config XTENSA_VARIANT_NAME
+        string
+        default "dc232b"                        if XTENSA_VARIANT_DC232B
+        default "dc233c"                        if XTENSA_VARIANT_DC233C
+        default "fsf"                           if XTENSA_VARIANT_FSF
+        default "s6000"                         if XTENSA_VARIANT_S6000
+        default XTENSA_VARIANT_CUSTOM_NAME      if XTENSA_VARIANT_CUSTOM
+
+config XTENSA_VARIANT_MMU
+        bool "Core variant has a Full MMU (TLB, Pages, Protection, etc)"
+        depends on XTENSA_VARIANT_CUSTOM
+        default y
+        help
+          Build a Conventional Kernel with full MMU support,
+          ie: it supports a TLB with auto-loading, page protection.
+
 config XTENSA_UNALIGNED_USER
         bool "Unaligned memory access in use space"
         help
@@ -156,13 +189,9 @@ config HOTPLUG_CPU
 
           Say N if you want to disable CPU hotplug.
 
-config MATH_EMULATION
-        bool "Math emulation"
-        help
-        Can we use information of configuration file?
-
 config INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX
         bool "Initialize Xtensa MMU inside the Linux kernel code"
+        depends on MMU
         default y
         help
           Earlier version initialized the MMU in the exception vector
@@ -192,6 +221,7 @@ config INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX
 
 config HIGHMEM
         bool "High Memory Support"
+        depends on MMU
         help
           Linux can use the full amount of RAM in the system by
           default. However, the default MMUv2 setup only maps the
@@ -208,6 +238,32 @@ config HIGHMEM
 
           If unsure, say Y.
 
+config FAST_SYSCALL_XTENSA
+        bool "Enable fast atomic syscalls"
+        default n
+        help
+          fast_syscall_xtensa is a syscall that can make atomic operations
+          on UP kernel when processor has no s32c1i support.
+
+          This syscall is deprecated. It may have issues when called with
+          invalid arguments. It is provided only for backwards compatibility.
+          Only enable it if your userspace software requires it.
+
+          If unsure, say N.
+
+config FAST_SYSCALL_SPILL_REGISTERS
+        bool "Enable spill registers syscall"
+        default n
+        help
+          fast_syscall_spill_registers is a syscall that spills all active
+          register windows of a calling userspace task onto its stack.
+
+          This syscall is deprecated. It may have issues when called with
+          invalid arguments. It is provided only for backwards compatibility.
+          Only enable it if your userspace software requires it.
+
+          If unsure, say N.
+
 endmenu
 
 config XTENSA_CALIBRATE_CCOUNT
@@ -250,12 +306,14 @@ config XTENSA_PLATFORM_ISS
 
 config XTENSA_PLATFORM_XT2000
         bool "XT2000"
+        select HAVE_IDE
         help
           XT2000 is the name of Tensilica's feature-rich emulation platform.
           This hardware is capable of running a full Linux distribution.
 
 config XTENSA_PLATFORM_S6105
         bool "S6105"
+        select HAVE_IDE
         select SERIAL_CONSOLE
         select NO_IOPORT_MAP
 
diff --git a/arch/xtensa/Makefile b/arch/xtensa/Makefile
index 81250ece3062..472533064b46 100644
--- a/arch/xtensa/Makefile
+++ b/arch/xtensa/Makefile
@@ -4,6 +4,7 @@
 # for more details.
 #
 # Copyright (C) 2001 - 2005  Tensilica Inc.
+# Copyright (C) 2014 Cadence Design Systems Inc.
 #
 # This file is included by the global makefile so that you can add your own
 # architecture-specific flags and dependencies. Remember to do have actions
@@ -13,11 +14,7 @@
 # Core configuration.
 # (Use VAR=<xtensa_config> to use another default compiler.)
 
-variant-$(CONFIG_XTENSA_VARIANT_FSF)            := fsf
-variant-$(CONFIG_XTENSA_VARIANT_DC232B)         := dc232b
-variant-$(CONFIG_XTENSA_VARIANT_DC233C)         := dc233c
-variant-$(CONFIG_XTENSA_VARIANT_S6000)          := s6000
-variant-$(CONFIG_XTENSA_VARIANT_LINUX_CUSTOM)   := custom
+variant-y := $(patsubst "%",%,$(CONFIG_XTENSA_VARIANT_NAME))
 
 VARIANT = $(variant-y)
 export VARIANT
diff --git a/arch/xtensa/boot/dts/kc705.dts b/arch/xtensa/boot/dts/kc705.dts
index 742a347be67a..c4d17a34ab86 100644
--- a/arch/xtensa/boot/dts/kc705.dts
+++ b/arch/xtensa/boot/dts/kc705.dts
@@ -4,8 +4,11 @@
 
 / {
         compatible = "cdns,xtensa-kc705";
+        chosen {
+                bootargs = "earlycon=uart8250,mmio32,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=0x38000000";
+        };
         memory@0 {
                 device_type = "memory";
-                reg = <0x00000000 0x08000000>;
+                reg = <0x00000000 0x38000000>;
         };
 };
diff --git a/arch/xtensa/configs/common_defconfig b/arch/xtensa/configs/common_defconfig
index f6000fe05119..721df1214bc3 100644
--- a/arch/xtensa/configs/common_defconfig
+++ b/arch/xtensa/configs/common_defconfig
@@ -66,7 +66,6 @@ CONFIG_XTENSA_ARCH_LINUX_BE=y
 CONFIG_MMU=y
 # CONFIG_XTENSA_UNALIGNED_USER is not set
 # CONFIG_PREEMPT is not set
-# CONFIG_MATH_EMULATION is not set
 # CONFIG_HIGHMEM is not set
 
 #
diff --git a/arch/xtensa/configs/iss_defconfig b/arch/xtensa/configs/iss_defconfig
index 1493c68352d1..b966baf82cae 100644
--- a/arch/xtensa/configs/iss_defconfig
+++ b/arch/xtensa/configs/iss_defconfig
@@ -146,7 +146,6 @@ CONFIG_XTENSA_VARIANT_FSF=y
 # CONFIG_XTENSA_VARIANT_S6000 is not set
 # CONFIG_XTENSA_UNALIGNED_USER is not set
 # CONFIG_PREEMPT is not set
-# CONFIG_MATH_EMULATION is not set
 CONFIG_XTENSA_CALIBRATE_CCOUNT=y
 CONFIG_SERIAL_CONSOLE=y
 CONFIG_XTENSA_ISS_NETWORK=y
@@ -308,7 +307,7 @@ CONFIG_MISC_DEVICES=y
 # EEPROM support
 #
 # CONFIG_EEPROM_93CX6 is not set
-CONFIG_HAVE_IDE=y
+# CONFIG_HAVE_IDE is not set
 # CONFIG_IDE is not set
 
 #
diff --git a/arch/xtensa/configs/s6105_defconfig b/arch/xtensa/configs/s6105_defconfig
index 12a492ab6d17..9471265b8ca6 100644
--- a/arch/xtensa/configs/s6105_defconfig
+++ b/arch/xtensa/configs/s6105_defconfig
@@ -109,7 +109,6 @@ CONFIG_VARIANT_IRQ_SWITCH=y
 CONFIG_XTENSA_VARIANT_S6000=y
 # CONFIG_XTENSA_UNALIGNED_USER is not set
 CONFIG_PREEMPT=y
-# CONFIG_MATH_EMULATION is not set
 # CONFIG_HIGHMEM is not set
 CONFIG_XTENSA_CALIBRATE_CCOUNT=y
 CONFIG_SERIAL_CONSOLE=y
diff --git a/arch/xtensa/include/asm/cacheflush.h b/arch/xtensa/include/asm/cacheflush.h
index 555a98a18453..e72aaca7a77f 100644
--- a/arch/xtensa/include/asm/cacheflush.h
+++ b/arch/xtensa/include/asm/cacheflush.h
@@ -37,6 +37,7 @@
  * specials for cache aliasing:
  *
  * __flush_invalidate_dcache_page_alias(vaddr,paddr)
+ * __invalidate_dcache_page_alias(vaddr,paddr)
  * __invalidate_icache_page_alias(vaddr,paddr)
  */
 
@@ -62,6 +63,7 @@ extern void __flush_invalidate_dcache_range(unsigned long, unsigned long);
 
 #if defined(CONFIG_MMU) && (DCACHE_WAY_SIZE > PAGE_SIZE)
 extern void __flush_invalidate_dcache_page_alias(unsigned long, unsigned long);
+extern void __invalidate_dcache_page_alias(unsigned long, unsigned long);
 #else
 static inline void __flush_invalidate_dcache_page_alias(unsigned long virt,
                                                         unsigned long phys) { }
diff --git a/arch/xtensa/include/asm/fixmap.h b/arch/xtensa/include/asm/fixmap.h
index 9f6c33d0428a..62b507deea9d 100644
--- a/arch/xtensa/include/asm/fixmap.h
+++ b/arch/xtensa/include/asm/fixmap.h
@@ -23,8 +23,8 @@
  * Here we define all the compile-time 'special' virtual
  * addresses. The point is to have a constant address at
  * compile time, but to set the physical address only
- * in the boot process. We allocate these special  addresses
- * from the end of the consistent memory region backwards.
+ * in the boot process. We allocate these special addresses
+ * from the start of the consistent memory region upwards.
  * Also this lets us do fail-safe vmalloc(), we
  * can guarantee that these special addresses and
  * vmalloc()-ed addresses never overlap.
@@ -38,7 +38,8 @@ enum fixed_addresses {
 #ifdef CONFIG_HIGHMEM
         /* reserved pte's for temporary kernel mappings */
         FIX_KMAP_BEGIN,
-        FIX_KMAP_END = FIX_KMAP_BEGIN + (KM_TYPE_NR * NR_CPUS) - 1,
+        FIX_KMAP_END = FIX_KMAP_BEGIN +
+                (KM_TYPE_NR * NR_CPUS * DCACHE_N_COLORS) - 1,
 #endif
         __end_of_fixed_addresses
 };
@@ -47,7 +48,28 @@ enum fixed_addresses {
 #define FIXADDR_SIZE    (__end_of_fixed_addresses << PAGE_SHIFT)
 #define FIXADDR_START   ((FIXADDR_TOP - FIXADDR_SIZE) & PMD_MASK)
 
-#include <asm-generic/fixmap.h>
+#define __fix_to_virt(x)        (FIXADDR_START + ((x) << PAGE_SHIFT))
+#define __virt_to_fix(x)        (((x) - FIXADDR_START) >> PAGE_SHIFT)
+
+#ifndef __ASSEMBLY__
+/*
+ * 'index to address' translation. If anyone tries to use the idx
+ * directly without translation, we catch the bug with a NULL-deference
+ * kernel oops. Illegal ranges of incoming indices are caught too.
+ */
+static __always_inline unsigned long fix_to_virt(const unsigned int idx)
+{
+        BUILD_BUG_ON(idx >= __end_of_fixed_addresses);
+        return __fix_to_virt(idx);
+}
+
+static inline unsigned long virt_to_fix(const unsigned long vaddr)
+{
+        BUG_ON(vaddr >= FIXADDR_TOP || vaddr < FIXADDR_START);
+        return __virt_to_fix(vaddr);
+}
+
+#endif
 
 #define kmap_get_fixmap_pte(vaddr) \
         pte_offset_kernel( \
diff --git a/arch/xtensa/include/asm/highmem.h b/arch/xtensa/include/asm/highmem.h
index 2653ef5d55f1..2c7901edffaf 100644
--- a/arch/xtensa/include/asm/highmem.h
+++ b/arch/xtensa/include/asm/highmem.h
@@ -12,19 +12,55 @@
 #ifndef _XTENSA_HIGHMEM_H
 #define _XTENSA_HIGHMEM_H
 
+#include <linux/wait.h>
 #include <asm/cacheflush.h>
 #include <asm/fixmap.h>
 #include <asm/kmap_types.h>
 #include <asm/pgtable.h>
 
-#define PKMAP_BASE              (FIXADDR_START - PMD_SIZE)
-#define LAST_PKMAP              PTRS_PER_PTE
+#define PKMAP_BASE              ((FIXADDR_START - \
+                                  (LAST_PKMAP + 1) * PAGE_SIZE) & PMD_MASK)
+#define LAST_PKMAP              (PTRS_PER_PTE * DCACHE_N_COLORS)
 #define LAST_PKMAP_MASK         (LAST_PKMAP - 1)
 #define PKMAP_NR(virt)          (((virt) - PKMAP_BASE) >> PAGE_SHIFT)
 #define PKMAP_ADDR(nr)          (PKMAP_BASE + ((nr) << PAGE_SHIFT))
 
 #define kmap_prot               PAGE_KERNEL
 
+#if DCACHE_WAY_SIZE > PAGE_SIZE
+#define get_pkmap_color get_pkmap_color
+static inline int get_pkmap_color(struct page *page)
+{
+        return DCACHE_ALIAS(page_to_phys(page));
+}
+
+extern unsigned int last_pkmap_nr_arr[];
+
+static inline unsigned int get_next_pkmap_nr(unsigned int color)
+{
+        last_pkmap_nr_arr[color] =
+                (last_pkmap_nr_arr[color] + DCACHE_N_COLORS) & LAST_PKMAP_MASK;
+        return last_pkmap_nr_arr[color] + color;
+}
+
+static inline int no_more_pkmaps(unsigned int pkmap_nr, unsigned int color)
+{
+        return pkmap_nr < DCACHE_N_COLORS;
+}
+
+static inline int get_pkmap_entries_count(unsigned int color)
+{
+        return LAST_PKMAP / DCACHE_N_COLORS;
+}
+
+extern wait_queue_head_t pkmap_map_wait_arr[];
+
+static inline wait_queue_head_t *get_pkmap_wait_queue_head(unsigned int color)
+{
+        return pkmap_map_wait_arr + color;
+}
+#endif
+
 extern pte_t *pkmap_page_table;
 
 void *kmap_high(struct page *page);
diff --git a/arch/xtensa/include/asm/page.h b/arch/xtensa/include/asm/page.h
index 47f582333f6b..abe24c6f8b2f 100644
--- a/arch/xtensa/include/asm/page.h
+++ b/arch/xtensa/include/asm/page.h
@@ -78,7 +78,9 @@
 # define DCACHE_ALIAS_EQ(a,b)   ((((a) ^ (b)) & DCACHE_ALIAS_MASK) == 0)
 #else
 # define DCACHE_ALIAS_ORDER     0
+# define DCACHE_ALIAS(a)        ((void)(a), 0)
 #endif
+#define DCACHE_N_COLORS         (1 << DCACHE_ALIAS_ORDER)
 
 #if ICACHE_WAY_SIZE > PAGE_SIZE
 # define ICACHE_ALIAS_ORDER     (ICACHE_WAY_SHIFT - PAGE_SHIFT)
@@ -134,6 +136,7 @@ static inline __attribute_const__ int get_order(unsigned long size)
 #endif
 
 struct page;
+struct vm_area_struct;
 extern void clear_page(void *page);
 extern void copy_page(void *to, void *from);
 
@@ -143,8 +146,15 @@ extern void copy_page(void *to, void *from);
  */
 
 #if DCACHE_WAY_SIZE > PAGE_SIZE
-extern void clear_user_page(void*, unsigned long, struct page*);
-extern void copy_user_page(void*, void*, unsigned long, struct page*);
+extern void clear_page_alias(void *vaddr, unsigned long paddr);
+extern void copy_page_alias(void *to, void *from,
+                            unsigned long to_paddr, unsigned long from_paddr);
+
+#define clear_user_highpage clear_user_highpage
+void clear_user_highpage(struct page *page, unsigned long vaddr);
+#define __HAVE_ARCH_COPY_USER_HIGHPAGE
+void copy_user_highpage(struct page *to, struct page *from,
+                        unsigned long vaddr, struct vm_area_struct *vma);
 #else
 # define clear_user_page(page, vaddr, pg)       clear_page(page)
 # define copy_user_page(to, from, vaddr, pg)    copy_page(to, from)
diff --git a/arch/xtensa/include/asm/pgtable.h b/arch/xtensa/include/asm/pgtable.h
index 4b0ca35a93b1..b2173e5da601 100644
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -67,7 +67,12 @@
 #define VMALLOC_START           0xC0000000
 #define VMALLOC_END             0xC7FEFFFF
 #define TLBTEMP_BASE_1          0xC7FF0000
-#define TLBTEMP_BASE_2          0xC7FF8000
+#define TLBTEMP_BASE_2          (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE)
+#if 2 * DCACHE_WAY_SIZE > ICACHE_WAY_SIZE
+#define TLBTEMP_SIZE            (2 * DCACHE_WAY_SIZE)
+#else
+#define TLBTEMP_SIZE            ICACHE_WAY_SIZE
+#endif
 
 /*
  * For the Xtensa architecture, the PTE layout is as follows:
diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h
index fd686dc45d1a..c7211e7e182d 100644
--- a/arch/xtensa/include/asm/uaccess.h
+++ b/arch/xtensa/include/asm/uaccess.h
@@ -52,7 +52,12 @@
  */
         .macro  get_fs  ad, sp
         GET_CURRENT(\ad,\sp)
+#if THREAD_CURRENT_DS > 1020
+        addi    \ad, \ad, TASK_THREAD
+        l32i    \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD
+#else
         l32i    \ad, \ad, THREAD_CURRENT_DS
+#endif
         .endm
 
 /*
diff --git a/arch/xtensa/include/uapi/asm/ioctls.h b/arch/xtensa/include/uapi/asm/ioctls.h
index b4cb1100c0fb..a47909f0c34b 100644
--- a/arch/xtensa/include/uapi/asm/ioctls.h
+++ b/arch/xtensa/include/uapi/asm/ioctls.h
@@ -28,17 +28,17 @@
 #define TCSETSW         0x5403
 #define TCSETSF         0x5404
 
-#define TCGETA          _IOR('t', 23, struct termio)
-#define TCSETA          _IOW('t', 24, struct termio)
-#define TCSETAW         _IOW('t', 25, struct termio)
-#define TCSETAF         _IOW('t', 28, struct termio)
+#define TCGETA          0x80127417      /* _IOR('t', 23, struct termio) */
+#define TCSETA          0x40127418      /* _IOW('t', 24, struct termio) */
+#define TCSETAW         0x40127419      /* _IOW('t', 25, struct termio) */
+#define TCSETAF         0x4012741C      /* _IOW('t', 28, struct termio) */
 
 #define TCSBRK          _IO('t', 29)
 #define TCXONC          _IO('t', 30)
 #define TCFLSH          _IO('t', 31)
 
-#define TIOCSWINSZ      _IOW('t', 103, struct winsize)
-#define TIOCGWINSZ      _IOR('t', 104, struct winsize)
+#define TIOCSWINSZ      0x40087467      /* _IOW('t', 103, struct winsize) */
+#define TIOCGWINSZ      0x80087468      /* _IOR('t', 104, struct winsize) */
 #define TIOCSTART       _IO('t', 110)           /* start output, like ^Q */
 #define TIOCSTOP        _IO('t', 111)           /* stop output, like ^S */
 #define TIOCOUTQ        _IOR('t', 115, int)     /* output queue size */
@@ -88,7 +88,6 @@
 #define TIOCSETD        _IOW('T', 35, int)
 #define TIOCGETD        _IOR('T', 36, int)
 #define TCSBRKP         _IOW('T', 37, int)   /* Needed for POSIX tcsendbreak()*/
-#define TIOCTTYGSTRUCT  _IOR('T', 38, struct tty_struct) /* For debugging only*/
 #define TIOCSBRK        _IO('T', 39)         /* BSD compatibility */
 #define TIOCCBRK        _IO('T', 40)         /* BSD compatibility */
 #define TIOCGSID        _IOR('T', 41, pid_t) /* Return the session ID of FD*/
@@ -114,8 +113,10 @@
 #define TIOCSERGETLSR   _IOR('T', 89, unsigned int) /* Get line status reg. */
   /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
 # define TIOCSER_TEMT    0x01                /* Transmitter physically empty */
-#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct) /* Get multiport config  */
-#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* Set multiport config */
+#define TIOCSERGETMULTI 0x80a8545a /* Get multiport config  */
+                        /* _IOR('T', 90, struct serial_multiport_struct) */
+#define TIOCSERSETMULTI 0x40a8545b /* Set multiport config */
+                        /* _IOW('T', 91, struct serial_multiport_struct) */
 
 #define TIOCMIWAIT      _IO('T', 92) /* wait for a change on serial input line(s) */
 #define TIOCGICOUNT     0x545D  /* read serial port inline interrupt counts */
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index b9395529f02d..8883fc877c5c 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -739,7 +739,10 @@ __SYSCALL(334, sys_sched_setattr, 2)
 #define __NR_sched_getattr                      335
 __SYSCALL(335, sys_sched_getattr, 3)
 
-#define __NR_syscall_count                      336
+#define __NR_renameat2                          336
+__SYSCALL(336, sys_renameat2, 5)
+
+#define __NR_syscall_count                      337
 
 /*
  * sysxtensa syscall handler
diff --git a/arch/xtensa/kernel/align.S b/arch/xtensa/kernel/align.S
index d4cef6039a5c..890004af03a9 100644
--- a/arch/xtensa/kernel/align.S
+++ b/arch/xtensa/kernel/align.S
@@ -8,6 +8,7 @@
  * this archive for more details.
  *
  * Copyright (C) 2001 - 2005 Tensilica, Inc.
+ * Copyright (C) 2014 Cadence Design Systems Inc.
  *
  * Rewritten by Chris Zankel <chris@zankel.net>
  *
@@ -174,6 +175,10 @@ ENTRY(fast_unaligned)
         s32i    a0, a2, PT_AREG2
         s32i    a3, a2, PT_AREG3
 
+        rsr     a3, excsave1
+        movi    a4, fast_unaligned_fixup
+        s32i    a4, a3, EXC_TABLE_FIXUP
+
         /* Keep value of SAR in a0 */
 
         rsr     a0, sar
@@ -225,10 +230,6 @@ ENTRY(fast_unaligned)
         addx8   a5, a6, a5
         jx      a5                      # jump into table
 
-        /* Invalid instruction, CRITICAL! */
-.Linvalid_instruction_load:
-        j       .Linvalid_instruction
-
         /* Load: Load memory address. */
 
 .Lload: movi    a3, ~3
@@ -272,18 +273,6 @@ ENTRY(fast_unaligned)
         /* Set target register. */
 
 1:
-
-#if XCHAL_HAVE_LOOPS
-        rsr     a5, lend                # check if we reached LEND
-        bne     a7, a5, 1f
-        rsr     a5, lcount              # and LCOUNT != 0
-        beqz    a5, 1f
-        addi    a5, a5, -1              # decrement LCOUNT and set
-        rsr     a7, lbeg                # set PC to LBEGIN
-        wsr     a5, lcount
-#endif
-
-1:      wsr     a7, epc1                # skip load instruction
         extui   a4, a4, INSN_T, 4       # extract target register
         movi    a5, .Lload_table
         addx8   a4, a4, a5
@@ -326,6 +315,35 @@ ENTRY(fast_unaligned)
         mov     a3, a14         ;       _j 1f;  .align 8
         mov     a3, a15         ;       _j 1f;  .align 8
 
+        /* We cannot handle this exception. */
+
+        .extern _kernel_exception
+.Linvalid_instruction_load:
+.Linvalid_instruction_store:
+
+        movi    a4, 0
+        rsr     a3, excsave1
+        s32i    a4, a3, EXC_TABLE_FIXUP
+
+        /* Restore a4...a8 and SAR, set SP, and jump to default exception. */
+
+        l32i    a8, a2, PT_AREG8
+        l32i    a7, a2, PT_AREG7
+        l32i    a6, a2, PT_AREG6
+        l32i    a5, a2, PT_AREG5
+        l32i    a4, a2, PT_AREG4
+        wsr     a0, sar
+        mov     a1, a2
+
+        rsr     a0, ps
+        bbsi.l  a0, PS_UM_BIT, 2f     # jump if user mode
+
+        movi    a0, _kernel_exception
+        jx      a0
+
+2:      movi    a0, _user_exception
+        jx      a0
+
 1:      # a7: instruction pointer, a4: instruction, a3: value
 
         movi    a6, 0                   # mask: ffffffff:00000000
@@ -353,17 +371,6 @@ ENTRY(fast_unaligned)
         /* Get memory address */
 
 1:
-#if XCHAL_HAVE_LOOPS
-        rsr     a4, lend                # check if we reached LEND
-        bne     a7, a4, 1f
-        rsr     a4, lcount              # and LCOUNT != 0
-        beqz    a4, 1f
-        addi    a4, a4, -1              # decrement LCOUNT and set
-        rsr     a7, lbeg                # set PC to LBEGIN
-        wsr     a4, lcount
-#endif
-
-1:      wsr     a7, epc1                # skip store instruction
         movi    a4, ~3
         and     a4, a4, a8              # align memory address
 
@@ -375,25 +382,25 @@ ENTRY(fast_unaligned)
 #endif
 
         __ssa8r a8
-        __src_b a7, a5, a6              # lo-mask  F..F0..0 (BE) 0..0F..F (LE)
+        __src_b a8, a5, a6              # lo-mask  F..F0..0 (BE) 0..0F..F (LE)
         __src_b a6, a6, a5              # hi-mask  0..0F..F (BE) F..F0..0 (LE)
 #ifdef UNALIGNED_USER_EXCEPTION
         l32e    a5, a4, -8
 #else
         l32i    a5, a4, 0               # load lower address word
 #endif
-        and     a5, a5, a7              # mask
-        __sh    a7, a3                  # shift value
-        or      a5, a5, a7              # or with original value
+        and     a5, a5, a8              # mask
+        __sh    a8, a3                  # shift value
+        or      a5, a5, a8              # or with original value
 #ifdef UNALIGNED_USER_EXCEPTION
         s32e    a5, a4, -8
-        l32e    a7, a4, -4
+        l32e    a8, a4, -4
 #else
         s32i    a5, a4, 0               # store
-        l32i    a7, a4, 4               # same for upper address word
+        l32i    a8, a4, 4               # same for upper address word
 #endif
         __sl    a5, a3
-        and     a6, a7, a6
+        and     a6, a8, a6
         or      a6, a6, a5
 #ifdef UNALIGNED_USER_EXCEPTION
         s32e    a6, a4, -4
@@ -401,9 +408,27 @@ ENTRY(fast_unaligned)
         s32i    a6, a4, 4
 #endif
 
-        /* Done. restore stack and return */
-
 .Lexit:
+#if XCHAL_HAVE_LOOPS
+        rsr     a4, lend                # check if we reached LEND
+        bne     a7, a4, 1f
+        rsr     a4, lcount              # and LCOUNT != 0
+        beqz    a4, 1f
+        addi    a4, a4, -1              # decrement LCOUNT and set
+        rsr     a7, lbeg                # set PC to LBEGIN
+        wsr     a4, lcount
+#endif
+
+1:      wsr     a7, epc1                # skip emulated instruction
+
+        /* Update icount if we're single-stepping in userspace. */
+        rsr     a4, icountlevel
+        beqz    a4, 1f
+        bgeui   a4, LOCKLEVEL + 1, 1f
+        rsr     a4, icount
+        addi    a4, a4, 1
+        wsr     a4, icount
+1:
         movi    a4, 0
         rsr     a3, excsave1
         s32i    a4, a3, EXC_TABLE_FIXUP
@@ -424,31 +449,40 @@ ENTRY(fast_unaligned)
         l32i    a2, a2, PT_AREG2
         rfe
 
-        /* We cannot handle this exception. */
+ENDPROC(fast_unaligned)
 
-        .extern _kernel_exception
-.Linvalid_instruction_store:
-.Linvalid_instruction:
+ENTRY(fast_unaligned_fixup)
 
-        /* Restore a4...a8 and SAR, set SP, and jump to default exception. */
+        l32i    a2, a3, EXC_TABLE_DOUBLE_SAVE
+        wsr     a3, excsave1
 
         l32i    a8, a2, PT_AREG8
         l32i    a7, a2, PT_AREG7
         l32i    a6, a2, PT_AREG6
         l32i    a5, a2, PT_AREG5
         l32i    a4, a2, PT_AREG4
+        l32i    a0, a2, PT_AREG2
+        xsr     a0, depc                        # restore depc and a0
         wsr     a0, sar
-        mov     a1, a2
+
+        rsr     a0, exccause
+        s32i    a0, a2, PT_DEPC                 # mark as a regular exception
 
         rsr     a0, ps
-        bbsi.l  a2, PS_UM_BIT, 1f     # jump if user mode
+        bbsi.l  a0, PS_UM_BIT, 1f               # jump if user mode
 
-        movi    a0, _kernel_exception
+        rsr     a0, exccause
+        addx4   a0, a0, a3                      # find entry in table
+        l32i    a0, a0, EXC_TABLE_FAST_KERNEL   # load handler
+        l32i    a3, a2, PT_AREG3
         jx      a0
-
-1:      movi    a0, _user_exception
+1:
+        rsr     a0, exccause
+        addx4   a0, a0, a3                      # find entry in table
+        l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
+        l32i    a3, a2, PT_AREG3
         jx      a0
 
-ENDPROC(fast_unaligned)
+ENDPROC(fast_unaligned_fixup)
 
 #endif /* XCHAL_UNALIGNED_LOAD_EXCEPTION || XCHAL_UNALIGNED_STORE_EXCEPTION */
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index ef7f4990722b..82bbfa5a05b3 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -986,6 +986,8 @@ ENDPROC(fast_syscall_unrecoverable)
  *              j done
  */
 
+#ifdef CONFIG_FAST_SYSCALL_XTENSA
+
 #define TRY                                                             \
         .section __ex_table, "a";                                       \
         .word   66f, 67f;                                               \
@@ -1001,9 +1003,8 @@ ENTRY(fast_syscall_xtensa)
         movi    a7, 4                   # sizeof(unsigned int)
         access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp
 
-        addi    a6, a6, -1              # assuming SYS_XTENSA_ATOMIC_SET = 1
-        _bgeui  a6, SYS_XTENSA_COUNT - 1, .Lill
-        _bnei   a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp
+        _bgeui  a6, SYS_XTENSA_COUNT, .Lill
+        _bnei   a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp
 
         /* Fall through for ATOMIC_CMP_SWP. */
 
@@ -1015,27 +1016,26 @@ TRY	s32i	a5, a3, 0		# different, modify value
         l32i    a7, a2, PT_AREG7        # restore a7
         l32i    a0, a2, PT_AREG0        # restore a0
         movi    a2, 1                   # and return 1
-        addi    a6, a6, 1               # restore a6 (really necessary?)
         rfe
 
 1:      l32i    a7, a2, PT_AREG7        # restore a7
         l32i    a0, a2, PT_AREG0        # restore a0
         movi    a2, 0                   # return 0 (note that we cannot set
-        addi    a6, a6, 1               # restore a6 (really necessary?)
         rfe
 
 .Lnswp: /* Atomic set, add, and exg_add. */
 
 TRY     l32i    a7, a3, 0               # orig
+        addi    a6, a6, -SYS_XTENSA_ATOMIC_SET
         add     a0, a4, a7              # + arg
         moveqz  a0, a4, a6              # set
+        addi    a6, a6, SYS_XTENSA_ATOMIC_SET
 TRY     s32i    a0, a3, 0               # write new value
 
         mov     a0, a2
         mov     a2, a7
         l32i    a7, a0, PT_AREG7        # restore a7
         l32i    a0, a0, PT_AREG0        # restore a0
-        addi    a6, a6, 1               # restore a6 (really necessary?)
         rfe
 
 CATCH
@@ -1044,13 +1044,25 @@ CATCH
         movi    a2, -EFAULT
         rfe
 
-.Lill:  l32i    a7, a2, PT_AREG0        # restore a7
+.Lill:  l32i    a7, a2, PT_AREG7        # restore a7
         l32i    a0, a2, PT_AREG0        # restore a0
         movi    a2, -EINVAL
         rfe
 
 ENDPROC(fast_syscall_xtensa)
 
+#else /* CONFIG_FAST_SYSCALL_XTENSA */
+
+ENTRY(fast_syscall_xtensa)
+
+        l32i    a0, a2, PT_AREG0        # restore a0
+        movi    a2, -ENOSYS
+        rfe
+
+ENDPROC(fast_syscall_xtensa)
+
+#endif /* CONFIG_FAST_SYSCALL_XTENSA */
+
 
 /* fast_syscall_spill_registers.
  *
@@ -1066,6 +1078,8 @@ ENDPROC(fast_syscall_xtensa)
  * Note: We assume the stack pointer is EXC_TABLE_KSTK in the fixup handler.
  */
 
+#ifdef CONFIG_FAST_SYSCALL_SPILL_REGISTERS
+
 ENTRY(fast_syscall_spill_registers)
 
         /* Register a FIXUP handler (pass current wb as a parameter) */
@@ -1400,6 +1414,18 @@ ENTRY(fast_syscall_spill_registers_fixup_return)
 
 ENDPROC(fast_syscall_spill_registers_fixup_return)
 
+#else /* CONFIG_FAST_SYSCALL_SPILL_REGISTERS */
+
+ENTRY(fast_syscall_spill_registers)
+
+        l32i    a0, a2, PT_AREG0        # restore a0
+        movi    a2, -ENOSYS
+        rfe
+
+ENDPROC(fast_syscall_spill_registers)
+
+#endif /* CONFIG_FAST_SYSCALL_SPILL_REGISTERS */
+
 #ifdef CONFIG_MMU
 /*
  * We should never get here. Bail out!
@@ -1565,7 +1591,7 @@ ENTRY(fast_second_level_miss)
         rsr     a0, excvaddr
         bltu    a0, a3, 2f
 
-        addi    a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT))
+        addi    a1, a0, -TLBTEMP_SIZE
         bgeu    a1, a3, 2f
 
         /* Check if we have to restore an ITLB mapping. */
@@ -1820,7 +1846,6 @@ ENTRY(_switch_to)
 
         entry   a1, 16
 
-        mov     a10, a2                 # preserve 'prev' (a2)
         mov     a11, a3                 # and 'next' (a3)
 
         l32i    a4, a2, TASK_THREAD_INFO
@@ -1828,8 +1853,14 @@ ENTRY(_switch_to)
 
         save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
 
-        s32i    a0, a10, THREAD_RA      # save return address
-        s32i    a1, a10, THREAD_SP      # save stack pointer
+#if THREAD_RA > 1020 || THREAD_SP > 1020
+        addi    a10, a2, TASK_THREAD
+        s32i    a0, a10, THREAD_RA - TASK_THREAD        # save return address
+        s32i    a1, a10, THREAD_SP - TASK_THREAD        # save stack pointer
+#else
+        s32i    a0, a2, THREAD_RA       # save return address
+        s32i    a1, a2, THREAD_SP       # save stack pointer
+#endif
 
         /* Disable ints while we manipulate the stack pointer. */
 
@@ -1870,7 +1901,6 @@ ENTRY(_switch_to)
         load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
 
         wsr     a14, ps
-        mov     a2, a10                 # return 'prev'
         rsync
 
         retw
diff --git a/arch/xtensa/kernel/pci-dma.c b/arch/xtensa/kernel/pci-dma.c
index 2d9cc6dbfd78..e8b76b8e4b29 100644
--- a/arch/xtensa/kernel/pci-dma.c
+++ b/arch/xtensa/kernel/pci-dma.c
@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,size_t size,dma_addr_t *handle,gfp_t flag)
 
         /* We currently don't support coherent memory outside KSEG */
 
-        if (ret < XCHAL_KSEG_CACHED_VADDR
-            || ret >= XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE)
-                BUG();
+        BUG_ON(ret < XCHAL_KSEG_CACHED_VADDR ||
+               ret > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
 
 
         if (ret != 0) {
@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent);
 void dma_free_coherent(struct device *hwdev, size_t size,
                          void *vaddr, dma_addr_t dma_handle)
 {
-        long addr=(long)vaddr+XCHAL_KSEG_CACHED_VADDR-XCHAL_KSEG_BYPASS_VADDR;
+        unsigned long addr = (unsigned long)vaddr +
+                XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR;
 
-        if (addr < 0 || addr >= XCHAL_KSEG_SIZE)
-                BUG();
+        BUG_ON(addr < XCHAL_KSEG_CACHED_VADDR ||
+               addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
 
         free_pages(addr, get_order(size));
 }
diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c
index 40b5a3771fb0..4d02e38514f5 100644
--- a/arch/xtensa/kernel/smp.c
+++ b/arch/xtensa/kernel/smp.c
@@ -571,6 +571,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
         };
         on_each_cpu(ipi_flush_icache_range, &fd, 1);
 }
+EXPORT_SYMBOL(flush_icache_range);
 
 /* ------------------------------------------------------------------------- */
 
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index eebbfd8c26fc..9d2f45f010ef 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -101,9 +101,8 @@ static dispatch_init_table_t __initdata dispatch_init_table[] = {
 #if XCHAL_UNALIGNED_LOAD_EXCEPTION || XCHAL_UNALIGNED_STORE_EXCEPTION
 #ifdef CONFIG_XTENSA_UNALIGNED_USER
 { EXCCAUSE_UNALIGNED,           USER,      fast_unaligned },
-#else
-{ EXCCAUSE_UNALIGNED,           0,         do_unaligned_user },
 #endif
+{ EXCCAUSE_UNALIGNED,           0,         do_unaligned_user },
 { EXCCAUSE_UNALIGNED,           KRNL,      fast_unaligned },
 #endif
 #ifdef CONFIG_MMU
@@ -264,7 +263,6 @@ do_illegal_instruction(struct pt_regs *regs)
  */
 
 #if XCHAL_UNALIGNED_LOAD_EXCEPTION || XCHAL_UNALIGNED_STORE_EXCEPTION
-#ifndef CONFIG_XTENSA_UNALIGNED_USER
 void
 do_unaligned_user (struct pt_regs *regs)
 {
@@ -286,7 +284,6 @@ do_unaligned_user (struct pt_regs *regs)
 
 }
 #endif
-#endif
 
 void
 do_debug(struct pt_regs *regs)
diff --git a/arch/xtensa/kernel/vectors.S b/arch/xtensa/kernel/vectors.S
index 8453e6e39895..1b397a902292 100644
--- a/arch/xtensa/kernel/vectors.S
+++ b/arch/xtensa/kernel/vectors.S
@@ -454,8 +454,14 @@ _DoubleExceptionVector_WindowOverflow:
         s32i    a0, a2, PT_DEPC
 
 _DoubleExceptionVector_handle_exception:
+        addi    a0, a0, -EXCCAUSE_UNALIGNED
+        beqz    a0, 2f
         addx4   a0, a0, a3
-        l32i    a0, a0, EXC_TABLE_FAST_USER
+        l32i    a0, a0, EXC_TABLE_FAST_USER + 4 * EXCCAUSE_UNALIGNED
+        xsr     a3, excsave1
+        jx      a0
+2:
+        movi    a0, user_exception
         xsr     a3, excsave1
         jx      a0
 
diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
index d16db6df86f8..fc1bc2ba8d5d 100644
--- a/arch/xtensa/kernel/vmlinux.lds.S
+++ b/arch/xtensa/kernel/vmlinux.lds.S
@@ -269,13 +269,13 @@ SECTIONS
                   .UserExceptionVector.literal)
   SECTION_VECTOR (_DoubleExceptionVector_literal,
                   .DoubleExceptionVector.literal,
-                  DOUBLEEXC_VECTOR_VADDR - 40,
+                  DOUBLEEXC_VECTOR_VADDR - 48,
                   SIZEOF(.UserExceptionVector.text),
                   .UserExceptionVector.text)
   SECTION_VECTOR (_DoubleExceptionVector_text,
                   .DoubleExceptionVector.text,
                   DOUBLEEXC_VECTOR_VADDR,
-                  40,
+                  48,
                   .DoubleExceptionVector.literal)
 
   . = (LOADADDR( .DoubleExceptionVector.text ) + SIZEOF( .DoubleExceptionVector.text ) + 3) & ~ 3;
diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
index 63cbb867dadd..d75aa1476da7 100644
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -59,9 +59,68 @@
  *
  */
 
-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && defined(CONFIG_HIGHMEM)
-#error "HIGHMEM is not supported on cores with aliasing cache."
-#endif
+#if (DCACHE_WAY_SIZE > PAGE_SIZE)
+static inline void kmap_invalidate_coherent(struct page *page,
+                                            unsigned long vaddr)
+{
+        if (!DCACHE_ALIAS_EQ(page_to_phys(page), vaddr)) {
+                unsigned long kvaddr;
+
+                if (!PageHighMem(page)) {
+                        kvaddr = (unsigned long)page_to_virt(page);
+
+                        __invalidate_dcache_page(kvaddr);
+                } else {
+                        kvaddr = TLBTEMP_BASE_1 +
+                                (page_to_phys(page) & DCACHE_ALIAS_MASK);
+
+                        __invalidate_dcache_page_alias(kvaddr,
+                                                       page_to_phys(page));
+                }
+        }
+}
+
+static inline void *coherent_kvaddr(struct page *page, unsigned long base,
+                                    unsigned long vaddr, unsigned long *paddr)
+{
+        if (PageHighMem(page) || !DCACHE_ALIAS_EQ(page_to_phys(page), vaddr)) {
+                *paddr = page_to_phys(page);
+                return (void *)(base + (vaddr & DCACHE_ALIAS_MASK));
+        } else {
+                *paddr = 0;
+                return page_to_virt(page);
+        }
+}
+
+void clear_user_highpage(struct page *page, unsigned long vaddr)
+{
+        unsigned long paddr;
+        void *kvaddr = coherent_kvaddr(page, TLBTEMP_BASE_1, vaddr, &paddr);
+
+        pagefault_disable();
+        kmap_invalidate_coherent(page, vaddr);
+        set_bit(PG_arch_1, &page->flags);
+        clear_page_alias(kvaddr, paddr);
+        pagefault_enable();
+}
+
+void copy_user_highpage(struct page *dst, struct page *src,
+                        unsigned long vaddr, struct vm_area_struct *vma)
+{
+        unsigned long dst_paddr, src_paddr;
+        void *dst_vaddr = coherent_kvaddr(dst, TLBTEMP_BASE_1, vaddr,
+                                          &dst_paddr);
+        void *src_vaddr = coherent_kvaddr(src, TLBTEMP_BASE_2, vaddr,
+                                          &src_paddr);
+
+        pagefault_disable();
+        kmap_invalidate_coherent(dst, vaddr);
+        set_bit(PG_arch_1, &dst->flags);
+        copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr);
+        pagefault_enable();
+}
+
+#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
 
 #if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
 
@@ -103,7 +162,8 @@ void flush_dcache_page(struct page *page)
                 if (!alias && !mapping)
                         return;
 
-                __flush_invalidate_dcache_page((long)page_address(page));
+                virt = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
+                __flush_invalidate_dcache_page_alias(virt, phys);
 
                 virt = TLBTEMP_BASE_1 + (temp & DCACHE_ALIAS_MASK);
 
@@ -168,13 +228,12 @@ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
 #if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
 
         if (!PageReserved(page) && test_bit(PG_arch_1, &page->flags)) {
-
-                unsigned long paddr = (unsigned long) page_address(page);
                 unsigned long phys = page_to_phys(page);
-                unsigned long tmp = TLBTEMP_BASE_1 + (addr & DCACHE_ALIAS_MASK);
-
-                __flush_invalidate_dcache_page(paddr);
+                unsigned long tmp;
 
+                tmp = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
+                __flush_invalidate_dcache_page_alias(tmp, phys);
+                tmp = TLBTEMP_BASE_1 + (addr & DCACHE_ALIAS_MASK);
                 __flush_invalidate_dcache_page_alias(tmp, phys);
                 __invalidate_icache_page_alias(tmp, phys);
 
diff --git a/arch/xtensa/mm/highmem.c b/arch/xtensa/mm/highmem.c
index 17a8c0d6fd17..8cfb71ec0937 100644
--- a/arch/xtensa/mm/highmem.c
+++ b/arch/xtensa/mm/highmem.c
@@ -14,23 +14,45 @@
 
 static pte_t *kmap_pte;
 
+#if DCACHE_WAY_SIZE > PAGE_SIZE
+unsigned int last_pkmap_nr_arr[DCACHE_N_COLORS];
+wait_queue_head_t pkmap_map_wait_arr[DCACHE_N_COLORS];
+
+static void __init kmap_waitqueues_init(void)
+{
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(pkmap_map_wait_arr); ++i)
+                init_waitqueue_head(pkmap_map_wait_arr + i);
+}
+#else
+static inline void kmap_waitqueues_init(void)
+{
+}
+#endif
+
+static inline enum fixed_addresses kmap_idx(int type, unsigned long color)
+{
+        return (type + KM_TYPE_NR * smp_processor_id()) * DCACHE_N_COLORS +
+                color;
+}
+
 void *kmap_atomic(struct page *page)
 {
         enum fixed_addresses idx;
         unsigned long vaddr;
-        int type;
 
         pagefault_disable();
         if (!PageHighMem(page))
                 return page_address(page);
 
-        type = kmap_atomic_idx_push();
-        idx = type + KM_TYPE_NR * smp_processor_id();
+        idx = kmap_idx(kmap_atomic_idx_push(),
+                       DCACHE_ALIAS(page_to_phys(page)));
         vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
 #ifdef CONFIG_DEBUG_HIGHMEM
-        BUG_ON(!pte_none(*(kmap_pte - idx)));
+        BUG_ON(!pte_none(*(kmap_pte + idx)));
 #endif
-        set_pte(kmap_pte - idx, mk_pte(page, PAGE_KERNEL_EXEC));
+        set_pte(kmap_pte + idx, mk_pte(page, PAGE_KERNEL_EXEC));
 
         return (void *)vaddr;
 }
@@ -38,12 +60,10 @@ EXPORT_SYMBOL(kmap_atomic);
 
 void __kunmap_atomic(void *kvaddr)
 {
-        int idx, type;
-
         if (kvaddr >= (void *)FIXADDR_START &&
             kvaddr < (void *)FIXADDR_TOP) {
-                type = kmap_atomic_idx();
-                idx = type + KM_TYPE_NR * smp_processor_id();
+                int idx = kmap_idx(kmap_atomic_idx(),
+                                   DCACHE_ALIAS((unsigned long)kvaddr));
 
                 /*
                  * Force other mappings to Oops if they'll try to access this
@@ -51,7 +71,7 @@ void __kunmap_atomic(void *kvaddr)
                  * is a bad idea also, in case the page changes cacheability
                  * attributes or becomes a protected page in a hypervisor.
                  */
-                pte_clear(&init_mm, kvaddr, kmap_pte - idx);
+                pte_clear(&init_mm, kvaddr, kmap_pte + idx);
                 local_flush_tlb_kernel_range((unsigned long)kvaddr,
                                              (unsigned long)kvaddr + PAGE_SIZE);
 
@@ -69,4 +89,5 @@ void __init kmap_init(void)
         /* cache the first kmap pte */
         kmap_vstart = __fix_to_virt(FIX_KMAP_BEGIN);
         kmap_pte = kmap_get_fixmap_pte(kmap_vstart);
+        kmap_waitqueues_init();
 }
diff --git a/arch/xtensa/mm/misc.S b/arch/xtensa/mm/misc.S
index 1f68558dbcc2..11a01c3e9cea 100644
--- a/arch/xtensa/mm/misc.S
+++ b/arch/xtensa/mm/misc.S
@@ -110,41 +110,24 @@ ENTRY(__tlbtemp_mapping_start)
 #if (DCACHE_WAY_SIZE > PAGE_SIZE)
 
 /*
- * clear_user_page (void *addr, unsigned long vaddr, struct page *page)
- *                     a2              a3                 a4
+ * clear_page_alias(void *addr, unsigned long paddr)
+ *                     a2              a3
  */
 
-ENTRY(clear_user_page)
+ENTRY(clear_page_alias)
 
         entry   a1, 32
 
-        /* Mark page dirty and determine alias. */
+        /* Skip setting up a temporary DTLB if not aliased low page. */
 
-        movi    a7, (1 << PG_ARCH_1)
-        l32i    a5, a4, PAGE_FLAGS
-        xor     a6, a2, a3
-        extui   a3, a3, PAGE_SHIFT, DCACHE_ALIAS_ORDER
-        extui   a6, a6, PAGE_SHIFT, DCACHE_ALIAS_ORDER
-        or      a5, a5, a7
-        slli    a3, a3, PAGE_SHIFT
-        s32i    a5, a4, PAGE_FLAGS
+        movi    a5, PAGE_OFFSET
+        movi    a6, 0
+        beqz    a3, 1f
 
-        /* Skip setting up a temporary DTLB if not aliased. */
-
-        beqz    a6, 1f
-
-        /* Invalidate kernel page. */
-
-        mov     a10, a2
-        call8   __invalidate_dcache_page
-
-        /* Setup a temporary DTLB with the color of the VPN */
-
-        movi    a4, ((PAGE_KERNEL | _PAGE_HW_WRITE) - PAGE_OFFSET) & 0xffffffff
-        movi    a5, TLBTEMP_BASE_1                      # virt
-        add     a6, a2, a4                              # ppn
-        add     a2, a5, a3                              # add 'color'
+        /* Setup a temporary DTLB for the addr. */
 
+        addi    a6, a3, (PAGE_KERNEL | _PAGE_HW_WRITE)
+        mov     a4, a2
         wdtlb   a6, a2
         dsync
 
@@ -165,62 +148,43 @@ ENTRY(clear_user_page)
 
         /* We need to invalidate the temporary idtlb entry, if any. */
 
-1:      addi    a2, a2, -PAGE_SIZE
-        idtlb   a2
+1:      idtlb   a4
         dsync
 
         retw
 
-ENDPROC(clear_user_page)
+ENDPROC(clear_page_alias)
 
 /*
- * copy_page_user (void *to, void *from, unsigned long vaddr, struct page *page)
- *                    a2          a3            a4                  a5
+ * copy_page_alias(void *to, void *from,
+ *                      a2        a3
+ *                 unsigned long to_paddr, unsigned long from_paddr)
+ *                               a4                      a5
  */
 
-ENTRY(copy_user_page)
+ENTRY(copy_page_alias)
 
         entry   a1, 32
 
-        /* Mark page dirty and determine alias for destination. */
-
-        movi    a8, (1 << PG_ARCH_1)
-        l32i    a9, a5, PAGE_FLAGS
-        xor     a6, a2, a4
-        xor     a7, a3, a4
-        extui   a4, a4, PAGE_SHIFT, DCACHE_ALIAS_ORDER
-        extui   a6, a6, PAGE_SHIFT, DCACHE_ALIAS_ORDER
-        extui   a7, a7, PAGE_SHIFT, DCACHE_ALIAS_ORDER
-        or      a9, a9, a8
-        slli    a4, a4, PAGE_SHIFT
-        s32i    a9, a5, PAGE_FLAGS
-        movi    a5, ((PAGE_KERNEL | _PAGE_HW_WRITE) - PAGE_OFFSET) & 0xffffffff
-
-        beqz    a6, 1f
-
-        /* Invalidate dcache */
-
-        mov     a10, a2
-        call8   __invalidate_dcache_page
+        /* Skip setting up a temporary DTLB for destination if not aliased. */
 
-        /* Setup a temporary DTLB with a matching color. */
+        movi    a6, 0
+        movi    a7, 0
+        beqz    a4, 1f
 
-        movi    a8, TLBTEMP_BASE_1                      # base
-        add     a6, a2, a5                              # ppn
-        add     a2, a8, a4                              # add 'color'
+        /* Setup a temporary DTLB for destination. */
 
+        addi    a6, a4, (PAGE_KERNEL | _PAGE_HW_WRITE)
         wdtlb   a6, a2
         dsync
 
-        /* Skip setting up a temporary DTLB for destination if not aliased. */
+        /* Skip setting up a temporary DTLB for source if not aliased. */
 
-1:      beqz    a7, 1f
+1:      beqz    a5, 1f
 
-        /* Setup a temporary DTLB with a matching color. */
+        /* Setup a temporary DTLB for source. */
 
-        movi    a8, TLBTEMP_BASE_2                      # base
-        add     a7, a3, a5                              # ppn
-        add     a3, a8, a4
+        addi    a7, a5, PAGE_KERNEL
         addi    a8, a3, 1                               # way1
 
         wdtlb   a7, a8
@@ -271,7 +235,7 @@ ENTRY(copy_user_page)
 
         retw
 
-ENDPROC(copy_user_page)
+ENDPROC(copy_page_alias)
 
 #endif
 
@@ -300,6 +264,30 @@ ENTRY(__flush_invalidate_dcache_page_alias)
         retw
 
 ENDPROC(__flush_invalidate_dcache_page_alias)
+
+/*
+ * void __invalidate_dcache_page_alias (addr, phys)
+ *                                       a2    a3
+ */
+
+ENTRY(__invalidate_dcache_page_alias)
+
+        entry   sp, 16
+
+        movi    a7, 0                   # required for exception handler
+        addi    a6, a3, (PAGE_KERNEL | _PAGE_HW_WRITE)
+        mov     a4, a2
+        wdtlb   a6, a2
+        dsync
+
+        ___invalidate_dcache_page a2 a3
+
+        idtlb   a4
+        dsync
+
+        retw
+
+ENDPROC(__invalidate_dcache_page_alias)
 #endif
 
 ENTRY(__tlbtemp_mapping_itlb)
diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
index 3429b483d9f8..abe4513eb0dd 100644
--- a/arch/xtensa/mm/mmu.c
+++ b/arch/xtensa/mm/mmu.c
@@ -18,32 +18,38 @@
 #include <asm/io.h>
 
 #if defined(CONFIG_HIGHMEM)
-static void * __init init_pmd(unsigned long vaddr)
+static void * __init init_pmd(unsigned long vaddr, unsigned long n_pages)
 {
         pgd_t *pgd = pgd_offset_k(vaddr);
         pmd_t *pmd = pmd_offset(pgd, vaddr);
+        pte_t *pte;
+        unsigned long i;
 
-        if (pmd_none(*pmd)) {
-                unsigned i;
-                pte_t *pte = alloc_bootmem_low_pages(PAGE_SIZE);
+        n_pages = ALIGN(n_pages, PTRS_PER_PTE);
 
-                for (i = 0; i < 1024; i++)
-                        pte_clear(NULL, 0, pte + i);
+        pr_debug("%s: vaddr: 0x%08lx, n_pages: %ld\n",
+                 __func__, vaddr, n_pages);
 
-                set_pmd(pmd, __pmd(((unsigned long)pte) & PAGE_MASK));
-                BUG_ON(pte != pte_offset_kernel(pmd, 0));
-                pr_debug("%s: vaddr: 0x%08lx, pmd: 0x%p, pte: 0x%p\n",
-                         __func__, vaddr, pmd, pte);
-                return pte;
-        } else {
-                return pte_offset_kernel(pmd, 0);
+        pte = alloc_bootmem_low_pages(n_pages * sizeof(pte_t));
+
+        for (i = 0; i < n_pages; ++i)
+                pte_clear(NULL, 0, pte + i);
+
+        for (i = 0; i < n_pages; i += PTRS_PER_PTE, ++pmd) {
+                pte_t *cur_pte = pte + i;
+
+                BUG_ON(!pmd_none(*pmd));
+                set_pmd(pmd, __pmd(((unsigned long)cur_pte) & PAGE_MASK));
+                BUG_ON(cur_pte != pte_offset_kernel(pmd, 0));
+                pr_debug("%s: pmd: 0x%p, pte: 0x%p\n",
+                         __func__, pmd, cur_pte);
         }
+        return pte;
 }
 
 static void __init fixedrange_init(void)
 {
-        BUILD_BUG_ON(FIXADDR_SIZE > PMD_SIZE);
-        init_pmd(__fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK);
+        init_pmd(__fix_to_virt(0), __end_of_fixed_addresses);
 }
 #endif
 
@@ -52,7 +58,7 @@ void __init paging_init(void)
         memset(swapper_pg_dir, 0, PAGE_SIZE);
 #ifdef CONFIG_HIGHMEM
         fixedrange_init();
-        pkmap_page_table = init_pmd(PKMAP_BASE);
+        pkmap_page_table = init_pmd(PKMAP_BASE, LAST_PKMAP);
         kmap_init();
 #endif
 }
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index bc423f7b02da..f14b4abbebd8 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -520,7 +520,7 @@ void bio_integrity_endio(struct bio *bio, int error)
          */
         if (error) {
                 bio->bi_end_io = bip->bip_end_io;
-                bio_endio(bio, error);
+                bio_endio_nodec(bio, error);
 
                 return;
         }
diff --git a/block/blk-core.c b/block/blk-core.c
index c359d72e9d76..bf930f481d43 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1252,7 +1252,6 @@ void blk_rq_set_block_pc(struct request *rq)
         rq->__sector = (sector_t) -1;
         rq->bio = rq->biotail = NULL;
         memset(rq->__cmd, 0, sizeof(rq->__cmd));
-        rq->cmd = rq->__cmd;
 }
 EXPORT_SYMBOL(blk_rq_set_block_pc);
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 5189cb1e478a..4aac82615a46 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -112,18 +112,22 @@ static void blk_mq_usage_counter_release(struct percpu_ref *ref)
  */
 void blk_mq_freeze_queue(struct request_queue *q)
 {
+        bool freeze;
+
         spin_lock_irq(q->queue_lock);
-        q->mq_freeze_depth++;
+        freeze = !q->mq_freeze_depth++;
         spin_unlock_irq(q->queue_lock);
 
-        percpu_ref_kill(&q->mq_usage_counter);
-        blk_mq_run_queues(q, false);
+        if (freeze) {
+                percpu_ref_kill(&q->mq_usage_counter);
+                blk_mq_run_queues(q, false);
+        }
         wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->mq_usage_counter));
 }
 
 static void blk_mq_unfreeze_queue(struct request_queue *q)
 {
-        bool wake = false;
+        bool wake;
 
         spin_lock_irq(q->queue_lock);
         wake = !--q->mq_freeze_depth;
@@ -172,6 +176,8 @@ static void blk_mq_rq_ctx_init(struct request_queue *q, struct blk_mq_ctx *ctx,
         /* tag was already set */
         rq->errors = 0;
 
+        rq->cmd = rq->__cmd;
+
         rq->extra_len = 0;
         rq->sense_len = 0;
         rq->resid_len = 0;
@@ -1068,13 +1074,17 @@ static void blk_mq_bio_to_request(struct request *rq, struct bio *bio)
                 blk_account_io_start(rq, 1);
 }
 
+static inline bool hctx_allow_merges(struct blk_mq_hw_ctx *hctx)
+{
+        return (hctx->flags & BLK_MQ_F_SHOULD_MERGE) &&
+                !blk_queue_nomerges(hctx->queue);
+}
+
 static inline bool blk_mq_merge_queue_io(struct blk_mq_hw_ctx *hctx,
                                          struct blk_mq_ctx *ctx,
                                          struct request *rq, struct bio *bio)
 {
-        struct request_queue *q = hctx->queue;
-
-        if (!(hctx->flags & BLK_MQ_F_SHOULD_MERGE)) {
+        if (!hctx_allow_merges(hctx)) {
                 blk_mq_bio_to_request(rq, bio);
                 spin_lock(&ctx->lock);
 insert_rq:
@@ -1082,6 +1092,8 @@ insert_rq:
                 spin_unlock(&ctx->lock);
                 return false;
         } else {
+                struct request_queue *q = hctx->queue;
+
                 spin_lock(&ctx->lock);
                 if (!blk_mq_attempt_merge(q, ctx, bio)) {
                         blk_mq_bio_to_request(rq, bio);
@@ -1574,7 +1586,7 @@ static int blk_mq_init_hw_queues(struct request_queue *q,
                 hctx->tags = set->tags[i];
 
                 /*
-                 * Allocate space for all possible cpus to avoid allocation in
+                 * Allocate space for all possible cpus to avoid allocation at
                  * runtime
                  */
                 hctx->ctxs = kmalloc_node(nr_cpu_ids * sizeof(void *),
@@ -1662,8 +1674,8 @@ static void blk_mq_map_swqueue(struct request_queue *q)
 
         queue_for_each_hw_ctx(q, hctx, i) {
                 /*
-                 * If not software queues are mapped to this hardware queue,
-                 * disable it and free the request entries
+                 * If no software queues are mapped to this hardware queue,
+                 * disable it and free the request entries.
                  */
                 if (!hctx->nr_ctx) {
                         struct blk_mq_tag_set *set = q->tag_set;
@@ -1713,14 +1725,10 @@ static void blk_mq_del_queue_tag_set(struct request_queue *q)
 {
         struct blk_mq_tag_set *set = q->tag_set;
 
-        blk_mq_freeze_queue(q);
-
         mutex_lock(&set->tag_list_lock);
         list_del_init(&q->tag_set_list);
         blk_mq_update_tag_set_depth(set);
         mutex_unlock(&set->tag_list_lock);
-
-        blk_mq_unfreeze_queue(q);
 }
 
 static void blk_mq_add_queue_tag_set(struct blk_mq_tag_set *set,
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index cadc37841744..3f31cf9508e6 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1272,15 +1272,22 @@ __cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
         rb_insert_color(&cfqg->rb_node, &st->rb);
 }
 
+/*
+ * This has to be called only on activation of cfqg
+ */
 static void
 cfq_update_group_weight(struct cfq_group *cfqg)
 {
-        BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
-
         if (cfqg->new_weight) {
                 cfqg->weight = cfqg->new_weight;
                 cfqg->new_weight = 0;
         }
+}
+
+static void
+cfq_update_group_leaf_weight(struct cfq_group *cfqg)
+{
+        BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
 
         if (cfqg->new_leaf_weight) {
                 cfqg->leaf_weight = cfqg->new_leaf_weight;
@@ -1299,7 +1306,12 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
         /* add to the service tree */
         BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
 
-        cfq_update_group_weight(cfqg);
+        /*
+         * Update leaf_weight.  We cannot update weight at this point
+         * because cfqg might already have been activated and is
+         * contributing its current weight to the parent's child_weight.
+         */
+        cfq_update_group_leaf_weight(cfqg);
         __cfq_group_service_tree_add(st, cfqg);
 
         /*
@@ -1323,6 +1335,7 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
          */
         while ((parent = cfqg_parent(pos))) {
                 if (propagate) {
+                        cfq_update_group_weight(pos);
                         propagate = !parent->nr_active++;
                         parent->children_weight += pos->weight;
                 }
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 51bf5155ee75..9b8eaeca6a79 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -279,7 +279,6 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
         r = blk_rq_unmap_user(bio);
         if (!ret)
                 ret = r;
-        blk_put_request(rq);
 
         return ret;
 }
@@ -297,8 +296,6 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
 
         if (hdr->interface_id != 'S')
                 return -EINVAL;
-        if (hdr->cmd_len > BLK_MAX_CDB)
-                return -EINVAL;
 
         if (hdr->dxfer_len > (queue_max_hw_sectors(q) << 9))
                 return -EIO;
@@ -317,16 +314,23 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
         if (hdr->flags & SG_FLAG_Q_AT_HEAD)
                 at_head = 1;
 
+        ret = -ENOMEM;
         rq = blk_get_request(q, writing ? WRITE : READ, GFP_KERNEL);
         if (!rq)
-                return -ENOMEM;
+                goto out;
         blk_rq_set_block_pc(rq);
 
-        if (blk_fill_sghdr_rq(q, rq, hdr, mode)) {
-                blk_put_request(rq);
-                return -EFAULT;
+        if (hdr->cmd_len > BLK_MAX_CDB) {
+                rq->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL);
+                if (!rq->cmd)
+                        goto out_put_request;
         }
 
+        ret = -EFAULT;
+        if (blk_fill_sghdr_rq(q, rq, hdr, mode))
+                goto out_free_cdb;
+
+        ret = 0;
         if (hdr->iovec_count) {
                 size_t iov_data_len;
                 struct iovec *iov = NULL;
@@ -335,7 +339,7 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
                                             0, NULL, &iov);
                 if (ret < 0) {
                         kfree(iov);
-                        goto out;
+                        goto out_free_cdb;
                 }
 
                 iov_data_len = ret;
@@ -358,7 +362,7 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
                                       GFP_KERNEL);
 
         if (ret)
-                goto out;
+                goto out_free_cdb;
 
         bio = rq->bio;
         memset(sense, 0, sizeof(sense));
@@ -376,9 +380,14 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
 
         hdr->duration = jiffies_to_msecs(jiffies - start_time);
 
-        return blk_complete_sghdr_rq(rq, hdr, bio);
-out:
+        ret = blk_complete_sghdr_rq(rq, hdr, bio);
+
+out_free_cdb:
+        if (rq->cmd != rq->__cmd)
+                kfree(rq->cmd);
+out_put_request:
         blk_put_request(rq);
+out:
         return ret;
 }
 
@@ -448,6 +457,11 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
         }
 
         rq = blk_get_request(q, in_len ? WRITE : READ, __GFP_WAIT);
+        if (!rq) {
+                err = -ENOMEM;
+                goto error;
+        }
+        blk_rq_set_block_pc(rq);
 
         cmdlen = COMMAND_SIZE(opcode);
 
@@ -501,7 +515,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
         memset(sense, 0, sizeof(sense));
         rq->sense = sense;
         rq->sense_len = 0;
-        blk_rq_set_block_pc(rq);
 
         blk_execute_rq(q, disk, rq, 0);
 
@@ -521,7 +534,8 @@ out:
         
 error:
         kfree(buffer);
-        blk_put_request(rq);
+        if (rq)
+                blk_put_request(rq);
         return err;
 }
 EXPORT_SYMBOL_GPL(sg_scsi_ioctl);
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index 97eb001960b9..2f6e4fb1a1ea 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -121,6 +121,7 @@ static int public_key_verify_signature_2(const struct key *key,
 struct asymmetric_key_subtype public_key_subtype = {
         .owner                  = THIS_MODULE,
         .name                   = "public_key",
+        .name_len               = sizeof("public_key") - 1,
         .describe               = public_key_describe,
         .destroy                = public_key_destroy,
         .verify_signature       = public_key_verify_signature_2,
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index 79175e6ea0b2..2421f46184ce 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -128,6 +128,7 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
 {
         struct win_certificate wrapper;
         const u8 *pkcs7;
+        unsigned len;
 
         if (ctx->sig_len < sizeof(wrapper)) {
                 pr_debug("Signature wrapper too short\n");
@@ -154,33 +155,49 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
                 return -ENOTSUPP;
         }
 
-        /* Looks like actual pkcs signature length is in wrapper->length.
-         * size obtained from data dir entries lists the total size of
-         * certificate table which is also aligned to octawrod boundary.
-         *
-         * So set signature length field appropriately.
+        /* It looks like the pkcs signature length in wrapper->length and the
+         * size obtained from the data dir entries, which lists the total size
+         * of certificate table, are both aligned to an octaword boundary, so
+         * we may have to deal with some padding.
          */
         ctx->sig_len = wrapper.length;
         ctx->sig_offset += sizeof(wrapper);
         ctx->sig_len -= sizeof(wrapper);
-        if (ctx->sig_len == 0) {
+        if (ctx->sig_len < 4) {
                 pr_debug("Signature data missing\n");
                 return -EKEYREJECTED;
         }
 
-        /* What's left should a PKCS#7 cert */
+        /* What's left should be a PKCS#7 cert */
         pkcs7 = pebuf + ctx->sig_offset;
-        if (pkcs7[0] == (ASN1_CONS_BIT | ASN1_SEQ)) {
-                if (pkcs7[1] == 0x82 &&
-                    pkcs7[2] == (((ctx->sig_len - 4) >> 8) & 0xff) &&
-                    pkcs7[3] ==  ((ctx->sig_len - 4)       & 0xff))
-                        return 0;
-                if (pkcs7[1] == 0x80)
-                        return 0;
-                if (pkcs7[1] > 0x82)
-                        return -EMSGSIZE;
+        if (pkcs7[0] != (ASN1_CONS_BIT | ASN1_SEQ))
+                goto not_pkcs7;
+
+        switch (pkcs7[1]) {
+        case 0 ... 0x7f:
+                len = pkcs7[1] + 2;
+                goto check_len;
+        case ASN1_INDEFINITE_LENGTH:
+                return 0;
+        case 0x81:
+                len = pkcs7[2] + 3;
+                goto check_len;
+        case 0x82:
+                len = ((pkcs7[2] << 8) | pkcs7[3]) + 4;
+                goto check_len;
+        case 0x83 ... 0xff:
+                return -EMSGSIZE;
+        default:
+                goto not_pkcs7;
         }
 
+check_len:
+        if (len <= ctx->sig_len) {
+                /* There may be padding */
+                ctx->sig_len = len;
+                return 0;
+        }
+not_pkcs7:
         pr_debug("Signature data not PKCS#7\n");
         return -ELIBBAD;
 }
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index ce06149088c5..9dfec48dd4e5 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -196,6 +196,17 @@ static struct lpss_device_desc byt_i2c_dev_desc = {
         .setup = lpss_i2c_setup,
 };
 
+static struct lpss_shared_clock bsw_pwm_clock = {
+        .name = "pwm_clk",
+        .rate = 19200000,
+};
+
+static struct lpss_device_desc bsw_pwm_dev_desc = {
+        .clk_required = true,
+        .save_ctx = true,
+        .shared_clock = &bsw_pwm_clock,
+};
+
 #else
 
 #define LPSS_ADDR(desc) (0UL)
@@ -225,6 +236,12 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
         { "INT33B2", },
         { "INT33FC", },
 
+        /* Braswell LPSS devices */
+        { "80862288", LPSS_ADDR(bsw_pwm_dev_desc) },
+        { "8086228A", LPSS_ADDR(byt_uart_dev_desc) },
+        { "8086228E", LPSS_ADDR(byt_spi_dev_desc) },
+        { "808622C1", LPSS_ADDR(byt_i2c_dev_desc) },
+
         { "INT3430", LPSS_ADDR(lpt_dev_desc) },
         { "INT3431", LPSS_ADDR(lpt_dev_desc) },
         { "INT3432", LPSS_ADDR(lpt_i2c_dev_desc) },
diff --git a/drivers/acpi/acpica/nsprepkg.c b/drivers/acpi/acpica/nsprepkg.c
index 68f725839eb6..1b13b921dda9 100644
--- a/drivers/acpi/acpica/nsprepkg.c
+++ b/drivers/acpi/acpica/nsprepkg.c
@@ -316,6 +316,45 @@ acpi_ns_check_package(struct acpi_evaluate_info *info,
                     acpi_ns_check_package_list(info, package, elements, count);
                 break;
 
+        case ACPI_PTYPE2_UUID_PAIR:
+
+                /* The package must contain pairs of (UUID + type) */
+
+                if (count & 1) {
+                        expected_count = count + 1;
+                        goto package_too_small;
+                }
+
+                while (count > 0) {
+                        status = acpi_ns_check_object_type(info, elements,
+                                                           package->ret_info.
+                                                           object_type1, 0);
+                        if (ACPI_FAILURE(status)) {
+                                return (status);
+                        }
+
+                        /* Validate length of the UUID buffer */
+
+                        if ((*elements)->buffer.length != 16) {
+                                ACPI_WARN_PREDEFINED((AE_INFO,
+                                                      info->full_pathname,
+                                                      info->node_flags,
+                                                      "Invalid length for UUID Buffer"));
+                                return (AE_AML_OPERAND_VALUE);
+                        }
+
+                        status = acpi_ns_check_object_type(info, elements + 1,
+                                                           package->ret_info.
+                                                           object_type2, 0);
+                        if (ACPI_FAILURE(status)) {
+                                return (status);
+                        }
+
+                        elements += 2;
+                        count -= 2;
+                }
+                break;
+
         default:
 
                 /* Should not get here if predefined info table is correct */
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index a66ab658abbc..cb6066c809ea 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -197,6 +197,8 @@ static bool advance_transaction(struct acpi_ec *ec)
                                 t->rdata[t->ri++] = acpi_ec_read_data(ec);
                                 if (t->rlen == t->ri) {
                                         t->flags |= ACPI_EC_COMMAND_COMPLETE;
+                                        if (t->command == ACPI_EC_COMMAND_QUERY)
+                                                pr_debug("hardware QR_EC completion\n");
                                         wakeup = true;
                                 }
                         } else
@@ -208,7 +210,20 @@ static bool advance_transaction(struct acpi_ec *ec)
                 }
                 return wakeup;
         } else {
-                if ((status & ACPI_EC_FLAG_IBF) == 0) {
+                /*
+                 * There is firmware refusing to respond QR_EC when SCI_EVT
+                 * is not set, for which case, we complete the QR_EC
+                 * without issuing it to the firmware.
+                 * https://bugzilla.kernel.org/show_bug.cgi?id=86211
+                 */
+                if (!(status & ACPI_EC_FLAG_SCI) &&
+                    (t->command == ACPI_EC_COMMAND_QUERY)) {
+                        t->flags |= ACPI_EC_COMMAND_POLL;
+                        t->rdata[t->ri++] = 0x00;
+                        t->flags |= ACPI_EC_COMMAND_COMPLETE;
+                        pr_debug("software QR_EC completion\n");
+                        wakeup = true;
+                } else if ((status & ACPI_EC_FLAG_IBF) == 0) {
                         acpi_ec_write_cmd(ec, t->command);
                         t->flags |= ACPI_EC_COMMAND_POLL;
                 } else
@@ -288,11 +303,11 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
         /* following two actions should be kept atomic */
         ec->curr = t;
         start_transaction(ec);
-        if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
-                clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
         spin_unlock_irqrestore(&ec->lock, tmp);
         ret = ec_poll(ec);
         spin_lock_irqsave(&ec->lock, tmp);
+        if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
+                clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
         ec->curr = NULL;
         spin_unlock_irqrestore(&ec->lock, tmp);
         return ret;
@@ -1015,6 +1030,10 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
         DMI_MATCH(DMI_SYS_VENDOR, "Quanta"),
         DMI_MATCH(DMI_PRODUCT_NAME, "TW9/SW9"),}, NULL},
         {
+        ec_flag_msi, "Clevo W350etq", {
+        DMI_MATCH(DMI_SYS_VENDOR, "CLEVO CO."),
+        DMI_MATCH(DMI_PRODUCT_NAME, "W35_37ET"),}, NULL},
+        {
         ec_validate_ecdt, "ASUS hardware", {
         DMI_MATCH(DMI_BIOS_VENDOR, "ASUS") }, NULL},
         {
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index c96887d5289e..6e6b80eb0bba 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -484,6 +484,10 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
         /* Keep IOAPIC pin configuration when suspending */
         if (dev->dev.power.is_prepared)
                 return;
+#ifdef  CONFIG_PM_RUNTIME
+        if (dev->dev.power.runtime_status == RPM_SUSPENDING)
+                return;
+#endif
 
         entry = acpi_pci_irq_lookup(dev, pin);
         if (!entry)
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 3dca36d4ad26..17f9ec501972 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1071,9 +1071,9 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
 
         if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) {
 
-                cpuidle_pause_and_lock();
                 /* Protect against cpu-hotplug */
                 get_online_cpus();
+                cpuidle_pause_and_lock();
 
                 /* Disable all cpuidle devices */
                 for_each_online_cpu(cpu) {
@@ -1100,8 +1100,8 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
                                 cpuidle_enable_device(dev);
                         }
                 }
-                put_online_cpus();
                 cpuidle_resume_and_unlock();
+                put_online_cpus();
         }
 
         return 0;
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 0a817ad24f16..3bf7764659a4 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -667,8 +667,14 @@ static ssize_t
 acpi_device_sun_show(struct device *dev, struct device_attribute *attr,
                      char *buf) {
         struct acpi_device *acpi_dev = to_acpi_device(dev);
+        acpi_status status;
+        unsigned long long sun;
+
+        status = acpi_evaluate_integer(acpi_dev->handle, "_SUN", NULL, &sun);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
 
-        return sprintf(buf, "%lu\n", acpi_dev->pnp.sun);
+        return sprintf(buf, "%llu\n", sun);
 }
 static DEVICE_ATTR(sun, 0444, acpi_device_sun_show, NULL);
 
@@ -690,7 +696,6 @@ static int acpi_device_setup_files(struct acpi_device *dev)
 {
         struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
         acpi_status status;
-        unsigned long long sun;
         int result = 0;
 
         /*
@@ -731,14 +736,10 @@ static int acpi_device_setup_files(struct acpi_device *dev)
         if (dev->pnp.unique_id)
                 result = device_create_file(&dev->dev, &dev_attr_uid);
 
-        status = acpi_evaluate_integer(dev->handle, "_SUN", NULL, &sun);
-        if (ACPI_SUCCESS(status)) {
-                dev->pnp.sun = (unsigned long)sun;
+        if (acpi_has_method(dev->handle, "_SUN")) {
                 result = device_create_file(&dev->dev, &dev_attr_sun);
                 if (result)
                         goto end;
-        } else {
-                dev->pnp.sun = (unsigned long)-1;
         }
 
         if (acpi_has_method(dev->handle, "_STA")) {
@@ -922,12 +923,17 @@ static void acpi_device_notify(acpi_handle handle, u32 event, void *data)
         device->driver->ops.notify(device, event);
 }
 
-static acpi_status acpi_device_notify_fixed(void *data)
+static void acpi_device_notify_fixed(void *data)
 {
         struct acpi_device *device = data;
 
         /* Fixed hardware devices have no handles */
         acpi_device_notify(NULL, ACPI_FIXED_HARDWARE_EVENT, device);
+}
+
+static acpi_status acpi_device_fixed_event(void *data)
+{
+        acpi_os_execute(OSL_NOTIFY_HANDLER, acpi_device_notify_fixed, data);
         return AE_OK;
 }
 
@@ -938,12 +944,12 @@ static int acpi_device_install_notify_handler(struct acpi_device *device)
         if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
                 status =
                     acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
-                                                     acpi_device_notify_fixed,
+                                                     acpi_device_fixed_event,
                                                      device);
         else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
                 status =
                     acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
-                                                     acpi_device_notify_fixed,
+                                                     acpi_device_fixed_event,
                                                      device);
         else
                 status = acpi_install_notify_handler(device->handle,
@@ -960,10 +966,10 @@ static void acpi_device_remove_notify_handler(struct acpi_device *device)
 {
         if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
                 acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
-                                                acpi_device_notify_fixed);
+                                                acpi_device_fixed_event);
         else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
                 acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
-                                                acpi_device_notify_fixed);
+                                                acpi_device_fixed_event);
         else
                 acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY,
                                            acpi_device_notify);
@@ -975,7 +981,7 @@ static int acpi_device_probe(struct device *dev)
         struct acpi_driver *acpi_drv = to_acpi_driver(dev->driver);
         int ret;
 
-        if (acpi_dev->handler)
+        if (acpi_dev->handler && !acpi_is_pnp_device(acpi_dev))
                 return -EINVAL;
 
         if (!acpi_drv->ops.add)
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 826884392e6b..fcbda105616e 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -82,9 +82,9 @@ module_param(allow_duplicates, bool, 0644);
  * For Windows 8 systems: used to decide if video module
  * should skip registering backlight interface of its own.
  */
-static int use_native_backlight_param = 1;
+static int use_native_backlight_param = -1;
 module_param_named(use_native_backlight, use_native_backlight_param, int, 0444);
-static bool use_native_backlight_dmi = false;
+static bool use_native_backlight_dmi = true;
 
 static int register_count;
 static struct mutex video_list_lock;
@@ -417,6 +417,12 @@ static int __init video_set_use_native_backlight(const struct dmi_system_id *d)
         return 0;
 }
 
+static int __init video_disable_native_backlight(const struct dmi_system_id *d)
+{
+        use_native_backlight_dmi = false;
+        return 0;
+}
+
 static struct dmi_system_id video_dmi_table[] __initdata = {
         /*
          * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
@@ -720,6 +726,41 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8780w"),
                 },
         },
+
+        /*
+         * These models have a working acpi_video backlight control, and using
+         * native backlight causes a regression where backlight does not work
+         * when userspace is not handling brightness key events. Disable
+         * native_backlight on these to fix this:
+         * https://bugzilla.kernel.org/show_bug.cgi?id=81691
+         */
+        {
+         .callback = video_disable_native_backlight,
+         .ident = "ThinkPad T420",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T420"),
+                },
+        },
+        {
+         .callback = video_disable_native_backlight,
+         .ident = "ThinkPad T520",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T520"),
+                },
+        },
+
+        /* The native backlight controls do not work on some older machines */
+        {
+         /* https://bugs.freedesktop.org/show_bug.cgi?id=81515 */
+         .callback = video_disable_native_backlight,
+         .ident = "HP ENVY 15 Notebook",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index a29f8012fb08..a0cc0edafc78 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -305,6 +305,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
         { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
         { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */
+        { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */
+        { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -442,6 +450,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9182 */
+        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 on some Gigabyte */
@@ -1329,6 +1339,18 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         else if (pdev->vendor == 0x1c44 && pdev->device == 0x8000)
                 ahci_pci_bar = AHCI_PCI_BAR_ENMOTUS;
 
+        /*
+         * The JMicron chip 361/363 contains one SATA controller and one
+         * PATA controller,for powering on these both controllers, we must
+         * follow the sequence one by one, otherwise one of them can not be
+         * powered on successfully, so here we disable the async suspend
+         * method for these chips.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_JMICRON &&
+                (pdev->device == PCI_DEVICE_ID_JMICRON_JMB363 ||
+                pdev->device == PCI_DEVICE_ID_JMICRON_JMB361))
+                device_disable_async_suspend(&pdev->dev);
+
         /* acquire resources */
         rc = pcim_enable_device(pdev);
         if (rc)
diff --git a/drivers/ata/ahci_tegra.c b/drivers/ata/ahci_tegra.c
index f1fef74e503c..032904402c95 100644
--- a/drivers/ata/ahci_tegra.c
+++ b/drivers/ata/ahci_tegra.c
@@ -18,14 +18,17 @@
  */
 
 #include <linux/ahci_platform.h>
-#include <linux/reset.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/consumer.h>
+#include <linux/reset.h>
+
+#include <soc/tegra/fuse.h>
 #include <soc/tegra/pmc.h>
+
 #include "ahci.h"
 
 #define SATA_CONFIGURATION_0                            0x180
@@ -180,9 +183,12 @@ static int tegra_ahci_controller_init(struct ahci_host_priv *hpriv)
 
         /* Pad calibration */
 
-        /* FIXME Always use calibration 0. Change this to read the calibration
-         * fuse once the fuse driver has landed. */
-        val = 0;
+        ret = tegra_fuse_readl(FUSE_SATA_CALIB, &val);
+        if (ret) {
+                dev_err(&tegra->pdev->dev,
+                        "failed to read calibration fuse: %d\n", ret);
+                return ret;
+        }
 
         calib = tegra124_pad_calibration[val & FUSE_SATA_CALIB_MASK];
 
diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c
index c6962300b93c..f03aab187f4d 100644
--- a/drivers/ata/ahci_xgene.c
+++ b/drivers/ata/ahci_xgene.c
@@ -78,6 +78,9 @@
 #define CFG_MEM_RAM_SHUTDOWN            0x00000070
 #define BLOCK_MEM_RDY                   0x00000074
 
+/* Max retry for link down */
+#define MAX_LINK_DOWN_RETRY 3
+
 struct xgene_ahci_context {
         struct ahci_host_priv *hpriv;
         struct device *dev;
@@ -145,6 +148,14 @@ static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc)
         return rc;
 }
 
+static bool xgene_ahci_is_memram_inited(struct xgene_ahci_context *ctx)
+{
+        void __iomem *diagcsr = ctx->csr_diag;
+
+        return (readl(diagcsr + CFG_MEM_RAM_SHUTDOWN) == 0 &&
+                readl(diagcsr + BLOCK_MEM_RDY) == 0xFFFFFFFF);
+}
+
 /**
  * xgene_ahci_read_id - Read ID data from the specified device
  * @dev: device
@@ -229,8 +240,11 @@ static void xgene_ahci_set_phy_cfg(struct xgene_ahci_context *ctx, int channel)
  * and Gen1 (1.5Gbps). Otherwise during long IO stress test, the PHY will
  * report disparity error and etc. In addition, during COMRESET, there can
  * be error reported in the register PORT_SCR_ERR. For SERR_DISPARITY and
- * SERR_10B_8B_ERR, the PHY receiver line must be reseted. The following
- * algorithm is followed to proper configure the hardware PHY during COMRESET:
+ * SERR_10B_8B_ERR, the PHY receiver line must be reseted. Also during long
+ * reboot cycle regression, sometimes the PHY reports link down even if the
+ * device is present because of speed negotiation failure. so need to retry
+ * the COMRESET to get the link up. The following algorithm is followed to
+ * proper configure the hardware PHY during COMRESET:
  *
  * Alg Part 1:
  * 1. Start the PHY at Gen3 speed (default setting)
@@ -246,9 +260,15 @@ static void xgene_ahci_set_phy_cfg(struct xgene_ahci_context *ctx, int channel)
  * Alg Part 2:
  * 1. On link up, if there are any SERR_DISPARITY and SERR_10B_8B_ERR error
  *    reported in the register PORT_SCR_ERR, then reset the PHY receiver line
- * 2. Go to Alg Part 3
+ * 2. Go to Alg Part 4
  *
  * Alg Part 3:
+ * 1. Check the PORT_SCR_STAT to see whether device presence detected but PHY
+ *    communication establishment failed and maximum link down attempts are
+ *    less than Max attempts 3 then goto Alg Part 1.
+ * 2. Go to Alg Part 4.
+ *
+ * Alg Part 4:
  * 1. Clear any pending from register PORT_SCR_ERR.
  *
  * NOTE: For the initial version, we will NOT support Gen1/Gen2. In addition
@@ -267,19 +287,27 @@ static int xgene_ahci_do_hardreset(struct ata_link *link,
         u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
         void __iomem *port_mmio = ahci_port_base(ap);
         struct ata_taskfile tf;
+        int link_down_retry = 0;
         int rc;
-        u32 val;
-
-        /* clear D2H reception area to properly wait for D2H FIS */
-        ata_tf_init(link->device, &tf);
-        tf.command = ATA_BUSY;
-        ata_tf_to_fis(&tf, 0, 0, d2h_fis);
-        rc = sata_link_hardreset(link, timing, deadline, online,
+        u32 val, sstatus;
+
+        do {
+                /* clear D2H reception area to properly wait for D2H FIS */
+                ata_tf_init(link->device, &tf);
+                tf.command = ATA_BUSY;
+                ata_tf_to_fis(&tf, 0, 0, d2h_fis);
+                rc = sata_link_hardreset(link, timing, deadline, online,
                                  ahci_check_ready);
+                if (*online) {
+                        val = readl(port_mmio + PORT_SCR_ERR);
+                        if (val & (SERR_DISPARITY | SERR_10B_8B_ERR))
+                                dev_warn(ctx->dev, "link has error\n");
+                        break;
+                }
 
-        val = readl(port_mmio + PORT_SCR_ERR);
-        if (val & (SERR_DISPARITY | SERR_10B_8B_ERR))
-                dev_warn(ctx->dev, "link has error\n");
+                sata_scr_read(link, SCR_STATUS, &sstatus);
+        } while (link_down_retry++ < MAX_LINK_DOWN_RETRY &&
+                 (sstatus & 0xff) == 0x1);
 
         /* clear all errors if any pending */
         val = readl(port_mmio + PORT_SCR_ERR);
@@ -467,6 +495,11 @@ static int xgene_ahci_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
+        if (xgene_ahci_is_memram_inited(ctx)) {
+                dev_info(dev, "skip clock and PHY initialization\n");
+                goto skip_clk_phy;
+        }
+
         /* Due to errata, HW requires full toggle transition */
         rc = ahci_platform_enable_clks(hpriv);
         if (rc)
@@ -479,7 +512,7 @@ static int xgene_ahci_probe(struct platform_device *pdev)
 
         /* Configure the host controller */
         xgene_ahci_hw_init(hpriv);
-
+skip_clk_phy:
         hpriv->flags = AHCI_HFLAG_NO_PMP | AHCI_HFLAG_NO_NCQ;
 
         rc = ahci_platform_init_host(pdev, hpriv, &xgene_ahci_port_info);
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 893e30e9a9ef..ffbe625e6fd2 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -340,6 +340,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
         { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
         /* SATA Controller IDE (Coleto Creek) */
         { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (9 Series) */
+        { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+        /* SATA Controller IDE (9 Series) */
+        { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+        /* SATA Controller IDE (9 Series) */
+        { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+        /* SATA Controller IDE (9 Series) */
+        { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
 
         { }     /* terminate list */
 };
diff --git a/drivers/ata/pata_jmicron.c b/drivers/ata/pata_jmicron.c
index 4d1a5d2c4287..47e418b8c8ba 100644
--- a/drivers/ata/pata_jmicron.c
+++ b/drivers/ata/pata_jmicron.c
@@ -143,6 +143,18 @@ static int jmicron_init_one (struct pci_dev *pdev, const struct pci_device_id *i
         };
         const struct ata_port_info *ppi[] = { &info, NULL };
 
+        /*
+         * The JMicron chip 361/363 contains one SATA controller and one
+         * PATA controller,for powering on these both controllers, we must
+         * follow the sequence one by one, otherwise one of them can not be
+         * powered on successfully, so here we disable the async suspend
+         * method for these chips.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_JMICRON &&
+                (pdev->device == PCI_DEVICE_ID_JMICRON_JMB363 ||
+                pdev->device == PCI_DEVICE_ID_JMICRON_JMB361))
+                device_disable_async_suspend(&pdev->dev);
+
         return ata_pci_bmdma_init_one(pdev, ppi, &jmicron_sht, NULL, 0);
 }
 
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 7d1326985bee..bfc90b8547f2 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -146,6 +146,9 @@ struct regcache_ops {
         enum regcache_type type;
         int (*init)(struct regmap *map);
         int (*exit)(struct regmap *map);
+#ifdef CONFIG_DEBUG_FS
+        void (*debugfs_init)(struct regmap *map);
+#endif
         int (*read)(struct regmap *map, unsigned int reg, unsigned int *value);
         int (*write)(struct regmap *map, unsigned int reg, unsigned int value);
         int (*sync)(struct regmap *map, unsigned int min, unsigned int max);
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index 6a7e4fa12854..f3e8fe0cc650 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -194,10 +194,6 @@ static void rbtree_debugfs_init(struct regmap *map)
 {
         debugfs_create_file("rbtree", 0400, map->debugfs, map, &rbtree_fops);
 }
-#else
-static void rbtree_debugfs_init(struct regmap *map)
-{
-}
 #endif
 
 static int regcache_rbtree_init(struct regmap *map)
@@ -222,8 +218,6 @@ static int regcache_rbtree_init(struct regmap *map)
                         goto err;
         }
 
-        rbtree_debugfs_init(map);
-
         return 0;
 
 err:
@@ -532,6 +526,9 @@ struct regcache_ops regcache_rbtree_ops = {
         .name = "rbtree",
         .init = regcache_rbtree_init,
         .exit = regcache_rbtree_exit,
+#ifdef CONFIG_DEBUG_FS
+        .debugfs_init = rbtree_debugfs_init,
+#endif
         .read = regcache_rbtree_read,
         .write = regcache_rbtree_write,
         .sync = regcache_rbtree_sync,
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 29b4128da0b0..5617da6dc898 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -698,7 +698,7 @@ int regcache_sync_block(struct regmap *map, void *block,
                         unsigned int block_base, unsigned int start,
                         unsigned int end)
 {
-        if (regmap_can_raw_write(map))
+        if (regmap_can_raw_write(map) && !map->use_single_rw)
                 return regcache_sync_block_raw(map, block, cache_present,
                                                block_base, start, end);
         else
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 45d812c0ea77..65ea7b256b3e 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -538,6 +538,9 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
 
                 next = rb_next(&range_node->node);
         }
+
+        if (map->cache_ops && map->cache_ops->debugfs_init)
+                map->cache_ops->debugfs_init(map);
 }
 
 void regmap_debugfs_exit(struct regmap *map)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 78f43fb2fe84..1cf427bc0d4a 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -109,7 +109,7 @@ bool regmap_readable(struct regmap *map, unsigned int reg)
 
 bool regmap_volatile(struct regmap *map, unsigned int reg)
 {
-        if (!regmap_readable(map, reg))
+        if (!map->format.format_write && !regmap_readable(map, reg))
                 return false;
 
         if (map->volatile_reg)
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index 294a7dd25190..f032ed6dd459 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -282,6 +282,7 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },  /* 0xA8DB */
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, bcma_pci_bridge_tbl);
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index c7d138eca731..3598110d2cef 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -442,12 +442,15 @@ static int rd_nr;
 int rd_size = CONFIG_BLK_DEV_RAM_SIZE;
 static int max_part;
 static int part_shift;
+static int part_show = 0;
 module_param(rd_nr, int, S_IRUGO);
 MODULE_PARM_DESC(rd_nr, "Maximum number of brd devices");
 module_param(rd_size, int, S_IRUGO);
 MODULE_PARM_DESC(rd_size, "Size of each RAM disk in kbytes.");
 module_param(max_part, int, S_IRUGO);
 MODULE_PARM_DESC(max_part, "Maximum number of partitions per RAM disk");
+module_param(part_show, int, S_IRUGO);
+MODULE_PARM_DESC(part_show, "Control RAM disk visibility in /proc/partitions");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_BLOCKDEV_MAJOR(RAMDISK_MAJOR);
 MODULE_ALIAS("rd");
@@ -501,7 +504,8 @@ static struct brd_device *brd_alloc(int i)
         disk->fops              = &brd_fops;
         disk->private_data      = brd;
         disk->queue             = brd->brd_queue;
-        disk->flags |= GENHD_FL_SUPPRESS_PARTITION_INFO;
+        if (!part_show)
+                disk->flags |= GENHD_FL_SUPPRESS_PARTITION_INFO;
         sprintf(disk->disk_name, "ram%d", i);
         set_capacity(disk, rd_size * 2);
 
diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c
index ab3ea62e5dfc..c4328d9d9981 100644
--- a/drivers/block/xsysace.c
+++ b/drivers/block/xsysace.c
@@ -1203,7 +1203,6 @@ static struct platform_driver ace_platform_driver = {
         .probe = ace_probe,
         .remove = ace_remove,
         .driver = {
-                .owner = THIS_MODULE,
                 .name = "xsysace",
                 .of_match_table = ace_of_match,
         },
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index dfa4024c448a..d00831c3d731 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -378,7 +378,6 @@ static int zram_decompress_page(struct zram *zram, char *mem, u32 index)
         /* Should NEVER happen. Return bio error if it does. */
         if (unlikely(ret)) {
                 pr_err("Decompression failed! err=%d, page=%u\n", ret, index);
-                atomic64_inc(&zram->stats.failed_reads);
                 return ret;
         }
 
@@ -547,8 +546,6 @@ out:
                 zcomp_strm_release(zram->comp, zstrm);
         if (is_partial_io(bvec))
                 kfree(uncmem);
-        if (ret)
-                atomic64_inc(&zram->stats.failed_writes);
         return ret;
 }
 
@@ -566,6 +563,13 @@ static int zram_bvec_rw(struct zram *zram, struct bio_vec *bvec, u32 index,
                 ret = zram_bvec_write(zram, bvec, index, offset);
         }
 
+        if (unlikely(ret)) {
+                if (rw == READ)
+                        atomic64_inc(&zram->stats.failed_reads);
+                else
+                        atomic64_inc(&zram->stats.failed_writes);
+        }
+
         return ret;
 }
 
diff --git a/drivers/block/zram/zram_drv.h b/drivers/block/zram/zram_drv.h
index 5b0afde729cd..e0f725c87cc6 100644
--- a/drivers/block/zram/zram_drv.h
+++ b/drivers/block/zram/zram_drv.h
@@ -84,7 +84,7 @@ struct zram_stats {
         atomic64_t compr_data_size;     /* compressed size of pages stored */
         atomic64_t num_reads;   /* failed + successful */
         atomic64_t num_writes;  /* --do-- */
-        atomic64_t failed_reads;        /* should NEVER! happen */
+        atomic64_t failed_reads;        /* can happen when memory is too low */
         atomic64_t failed_writes;       /* can happen when memory is too low */
         atomic64_t invalid_io;  /* non-page-aligned I/O requests */
         atomic64_t notify_free; /* no. of swap slot free notifications */
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 3266f8ff9311..a60f26400705 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -586,6 +586,30 @@ static int arm_ccn_pmu_type_eq(u32 a, u32 b)
         return 0;
 }
 
+static void arm_ccn_pmu_event_destroy(struct perf_event *event)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
+        struct hw_perf_event *hw = &event->hw;
+
+        if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER) {
+                clear_bit(CCN_IDX_PMU_CYCLE_COUNTER, ccn->dt.pmu_counters_mask);
+        } else {
+                struct arm_ccn_component *source =
+                                ccn->dt.pmu_counters[hw->idx].source;
+
+                if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP &&
+                                CCN_CONFIG_EVENT(event->attr.config) ==
+                                CCN_EVENT_WATCHPOINT)
+                        clear_bit(hw->config_base, source->xp.dt_cmp_mask);
+                else
+                        clear_bit(hw->config_base, source->pmu_events_mask);
+                clear_bit(hw->idx, ccn->dt.pmu_counters_mask);
+        }
+
+        ccn->dt.pmu_counters[hw->idx].source = NULL;
+        ccn->dt.pmu_counters[hw->idx].event = NULL;
+}
+
 static int arm_ccn_pmu_event_init(struct perf_event *event)
 {
         struct arm_ccn *ccn;
@@ -599,6 +623,7 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
                 return -ENOENT;
 
         ccn = pmu_to_arm_ccn(event->pmu);
+        event->destroy = arm_ccn_pmu_event_destroy;
 
         if (hw->sample_period) {
                 dev_warn(ccn->dev, "Sampling not supported!\n");
@@ -662,7 +687,7 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
                 }
                 if (e->num_vcs && vc >= e->num_vcs) {
                         dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n",
-                                        port, node_xp);
+                                        vc, node_xp);
                         return -EINVAL;
                 }
                 valid = 1;
@@ -731,30 +756,6 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
         return 0;
 }
 
-static void arm_ccn_pmu_event_free(struct perf_event *event)
-{
-        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
-        struct hw_perf_event *hw = &event->hw;
-
-        if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER) {
-                clear_bit(CCN_IDX_PMU_CYCLE_COUNTER, ccn->dt.pmu_counters_mask);
-        } else {
-                struct arm_ccn_component *source =
-                                ccn->dt.pmu_counters[hw->idx].source;
-
-                if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP &&
-                                CCN_CONFIG_EVENT(event->attr.config) ==
-                                CCN_EVENT_WATCHPOINT)
-                        clear_bit(hw->config_base, source->xp.dt_cmp_mask);
-                else
-                        clear_bit(hw->config_base, source->pmu_events_mask);
-                clear_bit(hw->idx, ccn->dt.pmu_counters_mask);
-        }
-
-        ccn->dt.pmu_counters[hw->idx].source = NULL;
-        ccn->dt.pmu_counters[hw->idx].event = NULL;
-}
-
 static u64 arm_ccn_pmu_read_counter(struct arm_ccn *ccn, int idx)
 {
         u64 res;
@@ -1027,8 +1028,6 @@ static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 static void arm_ccn_pmu_event_del(struct perf_event *event, int flags)
 {
         arm_ccn_pmu_event_stop(event, PERF_EF_UPDATE);
-
-        arm_ccn_pmu_event_free(event);
 }
 
 static void arm_ccn_pmu_event_read(struct perf_event *event)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index c5eac949760d..0668b389c516 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -660,6 +660,7 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
         ICPU(0x3f, core_params),
         ICPU(0x45, core_params),
         ICPU(0x46, core_params),
+        ICPU(0x4c, byt_params),
         ICPU(0x4f, core_params),
         ICPU(0x56, core_params),
         {}
@@ -688,7 +689,7 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
 
         add_timer_on(&cpu->timer, cpunum);
 
-        pr_info("Intel pstate controlling: cpu %d\n", cpunum);
+        pr_debug("Intel pstate controlling: cpu %d\n", cpunum);
 
         return 0;
 }
@@ -707,10 +708,6 @@ static unsigned int intel_pstate_get(unsigned int cpu_num)
 
 static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 {
-        struct cpudata *cpu;
-
-        cpu = all_cpu_data[policy->cpu];
-
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
 
diff --git a/drivers/cpufreq/s5pv210-cpufreq.c b/drivers/cpufreq/s5pv210-cpufreq.c
index 9a68225a757e..3f9791f07b8e 100644
--- a/drivers/cpufreq/s5pv210-cpufreq.c
+++ b/drivers/cpufreq/s5pv210-cpufreq.c
@@ -501,7 +501,7 @@ static int check_mem_type(void __iomem *dmc_reg)
         return val >> 8;
 }
 
-static int __init s5pv210_cpu_init(struct cpufreq_policy *policy)
+static int s5pv210_cpu_init(struct cpufreq_policy *policy)
 {
         unsigned long mem_type;
         int ret;
diff --git a/drivers/cpuidle/cpuidle-big_little.c b/drivers/cpuidle/cpuidle-big_little.c
index 344d79fa3407..ef94c3b81f18 100644
--- a/drivers/cpuidle/cpuidle-big_little.c
+++ b/drivers/cpuidle/cpuidle-big_little.c
@@ -138,25 +138,18 @@ static int bl_enter_powerdown(struct cpuidle_device *dev,
         return idx;
 }
 
-static int __init bl_idle_driver_init(struct cpuidle_driver *drv, int cpu_id)
+static int __init bl_idle_driver_init(struct cpuidle_driver *drv, int part_id)
 {
-        struct cpuinfo_arm *cpu_info;
         struct cpumask *cpumask;
-        unsigned long cpuid;
         int cpu;
 
         cpumask = kzalloc(cpumask_size(), GFP_KERNEL);
         if (!cpumask)
                 return -ENOMEM;
 
-        for_each_possible_cpu(cpu) {
-                cpu_info = &per_cpu(cpu_data, cpu);
-                cpuid = is_smp() ? cpu_info->cpuid : read_cpuid_id();
-
-                /* read cpu id part number */
-                if ((cpuid & 0xFFF0) == cpu_id)
+        for_each_possible_cpu(cpu)
+                if (smp_cpuid_part(cpu) == part_id)
                         cpumask_set_cpu(cpu, cpumask);
-        }
 
         drv->cpumask = cpumask;
 
diff --git a/drivers/dma-buf/fence.c b/drivers/dma-buf/fence.c
index 4222cb2aa96a..7bb9d65d9a2c 100644
--- a/drivers/dma-buf/fence.c
+++ b/drivers/dma-buf/fence.c
@@ -29,7 +29,7 @@
 EXPORT_TRACEPOINT_SYMBOL(fence_annotate_wait_on);
 EXPORT_TRACEPOINT_SYMBOL(fence_emit);
 
-/**
+/*
  * fence context counter: each execution context should have its own
  * fence context, this allows checking if fences belong to the same
  * context or not. One device can have multiple separate contexts,
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index f0a43646a2f3..5abe943e3404 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -481,7 +481,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_remove);
  */
 static void efivar_entry_list_del_unlock(struct efivar_entry *entry)
 {
-        WARN_ON(!spin_is_locked(&__efivars->lock));
+        lockdep_assert_held(&__efivars->lock);
 
         list_del(&entry->list);
         spin_unlock_irq(&__efivars->lock);
@@ -507,7 +507,7 @@ int __efivar_entry_delete(struct efivar_entry *entry)
         const struct efivar_operations *ops = __efivars->ops;
         efi_status_t status;
 
-        WARN_ON(!spin_is_locked(&__efivars->lock));
+        lockdep_assert_held(&__efivars->lock);
 
         status = ops->set_variable(entry->var.VariableName,
                                    &entry->var.VendorGuid,
@@ -667,7 +667,7 @@ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
         int strsize1, strsize2;
         bool found = false;
 
-        WARN_ON(!spin_is_locked(&__efivars->lock));
+        lockdep_assert_held(&__efivars->lock);
 
         list_for_each_entry_safe(entry, n, head, list) {
                 strsize1 = ucs2_strsize(name, 1024);
@@ -739,7 +739,7 @@ int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
         const struct efivar_operations *ops = __efivars->ops;
         efi_status_t status;
 
-        WARN_ON(!spin_is_locked(&__efivars->lock));
+        lockdep_assert_held(&__efivars->lock);
 
         status = ops->get_variable(entry->var.VariableName,
                                    &entry->var.VendorGuid,
diff --git a/drivers/gpio/devres.c b/drivers/gpio/devres.c
index 41b2f40578d5..954b9f6b0ef8 100644
--- a/drivers/gpio/devres.c
+++ b/drivers/gpio/devres.c
@@ -90,7 +90,7 @@ struct gpio_desc *__must_check __devm_gpiod_get_index(struct device *dev,
         struct gpio_desc **dr;
         struct gpio_desc *desc;
 
-        dr = devres_alloc(devm_gpiod_release, sizeof(struct gpiod_desc *),
+        dr = devres_alloc(devm_gpiod_release, sizeof(struct gpio_desc *),
                           GFP_KERNEL);
         if (!dr)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/gpio/gpio-bt8xx.c b/drivers/gpio/gpio-bt8xx.c
index 6557147d9331..7e4c43c18960 100644
--- a/drivers/gpio/gpio-bt8xx.c
+++ b/drivers/gpio/gpio-bt8xx.c
@@ -241,9 +241,6 @@ static void bt8xxgpio_remove(struct pci_dev *pdev)
         bgwrite(~0x0, BT848_INT_STAT);
         bgwrite(0x0, BT848_GPIO_OUT_EN);
 
-        iounmap(bg->mmio);
-        release_mem_region(pci_resource_start(pdev, 0),
-                           pci_resource_len(pdev, 0));
         pci_disable_device(pdev);
 }
 
diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c
index ff9eb911b5e4..fa945ec9ccff 100644
--- a/drivers/gpio/gpio-lynxpoint.c
+++ b/drivers/gpio/gpio-lynxpoint.c
@@ -407,9 +407,27 @@ static int lp_gpio_runtime_resume(struct device *dev)
         return 0;
 }
 
+static int lp_gpio_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct lp_gpio *lg = platform_get_drvdata(pdev);
+        unsigned long reg;
+        int i;
+
+        /* on some hardware suspend clears input sensing, re-enable it here */
+        for (i = 0; i < lg->chip.ngpio; i++) {
+                if (gpiochip_is_requested(&lg->chip, i) != NULL) {
+                        reg = lp_gpio_reg(&lg->chip, i, LP_CONFIG2);
+                        outl(inl(reg) & ~GPINDIS_BIT, reg);
+                }
+        }
+        return 0;
+}
+
 static const struct dev_pm_ops lp_gpio_pm_ops = {
         .runtime_suspend = lp_gpio_runtime_suspend,
         .runtime_resume = lp_gpio_runtime_resume,
+        .resume = lp_gpio_resume,
 };
 
 static const struct acpi_device_id lynxpoint_gpio_acpi_match[] = {
diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
index c3145f91fda3..31ad5df5dbc9 100644
--- a/drivers/gpio/gpio-zynq.c
+++ b/drivers/gpio/gpio-zynq.c
@@ -95,6 +95,9 @@ struct zynq_gpio {
         struct clk *clk;
 };
 
+static struct irq_chip zynq_gpio_level_irqchip;
+static struct irq_chip zynq_gpio_edge_irqchip;
+
 /**
  * zynq_gpio_get_bank_pin - Get the bank number and pin number within that bank
  * for a given pin in the GPIO device
@@ -410,6 +413,15 @@ static int zynq_gpio_set_irq_type(struct irq_data *irq_data, unsigned int type)
                        gpio->base_addr + ZYNQ_GPIO_INTPOL_OFFSET(bank_num));
         writel_relaxed(int_any,
                        gpio->base_addr + ZYNQ_GPIO_INTANY_OFFSET(bank_num));
+
+        if (type & IRQ_TYPE_LEVEL_MASK) {
+                __irq_set_chip_handler_name_locked(irq_data->irq,
+                        &zynq_gpio_level_irqchip, handle_fasteoi_irq, NULL);
+        } else {
+                __irq_set_chip_handler_name_locked(irq_data->irq,
+                        &zynq_gpio_edge_irqchip, handle_level_irq, NULL);
+        }
+
         return 0;
 }
 
@@ -424,9 +436,21 @@ static int zynq_gpio_set_wake(struct irq_data *data, unsigned int on)
 }
 
 /* irq chip descriptor */
-static struct irq_chip zynq_gpio_irqchip = {
+static struct irq_chip zynq_gpio_level_irqchip = {
         .name           = DRIVER_NAME,
         .irq_enable     = zynq_gpio_irq_enable,
+        .irq_eoi        = zynq_gpio_irq_ack,
+        .irq_mask       = zynq_gpio_irq_mask,
+        .irq_unmask     = zynq_gpio_irq_unmask,
+        .irq_set_type   = zynq_gpio_set_irq_type,
+        .irq_set_wake   = zynq_gpio_set_wake,
+        .flags          = IRQCHIP_EOI_THREADED | IRQCHIP_EOI_IF_HANDLED,
+};
+
+static struct irq_chip zynq_gpio_edge_irqchip = {
+        .name           = DRIVER_NAME,
+        .irq_enable     = zynq_gpio_irq_enable,
+        .irq_ack        = zynq_gpio_irq_ack,
         .irq_mask       = zynq_gpio_irq_mask,
         .irq_unmask     = zynq_gpio_irq_unmask,
         .irq_set_type   = zynq_gpio_set_irq_type,
@@ -469,10 +493,6 @@ static void zynq_gpio_irqhandler(unsigned int irq, struct irq_desc *desc)
                                                         offset);
                                 generic_handle_irq(gpio_irq);
                         }
-
-                        /* clear IRQ in HW */
-                        writel_relaxed(int_sts, gpio->base_addr +
-                                        ZYNQ_GPIO_INTSTS_OFFSET(bank_num));
                 }
         }
 
@@ -610,14 +630,14 @@ static int zynq_gpio_probe(struct platform_device *pdev)
                 writel_relaxed(ZYNQ_GPIO_IXR_DISABLE_ALL, gpio->base_addr +
                                ZYNQ_GPIO_INTDIS_OFFSET(bank_num));
 
-        ret = gpiochip_irqchip_add(chip, &zynq_gpio_irqchip, 0,
-                                   handle_simple_irq, IRQ_TYPE_NONE);
+        ret = gpiochip_irqchip_add(chip, &zynq_gpio_edge_irqchip, 0,
+                                   handle_level_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to add irq chip\n");
                 goto err_rm_gpiochip;
         }
 
-        gpiochip_set_chained_irqchip(chip, &zynq_gpio_irqchip, irq,
+        gpiochip_set_chained_irqchip(chip, &zynq_gpio_edge_irqchip, irq,
                                      zynq_gpio_irqhandler);
 
         pm_runtime_set_active(&pdev->dev);
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 7cfdc2278905..604dbe60bdee 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -307,7 +307,5 @@ void of_gpiochip_add(struct gpio_chip *chip)
 void of_gpiochip_remove(struct gpio_chip *chip)
 {
         gpiochip_remove_pin_ranges(chip);
-
-        if (chip->of_node)
-                of_node_put(chip->of_node);
+        of_node_put(chip->of_node);
 }
diff --git a/drivers/gpu/drm/ast/ast_tables.h b/drivers/gpu/drm/ast/ast_tables.h
index 4c761dcea972..05c01ea85294 100644
--- a/drivers/gpu/drm/ast/ast_tables.h
+++ b/drivers/gpu/drm/ast/ast_tables.h
@@ -99,6 +99,7 @@ static struct ast_vbios_dclk_info dclk_table[] = {
         {0x25, 0x65, 0x80},                                     /* 16: VCLK88.75    */
         {0x77, 0x58, 0x80},                                     /* 17: VCLK119      */
         {0x32, 0x67, 0x80},                                 /* 18: VCLK85_5     */
+        {0x6a, 0x6d, 0x80},                                     /* 19: VCLK97_75        */
 };
 
 static struct ast_vbios_stdtable vbios_stdtable[] = {
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index fa2be249999c..90e773019eac 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -4696,8 +4696,9 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev,
                 return -EINVAL;
 
         /* overflow checks for 32bit size calculations */
+        /* NOTE: DIV_ROUND_UP() can overflow */
         cpp = DIV_ROUND_UP(args->bpp, 8);
-        if (cpp > 0xffffffffU / args->width)
+        if (!cpp || cpp > 0xffffffffU / args->width)
                 return -EINVAL;
         stride = cpp * args->width;
         if (args->height > 0xffffffffU / stride)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index ec96f9a9724c..e27cdbe9d524 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -494,6 +494,36 @@ bool i915_semaphore_is_enabled(struct drm_device *dev)
         return true;
 }
 
+void intel_hpd_cancel_work(struct drm_i915_private *dev_priv)
+{
+        spin_lock_irq(&dev_priv->irq_lock);
+
+        dev_priv->long_hpd_port_mask = 0;
+        dev_priv->short_hpd_port_mask = 0;
+        dev_priv->hpd_event_bits = 0;
+
+        spin_unlock_irq(&dev_priv->irq_lock);
+
+        cancel_work_sync(&dev_priv->dig_port_work);
+        cancel_work_sync(&dev_priv->hotplug_work);
+        cancel_delayed_work_sync(&dev_priv->hotplug_reenable_work);
+}
+
+static void intel_suspend_encoders(struct drm_i915_private *dev_priv)
+{
+        struct drm_device *dev = dev_priv->dev;
+        struct drm_encoder *encoder;
+
+        drm_modeset_lock_all(dev);
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+                struct intel_encoder *intel_encoder = to_intel_encoder(encoder);
+
+                if (intel_encoder->suspend)
+                        intel_encoder->suspend(intel_encoder);
+        }
+        drm_modeset_unlock_all(dev);
+}
+
 static int i915_drm_freeze(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -538,6 +568,9 @@ static int i915_drm_freeze(struct drm_device *dev)
                 flush_delayed_work(&dev_priv->rps.delayed_resume_work);
 
                 intel_runtime_pm_disable_interrupts(dev);
+                intel_hpd_cancel_work(dev_priv);
+
+                intel_suspend_encoders(dev_priv);
 
                 intel_suspend_gt_powersave(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 4412f6a4383b..7a830eac5ba3 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1458,7 +1458,7 @@ struct drm_i915_private {
                 } hpd_mark;
         } hpd_stats[HPD_NUM_PINS];
         u32 hpd_event_bits;
-        struct timer_list hotplug_reenable_timer;
+        struct delayed_work hotplug_reenable_work;
 
         struct i915_fbc fbc;
         struct i915_drrs drrs;
@@ -2178,6 +2178,7 @@ extern unsigned long i915_mch_val(struct drm_i915_private *dev_priv);
 extern unsigned long i915_gfx_val(struct drm_i915_private *dev_priv);
 extern void i915_update_gfx_val(struct drm_i915_private *dev_priv);
 int vlv_force_gfx_clock(struct drm_i915_private *dev_priv, bool on);
+void intel_hpd_cancel_work(struct drm_i915_private *dev_priv);
 
 extern void intel_console_resume(struct work_struct *work);
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 390ccc2a3096..0050ee9470f1 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1189,8 +1189,8 @@ static void i915_hotplug_work_func(struct work_struct *work)
           * some connectors */
         if (hpd_disabled) {
                 drm_kms_helper_poll_enable(dev);
-                mod_timer(&dev_priv->hotplug_reenable_timer,
-                          jiffies + msecs_to_jiffies(I915_REENABLE_HOTPLUG_DELAY));
+                mod_delayed_work(system_wq, &dev_priv->hotplug_reenable_work,
+                                 msecs_to_jiffies(I915_REENABLE_HOTPLUG_DELAY));
         }
 
         spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
@@ -1213,11 +1213,6 @@ static void i915_hotplug_work_func(struct work_struct *work)
                 drm_kms_helper_hotplug_event(dev);
 }
 
-static void intel_hpd_irq_uninstall(struct drm_i915_private *dev_priv)
-{
-        del_timer_sync(&dev_priv->hotplug_reenable_timer);
-}
-
 static void ironlake_rps_change_irq_handler(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -3892,8 +3887,6 @@ static void gen8_irq_uninstall(struct drm_device *dev)
         if (!dev_priv)
                 return;
 
-        intel_hpd_irq_uninstall(dev_priv);
-
         gen8_irq_reset(dev);
 }
 
@@ -3908,8 +3901,6 @@ static void valleyview_irq_uninstall(struct drm_device *dev)
 
         I915_WRITE(VLV_MASTER_IER, 0);
 
-        intel_hpd_irq_uninstall(dev_priv);
-
         for_each_pipe(pipe)
                 I915_WRITE(PIPESTAT(pipe), 0xffff);
 
@@ -3988,8 +3979,6 @@ static void ironlake_irq_uninstall(struct drm_device *dev)
         if (!dev_priv)
                 return;
 
-        intel_hpd_irq_uninstall(dev_priv);
-
         ironlake_irq_reset(dev);
 }
 
@@ -4360,8 +4349,6 @@ static void i915_irq_uninstall(struct drm_device * dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         int pipe;
 
-        intel_hpd_irq_uninstall(dev_priv);
-
         if (I915_HAS_HOTPLUG(dev)) {
                 I915_WRITE(PORT_HOTPLUG_EN, 0);
                 I915_WRITE(PORT_HOTPLUG_STAT, I915_READ(PORT_HOTPLUG_STAT));
@@ -4598,8 +4585,6 @@ static void i965_irq_uninstall(struct drm_device * dev)
         if (!dev_priv)
                 return;
 
-        intel_hpd_irq_uninstall(dev_priv);
-
         I915_WRITE(PORT_HOTPLUG_EN, 0);
         I915_WRITE(PORT_HOTPLUG_STAT, I915_READ(PORT_HOTPLUG_STAT));
 
@@ -4615,14 +4600,18 @@ static void i965_irq_uninstall(struct drm_device * dev)
         I915_WRITE(IIR, I915_READ(IIR));
 }
 
-static void intel_hpd_irq_reenable(unsigned long data)
+static void intel_hpd_irq_reenable(struct work_struct *work)
 {
-        struct drm_i915_private *dev_priv = (struct drm_i915_private *)data;
+        struct drm_i915_private *dev_priv =
+                container_of(work, typeof(*dev_priv),
+                             hotplug_reenable_work.work);
         struct drm_device *dev = dev_priv->dev;
         struct drm_mode_config *mode_config = &dev->mode_config;
         unsigned long irqflags;
         int i;
 
+        intel_runtime_pm_get(dev_priv);
+
         spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
         for (i = (HPD_NONE + 1); i < HPD_NUM_PINS; i++) {
                 struct drm_connector *connector;
@@ -4648,6 +4637,8 @@ static void intel_hpd_irq_reenable(unsigned long data)
         if (dev_priv->display.hpd_irq_setup)
                 dev_priv->display.hpd_irq_setup(dev);
         spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+
+        intel_runtime_pm_put(dev_priv);
 }
 
 void intel_irq_init(struct drm_device *dev)
@@ -4670,8 +4661,8 @@ void intel_irq_init(struct drm_device *dev)
         setup_timer(&dev_priv->gpu_error.hangcheck_timer,
                     i915_hangcheck_elapsed,
                     (unsigned long) dev);
-        setup_timer(&dev_priv->hotplug_reenable_timer, intel_hpd_irq_reenable,
-                    (unsigned long) dev_priv);
+        INIT_DELAYED_WORK(&dev_priv->hotplug_reenable_work,
+                          intel_hpd_irq_reenable);
 
         pm_qos_add_request(&dev_priv->pm_qos, PM_QOS_CPU_DMA_LATENCY, PM_QOS_DEFAULT_VALUE);
 
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index a66955037e4e..eee79e1c3222 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1123,7 +1123,7 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
         }
 }
 
-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
+static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
 {
         DRM_DEBUG_KMS("Falling back to manually reading VBT from "
                       "VBIOS ROM for %s\n",
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 2efaf8e8d9c4..9212e6504e0f 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -699,16 +699,21 @@ intel_crt_detect(struct drm_connector *connector, bool force)
                 goto out;
         }
 
+        drm_modeset_acquire_init(&ctx, 0);
+
         /* for pre-945g platforms use load detect */
         if (intel_get_load_detect_pipe(connector, NULL, &tmp, &ctx)) {
                 if (intel_crt_detect_ddc(connector))
                         status = connector_status_connected;
                 else
                         status = intel_crt_load_detect(crt);
-                intel_release_load_detect_pipe(connector, &tmp, &ctx);
+                intel_release_load_detect_pipe(connector, &tmp);
         } else
                 status = connector_status_unknown;
 
+        drm_modeset_drop_locks(&ctx);
+        drm_modeset_acquire_fini(&ctx);
+
 out:
         intel_display_power_put(dev_priv, power_domain);
         return status;
@@ -799,7 +804,7 @@ static const struct drm_encoder_funcs intel_crt_enc_funcs = {
         .destroy = intel_encoder_destroy,
 };
 
-static int __init intel_no_crt_dmi_callback(const struct dmi_system_id *id)
+static int intel_no_crt_dmi_callback(const struct dmi_system_id *id)
 {
         DRM_INFO("Skipping CRT initialization for %s\n", id->ident);
         return 1;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 018fb7222f60..d8324c69fa86 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2233,6 +2233,15 @@ intel_pin_and_fence_fb_obj(struct drm_device *dev,
         if (need_vtd_wa(dev) && alignment < 256 * 1024)
                 alignment = 256 * 1024;
 
+        /*
+         * Global gtt pte registers are special registers which actually forward
+         * writes to a chunk of system memory. Which means that there is no risk
+         * that the register values disappear as soon as we call
+         * intel_runtime_pm_put(), so it is correct to wrap only the
+         * pin/unpin/fence and not more.
+         */
+        intel_runtime_pm_get(dev_priv);
+
         dev_priv->mm.interruptible = false;
         ret = i915_gem_object_pin_to_display_plane(obj, alignment, pipelined);
         if (ret)
@@ -2250,12 +2259,14 @@ intel_pin_and_fence_fb_obj(struct drm_device *dev,
         i915_gem_object_pin_fence(obj);
 
         dev_priv->mm.interruptible = true;
+        intel_runtime_pm_put(dev_priv);
         return 0;
 
 err_unpin:
         i915_gem_object_unpin_from_display_plane(obj);
 err_interruptible:
         dev_priv->mm.interruptible = true;
+        intel_runtime_pm_put(dev_priv);
         return ret;
 }
 
@@ -4188,10 +4199,6 @@ static void ironlake_crtc_disable(struct drm_crtc *crtc)
                 intel_set_pch_fifo_underrun_reporting(dev, pipe, false);
 
         intel_disable_pipe(dev_priv, pipe);
-
-        if (intel_crtc->config.dp_encoder_is_mst)
-                intel_ddi_set_vc_payload_alloc(crtc, false);
-
         ironlake_pfit_disable(intel_crtc);
 
         for_each_encoder_on_crtc(dev, crtc, encoder)
@@ -4256,6 +4263,9 @@ static void haswell_crtc_disable(struct drm_crtc *crtc)
                 intel_set_pch_fifo_underrun_reporting(dev, TRANSCODER_A, false);
         intel_disable_pipe(dev_priv, pipe);
 
+        if (intel_crtc->config.dp_encoder_is_mst)
+                intel_ddi_set_vc_payload_alloc(crtc, false);
+
         intel_ddi_disable_transcoder_func(dev_priv, cpu_transcoder);
 
         ironlake_pfit_disable(intel_crtc);
@@ -8240,6 +8250,15 @@ static int intel_crtc_cursor_set_obj(struct drm_crtc *crtc,
                         goto fail_locked;
                 }
 
+                /*
+                 * Global gtt pte registers are special registers which actually
+                 * forward writes to a chunk of system memory. Which means that
+                 * there is no risk that the register values disappear as soon
+                 * as we call intel_runtime_pm_put(), so it is correct to wrap
+                 * only the pin/unpin/fence and not more.
+                 */
+                intel_runtime_pm_get(dev_priv);
+
                 /* Note that the w/a also requires 2 PTE of padding following
                  * the bo. We currently fill all unused PTE with the shadow
                  * page and so we should always have valid PTE following the
@@ -8252,16 +8271,20 @@ static int intel_crtc_cursor_set_obj(struct drm_crtc *crtc,
                 ret = i915_gem_object_pin_to_display_plane(obj, alignment, NULL);
                 if (ret) {
                         DRM_DEBUG_KMS("failed to move cursor bo into the GTT\n");
+                        intel_runtime_pm_put(dev_priv);
                         goto fail_locked;
                 }
 
                 ret = i915_gem_object_put_fence(obj);
                 if (ret) {
                         DRM_DEBUG_KMS("failed to release fence for cursor");
+                        intel_runtime_pm_put(dev_priv);
                         goto fail_unpin;
                 }
 
                 addr = i915_gem_obj_ggtt_offset(obj);
+
+                intel_runtime_pm_put(dev_priv);
         } else {
                 int align = IS_I830(dev) ? 16 * 1024 : 256;
                 ret = i915_gem_object_attach_phys(obj, align);
@@ -8462,8 +8485,6 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
                       connector->base.id, connector->name,
                       encoder->base.id, encoder->name);
 
-        drm_modeset_acquire_init(ctx, 0);
-
 retry:
         ret = drm_modeset_lock(&config->connection_mutex, ctx);
         if (ret)
@@ -8502,10 +8523,14 @@ retry:
                 i++;
                 if (!(encoder->possible_crtcs & (1 << i)))
                         continue;
-                if (!possible_crtc->enabled) {
-                        crtc = possible_crtc;
-                        break;
-                }
+                if (possible_crtc->enabled)
+                        continue;
+                /* This can occur when applying the pipe A quirk on resume. */
+                if (to_intel_crtc(possible_crtc)->new_enabled)
+                        continue;
+
+                crtc = possible_crtc;
+                break;
         }
 
         /*
@@ -8574,15 +8599,11 @@ fail_unlock:
                 goto retry;
         }
 
-        drm_modeset_drop_locks(ctx);
-        drm_modeset_acquire_fini(ctx);
-
         return false;
 }
 
 void intel_release_load_detect_pipe(struct drm_connector *connector,
-                                    struct intel_load_detect_pipe *old,
-                                    struct drm_modeset_acquire_ctx *ctx)
+                                    struct intel_load_detect_pipe *old)
 {
         struct intel_encoder *intel_encoder =
                 intel_attached_encoder(connector);
@@ -8606,17 +8627,12 @@ void intel_release_load_detect_pipe(struct drm_connector *connector,
                         drm_framebuffer_unreference(old->release_fb);
                 }
 
-                goto unlock;
                 return;
         }
 
         /* Switch crtc and encoder back off if necessary */
         if (old->dpms_mode != DRM_MODE_DPMS_ON)
                 connector->funcs->dpms(connector, old->dpms_mode);
-
-unlock:
-        drm_modeset_drop_locks(ctx);
-        drm_modeset_acquire_fini(ctx);
 }
 
 static int i9xx_pll_refclk(struct drm_device *dev,
@@ -11700,8 +11716,8 @@ intel_cursor_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
         };
         const struct drm_rect clip = {
                 /* integer pixels */
-                .x2 = intel_crtc->config.pipe_src_w,
-                .y2 = intel_crtc->config.pipe_src_h,
+                .x2 = intel_crtc->active ? intel_crtc->config.pipe_src_w : 0,
+                .y2 = intel_crtc->active ? intel_crtc->config.pipe_src_h : 0,
         };
         bool visible;
         int ret;
@@ -12488,6 +12504,9 @@ static struct intel_quirk intel_quirks[] = {
         /* Acer C720 and C720P Chromebooks (Celeron 2955U) have backlights */
         { 0x0a06, 0x1025, 0x0a11, quirk_backlight_present },
 
+        /* Acer C720 Chromebook (Core i3 4005U) */
+        { 0x0a16, 0x1025, 0x0a11, quirk_backlight_present },
+
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
 
@@ -12659,7 +12678,7 @@ static void intel_enable_pipe_a(struct drm_device *dev)
         struct intel_connector *connector;
         struct drm_connector *crt = NULL;
         struct intel_load_detect_pipe load_detect_temp;
-        struct drm_modeset_acquire_ctx ctx;
+        struct drm_modeset_acquire_ctx *ctx = dev->mode_config.acquire_ctx;
 
         /* We can't just switch on the pipe A, we need to set things up with a
          * proper mode and output configuration. As a gross hack, enable pipe A
@@ -12676,10 +12695,8 @@ static void intel_enable_pipe_a(struct drm_device *dev)
         if (!crt)
                 return;
 
-        if (intel_get_load_detect_pipe(crt, NULL, &load_detect_temp, &ctx))
-                intel_release_load_detect_pipe(crt, &load_detect_temp, &ctx);
-
-
+        if (intel_get_load_detect_pipe(crt, NULL, &load_detect_temp, ctx))
+                intel_release_load_detect_pipe(crt, &load_detect_temp);
 }
 
 static bool
@@ -13112,7 +13129,7 @@ void intel_modeset_cleanup(struct drm_device *dev)
          * experience fancy races otherwise.
          */
         drm_irq_uninstall(dev);
-        cancel_work_sync(&dev_priv->hotplug_work);
+        intel_hpd_cancel_work(dev_priv);
         dev_priv->pm._irqs_disabled = true;
 
         /*
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index ee3942f0b068..81d7681faa63 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -3553,6 +3553,9 @@ intel_dp_check_link_status(struct intel_dp *intel_dp)
         if (WARN_ON(!intel_encoder->base.crtc))
                 return;
 
+        if (!to_intel_crtc(intel_encoder->base.crtc)->active)
+                return;
+
         /* Try to read receiver status if the link appears to be up */
         if (!intel_dp_get_link_status(intel_dp, link_status)) {
                 return;
@@ -3658,24 +3661,12 @@ ironlake_dp_detect(struct intel_dp *intel_dp)
         return intel_dp_detect_dpcd(intel_dp);
 }
 
-static enum drm_connector_status
-g4x_dp_detect(struct intel_dp *intel_dp)
+static int g4x_digital_port_connected(struct drm_device *dev,
+                                       struct intel_digital_port *intel_dig_port)
 {
-        struct drm_device *dev = intel_dp_to_dev(intel_dp);
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
         uint32_t bit;
 
-        /* Can't disconnect eDP, but you can close the lid... */
-        if (is_edp(intel_dp)) {
-                enum drm_connector_status status;
-
-                status = intel_panel_detect(dev);
-                if (status == connector_status_unknown)
-                        status = connector_status_connected;
-                return status;
-        }
-
         if (IS_VALLEYVIEW(dev)) {
                 switch (intel_dig_port->port) {
                 case PORT_B:
@@ -3688,7 +3679,7 @@ g4x_dp_detect(struct intel_dp *intel_dp)
                         bit = PORTD_HOTPLUG_LIVE_STATUS_VLV;
                         break;
                 default:
-                        return connector_status_unknown;
+                        return -EINVAL;
                 }
         } else {
                 switch (intel_dig_port->port) {
@@ -3702,11 +3693,36 @@ g4x_dp_detect(struct intel_dp *intel_dp)
                         bit = PORTD_HOTPLUG_LIVE_STATUS_G4X;
                         break;
                 default:
-                        return connector_status_unknown;
+                        return -EINVAL;
                 }
         }
 
         if ((I915_READ(PORT_HOTPLUG_STAT) & bit) == 0)
+                return 0;
+        return 1;
+}
+
+static enum drm_connector_status
+g4x_dp_detect(struct intel_dp *intel_dp)
+{
+        struct drm_device *dev = intel_dp_to_dev(intel_dp);
+        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+        int ret;
+
+        /* Can't disconnect eDP, but you can close the lid... */
+        if (is_edp(intel_dp)) {
+                enum drm_connector_status status;
+
+                status = intel_panel_detect(dev);
+                if (status == connector_status_unknown)
+                        status = connector_status_connected;
+                return status;
+        }
+
+        ret = g4x_digital_port_connected(dev, intel_dig_port);
+        if (ret == -EINVAL)
+                return connector_status_unknown;
+        else if (ret == 0)
                 return connector_status_disconnected;
 
         return intel_dp_detect_dpcd(intel_dp);
@@ -4003,6 +4019,16 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
         kfree(intel_dig_port);
 }
 
+static void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
+{
+        struct intel_dp *intel_dp = enc_to_intel_dp(&intel_encoder->base);
+
+        if (!is_edp(intel_dp))
+                return;
+
+        edp_panel_vdd_off_sync(intel_dp);
+}
+
 static void intel_dp_encoder_reset(struct drm_encoder *encoder)
 {
         intel_edp_panel_vdd_sanitize(to_intel_encoder(encoder));
@@ -4037,18 +4063,30 @@ bool
 intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
 {
         struct intel_dp *intel_dp = &intel_dig_port->dp;
+        struct intel_encoder *intel_encoder = &intel_dig_port->base;
         struct drm_device *dev = intel_dig_port->base.base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret;
+        enum intel_display_power_domain power_domain;
+        bool ret = true;
+
         if (intel_dig_port->base.type != INTEL_OUTPUT_EDP)
                 intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT;
 
         DRM_DEBUG_KMS("got hpd irq on port %d - %s\n", intel_dig_port->port,
                       long_hpd ? "long" : "short");
 
+        power_domain = intel_display_port_power_domain(intel_encoder);
+        intel_display_power_get(dev_priv, power_domain);
+
         if (long_hpd) {
-                if (!ibx_digital_port_connected(dev_priv, intel_dig_port))
-                        goto mst_fail;
+
+                if (HAS_PCH_SPLIT(dev)) {
+                        if (!ibx_digital_port_connected(dev_priv, intel_dig_port))
+                                goto mst_fail;
+                } else {
+                        if (g4x_digital_port_connected(dev, intel_dig_port) != 1)
+                                goto mst_fail;
+                }
 
                 if (!intel_dp_get_dpcd(intel_dp)) {
                         goto mst_fail;
@@ -4061,8 +4099,7 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
 
         } else {
                 if (intel_dp->is_mst) {
-                        ret = intel_dp_check_mst_status(intel_dp);
-                        if (ret == -EINVAL)
+                        if (intel_dp_check_mst_status(intel_dp) == -EINVAL)
                                 goto mst_fail;
                 }
 
@@ -4076,7 +4113,8 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
                         drm_modeset_unlock(&dev->mode_config.connection_mutex);
                 }
         }
-        return false;
+        ret = false;
+        goto put_power;
 mst_fail:
         /* if we were in MST mode, and device is not there get out of MST mode */
         if (intel_dp->is_mst) {
@@ -4084,7 +4122,10 @@ mst_fail:
                 intel_dp->is_mst = false;
                 drm_dp_mst_topology_mgr_set_mst(&intel_dp->mst_mgr, intel_dp->is_mst);
         }
-        return true;
+put_power:
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
 }
 
 /* Return which DP Port should be selected for Transcoder DP control */
@@ -4722,6 +4763,7 @@ intel_dp_init(struct drm_device *dev, int output_reg, enum port port)
         intel_encoder->disable = intel_disable_dp;
         intel_encoder->get_hw_state = intel_dp_get_hw_state;
         intel_encoder->get_config = intel_dp_get_config;
+        intel_encoder->suspend = intel_dp_encoder_suspend;
         if (IS_CHERRYVIEW(dev)) {
                 intel_encoder->pre_pll_enable = chv_dp_pre_pll_enable;
                 intel_encoder->pre_enable = chv_pre_enable_dp;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 4b2664bd5b81..b8c8bbd8e5f9 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -153,6 +153,12 @@ struct intel_encoder {
          * be set correctly before calling this function. */
         void (*get_config)(struct intel_encoder *,
                            struct intel_crtc_config *pipe_config);
+        /*
+         * Called during system suspend after all pending requests for the
+         * encoder are flushed (for example for DP AUX transactions) and
+         * device interrupts are disabled.
+         */
+        void (*suspend)(struct intel_encoder *);
         int crtc_mask;
         enum hpd_pin hpd_pin;
 };
@@ -830,8 +836,7 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
                                 struct intel_load_detect_pipe *old,
                                 struct drm_modeset_acquire_ctx *ctx);
 void intel_release_load_detect_pipe(struct drm_connector *connector,
-                                    struct intel_load_detect_pipe *old,
-                                    struct drm_modeset_acquire_ctx *ctx);
+                                    struct intel_load_detect_pipe *old);
 int intel_pin_and_fence_fb_obj(struct drm_device *dev,
                                struct drm_i915_gem_object *obj,
                                struct intel_engine_cs *pipelined);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 881361c0f27e..fdf40267249c 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -538,7 +538,7 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
         .destroy = intel_encoder_destroy,
 };
 
-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
 {
         DRM_INFO("Skipping LVDS initialization for %s\n", id->ident);
         return 1;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 59b028f0b1e8..8e374449c6b5 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -801,7 +801,7 @@ static void pch_enable_backlight(struct intel_connector *connector)
 
         cpu_ctl2 = I915_READ(BLC_PWM_CPU_CTL2);
         if (cpu_ctl2 & BLM_PWM_ENABLE) {
-                WARN(1, "cpu backlight already enabled\n");
+                DRM_DEBUG_KMS("cpu backlight already enabled\n");
                 cpu_ctl2 &= ~BLM_PWM_ENABLE;
                 I915_WRITE(BLC_PWM_CPU_CTL2, cpu_ctl2);
         }
@@ -845,7 +845,7 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
 
         ctl = I915_READ(BLC_PWM_CTL);
         if (ctl & BACKLIGHT_DUTY_CYCLE_MASK_PNV) {
-                WARN(1, "backlight already enabled\n");
+                DRM_DEBUG_KMS("backlight already enabled\n");
                 I915_WRITE(BLC_PWM_CTL, 0);
         }
 
@@ -876,7 +876,7 @@ static void i965_enable_backlight(struct intel_connector *connector)
 
         ctl2 = I915_READ(BLC_PWM_CTL2);
         if (ctl2 & BLM_PWM_ENABLE) {
-                WARN(1, "backlight already enabled\n");
+                DRM_DEBUG_KMS("backlight already enabled\n");
                 ctl2 &= ~BLM_PWM_ENABLE;
                 I915_WRITE(BLC_PWM_CTL2, ctl2);
         }
@@ -910,7 +910,7 @@ static void vlv_enable_backlight(struct intel_connector *connector)
 
         ctl2 = I915_READ(VLV_BLC_PWM_CTL2(pipe));
         if (ctl2 & BLM_PWM_ENABLE) {
-                WARN(1, "backlight already enabled\n");
+                DRM_DEBUG_KMS("backlight already enabled\n");
                 ctl2 &= ~BLM_PWM_ENABLE;
                 I915_WRITE(VLV_BLC_PWM_CTL2(pipe), ctl2);
         }
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index e211eef4b7e4..c69d3ce1b3d6 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1311,6 +1311,7 @@ intel_tv_detect(struct drm_connector *connector, bool force)
 {
         struct drm_display_mode mode;
         struct intel_tv *intel_tv = intel_attached_tv(connector);
+        enum drm_connector_status status;
         int type;
 
         DRM_DEBUG_KMS("[CONNECTOR:%d:%s] force=%d\n",
@@ -1323,16 +1324,24 @@ intel_tv_detect(struct drm_connector *connector, bool force)
                 struct intel_load_detect_pipe tmp;
                 struct drm_modeset_acquire_ctx ctx;
 
+                drm_modeset_acquire_init(&ctx, 0);
+
                 if (intel_get_load_detect_pipe(connector, &mode, &tmp, &ctx)) {
                         type = intel_tv_detect_type(intel_tv, connector);
-                        intel_release_load_detect_pipe(connector, &tmp, &ctx);
+                        intel_release_load_detect_pipe(connector, &tmp);
+                        status = type < 0 ?
+                                connector_status_disconnected :
+                                connector_status_connected;
                 } else
-                        return connector_status_unknown;
+                        status = connector_status_unknown;
+
+                drm_modeset_drop_locks(&ctx);
+                drm_modeset_acquire_fini(&ctx);
         } else
                 return connector->status;
 
-        if (type < 0)
-                return connector_status_disconnected;
+        if (status != connector_status_connected)
+                return status;
 
         intel_tv->type = type;
         intel_tv_find_better_format(connector);
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
index 74cebb51e8c2..c6c80ea28c35 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
@@ -397,6 +397,7 @@ static void mdp4_crtc_prepare(struct drm_crtc *crtc)
         struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
         DBG("%s", mdp4_crtc->name);
         /* make sure we hold a ref to mdp clks while setting up mode: */
+        drm_crtc_vblank_get(crtc);
         mdp4_enable(get_kms(crtc));
         mdp4_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
 }
@@ -407,6 +408,7 @@ static void mdp4_crtc_commit(struct drm_crtc *crtc)
         crtc_flush(crtc);
         /* drop the ref to mdp clk's that we got in prepare: */
         mdp4_disable(get_kms(crtc));
+        drm_crtc_vblank_put(crtc);
 }
 
 static int mdp4_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index b447c01ad89c..26ee80db17af 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -974,12 +974,11 @@ static int msm_pdev_probe(struct platform_device *pdev)
 
         for (i = 0; i < ARRAY_SIZE(devnames); i++) {
                 struct device *dev;
-                int ret;
 
                 dev = bus_find_device_by_name(&platform_bus_type,
                                 NULL, devnames[i]);
                 if (!dev) {
-                        dev_info(master, "still waiting for %s\n", devnames[i]);
+                        dev_info(&pdev->dev, "still waiting for %s\n", devnames[i]);
                         return -EPROBE_DEFER;
                 }
 
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index 9c5221ce391a..ab5bfd2d0ebf 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -143,7 +143,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
         ret = msm_gem_get_iova_locked(fbdev->bo, 0, &paddr);
         if (ret) {
                 dev_err(dev->dev, "failed to get buffer obj iova: %d\n", ret);
-                goto fail;
+                goto fail_unlock;
         }
 
         fbi = framebuffer_alloc(0, dev->dev);
diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index 099af483fdf0..7acdaa5688b7 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -27,8 +27,8 @@ struct msm_iommu {
 static int msm_fault_handler(struct iommu_domain *iommu, struct device *dev,
                 unsigned long iova, int flags, void *arg)
 {
-        DBG("*** fault: iova=%08lx, flags=%d", iova, flags);
-        return -ENOSYS;
+        pr_warn_ratelimited("*** fault: iova=%08lx, flags=%d\n", iova, flags);
+        return 0;
 }
 
 static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
diff --git a/drivers/gpu/drm/nouveau/core/core/parent.c b/drivers/gpu/drm/nouveau/core/core/parent.c
index 8701968a9743..30a2911878f8 100644
--- a/drivers/gpu/drm/nouveau/core/core/parent.c
+++ b/drivers/gpu/drm/nouveau/core/core/parent.c
@@ -86,7 +86,7 @@ nouveau_parent_lclass(struct nouveau_object *parent, u32 *lclass, int size)
         sclass = nv_parent(parent)->sclass;
         while (sclass) {
                 if (++nr < size)
-                        lclass[nr] = sclass->oclass->handle;
+                        lclass[nr] = sclass->oclass->handle & 0xffff;
                 sclass = sclass->sclass;
         }
 
@@ -96,7 +96,7 @@ nouveau_parent_lclass(struct nouveau_object *parent, u32 *lclass, int size)
                 if (engine && (oclass = engine->sclass)) {
                         while (oclass->ofuncs) {
                                 if (++nr < size)
-                                        lclass[nr] = oclass->handle;
+                                        lclass[nr] = oclass->handle & 0xffff;
                                 oclass++;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/Makefile b/drivers/gpu/drm/radeon/Makefile
index 0013ad0db9ef..f77b7135ee4c 100644
--- a/drivers/gpu/drm/radeon/Makefile
+++ b/drivers/gpu/drm/radeon/Makefile
@@ -76,7 +76,7 @@ radeon-y += radeon_device.o radeon_asic.o radeon_kms.o \
         evergreen.o evergreen_cs.o evergreen_blit_shaders.o \
         evergreen_hdmi.o radeon_trace_points.o ni.o cayman_blit_shaders.o \
         atombios_encoders.o radeon_semaphore.o radeon_sa.o atombios_i2c.o si.o \
-        si_blit_shaders.o radeon_prime.o radeon_uvd.o cik.o cik_blit_shaders.o \
+        si_blit_shaders.o radeon_prime.o cik.o cik_blit_shaders.o \
         r600_dpm.o rs780_dpm.o rv6xx_dpm.o rv770_dpm.o rv730_dpm.o rv740_dpm.o \
         rv770_smc.o cypress_dpm.o btc_dpm.o sumo_dpm.o sumo_smc.o trinity_dpm.o \
         trinity_smc.o ni_dpm.o si_smc.o si_dpm.o kv_smc.o kv_dpm.o ci_smc.o \
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 022561e28707..d416bb2ff48d 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -869,6 +869,9 @@ static int ci_set_thermal_temperature_range(struct radeon_device *rdev,
         WREG32_SMC(CG_THERMAL_CTRL, tmp);
 #endif
 
+        rdev->pm.dpm.thermal.min_temp = low_temp;
+        rdev->pm.dpm.thermal.max_temp = high_temp;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index b625646bf3e2..fa9565957f9d 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3483,7 +3483,7 @@ static void cik_gpu_init(struct radeon_device *rdev)
         u32 mc_shared_chmap, mc_arb_ramcfg;
         u32 hdp_host_path_cntl;
         u32 tmp;
-        int i, j, k;
+        int i, j;
 
         switch (rdev->family) {
         case CHIP_BONAIRE:
@@ -3544,6 +3544,7 @@ static void cik_gpu_init(struct radeon_device *rdev)
                            (rdev->pdev->device == 0x130B) ||
                            (rdev->pdev->device == 0x130E) ||
                            (rdev->pdev->device == 0x1315) ||
+                           (rdev->pdev->device == 0x1318) ||
                            (rdev->pdev->device == 0x131B)) {
                         rdev->config.cik.max_cu_per_sh = 4;
                         rdev->config.cik.max_backends_per_se = 1;
@@ -3672,12 +3673,11 @@ static void cik_gpu_init(struct radeon_device *rdev)
                      rdev->config.cik.max_sh_per_se,
                      rdev->config.cik.max_backends_per_se);
 
+        rdev->config.cik.active_cus = 0;
         for (i = 0; i < rdev->config.cik.max_shader_engines; i++) {
                 for (j = 0; j < rdev->config.cik.max_sh_per_se; j++) {
-                        for (k = 0; k < rdev->config.cik.max_cu_per_sh; k++) {
-                                rdev->config.cik.active_cus +=
-                                        hweight32(cik_get_cu_active_bitmap(rdev, i, j));
-                        }
+                        rdev->config.cik.active_cus +=
+                                hweight32(cik_get_cu_active_bitmap(rdev, i, j));
                 }
         }
 
@@ -3801,7 +3801,7 @@ int cik_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
         radeon_ring_write(ring, PACKET3(PACKET3_SET_UCONFIG_REG, 1));
         radeon_ring_write(ring, ((scratch - PACKET3_SET_UCONFIG_REG_START) >> 2));
         radeon_ring_write(ring, 0xDEADBEEF);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = 0; i < rdev->usec_timeout; i++) {
                 tmp = RREG32(scratch);
@@ -3920,6 +3920,17 @@ void cik_fence_compute_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, 0);
 }
 
+/**
+ * cik_semaphore_ring_emit - emit a semaphore on the CP ring
+ *
+ * @rdev: radeon_device pointer
+ * @ring: radeon ring buffer object
+ * @semaphore: radeon semaphore object
+ * @emit_wait: Is this a sempahore wait?
+ *
+ * Emits a semaphore signal/wait packet to the CP ring and prevents the PFP
+ * from running ahead of semaphore waits.
+ */
 bool cik_semaphore_ring_emit(struct radeon_device *rdev,
                              struct radeon_ring *ring,
                              struct radeon_semaphore *semaphore,
@@ -3932,6 +3943,12 @@ bool cik_semaphore_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, lower_32_bits(addr));
         radeon_ring_write(ring, (upper_32_bits(addr) & 0xffff) | sel);
 
+        if (emit_wait && ring->idx == RADEON_RING_TYPE_GFX_INDEX) {
+                /* Prevent the PFP from running ahead of the semaphore wait */
+                radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
+                radeon_ring_write(ring, 0x0);
+        }
+
         return true;
 }
 
@@ -4004,7 +4021,7 @@ int cik_copy_cpdma(struct radeon_device *rdev,
                 return r;
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_semaphore_free(rdev, &sem, *fence);
 
         return r;
@@ -4103,7 +4120,7 @@ int cik_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         ib.ptr[1] = ((scratch - PACKET3_SET_UCONFIG_REG_START) >> 2);
         ib.ptr[2] = 0xDEADBEEF;
         ib.length_dw = 3;
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 radeon_scratch_free(rdev, scratch);
                 radeon_ib_free(rdev, &ib);
@@ -4324,7 +4341,7 @@ static int cik_cp_gfx_start(struct radeon_device *rdev)
         radeon_ring_write(ring, 0x0000000e); /* VGT_VERTEX_REUSE_BLOCK_CNTL */
         radeon_ring_write(ring, 0x00000010); /* VGT_OUT_DEALLOC_CNTL */
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         return 0;
 }
@@ -5732,20 +5749,17 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
         WREG32(0x15D8, 0);
         WREG32(0x15DC, 0);
 
-        /* empty context1-15 */
-        /* FIXME start with 4G, once using 2 level pt switch to full
-         * vm size space
-         */
+        /* restore context1-15 */
         /* set vm size, must be a multiple of 4 */
         WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
         WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
         for (i = 1; i < 16; i++) {
                 if (i < 8)
                         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
-                               rdev->gart.table_addr >> 12);
+                               rdev->vm_manager.saved_table_addr[i]);
                 else
                         WREG32(VM_CONTEXT8_PAGE_TABLE_BASE_ADDR + ((i - 8) << 2),
-                               rdev->gart.table_addr >> 12);
+                               rdev->vm_manager.saved_table_addr[i]);
         }
 
         /* enable context1-15 */
@@ -5810,6 +5824,17 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
  */
 static void cik_pcie_gart_disable(struct radeon_device *rdev)
 {
+        unsigned i;
+
+        for (i = 1; i < 16; ++i) {
+                uint32_t reg;
+                if (i < 8)
+                        reg = VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2);
+                else
+                        reg = VM_CONTEXT8_PAGE_TABLE_BASE_ADDR + ((i - 8) << 2);
+                rdev->vm_manager.saved_table_addr[i] = RREG32(reg);
+        }
+
         /* Disable all tables */
         WREG32(VM_CONTEXT0_CNTL, 0);
         WREG32(VM_CONTEXT1_CNTL, 0);
@@ -5958,14 +5983,14 @@ void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
 
         /* update SH_MEM_* regs */
         radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
                                  WRITE_DATA_DST_SEL(0)));
         radeon_ring_write(ring, SRBM_GFX_CNTL >> 2);
         radeon_ring_write(ring, 0);
         radeon_ring_write(ring, VMID(vm->id));
 
         radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 6));
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
                                  WRITE_DATA_DST_SEL(0)));
         radeon_ring_write(ring, SH_MEM_BASES >> 2);
         radeon_ring_write(ring, 0);
@@ -5976,7 +6001,7 @@ void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
         radeon_ring_write(ring, 0); /* SH_MEM_APE1_LIMIT */
 
         radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
                                  WRITE_DATA_DST_SEL(0)));
         radeon_ring_write(ring, SRBM_GFX_CNTL >> 2);
         radeon_ring_write(ring, 0);
@@ -5987,7 +6012,7 @@ void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
 
         /* bits 0-15 are the VM contexts0-15 */
         radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
                                  WRITE_DATA_DST_SEL(0)));
         radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
         radeon_ring_write(ring, 0);
@@ -9538,6 +9563,9 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
         int ret, i;
         u16 tmp16;
 
+        if (pci_is_root_bus(rdev->pdev->bus))
+                return;
+
         if (radeon_pcie_gen2 == 0)
                 return;
 
@@ -9764,7 +9792,8 @@ static void cik_program_aspm(struct radeon_device *rdev)
                         if (orig != data)
                                 WREG32_PCIE_PORT(PCIE_LC_LINK_WIDTH_CNTL, data);
 
-                        if (!disable_clkreq) {
+                        if (!disable_clkreq &&
+                            !pci_is_root_bus(rdev->pdev->bus)) {
                                 struct pci_dev *root = rdev->pdev->bus->self;
                                 u32 lnkcap;
 
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index bcf480510ac2..192278bc993c 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -596,7 +596,7 @@ int cik_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_semaphore_free(rdev, &sem, *fence);
 
         return r;
@@ -638,7 +638,7 @@ int cik_sdma_ring_test(struct radeon_device *rdev,
         radeon_ring_write(ring, upper_32_bits(rdev->vram_scratch.gpu_addr));
         radeon_ring_write(ring, 1); /* number of DWs to follow */
         radeon_ring_write(ring, 0xDEADBEEF);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = 0; i < rdev->usec_timeout; i++) {
                 tmp = readl(ptr);
@@ -695,7 +695,7 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         ib.ptr[4] = 0xDEADBEEF;
         ib.length_dw = 5;
 
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 radeon_ib_free(rdev, &ib);
                 DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 4fedd14e670a..dbca60c7d097 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2869,7 +2869,7 @@ static int evergreen_cp_start(struct radeon_device *rdev)
         radeon_ring_write(ring, PACKET3_ME_INITIALIZE_DEVICE_ID(1));
         radeon_ring_write(ring, 0);
         radeon_ring_write(ring, 0);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         cp_me = 0xff;
         WREG32(CP_ME_CNTL, cp_me);
@@ -2912,7 +2912,7 @@ static int evergreen_cp_start(struct radeon_device *rdev)
         radeon_ring_write(ring, 0x0000000e); /* VGT_VERTEX_REUSE_BLOCK_CNTL */
         radeon_ring_write(ring, 0x00000010); /*  */
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/evergreen_dma.c b/drivers/gpu/drm/radeon/evergreen_dma.c
index 478caefe0fef..afaba388c36d 100644
--- a/drivers/gpu/drm/radeon/evergreen_dma.c
+++ b/drivers/gpu/drm/radeon/evergreen_dma.c
@@ -155,7 +155,7 @@ int evergreen_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_semaphore_free(rdev, &sem, *fence);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 9ef8c38f2d66..8b58e11b64fa 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -1438,14 +1438,14 @@ static int kv_update_uvd_dpm(struct radeon_device *rdev, bool gate)
         return kv_enable_uvd_dpm(rdev, !gate);
 }
 
-static u8 kv_get_vce_boot_level(struct radeon_device *rdev)
+static u8 kv_get_vce_boot_level(struct radeon_device *rdev, u32 evclk)
 {
         u8 i;
         struct radeon_vce_clock_voltage_dependency_table *table =
                 &rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table;
 
         for (i = 0; i < table->count; i++) {
-                if (table->entries[i].evclk >= 0) /* XXX */
+                if (table->entries[i].evclk >= evclk)
                         break;
         }
 
@@ -1468,7 +1468,7 @@ static int kv_update_vce_dpm(struct radeon_device *rdev,
                 if (pi->caps_stable_p_state)
                         pi->vce_boot_level = table->count - 1;
                 else
-                        pi->vce_boot_level = kv_get_vce_boot_level(rdev);
+                        pi->vce_boot_level = kv_get_vce_boot_level(rdev, radeon_new_state->evclk);
 
                 ret = kv_copy_bytes_to_smc(rdev,
                                            pi->dpm_table_start +
@@ -2726,7 +2726,10 @@ int kv_dpm_init(struct radeon_device *rdev)
         pi->caps_sclk_ds = true;
         pi->enable_auto_thermal_throttling = true;
         pi->disable_nb_ps3_in_battery = false;
-        pi->bapm_enable = true;
+        if (radeon_bapm == 0)
+                pi->bapm_enable = false;
+        else
+                pi->bapm_enable = true;
         pi->voltage_drop_t = 0;
         pi->caps_sclk_throttle_low_notification = false;
         pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 327b85f7fd0d..3faee58946dd 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1271,7 +1271,7 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev)
                 WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0);
                 WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn);
                 WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
-                        rdev->gart.table_addr >> 12);
+                       rdev->vm_manager.saved_table_addr[i]);
         }
 
         /* enable context1-7 */
@@ -1303,6 +1303,13 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev)
 
 static void cayman_pcie_gart_disable(struct radeon_device *rdev)
 {
+        unsigned i;
+
+        for (i = 1; i < 8; ++i) {
+                rdev->vm_manager.saved_table_addr[i] = RREG32(
+                        VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2));
+        }
+
         /* Disable all tables */
         WREG32(VM_CONTEXT0_CNTL, 0);
         WREG32(VM_CONTEXT1_CNTL, 0);
@@ -1505,7 +1512,7 @@ static int cayman_cp_start(struct radeon_device *rdev)
         radeon_ring_write(ring, PACKET3_ME_INITIALIZE_DEVICE_ID(1));
         radeon_ring_write(ring, 0);
         radeon_ring_write(ring, 0);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         cayman_cp_enable(rdev, true);
 
@@ -1547,7 +1554,7 @@ static int cayman_cp_start(struct radeon_device *rdev)
         radeon_ring_write(ring, 0x0000000e); /* VGT_VERTEX_REUSE_BLOCK_CNTL */
         radeon_ring_write(ring, 0x00000010); /*  */
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         /* XXX init other rings */
 
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 04b5940b8923..4c5ec44ff328 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -925,7 +925,7 @@ int r100_copy_blit(struct radeon_device *rdev,
         if (fence) {
                 r = radeon_fence_emit(rdev, fence, RADEON_RING_TYPE_GFX_INDEX);
         }
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         return r;
 }
 
@@ -958,7 +958,7 @@ void r100_ring_start(struct radeon_device *rdev, struct radeon_ring *ring)
                           RADEON_ISYNC_ANY3D_IDLE2D |
                           RADEON_ISYNC_WAIT_IDLEGUI |
                           RADEON_ISYNC_CPSCRATCH_IDLEGUI);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 }
 
 
@@ -3638,7 +3638,7 @@ int r100_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
         radeon_ring_write(ring, PACKET0(scratch, 0));
         radeon_ring_write(ring, 0xDEADBEEF);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         for (i = 0; i < rdev->usec_timeout; i++) {
                 tmp = RREG32(scratch);
                 if (tmp == 0xDEADBEEF) {
@@ -3700,7 +3700,7 @@ int r100_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         ib.ptr[6] = PACKET2(0);
         ib.ptr[7] = PACKET2(0);
         ib.length_dw = 8;
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
                 goto free_ib;
diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index 58f0473aa73f..67780374a652 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -121,7 +121,7 @@ int r200_copy_dma(struct radeon_device *rdev,
         if (fence) {
                 r = radeon_fence_emit(rdev, fence, RADEON_RING_TYPE_GFX_INDEX);
         }
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         return r;
 }
 
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 75b30338c226..1bc4704034ce 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -295,7 +295,7 @@ void r300_ring_start(struct radeon_device *rdev, struct radeon_ring *ring)
         radeon_ring_write(ring,
                           R300_GEOMETRY_ROUND_NEAREST |
                           R300_COLOR_ROUND_NEAREST);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 }
 
 static void r300_errata(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 802b19220a21..2828605aef3f 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -219,7 +219,7 @@ static void r420_cp_errata_init(struct radeon_device *rdev)
         radeon_ring_write(ring, PACKET0(R300_CP_RESYNC_ADDR, 1));
         radeon_ring_write(ring, rdev->config.r300.resync_scratch);
         radeon_ring_write(ring, 0xDEADBEEF);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 }
 
 static void r420_cp_errata_fini(struct radeon_device *rdev)
@@ -232,7 +232,7 @@ static void r420_cp_errata_fini(struct radeon_device *rdev)
         radeon_ring_lock(rdev, ring, 8);
         radeon_ring_write(ring, PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
         radeon_ring_write(ring, R300_RB3D_DC_FINISH);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_scratch_free(rdev, rdev->config.r300.resync_scratch);
 }
 
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index c70a504d96af..e616eb5f6e7a 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1812,7 +1812,6 @@ static void r600_gpu_init(struct radeon_device *rdev)
 {
         u32 tiling_config;
         u32 ramcfg;
-        u32 cc_rb_backend_disable;
         u32 cc_gc_shader_pipe_config;
         u32 tmp;
         int i, j;
@@ -1939,29 +1938,20 @@ static void r600_gpu_init(struct radeon_device *rdev)
         }
         tiling_config |= BANK_SWAPS(1);
 
-        cc_rb_backend_disable = RREG32(CC_RB_BACKEND_DISABLE) & 0x00ff0000;
-        tmp = R6XX_MAX_BACKENDS -
-                r600_count_pipe_bits((cc_rb_backend_disable >> 16) & R6XX_MAX_BACKENDS_MASK);
-        if (tmp < rdev->config.r600.max_backends) {
-                rdev->config.r600.max_backends = tmp;
-        }
-
         cc_gc_shader_pipe_config = RREG32(CC_GC_SHADER_PIPE_CONFIG) & 0x00ffff00;
-        tmp = R6XX_MAX_PIPES -
-                r600_count_pipe_bits((cc_gc_shader_pipe_config >> 8) & R6XX_MAX_PIPES_MASK);
-        if (tmp < rdev->config.r600.max_pipes) {
-                rdev->config.r600.max_pipes = tmp;
-        }
-        tmp = R6XX_MAX_SIMDS -
-                r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R6XX_MAX_SIMDS_MASK);
-        if (tmp < rdev->config.r600.max_simds) {
-                rdev->config.r600.max_simds = tmp;
-        }
         tmp = rdev->config.r600.max_simds -
                 r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R6XX_MAX_SIMDS_MASK);
         rdev->config.r600.active_simds = tmp;
 
         disabled_rb_mask = (RREG32(CC_RB_BACKEND_DISABLE) >> 16) & R6XX_MAX_BACKENDS_MASK;
+        tmp = 0;
+        for (i = 0; i < rdev->config.r600.max_backends; i++)
+                tmp |= (1 << i);
+        /* if all the backends are disabled, fix it up here */
+        if ((disabled_rb_mask & tmp) == tmp) {
+                for (i = 0; i < rdev->config.r600.max_backends; i++)
+                        disabled_rb_mask &= ~(1 << i);
+        }
         tmp = (tiling_config & PIPE_TILING__MASK) >> PIPE_TILING__SHIFT;
         tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.r600.max_backends,
                                         R6XX_MAX_BACKENDS, disabled_rb_mask);
@@ -2547,7 +2537,7 @@ int r600_cp_start(struct radeon_device *rdev)
         radeon_ring_write(ring, PACKET3_ME_INITIALIZE_DEVICE_ID(1));
         radeon_ring_write(ring, 0);
         radeon_ring_write(ring, 0);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         cp_me = 0xff;
         WREG32(R_0086D8_CP_ME_CNTL, cp_me);
@@ -2683,7 +2673,7 @@ int r600_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
         radeon_ring_write(ring, PACKET3(PACKET3_SET_CONFIG_REG, 1));
         radeon_ring_write(ring, ((scratch - PACKET3_SET_CONFIG_REG_OFFSET) >> 2));
         radeon_ring_write(ring, 0xDEADBEEF);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         for (i = 0; i < rdev->usec_timeout; i++) {
                 tmp = RREG32(scratch);
                 if (tmp == 0xDEADBEEF)
@@ -2753,6 +2743,17 @@ void r600_fence_ring_emit(struct radeon_device *rdev,
         }
 }
 
+/**
+ * r600_semaphore_ring_emit - emit a semaphore on the CP ring
+ *
+ * @rdev: radeon_device pointer
+ * @ring: radeon ring buffer object
+ * @semaphore: radeon semaphore object
+ * @emit_wait: Is this a sempahore wait?
+ *
+ * Emits a semaphore signal/wait packet to the CP ring and prevents the PFP
+ * from running ahead of semaphore waits.
+ */
 bool r600_semaphore_ring_emit(struct radeon_device *rdev,
                               struct radeon_ring *ring,
                               struct radeon_semaphore *semaphore,
@@ -2768,6 +2769,13 @@ bool r600_semaphore_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, lower_32_bits(addr));
         radeon_ring_write(ring, (upper_32_bits(addr) & 0xff) | sel);
 
+        /* PFP_SYNC_ME packet only exists on 7xx+ */
+        if (emit_wait && (rdev->family >= CHIP_RV770)) {
+                /* Prevent the PFP from running ahead of the semaphore wait */
+                radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
+                radeon_ring_write(ring, 0x0);
+        }
+
         return true;
 }
 
@@ -2845,7 +2853,7 @@ int r600_copy_cpdma(struct radeon_device *rdev,
                 return r;
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_semaphore_free(rdev, &sem, *fence);
 
         return r;
@@ -3165,7 +3173,7 @@ int r600_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         ib.ptr[1] = ((scratch - PACKET3_SET_CONFIG_REG_OFFSET) >> 2);
         ib.ptr[2] = 0xDEADBEEF;
         ib.length_dw = 3;
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
                 goto free_ib;
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index 4969cef44a19..51fd98553eaf 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -261,7 +261,7 @@ int r600_dma_ring_test(struct radeon_device *rdev,
         radeon_ring_write(ring, rdev->vram_scratch.gpu_addr & 0xfffffffc);
         radeon_ring_write(ring, upper_32_bits(rdev->vram_scratch.gpu_addr) & 0xff);
         radeon_ring_write(ring, 0xDEADBEEF);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = 0; i < rdev->usec_timeout; i++) {
                 tmp = readl(ptr);
@@ -368,7 +368,7 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         ib.ptr[3] = 0xDEADBEEF;
         ib.length_dw = 4;
 
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 radeon_ib_free(rdev, &ib);
                 DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
@@ -493,7 +493,7 @@ int r600_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_semaphore_free(rdev, &sem, *fence);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index f94e7a9afe75..0c4a7d8d93e0 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -1597,6 +1597,7 @@
                  */
 #              define PACKET3_CP_DMA_CMD_SAIC      (1 << 28)
 #              define PACKET3_CP_DMA_CMD_DAIC      (1 << 29)
+#define PACKET3_PFP_SYNC_ME                             0x42 /* r7xx+ only */
 #define PACKET3_SURFACE_SYNC                            0x43
 #              define PACKET3_CB0_DEST_BASE_ENA    (1 << 6)
 #              define PACKET3_FULL_CACHE_ENA       (1 << 20) /* r7xx+ only */
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 9e1732eb402c..5f05b4c84338 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -105,6 +105,7 @@ extern int radeon_vm_size;
 extern int radeon_vm_block_size;
 extern int radeon_deep_color;
 extern int radeon_use_pflipirq;
+extern int radeon_bapm;
 
 /*
  * Copy from radeon_drv.h so we don't have to include both and have conflicting
@@ -914,6 +915,8 @@ struct radeon_vm_manager {
         u64                             vram_base_offset;
         /* is vm enabled? */
         bool                            enabled;
+        /* for hw to save the PD addr on suspend/resume */
+        uint32_t                        saved_table_addr[RADEON_NUM_VM];
 };
 
 /*
@@ -967,7 +970,7 @@ int radeon_ib_get(struct radeon_device *rdev, int ring,
                   unsigned size);
 void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib *ib);
 int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
-                       struct radeon_ib *const_ib);
+                       struct radeon_ib *const_ib, bool hdp_flush);
 int radeon_ib_pool_init(struct radeon_device *rdev);
 void radeon_ib_pool_fini(struct radeon_device *rdev);
 int radeon_ib_ring_tests(struct radeon_device *rdev);
@@ -977,8 +980,10 @@ bool radeon_ring_supports_scratch_reg(struct radeon_device *rdev,
 void radeon_ring_free_size(struct radeon_device *rdev, struct radeon_ring *cp);
 int radeon_ring_alloc(struct radeon_device *rdev, struct radeon_ring *cp, unsigned ndw);
 int radeon_ring_lock(struct radeon_device *rdev, struct radeon_ring *cp, unsigned ndw);
-void radeon_ring_commit(struct radeon_device *rdev, struct radeon_ring *cp);
-void radeon_ring_unlock_commit(struct radeon_device *rdev, struct radeon_ring *cp);
+void radeon_ring_commit(struct radeon_device *rdev, struct radeon_ring *cp,
+                        bool hdp_flush);
+void radeon_ring_unlock_commit(struct radeon_device *rdev, struct radeon_ring *cp,
+                               bool hdp_flush);
 void radeon_ring_undo(struct radeon_ring *ring);
 void radeon_ring_unlock_undo(struct radeon_device *rdev, struct radeon_ring *cp);
 int radeon_ring_test(struct radeon_device *rdev, struct radeon_ring *cp);
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index ee712c199b25..83f382e8e40e 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -132,7 +132,8 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                  * the buffers used for read only, which doubles the range
                  * to 0 to 31. 32 is reserved for the kernel driver.
                  */
-                priority = (r->flags & 0xf) * 2 + !!r->write_domain;
+                priority = (r->flags & RADEON_RELOC_PRIO_MASK) * 2
+                           + !!r->write_domain;
 
                 /* the first reloc of an UVD job is the msg and that must be in
                    VRAM, also but everything into VRAM on AGP cards to avoid
@@ -450,7 +451,7 @@ static int radeon_cs_ib_chunk(struct radeon_device *rdev,
                 radeon_vce_note_usage(rdev);
 
         radeon_cs_sync_rings(parser);
-        r = radeon_ib_schedule(rdev, &parser->ib, NULL);
+        r = radeon_ib_schedule(rdev, &parser->ib, NULL, true);
         if (r) {
                 DRM_ERROR("Failed to schedule IB !\n");
         }
@@ -541,9 +542,9 @@ static int radeon_cs_ib_vm_chunk(struct radeon_device *rdev,
 
         if ((rdev->family >= CHIP_TAHITI) &&
             (parser->chunk_const_ib_idx != -1)) {
-                r = radeon_ib_schedule(rdev, &parser->ib, &parser->const_ib);
+                r = radeon_ib_schedule(rdev, &parser->ib, &parser->const_ib, true);
         } else {
-                r = radeon_ib_schedule(rdev, &parser->ib, NULL);
+                r = radeon_ib_schedule(rdev, &parser->ib, NULL, true);
         }
 
 out:
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index c8ea050c8fa4..6a219bcee66d 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1680,8 +1680,8 @@ int radeon_gpu_reset(struct radeon_device *rdev)
         radeon_save_bios_scratch_regs(rdev);
         /* block TTM */
         resched = ttm_bo_lock_delayed_workqueue(&rdev->mman.bdev);
-        radeon_pm_suspend(rdev);
         radeon_suspend(rdev);
+        radeon_hpd_fini(rdev);
 
         for (i = 0; i < RADEON_NUM_RINGS; ++i) {
                 ring_sizes[i] = radeon_ring_backup(rdev, &rdev->ring[i],
@@ -1726,9 +1726,39 @@ retry:
                 }
         }
 
-        radeon_pm_resume(rdev);
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
+                /* do dpm late init */
+                r = radeon_pm_late_init(rdev);
+                if (r) {
+                        rdev->pm.dpm_enabled = false;
+                        DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n");
+                }
+        } else {
+                /* resume old pm late */
+                radeon_pm_resume(rdev);
+        }
+
+        /* init dig PHYs, disp eng pll */
+        if (rdev->is_atom_bios) {
+                radeon_atom_encoder_init(rdev);
+                radeon_atom_disp_eng_pll_init(rdev);
+                /* turn on the BL */
+                if (rdev->mode_info.bl_encoder) {
+                        u8 bl_level = radeon_get_backlight_level(rdev,
+                                                                 rdev->mode_info.bl_encoder);
+                        radeon_set_backlight_level(rdev, rdev->mode_info.bl_encoder,
+                                                   bl_level);
+                }
+        }
+        /* reset hpd state */
+        radeon_hpd_init(rdev);
+
         drm_helper_resume_force_mode(rdev->ddev);
 
+        /* set the power state here in case we are a PX system or headless */
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
+                radeon_pm_compute_clocks(rdev);
+
         ttm_bo_unlock_delayed_workqueue(&rdev->mman.bdev, resched);
         if (r) {
                 /* bad news, how to tell it to userspace ? */
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 092d067f93e1..8df888908833 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -180,6 +180,7 @@ int radeon_vm_size = 8;
 int radeon_vm_block_size = -1;
 int radeon_deep_color = 0;
 int radeon_use_pflipirq = 2;
+int radeon_bapm = -1;
 
 MODULE_PARM_DESC(no_wb, "Disable AGP writeback for scratch registers");
 module_param_named(no_wb, radeon_no_wb, int, 0444);
@@ -259,6 +260,9 @@ module_param_named(deep_color, radeon_deep_color, int, 0444);
 MODULE_PARM_DESC(use_pflipirq, "Pflip irqs for pageflip completion (0 = disable, 1 = as fallback, 2 = exclusive (default))");
 module_param_named(use_pflipirq, radeon_use_pflipirq, int, 0444);
 
+MODULE_PARM_DESC(bapm, "BAPM support (1 = enable, 0 = disable, -1 = auto)");
+module_param_named(bapm, radeon_bapm, int, 0444);
+
 static struct pci_device_id pciidlist[] = {
         radeon_PCI_IDS
 };
diff --git a/drivers/gpu/drm/radeon/radeon_ib.c b/drivers/gpu/drm/radeon/radeon_ib.c
index 65b0c213488d..5bf2c0a05827 100644
--- a/drivers/gpu/drm/radeon/radeon_ib.c
+++ b/drivers/gpu/drm/radeon/radeon_ib.c
@@ -107,6 +107,7 @@ void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib *ib)
  * @rdev: radeon_device pointer
  * @ib: IB object to schedule
  * @const_ib: Const IB to schedule (SI only)
+ * @hdp_flush: Whether or not to perform an HDP cache flush
  *
  * Schedule an IB on the associated ring (all asics).
  * Returns 0 on success, error on failure.
@@ -122,7 +123,7 @@ void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib *ib)
  * to SI there was just a DE IB.
  */
 int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
-                       struct radeon_ib *const_ib)
+                       struct radeon_ib *const_ib, bool hdp_flush)
 {
         struct radeon_ring *ring = &rdev->ring[ib->ring];
         int r = 0;
@@ -176,7 +177,7 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
         if (ib->vm)
                 radeon_vm_fence(rdev, ib->vm, ib->fence);
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, hdp_flush);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 23314be49480..164898b0010c 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -460,10 +460,6 @@ static ssize_t radeon_get_dpm_state(struct device *dev,
         struct radeon_device *rdev = ddev->dev_private;
         enum radeon_pm_state_type pm = rdev->pm.dpm.user_state;
 
-        if  ((rdev->flags & RADEON_IS_PX) &&
-             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
-                return snprintf(buf, PAGE_SIZE, "off\n");
-
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         (pm == POWER_STATE_TYPE_BATTERY) ? "battery" :
                         (pm == POWER_STATE_TYPE_BALANCED) ? "balanced" : "performance");
@@ -477,11 +473,6 @@ static ssize_t radeon_set_dpm_state(struct device *dev,
         struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
 
-        /* Can't set dpm state when the card is off */
-        if  ((rdev->flags & RADEON_IS_PX) &&
-             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
-                return -EINVAL;
-
         mutex_lock(&rdev->pm.mutex);
         if (strncmp("battery", buf, strlen("battery")) == 0)
                 rdev->pm.dpm.user_state = POWER_STATE_TYPE_BATTERY;
@@ -495,7 +486,12 @@ static ssize_t radeon_set_dpm_state(struct device *dev,
                 goto fail;
         }
         mutex_unlock(&rdev->pm.mutex);
-        radeon_pm_compute_clocks(rdev);
+
+        /* Can't set dpm state when the card is off */
+        if (!(rdev->flags & RADEON_IS_PX) ||
+            (ddev->switch_power_state == DRM_SWITCH_POWER_ON))
+                radeon_pm_compute_clocks(rdev);
+
 fail:
         return count;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 5b4e0cf231a0..d65607902537 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -177,16 +177,18 @@ int radeon_ring_lock(struct radeon_device *rdev, struct radeon_ring *ring, unsig
  *
  * @rdev: radeon_device pointer
  * @ring: radeon_ring structure holding ring information
+ * @hdp_flush: Whether or not to perform an HDP cache flush
  *
  * Update the wptr (write pointer) to tell the GPU to
  * execute new commands on the ring buffer (all asics).
  */
-void radeon_ring_commit(struct radeon_device *rdev, struct radeon_ring *ring)
+void radeon_ring_commit(struct radeon_device *rdev, struct radeon_ring *ring,
+                        bool hdp_flush)
 {
         /* If we are emitting the HDP flush via the ring buffer, we need to
          * do it before padding.
          */
-        if (rdev->asic->ring[ring->idx]->hdp_flush)
+        if (hdp_flush && rdev->asic->ring[ring->idx]->hdp_flush)
                 rdev->asic->ring[ring->idx]->hdp_flush(rdev, ring);
         /* We pad to match fetch size */
         while (ring->wptr & ring->align_mask) {
@@ -196,7 +198,7 @@ void radeon_ring_commit(struct radeon_device *rdev, struct radeon_ring *ring)
         /* If we are emitting the HDP flush via MMIO, we need to do it after
          * all CPU writes to VRAM finished.
          */
-        if (rdev->asic->mmio_hdp_flush)
+        if (hdp_flush && rdev->asic->mmio_hdp_flush)
                 rdev->asic->mmio_hdp_flush(rdev);
         radeon_ring_set_wptr(rdev, ring);
 }
@@ -207,12 +209,14 @@ void radeon_ring_commit(struct radeon_device *rdev, struct radeon_ring *ring)
  *
  * @rdev: radeon_device pointer
  * @ring: radeon_ring structure holding ring information
+ * @hdp_flush: Whether or not to perform an HDP cache flush
  *
  * Call radeon_ring_commit() then unlock the ring (all asics).
  */
-void radeon_ring_unlock_commit(struct radeon_device *rdev, struct radeon_ring *ring)
+void radeon_ring_unlock_commit(struct radeon_device *rdev, struct radeon_ring *ring,
+                               bool hdp_flush)
 {
-        radeon_ring_commit(rdev, ring);
+        radeon_ring_commit(rdev, ring, hdp_flush);
         mutex_unlock(&rdev->ring_lock);
 }
 
@@ -372,7 +376,7 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
                 radeon_ring_write(ring, data[i]);
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         kfree(data);
         return 0;
 }
@@ -400,9 +404,7 @@ int radeon_ring_init(struct radeon_device *rdev, struct radeon_ring *ring, unsig
         /* Allocate ring buffer */
         if (ring->ring_obj == NULL) {
                 r = radeon_bo_create(rdev, ring->ring_size, PAGE_SIZE, true,
-                                     RADEON_GEM_DOMAIN_GTT,
-                                     (rdev->flags & RADEON_IS_PCIE) ?
-                                     RADEON_GEM_GTT_WC : 0,
+                                     RADEON_GEM_DOMAIN_GTT, 0,
                                      NULL, &ring->ring_obj);
                 if (r) {
                         dev_err(rdev->dev, "(%d) ring create failed\n", r);
diff --git a/drivers/gpu/drm/radeon/radeon_semaphore.c b/drivers/gpu/drm/radeon/radeon_semaphore.c
index dbd6bcde92de..56d9fd66d8ae 100644
--- a/drivers/gpu/drm/radeon/radeon_semaphore.c
+++ b/drivers/gpu/drm/radeon/radeon_semaphore.c
@@ -179,7 +179,7 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                         continue;
                 }
 
-                radeon_ring_commit(rdev, &rdev->ring[i]);
+                radeon_ring_commit(rdev, &rdev->ring[i], false);
                 radeon_fence_note_sync(fence, ring);
 
                 semaphore->gpu_addr += 8;
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index 5adf4207453d..17bc3dced9f1 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -288,7 +288,7 @@ static int radeon_test_create_and_emit_fence(struct radeon_device *rdev,
                         return r;
                 }
                 radeon_fence_emit(rdev, fence, ring->idx);
-                radeon_ring_unlock_commit(rdev, ring);
+                radeon_ring_unlock_commit(rdev, ring, false);
         }
         return 0;
 }
@@ -313,7 +313,7 @@ void radeon_test_ring_sync(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_wait(rdev, ringA->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringA);
+        radeon_ring_unlock_commit(rdev, ringA, false);
 
         r = radeon_test_create_and_emit_fence(rdev, ringA, &fence1);
         if (r)
@@ -325,7 +325,7 @@ void radeon_test_ring_sync(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_wait(rdev, ringA->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringA);
+        radeon_ring_unlock_commit(rdev, ringA, false);
 
         r = radeon_test_create_and_emit_fence(rdev, ringA, &fence2);
         if (r)
@@ -344,7 +344,7 @@ void radeon_test_ring_sync(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_signal(rdev, ringB->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringB);
+        radeon_ring_unlock_commit(rdev, ringB, false);
 
         r = radeon_fence_wait(fence1, false);
         if (r) {
@@ -365,7 +365,7 @@ void radeon_test_ring_sync(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_signal(rdev, ringB->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringB);
+        radeon_ring_unlock_commit(rdev, ringB, false);
 
         r = radeon_fence_wait(fence2, false);
         if (r) {
@@ -408,7 +408,7 @@ static void radeon_test_ring_sync2(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_wait(rdev, ringA->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringA);
+        radeon_ring_unlock_commit(rdev, ringA, false);
 
         r = radeon_test_create_and_emit_fence(rdev, ringA, &fenceA);
         if (r)
@@ -420,7 +420,7 @@ static void radeon_test_ring_sync2(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_wait(rdev, ringB->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringB);
+        radeon_ring_unlock_commit(rdev, ringB, false);
         r = radeon_test_create_and_emit_fence(rdev, ringB, &fenceB);
         if (r)
                 goto out_cleanup;
@@ -442,7 +442,7 @@ static void radeon_test_ring_sync2(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_signal(rdev, ringC->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringC);
+        radeon_ring_unlock_commit(rdev, ringC, false);
 
         for (i = 0; i < 30; ++i) {
                 mdelay(100);
@@ -468,7 +468,7 @@ static void radeon_test_ring_sync2(struct radeon_device *rdev,
                 goto out_cleanup;
         }
         radeon_semaphore_emit_signal(rdev, ringC->idx, semaphore);
-        radeon_ring_unlock_commit(rdev, ringC);
+        radeon_ring_unlock_commit(rdev, ringC, false);
 
         mdelay(1000);
 
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 6bf55ec85b62..341848a14376 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -646,7 +646,7 @@ static int radeon_uvd_send_msg(struct radeon_device *rdev,
                 ib.ptr[i] = PACKET2(0);
         ib.length_dw = 16;
 
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r)
                 goto err;
         ttm_eu_fence_buffer_objects(&ticket, &head, ib.fence);
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index f9b70a43aa52..c7190aadbd89 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -368,7 +368,7 @@ int radeon_vce_get_create_msg(struct radeon_device *rdev, int ring,
         for (i = ib.length_dw; i < ib_size_dw; ++i)
                 ib.ptr[i] = 0x0;
 
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
         }
@@ -425,7 +425,7 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
         for (i = ib.length_dw; i < ib_size_dw; ++i)
                 ib.ptr[i] = 0x0;
 
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
         }
@@ -715,7 +715,7 @@ int radeon_vce_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
                 return r;
         }
         radeon_ring_write(ring, VCE_CMD_END);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = 0; i < rdev->usec_timeout; i++) {
                 if (vce_v1_0_get_rptr(rdev, ring) != rptr)
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index ccae4d9dc3de..088ffdc2f577 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -420,7 +420,7 @@ static int radeon_vm_clear_bo(struct radeon_device *rdev,
         radeon_asic_vm_pad_ib(rdev, &ib);
         WARN_ON(ib.length_dw > 64);
 
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r)
                 goto error;
 
@@ -483,6 +483,10 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
                         /* add a clone of the bo_va to clear the old address */
                         struct radeon_bo_va *tmp;
                         tmp = kzalloc(sizeof(struct radeon_bo_va), GFP_KERNEL);
+                        if (!tmp) {
+                                mutex_unlock(&vm->mutex);
+                                return -ENOMEM;
+                        }
                         tmp->it.start = bo_va->it.start;
                         tmp->it.last = bo_va->it.last;
                         tmp->vm = vm;
@@ -693,7 +697,7 @@ int radeon_vm_update_page_directory(struct radeon_device *rdev,
                 radeon_semaphore_sync_to(ib.semaphore, pd->tbo.sync_obj);
                 radeon_semaphore_sync_to(ib.semaphore, vm->last_id_use);
                 WARN_ON(ib.length_dw > ndw);
-                r = radeon_ib_schedule(rdev, &ib, NULL);
+                r = radeon_ib_schedule(rdev, &ib, NULL, false);
                 if (r) {
                         radeon_ib_free(rdev, &ib);
                         return r;
@@ -957,7 +961,7 @@ int radeon_vm_bo_update(struct radeon_device *rdev,
         WARN_ON(ib.length_dw > ndw);
 
         radeon_semaphore_sync_to(ib.semaphore, vm->fence);
-        r = radeon_ib_schedule(rdev, &ib, NULL);
+        r = radeon_ib_schedule(rdev, &ib, NULL, false);
         if (r) {
                 radeon_ib_free(rdev, &ib);
                 return r;
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 3e21e869015f..8a477bf1fdb3 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -124,7 +124,7 @@ void rv515_ring_start(struct radeon_device *rdev, struct radeon_ring *ring)
         radeon_ring_write(ring, GEOMETRY_ROUND_NEAREST | COLOR_ROUND_NEAREST);
         radeon_ring_write(ring, PACKET0(0x20C8, 0));
         radeon_ring_write(ring, 0);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 }
 
 int rv515_mc_wait_for_idle(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 2983f17ea1b3..d9f5ce715c9b 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1177,7 +1177,6 @@ static void rv770_gpu_init(struct radeon_device *rdev)
         u32 hdp_host_path_cntl;
         u32 sq_dyn_gpr_size_simd_ab_0;
         u32 gb_tiling_config = 0;
-        u32 cc_rb_backend_disable = 0;
         u32 cc_gc_shader_pipe_config = 0;
         u32 mc_arb_ramcfg;
         u32 db_debug4, tmp;
@@ -1311,21 +1310,7 @@ static void rv770_gpu_init(struct radeon_device *rdev)
                 WREG32(SPI_CONFIG_CNTL, 0);
         }
 
-        cc_rb_backend_disable = RREG32(CC_RB_BACKEND_DISABLE) & 0x00ff0000;
-        tmp = R7XX_MAX_BACKENDS - r600_count_pipe_bits(cc_rb_backend_disable >> 16);
-        if (tmp < rdev->config.rv770.max_backends) {
-                rdev->config.rv770.max_backends = tmp;
-        }
-
         cc_gc_shader_pipe_config = RREG32(CC_GC_SHADER_PIPE_CONFIG) & 0xffffff00;
-        tmp = R7XX_MAX_PIPES - r600_count_pipe_bits((cc_gc_shader_pipe_config >> 8) & R7XX_MAX_PIPES_MASK);
-        if (tmp < rdev->config.rv770.max_pipes) {
-                rdev->config.rv770.max_pipes = tmp;
-        }
-        tmp = R7XX_MAX_SIMDS - r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R7XX_MAX_SIMDS_MASK);
-        if (tmp < rdev->config.rv770.max_simds) {
-                rdev->config.rv770.max_simds = tmp;
-        }
         tmp = rdev->config.rv770.max_simds -
                 r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R7XX_MAX_SIMDS_MASK);
         rdev->config.rv770.active_simds = tmp;
@@ -1348,6 +1333,14 @@ static void rv770_gpu_init(struct radeon_device *rdev)
         rdev->config.rv770.tiling_npipes = rdev->config.rv770.max_tile_pipes;
 
         disabled_rb_mask = (RREG32(CC_RB_BACKEND_DISABLE) >> 16) & R7XX_MAX_BACKENDS_MASK;
+        tmp = 0;
+        for (i = 0; i < rdev->config.rv770.max_backends; i++)
+                tmp |= (1 << i);
+        /* if all the backends are disabled, fix it up here */
+        if ((disabled_rb_mask & tmp) == tmp) {
+                for (i = 0; i < rdev->config.rv770.max_backends; i++)
+                        disabled_rb_mask &= ~(1 << i);
+        }
         tmp = (gb_tiling_config & PIPE_TILING__MASK) >> PIPE_TILING__SHIFT;
         tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.rv770.max_backends,
                                         R7XX_MAX_BACKENDS, disabled_rb_mask);
diff --git a/drivers/gpu/drm/radeon/rv770_dma.c b/drivers/gpu/drm/radeon/rv770_dma.c
index bbf2e076ee45..74426ac2bb5c 100644
--- a/drivers/gpu/drm/radeon/rv770_dma.c
+++ b/drivers/gpu/drm/radeon/rv770_dma.c
@@ -90,7 +90,7 @@ int rv770_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_semaphore_free(rdev, &sem, *fence);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 011779bd2b3d..6bce40847753 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3057,7 +3057,7 @@ static void si_gpu_init(struct radeon_device *rdev)
         u32 sx_debug_1;
         u32 hdp_host_path_cntl;
         u32 tmp;
-        int i, j, k;
+        int i, j;
 
         switch (rdev->family) {
         case CHIP_TAHITI:
@@ -3255,12 +3255,11 @@ static void si_gpu_init(struct radeon_device *rdev)
                      rdev->config.si.max_sh_per_se,
                      rdev->config.si.max_cu_per_sh);
 
+        rdev->config.si.active_cus = 0;
         for (i = 0; i < rdev->config.si.max_shader_engines; i++) {
                 for (j = 0; j < rdev->config.si.max_sh_per_se; j++) {
-                        for (k = 0; k < rdev->config.si.max_cu_per_sh; k++) {
-                                rdev->config.si.active_cus +=
-                                        hweight32(si_get_cu_active_bitmap(rdev, i, j));
-                        }
+                        rdev->config.si.active_cus +=
+                                hweight32(si_get_cu_active_bitmap(rdev, i, j));
                 }
         }
 
@@ -3541,7 +3540,7 @@ static int si_cp_start(struct radeon_device *rdev)
         radeon_ring_write(ring, PACKET3_BASE_INDEX(CE_PARTITION_BASE));
         radeon_ring_write(ring, 0xc000);
         radeon_ring_write(ring, 0xe000);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         si_cp_enable(rdev, true);
 
@@ -3570,7 +3569,7 @@ static int si_cp_start(struct radeon_device *rdev)
         radeon_ring_write(ring, 0x0000000e); /* VGT_VERTEX_REUSE_BLOCK_CNTL */
         radeon_ring_write(ring, 0x00000010); /* VGT_OUT_DEALLOC_CNTL */
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) {
                 ring = &rdev->ring[i];
@@ -3580,7 +3579,7 @@ static int si_cp_start(struct radeon_device *rdev)
                 radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0));
                 radeon_ring_write(ring, 0);
 
-                radeon_ring_unlock_commit(rdev, ring);
+                radeon_ring_unlock_commit(rdev, ring, false);
         }
 
         return 0;
@@ -4291,10 +4290,10 @@ static int si_pcie_gart_enable(struct radeon_device *rdev)
         for (i = 1; i < 16; i++) {
                 if (i < 8)
                         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
-                               rdev->gart.table_addr >> 12);
+                               rdev->vm_manager.saved_table_addr[i]);
                 else
                         WREG32(VM_CONTEXT8_PAGE_TABLE_BASE_ADDR + ((i - 8) << 2),
-                               rdev->gart.table_addr >> 12);
+                               rdev->vm_manager.saved_table_addr[i]);
         }
 
         /* enable context1-15 */
@@ -4326,6 +4325,17 @@ static int si_pcie_gart_enable(struct radeon_device *rdev)
 
 static void si_pcie_gart_disable(struct radeon_device *rdev)
 {
+        unsigned i;
+
+        for (i = 1; i < 16; ++i) {
+                uint32_t reg;
+                if (i < 8)
+                        reg = VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2);
+                else
+                        reg = VM_CONTEXT8_PAGE_TABLE_BASE_ADDR + ((i - 8) << 2);
+                rdev->vm_manager.saved_table_addr[i] = RREG32(reg);
+        }
+
         /* Disable all tables */
         WREG32(VM_CONTEXT0_CNTL, 0);
         WREG32(VM_CONTEXT1_CNTL, 0);
@@ -5028,7 +5038,7 @@ void si_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
 
         /* flush hdp cache */
         radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(1) |
                                  WRITE_DATA_DST_SEL(0)));
         radeon_ring_write(ring, HDP_MEM_COHERENCY_FLUSH_CNTL >> 2);
         radeon_ring_write(ring, 0);
@@ -5036,7 +5046,7 @@ void si_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
 
         /* bits 0-15 are the VM contexts0-15 */
         radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(1) |
                                  WRITE_DATA_DST_SEL(0)));
         radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
         radeon_ring_write(ring, 0);
@@ -7178,6 +7188,9 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
         int ret, i;
         u16 tmp16;
 
+        if (pci_is_root_bus(rdev->pdev->bus))
+                return;
+
         if (radeon_pcie_gen2 == 0)
                 return;
 
@@ -7455,7 +7468,8 @@ static void si_program_aspm(struct radeon_device *rdev)
                         if (orig != data)
                                 WREG32_PIF_PHY1(PB1_PIF_CNTL, data);
 
-                        if (!disable_clkreq) {
+                        if (!disable_clkreq &&
+                            !pci_is_root_bus(rdev->pdev->bus)) {
                                 struct pci_dev *root = rdev->pdev->bus->self;
                                 u32 lnkcap;
 
diff --git a/drivers/gpu/drm/radeon/si_dma.c b/drivers/gpu/drm/radeon/si_dma.c
index 716505129450..7c22baaf94db 100644
--- a/drivers/gpu/drm/radeon/si_dma.c
+++ b/drivers/gpu/drm/radeon/si_dma.c
@@ -275,7 +275,7 @@ int si_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         radeon_semaphore_free(rdev, &sem, *fence);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 32e50be9c4ac..57f780053b3e 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1874,16 +1874,22 @@ int trinity_dpm_init(struct radeon_device *rdev)
         for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
                 pi->at[i] = TRINITY_AT_DFLT;
 
-        /* There are stability issues reported on with
-         * bapm enabled when switching between AC and battery
-         * power.  At the same time, some MSI boards hang
-         * if it's not enabled and dpm is enabled.  Just enable
-         * it for MSI boards right now.
-         */
-        if (rdev->pdev->subsystem_vendor == 0x1462)
-                pi->enable_bapm = true;
-        else
+        if (radeon_bapm == -1) {
+                /* There are stability issues reported on with
+                 * bapm enabled when switching between AC and battery
+                 * power.  At the same time, some MSI boards hang
+                 * if it's not enabled and dpm is enabled.  Just enable
+                 * it for MSI boards right now.
+                 */
+                if (rdev->pdev->subsystem_vendor == 0x1462)
+                        pi->enable_bapm = true;
+                else
+                        pi->enable_bapm = false;
+        } else if (radeon_bapm == 0) {
                 pi->enable_bapm = false;
+        } else {
+                pi->enable_bapm = true;
+        }
         pi->enable_nbps_policy = true;
         pi->enable_sclk_ds = true;
         pi->enable_gfx_power_gating = true;
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index be42c8125203..cda391347286 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -124,7 +124,7 @@ int uvd_v1_0_init(struct radeon_device *rdev)
         radeon_ring_write(ring, PACKET0(UVD_SEMA_CNTL, 0));
         radeon_ring_write(ring, 3);
 
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
 
 done:
         /* lower clocks again */
@@ -331,7 +331,7 @@ int uvd_v1_0_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
         radeon_ring_write(ring, PACKET0(UVD_CONTEXT_ID, 0));
         radeon_ring_write(ring, 0xDEADBEEF);
-        radeon_ring_unlock_commit(rdev, ring);
+        radeon_ring_unlock_commit(rdev, ring, false);
         for (i = 0; i < rdev->usec_timeout; i++) {
                 tmp = RREG32(UVD_CONTEXT_ID);
                 if (tmp == 0xDEADBEEF)
diff --git a/drivers/gpu/drm/sti/Kconfig b/drivers/gpu/drm/sti/Kconfig
index 2d9d4252d598..ae8850f3e63b 100644
--- a/drivers/gpu/drm/sti/Kconfig
+++ b/drivers/gpu/drm/sti/Kconfig
@@ -1,6 +1,7 @@
 config DRM_STI
         tristate "DRM Support for STMicroelectronics SoC stiH41x Series"
         depends on DRM && (SOC_STIH415 || SOC_STIH416 || ARCH_MULTIPLATFORM)
+        select RESET_CONTROLLER
         select DRM_KMS_HELPER
         select DRM_GEM_CMA_HELPER
         select DRM_KMS_CMA_HELPER
diff --git a/drivers/gpu/drm/sti/sti_drm_drv.c b/drivers/gpu/drm/sti/sti_drm_drv.c
index a7cc24917a96..223d93c3a05d 100644
--- a/drivers/gpu/drm/sti/sti_drm_drv.c
+++ b/drivers/gpu/drm/sti/sti_drm_drv.c
@@ -201,8 +201,8 @@ static int sti_drm_platform_probe(struct platform_device *pdev)
         master = platform_device_register_resndata(dev,
                         DRIVER_NAME "__master", -1,
                         NULL, 0, NULL, 0);
-        if (!master)
-                return -EINVAL;
+        if (IS_ERR(master))
+               return PTR_ERR(master);
 
         platform_set_drvdata(pdev, master);
         return 0;
diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
index 72d957f81c05..2ae9a9b73666 100644
--- a/drivers/gpu/drm/sti/sti_hda.c
+++ b/drivers/gpu/drm/sti/sti_hda.c
@@ -730,16 +730,16 @@ static int sti_hda_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
         hda->regs = devm_ioremap_nocache(dev, res->start, resource_size(res));
-        if (IS_ERR(hda->regs))
-                return PTR_ERR(hda->regs);
+        if (!hda->regs)
+                return -ENOMEM;
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                         "video-dacs-ctrl");
         if (res) {
                 hda->video_dacs_ctrl = devm_ioremap_nocache(dev, res->start,
                                 resource_size(res));
-                if (IS_ERR(hda->video_dacs_ctrl))
-                        return PTR_ERR(hda->video_dacs_ctrl);
+                if (!hda->video_dacs_ctrl)
+                        return -ENOMEM;
         } else {
                 /* If no existing video-dacs-ctrl resource continue the probe */
                 DRM_DEBUG_DRIVER("No video-dacs-ctrl resource\n");
@@ -770,7 +770,7 @@ static int sti_hda_remove(struct platform_device *pdev)
         return 0;
 }
 
-static struct of_device_id hda_of_match[] = {
+static const struct of_device_id hda_of_match[] = {
         { .compatible = "st,stih416-hda", },
         { .compatible = "st,stih407-hda", },
         { /* end node */ }
diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
index 284e541d970d..ef93156a69c6 100644
--- a/drivers/gpu/drm/sti/sti_hdmi.c
+++ b/drivers/gpu/drm/sti/sti_hdmi.c
@@ -677,7 +677,7 @@ static const struct component_ops sti_hdmi_ops = {
         .unbind = sti_hdmi_unbind,
 };
 
-static struct of_device_id hdmi_of_match[] = {
+static const struct of_device_id hdmi_of_match[] = {
         {
                 .compatible = "st,stih416-hdmi",
                 .data = &tx3g0c55phy_ops,
@@ -713,8 +713,8 @@ static int sti_hdmi_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
         hdmi->regs = devm_ioremap_nocache(dev, res->start, resource_size(res));
-        if (IS_ERR(hdmi->regs))
-                return PTR_ERR(hdmi->regs);
+        if (!hdmi->regs)
+                return -ENOMEM;
 
         if (of_device_is_compatible(np, "st,stih416-hdmi")) {
                 res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -725,8 +725,8 @@ static int sti_hdmi_probe(struct platform_device *pdev)
                 }
                 hdmi->syscfg = devm_ioremap_nocache(dev, res->start,
                                                     resource_size(res));
-                if (IS_ERR(hdmi->syscfg))
-                        return PTR_ERR(hdmi->syscfg);
+                if (!hdmi->syscfg)
+                        return -ENOMEM;
 
         }
 
diff --git a/drivers/gpu/drm/sti/sti_tvout.c b/drivers/gpu/drm/sti/sti_tvout.c
index b69e26fee76e..b8afe490356a 100644
--- a/drivers/gpu/drm/sti/sti_tvout.c
+++ b/drivers/gpu/drm/sti/sti_tvout.c
@@ -591,8 +591,8 @@ static int sti_tvout_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
         tvout->regs = devm_ioremap_nocache(dev, res->start, resource_size(res));
-        if (IS_ERR(tvout->regs))
-                return PTR_ERR(tvout->regs);
+        if (!tvout->regs)
+                return -ENOMEM;
 
         /* get reset resources */
         tvout->reset = devm_reset_control_get(dev, "tvout");
@@ -624,7 +624,7 @@ static int sti_tvout_remove(struct platform_device *pdev)
         return 0;
 }
 
-static struct of_device_id tvout_of_match[] = {
+static const struct of_device_id tvout_of_match[] = {
         { .compatible = "st,stih416-tvout", },
         { .compatible = "st,stih407-tvout", },
         { /* end node */ }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 7bfdaa163a33..36b871686d3c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -450,11 +450,11 @@ static int vmw_cmd_res_reloc_add(struct vmw_private *dev_priv,
                                           res,
                                           id_loc - sw_context->buf_start);
         if (unlikely(ret != 0))
-                goto out_err;
+                return ret;
 
         ret = vmw_resource_val_add(sw_context, res, &node);
         if (unlikely(ret != 0))
-                goto out_err;
+                return ret;
 
         if (res_type == vmw_res_context && dev_priv->has_mob &&
             node->first_usage) {
@@ -468,13 +468,13 @@ static int vmw_cmd_res_reloc_add(struct vmw_private *dev_priv,
 
                 ret = vmw_resource_context_res_add(dev_priv, sw_context, res);
                 if (unlikely(ret != 0))
-                        goto out_err;
+                        return ret;
                 node->staged_bindings =
                         kzalloc(sizeof(*node->staged_bindings), GFP_KERNEL);
                 if (node->staged_bindings == NULL) {
                         DRM_ERROR("Failed to allocate context binding "
                                   "information.\n");
-                        goto out_err;
+                        return -ENOMEM;
                 }
                 INIT_LIST_HEAD(&node->staged_bindings->list);
         }
@@ -482,8 +482,7 @@ static int vmw_cmd_res_reloc_add(struct vmw_private *dev_priv,
         if (p_val)
                 *p_val = node;
 
-out_err:
-        return ret;
+        return 0;
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index 6ccd993e26bf..6eae14d2a3f7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -180,8 +180,9 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
 
         mutex_lock(&dev_priv->hw_mutex);
 
+        vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
         while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
-                vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+                ;
 
         dev_priv->last_read_seqno = ioread32(fifo_mem + SVGA_FIFO_FENCE);
 
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index b7ba82960c79..9bf8637747a5 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -656,7 +656,6 @@ static int logi_dj_raw_event(struct hid_device *hdev,
         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
         struct dj_report *dj_report = (struct dj_report *) data;
         unsigned long flags;
-        bool report_processed = false;
 
         dbg_hid("%s, size:%d\n", __func__, size);
 
@@ -683,34 +682,42 @@ static int logi_dj_raw_event(struct hid_device *hdev,
          * device (via hid_input_report() ) and return 1 so hid-core does not do
          * anything else with it.
          */
+
+        /* case 1) */
+        if (data[0] != REPORT_ID_DJ_SHORT)
+                return false;
+
         if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
             (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
-                dev_err(&hdev->dev, "%s: invalid device index:%d\n",
+                /*
+                 * Device index is wrong, bail out.
+                 * This driver can ignore safely the receiver notifications,
+                 * so ignore those reports too.
+                 */
+                if (dj_report->device_index != DJ_RECEIVER_INDEX)
+                        dev_err(&hdev->dev, "%s: invalid device index:%d\n",
                                 __func__, dj_report->device_index);
                 return false;
         }
 
         spin_lock_irqsave(&djrcv_dev->lock, flags);
-        if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
-                switch (dj_report->report_type) {
-                case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
-                case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
-                        logi_dj_recv_queue_notification(djrcv_dev, dj_report);
-                        break;
-                case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
-                        if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
-                            STATUS_LINKLOSS) {
-                                logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
-                        }
-                        break;
-                default:
-                        logi_dj_recv_forward_report(djrcv_dev, dj_report);
+        switch (dj_report->report_type) {
+        case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
+        case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
+                logi_dj_recv_queue_notification(djrcv_dev, dj_report);
+                break;
+        case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
+                if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
+                    STATUS_LINKLOSS) {
+                        logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
                 }
-                report_processed = true;
+                break;
+        default:
+                logi_dj_recv_forward_report(djrcv_dev, dj_report);
         }
         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
 
-        return report_processed;
+        return true;
 }
 
 static int logi_dj_probe(struct hid_device *hdev,
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
index 4a4000340ce1..daeb0aa4bee9 100644
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -27,6 +27,7 @@
 
 #define DJ_MAX_PAIRED_DEVICES                   6
 #define DJ_MAX_NUMBER_NOTIFICATIONS             8
+#define DJ_RECEIVER_INDEX                       0
 #define DJ_DEVICE_INDEX_MIN                     1
 #define DJ_DEVICE_INDEX_MAX                     6
 
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index ecc2cbf300cc..29a74c1efcb8 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
                 if (size < 4 || ((size - 4) % 9) != 0)
                         return 0;
                 npoints = (size - 4) / 9;
+                if (npoints > 15) {
+                        hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
+                                        size);
+                        return 0;
+                }
                 msc->ntouches = 0;
                 for (ii = 0; ii < npoints; ii++)
                         magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
                 if (size < 6 || ((size - 6) % 8) != 0)
                         return 0;
                 npoints = (size - 6) / 8;
+                if (npoints > 15) {
+                        hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
+                                        size);
+                        return 0;
+                }
                 msc->ntouches = 0;
                 for (ii = 0; ii < npoints; ii++)
                         magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
index acbb021065ec..020df3c2e8b4 100644
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev,
         if (!data)
                 return 1;
 
+        if (size > 64) {
+                hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
+                                size);
+                return 0;
+        }
+
         if (report->id == REPORT_KEY_STATE) {
                 if (data->input_keys)
                         ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
diff --git a/drivers/hwmon/ds1621.c b/drivers/hwmon/ds1621.c
index fc6f5d54e7f7..8890870309e4 100644
--- a/drivers/hwmon/ds1621.c
+++ b/drivers/hwmon/ds1621.c
@@ -309,6 +309,7 @@ static ssize_t set_convrate(struct device *dev, struct device_attribute *da,
         data->conf |= (resol << DS1621_REG_CONFIG_RESOL_SHIFT);
         i2c_smbus_write_byte_data(client, DS1621_REG_CONF, data->conf);
         data->update_interval = ds1721_convrates[resol];
+        data->zbits = 7 - resol;
         mutex_unlock(&data->update_lock);
 
         return count;
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index 79a68999a696..917d54588d95 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -101,6 +101,7 @@ struct at91_twi_dev {
         unsigned twi_cwgr_reg;
         struct at91_twi_pdata *pdata;
         bool use_dma;
+        bool recv_len_abort;
         struct at91_twi_dma dma;
 };
 
@@ -267,12 +268,24 @@ static void at91_twi_read_next_byte(struct at91_twi_dev *dev)
         *dev->buf = at91_twi_read(dev, AT91_TWI_RHR) & 0xff;
         --dev->buf_len;
 
+        /* return if aborting, we only needed to read RHR to clear RXRDY*/
+        if (dev->recv_len_abort)
+                return;
+
         /* handle I2C_SMBUS_BLOCK_DATA */
         if (unlikely(dev->msg->flags & I2C_M_RECV_LEN)) {
-                dev->msg->flags &= ~I2C_M_RECV_LEN;
-                dev->buf_len += *dev->buf;
-                dev->msg->len = dev->buf_len + 1;
-                dev_dbg(dev->dev, "received block length %d\n", dev->buf_len);
+                /* ensure length byte is a valid value */
+                if (*dev->buf <= I2C_SMBUS_BLOCK_MAX && *dev->buf > 0) {
+                        dev->msg->flags &= ~I2C_M_RECV_LEN;
+                        dev->buf_len += *dev->buf;
+                        dev->msg->len = dev->buf_len + 1;
+                        dev_dbg(dev->dev, "received block length %d\n",
+                                         dev->buf_len);
+                } else {
+                        /* abort and send the stop by reading one more byte */
+                        dev->recv_len_abort = true;
+                        dev->buf_len = 1;
+                }
         }
 
         /* send stop if second but last byte has been read */
@@ -421,8 +434,8 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 }
         }
 
-        ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
-                                                        dev->adapter.timeout);
+        ret = wait_for_completion_io_timeout(&dev->cmd_complete,
+                                             dev->adapter.timeout);
         if (ret == 0) {
                 dev_err(dev->dev, "controller timed out\n");
                 at91_init_twi_bus(dev);
@@ -444,6 +457,12 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 ret = -EIO;
                 goto error;
         }
+        if (dev->recv_len_abort) {
+                dev_err(dev->dev, "invalid smbus block length recvd\n");
+                ret = -EPROTO;
+                goto error;
+        }
+
         dev_dbg(dev->dev, "transfer complete\n");
 
         return 0;
@@ -500,6 +519,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
         dev->buf_len = m_start->len;
         dev->buf = m_start->buf;
         dev->msg = m_start;
+        dev->recv_len_abort = false;
 
         ret = at91_do_twi_transfer(dev);
 
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 6dc5ded86f62..2f64273d3f2b 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -746,8 +746,7 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
         }
         tclk = clk_get_rate(drv_data->clk);
 
-        rc = of_property_read_u32(np, "clock-frequency", &bus_freq);
-        if (rc)
+        if (of_property_read_u32(np, "clock-frequency", &bus_freq))
                 bus_freq = 100000; /* 100kHz by default */
 
         if (!mv64xxx_find_baud_factors(bus_freq, tclk,
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index f3c7139dfa25..1cc146cfc1f3 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -34,6 +34,7 @@
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
+#include <linux/spinlock.h>
 
 /* register offsets */
 #define ICSCR   0x00    /* slave ctrl */
@@ -95,6 +96,7 @@ struct rcar_i2c_priv {
         struct i2c_msg  *msg;
         struct clk *clk;
 
+        spinlock_t lock;
         wait_queue_head_t wait;
 
         int pos;
@@ -365,20 +367,20 @@ static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
         struct rcar_i2c_priv *priv = ptr;
         u32 msr;
 
+        /*-------------- spin lock -----------------*/
+        spin_lock(&priv->lock);
+
         msr = rcar_i2c_read(priv, ICMSR);
 
+        /* Only handle interrupts that are currently enabled */
+        msr &= rcar_i2c_read(priv, ICMIER);
+
         /* Arbitration lost */
         if (msr & MAL) {
                 rcar_i2c_flags_set(priv, (ID_DONE | ID_ARBLOST));
                 goto out;
         }
 
-        /* Stop */
-        if (msr & MST) {
-                rcar_i2c_flags_set(priv, ID_DONE);
-                goto out;
-        }
-
         /* Nack */
         if (msr & MNR) {
                 /* go to stop phase */
@@ -388,6 +390,12 @@ static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
                 goto out;
         }
 
+        /* Stop */
+        if (msr & MST) {
+                rcar_i2c_flags_set(priv, ID_DONE);
+                goto out;
+        }
+
         if (rcar_i2c_is_recv(priv))
                 rcar_i2c_flags_set(priv, rcar_i2c_irq_recv(priv, msr));
         else
@@ -400,6 +408,9 @@ out:
                 wake_up(&priv->wait);
         }
 
+        spin_unlock(&priv->lock);
+        /*-------------- spin unlock -----------------*/
+
         return IRQ_HANDLED;
 }
 
@@ -409,14 +420,21 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 {
         struct rcar_i2c_priv *priv = i2c_get_adapdata(adap);
         struct device *dev = rcar_i2c_priv_to_dev(priv);
+        unsigned long flags;
         int i, ret, timeout;
 
         pm_runtime_get_sync(dev);
 
+        /*-------------- spin lock -----------------*/
+        spin_lock_irqsave(&priv->lock, flags);
+
         rcar_i2c_init(priv);
         /* start clock */
         rcar_i2c_write(priv, ICCCR, priv->icccr);
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+        /*-------------- spin unlock -----------------*/
+
         ret = rcar_i2c_bus_barrier(priv);
         if (ret < 0)
                 goto out;
@@ -428,6 +446,9 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
                         break;
                 }
 
+                /*-------------- spin lock -----------------*/
+                spin_lock_irqsave(&priv->lock, flags);
+
                 /* init each data */
                 priv->msg       = &msgs[i];
                 priv->pos       = 0;
@@ -437,6 +458,9 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 
                 ret = rcar_i2c_prepare_msg(priv);
 
+                spin_unlock_irqrestore(&priv->lock, flags);
+                /*-------------- spin unlock -----------------*/
+
                 if (ret < 0)
                         break;
 
@@ -540,6 +564,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)
 
         irq = platform_get_irq(pdev, 0);
         init_waitqueue_head(&priv->wait);
+        spin_lock_init(&priv->lock);
 
         adap = &priv->adap;
         adap->nr = pdev->id;
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 69e11853e8bf..e637c32ae517 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -323,6 +323,10 @@ static void rk3x_i2c_handle_read(struct rk3x_i2c *i2c, unsigned int ipd)
         /* ack interrupt */
         i2c_writel(i2c, REG_INT_MBRF, REG_IPD);
 
+        /* Can only handle a maximum of 32 bytes at a time */
+        if (len > 32)
+                len = 32;
+
         /* read the data from receive buffer */
         for (i = 0; i < len; ++i) {
                 if (i % 4 == 0)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index e1e558a3d692..af8256353c7d 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1089,6 +1089,30 @@ static int __mlx4_ib_destroy_flow(struct mlx4_dev *dev, u64 reg_id)
         return err;
 }
 
+static int mlx4_ib_tunnel_steer_add(struct ib_qp *qp, struct ib_flow_attr *flow_attr,
+                                    u64 *reg_id)
+{
+        void *ib_flow;
+        union ib_flow_spec *ib_spec;
+        struct mlx4_dev *dev = to_mdev(qp->device)->dev;
+        int err = 0;
+
+        if (dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
+                return 0; /* do nothing */
+
+        ib_flow = flow_attr + 1;
+        ib_spec = (union ib_flow_spec *)ib_flow;
+
+        if (ib_spec->type !=  IB_FLOW_SPEC_ETH || flow_attr->num_of_specs != 1)
+                return 0; /* do nothing */
+
+        err = mlx4_tunnel_steer_add(to_mdev(qp->device)->dev, ib_spec->eth.val.dst_mac,
+                                    flow_attr->port, qp->qp_num,
+                                    MLX4_DOMAIN_UVERBS | (flow_attr->priority & 0xff),
+                                    reg_id);
+        return err;
+}
+
 static struct ib_flow *mlx4_ib_create_flow(struct ib_qp *qp,
                                     struct ib_flow_attr *flow_attr,
                                     int domain)
@@ -1136,6 +1160,12 @@ static struct ib_flow *mlx4_ib_create_flow(struct ib_qp *qp,
                 i++;
         }
 
+        if (i < ARRAY_SIZE(type) && flow_attr->type == IB_FLOW_ATTR_NORMAL) {
+                err = mlx4_ib_tunnel_steer_add(qp, flow_attr, &mflow->reg_id[i]);
+                if (err)
+                        goto err_free;
+        }
+
         return &mflow->ibflow;
 
 err_free:
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 67780452f0cf..efb9eff8906c 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1677,9 +1677,15 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
                 }
         }
 
-        if (qp->ibqp.qp_type == IB_QPT_RAW_PACKET)
+        if (qp->ibqp.qp_type == IB_QPT_RAW_PACKET) {
                 context->pri_path.ackto = (context->pri_path.ackto & 0xf8) |
                                         MLX4_IB_LINK_TYPE_ETH;
+                if (dev->dev->caps.tunnel_offload_mode ==  MLX4_TUNNEL_OFFLOAD_MODE_VXLAN) {
+                        /* set QP to receive both tunneled & non-tunneled packets */
+                        if (!(context->flags & (1 << MLX4_RSS_QPC_FLAG_OFFSET)))
+                                context->srqn = cpu_to_be32(7 << 28);
+                }
+        }
 
         if (ibqp->qp_type == IB_QPT_UD && (new_state == IB_QPS_RTR)) {
                 int is_eth = rdma_port_get_link_layer(
diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c
index c30204f2fa30..fbe29fcb15c5 100644
--- a/drivers/input/input-mt.c
+++ b/drivers/input/input-mt.c
@@ -236,6 +236,18 @@ void input_mt_report_pointer_emulation(struct input_dev *dev, bool use_count)
 }
 EXPORT_SYMBOL(input_mt_report_pointer_emulation);
 
+static void __input_mt_drop_unused(struct input_dev *dev, struct input_mt *mt)
+{
+        int i;
+
+        for (i = 0; i < mt->num_slots; i++) {
+                if (!input_mt_is_used(mt, &mt->slots[i])) {
+                        input_mt_slot(dev, i);
+                        input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, -1);
+                }
+        }
+}
+
 /**
  * input_mt_drop_unused() - Inactivate slots not seen in this frame
  * @dev: input device with allocated MT slots
@@ -245,19 +257,11 @@ EXPORT_SYMBOL(input_mt_report_pointer_emulation);
 void input_mt_drop_unused(struct input_dev *dev)
 {
         struct input_mt *mt = dev->mt;
-        int i;
 
-        if (!mt)
-                return;
-
-        for (i = 0; i < mt->num_slots; i++) {
-                if (!input_mt_is_used(mt, &mt->slots[i])) {
-                        input_mt_slot(dev, i);
-                        input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, -1);
-                }
+        if (mt) {
+                __input_mt_drop_unused(dev, mt);
+                mt->frame++;
         }
-
-        mt->frame++;
 }
 EXPORT_SYMBOL(input_mt_drop_unused);
 
@@ -278,12 +282,14 @@ void input_mt_sync_frame(struct input_dev *dev)
                 return;
 
         if (mt->flags & INPUT_MT_DROP_UNUSED)
-                input_mt_drop_unused(dev);
+                __input_mt_drop_unused(dev, mt);
 
         if ((mt->flags & INPUT_MT_POINTER) && !(mt->flags & INPUT_MT_SEMI_MT))
                 use_count = true;
 
         input_mt_report_pointer_emulation(dev, use_count);
+
+        mt->frame++;
 }
 EXPORT_SYMBOL(input_mt_sync_frame);
 
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index a59a1a64b674..a956b980ee73 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -2234,8 +2234,8 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
                 return 0;
         }
 
-        psmouse_info(psmouse,
-                     "Unknown ALPS touchpad: E7=%3ph, EC=%3ph\n", e7, ec);
+        psmouse_dbg(psmouse,
+                    "Likely not an ALPS touchpad: E7=%3ph, EC=%3ph\n", e7, ec);
 
         return -EINVAL;
 }
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index ee2a04d90d20..da51738eb59e 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -18,6 +18,7 @@
 #include <linux/input/mt.h>
 #include <linux/serio.h>
 #include <linux/libps2.h>
+#include <asm/unaligned.h>
 #include "psmouse.h"
 #include "elantech.h"
 
@@ -403,6 +404,68 @@ static void elantech_report_absolute_v2(struct psmouse *psmouse)
         input_sync(dev);
 }
 
+static void elantech_report_trackpoint(struct psmouse *psmouse,
+                                       int packet_type)
+{
+        /*
+         * byte 0:  0   0  sx  sy   0   M   R   L
+         * byte 1:~sx   0   0   0   0   0   0   0
+         * byte 2:~sy   0   0   0   0   0   0   0
+         * byte 3:  0   0 ~sy ~sx   0   1   1   0
+         * byte 4: x7  x6  x5  x4  x3  x2  x1  x0
+         * byte 5: y7  y6  y5  y4  y3  y2  y1  y0
+         *
+         * x and y are written in two's complement spread
+         * over 9 bits with sx/sy the relative top bit and
+         * x7..x0 and y7..y0 the lower bits.
+         * The sign of y is opposite to what the input driver
+         * expects for a relative movement
+         */
+
+        struct elantech_data *etd = psmouse->private;
+        struct input_dev *tp_dev = etd->tp_dev;
+        unsigned char *packet = psmouse->packet;
+        int x, y;
+        u32 t;
+
+        if (dev_WARN_ONCE(&psmouse->ps2dev.serio->dev,
+                          !tp_dev,
+                          psmouse_fmt("Unexpected trackpoint message\n"))) {
+                if (etd->debug == 1)
+                        elantech_packet_dump(psmouse);
+                return;
+        }
+
+        t = get_unaligned_le32(&packet[0]);
+
+        switch (t & ~7U) {
+        case 0x06000030U:
+        case 0x16008020U:
+        case 0x26800010U:
+        case 0x36808000U:
+                x = packet[4] - (int)((packet[1]^0x80) << 1);
+                y = (int)((packet[2]^0x80) << 1) - packet[5];
+
+                input_report_key(tp_dev, BTN_LEFT, packet[0] & 0x01);
+                input_report_key(tp_dev, BTN_RIGHT, packet[0] & 0x02);
+                input_report_key(tp_dev, BTN_MIDDLE, packet[0] & 0x04);
+
+                input_report_rel(tp_dev, REL_X, x);
+                input_report_rel(tp_dev, REL_Y, y);
+
+                input_sync(tp_dev);
+
+                break;
+
+        default:
+                /* Dump unexpected packet sequences if debug=1 (default) */
+                if (etd->debug == 1)
+                        elantech_packet_dump(psmouse);
+
+                break;
+        }
+}
+
 /*
  * Interpret complete data packets and report absolute mode input events for
  * hardware version 3. (12 byte packets for two fingers)
@@ -715,6 +778,8 @@ static int elantech_packet_check_v3(struct psmouse *psmouse)
 
                 if ((packet[0] & 0x0c) == 0x0c && (packet[3] & 0xce) == 0x0c)
                         return PACKET_V3_TAIL;
+                if ((packet[3] & 0x0f) == 0x06)
+                        return PACKET_TRACKPOINT;
         }
 
         return PACKET_UNKNOWN;
@@ -791,14 +856,23 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
 
         case 3:
                 packet_type = elantech_packet_check_v3(psmouse);
-                /* ignore debounce */
-                if (packet_type == PACKET_DEBOUNCE)
-                        return PSMOUSE_FULL_PACKET;
-
-                if (packet_type == PACKET_UNKNOWN)
+                switch (packet_type) {
+                case PACKET_UNKNOWN:
                         return PSMOUSE_BAD_DATA;
 
-                elantech_report_absolute_v3(psmouse, packet_type);
+                case PACKET_DEBOUNCE:
+                        /* ignore debounce */
+                        break;
+
+                case PACKET_TRACKPOINT:
+                        elantech_report_trackpoint(psmouse, packet_type);
+                        break;
+
+                default:
+                        elantech_report_absolute_v3(psmouse, packet_type);
+                        break;
+                }
+
                 break;
 
         case 4:
@@ -1018,8 +1092,10 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX31               0x361f00        20, 15, 0e      clickpad
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
+ * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
  * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
  * Lenovo L430             0x350f02        b9, 15, 0c      2 hw buttons (*)
+ * Lenovo L530             0x350f02        b9, 15, 0c      2 hw buttons (*)
  * Samsung NF210           0x150b00        78, 14, 0a      2 hw buttons
  * Samsung NP770Z5E        0x575f01        10, 15, 0f      clickpad
  * Samsung NP700Z5B        0x361f06        21, 15, 0f      clickpad
@@ -1029,6 +1105,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Samsung RF710           0x450f00        ?               2 hw buttons
  * System76 Pangolin       0x250f01        ?               2 hw buttons
  * (*) + 3 trackpoint buttons
+ * (**) + 0 trackpoint buttons
+ * Note: Lenovo L430 and Lenovo L430 have the same fw_version/caps
  */
 static void elantech_set_buttonpad_prop(struct psmouse *psmouse)
 {
@@ -1324,6 +1402,10 @@ int elantech_detect(struct psmouse *psmouse, bool set_properties)
  */
 static void elantech_disconnect(struct psmouse *psmouse)
 {
+        struct elantech_data *etd = psmouse->private;
+
+        if (etd->tp_dev)
+                input_unregister_device(etd->tp_dev);
         sysfs_remove_group(&psmouse->ps2dev.serio->dev.kobj,
                            &elantech_attr_group);
         kfree(psmouse->private);
@@ -1438,8 +1520,10 @@ static int elantech_set_properties(struct elantech_data *etd)
 int elantech_init(struct psmouse *psmouse)
 {
         struct elantech_data *etd;
-        int i, error;
+        int i;
+        int error = -EINVAL;
         unsigned char param[3];
+        struct input_dev *tp_dev;
 
         psmouse->private = etd = kzalloc(sizeof(struct elantech_data), GFP_KERNEL);
         if (!etd)
@@ -1498,14 +1582,49 @@ int elantech_init(struct psmouse *psmouse)
                 goto init_fail;
         }
 
+        /* The MSB indicates the presence of the trackpoint */
+        if ((etd->capabilities[0] & 0x80) == 0x80) {
+                tp_dev = input_allocate_device();
+
+                if (!tp_dev) {
+                        error = -ENOMEM;
+                        goto init_fail_tp_alloc;
+                }
+
+                etd->tp_dev = tp_dev;
+                snprintf(etd->tp_phys, sizeof(etd->tp_phys), "%s/input1",
+                        psmouse->ps2dev.serio->phys);
+                tp_dev->phys = etd->tp_phys;
+                tp_dev->name = "Elantech PS/2 TrackPoint";
+                tp_dev->id.bustype = BUS_I8042;
+                tp_dev->id.vendor  = 0x0002;
+                tp_dev->id.product = PSMOUSE_ELANTECH;
+                tp_dev->id.version = 0x0000;
+                tp_dev->dev.parent = &psmouse->ps2dev.serio->dev;
+                tp_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
+                tp_dev->relbit[BIT_WORD(REL_X)] =
+                        BIT_MASK(REL_X) | BIT_MASK(REL_Y);
+                tp_dev->keybit[BIT_WORD(BTN_LEFT)] =
+                        BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_MIDDLE) |
+                        BIT_MASK(BTN_RIGHT);
+                error = input_register_device(etd->tp_dev);
+                if (error < 0)
+                        goto init_fail_tp_reg;
+        }
+
         psmouse->protocol_handler = elantech_process_byte;
         psmouse->disconnect = elantech_disconnect;
         psmouse->reconnect = elantech_reconnect;
         psmouse->pktsize = etd->hw_version > 1 ? 6 : 4;
 
         return 0;
-
+ init_fail_tp_reg:
+        input_free_device(tp_dev);
+ init_fail_tp_alloc:
+        sysfs_remove_group(&psmouse->ps2dev.serio->dev.kobj,
+                           &elantech_attr_group);
  init_fail:
+        psmouse_reset(psmouse);
         kfree(etd);
-        return -1;
+        return error;
 }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index 9e0e2a1f340d..6f3afec02f03 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -94,6 +94,7 @@
 #define PACKET_V4_HEAD                  0x05
 #define PACKET_V4_MOTION                0x06
 #define PACKET_V4_STATUS                0x07
+#define PACKET_TRACKPOINT               0x08
 
 /*
  * track up to 5 fingers for v4 hardware
@@ -114,6 +115,8 @@ struct finger_pos {
 };
 
 struct elantech_data {
+        struct input_dev *tp_dev;       /* Relative device for trackpoint */
+        char tp_phys[32];
         unsigned char reg_07;
         unsigned char reg_10;
         unsigned char reg_11;
diff --git a/drivers/input/serio/i8042-sparcio.h b/drivers/input/serio/i8042-sparcio.h
index d6aa4c67dbb6..93cb7912703c 100644
--- a/drivers/input/serio/i8042-sparcio.h
+++ b/drivers/input/serio/i8042-sparcio.h
@@ -17,7 +17,6 @@ static int i8042_aux_irq = -1;
 #define I8042_MUX_PHYS_DESC "sparcps2/serio%d"
 
 static void __iomem *kbd_iobase;
-static struct resource *kbd_res;
 
 #define I8042_COMMAND_REG       (kbd_iobase + 0x64UL)
 #define I8042_DATA_REG          (kbd_iobase + 0x60UL)
@@ -44,6 +43,8 @@ static inline void i8042_write_command(int val)
 
 #ifdef CONFIG_PCI
 
+static struct resource *kbd_res;
+
 #define OBP_PS2KBD_NAME1        "kb_ps2"
 #define OBP_PS2KBD_NAME2        "keyboard"
 #define OBP_PS2MS_NAME1         "kdmouse"
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index 129729d35478..aa29198fca3e 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -15,10 +15,10 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
+#include <linux/timer.h>
 #include <linux/err.h>
 #include <linux/ctype.h>
 #include <linux/leds.h>
-#include <linux/workqueue.h>
 #include "leds.h"
 
 static struct class *leds_class;
@@ -97,10 +97,9 @@ static const struct attribute_group *led_groups[] = {
         NULL,
 };
 
-static void led_work_function(struct work_struct *ws)
+static void led_timer_function(unsigned long data)
 {
-        struct led_classdev *led_cdev =
-                container_of(ws, struct led_classdev, blink_work.work);
+        struct led_classdev *led_cdev = (void *)data;
         unsigned long brightness;
         unsigned long delay;
 
@@ -144,8 +143,7 @@ static void led_work_function(struct work_struct *ws)
                 }
         }
 
-        queue_delayed_work(system_wq, &led_cdev->blink_work,
-                           msecs_to_jiffies(delay));
+        mod_timer(&led_cdev->blink_timer, jiffies + msecs_to_jiffies(delay));
 }
 
 static void set_brightness_delayed(struct work_struct *ws)
@@ -233,7 +231,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
 
         INIT_WORK(&led_cdev->set_brightness_work, set_brightness_delayed);
 
-        INIT_DELAYED_WORK(&led_cdev->blink_work, led_work_function);
+        init_timer(&led_cdev->blink_timer);
+        led_cdev->blink_timer.function = led_timer_function;
+        led_cdev->blink_timer.data = (unsigned long)led_cdev;
 
 #ifdef CONFIG_LEDS_TRIGGERS
         led_trigger_set_default(led_cdev);
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index 4bb116867b88..71b40d3bf776 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/rwsem.h>
 #include <linux/leds.h>
-#include <linux/workqueue.h>
 #include "leds.h"
 
 DECLARE_RWSEM(leds_list_lock);
@@ -52,7 +51,7 @@ static void led_set_software_blink(struct led_classdev *led_cdev,
                 return;
         }
 
-        queue_delayed_work(system_wq, &led_cdev->blink_work, 1);
+        mod_timer(&led_cdev->blink_timer, jiffies + 1);
 }
 
 
@@ -76,7 +75,7 @@ void led_blink_set(struct led_classdev *led_cdev,
                    unsigned long *delay_on,
                    unsigned long *delay_off)
 {
-        cancel_delayed_work_sync(&led_cdev->blink_work);
+        del_timer_sync(&led_cdev->blink_timer);
 
         led_cdev->flags &= ~LED_BLINK_ONESHOT;
         led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP;
@@ -91,7 +90,7 @@ void led_blink_set_oneshot(struct led_classdev *led_cdev,
                            int invert)
 {
         if ((led_cdev->flags & LED_BLINK_ONESHOT) &&
-             delayed_work_pending(&led_cdev->blink_work))
+             timer_pending(&led_cdev->blink_timer))
                 return;
 
         led_cdev->flags |= LED_BLINK_ONESHOT;
@@ -108,7 +107,7 @@ EXPORT_SYMBOL(led_blink_set_oneshot);
 
 void led_stop_software_blink(struct led_classdev *led_cdev)
 {
-        cancel_delayed_work_sync(&led_cdev->blink_work);
+        del_timer_sync(&led_cdev->blink_timer);
         led_cdev->blink_delay_on = 0;
         led_cdev->blink_delay_off = 0;
 }
@@ -117,7 +116,7 @@ EXPORT_SYMBOL_GPL(led_stop_software_blink);
 void led_set_brightness(struct led_classdev *led_cdev,
                         enum led_brightness brightness)
 {
-        /* delay brightness setting if need to stop soft-blink work */
+        /* delay brightness setting if need to stop soft-blink timer */
         if (led_cdev->blink_delay_on || led_cdev->blink_delay_off) {
                 led_cdev->delayed_set_value = brightness;
                 schedule_work(&led_cdev->set_brightness_work);
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 2785007e0e46..cd15e0801228 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1688,6 +1688,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         unsigned int key_size, opt_params;
         unsigned long long tmpll;
         int ret;
+        size_t iv_size_padding;
         struct dm_arg_set as;
         const char *opt_string;
         char dummy;
@@ -1724,20 +1725,32 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
         cc->dmreq_start = sizeof(struct ablkcipher_request);
         cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc));
-        cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment());
-        cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) &
-                           ~(crypto_tfm_ctx_alignment() - 1);
+        cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
+
+        if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) {
+                /* Allocate the padding exactly */
+                iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
+                                & crypto_ablkcipher_alignmask(any_tfm(cc));
+        } else {
+                /*
+                 * If the cipher requires greater alignment than kmalloc
+                 * alignment, we don't know the exact position of the
+                 * initialization vector. We must assume worst case.
+                 */
+                iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc));
+        }
 
         cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start +
-                        sizeof(struct dm_crypt_request) + cc->iv_size);
+                        sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size);
         if (!cc->req_pool) {
                 ti->error = "Cannot allocate crypt request mempool";
                 goto bad;
         }
 
         cc->per_bio_data_size = ti->per_bio_data_size =
-                                sizeof(struct dm_crypt_io) + cc->dmreq_start +
-                                sizeof(struct dm_crypt_request) + cc->iv_size;
+                ALIGN(sizeof(struct dm_crypt_io) + cc->dmreq_start +
+                      sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size,
+                      ARCH_KMALLOC_MINALIGN);
 
         cc->page_pool = mempool_create_page_pool(MIN_POOL_PAGES, 0);
         if (!cc->page_pool) {
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index ce48aa72bb42..bde2fc072410 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -1754,7 +1754,7 @@ static int ab8500_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-#if CONFIG_DEBUG_FS
+#ifdef CONFIG_DEBUG_FS
         /* Pass to debugfs */
         ab8500_debug_resources[0].start = ab8500->irq;
         ab8500_debug_resources[0].end = ab8500->irq;
diff --git a/drivers/mfd/htc-i2cpld.c b/drivers/mfd/htc-i2cpld.c
index b44f0203983b..6bdb78c2ac77 100644
--- a/drivers/mfd/htc-i2cpld.c
+++ b/drivers/mfd/htc-i2cpld.c
@@ -404,7 +404,7 @@ static int htcpld_register_chip_i2c(
         }
 
         i2c_set_clientdata(client, chip);
-        snprintf(client->name, I2C_NAME_SIZE, "Chip_0x%d", client->addr);
+        snprintf(client->name, I2C_NAME_SIZE, "Chip_0x%x", client->addr);
         chip->client = client;
 
         /* Reset the chip */
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 33a9234b701c..83dab2f0a50e 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -647,7 +647,7 @@ static int usbhs_omap_probe(struct platform_device *pdev)
                 default:
                         omap->nports = OMAP3_HS_USB_PORTS;
                         dev_dbg(dev,
-                         "USB HOST Rev:0x%d not recognized, assuming %d ports\n",
+                         "USB HOST Rev:0x%x not recognized, assuming %d ports\n",
                          omap->usbhs_rev, omap->nports);
                         break;
                 }
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index 3bc969a5916b..4d3ff3771491 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -724,24 +724,24 @@ static struct twl4030_script *omap3_idle_scripts[] = {
  * above.
  */
 static struct twl4030_resconfig omap3_idle_rconfig[] = {
-        TWL_REMAP_SLEEP(RES_VAUX1, DEV_GRP_NULL, 0, 0),
-        TWL_REMAP_SLEEP(RES_VAUX2, DEV_GRP_NULL, 0, 0),
-        TWL_REMAP_SLEEP(RES_VAUX3, DEV_GRP_NULL, 0, 0),
-        TWL_REMAP_SLEEP(RES_VAUX4, DEV_GRP_NULL, 0, 0),
-        TWL_REMAP_SLEEP(RES_VMMC1, DEV_GRP_NULL, 0, 0),
-        TWL_REMAP_SLEEP(RES_VMMC2, DEV_GRP_NULL, 0, 0),
+        TWL_REMAP_SLEEP(RES_VAUX1, TWL4030_RESCONFIG_UNDEF, 0, 0),
+        TWL_REMAP_SLEEP(RES_VAUX2, TWL4030_RESCONFIG_UNDEF, 0, 0),
+        TWL_REMAP_SLEEP(RES_VAUX3, TWL4030_RESCONFIG_UNDEF, 0, 0),
+        TWL_REMAP_SLEEP(RES_VAUX4, TWL4030_RESCONFIG_UNDEF, 0, 0),
+        TWL_REMAP_SLEEP(RES_VMMC1, TWL4030_RESCONFIG_UNDEF, 0, 0),
+        TWL_REMAP_SLEEP(RES_VMMC2, TWL4030_RESCONFIG_UNDEF, 0, 0),
         TWL_REMAP_OFF(RES_VPLL1, DEV_GRP_P1, 3, 1),
         TWL_REMAP_SLEEP(RES_VPLL2, DEV_GRP_P1, 0, 0),
-        TWL_REMAP_SLEEP(RES_VSIM, DEV_GRP_NULL, 0, 0),
-        TWL_REMAP_SLEEP(RES_VDAC, DEV_GRP_NULL, 0, 0),
+        TWL_REMAP_SLEEP(RES_VSIM, TWL4030_RESCONFIG_UNDEF, 0, 0),
+        TWL_REMAP_SLEEP(RES_VDAC, TWL4030_RESCONFIG_UNDEF, 0, 0),
         TWL_REMAP_SLEEP(RES_VINTANA1, TWL_DEV_GRP_P123, 1, 2),
         TWL_REMAP_SLEEP(RES_VINTANA2, TWL_DEV_GRP_P123, 0, 2),
         TWL_REMAP_SLEEP(RES_VINTDIG, TWL_DEV_GRP_P123, 1, 2),
         TWL_REMAP_SLEEP(RES_VIO, TWL_DEV_GRP_P123, 2, 2),
         TWL_REMAP_OFF(RES_VDD1, DEV_GRP_P1, 4, 1),
         TWL_REMAP_OFF(RES_VDD2, DEV_GRP_P1, 3, 1),
-        TWL_REMAP_SLEEP(RES_VUSB_1V5, DEV_GRP_NULL, 0, 0),
-        TWL_REMAP_SLEEP(RES_VUSB_1V8, DEV_GRP_NULL, 0, 0),
+        TWL_REMAP_SLEEP(RES_VUSB_1V5, TWL4030_RESCONFIG_UNDEF, 0, 0),
+        TWL_REMAP_SLEEP(RES_VUSB_1V8, TWL4030_RESCONFIG_UNDEF, 0, 0),
         TWL_REMAP_SLEEP(RES_VUSB_3V1, TWL_DEV_GRP_P123, 0, 0),
         /* Resource #20 USB charge pump skipped */
         TWL_REMAP_SLEEP(RES_REGEN, TWL_DEV_GRP_P123, 2, 1),
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 324e1de93687..2da05c0e113d 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -601,6 +601,7 @@ int mei_cl_connect(struct mei_cl *cl, struct file *file)
                 cl->timer_count = MEI_CONNECT_TIMEOUT;
                 list_add_tail(&cb->list, &dev->ctrl_rd_list.list);
         } else {
+                cl->state = MEI_FILE_INITIALIZING;
                 list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
         }
 
diff --git a/drivers/misc/mei/nfc.c b/drivers/misc/mei/nfc.c
index 3095fc514a65..5ccc23bc7690 100644
--- a/drivers/misc/mei/nfc.c
+++ b/drivers/misc/mei/nfc.c
@@ -342,9 +342,10 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
         ndev = (struct mei_nfc_dev *) cldev->priv_data;
         dev = ndev->cl->dev;
 
+        err = -ENOMEM;
         mei_buf = kzalloc(length + MEI_NFC_HEADER_SIZE, GFP_KERNEL);
         if (!mei_buf)
-                return -ENOMEM;
+                goto out;
 
         hdr = (struct mei_nfc_hci_hdr *) mei_buf;
         hdr->cmd = MEI_NFC_CMD_HCI_SEND;
@@ -354,12 +355,9 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
         hdr->data_size = length;
 
         memcpy(mei_buf + MEI_NFC_HEADER_SIZE, buf, length);
-
         err = __mei_cl_send(ndev->cl, mei_buf, length + MEI_NFC_HEADER_SIZE);
         if (err < 0)
-                return err;
-
-        kfree(mei_buf);
+                goto out;
 
         if (!wait_event_interruptible_timeout(ndev->send_wq,
                                 ndev->recv_req_id == ndev->req_id, HZ)) {
@@ -368,7 +366,8 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
         } else {
                 ndev->req_id++;
         }
-
+out:
+        kfree(mei_buf);
         return err;
 }
 
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 5a4bfe33112a..46c4643b7a07 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1434,6 +1434,10 @@ static int cfi_amdstd_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
 
                                 mutex_lock(&chip->mutex);
                                 ret = get_chip(map, chip, base, FL_LOCKING);
+                                if (ret) {
+                                        mutex_unlock(&chip->mutex);
+                                        return ret;
+                                }
 
                                 /* Enter lock register command */
                                 cfi_send_gen_cmd(0xAA, cfi->addr_unlock1,
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index f0ed92e210a1..5967b385141b 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -931,7 +931,7 @@ static int omap_calculate_ecc(struct mtd_info *mtd, const u_char *dat,
         u32 val;
 
         val = readl(info->reg.gpmc_ecc_config);
-        if (((val >> ECC_CONFIG_CS_SHIFT)  & ~CS_MASK) != info->gpmc_cs)
+        if (((val >> ECC_CONFIG_CS_SHIFT) & CS_MASK) != info->gpmc_cs)
                 return -EINVAL;
 
         /* read ecc result */
@@ -1794,9 +1794,12 @@ static int omap_nand_probe(struct platform_device *pdev)
         }
 
         /* populate MTD interface based on ECC scheme */
-        nand_chip->ecc.layout   = &omap_oobinfo;
         ecclayout               = &omap_oobinfo;
         switch (info->ecc_opt) {
+        case OMAP_ECC_HAM1_CODE_SW:
+                nand_chip->ecc.mode = NAND_ECC_SOFT;
+                break;
+
         case OMAP_ECC_HAM1_CODE_HW:
                 pr_info("nand: using OMAP_ECC_HAM1_CODE_HW\n");
                 nand_chip->ecc.mode             = NAND_ECC_HW;
@@ -1848,7 +1851,7 @@ static int omap_nand_probe(struct platform_device *pdev)
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
                                                         nand_chip->ecc.bytes,
-                                                        &nand_chip->ecc.layout);
+                                                        &ecclayout);
                 if (!nand_chip->ecc.priv) {
                         pr_err("nand: error: unable to use s/w BCH library\n");
                         err = -EINVAL;
@@ -1923,7 +1926,7 @@ static int omap_nand_probe(struct platform_device *pdev)
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
                                                         nand_chip->ecc.bytes,
-                                                        &nand_chip->ecc.layout);
+                                                        &ecclayout);
                 if (!nand_chip->ecc.priv) {
                         pr_err("nand: error: unable to use s/w BCH library\n");
                         err = -EINVAL;
@@ -2012,6 +2015,9 @@ static int omap_nand_probe(struct platform_device *pdev)
                 goto return_error;
         }
 
+        if (info->ecc_opt == OMAP_ECC_HAM1_CODE_SW)
+                goto scan_tail;
+
         /* all OOB bytes from oobfree->offset till end off OOB are free */
         ecclayout->oobfree->length = mtd->oobsize - ecclayout->oobfree->offset;
         /* check if NAND device's OOB is enough to store ECC signatures */
@@ -2021,7 +2027,9 @@ static int omap_nand_probe(struct platform_device *pdev)
                 err = -EINVAL;
                 goto return_error;
         }
+        nand_chip->ecc.layout = ecclayout;
 
+scan_tail:
         /* second phase scan */
         if (nand_scan_tail(mtd)) {
                 err = -ENXIO;
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 059c7414e303..3fe45c705933 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -2177,10 +2177,10 @@ boomerang_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
                         vp->tx_ring[entry].frag[i+1].addr =
-                                        cpu_to_le32(pci_map_single(
-                                                VORTEX_PCI(vp),
-                                                (void *)skb_frag_address(frag),
-                                                skb_frag_size(frag), PCI_DMA_TODEVICE));
+                                        cpu_to_le32(skb_frag_dma_map(
+                                                &VORTEX_PCI(vp)->dev,
+                                                frag,
+                                                frag->page_offset, frag->size, DMA_TO_DEVICE));
 
                         if (i == skb_shinfo(skb)->nr_frags-1)
                                         vp->tx_ring[entry].frag[i+1].length = cpu_to_le32(skb_frag_size(frag)|LAST_FRAG);
diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c
index 23578dfee249..3005155e412b 100644
--- a/drivers/net/ethernet/aeroflex/greth.c
+++ b/drivers/net/ethernet/aeroflex/greth.c
@@ -123,6 +123,12 @@ static inline void greth_enable_tx(struct greth_private *greth)
         GRETH_REGORIN(greth->regs->control, GRETH_TXEN);
 }
 
+static inline void greth_enable_tx_and_irq(struct greth_private *greth)
+{
+        wmb(); /* BDs must been written to memory before enabling TX */
+        GRETH_REGORIN(greth->regs->control, GRETH_TXEN | GRETH_TXI);
+}
+
 static inline void greth_disable_tx(struct greth_private *greth)
 {
         GRETH_REGANDIN(greth->regs->control, ~GRETH_TXEN);
@@ -447,29 +453,30 @@ out:
         return err;
 }
 
+static inline u16 greth_num_free_bds(u16 tx_last, u16 tx_next)
+{
+        if (tx_next < tx_last)
+                return (tx_last - tx_next) - 1;
+        else
+                return GRETH_TXBD_NUM - (tx_next - tx_last) - 1;
+}
 
 static netdev_tx_t
 greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
 {
         struct greth_private *greth = netdev_priv(dev);
         struct greth_bd *bdp;
-        u32 status = 0, dma_addr, ctrl;
+        u32 status, dma_addr;
         int curr_tx, nr_frags, i, err = NETDEV_TX_OK;
         unsigned long flags;
+        u16 tx_last;
 
         nr_frags = skb_shinfo(skb)->nr_frags;
+        tx_last = greth->tx_last;
+        rmb(); /* tx_last is updated by the poll task */
 
-        /* Clean TX Ring */
-        greth_clean_tx_gbit(dev);
-
-        if (greth->tx_free < nr_frags + 1) {
-                spin_lock_irqsave(&greth->devlock, flags);/*save from poll/irq*/
-                ctrl = GRETH_REGLOAD(greth->regs->control);
-                /* Enable TX IRQ only if not already in poll() routine */
-                if (ctrl & GRETH_RXI)
-                        GRETH_REGSAVE(greth->regs->control, ctrl | GRETH_TXI);
+        if (greth_num_free_bds(tx_last, greth->tx_next) < nr_frags + 1) {
                 netif_stop_queue(dev);
-                spin_unlock_irqrestore(&greth->devlock, flags);
                 err = NETDEV_TX_BUSY;
                 goto out;
         }
@@ -488,6 +495,8 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
         /* Linear buf */
         if (nr_frags != 0)
                 status = GRETH_TXBD_MORE;
+        else
+                status = GRETH_BD_IE;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL)
                 status |= GRETH_TXBD_CSALL;
@@ -545,14 +554,12 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
 
         /* Enable the descriptor chain by enabling the first descriptor */
         bdp = greth->tx_bd_base + greth->tx_next;
-        greth_write_bd(&bdp->stat, greth_read_bd(&bdp->stat) | GRETH_BD_EN);
-        greth->tx_next = curr_tx;
-        greth->tx_free -= nr_frags + 1;
-
-        wmb();
+        greth_write_bd(&bdp->stat,
+                       greth_read_bd(&bdp->stat) | GRETH_BD_EN);
 
         spin_lock_irqsave(&greth->devlock, flags); /*save from poll/irq*/
-        greth_enable_tx(greth);
+        greth->tx_next = curr_tx;
+        greth_enable_tx_and_irq(greth);
         spin_unlock_irqrestore(&greth->devlock, flags);
 
         return NETDEV_TX_OK;
@@ -648,7 +655,6 @@ static void greth_clean_tx(struct net_device *dev)
         if (greth->tx_free > 0) {
                 netif_wake_queue(dev);
         }
-
 }
 
 static inline void greth_update_tx_stats(struct net_device *dev, u32 stat)
@@ -670,20 +676,22 @@ static void greth_clean_tx_gbit(struct net_device *dev)
 {
         struct greth_private *greth;
         struct greth_bd *bdp, *bdp_last_frag;
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         u32 stat;
         int nr_frags, i;
+        u16 tx_last;
 
         greth = netdev_priv(dev);
+        tx_last = greth->tx_last;
 
-        while (greth->tx_free < GRETH_TXBD_NUM) {
+        while (tx_last != greth->tx_next) {
 
-                skb = greth->tx_skbuff[greth->tx_last];
+                skb = greth->tx_skbuff[tx_last];
 
                 nr_frags = skb_shinfo(skb)->nr_frags;
 
                 /* We only clean fully completed SKBs */
-                bdp_last_frag = greth->tx_bd_base + SKIP_TX(greth->tx_last, nr_frags);
+                bdp_last_frag = greth->tx_bd_base + SKIP_TX(tx_last, nr_frags);
 
                 GRETH_REGSAVE(greth->regs->status, GRETH_INT_TE | GRETH_INT_TX);
                 mb();
@@ -692,14 +700,14 @@ static void greth_clean_tx_gbit(struct net_device *dev)
                 if (stat & GRETH_BD_EN)
                         break;
 
-                greth->tx_skbuff[greth->tx_last] = NULL;
+                greth->tx_skbuff[tx_last] = NULL;
 
                 greth_update_tx_stats(dev, stat);
                 dev->stats.tx_bytes += skb->len;
 
-                bdp = greth->tx_bd_base + greth->tx_last;
+                bdp = greth->tx_bd_base + tx_last;
 
-                greth->tx_last = NEXT_TX(greth->tx_last);
+                tx_last = NEXT_TX(tx_last);
 
                 dma_unmap_single(greth->dev,
                                  greth_read_bd(&bdp->addr),
@@ -708,21 +716,26 @@ static void greth_clean_tx_gbit(struct net_device *dev)
 
                 for (i = 0; i < nr_frags; i++) {
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                        bdp = greth->tx_bd_base + greth->tx_last;
+                        bdp = greth->tx_bd_base + tx_last;
 
                         dma_unmap_page(greth->dev,
                                        greth_read_bd(&bdp->addr),
                                        skb_frag_size(frag),
                                        DMA_TO_DEVICE);
 
-                        greth->tx_last = NEXT_TX(greth->tx_last);
+                        tx_last = NEXT_TX(tx_last);
                 }
-                greth->tx_free += nr_frags+1;
                 dev_kfree_skb(skb);
         }
+        if (skb) { /* skb is set only if the above while loop was entered */
+                wmb();
+                greth->tx_last = tx_last;
 
-        if (netif_queue_stopped(dev) && (greth->tx_free > (MAX_SKB_FRAGS+1)))
-                netif_wake_queue(dev);
+                if (netif_queue_stopped(dev) &&
+                    (greth_num_free_bds(tx_last, greth->tx_next) >
+                    (MAX_SKB_FRAGS+1)))
+                        netif_wake_queue(dev);
+        }
 }
 
 static int greth_rx(struct net_device *dev, int limit)
@@ -965,16 +978,12 @@ static int greth_poll(struct napi_struct *napi, int budget)
         greth = container_of(napi, struct greth_private, napi);
 
 restart_txrx_poll:
-        if (netif_queue_stopped(greth->netdev)) {
-                if (greth->gbit_mac)
-                        greth_clean_tx_gbit(greth->netdev);
-                else
-                        greth_clean_tx(greth->netdev);
-        }
-
         if (greth->gbit_mac) {
+                greth_clean_tx_gbit(greth->netdev);
                 work_done += greth_rx_gbit(greth->netdev, budget - work_done);
         } else {
+                if (netif_queue_stopped(greth->netdev))
+                        greth_clean_tx(greth->netdev);
                 work_done += greth_rx(greth->netdev, budget - work_done);
         }
 
@@ -983,7 +992,8 @@ restart_txrx_poll:
                 spin_lock_irqsave(&greth->devlock, flags);
 
                 ctrl = GRETH_REGLOAD(greth->regs->control);
-                if (netif_queue_stopped(greth->netdev)) {
+                if ((greth->gbit_mac && (greth->tx_last != greth->tx_next)) ||
+                    (!greth->gbit_mac && netif_queue_stopped(greth->netdev))) {
                         GRETH_REGSAVE(greth->regs->control,
                                         ctrl | GRETH_TXI | GRETH_RXI);
                         mask = GRETH_INT_RX | GRETH_INT_RE |
diff --git a/drivers/net/ethernet/aeroflex/greth.h b/drivers/net/ethernet/aeroflex/greth.h
index 232a622a85b7..ae16ac94daf8 100644
--- a/drivers/net/ethernet/aeroflex/greth.h
+++ b/drivers/net/ethernet/aeroflex/greth.h
@@ -107,7 +107,7 @@ struct greth_private {
 
         u16 tx_next;
         u16 tx_last;
-        u16 tx_free;
+        u16 tx_free; /* only used on 10/100Mbit */
         u16 rx_cur;
 
         struct greth_regs *regs;        /* Address of controller registers. */
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
index 978f9ec961ae..76479d04b903 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
@@ -271,8 +271,8 @@ static ssize_t xpcs_reg_value_read(struct file *filp, char __user *buffer,
         struct xgbe_prv_data *pdata = filp->private_data;
         unsigned int value;
 
-        value = pdata->hw_if.read_mmd_regs(pdata, pdata->debugfs_xpcs_mmd,
-                                           pdata->debugfs_xpcs_reg);
+        value = XMDIO_READ(pdata, pdata->debugfs_xpcs_mmd,
+                           pdata->debugfs_xpcs_reg);
 
         return xgbe_common_read(buffer, count, ppos, value);
 }
@@ -289,8 +289,8 @@ static ssize_t xpcs_reg_value_write(struct file *filp,
         if (len < 0)
                 return len;
 
-        pdata->hw_if.write_mmd_regs(pdata, pdata->debugfs_xpcs_mmd,
-                                    pdata->debugfs_xpcs_reg, value);
+        XMDIO_WRITE(pdata, pdata->debugfs_xpcs_mmd, pdata->debugfs_xpcs_reg,
+                    value);
 
         return len;
 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 3be98e505001..9da3a03e8c07 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -347,7 +347,7 @@ static int xgbe_disable_tx_flow_control(struct xgbe_prv_data *pdata)
 
         /* Clear MAC flow control */
         max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES;
-        q_count = min_t(unsigned int, pdata->rx_q_count, max_q_count);
+        q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count);
         reg = MAC_Q0TFCR;
         for (i = 0; i < q_count; i++) {
                 reg_val = XGMAC_IOREAD(pdata, reg);
@@ -372,7 +372,7 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata)
 
         /* Set MAC flow control */
         max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES;
-        q_count = min_t(unsigned int, pdata->rx_q_count, max_q_count);
+        q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count);
         reg = MAC_Q0TFCR;
         for (i = 0; i < q_count; i++) {
                 reg_val = XGMAC_IOREAD(pdata, reg);
@@ -508,8 +508,8 @@ static void xgbe_enable_mac_interrupts(struct xgbe_prv_data *pdata)
         XGMAC_IOWRITE(pdata, MAC_IER, mac_ier);
 
         /* Enable all counter interrupts */
-        XGMAC_IOWRITE_BITS(pdata, MMC_RIER, ALL_INTERRUPTS, 0xff);
-        XGMAC_IOWRITE_BITS(pdata, MMC_TIER, ALL_INTERRUPTS, 0xff);
+        XGMAC_IOWRITE_BITS(pdata, MMC_RIER, ALL_INTERRUPTS, 0xffffffff);
+        XGMAC_IOWRITE_BITS(pdata, MMC_TIER, ALL_INTERRUPTS, 0xffffffff);
 }
 
 static int xgbe_set_gmii_speed(struct xgbe_prv_data *pdata)
@@ -1632,6 +1632,9 @@ static int xgbe_flush_tx_queues(struct xgbe_prv_data *pdata)
 {
         unsigned int i, count;
 
+        if (XGMAC_GET_BITS(pdata->hw_feat.version, MAC_VR, SNPSVER) < 0x21)
+                return 0;
+
         for (i = 0; i < pdata->tx_q_count; i++)
                 XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_TQOMR, FTQ, 1);
 
@@ -1702,8 +1705,8 @@ static void xgbe_config_mtl_mode(struct xgbe_prv_data *pdata)
         XGMAC_IOWRITE_BITS(pdata, MTL_OMR, RAA, MTL_RAA_SP);
 }
 
-static unsigned int xgbe_calculate_per_queue_fifo(unsigned long fifo_size,
-                                                  unsigned char queue_count)
+static unsigned int xgbe_calculate_per_queue_fifo(unsigned int fifo_size,
+                                                  unsigned int queue_count)
 {
         unsigned int q_fifo_size = 0;
         enum xgbe_mtl_fifo_size p_fifo = XGMAC_MTL_FIFO_SIZE_256;
@@ -1747,6 +1750,10 @@ static unsigned int xgbe_calculate_per_queue_fifo(unsigned long fifo_size,
                 q_fifo_size = XGBE_FIFO_SIZE_KB(256);
                 break;
         }
+
+        /* The configured value is not the actual amount of fifo RAM */
+        q_fifo_size = min_t(unsigned int, XGBE_FIFO_MAX, q_fifo_size);
+
         q_fifo_size = q_fifo_size / queue_count;
 
         /* Set the queue fifo size programmable value */
@@ -1946,6 +1953,32 @@ static void xgbe_config_vlan_support(struct xgbe_prv_data *pdata)
                 xgbe_disable_rx_vlan_stripping(pdata);
 }
 
+static u64 xgbe_mmc_read(struct xgbe_prv_data *pdata, unsigned int reg_lo)
+{
+        bool read_hi;
+        u64 val;
+
+        switch (reg_lo) {
+        /* These registers are always 64 bit */
+        case MMC_TXOCTETCOUNT_GB_LO:
+        case MMC_TXOCTETCOUNT_G_LO:
+        case MMC_RXOCTETCOUNT_GB_LO:
+        case MMC_RXOCTETCOUNT_G_LO:
+                read_hi = true;
+                break;
+
+        default:
+                read_hi = false;
+        };
+
+        val = XGMAC_IOREAD(pdata, reg_lo);
+
+        if (read_hi)
+                val |= ((u64)XGMAC_IOREAD(pdata, reg_lo + 4) << 32);
+
+        return val;
+}
+
 static void xgbe_tx_mmc_int(struct xgbe_prv_data *pdata)
 {
         struct xgbe_mmc_stats *stats = &pdata->mmc_stats;
@@ -1953,75 +1986,75 @@ static void xgbe_tx_mmc_int(struct xgbe_prv_data *pdata)
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXOCTETCOUNT_GB))
                 stats->txoctetcount_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TXOCTETCOUNT_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TXOCTETCOUNT_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXFRAMECOUNT_GB))
                 stats->txframecount_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TXFRAMECOUNT_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TXFRAMECOUNT_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXBROADCASTFRAMES_G))
                 stats->txbroadcastframes_g +=
-                        XGMAC_IOREAD(pdata, MMC_TXBROADCASTFRAMES_G_LO);
+                        xgbe_mmc_read(pdata, MMC_TXBROADCASTFRAMES_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXMULTICASTFRAMES_G))
                 stats->txmulticastframes_g +=
-                        XGMAC_IOREAD(pdata, MMC_TXMULTICASTFRAMES_G_LO);
+                        xgbe_mmc_read(pdata, MMC_TXMULTICASTFRAMES_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TX64OCTETS_GB))
                 stats->tx64octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TX64OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TX64OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TX65TO127OCTETS_GB))
                 stats->tx65to127octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TX65TO127OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TX65TO127OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TX128TO255OCTETS_GB))
                 stats->tx128to255octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TX128TO255OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TX128TO255OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TX256TO511OCTETS_GB))
                 stats->tx256to511octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TX256TO511OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TX256TO511OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TX512TO1023OCTETS_GB))
                 stats->tx512to1023octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TX512TO1023OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TX512TO1023OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TX1024TOMAXOCTETS_GB))
                 stats->tx1024tomaxoctets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TX1024TOMAXOCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TX1024TOMAXOCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXUNICASTFRAMES_GB))
                 stats->txunicastframes_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TXUNICASTFRAMES_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TXUNICASTFRAMES_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXMULTICASTFRAMES_GB))
                 stats->txmulticastframes_gb +=
-                        XGMAC_IOREAD(pdata, MMC_TXMULTICASTFRAMES_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TXMULTICASTFRAMES_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXBROADCASTFRAMES_GB))
                 stats->txbroadcastframes_g +=
-                        XGMAC_IOREAD(pdata, MMC_TXBROADCASTFRAMES_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_TXBROADCASTFRAMES_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXUNDERFLOWERROR))
                 stats->txunderflowerror +=
-                        XGMAC_IOREAD(pdata, MMC_TXUNDERFLOWERROR_LO);
+                        xgbe_mmc_read(pdata, MMC_TXUNDERFLOWERROR_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXOCTETCOUNT_G))
                 stats->txoctetcount_g +=
-                        XGMAC_IOREAD(pdata, MMC_TXOCTETCOUNT_G_LO);
+                        xgbe_mmc_read(pdata, MMC_TXOCTETCOUNT_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXFRAMECOUNT_G))
                 stats->txframecount_g +=
-                        XGMAC_IOREAD(pdata, MMC_TXFRAMECOUNT_G_LO);
+                        xgbe_mmc_read(pdata, MMC_TXFRAMECOUNT_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXPAUSEFRAMES))
                 stats->txpauseframes +=
-                        XGMAC_IOREAD(pdata, MMC_TXPAUSEFRAMES_LO);
+                        xgbe_mmc_read(pdata, MMC_TXPAUSEFRAMES_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_TISR, TXVLANFRAMES_G))
                 stats->txvlanframes_g +=
-                        XGMAC_IOREAD(pdata, MMC_TXVLANFRAMES_G_LO);
+                        xgbe_mmc_read(pdata, MMC_TXVLANFRAMES_G_LO);
 }
 
 static void xgbe_rx_mmc_int(struct xgbe_prv_data *pdata)
@@ -2031,95 +2064,95 @@ static void xgbe_rx_mmc_int(struct xgbe_prv_data *pdata)
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXFRAMECOUNT_GB))
                 stats->rxframecount_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RXFRAMECOUNT_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RXFRAMECOUNT_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXOCTETCOUNT_GB))
                 stats->rxoctetcount_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RXOCTETCOUNT_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RXOCTETCOUNT_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXOCTETCOUNT_G))
                 stats->rxoctetcount_g +=
-                        XGMAC_IOREAD(pdata, MMC_RXOCTETCOUNT_G_LO);
+                        xgbe_mmc_read(pdata, MMC_RXOCTETCOUNT_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXBROADCASTFRAMES_G))
                 stats->rxbroadcastframes_g +=
-                        XGMAC_IOREAD(pdata, MMC_RXBROADCASTFRAMES_G_LO);
+                        xgbe_mmc_read(pdata, MMC_RXBROADCASTFRAMES_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXMULTICASTFRAMES_G))
                 stats->rxmulticastframes_g +=
-                        XGMAC_IOREAD(pdata, MMC_RXMULTICASTFRAMES_G_LO);
+                        xgbe_mmc_read(pdata, MMC_RXMULTICASTFRAMES_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXCRCERROR))
                 stats->rxcrcerror +=
-                        XGMAC_IOREAD(pdata, MMC_RXCRCERROR_LO);
+                        xgbe_mmc_read(pdata, MMC_RXCRCERROR_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXRUNTERROR))
                 stats->rxrunterror +=
-                        XGMAC_IOREAD(pdata, MMC_RXRUNTERROR);
+                        xgbe_mmc_read(pdata, MMC_RXRUNTERROR);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXJABBERERROR))
                 stats->rxjabbererror +=
-                        XGMAC_IOREAD(pdata, MMC_RXJABBERERROR);
+                        xgbe_mmc_read(pdata, MMC_RXJABBERERROR);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXUNDERSIZE_G))
                 stats->rxundersize_g +=
-                        XGMAC_IOREAD(pdata, MMC_RXUNDERSIZE_G);
+                        xgbe_mmc_read(pdata, MMC_RXUNDERSIZE_G);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXOVERSIZE_G))
                 stats->rxoversize_g +=
-                        XGMAC_IOREAD(pdata, MMC_RXOVERSIZE_G);
+                        xgbe_mmc_read(pdata, MMC_RXOVERSIZE_G);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RX64OCTETS_GB))
                 stats->rx64octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RX64OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RX64OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RX65TO127OCTETS_GB))
                 stats->rx65to127octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RX65TO127OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RX65TO127OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RX128TO255OCTETS_GB))
                 stats->rx128to255octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RX128TO255OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RX128TO255OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RX256TO511OCTETS_GB))
                 stats->rx256to511octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RX256TO511OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RX256TO511OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RX512TO1023OCTETS_GB))
                 stats->rx512to1023octets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RX512TO1023OCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RX512TO1023OCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RX1024TOMAXOCTETS_GB))
                 stats->rx1024tomaxoctets_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RX1024TOMAXOCTETS_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RX1024TOMAXOCTETS_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXUNICASTFRAMES_G))
                 stats->rxunicastframes_g +=
-                        XGMAC_IOREAD(pdata, MMC_RXUNICASTFRAMES_G_LO);
+                        xgbe_mmc_read(pdata, MMC_RXUNICASTFRAMES_G_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXLENGTHERROR))
                 stats->rxlengtherror +=
-                        XGMAC_IOREAD(pdata, MMC_RXLENGTHERROR_LO);
+                        xgbe_mmc_read(pdata, MMC_RXLENGTHERROR_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXOUTOFRANGETYPE))
                 stats->rxoutofrangetype +=
-                        XGMAC_IOREAD(pdata, MMC_RXOUTOFRANGETYPE_LO);
+                        xgbe_mmc_read(pdata, MMC_RXOUTOFRANGETYPE_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXPAUSEFRAMES))
                 stats->rxpauseframes +=
-                        XGMAC_IOREAD(pdata, MMC_RXPAUSEFRAMES_LO);
+                        xgbe_mmc_read(pdata, MMC_RXPAUSEFRAMES_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXFIFOOVERFLOW))
                 stats->rxfifooverflow +=
-                        XGMAC_IOREAD(pdata, MMC_RXFIFOOVERFLOW_LO);
+                        xgbe_mmc_read(pdata, MMC_RXFIFOOVERFLOW_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXVLANFRAMES_GB))
                 stats->rxvlanframes_gb +=
-                        XGMAC_IOREAD(pdata, MMC_RXVLANFRAMES_GB_LO);
+                        xgbe_mmc_read(pdata, MMC_RXVLANFRAMES_GB_LO);
 
         if (XGMAC_GET_BITS(mmc_isr, MMC_RISR, RXWATCHDOGERROR))
                 stats->rxwatchdogerror +=
-                        XGMAC_IOREAD(pdata, MMC_RXWATCHDOGERROR);
+                        xgbe_mmc_read(pdata, MMC_RXWATCHDOGERROR);
 }
 
 static void xgbe_read_mmc_stats(struct xgbe_prv_data *pdata)
@@ -2130,127 +2163,127 @@ static void xgbe_read_mmc_stats(struct xgbe_prv_data *pdata)
         XGMAC_IOWRITE_BITS(pdata, MMC_CR, MCF, 1);
 
         stats->txoctetcount_gb +=
-                XGMAC_IOREAD(pdata, MMC_TXOCTETCOUNT_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TXOCTETCOUNT_GB_LO);
 
         stats->txframecount_gb +=
-                XGMAC_IOREAD(pdata, MMC_TXFRAMECOUNT_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TXFRAMECOUNT_GB_LO);
 
         stats->txbroadcastframes_g +=
-                XGMAC_IOREAD(pdata, MMC_TXBROADCASTFRAMES_G_LO);
+                xgbe_mmc_read(pdata, MMC_TXBROADCASTFRAMES_G_LO);
 
         stats->txmulticastframes_g +=
-                XGMAC_IOREAD(pdata, MMC_TXMULTICASTFRAMES_G_LO);
+                xgbe_mmc_read(pdata, MMC_TXMULTICASTFRAMES_G_LO);
 
         stats->tx64octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_TX64OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TX64OCTETS_GB_LO);
 
         stats->tx65to127octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_TX65TO127OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TX65TO127OCTETS_GB_LO);
 
         stats->tx128to255octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_TX128TO255OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TX128TO255OCTETS_GB_LO);
 
         stats->tx256to511octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_TX256TO511OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TX256TO511OCTETS_GB_LO);
 
         stats->tx512to1023octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_TX512TO1023OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TX512TO1023OCTETS_GB_LO);
 
         stats->tx1024tomaxoctets_gb +=
-                XGMAC_IOREAD(pdata, MMC_TX1024TOMAXOCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TX1024TOMAXOCTETS_GB_LO);
 
         stats->txunicastframes_gb +=
-                XGMAC_IOREAD(pdata, MMC_TXUNICASTFRAMES_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TXUNICASTFRAMES_GB_LO);
 
         stats->txmulticastframes_gb +=
-                XGMAC_IOREAD(pdata, MMC_TXMULTICASTFRAMES_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TXMULTICASTFRAMES_GB_LO);
 
         stats->txbroadcastframes_g +=
-                XGMAC_IOREAD(pdata, MMC_TXBROADCASTFRAMES_GB_LO);
+                xgbe_mmc_read(pdata, MMC_TXBROADCASTFRAMES_GB_LO);
 
         stats->txunderflowerror +=
-                XGMAC_IOREAD(pdata, MMC_TXUNDERFLOWERROR_LO);
+                xgbe_mmc_read(pdata, MMC_TXUNDERFLOWERROR_LO);
 
         stats->txoctetcount_g +=
-                XGMAC_IOREAD(pdata, MMC_TXOCTETCOUNT_G_LO);
+                xgbe_mmc_read(pdata, MMC_TXOCTETCOUNT_G_LO);
 
         stats->txframecount_g +=
-                XGMAC_IOREAD(pdata, MMC_TXFRAMECOUNT_G_LO);
+                xgbe_mmc_read(pdata, MMC_TXFRAMECOUNT_G_LO);
 
         stats->txpauseframes +=
-                XGMAC_IOREAD(pdata, MMC_TXPAUSEFRAMES_LO);
+                xgbe_mmc_read(pdata, MMC_TXPAUSEFRAMES_LO);
 
         stats->txvlanframes_g +=
-                XGMAC_IOREAD(pdata, MMC_TXVLANFRAMES_G_LO);
+                xgbe_mmc_read(pdata, MMC_TXVLANFRAMES_G_LO);
 
         stats->rxframecount_gb +=
-                XGMAC_IOREAD(pdata, MMC_RXFRAMECOUNT_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RXFRAMECOUNT_GB_LO);
 
         stats->rxoctetcount_gb +=
-                XGMAC_IOREAD(pdata, MMC_RXOCTETCOUNT_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RXOCTETCOUNT_GB_LO);
 
         stats->rxoctetcount_g +=
-                XGMAC_IOREAD(pdata, MMC_RXOCTETCOUNT_G_LO);
+                xgbe_mmc_read(pdata, MMC_RXOCTETCOUNT_G_LO);
 
         stats->rxbroadcastframes_g +=
-                XGMAC_IOREAD(pdata, MMC_RXBROADCASTFRAMES_G_LO);
+                xgbe_mmc_read(pdata, MMC_RXBROADCASTFRAMES_G_LO);
 
         stats->rxmulticastframes_g +=
-                XGMAC_IOREAD(pdata, MMC_RXMULTICASTFRAMES_G_LO);
+                xgbe_mmc_read(pdata, MMC_RXMULTICASTFRAMES_G_LO);
 
         stats->rxcrcerror +=
-                XGMAC_IOREAD(pdata, MMC_RXCRCERROR_LO);
+                xgbe_mmc_read(pdata, MMC_RXCRCERROR_LO);
 
         stats->rxrunterror +=
-                XGMAC_IOREAD(pdata, MMC_RXRUNTERROR);
+                xgbe_mmc_read(pdata, MMC_RXRUNTERROR);
 
         stats->rxjabbererror +=
-                XGMAC_IOREAD(pdata, MMC_RXJABBERERROR);
+                xgbe_mmc_read(pdata, MMC_RXJABBERERROR);
 
         stats->rxundersize_g +=
-                XGMAC_IOREAD(pdata, MMC_RXUNDERSIZE_G);
+                xgbe_mmc_read(pdata, MMC_RXUNDERSIZE_G);
 
         stats->rxoversize_g +=
-                XGMAC_IOREAD(pdata, MMC_RXOVERSIZE_G);
+                xgbe_mmc_read(pdata, MMC_RXOVERSIZE_G);
 
         stats->rx64octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_RX64OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RX64OCTETS_GB_LO);
 
         stats->rx65to127octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_RX65TO127OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RX65TO127OCTETS_GB_LO);
 
         stats->rx128to255octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_RX128TO255OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RX128TO255OCTETS_GB_LO);
 
         stats->rx256to511octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_RX256TO511OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RX256TO511OCTETS_GB_LO);
 
         stats->rx512to1023octets_gb +=
-                XGMAC_IOREAD(pdata, MMC_RX512TO1023OCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RX512TO1023OCTETS_GB_LO);
 
         stats->rx1024tomaxoctets_gb +=
-                XGMAC_IOREAD(pdata, MMC_RX1024TOMAXOCTETS_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RX1024TOMAXOCTETS_GB_LO);
 
         stats->rxunicastframes_g +=
-                XGMAC_IOREAD(pdata, MMC_RXUNICASTFRAMES_G_LO);
+                xgbe_mmc_read(pdata, MMC_RXUNICASTFRAMES_G_LO);
 
         stats->rxlengtherror +=
-                XGMAC_IOREAD(pdata, MMC_RXLENGTHERROR_LO);
+                xgbe_mmc_read(pdata, MMC_RXLENGTHERROR_LO);
 
         stats->rxoutofrangetype +=
-                XGMAC_IOREAD(pdata, MMC_RXOUTOFRANGETYPE_LO);
+                xgbe_mmc_read(pdata, MMC_RXOUTOFRANGETYPE_LO);
 
         stats->rxpauseframes +=
-                XGMAC_IOREAD(pdata, MMC_RXPAUSEFRAMES_LO);
+                xgbe_mmc_read(pdata, MMC_RXPAUSEFRAMES_LO);
 
         stats->rxfifooverflow +=
-                XGMAC_IOREAD(pdata, MMC_RXFIFOOVERFLOW_LO);
+                xgbe_mmc_read(pdata, MMC_RXFIFOOVERFLOW_LO);
 
         stats->rxvlanframes_gb +=
-                XGMAC_IOREAD(pdata, MMC_RXVLANFRAMES_GB_LO);
+                xgbe_mmc_read(pdata, MMC_RXVLANFRAMES_GB_LO);
 
         stats->rxwatchdogerror +=
-                XGMAC_IOREAD(pdata, MMC_RXWATCHDOGERROR);
+                xgbe_mmc_read(pdata, MMC_RXWATCHDOGERROR);
 
         /* Un-freeze counters */
         XGMAC_IOWRITE_BITS(pdata, MMC_CR, MCF, 0);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 847da66d1548..29554992215a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -360,6 +360,8 @@ void xgbe_get_all_hw_features(struct xgbe_prv_data *pdata)
 
         memset(hw_feat, 0, sizeof(*hw_feat));
 
+        hw_feat->version = XGMAC_IOREAD(pdata, MAC_VR);
+
         /* Hardware feature register 0 */
         hw_feat->gmii        = XGMAC_GET_BITS(mac_hfr0, MAC_HWF0R, GMIISEL);
         hw_feat->vlhash      = XGMAC_GET_BITS(mac_hfr0, MAC_HWF0R, VLHASH);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
index 2289526b6f1c..49508ec98b72 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
@@ -361,15 +361,16 @@ static void xgbe_get_drvinfo(struct net_device *netdev,
                              struct ethtool_drvinfo *drvinfo)
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
+        struct xgbe_hw_features *hw_feat = &pdata->hw_feat;
 
         strlcpy(drvinfo->driver, XGBE_DRV_NAME, sizeof(drvinfo->driver));
         strlcpy(drvinfo->version, XGBE_DRV_VERSION, sizeof(drvinfo->version));
         strlcpy(drvinfo->bus_info, dev_name(pdata->dev),
                 sizeof(drvinfo->bus_info));
         snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), "%d.%d.%d",
-                 XGMAC_IOREAD_BITS(pdata, MAC_VR, USERVER),
-                 XGMAC_IOREAD_BITS(pdata, MAC_VR, DEVID),
-                 XGMAC_IOREAD_BITS(pdata, MAC_VR, SNPSVER));
+                 XGMAC_GET_BITS(hw_feat->version, MAC_VR, USERVER),
+                 XGMAC_GET_BITS(hw_feat->version, MAC_VR, DEVID),
+                 XGMAC_GET_BITS(hw_feat->version, MAC_VR, SNPSVER));
         drvinfo->n_stats = XGBE_STATS_COUNT;
 }
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index 984161d4ffc9..f5a8fa03921a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -171,7 +171,7 @@ static struct xgbe_channel *xgbe_alloc_rings(struct xgbe_prv_data *pdata)
                 }
 
                 if (i < pdata->rx_ring_count) {
-                        spin_lock_init(&tx_ring->lock);
+                        spin_lock_init(&rx_ring->lock);
                         channel->rx_ring = rx_ring++;
                 }
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index 84fe34ce5571..789957d43a13 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -182,6 +182,7 @@
 #define XGMAC_DRIVER_CONTEXT    1
 #define XGMAC_IOCTL_CONTEXT     2
 
+#define XGBE_FIFO_MAX           81920
 #define XGBE_FIFO_SIZE_B(x)     (x)
 #define XGBE_FIFO_SIZE_KB(x)    (x * 1024)
 
@@ -524,6 +525,9 @@ struct xgbe_desc_if {
  * or configurations are present in the device.
  */
 struct xgbe_hw_features {
+        /* HW Version */
+        unsigned int version;
+
         /* HW Feature Register0 */
         unsigned int gmii;              /* 1000 Mbps support */
         unsigned int vlhash;            /* VLAN Hash Filter */
diff --git a/drivers/net/ethernet/apm/xgene/Kconfig b/drivers/net/ethernet/apm/xgene/Kconfig
index 616dff6d3f5f..f4054d242f3c 100644
--- a/drivers/net/ethernet/apm/xgene/Kconfig
+++ b/drivers/net/ethernet/apm/xgene/Kconfig
@@ -1,5 +1,6 @@
 config NET_XGENE
         tristate "APM X-Gene SoC Ethernet Driver"
+        depends on HAS_DMA
         select PHYLIB
         help
           This is the Ethernet driver for the on-chip ethernet interface on the
diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig
index a5ea416133a8..c3e260c21734 100644
--- a/drivers/net/ethernet/broadcom/Kconfig
+++ b/drivers/net/ethernet/broadcom/Kconfig
@@ -84,7 +84,7 @@ config BNX2
 
 config CNIC
         tristate "QLogic CNIC support"
-        depends on PCI
+        depends on PCI && (IPV6 || IPV6=n)
         select BNX2
         select UIO
         ---help---
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
index 5579d4bdbaac..3e0621acdf05 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
@@ -2233,7 +2233,12 @@ struct shmem2_region {
         u32 reserved3;                          /* Offset 0x14C */
         u32 reserved4;                          /* Offset 0x150 */
         u32 link_attr_sync[PORT_MAX];           /* Offset 0x154 */
-        #define LINK_ATTR_SYNC_KR2_ENABLE       (1<<0)
+        #define LINK_ATTR_SYNC_KR2_ENABLE       0x00000001
+        #define LINK_SFP_EEPROM_COMP_CODE_MASK  0x0000ff00
+        #define LINK_SFP_EEPROM_COMP_CODE_SHIFT          8
+        #define LINK_SFP_EEPROM_COMP_CODE_SR    0x00001000
+        #define LINK_SFP_EEPROM_COMP_CODE_LR    0x00002000
+        #define LINK_SFP_EEPROM_COMP_CODE_LRM   0x00004000
 
         u32 reserved5[2];
         u32 reserved6[PORT_MAX];
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 53fb4fa61b40..549549eaf580 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -154,15 +154,22 @@ typedef int (*read_sfp_module_eeprom_func_p)(struct bnx2x_phy *phy,
                          LINK_STATUS_LINK_PARTNER_ASYMMETRIC_PAUSE)
 
 #define SFP_EEPROM_CON_TYPE_ADDR                0x2
+        #define SFP_EEPROM_CON_TYPE_VAL_UNKNOWN 0x0
         #define SFP_EEPROM_CON_TYPE_VAL_LC      0x7
         #define SFP_EEPROM_CON_TYPE_VAL_COPPER  0x21
         #define SFP_EEPROM_CON_TYPE_VAL_RJ45    0x22
 
 
-#define SFP_EEPROM_COMP_CODE_ADDR               0x3
-        #define SFP_EEPROM_COMP_CODE_SR_MASK    (1<<4)
-        #define SFP_EEPROM_COMP_CODE_LR_MASK    (1<<5)
-        #define SFP_EEPROM_COMP_CODE_LRM_MASK   (1<<6)
+#define SFP_EEPROM_10G_COMP_CODE_ADDR           0x3
+        #define SFP_EEPROM_10G_COMP_CODE_SR_MASK        (1<<4)
+        #define SFP_EEPROM_10G_COMP_CODE_LR_MASK        (1<<5)
+        #define SFP_EEPROM_10G_COMP_CODE_LRM_MASK       (1<<6)
+
+#define SFP_EEPROM_1G_COMP_CODE_ADDR            0x6
+        #define SFP_EEPROM_1G_COMP_CODE_SX      (1<<0)
+        #define SFP_EEPROM_1G_COMP_CODE_LX      (1<<1)
+        #define SFP_EEPROM_1G_COMP_CODE_CX      (1<<2)
+        #define SFP_EEPROM_1G_COMP_CODE_BASE_T  (1<<3)
 
 #define SFP_EEPROM_FC_TX_TECH_ADDR              0x8
         #define SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE 0x4
@@ -3633,8 +3640,8 @@ static void bnx2x_warpcore_enable_AN_KR2(struct bnx2x_phy *phy,
                                  reg_set[i].val);
 
         /* Start KR2 work-around timer which handles BCM8073 link-parner */
-        vars->link_attr_sync |= LINK_ATTR_SYNC_KR2_ENABLE;
-        bnx2x_update_link_attr(params, vars->link_attr_sync);
+        params->link_attr_sync |= LINK_ATTR_SYNC_KR2_ENABLE;
+        bnx2x_update_link_attr(params, params->link_attr_sync);
 }
 
 static void bnx2x_disable_kr2(struct link_params *params,
@@ -3666,8 +3673,8 @@ static void bnx2x_disable_kr2(struct link_params *params,
         for (i = 0; i < ARRAY_SIZE(reg_set); i++)
                 bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
                                  reg_set[i].val);
-        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
-        bnx2x_update_link_attr(params, vars->link_attr_sync);
+        params->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
+        bnx2x_update_link_attr(params, params->link_attr_sync);
 
         vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
 }
@@ -4810,7 +4817,7 @@ void bnx2x_link_status_update(struct link_params *params,
                                         ~FEATURE_CONFIG_PFC_ENABLED;
 
         if (SHMEM2_HAS(bp, link_attr_sync))
-                vars->link_attr_sync = SHMEM2_RD(bp,
+                params->link_attr_sync = SHMEM2_RD(bp,
                                                  link_attr_sync[params->port]);
 
         DP(NETIF_MSG_LINK, "link_status 0x%x  phy_link_up %x int_mask 0x%x\n",
@@ -8057,21 +8064,24 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
 {
         struct bnx2x *bp = params->bp;
         u32 sync_offset = 0, phy_idx, media_types;
-        u8 gport, val[2], check_limiting_mode = 0;
+        u8 val[SFP_EEPROM_FC_TX_TECH_ADDR + 1], check_limiting_mode = 0;
         *edc_mode = EDC_MODE_LIMITING;
         phy->media_type = ETH_PHY_UNSPECIFIED;
         /* First check for copper cable */
         if (bnx2x_read_sfp_module_eeprom(phy,
                                          params,
                                          I2C_DEV_ADDR_A0,
-                                         SFP_EEPROM_CON_TYPE_ADDR,
-                                         2,
+                                         0,
+                                         SFP_EEPROM_FC_TX_TECH_ADDR + 1,
                                          (u8 *)val) != 0) {
                 DP(NETIF_MSG_LINK, "Failed to read from SFP+ module EEPROM\n");
                 return -EINVAL;
         }
-
-        switch (val[0]) {
+        params->link_attr_sync &= ~LINK_SFP_EEPROM_COMP_CODE_MASK;
+        params->link_attr_sync |= val[SFP_EEPROM_10G_COMP_CODE_ADDR] <<
+                LINK_SFP_EEPROM_COMP_CODE_SHIFT;
+        bnx2x_update_link_attr(params, params->link_attr_sync);
+        switch (val[SFP_EEPROM_CON_TYPE_ADDR]) {
         case SFP_EEPROM_CON_TYPE_VAL_COPPER:
         {
                 u8 copper_module_type;
@@ -8079,17 +8089,7 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                 /* Check if its active cable (includes SFP+ module)
                  * of passive cable
                  */
-                if (bnx2x_read_sfp_module_eeprom(phy,
-                                               params,
-                                               I2C_DEV_ADDR_A0,
-                                               SFP_EEPROM_FC_TX_TECH_ADDR,
-                                               1,
-                                               &copper_module_type) != 0) {
-                        DP(NETIF_MSG_LINK,
-                                "Failed to read copper-cable-type"
-                                " from SFP+ EEPROM\n");
-                        return -EINVAL;
-                }
+                copper_module_type = val[SFP_EEPROM_FC_TX_TECH_ADDR];
 
                 if (copper_module_type &
                     SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_ACTIVE) {
@@ -8115,16 +8115,18 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                 }
                 break;
         }
+        case SFP_EEPROM_CON_TYPE_VAL_UNKNOWN:
         case SFP_EEPROM_CON_TYPE_VAL_LC:
         case SFP_EEPROM_CON_TYPE_VAL_RJ45:
                 check_limiting_mode = 1;
-                if ((val[1] & (SFP_EEPROM_COMP_CODE_SR_MASK |
-                               SFP_EEPROM_COMP_CODE_LR_MASK |
-                               SFP_EEPROM_COMP_CODE_LRM_MASK)) == 0) {
+                if ((val[SFP_EEPROM_10G_COMP_CODE_ADDR] &
+                     (SFP_EEPROM_10G_COMP_CODE_SR_MASK |
+                      SFP_EEPROM_10G_COMP_CODE_LR_MASK |
+                      SFP_EEPROM_10G_COMP_CODE_LRM_MASK)) == 0) {
                         DP(NETIF_MSG_LINK, "1G SFP module detected\n");
-                        gport = params->port;
                         phy->media_type = ETH_PHY_SFP_1G_FIBER;
                         if (phy->req_line_speed != SPEED_1000) {
+                                u8 gport = params->port;
                                 phy->req_line_speed = SPEED_1000;
                                 if (!CHIP_IS_E1x(bp)) {
                                         gport = BP_PATH(bp) +
@@ -8134,6 +8136,12 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                                            "Warning: Link speed was forced to 1000Mbps. Current SFP module in port %d is not compliant with 10G Ethernet\n",
                                            gport);
                         }
+                        if (val[SFP_EEPROM_1G_COMP_CODE_ADDR] &
+                            SFP_EEPROM_1G_COMP_CODE_BASE_T) {
+                                bnx2x_sfp_set_transmitter(params, phy, 0);
+                                msleep(40);
+                                bnx2x_sfp_set_transmitter(params, phy, 1);
+                        }
                 } else {
                         int idx, cfg_idx = 0;
                         DP(NETIF_MSG_LINK, "10G Optic module detected\n");
@@ -8149,7 +8157,7 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                 break;
         default:
                 DP(NETIF_MSG_LINK, "Unable to determine module type 0x%x !!!\n",
-                         val[0]);
+                         val[SFP_EEPROM_CON_TYPE_ADDR]);
                 return -EINVAL;
         }
         sync_offset = params->shmem_base +
@@ -13507,7 +13515,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
 
         sigdet = bnx2x_warpcore_get_sigdet(phy, params);
         if (!sigdet) {
-                if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
+                if (!(params->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
                         bnx2x_kr2_recovery(params, vars, phy);
                         DP(NETIF_MSG_LINK, "No sigdet\n");
                 }
@@ -13525,7 +13533,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
 
         /* CL73 has not begun yet */
         if (base_page == 0) {
-                if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
+                if (!(params->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
                         bnx2x_kr2_recovery(params, vars, phy);
                         DP(NETIF_MSG_LINK, "No BP\n");
                 }
@@ -13541,7 +13549,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
                             ((next_page & 0xe0) == 0x20))));
 
         /* In case KR2 is already disabled, check if we need to re-enable it */
-        if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
+        if (!(params->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
                 if (!not_kr2_device) {
                         DP(NETIF_MSG_LINK, "BP=0x%x, NP=0x%x\n", base_page,
                            next_page);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
index 389f5f8cb0a3..d9cce4c3899b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
@@ -323,6 +323,9 @@ struct link_params {
 #define LINK_FLAGS_INT_DISABLED         (1<<0)
 #define PHY_INITIALIZED         (1<<1)
         u32 lfa_base;
+
+        /* The same definitions as the shmem2 parameter */
+        u32 link_attr_sync;
 };
 
 /* Output parameters */
@@ -364,8 +367,6 @@ struct link_vars {
         u8 rx_tx_asic_rst;
         u8 turn_to_run_wc_rt;
         u16 rsrv2;
-        /* The same definitions as the shmem2 parameter */
-        u32 link_attr_sync;
 };
 
 /***********************************************************/
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 93132d8fec67..32e2444ab5e1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -6868,6 +6868,37 @@ static void bnx2x__common_init_phy(struct bnx2x *bp)
         bnx2x_release_phy_lock(bp);
 }
 
+static void bnx2x_config_endianity(struct bnx2x *bp, u32 val)
+{
+        REG_WR(bp, PXP2_REG_RQ_QM_ENDIAN_M, val);
+        REG_WR(bp, PXP2_REG_RQ_TM_ENDIAN_M, val);
+        REG_WR(bp, PXP2_REG_RQ_SRC_ENDIAN_M, val);
+        REG_WR(bp, PXP2_REG_RQ_CDU_ENDIAN_M, val);
+        REG_WR(bp, PXP2_REG_RQ_DBG_ENDIAN_M, val);
+
+        /* make sure this value is 0 */
+        REG_WR(bp, PXP2_REG_RQ_HC_ENDIAN_M, 0);
+
+        REG_WR(bp, PXP2_REG_RD_QM_SWAP_MODE, val);
+        REG_WR(bp, PXP2_REG_RD_TM_SWAP_MODE, val);
+        REG_WR(bp, PXP2_REG_RD_SRC_SWAP_MODE, val);
+        REG_WR(bp, PXP2_REG_RD_CDURD_SWAP_MODE, val);
+}
+
+static void bnx2x_set_endianity(struct bnx2x *bp)
+{
+#ifdef __BIG_ENDIAN
+        bnx2x_config_endianity(bp, 1);
+#else
+        bnx2x_config_endianity(bp, 0);
+#endif
+}
+
+static void bnx2x_reset_endianity(struct bnx2x *bp)
+{
+        bnx2x_config_endianity(bp, 0);
+}
+
 /**
  * bnx2x_init_hw_common - initialize the HW at the COMMON phase.
  *
@@ -6934,23 +6965,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
 
         bnx2x_init_block(bp, BLOCK_PXP2, PHASE_COMMON);
         bnx2x_init_pxp(bp);
-
-#ifdef __BIG_ENDIAN
-        REG_WR(bp, PXP2_REG_RQ_QM_ENDIAN_M, 1);
-        REG_WR(bp, PXP2_REG_RQ_TM_ENDIAN_M, 1);
-        REG_WR(bp, PXP2_REG_RQ_SRC_ENDIAN_M, 1);
-        REG_WR(bp, PXP2_REG_RQ_CDU_ENDIAN_M, 1);
-        REG_WR(bp, PXP2_REG_RQ_DBG_ENDIAN_M, 1);
-        /* make sure this value is 0 */
-        REG_WR(bp, PXP2_REG_RQ_HC_ENDIAN_M, 0);
-
-/*      REG_WR(bp, PXP2_REG_RD_PBF_SWAP_MODE, 1); */
-        REG_WR(bp, PXP2_REG_RD_QM_SWAP_MODE, 1);
-        REG_WR(bp, PXP2_REG_RD_TM_SWAP_MODE, 1);
-        REG_WR(bp, PXP2_REG_RD_SRC_SWAP_MODE, 1);
-        REG_WR(bp, PXP2_REG_RD_CDURD_SWAP_MODE, 1);
-#endif
-
+        bnx2x_set_endianity(bp);
         bnx2x_ilt_init_page_size(bp, INITOP_SET);
 
         if (CHIP_REV_IS_FPGA(bp) && CHIP_IS_E1H(bp))
@@ -13440,9 +13455,15 @@ static void __bnx2x_remove(struct pci_dev *pdev,
         bnx2x_iov_remove_one(bp);
 
         /* Power on: we can't let PCI layer write to us while we are in D3 */
-        if (IS_PF(bp))
+        if (IS_PF(bp)) {
                 bnx2x_set_power_state(bp, PCI_D0);
 
+                /* Set endianity registers to reset values in case next driver
+                 * boots in different endianty environment.
+                 */
+                bnx2x_reset_endianity(bp);
+        }
+
         /* Disable MSI/MSI-X */
         bnx2x_disable_msi(bp);
 
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index eef63a8508e6..23f23c97c2ad 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -31,7 +31,7 @@
 #include <linux/if_vlan.h>
 #include <linux/prefetch.h>
 #include <linux/random.h>
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+#if IS_ENABLED(CONFIG_VLAN_8021Q)
 #define BCM_VLAN 1
 #endif
 #include <net/ip.h>
@@ -3685,7 +3685,7 @@ static int cnic_get_v4_route(struct sockaddr_in *dst_addr,
 static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
                              struct dst_entry **dst)
 {
-#if defined(CONFIG_IPV6) || (defined(CONFIG_IPV6_MODULE) && defined(MODULE))
+#if IS_ENABLED(CONFIG_IPV6)
         struct flowi6 fl6;
 
         memset(&fl6, 0, sizeof(fl6));
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3ac5d23454a8..cb77ae93d89a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -11617,6 +11617,12 @@ static int tg3_open(struct net_device *dev)
         struct tg3 *tp = netdev_priv(dev);
         int err;
 
+        if (tp->pcierr_recovery) {
+                netdev_err(dev, "Failed to open device. PCI error recovery "
+                           "in progress\n");
+                return -EAGAIN;
+        }
+
         if (tp->fw_needed) {
                 err = tg3_request_firmware(tp);
                 if (tg3_asic_rev(tp) == ASIC_REV_57766) {
@@ -11674,6 +11680,12 @@ static int tg3_close(struct net_device *dev)
 {
         struct tg3 *tp = netdev_priv(dev);
 
+        if (tp->pcierr_recovery) {
+                netdev_err(dev, "Failed to close device. PCI error recovery "
+                           "in progress\n");
+                return -EAGAIN;
+        }
+
         tg3_ptp_fini(tp);
 
         tg3_stop(tp);
@@ -17561,6 +17573,7 @@ static int tg3_init_one(struct pci_dev *pdev,
         tp->rx_mode = TG3_DEF_RX_MODE;
         tp->tx_mode = TG3_DEF_TX_MODE;
         tp->irq_sync = 1;
+        tp->pcierr_recovery = false;
 
         if (tg3_debug > 0)
                 tp->msg_enable = tg3_debug;
@@ -18071,6 +18084,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
 
         rtnl_lock();
 
+        tp->pcierr_recovery = true;
+
         /* We probably don't have netdev yet */
         if (!netdev || !netif_running(netdev))
                 goto done;
@@ -18195,6 +18210,7 @@ static void tg3_io_resume(struct pci_dev *pdev)
         tg3_phy_start(tp);
 
 done:
+        tp->pcierr_recovery = false;
         rtnl_unlock();
 }
 
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 461accaf0aa4..31c9f8295953 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -3407,6 +3407,7 @@ struct tg3 {
 
         struct device                   *hwmon_dev;
         bool                            link_up;
+        bool                            pcierr_recovery;
 };
 
 /* Accessor macros for chip and asic attributes
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index ff8cae5e2535..ffc92a41d75b 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -2506,7 +2506,7 @@ bnad_tso_prepare(struct bnad *bnad, struct sk_buff *skb)
          * For TSO, the TCP checksum field is seeded with pseudo-header sum
          * excluding the length field.
          */
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (vlan_get_protocol(skb) == htons(ETH_P_IP)) {
                 struct iphdr *iph = ip_hdr(skb);
 
                 /* Do we really need these? */
@@ -2870,12 +2870,13 @@ bnad_txq_wi_prepare(struct bnad *bnad, struct bna_tcb *tcb,
                 }
 
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                        __be16 net_proto = vlan_get_protocol(skb);
                         u8 proto = 0;
 
-                        if (skb->protocol == htons(ETH_P_IP))
+                        if (net_proto == htons(ETH_P_IP))
                                 proto = ip_hdr(skb)->protocol;
 #ifdef NETIF_F_IPV6_CSUM
-                        else if (skb->protocol == htons(ETH_P_IPV6)) {
+                        else if (net_proto == htons(ETH_P_IPV6)) {
                                 /* nexthdr may not be TCP immediately. */
                                 proto = ipv6_hdr(skb)->nexthdr;
                         }
diff --git a/drivers/net/ethernet/calxeda/Kconfig b/drivers/net/ethernet/calxeda/Kconfig
index 184a063bed5f..07d2201530d2 100644
--- a/drivers/net/ethernet/calxeda/Kconfig
+++ b/drivers/net/ethernet/calxeda/Kconfig
@@ -1,6 +1,7 @@
 config NET_CALXEDA_XGMAC
         tristate "Calxeda 1G/10G XGMAC Ethernet driver"
         depends on HAS_IOMEM && HAS_DMA
+        depends on ARCH_HIGHBANK || COMPILE_TEST
         select CRC32
         help
           This is the driver for the XGMAC Ethernet IP block found on Calxeda
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 18fb9c61d7ba..8c34811a1128 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -1253,7 +1253,9 @@ freeout:	t4_free_sge_resources(adap);
                         goto freeout;
         }
 
-        t4_write_reg(adap, MPS_TRC_RSS_CONTROL,
+        t4_write_reg(adap, is_t4(adap->params.chip) ?
+                                MPS_TRC_RSS_CONTROL :
+                                MPS_T5_TRC_RSS_CONTROL,
                      RSSCONTROL(netdev2pinfo(adap->port[0])->tx_chan) |
                      QUEUENUMBER(s->ethrxq[0].rspq.abs_id));
         return 0;
@@ -1761,7 +1763,8 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
                 0xd004, 0xd03c,
                 0xdfc0, 0xdfe0,
                 0xe000, 0xea7c,
-                0xf000, 0x11190,
+                0xf000, 0x11110,
+                0x11118, 0x11190,
                 0x19040, 0x1906c,
                 0x19078, 0x19080,
                 0x1908c, 0x19124,
@@ -1968,7 +1971,8 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
                 0xd004, 0xd03c,
                 0xdfc0, 0xdfe0,
                 0xe000, 0x11088,
-                0x1109c, 0x1117c,
+                0x1109c, 0x11110,
+                0x11118, 0x1117c,
                 0x11190, 0x11204,
                 0x19040, 0x1906c,
                 0x19078, 0x19080,
@@ -5955,7 +5959,8 @@ static int adap_init0(struct adapter *adap)
                 params[3] = FW_PARAM_PFVF(CQ_END);
                 params[4] = FW_PARAM_PFVF(OCQ_START);
                 params[5] = FW_PARAM_PFVF(OCQ_END);
-                ret = t4_query_params(adap, 0, 0, 0, 6, params, val);
+                ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 6, params,
+                                      val);
                 if (ret < 0)
                         goto bye;
                 adap->vres.qp.start = val[0];
@@ -5967,7 +5972,8 @@ static int adap_init0(struct adapter *adap)
 
                 params[0] = FW_PARAM_DEV(MAXORDIRD_QP);
                 params[1] = FW_PARAM_DEV(MAXIRD_ADAPTER);
-                ret = t4_query_params(adap, 0, 0, 0, 2, params, val);
+                ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 2, params,
+                                      val);
                 if (ret < 0) {
                         adap->params.max_ordird_qp = 8;
                         adap->params.max_ird_adapter = 32 * adap->tids.ntids;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index a853133d8db8..41d04462b72e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -168,6 +168,34 @@ void t4_hw_pci_read_cfg4(struct adapter *adap, int reg, u32 *val)
 }
 
 /*
+ * t4_report_fw_error - report firmware error
+ * @adap: the adapter
+ *
+ * The adapter firmware can indicate error conditions to the host.
+ * If the firmware has indicated an error, print out the reason for
+ * the firmware error.
+ */
+static void t4_report_fw_error(struct adapter *adap)
+{
+        static const char *const reason[] = {
+                "Crash",                        /* PCIE_FW_EVAL_CRASH */
+                "During Device Preparation",    /* PCIE_FW_EVAL_PREP */
+                "During Device Configuration",  /* PCIE_FW_EVAL_CONF */
+                "During Device Initialization", /* PCIE_FW_EVAL_INIT */
+                "Unexpected Event",             /* PCIE_FW_EVAL_UNEXPECTEDEVENT */
+                "Insufficient Airflow",         /* PCIE_FW_EVAL_OVERHEAT */
+                "Device Shutdown",              /* PCIE_FW_EVAL_DEVICESHUTDOWN */
+                "Reserved",                     /* reserved */
+        };
+        u32 pcie_fw;
+
+        pcie_fw = t4_read_reg(adap, MA_PCIE_FW);
+        if (pcie_fw & FW_PCIE_FW_ERR)
+                dev_err(adap->pdev_dev, "Firmware reports adapter error: %s\n",
+                        reason[FW_PCIE_FW_EVAL_GET(pcie_fw)]);
+}
+
+/*
  * Get the reply to a mailbox command and store it in @rpl in big-endian order.
  */
 static void get_mbox_rpl(struct adapter *adap, __be64 *rpl, int nflit,
@@ -300,6 +328,7 @@ int t4_wr_mbox_meat(struct adapter *adap, int mbox, const void *cmd, int size,
         dump_mbox(adap, mbox, data_reg);
         dev_err(adap->pdev_dev, "command %#x in mailbox %d timed out\n",
                 *(const u8 *)cmd, mbox);
+        t4_report_fw_error(adap);
         return -ETIMEDOUT;
 }
 
@@ -566,6 +595,7 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
 #define VPD_BASE           0x400
 #define VPD_BASE_OLD       0
 #define VPD_LEN            1024
+#define CHELSIO_VPD_UNIQUE_ID 0x82
 
 /**
  *      t4_seeprom_wp - enable/disable EEPROM write protection
@@ -603,7 +633,14 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
         ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(u32), vpd);
         if (ret < 0)
                 goto out;
-        addr = *vpd == 0x82 ? VPD_BASE : VPD_BASE_OLD;
+
+        /* The VPD shall have a unique identifier specified by the PCI SIG.
+         * For chelsio adapters, the identifier is 0x82. The first byte of a VPD
+         * shall be CHELSIO_VPD_UNIQUE_ID (0x82). The VPD programming software
+         * is expected to automatically put this entry at the
+         * beginning of the VPD.
+         */
+        addr = *vpd == CHELSIO_VPD_UNIQUE_ID ? VPD_BASE : VPD_BASE_OLD;
 
         ret = pci_read_vpd(adapter->pdev, addr, VPD_LEN, vpd);
         if (ret < 0)
@@ -667,6 +704,7 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
         i = pci_vpd_info_field_size(vpd + sn - PCI_VPD_INFO_FLD_HDR_SIZE);
         memcpy(p->sn, vpd + sn, min(i, SERNUM_LEN));
         strim(p->sn);
+        i = pci_vpd_info_field_size(vpd + pn - PCI_VPD_INFO_FLD_HDR_SIZE);
         memcpy(p->pn, vpd + pn, min(i, PN_LEN));
         strim(p->pn);
 
@@ -1394,15 +1432,18 @@ static void pcie_intr_handler(struct adapter *adapter)
 
         int fat;
 
-        fat = t4_handle_intr_status(adapter,
-                                    PCIE_CORE_UTL_SYSTEM_BUS_AGENT_STATUS,
-                                    sysbus_intr_info) +
-              t4_handle_intr_status(adapter,
-                                    PCIE_CORE_UTL_PCI_EXPRESS_PORT_STATUS,
-                                    pcie_port_intr_info) +
-              t4_handle_intr_status(adapter, PCIE_INT_CAUSE,
-                                    is_t4(adapter->params.chip) ?
-                                    pcie_intr_info : t5_pcie_intr_info);
+        if (is_t4(adapter->params.chip))
+                fat = t4_handle_intr_status(adapter,
+                                            PCIE_CORE_UTL_SYSTEM_BUS_AGENT_STATUS,
+                                            sysbus_intr_info) +
+                        t4_handle_intr_status(adapter,
+                                              PCIE_CORE_UTL_PCI_EXPRESS_PORT_STATUS,
+                                              pcie_port_intr_info) +
+                        t4_handle_intr_status(adapter, PCIE_INT_CAUSE,
+                                              pcie_intr_info);
+        else
+                fat = t4_handle_intr_status(adapter, PCIE_INT_CAUSE,
+                                            t5_pcie_intr_info);
 
         if (fat)
                 t4_fatal_err(adapter);
@@ -1521,6 +1562,9 @@ static void cim_intr_handler(struct adapter *adapter)
 
         int fat;
 
+        if (t4_read_reg(adapter, MA_PCIE_FW) & FW_PCIE_FW_ERR)
+                t4_report_fw_error(adapter);
+
         fat = t4_handle_intr_status(adapter, CIM_HOST_INT_CAUSE,
                                     cim_intr_info) +
               t4_handle_intr_status(adapter, CIM_HOST_UPACC_INT_CAUSE,
@@ -1768,10 +1812,16 @@ static void ma_intr_handler(struct adapter *adap)
 {
         u32 v, status = t4_read_reg(adap, MA_INT_CAUSE);
 
-        if (status & MEM_PERR_INT_CAUSE)
+        if (status & MEM_PERR_INT_CAUSE) {
                 dev_alert(adap->pdev_dev,
                           "MA parity error, parity status %#x\n",
                           t4_read_reg(adap, MA_PARITY_ERROR_STATUS));
+                if (is_t5(adap->params.chip))
+                        dev_alert(adap->pdev_dev,
+                                  "MA parity error, parity status %#x\n",
+                                  t4_read_reg(adap,
+                                              MA_PARITY_ERROR_STATUS2));
+        }
         if (status & MEM_WRAP_INT_CAUSE) {
                 v = t4_read_reg(adap, MA_INT_WRAP_STATUS);
                 dev_alert(adap->pdev_dev, "MA address wrap-around error by "
@@ -2733,12 +2783,16 @@ retry:
         /*
          * Issue the HELLO command to the firmware.  If it's not successful
          * but indicates that we got a "busy" or "timeout" condition, retry
-         * the HELLO until we exhaust our retry limit.
+         * the HELLO until we exhaust our retry limit.  If we do exceed our
+         * retry limit, check to see if the firmware left us any error
+         * information and report that if so.
          */
         ret = t4_wr_mbox(adap, mbox, &c, sizeof(c), &c);
         if (ret < 0) {
                 if ((ret == -EBUSY || ret == -ETIMEDOUT) && retries-- > 0)
                         goto retry;
+                if (t4_read_reg(adap, MA_PCIE_FW) & FW_PCIE_FW_ERR)
+                        t4_report_fw_error(adap);
                 return ret;
         }
 
@@ -3742,6 +3796,7 @@ int t4_handle_fw_rpl(struct adapter *adap, const __be64 *rpl)
                         lc->link_ok = link_ok;
                         lc->speed = speed;
                         lc->fc = fc;
+                        lc->supported = be16_to_cpu(p->u.info.pcap);
                         t4_os_link_changed(adap, port, link_ok);
                 }
                 if (mod != pi->mod_type) {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index e3146e83df20..39fb325474f7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -511,6 +511,7 @@
 #define  MEM_WRAP_CLIENT_NUM_GET(x) (((x) & MEM_WRAP_CLIENT_NUM_MASK) >> MEM_WRAP_CLIENT_NUM_SHIFT)
 #define MA_PCIE_FW 0x30b8
 #define MA_PARITY_ERROR_STATUS 0x77f4
+#define MA_PARITY_ERROR_STATUS2 0x7804
 
 #define MA_EXT_MEMORY1_BAR 0x7808
 #define EDC_0_BASE_ADDR 0x7900
@@ -959,6 +960,7 @@
 #define  TRCMULTIFILTER     0x00000001U
 
 #define MPS_TRC_RSS_CONTROL 0x9808
+#define MPS_T5_TRC_RSS_CONTROL 0xa00c
 #define  RSSCONTROL_MASK    0x00ff0000U
 #define  RSSCONTROL_SHIFT   16
 #define  RSSCONTROL(x)      ((x) << RSSCONTROL_SHIFT)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index 5f2729ebadbe..3409756a85b9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -2228,6 +2228,10 @@ struct fw_debug_cmd {
 #define FW_PCIE_FW_MASTER(x)     ((x) << FW_PCIE_FW_MASTER_SHIFT)
 #define FW_PCIE_FW_MASTER_GET(x) (((x) >> FW_PCIE_FW_MASTER_SHIFT) & \
                                  FW_PCIE_FW_MASTER_MASK)
+#define FW_PCIE_FW_EVAL_MASK   0x7
+#define FW_PCIE_FW_EVAL_SHIFT  24
+#define FW_PCIE_FW_EVAL_GET(x) (((x) >> FW_PCIE_FW_EVAL_SHIFT) & \
+                                 FW_PCIE_FW_EVAL_MASK)
 
 struct fw_hdr {
         u8 ver;
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index a0b418e007a0..566b17db135a 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -1994,7 +1994,7 @@ static void xmit_common(struct sk_buff *skb, struct ehea_swqe *swqe)
 {
         swqe->tx_control |= EHEA_SWQE_IMM_DATA_PRESENT | EHEA_SWQE_CRC;
 
-        if (skb->protocol != htons(ETH_P_IP))
+        if (vlan_get_protocol(skb) != htons(ETH_P_IP))
                 return;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL)
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index cbc330b301cd..ad3d5d12173f 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -2674,7 +2674,8 @@ set_itr_now:
 #define E1000_TX_FLAGS_VLAN_SHIFT       16
 
 static int e1000_tso(struct e1000_adapter *adapter,
-                     struct e1000_tx_ring *tx_ring, struct sk_buff *skb)
+                     struct e1000_tx_ring *tx_ring, struct sk_buff *skb,
+                     __be16 protocol)
 {
         struct e1000_context_desc *context_desc;
         struct e1000_buffer *buffer_info;
@@ -2692,7 +2693,7 @@ static int e1000_tso(struct e1000_adapter *adapter,
 
                 hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 mss = skb_shinfo(skb)->gso_size;
-                if (skb->protocol == htons(ETH_P_IP)) {
+                if (protocol == htons(ETH_P_IP)) {
                         struct iphdr *iph = ip_hdr(skb);
                         iph->tot_len = 0;
                         iph->check = 0;
@@ -2702,7 +2703,7 @@ static int e1000_tso(struct e1000_adapter *adapter,
                                                                  0);
                         cmd_length = E1000_TXD_CMD_IP;
                         ipcse = skb_transport_offset(skb) - 1;
-                } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                } else if (skb_is_gso_v6(skb)) {
                         ipv6_hdr(skb)->payload_len = 0;
                         tcp_hdr(skb)->check =
                                 ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
@@ -2745,7 +2746,8 @@ static int e1000_tso(struct e1000_adapter *adapter,
 }
 
 static bool e1000_tx_csum(struct e1000_adapter *adapter,
-                          struct e1000_tx_ring *tx_ring, struct sk_buff *skb)
+                          struct e1000_tx_ring *tx_ring, struct sk_buff *skb,
+                          __be16 protocol)
 {
         struct e1000_context_desc *context_desc;
         struct e1000_buffer *buffer_info;
@@ -2756,7 +2758,7 @@ static bool e1000_tx_csum(struct e1000_adapter *adapter,
         if (skb->ip_summed != CHECKSUM_PARTIAL)
                 return false;
 
-        switch (skb->protocol) {
+        switch (protocol) {
         case cpu_to_be16(ETH_P_IP):
                 if (ip_hdr(skb)->protocol == IPPROTO_TCP)
                         cmd_len |= E1000_TXD_CMD_TCP;
@@ -3097,6 +3099,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
         int count = 0;
         int tso;
         unsigned int f;
+        __be16 protocol = vlan_get_protocol(skb);
 
         /* This goes back to the question of how to logically map a Tx queue
          * to a flow.  Right now, performance is impacted slightly negatively
@@ -3210,7 +3213,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
 
         first = tx_ring->next_to_use;
 
-        tso = e1000_tso(adapter, tx_ring, skb);
+        tso = e1000_tso(adapter, tx_ring, skb, protocol);
         if (tso < 0) {
                 dev_kfree_skb_any(skb);
                 return NETDEV_TX_OK;
@@ -3220,10 +3223,10 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                 if (likely(hw->mac_type != e1000_82544))
                         tx_ring->last_tx_tso = true;
                 tx_flags |= E1000_TX_FLAGS_TSO;
-        } else if (likely(e1000_tx_csum(adapter, tx_ring, skb)))
+        } else if (likely(e1000_tx_csum(adapter, tx_ring, skb, protocol)))
                 tx_flags |= E1000_TX_FLAGS_CSUM;
 
-        if (likely(skb->protocol == htons(ETH_P_IP)))
+        if (protocol == htons(ETH_P_IP))
                 tx_flags |= E1000_TX_FLAGS_IPV4;
 
         if (unlikely(skb->no_fcs))
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 65c3aef2bd36..247335d2c7ec 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -5164,7 +5164,8 @@ link_up:
 #define E1000_TX_FLAGS_VLAN_MASK        0xffff0000
 #define E1000_TX_FLAGS_VLAN_SHIFT       16
 
-static int e1000_tso(struct e1000_ring *tx_ring, struct sk_buff *skb)
+static int e1000_tso(struct e1000_ring *tx_ring, struct sk_buff *skb,
+                     __be16 protocol)
 {
         struct e1000_context_desc *context_desc;
         struct e1000_buffer *buffer_info;
@@ -5183,7 +5184,7 @@ static int e1000_tso(struct e1000_ring *tx_ring, struct sk_buff *skb)
 
         hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
         mss = skb_shinfo(skb)->gso_size;
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (protocol == htons(ETH_P_IP)) {
                 struct iphdr *iph = ip_hdr(skb);
                 iph->tot_len = 0;
                 iph->check = 0;
@@ -5231,7 +5232,8 @@ static int e1000_tso(struct e1000_ring *tx_ring, struct sk_buff *skb)
         return 1;
 }
 
-static bool e1000_tx_csum(struct e1000_ring *tx_ring, struct sk_buff *skb)
+static bool e1000_tx_csum(struct e1000_ring *tx_ring, struct sk_buff *skb,
+                          __be16 protocol)
 {
         struct e1000_adapter *adapter = tx_ring->adapter;
         struct e1000_context_desc *context_desc;
@@ -5239,16 +5241,10 @@ static bool e1000_tx_csum(struct e1000_ring *tx_ring, struct sk_buff *skb)
         unsigned int i;
         u8 css;
         u32 cmd_len = E1000_TXD_CMD_DEXT;
-        __be16 protocol;
 
         if (skb->ip_summed != CHECKSUM_PARTIAL)
                 return false;
 
-        if (skb->protocol == cpu_to_be16(ETH_P_8021Q))
-                protocol = vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
-        else
-                protocol = skb->protocol;
-
         switch (protocol) {
         case cpu_to_be16(ETH_P_IP):
                 if (ip_hdr(skb)->protocol == IPPROTO_TCP)
@@ -5546,6 +5542,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
         int count = 0;
         int tso;
         unsigned int f;
+        __be16 protocol = vlan_get_protocol(skb);
 
         if (test_bit(__E1000_DOWN, &adapter->state)) {
                 dev_kfree_skb_any(skb);
@@ -5620,7 +5617,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
 
         first = tx_ring->next_to_use;
 
-        tso = e1000_tso(tx_ring, skb);
+        tso = e1000_tso(tx_ring, skb, protocol);
         if (tso < 0) {
                 dev_kfree_skb_any(skb);
                 return NETDEV_TX_OK;
@@ -5628,14 +5625,14 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
 
         if (tso)
                 tx_flags |= E1000_TX_FLAGS_TSO;
-        else if (e1000_tx_csum(tx_ring, skb))
+        else if (e1000_tx_csum(tx_ring, skb, protocol))
                 tx_flags |= E1000_TX_FLAGS_CSUM;
 
         /* Old method was to assume IPv4 packet by default if TSO was enabled.
          * 82571 hardware supports TSO capabilities for IPv6 as well...
          * no longer assume, we must.
          */
-        if (skb->protocol == htons(ETH_P_IP))
+        if (protocol == htons(ETH_P_IP))
                 tx_flags |= E1000_TX_FLAGS_IPV4;
 
         if (unlikely(skb->no_fcs))
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index b60f16381229..be039dd6114d 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2323,7 +2323,7 @@ static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
                 goto out_drop;
 
         /* obtain protocol of skb */
-        protocol = skb->protocol;
+        protocol = vlan_get_protocol(skb);
 
         /* record the location of the first descriptor for this packet */
         first = &tx_ring->tx_bi[tx_ring->next_to_use];
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index 50cf5b8d0e15..04c7c1557a0c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1599,7 +1599,7 @@ static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
                 goto out_drop;
 
         /* obtain protocol of skb */
-        protocol = skb->protocol;
+        protocol = vlan_get_protocol(skb);
 
         /* record the location of the first descriptor for this packet */
         first = &tx_ring->tx_bi[tx_ring->next_to_use];
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index c9f1d1b7ef37..ade067de1689 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -20,6 +20,7 @@
 #include <linux/mbus.h>
 #include <linux/module.h>
 #include <linux/interrupt.h>
+#include <linux/if_vlan.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <linux/io.h>
@@ -1371,15 +1372,16 @@ static u32 mvneta_skb_tx_csum(struct mvneta_port *pp, struct sk_buff *skb)
 {
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 int ip_hdr_len = 0;
+                __be16 l3_proto = vlan_get_protocol(skb);
                 u8 l4_proto;
 
-                if (skb->protocol == htons(ETH_P_IP)) {
+                if (l3_proto == htons(ETH_P_IP)) {
                         struct iphdr *ip4h = ip_hdr(skb);
 
                         /* Calculate IPv4 checksum and L4 checksum */
                         ip_hdr_len = ip4h->ihl;
                         l4_proto = ip4h->protocol;
-                } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                } else if (l3_proto == htons(ETH_P_IPV6)) {
                         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 
                         /* Read l4_protocol from one of IPv6 extra headers */
@@ -1390,7 +1392,7 @@ static u32 mvneta_skb_tx_csum(struct mvneta_port *pp, struct sk_buff *skb)
                         return MVNETA_TX_L4_CSUM_NOT;
 
                 return mvneta_txq_desc_csum(skb_network_offset(skb),
-                                skb->protocol, ip_hdr_len, l4_proto);
+                                            l3_proto, ip_hdr_len, l4_proto);
         }
 
         return MVNETA_TX_L4_CSUM_NOT;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index bb536aa613f4..abddcf8c40aa 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -474,39 +474,12 @@ static int mlx4_en_tunnel_steer_add(struct mlx4_en_priv *priv, unsigned char *ad
                                     int qpn, u64 *reg_id)
 {
         int err;
-        struct mlx4_spec_list spec_eth_outer = { {NULL} };
-        struct mlx4_spec_list spec_vxlan     = { {NULL} };
-        struct mlx4_spec_list spec_eth_inner = { {NULL} };
-
-        struct mlx4_net_trans_rule rule = {
-                .queue_mode = MLX4_NET_TRANS_Q_FIFO,
-                .exclusive = 0,
-                .allow_loopback = 1,
-                .promisc_mode = MLX4_FS_REGULAR,
-                .priority = MLX4_DOMAIN_NIC,
-        };
-
-        __be64 mac_mask = cpu_to_be64(MLX4_MAC_MASK << 16);
 
         if (priv->mdev->dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 return 0; /* do nothing */
 
-        rule.port = priv->port;
-        rule.qpn = qpn;
-        INIT_LIST_HEAD(&rule.list);
-
-        spec_eth_outer.id = MLX4_NET_TRANS_RULE_ID_ETH;
-        memcpy(spec_eth_outer.eth.dst_mac, addr, ETH_ALEN);
-        memcpy(spec_eth_outer.eth.dst_mac_msk, &mac_mask, ETH_ALEN);
-
-        spec_vxlan.id = MLX4_NET_TRANS_RULE_ID_VXLAN;    /* any vxlan header */
-        spec_eth_inner.id = MLX4_NET_TRANS_RULE_ID_ETH;  /* any inner eth header */
-
-        list_add_tail(&spec_eth_outer.list, &rule.list);
-        list_add_tail(&spec_vxlan.list,     &rule.list);
-        list_add_tail(&spec_eth_inner.list, &rule.list);
-
-        err = mlx4_flow_attach(priv->mdev->dev, &rule, reg_id);
+        err = mlx4_tunnel_steer_add(priv->mdev->dev, addr, priv->port, qpn,
+                                    MLX4_DOMAIN_NIC, reg_id);
         if (err) {
                 en_err(priv, "failed to add vxlan steering rule, err %d\n", err);
                 return err;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index d80e7a6fac74..ca0f98c95105 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -1020,6 +1020,44 @@ int mlx4_flow_detach(struct mlx4_dev *dev, u64 reg_id)
 }
 EXPORT_SYMBOL_GPL(mlx4_flow_detach);
 
+int mlx4_tunnel_steer_add(struct mlx4_dev *dev, unsigned char *addr,
+                          int port, int qpn, u16 prio, u64 *reg_id)
+{
+        int err;
+        struct mlx4_spec_list spec_eth_outer = { {NULL} };
+        struct mlx4_spec_list spec_vxlan     = { {NULL} };
+        struct mlx4_spec_list spec_eth_inner = { {NULL} };
+
+        struct mlx4_net_trans_rule rule = {
+                .queue_mode = MLX4_NET_TRANS_Q_FIFO,
+                .exclusive = 0,
+                .allow_loopback = 1,
+                .promisc_mode = MLX4_FS_REGULAR,
+        };
+
+        __be64 mac_mask = cpu_to_be64(MLX4_MAC_MASK << 16);
+
+        rule.port = port;
+        rule.qpn = qpn;
+        rule.priority = prio;
+        INIT_LIST_HEAD(&rule.list);
+
+        spec_eth_outer.id = MLX4_NET_TRANS_RULE_ID_ETH;
+        memcpy(spec_eth_outer.eth.dst_mac, addr, ETH_ALEN);
+        memcpy(spec_eth_outer.eth.dst_mac_msk, &mac_mask, ETH_ALEN);
+
+        spec_vxlan.id = MLX4_NET_TRANS_RULE_ID_VXLAN;    /* any vxlan header */
+        spec_eth_inner.id = MLX4_NET_TRANS_RULE_ID_ETH;  /* any inner eth header */
+
+        list_add_tail(&spec_eth_outer.list, &rule.list);
+        list_add_tail(&spec_vxlan.list,     &rule.list);
+        list_add_tail(&spec_eth_inner.list, &rule.list);
+
+        err = mlx4_flow_attach(dev, &rule, reg_id);
+        return err;
+}
+EXPORT_SYMBOL(mlx4_tunnel_steer_add);
+
 int mlx4_FLOW_STEERING_IB_UC_QP_RANGE(struct mlx4_dev *dev, u32 min_range_qpn,
                                       u32 max_range_qpn)
 {
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 5020fd47825d..2f12c88c66ab 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -206,7 +206,7 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
         int rx_head = priv->rx_head;
         int rx = 0;
 
-        while (1) {
+        while (rx < budget) {
                 desc = priv->rx_desc_base + (RX_REG_DESC_SIZE * rx_head);
                 desc0 = readl(desc + RX_REG_OFFSET_DESC0);
 
@@ -218,7 +218,7 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
                         net_dbg_ratelimited("packet error\n");
                         priv->stats.rx_dropped++;
                         priv->stats.rx_errors++;
-                        continue;
+                        goto rx_next;
                 }
 
                 len = desc0 & RX_DESC0_FRAME_LEN_MASK;
@@ -226,13 +226,19 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
                 if (len > RX_BUF_SIZE)
                         len = RX_BUF_SIZE;
 
-                skb = build_skb(priv->rx_buf[rx_head], priv->rx_buf_size);
+                dma_sync_single_for_cpu(&ndev->dev,
+                                        priv->rx_mapping[rx_head],
+                                        priv->rx_buf_size, DMA_FROM_DEVICE);
+                skb = netdev_alloc_skb_ip_align(ndev, len);
+
                 if (unlikely(!skb)) {
-                        net_dbg_ratelimited("build_skb failed\n");
+                        net_dbg_ratelimited("netdev_alloc_skb_ip_align failed\n");
                         priv->stats.rx_dropped++;
                         priv->stats.rx_errors++;
+                        goto rx_next;
                 }
 
+                memcpy(skb->data, priv->rx_buf[rx_head], len);
                 skb_put(skb, len);
                 skb->protocol = eth_type_trans(skb, ndev);
                 napi_gro_receive(&priv->napi, skb);
@@ -244,18 +250,15 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
                 if (desc0 & RX_DESC0_MULTICAST)
                         priv->stats.multicast++;
 
+rx_next:
                 writel(RX_DESC0_DMA_OWN, desc + RX_REG_OFFSET_DESC0);
 
                 rx_head = RX_NEXT(rx_head);
                 priv->rx_head = rx_head;
-
-                if (rx >= budget)
-                        break;
         }
 
         if (rx < budget) {
-                napi_gro_flush(napi, false);
-                __napi_complete(napi);
+                napi_complete(napi);
         }
 
         priv->reg_imr |= RPKT_FINISH_M;
@@ -346,10 +349,12 @@ static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 len = ETH_ZLEN;
         }
 
-        txdes1 = readl(desc + TX_REG_OFFSET_DESC1);
-        txdes1 |= TX_DESC1_LTS | TX_DESC1_FTS;
-        txdes1 &= ~(TX_DESC1_FIFO_COMPLETE | TX_DESC1_INTR_COMPLETE);
-        txdes1 |= (len & TX_DESC1_BUF_SIZE_MASK);
+        dma_sync_single_for_device(&ndev->dev, priv->tx_mapping[tx_head],
+                                   priv->tx_buf_size, DMA_TO_DEVICE);
+
+        txdes1 = TX_DESC1_LTS | TX_DESC1_FTS | (len & TX_DESC1_BUF_SIZE_MASK);
+        if (tx_head == TX_DESC_NUM_MASK)
+                txdes1 |= TX_DESC1_END;
         writel(txdes1, desc + TX_REG_OFFSET_DESC1);
         writel(TX_DESC0_DMA_OWN, desc + TX_REG_OFFSET_DESC0);
 
@@ -465,8 +470,7 @@ static int moxart_mac_probe(struct platform_device *pdev)
         spin_lock_init(&priv->txlock);
 
         priv->tx_buf_size = TX_BUF_SIZE;
-        priv->rx_buf_size = RX_BUF_SIZE +
-                            SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        priv->rx_buf_size = RX_BUF_SIZE;
 
         priv->tx_desc_base = dma_alloc_coherent(NULL, TX_REG_DESC_SIZE *
                                                 TX_DESC_NUM, &priv->tx_base,
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 8706c0dbd0c3..a44a03c45014 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -1220,6 +1220,9 @@ static int lpc_eth_open(struct net_device *ndev)
 
         __lpc_eth_clock_enable(pldat, true);
 
+        /* Suspended PHY makes LPC ethernet core block, so resume now */
+        phy_resume(pldat->phy_dev);
+
         /* Reset and initialize */
         __lpc_eth_reset(pldat);
         __lpc_eth_init(pldat);
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 188626e2a861..3e96f269150d 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2556,6 +2556,7 @@ static int ql_tso(struct sk_buff *skb, struct ob_mac_tso_iocb_req *mac_iocb_ptr)
 
         if (skb_is_gso(skb)) {
                 int err;
+                __be16 l3_proto = vlan_get_protocol(skb);
 
                 err = skb_cow_head(skb, 0);
                 if (err < 0)
@@ -2572,7 +2573,7 @@ static int ql_tso(struct sk_buff *skb, struct ob_mac_tso_iocb_req *mac_iocb_ptr)
                                 << OB_MAC_TRANSPORT_HDR_SHIFT);
                 mac_iocb_ptr->mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
                 mac_iocb_ptr->flags2 |= OB_MAC_TSO_IOCB_LSO;
-                if (likely(skb->protocol == htons(ETH_P_IP))) {
+                if (likely(l3_proto == htons(ETH_P_IP))) {
                         struct iphdr *iph = ip_hdr(skb);
                         iph->check = 0;
                         mac_iocb_ptr->flags1 |= OB_MAC_TSO_IOCB_IP4;
@@ -2580,7 +2581,7 @@ static int ql_tso(struct sk_buff *skb, struct ob_mac_tso_iocb_req *mac_iocb_ptr)
                                                                  iph->daddr, 0,
                                                                  IPPROTO_TCP,
                                                                  0);
-                } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                } else if (l3_proto == htons(ETH_P_IPV6)) {
                         mac_iocb_ptr->flags1 |= OB_MAC_TSO_IOCB_IP6;
                         tcp_hdr(skb)->check =
                             ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
diff --git a/drivers/net/ethernet/renesas/Kconfig b/drivers/net/ethernet/renesas/Kconfig
index 9e757c792d84..196e98a2d93b 100644
--- a/drivers/net/ethernet/renesas/Kconfig
+++ b/drivers/net/ethernet/renesas/Kconfig
@@ -5,6 +5,7 @@
 config SH_ETH
         tristate "Renesas SuperH Ethernet support"
         depends on HAS_DMA
+        depends on ARCH_SHMOBILE || SUPERH || COMPILE_TEST
         select CRC32
         select MII
         select MDIO_BITBANG
diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index c553f6b5a913..cf28daba4346 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -28,7 +28,7 @@
 
 #include "stmmac.h"
 
-static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
+static int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
 {
         struct stmmac_priv *priv = (struct stmmac_priv *)p;
         unsigned int txsize = priv->dma_tx_size;
@@ -47,7 +47,9 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
 
         desc->des2 = dma_map_single(priv->device, skb->data,
                                     bmax, DMA_TO_DEVICE);
-        priv->tx_skbuff_dma[entry] = desc->des2;
+        if (dma_mapping_error(priv->device, desc->des2))
+                return -1;
+        priv->tx_skbuff_dma[entry].buf = desc->des2;
         priv->hw->desc->prepare_tx_desc(desc, 1, bmax, csum, STMMAC_CHAIN_MODE);
 
         while (len != 0) {
@@ -59,7 +61,9 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                         desc->des2 = dma_map_single(priv->device,
                                                     (skb->data + bmax * i),
                                                     bmax, DMA_TO_DEVICE);
-                        priv->tx_skbuff_dma[entry] = desc->des2;
+                        if (dma_mapping_error(priv->device, desc->des2))
+                                return -1;
+                        priv->tx_skbuff_dma[entry].buf = desc->des2;
                         priv->hw->desc->prepare_tx_desc(desc, 0, bmax, csum,
                                                         STMMAC_CHAIN_MODE);
                         priv->hw->desc->set_tx_owner(desc);
@@ -69,7 +73,9 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                         desc->des2 = dma_map_single(priv->device,
                                                     (skb->data + bmax * i), len,
                                                     DMA_TO_DEVICE);
-                        priv->tx_skbuff_dma[entry] = desc->des2;
+                        if (dma_mapping_error(priv->device, desc->des2))
+                                return -1;
+                        priv->tx_skbuff_dma[entry].buf = desc->des2;
                         priv->hw->desc->prepare_tx_desc(desc, 0, len, csum,
                                                         STMMAC_CHAIN_MODE);
                         priv->hw->desc->set_tx_owner(desc);
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index de507c32036c..593e6c4144a7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -220,10 +220,10 @@ enum dma_irq_status {
         handle_tx = 0x8,
 };
 
-#define CORE_IRQ_TX_PATH_IN_LPI_MODE    (1 << 1)
-#define CORE_IRQ_TX_PATH_EXIT_LPI_MODE  (1 << 2)
-#define CORE_IRQ_RX_PATH_IN_LPI_MODE    (1 << 3)
-#define CORE_IRQ_RX_PATH_EXIT_LPI_MODE  (1 << 4)
+#define CORE_IRQ_TX_PATH_IN_LPI_MODE    (1 << 0)
+#define CORE_IRQ_TX_PATH_EXIT_LPI_MODE  (1 << 1)
+#define CORE_IRQ_RX_PATH_IN_LPI_MODE    (1 << 2)
+#define CORE_IRQ_RX_PATH_EXIT_LPI_MODE  (1 << 3)
 
 #define CORE_PCS_ANE_COMPLETE           (1 << 5)
 #define CORE_PCS_LINK_STATUS            (1 << 6)
@@ -287,7 +287,7 @@ struct dma_features {
 
 /* Default LPI timers */
 #define STMMAC_DEFAULT_LIT_LS   0x3E8
-#define STMMAC_DEFAULT_TWT_LS   0x0
+#define STMMAC_DEFAULT_TWT_LS   0x1E
 
 #define STMMAC_CHAIN_MODE       0x1
 #define STMMAC_RING_MODE        0x2
@@ -425,7 +425,7 @@ struct stmmac_mode_ops {
         void (*init) (void *des, dma_addr_t phy_addr, unsigned int size,
                       unsigned int extend_desc);
         unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
-        unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
+        int (*jumbo_frm)(void *priv, struct sk_buff *skb, int csum);
         int (*set_16kib_bfsize)(int mtu);
         void (*init_desc3)(struct dma_desc *p);
         void (*refill_desc3) (void *priv, struct dma_desc *p);
@@ -445,6 +445,7 @@ struct mac_device_info {
         int multicast_filter_bins;
         int unicast_filter_entries;
         int mcast_bits_log2;
+        unsigned int rx_csum;
 };
 
 struct mac_device_info *dwmac1000_setup(void __iomem *ioaddr, int mcbins,
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
index 71b5419256c1..64d8f56a9c17 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
@@ -153,7 +153,7 @@ enum inter_frame_gap {
 #define GMAC_CONTROL_RE         0x00000004      /* Receiver Enable */
 
 #define GMAC_CORE_INIT (GMAC_CONTROL_JD | GMAC_CONTROL_PS | GMAC_CONTROL_ACS | \
-                        GMAC_CONTROL_BE)
+                        GMAC_CONTROL_BE | GMAC_CONTROL_DCRS)
 
 /* GMAC Frame Filter defines */
 #define GMAC_FRAME_FILTER_PR    0x00000001      /* Promiscuous Mode */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index d8ef18786a1c..5efe60ea6526 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -58,7 +58,11 @@ static int dwmac1000_rx_ipc_enable(struct mac_device_info *hw)
         void __iomem *ioaddr = hw->pcsr;
         u32 value = readl(ioaddr + GMAC_CONTROL);
 
-        value |= GMAC_CONTROL_IPC;
+        if (hw->rx_csum)
+                value |= GMAC_CONTROL_IPC;
+        else
+                value &= ~GMAC_CONTROL_IPC;
+
         writel(value, ioaddr + GMAC_CONTROL);
 
         value = readl(ioaddr + GMAC_CONTROL);
diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc.h b/drivers/net/ethernet/stmicro/stmmac/mmc.h
index 8607488cbcfc..192c2491330b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc.h
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc.h
@@ -68,7 +68,7 @@ struct stmmac_counters {
         unsigned int mmc_rx_octetcount_g;
         unsigned int mmc_rx_broadcastframe_g;
         unsigned int mmc_rx_multicastframe_g;
-        unsigned int mmc_rx_crc_errror;
+        unsigned int mmc_rx_crc_error;
         unsigned int mmc_rx_align_error;
         unsigned int mmc_rx_run_error;
         unsigned int mmc_rx_jabber_error;
diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
index 50617c5a0bdb..08c483bd2ec7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
@@ -196,7 +196,7 @@ void dwmac_mmc_read(void __iomem *ioaddr, struct stmmac_counters *mmc)
         mmc->mmc_rx_octetcount_g += readl(ioaddr + MMC_RX_OCTETCOUNT_G);
         mmc->mmc_rx_broadcastframe_g += readl(ioaddr + MMC_RX_BROADCASTFRAME_G);
         mmc->mmc_rx_multicastframe_g += readl(ioaddr + MMC_RX_MULTICASTFRAME_G);
-        mmc->mmc_rx_crc_errror += readl(ioaddr + MMC_RX_CRC_ERRROR);
+        mmc->mmc_rx_crc_error += readl(ioaddr + MMC_RX_CRC_ERRROR);
         mmc->mmc_rx_align_error += readl(ioaddr + MMC_RX_ALIGN_ERROR);
         mmc->mmc_rx_run_error += readl(ioaddr + MMC_RX_RUN_ERROR);
         mmc->mmc_rx_jabber_error += readl(ioaddr + MMC_RX_JABBER_ERROR);
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index 650a4be6bce5..5dd50c6cda5b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -28,7 +28,7 @@
 
 #include "stmmac.h"
 
-static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
+static int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
 {
         struct stmmac_priv *priv = (struct stmmac_priv *)p;
         unsigned int txsize = priv->dma_tx_size;
@@ -53,7 +53,10 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
 
                 desc->des2 = dma_map_single(priv->device, skb->data,
                                             bmax, DMA_TO_DEVICE);
-                priv->tx_skbuff_dma[entry] = desc->des2;
+                if (dma_mapping_error(priv->device, desc->des2))
+                        return -1;
+
+                priv->tx_skbuff_dma[entry].buf = desc->des2;
                 desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                 priv->hw->desc->prepare_tx_desc(desc, 1, bmax, csum,
                                                 STMMAC_RING_MODE);
@@ -68,7 +71,9 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
 
                 desc->des2 = dma_map_single(priv->device, skb->data + bmax,
                                             len, DMA_TO_DEVICE);
-                priv->tx_skbuff_dma[entry] = desc->des2;
+                if (dma_mapping_error(priv->device, desc->des2))
+                        return -1;
+                priv->tx_skbuff_dma[entry].buf = desc->des2;
                 desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                 priv->hw->desc->prepare_tx_desc(desc, 0, len, csum,
                                                 STMMAC_RING_MODE);
@@ -77,7 +82,9 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
         } else {
                 desc->des2 = dma_map_single(priv->device, skb->data,
                                             nopaged_len, DMA_TO_DEVICE);
-                priv->tx_skbuff_dma[entry] = desc->des2;
+                if (dma_mapping_error(priv->device, desc->des2))
+                        return -1;
+                priv->tx_skbuff_dma[entry].buf = desc->des2;
                 desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                 priv->hw->desc->prepare_tx_desc(desc, 1, nopaged_len, csum,
                                                 STMMAC_RING_MODE);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index ca01035634a7..58097c0e2ad5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -34,6 +34,11 @@
 #include <linux/ptp_clock_kernel.h>
 #include <linux/reset.h>
 
+struct stmmac_tx_info {
+        dma_addr_t buf;
+        bool map_as_page;
+};
+
 struct stmmac_priv {
         /* Frequently used values are kept adjacent for cache effect */
         struct dma_extended_desc *dma_etx ____cacheline_aligned_in_smp;
@@ -45,7 +50,7 @@ struct stmmac_priv {
         u32 tx_count_frames;
         u32 tx_coal_frames;
         u32 tx_coal_timer;
-        dma_addr_t *tx_skbuff_dma;
+        struct stmmac_tx_info *tx_skbuff_dma;
         dma_addr_t dma_tx_phy;
         int tx_coalesce;
         int hwts_tx_en;
@@ -105,6 +110,8 @@ struct stmmac_priv {
         struct ptp_clock *ptp_clock;
         struct ptp_clock_info ptp_clock_ops;
         unsigned int default_addend;
+        struct clk *clk_ptp_ref;
+        unsigned int clk_ptp_rate;
         u32 adv_ts;
         int use_riwt;
         int irq_wake;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index 493fe693e675..3a08a1f78c73 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -175,7 +175,7 @@ static const struct stmmac_stats stmmac_mmc[] = {
         STMMAC_MMC_STAT(mmc_rx_octetcount_g),
         STMMAC_MMC_STAT(mmc_rx_broadcastframe_g),
         STMMAC_MMC_STAT(mmc_rx_multicastframe_g),
-        STMMAC_MMC_STAT(mmc_rx_crc_errror),
+        STMMAC_MMC_STAT(mmc_rx_crc_error),
         STMMAC_MMC_STAT(mmc_rx_align_error),
         STMMAC_MMC_STAT(mmc_rx_run_error),
         STMMAC_MMC_STAT(mmc_rx_jabber_error),
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8fcc64c37ff1..9dbb02d9d9c2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -275,6 +275,7 @@ static void stmmac_eee_ctrl_timer(unsigned long arg)
  */
 bool stmmac_eee_init(struct stmmac_priv *priv)
 {
+        char *phy_bus_name = priv->plat->phy_bus_name;
         bool ret = false;
 
         /* Using PCS we cannot dial with the phy registers at this stage
@@ -284,6 +285,10 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
             (priv->pcs == STMMAC_PCS_RTBI))
                 goto out;
 
+        /* Never init EEE in case of a switch is attached */
+        if (phy_bus_name && (!strcmp(phy_bus_name, "fixed")))
+                goto out;
+
         /* MAC core supports the EEE feature. */
         if (priv->dma_cap.eee) {
                 int tx_lpi_timer = priv->tx_lpi_timer;
@@ -316,10 +321,9 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                         priv->hw->mac->set_eee_timer(priv->hw,
                                                      STMMAC_DEFAULT_LIT_LS,
                                                      tx_lpi_timer);
-                } else
-                        /* Set HW EEE according to the speed */
-                        priv->hw->mac->set_eee_pls(priv->hw,
-                                                   priv->phydev->link);
+                }
+                /* Set HW EEE according to the speed */
+                priv->hw->mac->set_eee_pls(priv->hw, priv->phydev->link);
 
                 pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
 
@@ -603,16 +607,16 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                 /* calculate default added value:
                  * formula is :
                  * addend = (2^32)/freq_div_ratio;
-                 * where, freq_div_ratio = STMMAC_SYSCLOCK/50MHz
-                 * hence, addend = ((2^32) * 50MHz)/STMMAC_SYSCLOCK;
-                 * NOTE: STMMAC_SYSCLOCK should be >= 50MHz to
+                 * where, freq_div_ratio = clk_ptp_ref_i/50MHz
+                 * hence, addend = ((2^32) * 50MHz)/clk_ptp_ref_i;
+                 * NOTE: clk_ptp_ref_i should be >= 50MHz to
                  *       achive 20ns accuracy.
                  *
                  * 2^x * y == (y << x), hence
                  * 2^32 * 50000000 ==> (50000000 << 32)
                  */
                 temp = (u64) (50000000ULL << 32);
-                priv->default_addend = div_u64(temp, STMMAC_SYSCLOCK);
+                priv->default_addend = div_u64(temp, priv->clk_ptp_rate);
                 priv->hw->ptp->config_addend(priv->ioaddr,
                                              priv->default_addend);
 
@@ -638,6 +642,16 @@ static int stmmac_init_ptp(struct stmmac_priv *priv)
         if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
                 return -EOPNOTSUPP;
 
+        /* Fall-back to main clock in case of no PTP ref is passed */
+        priv->clk_ptp_ref = devm_clk_get(priv->device, "clk_ptp_ref");
+        if (IS_ERR(priv->clk_ptp_ref)) {
+                priv->clk_ptp_rate = clk_get_rate(priv->stmmac_clk);
+                priv->clk_ptp_ref = NULL;
+        } else {
+                clk_prepare_enable(priv->clk_ptp_ref);
+                priv->clk_ptp_rate = clk_get_rate(priv->clk_ptp_ref);
+        }
+
         priv->adv_ts = 0;
         if (priv->dma_cap.atime_stamp && priv->extend_desc)
                 priv->adv_ts = 1;
@@ -657,6 +671,8 @@ static int stmmac_init_ptp(struct stmmac_priv *priv)
 
 static void stmmac_release_ptp(struct stmmac_priv *priv)
 {
+        if (priv->clk_ptp_ref)
+                clk_disable_unprepare(priv->clk_ptp_ref);
         stmmac_ptp_unregister(priv);
 }
 
@@ -1061,7 +1077,8 @@ static int init_dma_desc_rings(struct net_device *dev)
                 else
                         p = priv->dma_tx + i;
                 p->des2 = 0;
-                priv->tx_skbuff_dma[i] = 0;
+                priv->tx_skbuff_dma[i].buf = 0;
+                priv->tx_skbuff_dma[i].map_as_page = false;
                 priv->tx_skbuff[i] = NULL;
         }
 
@@ -1100,17 +1117,24 @@ static void dma_free_tx_skbufs(struct stmmac_priv *priv)
                 else
                         p = priv->dma_tx + i;
 
-                if (priv->tx_skbuff_dma[i]) {
-                        dma_unmap_single(priv->device,
-                                         priv->tx_skbuff_dma[i],
-                                         priv->hw->desc->get_tx_len(p),
-                                         DMA_TO_DEVICE);
-                        priv->tx_skbuff_dma[i] = 0;
+                if (priv->tx_skbuff_dma[i].buf) {
+                        if (priv->tx_skbuff_dma[i].map_as_page)
+                                dma_unmap_page(priv->device,
+                                               priv->tx_skbuff_dma[i].buf,
+                                               priv->hw->desc->get_tx_len(p),
+                                               DMA_TO_DEVICE);
+                        else
+                                dma_unmap_single(priv->device,
+                                                 priv->tx_skbuff_dma[i].buf,
+                                                 priv->hw->desc->get_tx_len(p),
+                                                 DMA_TO_DEVICE);
                 }
 
                 if (priv->tx_skbuff[i] != NULL) {
                         dev_kfree_skb_any(priv->tx_skbuff[i]);
                         priv->tx_skbuff[i] = NULL;
+                        priv->tx_skbuff_dma[i].buf = 0;
+                        priv->tx_skbuff_dma[i].map_as_page = false;
                 }
         }
 }
@@ -1131,7 +1155,8 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv)
         if (!priv->rx_skbuff)
                 goto err_rx_skbuff;
 
-        priv->tx_skbuff_dma = kmalloc_array(txsize, sizeof(dma_addr_t),
+        priv->tx_skbuff_dma = kmalloc_array(txsize,
+                                            sizeof(*priv->tx_skbuff_dma),
                                             GFP_KERNEL);
         if (!priv->tx_skbuff_dma)
                 goto err_tx_skbuff_dma;
@@ -1293,12 +1318,19 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
                         pr_debug("%s: curr %d, dirty %d\n", __func__,
                                  priv->cur_tx, priv->dirty_tx);
 
-                if (likely(priv->tx_skbuff_dma[entry])) {
-                        dma_unmap_single(priv->device,
-                                         priv->tx_skbuff_dma[entry],
-                                         priv->hw->desc->get_tx_len(p),
-                                         DMA_TO_DEVICE);
-                        priv->tx_skbuff_dma[entry] = 0;
+                if (likely(priv->tx_skbuff_dma[entry].buf)) {
+                        if (priv->tx_skbuff_dma[entry].map_as_page)
+                                dma_unmap_page(priv->device,
+                                               priv->tx_skbuff_dma[entry].buf,
+                                               priv->hw->desc->get_tx_len(p),
+                                               DMA_TO_DEVICE);
+                        else
+                                dma_unmap_single(priv->device,
+                                                 priv->tx_skbuff_dma[entry].buf,
+                                                 priv->hw->desc->get_tx_len(p),
+                                                 DMA_TO_DEVICE);
+                        priv->tx_skbuff_dma[entry].buf = 0;
+                        priv->tx_skbuff_dma[entry].map_as_page = false;
                 }
                 priv->hw->mode->clean_desc3(priv, p);
 
@@ -1637,6 +1669,13 @@ static int stmmac_hw_setup(struct net_device *dev)
         /* Initialize the MAC Core */
         priv->hw->mac->core_init(priv->hw, dev->mtu);
 
+        ret = priv->hw->mac->rx_ipc(priv->hw);
+        if (!ret) {
+                pr_warn(" RX IPC Checksum Offload disabled\n");
+                priv->plat->rx_coe = STMMAC_RX_COE_NONE;
+                priv->hw->rx_csum = 0;
+        }
+
         /* Enable the MAC Rx/Tx */
         stmmac_set_mac(priv->ioaddr, true);
 
@@ -1887,12 +1926,16 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         if (likely(!is_jumbo)) {
                 desc->des2 = dma_map_single(priv->device, skb->data,
                                             nopaged_len, DMA_TO_DEVICE);
-                priv->tx_skbuff_dma[entry] = desc->des2;
+                if (dma_mapping_error(priv->device, desc->des2))
+                        goto dma_map_err;
+                priv->tx_skbuff_dma[entry].buf = desc->des2;
                 priv->hw->desc->prepare_tx_desc(desc, 1, nopaged_len,
                                                 csum_insertion, priv->mode);
         } else {
                 desc = first;
                 entry = priv->hw->mode->jumbo_frm(priv, skb, csum_insertion);
+                if (unlikely(entry < 0))
+                        goto dma_map_err;
         }
 
         for (i = 0; i < nfrags; i++) {
@@ -1908,7 +1951,11 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 desc->des2 = skb_frag_dma_map(priv->device, frag, 0, len,
                                               DMA_TO_DEVICE);
-                priv->tx_skbuff_dma[entry] = desc->des2;
+                if (dma_mapping_error(priv->device, desc->des2))
+                        goto dma_map_err; /* should reuse desc w/o issues */
+
+                priv->tx_skbuff_dma[entry].buf = desc->des2;
+                priv->tx_skbuff_dma[entry].map_as_page = true;
                 priv->hw->desc->prepare_tx_desc(desc, 0, len, csum_insertion,
                                                 priv->mode);
                 wmb();
@@ -1975,7 +2022,12 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         priv->hw->dma->enable_dma_transmission(priv->ioaddr);
 
         spin_unlock(&priv->tx_lock);
+        return NETDEV_TX_OK;
 
+dma_map_err:
+        dev_err(priv->device, "Tx dma map failed\n");
+        dev_kfree_skb(skb);
+        priv->dev->stats.tx_dropped++;
         return NETDEV_TX_OK;
 }
 
@@ -2028,7 +2080,12 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                         priv->rx_skbuff_dma[entry] =
                             dma_map_single(priv->device, skb->data, bfsize,
                                            DMA_FROM_DEVICE);
-
+                        if (dma_mapping_error(priv->device,
+                                              priv->rx_skbuff_dma[entry])) {
+                                dev_err(priv->device, "Rx dma map failed\n");
+                                dev_kfree_skb(skb);
+                                break;
+                        }
                         p->des2 = priv->rx_skbuff_dma[entry];
 
                         priv->hw->mode->refill_desc3(priv, p);
@@ -2055,7 +2112,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
         unsigned int entry = priv->cur_rx % rxsize;
         unsigned int next_entry;
         unsigned int count = 0;
-        int coe = priv->plat->rx_coe;
+        int coe = priv->hw->rx_csum;
 
         if (netif_msg_rx_status(priv)) {
                 pr_debug("%s: descriptor ring:\n", __func__);
@@ -2276,8 +2333,7 @@ static netdev_features_t stmmac_fix_features(struct net_device *dev,
 
         if (priv->plat->rx_coe == STMMAC_RX_COE_NONE)
                 features &= ~NETIF_F_RXCSUM;
-        else if (priv->plat->rx_coe == STMMAC_RX_COE_TYPE1)
-                features &= ~NETIF_F_IPV6_CSUM;
+
         if (!priv->plat->tx_coe)
                 features &= ~NETIF_F_ALL_CSUM;
 
@@ -2292,6 +2348,24 @@ static netdev_features_t stmmac_fix_features(struct net_device *dev,
         return features;
 }
 
+static int stmmac_set_features(struct net_device *netdev,
+                               netdev_features_t features)
+{
+        struct stmmac_priv *priv = netdev_priv(netdev);
+
+        /* Keep the COE Type in case of csum is supporting */
+        if (features & NETIF_F_RXCSUM)
+                priv->hw->rx_csum = priv->plat->rx_coe;
+        else
+                priv->hw->rx_csum = 0;
+        /* No check needed because rx_coe has been set before and it will be
+         * fixed in case of issue.
+         */
+        priv->hw->mac->rx_ipc(priv->hw);
+
+        return 0;
+}
+
 /**
  *  stmmac_interrupt - main ISR
  *  @irq: interrupt number.
@@ -2572,6 +2646,7 @@ static const struct net_device_ops stmmac_netdev_ops = {
         .ndo_stop = stmmac_release,
         .ndo_change_mtu = stmmac_change_mtu,
         .ndo_fix_features = stmmac_fix_features,
+        .ndo_set_features = stmmac_set_features,
         .ndo_set_rx_mode = stmmac_set_rx_mode,
         .ndo_tx_timeout = stmmac_tx_timeout,
         .ndo_do_ioctl = stmmac_ioctl,
@@ -2592,7 +2667,6 @@ static const struct net_device_ops stmmac_netdev_ops = {
  */
 static int stmmac_hw_init(struct stmmac_priv *priv)
 {
-        int ret;
         struct mac_device_info *mac;
 
         /* Identify the MAC HW device */
@@ -2649,15 +2723,11 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
         /* To use alternate (extended) or normal descriptor structures */
         stmmac_selec_desc_mode(priv);
 
-        ret = priv->hw->mac->rx_ipc(priv->hw);
-        if (!ret) {
-                pr_warn(" RX IPC Checksum Offload not configured.\n");
-                priv->plat->rx_coe = STMMAC_RX_COE_NONE;
-        }
-
-        if (priv->plat->rx_coe)
+        if (priv->plat->rx_coe) {
+                priv->hw->rx_csum = priv->plat->rx_coe;
                 pr_info(" RX Checksum Offload Engine supported (type %d)\n",
                         priv->plat->rx_coe);
+        }
         if (priv->plat->tx_coe)
                 pr_info(" TX Checksum insertion supported\n");
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index b7ad3565566c..c5ee79d8a8c5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -206,6 +206,7 @@ void stmmac_ptp_unregister(struct stmmac_priv *priv)
 {
         if (priv->ptp_clock) {
                 ptp_clock_unregister(priv->ptp_clock);
+                priv->ptp_clock = NULL;
                 pr_debug("Removed PTP HW clock successfully on %s\n",
                          priv->dev->name);
         }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
index 3dbc047622fa..4535df37c227 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
@@ -25,8 +25,6 @@
 #ifndef __STMMAC_PTP_H__
 #define __STMMAC_PTP_H__
 
-#define STMMAC_SYSCLOCK 62500000
-
 /* IEEE 1588 PTP register offsets */
 #define PTP_TCR         0x0700  /* Timestamp Control Reg */
 #define PTP_SSIR        0x0704  /* Sub-Second Increment Reg */
diff --git a/drivers/net/fddi/skfp/h/skfbi.h b/drivers/net/fddi/skfp/h/skfbi.h
index c1ba26c06d73..3de2f0d15fe2 100644
--- a/drivers/net/fddi/skfp/h/skfbi.h
+++ b/drivers/net/fddi/skfp/h/skfbi.h
@@ -147,11 +147,6 @@
 #define PCI_MEM64BIT    (2<<1)       /* Base addr anywhere in 64 Bit range */
 #define PCI_MEMSPACE    0x00000001L  /* Bit 0:  Memory Space Indic. */
 
-/*      PCI_BASE_2ND    32 bit  2nd Base address */
-#define PCI_IOBASE      0xffffff00L  /* Bit 31..8:  I/O Base address */
-#define PCI_IOSIZE      0x000000fcL  /* Bit 7..2:   I/O Size Requirements */
-#define PCI_IOSPACE     0x00000001L  /* Bit 0:      I/O Space Indicator */
-
 /*      PCI_SUB_VID     16 bit  Subsystem Vendor ID */
 /*      PCI_SUB_ID      16 bit  Subsystem ID */
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 932190e04d08..1dfffdc9dfc3 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -1040,31 +1040,31 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
                 /* First check if the EEE ability is supported */
                 eee_cap = phy_read_mmd_indirect(phydev, MDIO_PCS_EEE_ABLE,
                                                 MDIO_MMD_PCS, phydev->addr);
-                if (eee_cap < 0)
-                        return eee_cap;
+                if (eee_cap <= 0)
+                        goto eee_exit_err;
 
                 cap = mmd_eee_cap_to_ethtool_sup_t(eee_cap);
                 if (!cap)
-                        return -EPROTONOSUPPORT;
+                        goto eee_exit_err;
 
                 /* Check which link settings negotiated and verify it in
                  * the EEE advertising registers.
                  */
                 eee_lp = phy_read_mmd_indirect(phydev, MDIO_AN_EEE_LPABLE,
                                                MDIO_MMD_AN, phydev->addr);
-                if (eee_lp < 0)
-                        return eee_lp;
+                if (eee_lp <= 0)
+                        goto eee_exit_err;
 
                 eee_adv = phy_read_mmd_indirect(phydev, MDIO_AN_EEE_ADV,
                                                 MDIO_MMD_AN, phydev->addr);
-                if (eee_adv < 0)
-                        return eee_adv;
+                if (eee_adv <= 0)
+                        goto eee_exit_err;
 
                 adv = mmd_eee_adv_to_ethtool_adv_t(eee_adv);
                 lp = mmd_eee_adv_to_ethtool_adv_t(eee_lp);
                 idx = phy_find_setting(phydev->speed, phydev->duplex);
                 if (!(lp & adv & settings[idx].setting))
-                        return -EPROTONOSUPPORT;
+                        goto eee_exit_err;
 
                 if (clk_stop_enable) {
                         /* Configure the PHY to stop receiving xMII
@@ -1084,7 +1084,7 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
 
                 return 0; /* EEE supported */
         }
-
+eee_exit_err:
         return -EPROTONOSUPPORT;
 }
 EXPORT_SYMBOL(phy_init_eee);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index d6e90c72c257..6dfcbf523936 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2056,7 +2056,6 @@ vmxnet3_set_mc(struct net_device *netdev)
                 if (!netdev_mc_empty(netdev)) {
                         new_table = vmxnet3_copy_mc(netdev);
                         if (new_table) {
-                                new_mode |= VMXNET3_RXM_MCAST;
                                 rxConf->mfTableLen = cpu_to_le16(
                                         netdev_mc_count(netdev) * ETH_ALEN);
                                 new_table_pa = dma_map_single(
@@ -2064,15 +2063,18 @@ vmxnet3_set_mc(struct net_device *netdev)
                                                         new_table,
                                                         rxConf->mfTableLen,
                                                         PCI_DMA_TODEVICE);
+                        }
+
+                        if (new_table_pa) {
+                                new_mode |= VMXNET3_RXM_MCAST;
                                 rxConf->mfTablePA = cpu_to_le64(new_table_pa);
                         } else {
-                                netdev_info(netdev, "failed to copy mcast list"
-                                            ", setting ALL_MULTI\n");
+                                netdev_info(netdev,
+                                            "failed to copy mcast list, setting ALL_MULTI\n");
                                 new_mode |= VMXNET3_RXM_ALL_MULTI;
                         }
                 }
 
-
         if (!(new_mode & VMXNET3_RXM_MCAST)) {
                 rxConf->mfTableLen = 0;
                 rxConf->mfTablePA = 0;
@@ -2091,11 +2093,10 @@ vmxnet3_set_mc(struct net_device *netdev)
                                VMXNET3_CMD_UPDATE_MAC_FILTERS);
         spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 
-        if (new_table) {
+        if (new_table_pa)
                 dma_unmap_single(&adapter->pdev->dev, new_table_pa,
                                  rxConf->mfTableLen, PCI_DMA_TODEVICE);
-                kfree(new_table);
-        }
+        kfree(new_table);
 }
 
 void
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 29ee77f2c97f..3759479f959a 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.2.0.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.2.1.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01020000
+#define VMXNET3_DRIVER_VERSION_NUM      0x01020100
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 334c2ece855a..da92bfa76b7c 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -2423,8 +2423,6 @@ static void at76_delete_device(struct at76_priv *priv)
 
         kfree_skb(priv->rx_skb);
 
-        usb_put_dev(priv->udev);
-
         at76_dbg(DBG_PROC_ENTRY, "%s: before freeing priv/ieee80211_hw",
                  __func__);
         ieee80211_free_hw(priv->hw);
@@ -2558,6 +2556,7 @@ static void at76_disconnect(struct usb_interface *interface)
 
         wiphy_info(priv->hw->wiphy, "disconnecting\n");
         at76_delete_device(priv);
+        usb_put_dev(priv->udev);
         dev_info(&interface->dev, "disconnected\n");
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/spectral.c b/drivers/net/wireless/ath/ath9k/spectral.c
index 5fe29b9f8fa2..8f68426ca653 100644
--- a/drivers/net/wireless/ath/ath9k/spectral.c
+++ b/drivers/net/wireless/ath/ath9k/spectral.c
@@ -253,7 +253,7 @@ static ssize_t write_file_spec_scan_ctl(struct file *file,
 
         if (strncmp("trigger", buf, 7) == 0) {
                 ath9k_spectral_scan_trigger(sc->hw);
-        } else if (strncmp("background", buf, 9) == 0) {
+        } else if (strncmp("background", buf, 10) == 0) {
                 ath9k_spectral_scan_config(sc->hw, SPECTRAL_BACKGROUND);
                 ath_dbg(common, CONFIG, "spectral scan: background mode enabled\n");
         } else if (strncmp("chanscan", buf, 8) == 0) {
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 6451d2b6abcf..824f5e287783 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -51,7 +51,6 @@ config IWLWIFI_LEDS
 
 config IWLDVM
         tristate "Intel Wireless WiFi DVM Firmware support"
-        depends on m
         default IWLWIFI
         help
           This is the driver that supports the DVM firmware which is
@@ -60,7 +59,6 @@ config IWLDVM
 
 config IWLMVM
         tristate "Intel Wireless WiFi MVM Firmware support"
-        depends on m
         help
           This is the driver that supports the MVM firmware which is
           currently only available for 7260 and 3160 devices.
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 6dc5dd3ced44..ed50de6362ed 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1068,6 +1068,13 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         /* recalculate basic rates */
         iwl_calc_basic_rates(priv, ctx);
 
+        /*
+         * force CTS-to-self frames protection if RTS-CTS is not preferred
+         * one aggregation protection method
+         */
+        if (!priv->hw_params.use_rts_for_aggregation)
+                ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
+
         if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
             !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
                 ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
@@ -1473,6 +1480,11 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
         else
                 ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
 
+        if (bss_conf->use_cts_prot)
+                ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
+        else
+                ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
+
         memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
 
         if (vif->type == NL80211_IFTYPE_AP ||
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 48730064da73..d67a37a786aa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -67,8 +67,8 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   9
-#define IWL3160_UCODE_API_MAX   9
+#define IWL7260_UCODE_API_MAX   10
+#define IWL3160_UCODE_API_MAX   10
 
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    9
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index 44b19e015102..e93c6972290b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -67,7 +67,7 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL8000_UCODE_API_MAX   9
+#define IWL8000_UCODE_API_MAX   10
 
 /* Oldest version we won't warn about */
 #define IWL8000_UCODE_API_OK    8
diff --git a/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c
index 33da3dfcfa4f..d4bd550f505c 100644
--- a/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c
+++ b/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c
@@ -101,7 +101,7 @@ static bool halbtc_legacy(struct rtl_priv *adapter)
 
         bool is_legacy = false;
 
-        if ((mac->mode == WIRELESS_MODE_B) || (mac->mode == WIRELESS_MODE_B))
+        if ((mac->mode == WIRELESS_MODE_B) || (mac->mode == WIRELESS_MODE_G))
                 is_legacy = true;
 
         return is_legacy;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 361435f8608a..1ac6383e7947 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -317,6 +317,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
         {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+        {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
         {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
         {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index e29e15dca86e..f379689dde30 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -576,6 +576,9 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
         init_waitqueue_head(&queue->dealloc_wq);
         atomic_set(&queue->inflight_packets, 0);
 
+        netif_napi_add(queue->vif->dev, &queue->napi, xenvif_poll,
+                        XENVIF_NAPI_WEIGHT);
+
         if (tx_evtchn == rx_evtchn) {
                 /* feature-split-event-channels == 0 */
                 err = bind_interdomain_evtchn_to_irqhandler(
@@ -629,9 +632,6 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
         wake_up_process(queue->task);
         wake_up_process(queue->dealloc_task);
 
-        netif_napi_add(queue->vif->dev, &queue->napi, xenvif_poll,
-                        XENVIF_NAPI_WEIGHT);
-
         return 0;
 
 err_rx_unbind:
diff --git a/drivers/pci/host/Kconfig b/drivers/pci/host/Kconfig
index 8922c376456a..90f5ccacce4b 100644
--- a/drivers/pci/host/Kconfig
+++ b/drivers/pci/host/Kconfig
@@ -56,7 +56,7 @@ config PCI_HOST_GENERIC
           controller, such as the one emulated by kvmtool.
 
 config PCIE_SPEAR13XX
-        tristate "STMicroelectronics SPEAr PCIe controller"
+        bool "STMicroelectronics SPEAr PCIe controller"
         depends on ARCH_SPEAR13XX
         select PCIEPORTBUS
         select PCIE_DW
diff --git a/drivers/pinctrl/nomadik/pinctrl-abx500.c b/drivers/pinctrl/nomadik/pinctrl-abx500.c
index a53a689a2bfa..8c6fd8d4dd3c 100644
--- a/drivers/pinctrl/nomadik/pinctrl-abx500.c
+++ b/drivers/pinctrl/nomadik/pinctrl-abx500.c
@@ -620,8 +620,7 @@ static void abx500_gpio_dbg_show_one(struct seq_file *s,
         } else
                 seq_printf(s, " %-9s", chip->get(chip, offset) ? "hi" : "lo");
 
-        if (pctldev)
-                mode = abx500_get_mode(pctldev, chip, offset);
+        mode = abx500_get_mode(pctldev, chip, offset);
 
         seq_printf(s, " %s", (mode < 0) ? "unknown" : modes[mode]);
 
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index af1ba4fc150d..60464a2648aa 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -497,10 +497,10 @@ static struct at91_pinctrl_mux_ops at91sam9x5_ops = {
 static void at91_pin_dbg(const struct device *dev, const struct at91_pmx_pin *pin)
 {
         if (pin->mux) {
-                dev_dbg(dev, "pio%c%d configured as periph%c with conf = 0x%lu\n",
+                dev_dbg(dev, "pio%c%d configured as periph%c with conf = 0x%lx\n",
                         pin->bank + 'A', pin->pin, pin->mux - 1 + 'A', pin->conf);
         } else {
-                dev_dbg(dev, "pio%c%d configured as gpio with conf = 0x%lu\n",
+                dev_dbg(dev, "pio%c%d configured as gpio with conf = 0x%lx\n",
                         pin->bank + 'A', pin->pin, pin->conf);
         }
 }
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index 5e8b2e04cd7a..0c372a300cb8 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -438,7 +438,7 @@ static int rockchip_set_mux(struct rockchip_pin_bank *bank, int pin, int mux)
         int reg, ret, mask;
         unsigned long flags;
         u8 bit;
-        u32 data;
+        u32 data, rmask;
 
         if (iomux_num > 3)
                 return -EINVAL;
@@ -478,8 +478,9 @@ static int rockchip_set_mux(struct rockchip_pin_bank *bank, int pin, int mux)
         spin_lock_irqsave(&bank->slock, flags);
 
         data = (mask << (bit + 16));
+        rmask = data | (data >> 16);
         data |= (mux & mask) << bit;
-        ret = regmap_write(regmap, reg, data);
+        ret = regmap_update_bits(regmap, reg, rmask, data);
 
         spin_unlock_irqrestore(&bank->slock, flags);
 
@@ -634,7 +635,7 @@ static int rk3288_set_drive(struct rockchip_pin_bank *bank, int pin_num,
         struct regmap *regmap;
         unsigned long flags;
         int reg, ret, i;
-        u32 data;
+        u32 data, rmask;
         u8 bit;
 
         rk3288_calc_drv_reg_and_bit(bank, pin_num, &regmap, &reg, &bit);
@@ -657,9 +658,10 @@ static int rk3288_set_drive(struct rockchip_pin_bank *bank, int pin_num,
 
         /* enable the write to the equivalent lower bits */
         data = ((1 << RK3288_DRV_BITS_PER_PIN) - 1) << (bit + 16);
+        rmask = data | (data >> 16);
         data |= (ret << bit);
 
-        ret = regmap_write(regmap, reg, data);
+        ret = regmap_update_bits(regmap, reg, rmask, data);
         spin_unlock_irqrestore(&bank->slock, flags);
 
         return ret;
@@ -722,7 +724,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank,
         int reg, ret;
         unsigned long flags;
         u8 bit;
-        u32 data;
+        u32 data, rmask;
 
         dev_dbg(info->dev, "setting pull of GPIO%d-%d to %d\n",
                  bank->bank_num, pin_num, pull);
@@ -750,6 +752,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank,
 
                 /* enable the write to the equivalent lower bits */
                 data = ((1 << RK3188_PULL_BITS_PER_PIN) - 1) << (bit + 16);
+                rmask = data | (data >> 16);
 
                 switch (pull) {
                 case PIN_CONFIG_BIAS_DISABLE:
@@ -770,7 +773,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank,
                         return -EINVAL;
                 }
 
-                ret = regmap_write(regmap, reg, data);
+                ret = regmap_update_bits(regmap, reg, rmask, data);
 
                 spin_unlock_irqrestore(&bank->slock, flags);
                 break;
diff --git a/drivers/pinctrl/pinctrl-tegra-xusb.c b/drivers/pinctrl/pinctrl-tegra-xusb.c
index a06620474845..e641b4226c42 100644
--- a/drivers/pinctrl/pinctrl-tegra-xusb.c
+++ b/drivers/pinctrl/pinctrl-tegra-xusb.c
@@ -680,7 +680,7 @@ static struct phy *tegra_xusb_padctl_xlate(struct device *dev,
         if (args->args_count <= 0)
                 return ERR_PTR(-EINVAL);
 
-        if (index > ARRAY_SIZE(padctl->phys))
+        if (index >= ARRAY_SIZE(padctl->phys))
                 return ERR_PTR(-EINVAL);
 
         return padctl->phys[index];
@@ -930,7 +930,8 @@ static int tegra_xusb_padctl_probe(struct platform_device *pdev)
 
         padctl->provider = devm_of_phy_provider_register(&pdev->dev,
                                                          tegra_xusb_padctl_xlate);
-        if (err < 0) {
+        if (IS_ERR(padctl->provider)) {
+                err = PTR_ERR(padctl->provider);
                 dev_err(&pdev->dev, "failed to register PHYs: %d\n", err);
                 goto unregister;
         }
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
index 003bfd874a61..d7154ed0b0eb 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
@@ -127,14 +127,10 @@ static int exynos_irq_set_type(struct irq_data *irqd, unsigned int type)
         struct irq_chip *chip = irq_data_get_irq_chip(irqd);
         struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip);
         struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
-        struct samsung_pin_bank_type *bank_type = bank->type;
         struct samsung_pinctrl_drv_data *d = bank->drvdata;
-        unsigned int pin = irqd->hwirq;
-        unsigned int shift = EXYNOS_EINT_CON_LEN * pin;
+        unsigned int shift = EXYNOS_EINT_CON_LEN * irqd->hwirq;
         unsigned int con, trig_type;
         unsigned long reg_con = our_chip->eint_con + bank->eint_offset;
-        unsigned long flags;
-        unsigned int mask;
 
         switch (type) {
         case IRQ_TYPE_EDGE_RISING:
@@ -167,8 +163,32 @@ static int exynos_irq_set_type(struct irq_data *irqd, unsigned int type)
         con |= trig_type << shift;
         writel(con, d->virt_base + reg_con);
 
+        return 0;
+}
+
+static int exynos_irq_request_resources(struct irq_data *irqd)
+{
+        struct irq_chip *chip = irq_data_get_irq_chip(irqd);
+        struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip);
+        struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+        struct samsung_pin_bank_type *bank_type = bank->type;
+        struct samsung_pinctrl_drv_data *d = bank->drvdata;
+        unsigned int shift = EXYNOS_EINT_CON_LEN * irqd->hwirq;
+        unsigned long reg_con = our_chip->eint_con + bank->eint_offset;
+        unsigned long flags;
+        unsigned int mask;
+        unsigned int con;
+        int ret;
+
+        ret = gpio_lock_as_irq(&bank->gpio_chip, irqd->hwirq);
+        if (ret) {
+                dev_err(bank->gpio_chip.dev, "unable to lock pin %s-%lu IRQ\n",
+                        bank->name, irqd->hwirq);
+                return ret;
+        }
+
         reg_con = bank->pctl_offset + bank_type->reg_offset[PINCFG_TYPE_FUNC];
-        shift = pin * bank_type->fld_width[PINCFG_TYPE_FUNC];
+        shift = irqd->hwirq * bank_type->fld_width[PINCFG_TYPE_FUNC];
         mask = (1 << bank_type->fld_width[PINCFG_TYPE_FUNC]) - 1;
 
         spin_lock_irqsave(&bank->slock, flags);
@@ -180,9 +200,42 @@ static int exynos_irq_set_type(struct irq_data *irqd, unsigned int type)
 
         spin_unlock_irqrestore(&bank->slock, flags);
 
+        exynos_irq_unmask(irqd);
+
         return 0;
 }
 
+static void exynos_irq_release_resources(struct irq_data *irqd)
+{
+        struct irq_chip *chip = irq_data_get_irq_chip(irqd);
+        struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip);
+        struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+        struct samsung_pin_bank_type *bank_type = bank->type;
+        struct samsung_pinctrl_drv_data *d = bank->drvdata;
+        unsigned int shift = EXYNOS_EINT_CON_LEN * irqd->hwirq;
+        unsigned long reg_con = our_chip->eint_con + bank->eint_offset;
+        unsigned long flags;
+        unsigned int mask;
+        unsigned int con;
+
+        reg_con = bank->pctl_offset + bank_type->reg_offset[PINCFG_TYPE_FUNC];
+        shift = irqd->hwirq * bank_type->fld_width[PINCFG_TYPE_FUNC];
+        mask = (1 << bank_type->fld_width[PINCFG_TYPE_FUNC]) - 1;
+
+        exynos_irq_mask(irqd);
+
+        spin_lock_irqsave(&bank->slock, flags);
+
+        con = readl(d->virt_base + reg_con);
+        con &= ~(mask << shift);
+        con |= FUNC_INPUT << shift;
+        writel(con, d->virt_base + reg_con);
+
+        spin_unlock_irqrestore(&bank->slock, flags);
+
+        gpio_unlock_as_irq(&bank->gpio_chip, irqd->hwirq);
+}
+
 /*
  * irq_chip for gpio interrupts.
  */
@@ -193,6 +246,8 @@ static struct exynos_irq_chip exynos_gpio_irq_chip = {
                 .irq_mask = exynos_irq_mask,
                 .irq_ack = exynos_irq_ack,
                 .irq_set_type = exynos_irq_set_type,
+                .irq_request_resources = exynos_irq_request_resources,
+                .irq_release_resources = exynos_irq_release_resources,
         },
         .eint_con = EXYNOS_GPIO_ECON_OFFSET,
         .eint_mask = EXYNOS_GPIO_EMASK_OFFSET,
@@ -336,6 +391,8 @@ static struct exynos_irq_chip exynos_wkup_irq_chip = {
                 .irq_ack = exynos_irq_ack,
                 .irq_set_type = exynos_irq_set_type,
                 .irq_set_wake = exynos_wkup_irq_set_wake,
+                .irq_request_resources = exynos_irq_request_resources,
+                .irq_release_resources = exynos_irq_release_resources,
         },
         .eint_con = EXYNOS_WKUP_ECON_OFFSET,
         .eint_mask = EXYNOS_WKUP_EMASK_OFFSET,
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h
index 2b882320e8e9..5cedc9d26390 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.h
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.h
@@ -26,6 +26,7 @@
 #include <linux/gpio.h>
 
 /* pinmux function number for pin as gpio output line */
+#define FUNC_INPUT      0x0
 #define FUNC_OUTPUT     0x1
 
 /**
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 576d41b459e9..c6e5deba238e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -4509,24 +4509,24 @@ static const char * const audio_clk_groups[] = {
 };
 
 static const char * const can0_groups[] = {
-        "can0_data_a",
+        "can0_data",
         "can0_data_b",
         "can0_data_c",
         "can0_data_d",
         "can0_data_e",
         "can0_data_f",
-        "can_clk_a",
+        "can_clk",
         "can_clk_b",
         "can_clk_c",
         "can_clk_d",
 };
 
 static const char * const can1_groups[] = {
-        "can1_data_a",
+        "can1_data",
         "can1_data_b",
         "can1_data_c",
         "can1_data_d",
-        "can_clk_a",
+        "can_clk",
         "can_clk_b",
         "can_clk_c",
         "can_clk_d",
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index fc468a3d95ce..02152de135b5 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -88,7 +88,6 @@ struct ideapad_private {
         struct dentry *debug;
         unsigned long cfg;
         bool has_hw_rfkill_switch;
-        bool has_touchpad_control;
 };
 
 static bool no_bt_rfkill;
@@ -456,7 +455,7 @@ struct ideapad_rfk_data {
         int type;
 };
 
-const const struct ideapad_rfk_data ideapad_rfk_data[] = {
+static const struct ideapad_rfk_data ideapad_rfk_data[] = {
         { "ideapad_wlan",    CFG_WIFI_BIT, VPCCMD_W_WIFI, RFKILL_TYPE_WLAN },
         { "ideapad_bluetooth", CFG_BT_BIT, VPCCMD_W_BT, RFKILL_TYPE_BLUETOOTH },
         { "ideapad_3g",        CFG_3G_BIT, VPCCMD_W_3G, RFKILL_TYPE_WWAN },
@@ -767,9 +766,6 @@ static void ideapad_sync_touchpad_state(struct ideapad_private *priv)
 {
         unsigned long value;
 
-        if (!priv->has_touchpad_control)
-                return;
-
         /* Without reading from EC touchpad LED doesn't switch state */
         if (!read_ec_data(priv->adev->handle, VPCCMD_R_TOUCHPAD, &value)) {
                 /* Some IdeaPads don't really turn off touchpad - they only
@@ -833,29 +829,7 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data)
  * always results in 0 on these models, causing ideapad_laptop to wrongly
  * report all radios as hardware-blocked.
  */
-static struct dmi_system_id no_hw_rfkill_list[] = {
-        {
-                .ident = "Lenovo Yoga 2 11 / 13 / Pro",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2"),
-                },
-        },
-        {}
-};
-
-/*
- * Some models don't offer touchpad ctrl through the ideapad interface, causing
- * ideapad_sync_touchpad_state to send wrong touchpad enable/disable events.
- */
-static struct dmi_system_id no_touchpad_ctrl_list[] = {
-        {
-                .ident = "Lenovo Yoga 1 series",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo IdeaPad Yoga"),
-                },
-        },
+static const struct dmi_system_id no_hw_rfkill_list[] = {
         {
                 .ident = "Lenovo Yoga 2 11 / 13 / Pro",
                 .matches = {
@@ -889,7 +863,6 @@ static int ideapad_acpi_add(struct platform_device *pdev)
         priv->adev = adev;
         priv->platform_device = pdev;
         priv->has_hw_rfkill_switch = !dmi_check_system(no_hw_rfkill_list);
-        priv->has_touchpad_control = !dmi_check_system(no_touchpad_ctrl_list);
 
         ret = ideapad_sysfs_init(priv);
         if (ret)
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index b062d3d7b373..d0dce734b2ed 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -1255,10 +1255,15 @@ static ssize_t toshiba_kbd_bl_mode_store(struct device *dev,
                                          const char *buf, size_t count)
 {
         struct toshiba_acpi_dev *toshiba = dev_get_drvdata(dev);
-        int mode = -1;
-        int time = -1;
+        int mode;
+        int time;
+        int ret;
 
-        if (sscanf(buf, "%i", &mode) != 1 && (mode != 2 || mode != 1))
+
+        ret = kstrtoint(buf, 0, &mode);
+        if (ret)
+                return ret;
+        if (mode != SCI_KBD_MODE_FNZ && mode != SCI_KBD_MODE_AUTO)
                 return -EINVAL;
 
         /* Set the Keyboard Backlight Mode where:
@@ -1266,11 +1271,12 @@ static ssize_t toshiba_kbd_bl_mode_store(struct device *dev,
          *      Auto - KBD backlight turns off automatically in given time
          *      FN-Z - KBD backlight "toggles" when hotkey pressed
          */
-        if (mode != -1 && toshiba->kbd_mode != mode) {
+        if (toshiba->kbd_mode != mode) {
                 time = toshiba->kbd_time << HCI_MISC_SHIFT;
                 time = time + toshiba->kbd_mode;
-                if (toshiba_kbd_illum_status_set(toshiba, time) < 0)
-                        return -EIO;
+                ret = toshiba_kbd_illum_status_set(toshiba, time);
+                if (ret)
+                        return ret;
                 toshiba->kbd_mode = mode;
         }
 
@@ -1857,9 +1863,16 @@ static int toshiba_acpi_resume(struct device *device)
 {
         struct toshiba_acpi_dev *dev = acpi_driver_data(to_acpi_device(device));
         u32 result;
+        acpi_status status;
+
+        if (dev->hotkey_dev) {
+                status = acpi_evaluate_object(dev->acpi_dev->handle, "ENAB",
+                                NULL, NULL);
+                if (ACPI_FAILURE(status))
+                        pr_info("Unable to re-enable hotkeys\n");
 
-        if (dev->hotkey_dev)
                 hci_write1(dev, HCI_HOTKEY_EVENT, HCI_HOTKEY_ENABLE, &result);
+        }
 
         return 0;
 }
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index b1cda6ffdbcc..45e05b32f9b6 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -953,6 +953,7 @@ static const struct x86_cpu_id rapl_ids[] = {
         { X86_VENDOR_INTEL, 6, 0x3a},/* Ivy Bridge */
         { X86_VENDOR_INTEL, 6, 0x3c},/* Haswell */
         { X86_VENDOR_INTEL, 6, 0x3d},/* Broadwell */
+        { X86_VENDOR_INTEL, 6, 0x3f},/* Haswell */
         { X86_VENDOR_INTEL, 6, 0x45},/* Haswell ULT */
         /* TODO: Add more CPU IDs after testing */
         {}
@@ -1166,11 +1167,10 @@ static int rapl_detect_domains(struct rapl_package *rp, int cpu)
 
         for (i = 0; i < RAPL_DOMAIN_MAX; i++) {
                 /* use physical package id to read counters */
-                if (!rapl_check_domain(cpu, i))
+                if (!rapl_check_domain(cpu, i)) {
                         rp->domain_map |= 1 << i;
-                else
-                        pr_warn("RAPL domain %s detection failed\n",
-                                rapl_domain_names[i]);
+                        pr_info("Found RAPL domain %s\n", rapl_domain_names[i]);
+                }
         }
         rp->nr_domains = bitmap_weight(&rp->domain_map, RAPL_DOMAIN_MAX);
         if (!rp->nr_domains) {
diff --git a/drivers/rtc/rtc-s5m.c b/drivers/rtc/rtc-s5m.c
index 8f06250a0389..8754c33361e8 100644
--- a/drivers/rtc/rtc-s5m.c
+++ b/drivers/rtc/rtc-s5m.c
@@ -717,12 +717,14 @@ static int s5m_rtc_probe(struct platform_device *pdev)
         info->device_type = s5m87xx->device_type;
         info->wtsr_smpl = s5m87xx->wtsr_smpl;
 
-        info->irq = regmap_irq_get_virq(s5m87xx->irq_data, alarm_irq);
-        if (info->irq <= 0) {
-                ret = -EINVAL;
-                dev_err(&pdev->dev, "Failed to get virtual IRQ %d\n",
+        if (s5m87xx->irq_data) {
+                info->irq = regmap_irq_get_virq(s5m87xx->irq_data, alarm_irq);
+                if (info->irq <= 0) {
+                        ret = -EINVAL;
+                        dev_err(&pdev->dev, "Failed to get virtual IRQ %d\n",
                                 alarm_irq);
-                goto err;
+                        goto err;
+                }
         }
 
         platform_set_drvdata(pdev, info);
@@ -744,6 +746,11 @@ static int s5m_rtc_probe(struct platform_device *pdev)
                 goto err;
         }
 
+        if (!info->irq) {
+                dev_info(&pdev->dev, "Alarm IRQ not available\n");
+                return 0;
+        }
+
         ret = devm_request_threaded_irq(&pdev->dev, info->irq, NULL,
                                         s5m_rtc_alarm_irq, 0, "rtc-alarm0",
                                         info);
@@ -802,7 +809,7 @@ static int s5m_rtc_resume(struct device *dev)
         struct s5m_rtc_info *info = dev_get_drvdata(dev);
         int ret = 0;
 
-        if (device_may_wakeup(dev))
+        if (info->irq && device_may_wakeup(dev))
                 ret = disable_irq_wake(info->irq);
 
         return ret;
@@ -813,7 +820,7 @@ static int s5m_rtc_suspend(struct device *dev)
         struct s5m_rtc_info *info = dev_get_drvdata(dev);
         int ret = 0;
 
-        if (device_may_wakeup(dev))
+        if (info->irq && device_may_wakeup(dev))
                 ret = enable_irq_wake(info->irq);
 
         return ret;
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index a6d47e5eee9e..c43aca69fb30 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -1035,12 +1035,26 @@ static int tty3215_write(struct tty_struct * tty,
                          const unsigned char *buf, int count)
 {
         struct raw3215_info *raw;
+        int i, written;
 
         if (!tty)
                 return 0;
         raw = (struct raw3215_info *) tty->driver_data;
-        raw3215_write(raw, buf, count);
-        return count;
+        written = count;
+        while (count > 0) {
+                for (i = 0; i < count; i++)
+                        if (buf[i] == '\t' || buf[i] == '\n')
+                                break;
+                raw3215_write(raw, buf, i);
+                count -= i;
+                buf += i;
+                if (count > 0) {
+                        raw3215_putchar(raw, *buf);
+                        count--;
+                        buf++;
+                }
+        }
+        return written;
 }
 
 /*
@@ -1188,7 +1202,7 @@ static int __init tty3215_init(void)
         driver->subtype = SYSTEM_TYPE_TTY;
         driver->init_termios = tty_std_termios;
         driver->init_termios.c_iflag = IGNBRK | IGNPAR;
-        driver->init_termios.c_oflag = ONLCR | XTABS;
+        driver->init_termios.c_oflag = ONLCR;
         driver->init_termios.c_lflag = ISIG;
         driver->flags = TTY_DRIVER_REAL_RAW;
         tty_set_operations(driver, &tty3215_ops);
diff --git a/drivers/s390/char/sclp_tty.c b/drivers/s390/char/sclp_tty.c
index 7ed7a5987816..003663288e29 100644
--- a/drivers/s390/char/sclp_tty.c
+++ b/drivers/s390/char/sclp_tty.c
@@ -559,7 +559,7 @@ sclp_tty_init(void)
         driver->subtype = SYSTEM_TYPE_TTY;
         driver->init_termios = tty_std_termios;
         driver->init_termios.c_iflag = IGNBRK | IGNPAR;
-        driver->init_termios.c_oflag = ONLCR | XTABS;
+        driver->init_termios.c_oflag = ONLCR;
         driver->init_termios.c_lflag = ISIG | ECHO;
         driver->flags = TTY_DRIVER_REAL_RAW;
         tty_set_operations(driver, &sclp_ops);
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 97ef37b51068..e7646ce3d659 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -889,6 +889,7 @@ extern const struct attribute_group *qeth_generic_attr_groups[];
 extern const struct attribute_group *qeth_osn_attr_groups[];
 extern struct workqueue_struct *qeth_wq;
 
+int qeth_card_hw_is_reachable(struct qeth_card *);
 const char *qeth_get_cardname_short(struct qeth_card *);
 int qeth_realloc_buffer_pool(struct qeth_card *, int);
 int qeth_core_load_discipline(struct qeth_card *, enum qeth_discipline_id);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index c0d6ba8655c7..fd22c811cbe1 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -73,6 +73,13 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *, int);
 struct workqueue_struct *qeth_wq;
 EXPORT_SYMBOL_GPL(qeth_wq);
 
+int qeth_card_hw_is_reachable(struct qeth_card *card)
+{
+        return (card->state == CARD_STATE_SOFTSETUP) ||
+                (card->state == CARD_STATE_UP);
+}
+EXPORT_SYMBOL_GPL(qeth_card_hw_is_reachable);
+
 static void qeth_close_dev_handler(struct work_struct *work)
 {
         struct qeth_card *card;
@@ -5790,6 +5797,7 @@ int qeth_core_ethtool_get_settings(struct net_device *netdev,
         struct qeth_card *card = netdev->ml_priv;
         enum qeth_link_types link_type;
         struct carrier_info carrier_info;
+        int rc;
         u32 speed;
 
         if ((card->info.type == QETH_CARD_TYPE_IQD) || (card->info.guestlan))
@@ -5832,8 +5840,14 @@ int qeth_core_ethtool_get_settings(struct net_device *netdev,
         /* Check if we can obtain more accurate information.     */
         /* If QUERY_CARD_INFO command is not supported or fails, */
         /* just return the heuristics that was filled above.     */
-        if (qeth_query_card_info(card, &carrier_info) != 0)
+        if (!qeth_card_hw_is_reachable(card))
+                return -ENODEV;
+        rc = qeth_query_card_info(card, &carrier_info);
+        if (rc == -EOPNOTSUPP) /* for old hardware, return heuristic */
                 return 0;
+        if (rc) /* report error from the hardware operation */
+                return rc;
+        /* on success, fill in the information got from the hardware */
 
         netdev_dbg(netdev,
         "card info: card_type=0x%02x, port_mode=0x%04x, port_speed=0x%08x\n",
diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c
index ae1bc04b8653..59e3aa538b4d 100644
--- a/drivers/s390/net/qeth_l2_sys.c
+++ b/drivers/s390/net/qeth_l2_sys.c
@@ -5,17 +5,12 @@
 
 #include <linux/slab.h>
 #include <asm/ebcdic.h>
+#include "qeth_core.h"
 #include "qeth_l2.h"
 
 #define QETH_DEVICE_ATTR(_id, _name, _mode, _show, _store) \
 struct device_attribute dev_attr_##_id = __ATTR(_name, _mode, _show, _store)
 
-static int qeth_card_hw_is_reachable(struct qeth_card *card)
-{
-        return (card->state == CARD_STATE_SOFTSETUP) ||
-                (card->state == CARD_STATE_UP);
-}
-
 static ssize_t qeth_bridge_port_role_state_show(struct device *dev,
                                 struct device_attribute *attr, char *buf,
                                 int show_state)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ce62e8798cc8..d837dc180522 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1808,7 +1808,6 @@ static int scsi_mq_prep_fn(struct request *req)
 
         cmd->tag = req->tag;
 
-        req->cmd = req->__cmd;
         cmd->cmnd = req->cmd;
         cmd->prot_op = SCSI_PROT_NORMAL;
 
diff --git a/drivers/sh/Makefile b/drivers/sh/Makefile
index 788ed9b59b4e..114203f32843 100644
--- a/drivers/sh/Makefile
+++ b/drivers/sh/Makefile
@@ -1,8 +1,7 @@
 #
 # Makefile for the SuperH specific drivers.
 #
-obj-$(CONFIG_SUPERH)                    += intc/
-obj-$(CONFIG_ARCH_SHMOBILE_LEGACY)      += intc/
+obj-$(CONFIG_SH_INTC)                   += intc/
 ifneq ($(CONFIG_COMMON_CLK),y)
 obj-$(CONFIG_HAVE_CLK)                  += clk/
 endif
diff --git a/drivers/sh/intc/Kconfig b/drivers/sh/intc/Kconfig
index 60228fae943f..6a1b05ddc8c9 100644
--- a/drivers/sh/intc/Kconfig
+++ b/drivers/sh/intc/Kconfig
@@ -1,7 +1,9 @@
 config SH_INTC
-        def_bool y
+        bool
         select IRQ_DOMAIN
 
+if SH_INTC
+
 comment "Interrupt controller options"
 
 config INTC_USERIMASK
@@ -37,3 +39,5 @@ config INTC_MAPPING_DEBUG
           between system IRQs and the per-controller id tables.
 
           If in doubt, say N.
+
+endif
diff --git a/drivers/spi/spi-au1550.c b/drivers/spi/spi-au1550.c
index 40c3d43c9292..f40b34cdf2fc 100644
--- a/drivers/spi/spi-au1550.c
+++ b/drivers/spi/spi-au1550.c
@@ -945,7 +945,7 @@ static int au1550_spi_remove(struct platform_device *pdev)
         spi_bitbang_stop(&hw->bitbang);
         free_irq(hw->irq, hw);
         iounmap((void __iomem *)hw->regs);
-        release_mem_region(r->start, sizeof(psc_spi_t));
+        release_mem_region(hw->ioarea->start, sizeof(psc_spi_t));
 
         if (hw->usedma) {
                 au1550_spi_dma_rxtmp_free(hw);
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 276a3884fb3c..48f1d26e6ad9 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -417,16 +417,16 @@ static int davinci_spi_setup(struct spi_device *spi)
                                                   flags, dev_name(&spi->dev));
                         internal_cs = false;
                 }
-        }
 
-        if (retval) {
-                dev_err(&spi->dev, "GPIO %d setup failed (%d)\n",
-                        spi->cs_gpio, retval);
-                return retval;
-        }
+                if (retval) {
+                        dev_err(&spi->dev, "GPIO %d setup failed (%d)\n",
+                                spi->cs_gpio, retval);
+                        return retval;
+                }
 
-        if (internal_cs)
-                set_io_bits(dspi->base + SPIPC0, 1 << spi->chip_select);
+                if (internal_cs)
+                        set_io_bits(dspi->base + SPIPC0, 1 << spi->chip_select);
+        }
 
         if (spi->mode & SPI_READY)
                 set_io_bits(dspi->base + SPIPC0, SPIPC0_SPIENA_MASK);
diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
index 3f3dc1226edf..e14960470d8d 100644
--- a/drivers/spi/spi-dw-pci.c
+++ b/drivers/spi/spi-dw-pci.c
@@ -62,6 +62,8 @@ static int spi_pci_probe(struct pci_dev *pdev,
         if (ret)
                 return ret;
 
+        dws->regs = pcim_iomap_table(pdev)[pci_bar];
+
         dws->bus_num = 0;
         dws->num_cs = 4;
         dws->irq = pdev->irq;
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 29f33143b795..670f0627f3bf 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -271,7 +271,7 @@ static void giveback(struct dw_spi *dws)
                                         transfer_list);
 
         if (!last_transfer->cs_change)
-                spi_chip_sel(dws, dws->cur_msg->spi, 0);
+                spi_chip_sel(dws, msg->spi, 0);
 
         spi_finalize_current_message(dws->master);
 }
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index 68441fa448de..352eed7463ac 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -329,7 +329,8 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
 disable_fifo:
         if (t->rx_buf != NULL)
                 chconf &= ~OMAP2_MCSPI_CHCONF_FFER;
-        else
+
+        if (t->tx_buf != NULL)
                 chconf &= ~OMAP2_MCSPI_CHCONF_FFET;
 
         mcspi_write_chconf0(spi, chconf);
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index fe792106bdc5..46f45ca2c694 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1074,6 +1074,7 @@ static struct acpi_device_id pxa2xx_spi_acpi_match[] = {
         { "INT3430", 0 },
         { "INT3431", 0 },
         { "80860F0E", 0 },
+        { "8086228E", 0 },
         { },
 };
 MODULE_DEVICE_TABLE(acpi, pxa2xx_spi_acpi_match);
diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index c0743604b906..cd0e08b0c9f6 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -499,7 +499,7 @@ static void rockchip_spi_config(struct rockchip_spi *rs)
         }
 
         /* div doesn't support odd number */
-        div = rs->max_freq / rs->speed;
+        div = max_t(u32, rs->max_freq / rs->speed, 1);
         div = (div + 1) & 0xfffe;
 
         spi_enable_chip(rs, 0);
@@ -678,7 +678,7 @@ static int rockchip_spi_probe(struct platform_device *pdev)
                 rs->dma_tx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_TXDR);
                 rs->dma_rx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_RXDR);
                 rs->dma_tx.direction = DMA_MEM_TO_DEV;
-                rs->dma_tx.direction = DMA_DEV_TO_MEM;
+                rs->dma_rx.direction = DMA_DEV_TO_MEM;
 
                 master->can_dma = rockchip_spi_can_dma;
                 master->dma_tx = rs->dma_tx.ch;
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index c850dfdfa9e3..ad87a98f8f68 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -472,25 +472,52 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
         dma_cookie_t cookie;
         int ret;
 
-        if (tx) {
-                desc_tx = dmaengine_prep_slave_sg(rspi->master->dma_tx,
-                                        tx->sgl, tx->nents, DMA_TO_DEVICE,
-                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                if (!desc_tx)
-                        goto no_dma;
-
-                irq_mask |= SPCR_SPTIE;
-        }
+        /* First prepare and submit the DMA request(s), as this may fail */
         if (rx) {
                 desc_rx = dmaengine_prep_slave_sg(rspi->master->dma_rx,
                                         rx->sgl, rx->nents, DMA_FROM_DEVICE,
                                         DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                if (!desc_rx)
-                        goto no_dma;
+                if (!desc_rx) {
+                        ret = -EAGAIN;
+                        goto no_dma_rx;
+                }
+
+                desc_rx->callback = rspi_dma_complete;
+                desc_rx->callback_param = rspi;
+                cookie = dmaengine_submit(desc_rx);
+                if (dma_submit_error(cookie)) {
+                        ret = cookie;
+                        goto no_dma_rx;
+                }
 
                 irq_mask |= SPCR_SPRIE;
         }
 
+        if (tx) {
+                desc_tx = dmaengine_prep_slave_sg(rspi->master->dma_tx,
+                                        tx->sgl, tx->nents, DMA_TO_DEVICE,
+                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+                if (!desc_tx) {
+                        ret = -EAGAIN;
+                        goto no_dma_tx;
+                }
+
+                if (rx) {
+                        /* No callback */
+                        desc_tx->callback = NULL;
+                } else {
+                        desc_tx->callback = rspi_dma_complete;
+                        desc_tx->callback_param = rspi;
+                }
+                cookie = dmaengine_submit(desc_tx);
+                if (dma_submit_error(cookie)) {
+                        ret = cookie;
+                        goto no_dma_tx;
+                }
+
+                irq_mask |= SPCR_SPTIE;
+        }
+
         /*
          * DMAC needs SPxIE, but if SPxIE is set, the IRQ routine will be
          * called. So, this driver disables the IRQ while DMA transfer.
@@ -503,34 +530,24 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
         rspi_enable_irq(rspi, irq_mask);
         rspi->dma_callbacked = 0;
 
-        if (rx) {
-                desc_rx->callback = rspi_dma_complete;
-                desc_rx->callback_param = rspi;
-                cookie = dmaengine_submit(desc_rx);
-                if (dma_submit_error(cookie))
-                        return cookie;
+        /* Now start DMA */
+        if (rx)
                 dma_async_issue_pending(rspi->master->dma_rx);
-        }
-        if (tx) {
-                if (rx) {
-                        /* No callback */
-                        desc_tx->callback = NULL;
-                } else {
-                        desc_tx->callback = rspi_dma_complete;
-                        desc_tx->callback_param = rspi;
-                }
-                cookie = dmaengine_submit(desc_tx);
-                if (dma_submit_error(cookie))
-                        return cookie;
+        if (tx)
                 dma_async_issue_pending(rspi->master->dma_tx);
-        }
 
         ret = wait_event_interruptible_timeout(rspi->wait,
                                                rspi->dma_callbacked, HZ);
         if (ret > 0 && rspi->dma_callbacked)
                 ret = 0;
-        else if (!ret)
+        else if (!ret) {
+                dev_err(&rspi->master->dev, "DMA timeout\n");
                 ret = -ETIMEDOUT;
+                if (tx)
+                        dmaengine_terminate_all(rspi->master->dma_tx);
+                if (rx)
+                        dmaengine_terminate_all(rspi->master->dma_rx);
+        }
 
         rspi_disable_irq(rspi, irq_mask);
 
@@ -541,11 +558,16 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
 
         return ret;
 
-no_dma:
-        pr_warn_once("%s %s: DMA not available, falling back to PIO\n",
-                     dev_driver_string(&rspi->master->dev),
-                     dev_name(&rspi->master->dev));
-        return -EAGAIN;
+no_dma_tx:
+        if (rx)
+                dmaengine_terminate_all(rspi->master->dma_rx);
+no_dma_rx:
+        if (ret == -EAGAIN) {
+                pr_warn_once("%s %s: DMA not available, falling back to PIO\n",
+                             dev_driver_string(&rspi->master->dev),
+                             dev_name(&rspi->master->dev));
+        }
+        return ret;
 }
 
 static void rspi_receive_init(const struct rspi_data *rspi)
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 2a4354dcd661..543075b80f16 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -636,48 +636,38 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
         dma_cookie_t cookie;
         int ret;
 
-        if (tx) {
-                ier_bits |= IER_TDREQE | IER_TDMAE;
-                dma_sync_single_for_device(p->master->dma_tx->device->dev,
-                                           p->tx_dma_addr, len, DMA_TO_DEVICE);
-                desc_tx = dmaengine_prep_slave_single(p->master->dma_tx,
-                                        p->tx_dma_addr, len, DMA_TO_DEVICE,
-                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                if (!desc_tx)
-                        return -EAGAIN;
-        }
-
+        /* First prepare and submit the DMA request(s), as this may fail */
         if (rx) {
                 ier_bits |= IER_RDREQE | IER_RDMAE;
                 desc_rx = dmaengine_prep_slave_single(p->master->dma_rx,
                                         p->rx_dma_addr, len, DMA_FROM_DEVICE,
                                         DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                if (!desc_rx)
-                        return -EAGAIN;
-        }
-
-        /* 1 stage FIFO watermarks for DMA */
-        sh_msiof_write(p, FCTR, FCTR_TFWM_1 | FCTR_RFWM_1);
-
-        /* setup msiof transfer mode registers (32-bit words) */
-        sh_msiof_spi_set_mode_regs(p, tx, rx, 32, len / 4);
-
-        sh_msiof_write(p, IER, ier_bits);
-
-        reinit_completion(&p->done);
+                if (!desc_rx) {
+                        ret = -EAGAIN;
+                        goto no_dma_rx;
+                }
 
-        if (rx) {
                 desc_rx->callback = sh_msiof_dma_complete;
                 desc_rx->callback_param = p;
                 cookie = dmaengine_submit(desc_rx);
                 if (dma_submit_error(cookie)) {
                         ret = cookie;
-                        goto stop_ier;
+                        goto no_dma_rx;
                 }
-                dma_async_issue_pending(p->master->dma_rx);
         }
 
         if (tx) {
+                ier_bits |= IER_TDREQE | IER_TDMAE;
+                dma_sync_single_for_device(p->master->dma_tx->device->dev,
+                                           p->tx_dma_addr, len, DMA_TO_DEVICE);
+                desc_tx = dmaengine_prep_slave_single(p->master->dma_tx,
+                                        p->tx_dma_addr, len, DMA_TO_DEVICE,
+                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+                if (!desc_tx) {
+                        ret = -EAGAIN;
+                        goto no_dma_tx;
+                }
+
                 if (rx) {
                         /* No callback */
                         desc_tx->callback = NULL;
@@ -688,15 +678,30 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
                 cookie = dmaengine_submit(desc_tx);
                 if (dma_submit_error(cookie)) {
                         ret = cookie;
-                        goto stop_rx;
+                        goto no_dma_tx;
                 }
-                dma_async_issue_pending(p->master->dma_tx);
         }
 
+        /* 1 stage FIFO watermarks for DMA */
+        sh_msiof_write(p, FCTR, FCTR_TFWM_1 | FCTR_RFWM_1);
+
+        /* setup msiof transfer mode registers (32-bit words) */
+        sh_msiof_spi_set_mode_regs(p, tx, rx, 32, len / 4);
+
+        sh_msiof_write(p, IER, ier_bits);
+
+        reinit_completion(&p->done);
+
+        /* Now start DMA */
+        if (rx)
+                dma_async_issue_pending(p->master->dma_rx);
+        if (tx)
+                dma_async_issue_pending(p->master->dma_tx);
+
         ret = sh_msiof_spi_start(p, rx);
         if (ret) {
                 dev_err(&p->pdev->dev, "failed to start hardware\n");
-                goto stop_tx;
+                goto stop_dma;
         }
 
         /* wait for tx fifo to be emptied / rx fifo to be filled */
@@ -726,14 +731,14 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
 stop_reset:
         sh_msiof_reset_str(p);
         sh_msiof_spi_stop(p, rx);
-stop_tx:
+stop_dma:
         if (tx)
                 dmaengine_terminate_all(p->master->dma_tx);
-stop_rx:
+no_dma_tx:
         if (rx)
                 dmaengine_terminate_all(p->master->dma_rx);
-stop_ier:
         sh_msiof_write(p, IER, 0);
+no_dma_rx:
         return ret;
 }
 
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index e0531baf2782..ca935df80c88 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -848,6 +848,7 @@ out:
 
 /**
  * spi_finalize_current_transfer - report completion of a transfer
+ * @master: the master reporting completion
  *
  * Called by SPI drivers using the core transfer_one_message()
  * implementation to notify it that the current interrupt driven
diff --git a/drivers/ssb/b43_pci_bridge.c b/drivers/ssb/b43_pci_bridge.c
index 19396dc4ee47..bed2fedeb057 100644
--- a/drivers/ssb/b43_pci_bridge.c
+++ b/drivers/ssb/b43_pci_bridge.c
@@ -38,6 +38,7 @@ static const struct pci_device_id b43_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432b) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432c) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4350) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4351) },
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, b43_pci_bridge_tbl);
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index 2c486ea6236b..35b494f5667f 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -28,8 +28,6 @@ source "drivers/staging/et131x/Kconfig"
 
 source "drivers/staging/slicoss/Kconfig"
 
-source "drivers/staging/usbip/Kconfig"
-
 source "drivers/staging/wlan-ng/Kconfig"
 
 source "drivers/staging/comedi/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 1e1a3a10faf7..e66a5dbd9b02 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -6,7 +6,6 @@ obj-$(CONFIG_STAGING)		+= staging.o
 obj-y                           += media/
 obj-$(CONFIG_ET131X)            += et131x/
 obj-$(CONFIG_SLICOSS)           += slicoss/
-obj-$(CONFIG_USBIP_CORE)        += usbip/
 obj-$(CONFIG_PRISM2_USB)        += wlan-ng/
 obj-$(CONFIG_COMEDI)            += comedi/
 obj-$(CONFIG_FB_OLPC_DCON)      += olpc_dcon/
diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
index 9b47e66599a3..0bf0d24d12d5 100644
--- a/drivers/staging/android/logger.c
+++ b/drivers/staging/android/logger.c
@@ -790,7 +790,7 @@ static int __init create_log(char *log_name, int size)
         if (unlikely(ret)) {
                 pr_err("failed to register misc device for log '%s'!\n",
                                 log->misc.name);
-                goto out_free_log;
+                goto out_free_misc_name;
         }
 
         pr_info("created %luK log '%s'\n",
@@ -798,6 +798,9 @@ static int __init create_log(char *log_name, int size)
 
         return 0;
 
+out_free_misc_name:
+        kfree(log->misc.name);
+
 out_free_log:
         kfree(log);
 
diff --git a/drivers/staging/et131x/et131x.c b/drivers/staging/et131x/et131x.c
index 8bf1eb485163..831b7c6fe494 100644
--- a/drivers/staging/et131x/et131x.c
+++ b/drivers/staging/et131x/et131x.c
@@ -1421,22 +1421,16 @@ static int et131x_mii_read(struct et131x_adapter *adapter, u8 reg, u16 *value)
  * @reg: the register to read
  * @value: 16-bit value to write
  */
-static int et131x_mii_write(struct et131x_adapter *adapter, u8 reg, u16 value)
+static int et131x_mii_write(struct et131x_adapter *adapter, u8 addr, u8 reg,
+                            u16 value)
 {
         struct mac_regs __iomem *mac = &adapter->regs->mac;
-        struct phy_device *phydev = adapter->phydev;
         int status = 0;
-        u8 addr;
         u32 delay = 0;
         u32 mii_addr;
         u32 mii_cmd;
         u32 mii_indicator;
 
-        if (!phydev)
-                return -EIO;
-
-        addr = phydev->addr;
-
         /* Save a local copy of the registers we are dealing with so we can
          * set them back
          */
@@ -1631,17 +1625,7 @@ static int et131x_mdio_write(struct mii_bus *bus, int phy_addr,
         struct net_device *netdev = bus->priv;
         struct et131x_adapter *adapter = netdev_priv(netdev);
 
-        return et131x_mii_write(adapter, reg, value);
-}
-
-static int et131x_mdio_reset(struct mii_bus *bus)
-{
-        struct net_device *netdev = bus->priv;
-        struct et131x_adapter *adapter = netdev_priv(netdev);
-
-        et131x_mii_write(adapter, MII_BMCR, BMCR_RESET);
-
-        return 0;
+        return et131x_mii_write(adapter, phy_addr, reg, value);
 }
 
 /*      et1310_phy_power_switch -       PHY power control
@@ -1656,18 +1640,20 @@ static int et131x_mdio_reset(struct mii_bus *bus)
 static void et1310_phy_power_switch(struct et131x_adapter *adapter, bool down)
 {
         u16 data;
+        struct  phy_device *phydev = adapter->phydev;
 
         et131x_mii_read(adapter, MII_BMCR, &data);
         data &= ~BMCR_PDOWN;
         if (down)
                 data |= BMCR_PDOWN;
-        et131x_mii_write(adapter, MII_BMCR, data);
+        et131x_mii_write(adapter, phydev->addr, MII_BMCR, data);
 }
 
 /* et131x_xcvr_init - Init the phy if we are setting it into force mode */
 static void et131x_xcvr_init(struct et131x_adapter *adapter)
 {
         u16 lcr2;
+        struct  phy_device *phydev = adapter->phydev;
 
         /* Set the LED behavior such that LED 1 indicates speed (off =
          * 10Mbits, blink = 100Mbits, on = 1000Mbits) and LED 2 indicates
@@ -1688,7 +1674,7 @@ static void et131x_xcvr_init(struct et131x_adapter *adapter)
                 else
                         lcr2 |= (LED_VAL_LINKON << LED_TXRX_SHIFT);
 
-                et131x_mii_write(adapter, PHY_LED_2, lcr2);
+                et131x_mii_write(adapter, phydev->addr, PHY_LED_2, lcr2);
         }
 }
 
@@ -3643,14 +3629,14 @@ static void et131x_adjust_link(struct net_device *netdev)
 
                         et131x_mii_read(adapter, PHY_MPHY_CONTROL_REG,
                                          &register18);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18 | 0x4);
-                        et131x_mii_write(adapter, PHY_INDEX_REG,
+                        et131x_mii_write(adapter, phydev->addr,
+                                         PHY_MPHY_CONTROL_REG, register18 | 0x4);
+                        et131x_mii_write(adapter, phydev->addr, PHY_INDEX_REG,
                                          register18 | 0x8402);
-                        et131x_mii_write(adapter, PHY_DATA_REG,
+                        et131x_mii_write(adapter, phydev->addr, PHY_DATA_REG,
                                          register18 | 511);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18);
+                        et131x_mii_write(adapter, phydev->addr,
+                                         PHY_MPHY_CONTROL_REG, register18);
                 }
 
                 et1310_config_flow_control(adapter);
@@ -3662,7 +3648,8 @@ static void et131x_adjust_link(struct net_device *netdev)
                         et131x_mii_read(adapter, PHY_CONFIG, &reg);
                         reg &= ~ET_PHY_CONFIG_TX_FIFO_DEPTH;
                         reg |= ET_PHY_CONFIG_FIFO_DEPTH_32;
-                        et131x_mii_write(adapter, PHY_CONFIG, reg);
+                        et131x_mii_write(adapter, phydev->addr, PHY_CONFIG,
+                                         reg);
                 }
 
                 et131x_set_rx_dma_timer(adapter);
@@ -3675,14 +3662,14 @@ static void et131x_adjust_link(struct net_device *netdev)
 
                         et131x_mii_read(adapter, PHY_MPHY_CONTROL_REG,
                                          &register18);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18 | 0x4);
-                        et131x_mii_write(adapter, PHY_INDEX_REG,
-                                         register18 | 0x8402);
-                        et131x_mii_write(adapter, PHY_DATA_REG,
-                                         register18 | 511);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_MPHY_CONTROL_REG, register18 | 0x4);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_INDEX_REG, register18 | 0x8402);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_DATA_REG, register18 | 511);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_MPHY_CONTROL_REG, register18);
                 }
 
                 /* Free the packets being actively sent & stopped */
@@ -4644,10 +4631,6 @@ static int et131x_pci_setup(struct pci_dev *pdev,
         /* Copy address into the net_device struct */
         memcpy(netdev->dev_addr, adapter->addr, ETH_ALEN);
 
-        /* Init variable for counting how long we do not have link status */
-        adapter->boot_coma = 0;
-        et1310_disable_phy_coma(adapter);
-
         rc = -ENOMEM;
 
         /* Setup the mii_bus struct */
@@ -4663,7 +4646,6 @@ static int et131x_pci_setup(struct pci_dev *pdev,
         adapter->mii_bus->priv = netdev;
         adapter->mii_bus->read = et131x_mdio_read;
         adapter->mii_bus->write = et131x_mdio_write;
-        adapter->mii_bus->reset = et131x_mdio_reset;
         adapter->mii_bus->irq = kmalloc_array(PHY_MAX_ADDR, sizeof(int),
                                               GFP_KERNEL);
         if (!adapter->mii_bus->irq)
@@ -4687,6 +4669,10 @@ static int et131x_pci_setup(struct pci_dev *pdev,
         /* Setup et1310 as per the documentation */
         et131x_adapter_setup(adapter);
 
+        /* Init variable for counting how long we do not have link status */
+        adapter->boot_coma = 0;
+        et1310_disable_phy_coma(adapter);
+
         /* We can enable interrupts now
          *
          *  NOTE - Because registration of interrupt handler is done in the
diff --git a/drivers/staging/lustre/lustre/libcfs/workitem.c b/drivers/staging/lustre/lustre/libcfs/workitem.c
index 65629579bd7d..03ab9e046784 100644
--- a/drivers/staging/lustre/lustre/libcfs/workitem.c
+++ b/drivers/staging/lustre/lustre/libcfs/workitem.c
@@ -365,6 +365,7 @@ cfs_wi_sched_create(char *name, struct cfs_cpt_table *cptab,
                 return -ENOMEM;
 
         strncpy(sched->ws_name, name, CFS_WS_NAME_LEN);
+        sched->ws_name[CFS_WS_NAME_LEN - 1] = '\0';
         sched->ws_cptab = cptab;
         sched->ws_cpt = cpt;
 
diff --git a/drivers/staging/lustre/lustre/obdclass/class_obd.c b/drivers/staging/lustre/lustre/obdclass/class_obd.c
index 8b19f3caa68f..701c6a776524 100644
--- a/drivers/staging/lustre/lustre/obdclass/class_obd.c
+++ b/drivers/staging/lustre/lustre/obdclass/class_obd.c
@@ -35,7 +35,7 @@
  */
 
 #define DEBUG_SUBSYSTEM S_CLASS
-# include <asm/atomic.h>
+# include <linux/atomic.h>
 
 #include "../include/obd_support.h"
 #include "../include/obd_class.h"
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index b8676ac77b0c..407a318b09db 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -43,9 +43,11 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */
         /*=== Customer ID ===*/
         /****** 8188EUS ********/
+        {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
         {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+        {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
         {}      /* Terminating entry */
 };
 
diff --git a/drivers/thunderbolt/path.c b/drivers/thunderbolt/path.c
index 8fcf8a7b6c22..9562cd026dc0 100644
--- a/drivers/thunderbolt/path.c
+++ b/drivers/thunderbolt/path.c
@@ -150,7 +150,26 @@ int tb_path_activate(struct tb_path *path)
 
         /* Activate hops. */
         for (i = path->path_length - 1; i >= 0; i--) {
-                struct tb_regs_hop hop;
+                struct tb_regs_hop hop = { 0 };
+
+                /*
+                 * We do (currently) not tear down paths setup by the firmeware.
+                 * If a firmware device is unplugged and plugged in again then
+                 * it can happen that we reuse some of the hops from the (now
+                 * defunct) firmeware path. This causes the hotplug operation to
+                 * fail (the pci device does not show up). Clearing the hop
+                 * before overwriting it fixes the problem.
+                 *
+                 * Should be removed once we discover and tear down firmeware
+                 * paths.
+                 */
+                res = tb_port_write(path->hops[i].in_port, &hop, TB_CFG_HOPS,
+                                    2 * path->hops[i].in_hop_index, 2);
+                if (res) {
+                        __tb_path_deactivate_hops(path, i);
+                        __tb_path_deallocate_nfc(path, 0);
+                        goto err;
+                }
 
                 /* dword 0 */
                 hop.next_hop = path->hops[i].next_hop_index;
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index e0cad4418085..cf1b19bca306 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -92,6 +92,8 @@ source "drivers/usb/storage/Kconfig"
 
 source "drivers/usb/image/Kconfig"
 
+source "drivers/usb/usbip/Kconfig"
+
 endif
 
 source "drivers/usb/musb/Kconfig"
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 3cba892b83a2..d7be71778059 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -60,3 +60,5 @@ obj-$(CONFIG_USB_RENESAS_USBHS)	+= renesas_usbhs/
 obj-$(CONFIG_USB_GADGET)        += gadget/
 
 obj-$(CONFIG_USB_COMMON)        += common/
+
+obj-$(CONFIG_USBIP_CORE)        += usbip/
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 8a4dcbc7a75f..46f5161c7891 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1728,8 +1728,14 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
          * - Change autosuspend delay of hub can avoid unnecessary auto
          *   suspend timer for hub, also may decrease power consumption
          *   of USB bus.
+         *
+         * - If user has indicated to prevent autosuspend by passing
+         *   usbcore.autosuspend = -1 then keep autosuspend disabled.
          */
-        pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
+#ifdef CONFIG_PM_RUNTIME
+        if (hdev->dev.power.autosuspend_delay >= 0)
+                pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
+#endif
 
         /*
          * Hubs have proper suspend/resume support, except for root hubs
@@ -2107,8 +2113,8 @@ void usb_disconnect(struct usb_device **pdev)
 {
         struct usb_port *port_dev = NULL;
         struct usb_device *udev = *pdev;
-        struct usb_hub *hub;
-        int port1;
+        struct usb_hub *hub = NULL;
+        int port1 = 1;
 
         /* mark the device as inactive, so any further urb submissions for
          * this device (and any of its children) will fail immediately.
@@ -4631,9 +4637,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                         if (status != -ENODEV &&
                                 port1 != unreliable_port &&
                                 printk_ratelimit())
-                                dev_err(&udev->dev, "connect-debounce failed, port %d disabled\n",
-                                        port1);
-
+                                dev_err(&port_dev->dev, "connect-debounce failed\n");
                         portstatus &= ~USB_PORT_STAT_CONNECTION;
                         unreliable_port = port1;
                 } else {
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0ba9c335b584..7c9618e916e2 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1901,7 +1901,7 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
 static void s3c_hsotg_irq_enumdone(struct s3c_hsotg *hsotg)
 {
         u32 dsts = readl(hsotg->regs + DSTS);
-        int ep0_mps = 0, ep_mps;
+        int ep0_mps = 0, ep_mps = 8;
 
         /*
          * This should signal the finish of the enumeration phase
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index ef4936ff626c..9dcfbe7cd5f5 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -425,7 +425,7 @@ static void dwc3_omap_set_utmi_mode(struct dwc3_omap *omap)
 
 static int dwc3_omap_extcon_register(struct dwc3_omap *omap)
 {
-        u32                     ret;
+        int                     ret;
         struct device_node      *node = omap->dev->of_node;
         struct extcon_dev       *edev;
 
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index a186afeaa700..9add915d41f7 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -3,7 +3,7 @@
 #
 subdir-ccflags-$(CONFIG_USB_GADGET_DEBUG)       := -DDEBUG
 subdir-ccflags-$(CONFIG_USB_GADGET_VERBOSE)     += -DVERBOSE_DEBUG
-ccflags-y                               += -I$(PWD)/drivers/usb/gadget/udc
+ccflags-y                               += -Idrivers/usb/gadget/udc
 
 obj-$(CONFIG_USB_LIBCOMPOSITE)  += libcomposite.o
 libcomposite-y                  := usbstring.o config.o epautoconf.o
diff --git a/drivers/usb/gadget/function/Makefile b/drivers/usb/gadget/function/Makefile
index 6d91f21b52a6..83ae1065149d 100644
--- a/drivers/usb/gadget/function/Makefile
+++ b/drivers/usb/gadget/function/Makefile
@@ -2,8 +2,8 @@
 # USB peripheral controller drivers
 #
 
-ccflags-y                       := -I$(PWD)/drivers/usb/gadget/
-ccflags-y                       += -I$(PWD)/drivers/usb/gadget/udc/
+ccflags-y                       := -Idrivers/usb/gadget/
+ccflags-y                       += -Idrivers/usb/gadget/udc/
 
 # USB Functions
 usb_f_acm-y                     := f_acm.o
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index d50adda913cf..6e6f87656e7b 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -1127,10 +1127,7 @@ void gether_disconnect(struct gether *link)
 
         DBG(dev, "%s\n", __func__);
 
-        netif_tx_lock(dev->net);
         netif_stop_queue(dev->net);
-        netif_tx_unlock(dev->net);
-
         netif_carrier_off(dev->net);
 
         /* disable endpoints, forcing (synchronous) completion
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 71e896d4c5ae..a5eb9a3fbb7a 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -195,6 +195,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
                 printk(KERN_INFO "Failed to queue request (%d).\n", ret);
                 usb_ep_set_halt(ep);
                 spin_unlock_irqrestore(&video->queue.irqlock, flags);
+                uvc_queue_cancel(queue, 0);
                 goto requeue;
         }
         spin_unlock_irqrestore(&video->queue.irqlock, flags);
@@ -281,6 +282,7 @@ error:
 static int
 uvc_video_pump(struct uvc_video *video)
 {
+        struct uvc_video_queue *queue = &video->queue;
         struct usb_request *req;
         struct uvc_buffer *buf;
         unsigned long flags;
@@ -322,6 +324,7 @@ uvc_video_pump(struct uvc_video *video)
                         printk(KERN_INFO "Failed to queue request (%d)\n", ret);
                         usb_ep_set_halt(video->ep);
                         spin_unlock_irqrestore(&video->queue.irqlock, flags);
+                        uvc_queue_cancel(queue, 0);
                         break;
                 }
                 spin_unlock_irqrestore(&video->queue.irqlock, flags);
diff --git a/drivers/usb/gadget/legacy/Makefile b/drivers/usb/gadget/legacy/Makefile
index a11aad5635df..edba2d1ee0f3 100644
--- a/drivers/usb/gadget/legacy/Makefile
+++ b/drivers/usb/gadget/legacy/Makefile
@@ -2,9 +2,9 @@
 # USB gadget drivers
 #
 
-ccflags-y                       := -I$(PWD)/drivers/usb/gadget/
-ccflags-y                       += -I$(PWD)/drivers/usb/gadget/udc/
-ccflags-y                       += -I$(PWD)/drivers/usb/gadget/function/
+ccflags-y                       := -Idrivers/usb/gadget/
+ccflags-y                       += -Idrivers/usb/gadget/udc/
+ccflags-y                       += -Idrivers/usb/gadget/function/
 
 g_zero-y                        := zero.o
 g_audio-y                       := audio.o
diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
index 986fc511a2ed..225e385a6160 100644
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -222,10 +222,12 @@ static void dbgp_unbind(struct usb_gadget *gadget)
 {
 #ifdef CONFIG_USB_G_DBGP_SERIAL
         kfree(dbgp.serial);
+        dbgp.serial = NULL;
 #endif
         if (dbgp.req) {
                 kfree(dbgp.req->buf);
                 usb_ep_free_request(gadget->ep0, dbgp.req);
+                dbgp.req = NULL;
         }
 
         gadget->ep0->driver_data = NULL;
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 2e4ce7704908..e96077b8bf79 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -440,7 +440,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
         value = -ENOMEM;
         kbuf = memdup_user(buf, len);
-        if (!kbuf) {
+        if (IS_ERR(kbuf)) {
                 value = PTR_ERR(kbuf);
                 goto free1;
         }
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 5151f947a4f5..34ebaa68504c 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -332,7 +332,7 @@ config USB_GOKU
            gadget drivers to also be dynamically linked.
 
 config USB_EG20T
-        tristate "Intel EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
+        tristate "Intel QUARK X1000/EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
         depends on PCI
         help
           This is a USB device driver for EG20T PCH.
@@ -353,6 +353,7 @@ config USB_EG20T
           ML7213/ML7831 is companion chip for Intel Atom E6xx series.
           ML7213/ML7831 is completely compatible for Intel EG20T PCH.
 
+          This driver can be used with Intel's Quark X1000 SOC platform
 #
 # LAST -- dummy/emulated controller
 #
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 906e65f0e4fa..c9fe67e29d35 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -1661,7 +1661,7 @@ static irqreturn_t usba_udc_irq(int irq, void *devid)
         if (dma_status) {
                 int i;
 
-                for (i = 1; i < USBA_NR_DMAS; i++)
+                for (i = 1; i <= USBA_NR_DMAS; i++)
                         if (dma_status & (1 << i))
                                 usba_dma_irq(udc, &udc->usba_ep[i]);
         }
diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
index d40255f784df..5c5d1adda7eb 100644
--- a/drivers/usb/gadget/udc/fusb300_udc.c
+++ b/drivers/usb/gadget/udc/fusb300_udc.c
@@ -1398,13 +1398,17 @@ static int fusb300_probe(struct platform_device *pdev)
 
         /* initialize udc */
         fusb300 = kzalloc(sizeof(struct fusb300), GFP_KERNEL);
-        if (fusb300 == NULL)
+        if (fusb300 == NULL) {
+                ret = -ENOMEM;
                 goto clean_up;
+        }
 
         for (i = 0; i < FUSB300_MAX_NUM_EP; i++) {
                 _ep[i] = kzalloc(sizeof(struct fusb300_ep), GFP_KERNEL);
-                if (_ep[i] == NULL)
+                if (_ep[i] == NULL) {
+                        ret = -ENOMEM;
                         goto clean_up;
+                }
                 fusb300->ep[i] = _ep[i];
         }
 
diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index eb8c3bedb57a..460d953c91b6 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -343,6 +343,7 @@ struct pch_vbus_gpio_data {
  * @setup_data:         Received setup data
  * @phys_addr:          of device memory
  * @base_addr:          for mapped device memory
+ * @bar:                Indicates which PCI BAR for USB regs
  * @irq:                IRQ line for the device
  * @cfg_data:           current cfg, intf, and alt in use
  * @vbus_gpio:          GPIO informaton for detecting VBUS
@@ -370,14 +371,17 @@ struct pch_udc_dev {
         struct usb_ctrlrequest          setup_data;
         unsigned long                   phys_addr;
         void __iomem                    *base_addr;
+        unsigned                        bar;
         unsigned                        irq;
         struct pch_udc_cfg_data         cfg_data;
         struct pch_vbus_gpio_data       vbus_gpio;
 };
 #define to_pch_udc(g)   (container_of((g), struct pch_udc_dev, gadget))
 
+#define PCH_UDC_PCI_BAR_QUARK_X1000     0
 #define PCH_UDC_PCI_BAR                 1
 #define PCI_DEVICE_ID_INTEL_EG20T_UDC   0x8808
+#define PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC     0x0939
 #define PCI_VENDOR_ID_ROHM              0x10DB
 #define PCI_DEVICE_ID_ML7213_IOH_UDC    0x801D
 #define PCI_DEVICE_ID_ML7831_IOH_UDC    0x8808
@@ -3076,7 +3080,7 @@ static void pch_udc_remove(struct pci_dev *pdev)
                 iounmap(dev->base_addr);
         if (dev->mem_region)
                 release_mem_region(dev->phys_addr,
-                                   pci_resource_len(pdev, PCH_UDC_PCI_BAR));
+                                   pci_resource_len(pdev, dev->bar));
         if (dev->active)
                 pci_disable_device(pdev);
         kfree(dev);
@@ -3144,9 +3148,15 @@ static int pch_udc_probe(struct pci_dev *pdev,
         dev->active = 1;
         pci_set_drvdata(pdev, dev);
 
+        /* Determine BAR based on PCI ID */
+        if (id->device == PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC)
+                dev->bar = PCH_UDC_PCI_BAR_QUARK_X1000;
+        else
+                dev->bar = PCH_UDC_PCI_BAR;
+
         /* PCI resource allocation */
-        resource = pci_resource_start(pdev, 1);
-        len = pci_resource_len(pdev, 1);
+        resource = pci_resource_start(pdev, dev->bar);
+        len = pci_resource_len(pdev, dev->bar);
 
         if (!request_mem_region(resource, len, KBUILD_MODNAME)) {
                 dev_err(&pdev->dev, "%s: pci device used already\n", __func__);
@@ -3212,6 +3222,12 @@ finished:
 
 static const struct pci_device_id pch_udc_pcidev_id[] = {
         {
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL,
+                           PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC),
+                .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
+                .class_mask = 0xffffffff,
+        },
+        {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_EG20T_UDC),
                 .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
                 .class_mask = 0xffffffff,
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index 46008421c1ec..de2a8713b428 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1868,8 +1868,8 @@ static int r8a66597_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         reg = devm_ioremap_resource(&pdev->dev, res);
-        if (!reg)
-                return -ENODEV;
+        if (IS_ERR(reg))
+                return PTR_ERR(reg);
 
         ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         irq = ires->start;
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index cc305c71ac3d..6130b7574908 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1230,7 +1230,7 @@ int ehci_hub_control(
                         if (selector == EHSET_TEST_SINGLE_STEP_SET_FEATURE) {
                                 spin_unlock_irqrestore(&ehci->lock, flags);
                                 retval = ehset_single_step_set_feature(hcd,
-                                                                        wIndex);
+                                                                wIndex + 1);
                                 spin_lock_irqsave(&ehci->lock, flags);
                                 break;
                         }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 687d36608155..c22a3e15a16e 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -101,6 +101,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         /* AMD PLL quirk */
         if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                 xhci->quirks |= XHCI_AMD_PLL_FIX;
+
+        if (pdev->vendor == PCI_VENDOR_ID_AMD)
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
@@ -151,6 +155,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_VIA)
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
 
+        /* See https://bugzilla.kernel.org/show_bug.cgi?id=79511 */
+        if (pdev->vendor == PCI_VENDOR_ID_VIA &&
+                        pdev->device == 0x3432)
+                xhci->quirks |= XHCI_BROKEN_STREAMS;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 60fb52ae864b..abed30b82905 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -364,32 +364,6 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
         }
 }
 
-/*
- * Find the segment that trb is in.  Start searching in start_seg.
- * If we must move past a segment that has a link TRB with a toggle cycle state
- * bit set, then we will toggle the value pointed at by cycle_state.
- */
-static struct xhci_segment *find_trb_seg(
-                struct xhci_segment *start_seg,
-                union xhci_trb  *trb, int *cycle_state)
-{
-        struct xhci_segment *cur_seg = start_seg;
-        struct xhci_generic_trb *generic_trb;
-
-        while (cur_seg->trbs > trb ||
-                        &cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) {
-                generic_trb = &cur_seg->trbs[TRBS_PER_SEGMENT - 1].generic;
-                if (generic_trb->field[3] & cpu_to_le32(LINK_TOGGLE))
-                        *cycle_state ^= 0x1;
-                cur_seg = cur_seg->next;
-                if (cur_seg == start_seg)
-                        /* Looped over the entire list.  Oops! */
-                        return NULL;
-        }
-        return cur_seg;
-}
-
-
 static struct xhci_ring *xhci_triad_to_transfer_ring(struct xhci_hcd *xhci,
                 unsigned int slot_id, unsigned int ep_index,
                 unsigned int stream_id)
@@ -459,9 +433,12 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
         struct xhci_virt_device *dev = xhci->devs[slot_id];
         struct xhci_virt_ep *ep = &dev->eps[ep_index];
         struct xhci_ring *ep_ring;
-        struct xhci_generic_trb *trb;
+        struct xhci_segment *new_seg;
+        union xhci_trb *new_deq;
         dma_addr_t addr;
         u64 hw_dequeue;
+        bool cycle_found = false;
+        bool td_last_trb_found = false;
 
         ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
                         ep_index, stream_id);
@@ -486,45 +463,45 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                 hw_dequeue = le64_to_cpu(ep_ctx->deq);
         }
 
-        /* Find virtual address and segment of hardware dequeue pointer */
-        state->new_deq_seg = ep_ring->deq_seg;
-        state->new_deq_ptr = ep_ring->dequeue;
-        while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
-                        != (dma_addr_t)(hw_dequeue & ~0xf)) {
-                next_trb(xhci, ep_ring, &state->new_deq_seg,
-                                        &state->new_deq_ptr);
-                if (state->new_deq_ptr == ep_ring->dequeue) {
-                        WARN_ON(1);
-                        return;
-                }
-        }
+        new_seg = ep_ring->deq_seg;
+        new_deq = ep_ring->dequeue;
+        state->new_cycle_state = hw_dequeue & 0x1;
+
         /*
-         * Find cycle state for last_trb, starting at old cycle state of
-         * hw_dequeue. If there is only one segment ring, find_trb_seg() will
-         * return immediately and cannot toggle the cycle state if this search
-         * wraps around, so add one more toggle manually in that case.
+         * We want to find the pointer, segment and cycle state of the new trb
+         * (the one after current TD's last_trb). We know the cycle state at
+         * hw_dequeue, so walk the ring until both hw_dequeue and last_trb are
+         * found.
          */
-        state->new_cycle_state = hw_dequeue & 0x1;
-        if (ep_ring->first_seg == ep_ring->first_seg->next &&
-                        cur_td->last_trb < state->new_deq_ptr)
-                state->new_cycle_state ^= 0x1;
+        do {
+                if (!cycle_found && xhci_trb_virt_to_dma(new_seg, new_deq)
+                    == (dma_addr_t)(hw_dequeue & ~0xf)) {
+                        cycle_found = true;
+                        if (td_last_trb_found)
+                                break;
+                }
+                if (new_deq == cur_td->last_trb)
+                        td_last_trb_found = true;
 
-        state->new_deq_ptr = cur_td->last_trb;
-        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
-                        "Finding segment containing last TRB in TD.");
-        state->new_deq_seg = find_trb_seg(state->new_deq_seg,
-                        state->new_deq_ptr, &state->new_cycle_state);
-        if (!state->new_deq_seg) {
-                WARN_ON(1);
-                return;
-        }
+                if (cycle_found &&
+                    TRB_TYPE_LINK_LE32(new_deq->generic.field[3]) &&
+                    new_deq->generic.field[3] & cpu_to_le32(LINK_TOGGLE))
+                        state->new_cycle_state ^= 0x1;
+
+                next_trb(xhci, ep_ring, &new_seg, &new_deq);
+
+                /* Search wrapped around, bail out */
+                if (new_deq == ep->ring->dequeue) {
+                        xhci_err(xhci, "Error: Failed finding new dequeue state\n");
+                        state->new_deq_seg = NULL;
+                        state->new_deq_ptr = NULL;
+                        return;
+                }
+
+        } while (!cycle_found || !td_last_trb_found);
 
-        /* Increment to find next TRB after last_trb. Cycle if appropriate. */
-        trb = &state->new_deq_ptr->generic;
-        if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
-            (trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
-                state->new_cycle_state ^= 0x1;
-        next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
+        state->new_deq_seg = new_seg;
+        state->new_deq_ptr = new_deq;
 
         /* Don't update the ring cycle state for the producer (us). */
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
@@ -2487,7 +2464,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                  * last TRB of the previous TD. The command completion handle
                  * will take care the rest.
                  */
-                if (!event_seg && trb_comp_code == COMP_STOP_INVAL) {
+                if (!event_seg && (trb_comp_code == COMP_STOP ||
+                                   trb_comp_code == COMP_STOP_INVAL)) {
                         ret = 0;
                         goto cleanup;
                 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b6f21175b872..c020b094fe7d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2880,6 +2880,9 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
                         ep_index, ep->stopped_stream, ep->stopped_td,
                         &deq_state);
 
+        if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg)
+                return;
+
         /* HW with the reset endpoint quirk will use the saved dequeue state to
          * issue a configure endpoint command later.
          */
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 06b5d77cd9ad..633caf643122 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3250,6 +3250,7 @@ static const struct usb_device_id sisusb_table[] = {
         { USB_DEVICE(0x0711, 0x0918) },
         { USB_DEVICE(0x0711, 0x0920) },
         { USB_DEVICE(0x0711, 0x0950) },
+        { USB_DEVICE(0x0711, 0x5200) },
         { USB_DEVICE(0x182d, 0x021c) },
         { USB_DEVICE(0x182d, 0x0269) },
         { }
diff --git a/drivers/usb/musb/ux500_dma.c b/drivers/usb/musb/ux500_dma.c
index 9aad00f11bd5..221faed9f074 100644
--- a/drivers/usb/musb/ux500_dma.c
+++ b/drivers/usb/musb/ux500_dma.c
@@ -96,7 +96,7 @@ static bool ux500_configure_channel(struct dma_channel *channel,
         struct musb *musb = ux500_channel->controller->private_data;
 
         dev_dbg(musb->controller,
-                "packet_sz=%d, mode=%d, dma_addr=0x%llu, len=%d is_tx=%d\n",
+                "packet_sz=%d, mode=%d, dma_addr=0x%llx, len=%d is_tx=%d\n",
                 packet_sz, mode, (unsigned long long) dma_addr,
                 len, ux500_channel->is_tx);
 
diff --git a/drivers/usb/phy/phy-gpio-vbus-usb.c b/drivers/usb/phy/phy-gpio-vbus-usb.c
index ea9e705555df..f4b14bd97e14 100644
--- a/drivers/usb/phy/phy-gpio-vbus-usb.c
+++ b/drivers/usb/phy/phy-gpio-vbus-usb.c
@@ -260,10 +260,8 @@ static int gpio_vbus_probe(struct platform_device *pdev)
 
         gpio_vbus->phy.otg = devm_kzalloc(&pdev->dev, sizeof(struct usb_otg),
                                           GFP_KERNEL);
-        if (!gpio_vbus->phy.otg) {
-                kfree(gpio_vbus);
+        if (!gpio_vbus->phy.otg)
                 return -ENOMEM;
-        }
 
         platform_set_drvdata(pdev, gpio_vbus);
         gpio_vbus->dev = &pdev->dev;
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index e4108eec5ef4..afc09087ec36 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -1601,8 +1601,8 @@ static int msm_otg_probe(struct platform_device *pdev)
          */
         if (motg->phy_number) {
                 phy_select = devm_ioremap_nocache(&pdev->dev, USB2_PHY_SEL, 4);
-                if (IS_ERR(phy_select))
-                        return PTR_ERR(phy_select);
+                if (!phy_select)
+                        return -ENOMEM;
                 /* Enable second PHY with the OTG port */
                 writel(0x1, phy_select);
         }
diff --git a/drivers/usb/phy/phy-samsung-usb.h b/drivers/usb/phy/phy-samsung-usb.h
index 68771bfd1825..80eedd45a20a 100644
--- a/drivers/usb/phy/phy-samsung-usb.h
+++ b/drivers/usb/phy/phy-samsung-usb.h
@@ -216,7 +216,7 @@
 
 #define EXYNOS5_DRD_PHYPARAM1                   (0x20)
 
-#define PHYPARAM1_PCS_TXDEEMPH_MASK             (0x1f << 0)
+#define PHYPARAM1_PCS_TXDEEMPH_MASK             (0x3f << 0)
 #define PHYPARAM1_PCS_TXDEEMPH                  (0x1c)
 
 #define EXYNOS5_DRD_PHYTERM                     (0x24)
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index 6d0f6080eceb..045cd309367a 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -232,6 +232,9 @@ struct usb_phy *usb_get_phy_dev(struct device *dev, u8 index)
         phy = __usb_find_phy_dev(dev, &phy_bind_list, index);
         if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
                 dev_dbg(dev, "unable to find transceiver\n");
+                if (!IS_ERR(phy))
+                        phy = ERR_PTR(-ENODEV);
+
                 goto err0;
         }
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 216ce3078270..824ea5e7ec8b 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -146,6 +146,7 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_BM_ATOM_NANO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
@@ -934,6 +935,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
         { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
         { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+        /* ekey Devices */
+        { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
         /* Infineon Devices */
         { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
         { }                                     /* Terminating entry */
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1e58d90a0b6c..70b0b1d88ae9 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -42,6 +42,8 @@
 /* www.candapter.com Ewert Energy Systems CANdapter device */
 #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
 
+#define FTDI_BM_ATOM_NANO_PID   0xa559  /* Basic Micro ATOM Nano USB2Serial */
+
 /*
  * Texas Instruments XDS100v2 JTAG / BeagleBone A3
  * http://processors.wiki.ti.com/index.php/XDS100
@@ -1378,3 +1380,8 @@
 #define BRAINBOXES_US_160_6_PID         0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
 #define BRAINBOXES_US_160_7_PID         0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
 #define BRAINBOXES_US_160_8_PID         0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
+
+/*
+ * ekey biometric systems GmbH (http://ekey.net/)
+ */
+#define FTDI_EKEY_CONV_USB_PID          0xCB08  /* Converter USB */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index a9688940543d..54a8120897a6 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -275,8 +275,12 @@ static void option_instat_callback(struct urb *urb);
 #define ZTE_PRODUCT_MF622                       0x0001
 #define ZTE_PRODUCT_MF628                       0x0015
 #define ZTE_PRODUCT_MF626                       0x0031
-#define ZTE_PRODUCT_MC2718                      0xffe8
 #define ZTE_PRODUCT_AC2726                      0xfff1
+#define ZTE_PRODUCT_CDMA_TECH                   0xfffe
+#define ZTE_PRODUCT_AC8710T                     0xffff
+#define ZTE_PRODUCT_MC2718                      0xffe8
+#define ZTE_PRODUCT_AD3812                      0xffeb
+#define ZTE_PRODUCT_MC2716                      0xffed
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -494,6 +498,10 @@ static void option_instat_callback(struct urb *urb);
 #define INOVIA_VENDOR_ID                        0x20a6
 #define INOVIA_SEW858                           0x1105
 
+/* VIA Telecom */
+#define VIATELECOM_VENDOR_ID                    0x15eb
+#define VIATELECOM_PRODUCT_CDS7                 0x0001
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -527,10 +535,18 @@ static const struct option_blacklist_info zte_k3765_z_blacklist = {
         .reserved = BIT(4),
 };
 
+static const struct option_blacklist_info zte_ad3812_z_blacklist = {
+        .sendsetup = BIT(0) | BIT(1) | BIT(2),
+};
+
 static const struct option_blacklist_info zte_mc2718_z_blacklist = {
         .sendsetup = BIT(1) | BIT(2) | BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info zte_mc2716_z_blacklist = {
+        .sendsetup = BIT(1) | BIT(2) | BIT(3),
+};
+
 static const struct option_blacklist_info huawei_cdc12_blacklist = {
         .reserved = BIT(1) | BIT(2),
 };
@@ -1070,6 +1086,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_INTERFACE_CLASS(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1012, 0xff) },
         { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
         { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
@@ -1544,13 +1561,18 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
 
-        /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff),
          .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff),
+         .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
+         .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
 
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
@@ -1724,6 +1746,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+        { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
@@ -1916,6 +1939,8 @@ static void option_instat_callback(struct urb *urb)
                         dev_dbg(dev, "%s: type %x req %x\n", __func__,
                                 req_pkt->bRequestType, req_pkt->bRequest);
                 }
+        } else if (status == -ENOENT || status == -ESHUTDOWN) {
+                dev_dbg(dev, "%s: urb stopped: %d\n", __func__, status);
         } else
                 dev_err(dev, "%s: error %d\n", __func__, status);
 
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index b3d5a35c0d4b..e9bad928039f 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -45,6 +45,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 42bc082896ac..71fd9da1d6e7 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -22,6 +22,7 @@
 #define PL2303_PRODUCT_ID_GPRS          0x0609
 #define PL2303_PRODUCT_ID_HCR331        0x331a
 #define PL2303_PRODUCT_ID_MOTOROLA      0x0307
+#define PL2303_PRODUCT_ID_ZTEK          0xe1f1
 
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 02de3110fe94..475723c006f9 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_interface *interface,
                 if (usb_endpoint_is_bulk_in(endpoint)) {
                         /* we found a bulk in endpoint */
                         dev_dbg(ddev, "found bulk in on endpoint %d\n", i);
-                        bulk_in_endpoint[num_bulk_in] = endpoint;
-                        ++num_bulk_in;
+                        if (num_bulk_in < MAX_NUM_PORTS) {
+                                bulk_in_endpoint[num_bulk_in] = endpoint;
+                                ++num_bulk_in;
+                        }
                 }
 
                 if (usb_endpoint_is_bulk_out(endpoint)) {
                         /* we found a bulk out endpoint */
                         dev_dbg(ddev, "found bulk out on endpoint %d\n", i);
-                        bulk_out_endpoint[num_bulk_out] = endpoint;
-                        ++num_bulk_out;
+                        if (num_bulk_out < MAX_NUM_PORTS) {
+                                bulk_out_endpoint[num_bulk_out] = endpoint;
+                                ++num_bulk_out;
+                        }
                 }
 
                 if (usb_endpoint_is_int_in(endpoint)) {
                         /* we found a interrupt in endpoint */
                         dev_dbg(ddev, "found interrupt in on endpoint %d\n", i);
-                        interrupt_in_endpoint[num_interrupt_in] = endpoint;
-                        ++num_interrupt_in;
+                        if (num_interrupt_in < MAX_NUM_PORTS) {
+                                interrupt_in_endpoint[num_interrupt_in] =
+                                                endpoint;
+                                ++num_interrupt_in;
+                        }
                 }
 
                 if (usb_endpoint_is_int_out(endpoint)) {
                         /* we found an interrupt out endpoint */
                         dev_dbg(ddev, "found interrupt out on endpoint %d\n", i);
-                        interrupt_out_endpoint[num_interrupt_out] = endpoint;
-                        ++num_interrupt_out;
+                        if (num_interrupt_out < MAX_NUM_PORTS) {
+                                interrupt_out_endpoint[num_interrupt_out] =
+                                                endpoint;
+                                ++num_interrupt_out;
+                        }
                 }
         }
 
@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_interface *interface,
                                 if (usb_endpoint_is_int_in(endpoint)) {
                                         /* we found a interrupt in endpoint */
                                         dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n");
-                                        interrupt_in_endpoint[num_interrupt_in] = endpoint;
-                                        ++num_interrupt_in;
+                                        if (num_interrupt_in < MAX_NUM_PORTS) {
+                                                interrupt_in_endpoint[num_interrupt_in] = endpoint;
+                                                ++num_interrupt_in;
+                                        }
                                 }
                         }
                 }
@@ -850,6 +862,11 @@ static int usb_serial_probe(struct usb_interface *interface,
                         num_ports = type->num_ports;
         }
 
+        if (num_ports > MAX_NUM_PORTS) {
+                dev_warn(ddev, "too many ports requested: %d\n", num_ports);
+                num_ports = MAX_NUM_PORTS;
+        }
+
         serial->num_ports = num_ports;
         serial->num_bulk_in = num_bulk_in;
         serial->num_bulk_out = num_bulk_out;
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index e62f2dff8b7d..6c3734d2b45a 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -514,6 +514,10 @@ static void command_port_read_callback(struct urb *urb)
                 dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
                 return;
         }
+        if (!urb->actual_length) {
+                dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
+                return;
+        }
         if (status) {
                 dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
                 if (status != -ENOENT)
@@ -534,7 +538,8 @@ static void command_port_read_callback(struct urb *urb)
                 /* These are unsolicited reports from the firmware, hence no
                    waiting command to wakeup */
                 dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
-        } else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
+        } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
+                (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
                 memcpy(command_info->result_buffer, &data[1],
                                                 urb->actual_length - 1);
                 command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
diff --git a/drivers/usb/serial/zte_ev.c b/drivers/usb/serial/zte_ev.c
index e40ab739c4a6..1a132e9e947a 100644
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -272,28 +272,8 @@ static void zte_ev_usb_serial_close(struct usb_serial_port *port)
 }
 
 static const struct usb_device_id id_table[] = {
-        /* AC8710, AC8710T */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffff, 0xff, 0xff, 0xff) },
-         /* AC8700 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfffe, 0xff, 0xff, 0xff) },
         /* MG880 */
         { USB_DEVICE(0x19d2, 0xfffd) },
-        { USB_DEVICE(0x19d2, 0xfffc) },
-        { USB_DEVICE(0x19d2, 0xfffb) },
-        /* AC8710_V3 */
-        { USB_DEVICE(0x19d2, 0xfff6) },
-        { USB_DEVICE(0x19d2, 0xfff7) },
-        { USB_DEVICE(0x19d2, 0xfff8) },
-        { USB_DEVICE(0x19d2, 0xfff9) },
-        { USB_DEVICE(0x19d2, 0xffee) },
-        /* AC2716, MC2716 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffed, 0xff, 0xff, 0xff) },
-        /* AD3812 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffeb, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(0x19d2, 0xffec) },
-        { USB_DEVICE(0x05C6, 0x3197) },
-        { USB_DEVICE(0x05C6, 0x6000) },
-        { USB_DEVICE(0x05C6, 0x9008) },
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 80a5b366255f..7ef99b2f3aaf 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -922,6 +922,12 @@ UNUSUAL_DEV(  0x069b, 0x3004, 0x0001, 0x0001,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
+UNUSUAL_DEV(  0x06ca, 0x2003, 0x0100, 0x0100,
+                "Newer Technology",
+                "uSCSI",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+                US_FL_SCM_MULT_TARG ),
+
 /* Reported by Adrian Pilchowiec <adi1981@epf.pl> */
 UNUSUAL_DEV(  0x071b, 0x3203, 0x0000, 0x0000,
                 "RockChip",
diff --git a/drivers/staging/usbip/Kconfig b/drivers/usb/usbip/Kconfig
index bd99e9e47e50..bd99e9e47e50 100644
--- a/drivers/staging/usbip/Kconfig
+++ b/drivers/usb/usbip/Kconfig
diff --git a/drivers/staging/usbip/Makefile b/drivers/usb/usbip/Makefile
index 9ecd61545be1..9ecd61545be1 100644
--- a/drivers/staging/usbip/Makefile
+++ b/drivers/usb/usbip/Makefile
diff --git a/drivers/staging/usbip/README b/drivers/usb/usbip/README
index 41a2cf2e77a6..41a2cf2e77a6 100644
--- a/drivers/staging/usbip/README
+++ b/drivers/usb/usbip/README
diff --git a/drivers/staging/usbip/stub.h b/drivers/usb/usbip/stub.h
index 266e2b0ce9a8..266e2b0ce9a8 100644
--- a/drivers/staging/usbip/stub.h
+++ b/drivers/usb/usbip/stub.h
diff --git a/drivers/staging/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 51d0c7188738..fac20e0434c0 100644
--- a/drivers/staging/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -26,33 +26,6 @@
 #include "stub.h"
 
 /*
- * Define device IDs here if you want to explicitly limit exportable devices.
- * In most cases, wildcard matching will be okay because driver binding can be
- * changed dynamically by a userland program.
- */
-static struct usb_device_id stub_table[] = {
-#if 0
-        /* just an example */
-        { USB_DEVICE(0x05ac, 0x0301) },   /* Mac 1 button mouse */
-        { USB_DEVICE(0x0430, 0x0009) },   /* Plat Home Keyboard */
-        { USB_DEVICE(0x059b, 0x0001) },   /* Iomega USB Zip 100 */
-        { USB_DEVICE(0x04b3, 0x4427) },   /* IBM USB CD-ROM */
-        { USB_DEVICE(0x05a9, 0xa511) },   /* LifeView USB cam */
-        { USB_DEVICE(0x55aa, 0x0201) },   /* Imation card reader */
-        { USB_DEVICE(0x046d, 0x0870) },   /* Qcam Express(QV-30) */
-        { USB_DEVICE(0x04bb, 0x0101) },   /* IO-DATA HD 120GB */
-        { USB_DEVICE(0x04bb, 0x0904) },   /* IO-DATA USB-ET/TX */
-        { USB_DEVICE(0x04bb, 0x0201) },   /* IO-DATA USB-ET/TX */
-        { USB_DEVICE(0x08bb, 0x2702) },   /* ONKYO USB Speaker */
-        { USB_DEVICE(0x046d, 0x08b2) },   /* Logicool Qcam 4000 Pro */
-#endif
-        /* magic for wild card */
-        { .driver_info = 1 },
-        { 0, }                                     /* Terminating entry */
-};
-MODULE_DEVICE_TABLE(usb, stub_table);
-
-/*
  * usbip_status shows the status of usbip-host as long as this driver is bound
  * to the target device.
  */
diff --git a/drivers/staging/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
index 44ab43fc4fcc..44ab43fc4fcc 100644
--- a/drivers/staging/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 00e475c51a12..00e475c51a12 100644
--- a/drivers/staging/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
diff --git a/drivers/staging/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
index dbcabc9dbe0d..dbcabc9dbe0d 100644
--- a/drivers/staging/usbip/stub_tx.c
+++ b/drivers/usb/usbip/stub_tx.c
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
index facaaf003f19..facaaf003f19 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index 4da3866a037d..86b08475c254 100644
--- a/drivers/staging/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -29,7 +29,7 @@
 #include <linux/types.h>
 #include <linux/usb.h>
 #include <linux/wait.h>
-#include "uapi/usbip.h"
+#include <uapi/linux/usbip.h>
 
 #define USBIP_VERSION "1.0.0"
 
diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 64933b993d7a..64933b993d7a 100644
--- a/drivers/staging/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
diff --git a/drivers/staging/usbip/usbip_protocol.txt b/drivers/usb/usbip/usbip_protocol.txt
index 16b6fe27284c..16b6fe27284c 100644
--- a/drivers/staging/usbip/usbip_protocol.txt
+++ b/drivers/usb/usbip/usbip_protocol.txt
diff --git a/drivers/staging/usbip/vhci.h b/drivers/usb/usbip/vhci.h
index a863a98a91ce..a863a98a91ce 100644
--- a/drivers/staging/usbip/vhci.h
+++ b/drivers/usb/usbip/vhci.h
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index c02374b6049c..c02374b6049c 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
index 00e4a54308e4..00e4a54308e4 100644
--- a/drivers/staging/usbip/vhci_rx.c
+++ b/drivers/usb/usbip/vhci_rx.c
diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index 211f43f67ea2..211f43f67ea2 100644
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
diff --git a/drivers/staging/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c
index 409fd99f3257..409fd99f3257 100644
--- a/drivers/staging/usbip/vhci_tx.c
+++ b/drivers/usb/usbip/vhci_tx.c
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 3e2e4ed20157..e279015be466 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -2602,6 +2602,7 @@ static void wa_buf_in_cb(struct urb *urb)
         dev = &wa->usb_iface->dev;
         --(wa->active_buf_in_urbs);
         active_buf_in_urbs = wa->active_buf_in_urbs;
+        rpipe = xfer->ep->hcpriv;
 
         if (usb_pipeisoc(xfer->urb->pipe)) {
                 struct usb_iso_packet_descriptor *iso_frame_desc =
@@ -2659,7 +2660,6 @@ static void wa_buf_in_cb(struct urb *urb)
                           resubmit_dti = (isoc_data_frame_count ==
                                                         urb_frame_count);
                 } else if (active_buf_in_urbs == 0) {
-                        rpipe = xfer->ep->hcpriv;
                         dev_dbg(dev,
                                 "xfer %p 0x%08X#%u: data in done (%zu bytes)\n",
                                 xfer, wa_xfer_id(xfer), seg->index,
@@ -2685,7 +2685,6 @@ static void wa_buf_in_cb(struct urb *urb)
                  */
                 resubmit_dti = wa->dti_state != WA_DTI_TRANSFER_RESULT_PENDING;
                 spin_lock_irqsave(&xfer->lock, flags);
-                rpipe = xfer->ep->hcpriv;
                 if (printk_ratelimit())
                         dev_err(dev, "xfer %p 0x%08X#%u: data in error %d\n",
                                 xfer, wa_xfer_id(xfer), seg->index,
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index d7a3d13e72ec..b85983e97f0a 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -173,6 +173,7 @@ static int pwm_backlight_parse_dt(struct device *dev,
                 data->max_brightness--;
         }
 
+        data->enable_gpio = -EINVAL;
         return 0;
 }
 
diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
index beadd3edaa17..a7b6217ac87b 100644
--- a/drivers/video/fbdev/amba-clcd.c
+++ b/drivers/video/fbdev/amba-clcd.c
@@ -24,6 +24,7 @@
 #include <linux/list.h>
 #include <linux/amba/bus.h>
 #include <linux/amba/clcd.h>
+#include <linux/bitops.h>
 #include <linux/clk.h>
 #include <linux/hardirq.h>
 #include <linux/dma-mapping.h>
@@ -650,6 +651,7 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)
 {
         struct device_node *endpoint;
         int err;
+        unsigned int bpp;
         u32 max_bandwidth;
         u32 tft_r0b0g0[3];
 
@@ -667,11 +669,22 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)
 
         err = of_property_read_u32(fb->dev->dev.of_node, "max-memory-bandwidth",
                         &max_bandwidth);
-        if (!err)
-                fb->panel->bpp = 8 * max_bandwidth / (fb->panel->mode.xres *
-                                fb->panel->mode.yres * fb->panel->mode.refresh);
-        else
-                fb->panel->bpp = 32;
+        if (!err) {
+                /*
+                 * max_bandwidth is in bytes per second and pixclock in
+                 * pico-seconds, so the maximum allowed bits per pixel is
+                 *   8 * max_bandwidth / (PICOS2KHZ(pixclock) * 1000)
+                 * Rearrange this calculation to avoid overflow and then ensure
+                 * result is a valid format.
+                 */
+                bpp = max_bandwidth / (1000 / 8)
+                        / PICOS2KHZ(fb->panel->mode.pixclock);
+                bpp = rounddown_pow_of_two(bpp);
+                if (bpp > 32)
+                        bpp = 32;
+        } else
+                bpp = 32;
+        fb->panel->bpp = bpp;
 
 #ifdef CONFIG_CPU_BIG_ENDIAN
         fb->panel->cntl |= CNTL_BEBO;
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 92640d46770a..1d8bdb92939b 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1102,12 +1102,14 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
         timings = of_get_display_timings(display_np);
         if (!timings) {
                 dev_err(dev, "failed to get display timings\n");
+                ret = -EINVAL;
                 goto put_display_node;
         }
 
         timings_np = of_find_node_by_name(display_np, "display-timings");
         if (!timings_np) {
                 dev_err(dev, "failed to find display-timings node\n");
+                ret = -ENODEV;
                 goto put_display_node;
         }
 
diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index 206a66b61072..59abdc6a97f6 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -273,7 +273,7 @@ static struct chips_init_reg chips_init_xr[] = {
         { 0xa8, 0x00 }
 };
 
-static void __init chips_hw_init(void)
+static void chips_hw_init(void)
 {
         int i;
 
diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
index 788f6b37fce7..10c876c95772 100644
--- a/drivers/video/fbdev/da8xx-fb.c
+++ b/drivers/video/fbdev/da8xx-fb.c
@@ -419,7 +419,7 @@ static void lcd_cfg_horizontal_sync(int back_porch, int pulse_width,
 {
         u32 reg;
 
-        reg = lcdc_read(LCD_RASTER_TIMING_0_REG) & 0xf;
+        reg = lcdc_read(LCD_RASTER_TIMING_0_REG) & 0x3ff;
         reg |= (((back_porch-1) & 0xff) << 24)
             | (((front_porch-1) & 0xff) << 16)
             | (((pulse_width-1) & 0x3f) << 10);
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 987edf110038..5c098d5b4043 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -236,6 +236,7 @@ timingfail:
         if (native_mode)
                 of_node_put(native_mode);
         display_timings_release(disp);
+        disp = NULL;
 entryfail:
         kfree(disp);
 dispfail:
diff --git a/fs/aio.c b/fs/aio.c
index ae635872affb..733750096b71 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -141,6 +141,7 @@ struct kioctx {
 
         struct {
                 unsigned        tail;
+                unsigned        completed_events;
                 spinlock_t      completion_lock;
         } ____cacheline_aligned_in_smp;
 
@@ -792,6 +793,8 @@ void exit_aio(struct mm_struct *mm)
 
         for (i = 0; i < table->nr; ++i) {
                 struct kioctx *ctx = table->table[i];
+                struct completion requests_done =
+                        COMPLETION_INITIALIZER_ONSTACK(requests_done);
 
                 if (!ctx)
                         continue;
@@ -803,7 +806,10 @@ void exit_aio(struct mm_struct *mm)
                  * that it needs to unmap the area, just set it to 0.
                  */
                 ctx->mmap_size = 0;
-                kill_ioctx(mm, ctx, NULL);
+                kill_ioctx(mm, ctx, &requests_done);
+
+                /* Wait until all IO for the context are done. */
+                wait_for_completion(&requests_done);
         }
 
         RCU_INIT_POINTER(mm->ioctx_table, NULL);
@@ -857,6 +863,68 @@ out:
         return ret;
 }
 
+/* refill_reqs_available
+ *      Updates the reqs_available reference counts used for tracking the
+ *      number of free slots in the completion ring.  This can be called
+ *      from aio_complete() (to optimistically update reqs_available) or
+ *      from aio_get_req() (the we're out of events case).  It must be
+ *      called holding ctx->completion_lock.
+ */
+static void refill_reqs_available(struct kioctx *ctx, unsigned head,
+                                  unsigned tail)
+{
+        unsigned events_in_ring, completed;
+
+        /* Clamp head since userland can write to it. */
+        head %= ctx->nr_events;
+        if (head <= tail)
+                events_in_ring = tail - head;
+        else
+                events_in_ring = ctx->nr_events - (head - tail);
+
+        completed = ctx->completed_events;
+        if (events_in_ring < completed)
+                completed -= events_in_ring;
+        else
+                completed = 0;
+
+        if (!completed)
+                return;
+
+        ctx->completed_events -= completed;
+        put_reqs_available(ctx, completed);
+}
+
+/* user_refill_reqs_available
+ *      Called to refill reqs_available when aio_get_req() encounters an
+ *      out of space in the completion ring.
+ */
+static void user_refill_reqs_available(struct kioctx *ctx)
+{
+        spin_lock_irq(&ctx->completion_lock);
+        if (ctx->completed_events) {
+                struct aio_ring *ring;
+                unsigned head;
+
+                /* Access of ring->head may race with aio_read_events_ring()
+                 * here, but that's okay since whether we read the old version
+                 * or the new version, and either will be valid.  The important
+                 * part is that head cannot pass tail since we prevent
+                 * aio_complete() from updating tail by holding
+                 * ctx->completion_lock.  Even if head is invalid, the check
+                 * against ctx->completed_events below will make sure we do the
+                 * safe/right thing.
+                 */
+                ring = kmap_atomic(ctx->ring_pages[0]);
+                head = ring->head;
+                kunmap_atomic(ring);
+
+                refill_reqs_available(ctx, head, ctx->tail);
+        }
+
+        spin_unlock_irq(&ctx->completion_lock);
+}
+
 /* aio_get_req
  *      Allocate a slot for an aio request.
  * Returns NULL if no requests are free.
@@ -865,8 +933,11 @@ static inline struct kiocb *aio_get_req(struct kioctx *ctx)
 {
         struct kiocb *req;
 
-        if (!get_reqs_available(ctx))
-                return NULL;
+        if (!get_reqs_available(ctx)) {
+                user_refill_reqs_available(ctx);
+                if (!get_reqs_available(ctx))
+                        return NULL;
+        }
 
         req = kmem_cache_alloc(kiocb_cachep, GFP_KERNEL|__GFP_ZERO);
         if (unlikely(!req))
@@ -925,8 +996,8 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
         struct kioctx   *ctx = iocb->ki_ctx;
         struct aio_ring *ring;
         struct io_event *ev_page, *event;
+        unsigned tail, pos, head;
         unsigned long   flags;
-        unsigned tail, pos;
 
         /*
          * Special case handling for sync iocbs:
@@ -987,10 +1058,14 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
         ctx->tail = tail;
 
         ring = kmap_atomic(ctx->ring_pages[0]);
+        head = ring->head;
         ring->tail = tail;
         kunmap_atomic(ring);
         flush_dcache_page(ctx->ring_pages[0]);
 
+        ctx->completed_events++;
+        if (ctx->completed_events > 1)
+                refill_reqs_available(ctx, head, tail);
         spin_unlock_irqrestore(&ctx->completion_lock, flags);
 
         pr_debug("added to ring %p at [%u]\n", iocb, tail);
@@ -1005,7 +1080,6 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
 
         /* everything turned out well, dispose of the aiocb. */
         kiocb_free(iocb);
-        put_reqs_available(ctx, 1);
 
         /*
          * We have to order our ring_info tail store above and test
@@ -1042,6 +1116,12 @@ static long aio_read_events_ring(struct kioctx *ctx,
         tail = ring->tail;
         kunmap_atomic(ring);
 
+        /*
+         * Ensure that once we've read the current tail pointer, that
+         * we also see the events that were stored up to the tail.
+         */
+        smp_rmb();
+
         pr_debug("h%u t%u m%u\n", head, tail, ctx->nr_events);
 
         if (head == tail)
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 5a201d81049c..fbd76ded9a34 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -22,7 +22,6 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/freezer.h>
-#include <linux/workqueue.h>
 #include "async-thread.h"
 #include "ctree.h"
 
@@ -55,8 +54,39 @@ struct btrfs_workqueue {
         struct __btrfs_workqueue *high;
 };
 
-static inline struct __btrfs_workqueue
-*__btrfs_alloc_workqueue(const char *name, int flags, int max_active,
+static void normal_work_helper(struct btrfs_work *work);
+
+#define BTRFS_WORK_HELPER(name)                                 \
+void btrfs_##name(struct work_struct *arg)                              \
+{                                                                       \
+        struct btrfs_work *work = container_of(arg, struct btrfs_work,  \
+                                               normal_work);            \
+        normal_work_helper(work);                                       \
+}
+
+BTRFS_WORK_HELPER(worker_helper);
+BTRFS_WORK_HELPER(delalloc_helper);
+BTRFS_WORK_HELPER(flush_delalloc_helper);
+BTRFS_WORK_HELPER(cache_helper);
+BTRFS_WORK_HELPER(submit_helper);
+BTRFS_WORK_HELPER(fixup_helper);
+BTRFS_WORK_HELPER(endio_helper);
+BTRFS_WORK_HELPER(endio_meta_helper);
+BTRFS_WORK_HELPER(endio_meta_write_helper);
+BTRFS_WORK_HELPER(endio_raid56_helper);
+BTRFS_WORK_HELPER(rmw_helper);
+BTRFS_WORK_HELPER(endio_write_helper);
+BTRFS_WORK_HELPER(freespace_write_helper);
+BTRFS_WORK_HELPER(delayed_meta_helper);
+BTRFS_WORK_HELPER(readahead_helper);
+BTRFS_WORK_HELPER(qgroup_rescan_helper);
+BTRFS_WORK_HELPER(extent_refs_helper);
+BTRFS_WORK_HELPER(scrub_helper);
+BTRFS_WORK_HELPER(scrubwrc_helper);
+BTRFS_WORK_HELPER(scrubnc_helper);
+
+static struct __btrfs_workqueue *
+__btrfs_alloc_workqueue(const char *name, int flags, int max_active,
                          int thresh)
 {
         struct __btrfs_workqueue *ret = kzalloc(sizeof(*ret), GFP_NOFS);
@@ -232,13 +262,11 @@ static void run_ordered_work(struct __btrfs_workqueue *wq)
         spin_unlock_irqrestore(lock, flags);
 }
 
-static void normal_work_helper(struct work_struct *arg)
+static void normal_work_helper(struct btrfs_work *work)
 {
-        struct btrfs_work *work;
         struct __btrfs_workqueue *wq;
         int need_order = 0;
 
-        work = container_of(arg, struct btrfs_work, normal_work);
         /*
          * We should not touch things inside work in the following cases:
          * 1) after work->func() if it has no ordered_free
@@ -262,7 +290,7 @@ static void normal_work_helper(struct work_struct *arg)
                 trace_btrfs_all_work_done(work);
 }
 
-void btrfs_init_work(struct btrfs_work *work,
+void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t uniq_func,
                      btrfs_func_t func,
                      btrfs_func_t ordered_func,
                      btrfs_func_t ordered_free)
@@ -270,7 +298,7 @@ void btrfs_init_work(struct btrfs_work *work,
         work->func = func;
         work->ordered_func = ordered_func;
         work->ordered_free = ordered_free;
-        INIT_WORK(&work->normal_work, normal_work_helper);
+        INIT_WORK(&work->normal_work, uniq_func);
         INIT_LIST_HEAD(&work->ordered_list);
         work->flags = 0;
 }
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index 9c6b66d15fb0..e9e31c94758f 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -19,12 +19,14 @@
 
 #ifndef __BTRFS_ASYNC_THREAD_
 #define __BTRFS_ASYNC_THREAD_
+#include <linux/workqueue.h>
 
 struct btrfs_workqueue;
 /* Internal use only */
 struct __btrfs_workqueue;
 struct btrfs_work;
 typedef void (*btrfs_func_t)(struct btrfs_work *arg);
+typedef void (*btrfs_work_func_t)(struct work_struct *arg);
 
 struct btrfs_work {
         btrfs_func_t func;
@@ -38,11 +40,35 @@ struct btrfs_work {
         unsigned long flags;
 };
 
+#define BTRFS_WORK_HELPER_PROTO(name)                                   \
+void btrfs_##name(struct work_struct *arg)
+
+BTRFS_WORK_HELPER_PROTO(worker_helper);
+BTRFS_WORK_HELPER_PROTO(delalloc_helper);
+BTRFS_WORK_HELPER_PROTO(flush_delalloc_helper);
+BTRFS_WORK_HELPER_PROTO(cache_helper);
+BTRFS_WORK_HELPER_PROTO(submit_helper);
+BTRFS_WORK_HELPER_PROTO(fixup_helper);
+BTRFS_WORK_HELPER_PROTO(endio_helper);
+BTRFS_WORK_HELPER_PROTO(endio_meta_helper);
+BTRFS_WORK_HELPER_PROTO(endio_meta_write_helper);
+BTRFS_WORK_HELPER_PROTO(endio_raid56_helper);
+BTRFS_WORK_HELPER_PROTO(rmw_helper);
+BTRFS_WORK_HELPER_PROTO(endio_write_helper);
+BTRFS_WORK_HELPER_PROTO(freespace_write_helper);
+BTRFS_WORK_HELPER_PROTO(delayed_meta_helper);
+BTRFS_WORK_HELPER_PROTO(readahead_helper);
+BTRFS_WORK_HELPER_PROTO(qgroup_rescan_helper);
+BTRFS_WORK_HELPER_PROTO(extent_refs_helper);
+BTRFS_WORK_HELPER_PROTO(scrub_helper);
+BTRFS_WORK_HELPER_PROTO(scrubwrc_helper);
+BTRFS_WORK_HELPER_PROTO(scrubnc_helper);
+
 struct btrfs_workqueue *btrfs_alloc_workqueue(const char *name,
                                               int flags,
                                               int max_active,
                                               int thresh);
-void btrfs_init_work(struct btrfs_work *work,
+void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t helper,
                      btrfs_func_t func,
                      btrfs_func_t ordered_func,
                      btrfs_func_t ordered_free);
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index da775bfdebc9..a2e90f855d7d 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1395,8 +1395,8 @@ static int btrfs_wq_run_delayed_node(struct btrfs_delayed_root *delayed_root,
                 return -ENOMEM;
 
         async_work->delayed_root = delayed_root;
-        btrfs_init_work(&async_work->work, btrfs_async_run_delayed_root,
-                        NULL, NULL);
+        btrfs_init_work(&async_work->work, btrfs_delayed_meta_helper,
+                        btrfs_async_run_delayed_root, NULL, NULL);
         async_work->nr = nr;
 
         btrfs_queue_work(root->fs_info->delayed_workers, &async_work->work);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index d0ed9e664f7d..a1d36e62179c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -39,7 +39,6 @@
 #include "btrfs_inode.h"
 #include "volumes.h"
 #include "print-tree.h"
-#include "async-thread.h"
 #include "locking.h"
 #include "tree-log.h"
 #include "free-space-cache.h"
@@ -693,35 +692,41 @@ static void end_workqueue_bio(struct bio *bio, int err)
 {
         struct end_io_wq *end_io_wq = bio->bi_private;
         struct btrfs_fs_info *fs_info;
+        struct btrfs_workqueue *wq;
+        btrfs_work_func_t func;
 
         fs_info = end_io_wq->info;
         end_io_wq->error = err;
-        btrfs_init_work(&end_io_wq->work, end_workqueue_fn, NULL, NULL);
 
         if (bio->bi_rw & REQ_WRITE) {
-                if (end_io_wq->metadata == BTRFS_WQ_ENDIO_METADATA)
-                        btrfs_queue_work(fs_info->endio_meta_write_workers,
-                                         &end_io_wq->work);
-                else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_FREE_SPACE)
-                        btrfs_queue_work(fs_info->endio_freespace_worker,
-                                         &end_io_wq->work);
-                else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56)
-                        btrfs_queue_work(fs_info->endio_raid56_workers,
-                                         &end_io_wq->work);
-                else
-                        btrfs_queue_work(fs_info->endio_write_workers,
-                                         &end_io_wq->work);
+                if (end_io_wq->metadata == BTRFS_WQ_ENDIO_METADATA) {
+                        wq = fs_info->endio_meta_write_workers;
+                        func = btrfs_endio_meta_write_helper;
+                } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_FREE_SPACE) {
+                        wq = fs_info->endio_freespace_worker;
+                        func = btrfs_freespace_write_helper;
+                } else if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) {
+                        wq = fs_info->endio_raid56_workers;
+                        func = btrfs_endio_raid56_helper;
+                } else {
+                        wq = fs_info->endio_write_workers;
+                        func = btrfs_endio_write_helper;
+                }
         } else {
-                if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56)
-                        btrfs_queue_work(fs_info->endio_raid56_workers,
-                                         &end_io_wq->work);
-                else if (end_io_wq->metadata)
-                        btrfs_queue_work(fs_info->endio_meta_workers,
-                                         &end_io_wq->work);
-                else
-                        btrfs_queue_work(fs_info->endio_workers,
-                                         &end_io_wq->work);
+                if (end_io_wq->metadata == BTRFS_WQ_ENDIO_RAID56) {
+                        wq = fs_info->endio_raid56_workers;
+                        func = btrfs_endio_raid56_helper;
+                } else if (end_io_wq->metadata) {
+                        wq = fs_info->endio_meta_workers;
+                        func = btrfs_endio_meta_helper;
+                } else {
+                        wq = fs_info->endio_workers;
+                        func = btrfs_endio_helper;
+                }
         }
+
+        btrfs_init_work(&end_io_wq->work, func, end_workqueue_fn, NULL, NULL);
+        btrfs_queue_work(wq, &end_io_wq->work);
 }
 
 /*
@@ -828,7 +833,7 @@ int btrfs_wq_submit_bio(struct btrfs_fs_info *fs_info, struct inode *inode,
         async->submit_bio_start = submit_bio_start;
         async->submit_bio_done = submit_bio_done;
 
-        btrfs_init_work(&async->work, run_one_async_start,
+        btrfs_init_work(&async->work, btrfs_worker_helper, run_one_async_start,
                         run_one_async_done, run_one_async_free);
 
         async->bio_flags = bio_flags;
@@ -3450,7 +3455,8 @@ static int write_all_supers(struct btrfs_root *root, int max_mirrors)
                 btrfs_set_stack_device_generation(dev_item, 0);
                 btrfs_set_stack_device_type(dev_item, dev->type);
                 btrfs_set_stack_device_id(dev_item, dev->devid);
-                btrfs_set_stack_device_total_bytes(dev_item, dev->total_bytes);
+                btrfs_set_stack_device_total_bytes(dev_item,
+                                                   dev->disk_total_bytes);
                 btrfs_set_stack_device_bytes_used(dev_item, dev->bytes_used);
                 btrfs_set_stack_device_io_align(dev_item, dev->io_align);
                 btrfs_set_stack_device_io_width(dev_item, dev->io_width);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 102ed3143976..3efe1c3877bf 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -552,7 +552,8 @@ static int cache_block_group(struct btrfs_block_group_cache *cache,
         caching_ctl->block_group = cache;
         caching_ctl->progress = cache->key.objectid;
         atomic_set(&caching_ctl->count, 1);
-        btrfs_init_work(&caching_ctl->work, caching_thread, NULL, NULL);
+        btrfs_init_work(&caching_ctl->work, btrfs_cache_helper,
+                        caching_thread, NULL, NULL);
 
         spin_lock(&cache->lock);
         /*
@@ -2749,8 +2750,8 @@ int btrfs_async_run_delayed_refs(struct btrfs_root *root,
                 async->sync = 0;
         init_completion(&async->wait);
 
-        btrfs_init_work(&async->work, delayed_ref_async_start,
-                        NULL, NULL);
+        btrfs_init_work(&async->work, btrfs_extent_refs_helper,
+                        delayed_ref_async_start, NULL, NULL);
 
         btrfs_queue_work(root->fs_info->extent_workers, &async->work);
 
@@ -3586,13 +3587,7 @@ static u64 get_restripe_target(struct btrfs_fs_info *fs_info, u64 flags)
  */
 static u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags)
 {
-        /*
-         * we add in the count of missing devices because we want
-         * to make sure that any RAID levels on a degraded FS
-         * continue to be honored.
-         */
-        u64 num_devices = root->fs_info->fs_devices->rw_devices +
-                root->fs_info->fs_devices->missing_devices;
+        u64 num_devices = root->fs_info->fs_devices->rw_devices;
         u64 target;
         u64 tmp;
 
@@ -8440,13 +8435,7 @@ static u64 update_block_group_flags(struct btrfs_root *root, u64 flags)
         if (stripped)
                 return extended_to_chunk(stripped);
 
-        /*
-         * we add in the count of missing devices because we want
-         * to make sure that any RAID levels on a degraded FS
-         * continue to be honored.
-         */
-        num_devices = root->fs_info->fs_devices->rw_devices +
-                root->fs_info->fs_devices->missing_devices;
+        num_devices = root->fs_info->fs_devices->rw_devices;
 
         stripped = BTRFS_BLOCK_GROUP_RAID0 |
                 BTRFS_BLOCK_GROUP_RAID5 | BTRFS_BLOCK_GROUP_RAID6 |
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 3e11aab9f391..af0359dcf337 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2532,6 +2532,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                                         test_bit(BIO_UPTODATE, &bio->bi_flags);
                                 if (err)
                                         uptodate = 0;
+                                offset += len;
                                 continue;
                         }
                 }
@@ -4207,8 +4208,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 return -ENOMEM;
         path->leave_spinning = 1;
 
-        start = ALIGN(start, BTRFS_I(inode)->root->sectorsize);
-        len = ALIGN(len, BTRFS_I(inode)->root->sectorsize);
+        start = round_down(start, BTRFS_I(inode)->root->sectorsize);
+        len = round_up(max, BTRFS_I(inode)->root->sectorsize) - start;
 
         /*
          * lookup the last file extent.  We're not using i_size here
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index d3afac292d67..36861b7a6757 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1840,7 +1840,15 @@ int btrfs_release_file(struct inode *inode, struct file *filp)
 {
         if (filp->private_data)
                 btrfs_ioctl_trans_end(filp);
-        filemap_flush(inode->i_mapping);
+        /*
+         * ordered_data_close is set by settattr when we are about to truncate
+         * a file from a non-zero size to a zero size.  This tries to
+         * flush down new bytes that may have been written if the
+         * application were using truncate to replace a file in place.
+         */
+        if (test_and_clear_bit(BTRFS_INODE_ORDERED_DATA_CLOSE,
+                               &BTRFS_I(inode)->runtime_flags))
+                        filemap_flush(inode->i_mapping);
         return 0;
 }
 
@@ -2088,10 +2096,9 @@ static int fill_holes(struct btrfs_trans_handle *trans, struct inode *inode,
                 goto out;
         }
 
-        if (hole_mergeable(inode, leaf, path->slots[0]+1, offset, end)) {
+        if (hole_mergeable(inode, leaf, path->slots[0], offset, end)) {
                 u64 num_bytes;
 
-                path->slots[0]++;
                 key.offset = offset;
                 btrfs_set_item_key_safe(root, path, &key);
                 fi = btrfs_item_ptr(leaf, path->slots[0],
@@ -2216,7 +2223,7 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
                 goto out_only_mutex;
         }
 
-        lockstart = round_up(offset , BTRFS_I(inode)->root->sectorsize);
+        lockstart = round_up(offset, BTRFS_I(inode)->root->sectorsize);
         lockend = round_down(offset + len,
                              BTRFS_I(inode)->root->sectorsize) - 1;
         same_page = ((offset >> PAGE_CACHE_SHIFT) ==
@@ -2277,7 +2284,7 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
                                                 tail_start + tail_len, 0, 1);
                                 if (ret)
                                         goto out_only_mutex;
-                                }
+                        }
                 }
         }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 03708ef3deef..9c194bd74d6e 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1096,8 +1096,10 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
                 async_cow->end = cur_end;
                 INIT_LIST_HEAD(&async_cow->extents);
 
-                btrfs_init_work(&async_cow->work, async_cow_start,
-                                async_cow_submit, async_cow_free);
+                btrfs_init_work(&async_cow->work,
+                                btrfs_delalloc_helper,
+                                async_cow_start, async_cow_submit,
+                                async_cow_free);
 
                 nr_pages = (cur_end - start + PAGE_CACHE_SIZE) >>
                         PAGE_CACHE_SHIFT;
@@ -1881,7 +1883,8 @@ static int btrfs_writepage_start_hook(struct page *page, u64 start, u64 end)
 
         SetPageChecked(page);
         page_cache_get(page);
-        btrfs_init_work(&fixup->work, btrfs_writepage_fixup_worker, NULL, NULL);
+        btrfs_init_work(&fixup->work, btrfs_fixup_helper,
+                        btrfs_writepage_fixup_worker, NULL, NULL);
         fixup->page = page;
         btrfs_queue_work(root->fs_info->fixup_workers, &fixup->work);
         return -EBUSY;
@@ -2822,7 +2825,8 @@ static int btrfs_writepage_end_io_hook(struct page *page, u64 start, u64 end,
         struct inode *inode = page->mapping->host;
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_ordered_extent *ordered_extent = NULL;
-        struct btrfs_workqueue *workers;
+        struct btrfs_workqueue *wq;
+        btrfs_work_func_t func;
 
         trace_btrfs_writepage_end_io_hook(page, start, end, uptodate);
 
@@ -2831,13 +2835,17 @@ static int btrfs_writepage_end_io_hook(struct page *page, u64 start, u64 end,
                                             end - start + 1, uptodate))
                 return 0;
 
-        btrfs_init_work(&ordered_extent->work, finish_ordered_fn, NULL, NULL);
+        if (btrfs_is_free_space_inode(inode)) {
+                wq = root->fs_info->endio_freespace_worker;
+                func = btrfs_freespace_write_helper;
+        } else {
+                wq = root->fs_info->endio_write_workers;
+                func = btrfs_endio_write_helper;
+        }
 
-        if (btrfs_is_free_space_inode(inode))
-                workers = root->fs_info->endio_freespace_worker;
-        else
-                workers = root->fs_info->endio_write_workers;
-        btrfs_queue_work(workers, &ordered_extent->work);
+        btrfs_init_work(&ordered_extent->work, func, finish_ordered_fn, NULL,
+                        NULL);
+        btrfs_queue_work(wq, &ordered_extent->work);
 
         return 0;
 }
@@ -4674,6 +4682,11 @@ static void evict_inode_truncate_pages(struct inode *inode)
                 clear_bit(EXTENT_FLAG_LOGGING, &em->flags);
                 remove_extent_mapping(map_tree, em);
                 free_extent_map(em);
+                if (need_resched()) {
+                        write_unlock(&map_tree->lock);
+                        cond_resched();
+                        write_lock(&map_tree->lock);
+                }
         }
         write_unlock(&map_tree->lock);
 
@@ -4696,6 +4709,7 @@ static void evict_inode_truncate_pages(struct inode *inode)
                                  &cached_state, GFP_NOFS);
                 free_extent_state(state);
 
+                cond_resched();
                 spin_lock(&io_tree->lock);
         }
         spin_unlock(&io_tree->lock);
@@ -5181,6 +5195,42 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
                         iput(inode);
                         inode = ERR_PTR(ret);
                 }
+                /*
+                 * If orphan cleanup did remove any orphans, it means the tree
+                 * was modified and therefore the commit root is not the same as
+                 * the current root anymore. This is a problem, because send
+                 * uses the commit root and therefore can see inode items that
+                 * don't exist in the current root anymore, and for example make
+                 * calls to btrfs_iget, which will do tree lookups based on the
+                 * current root and not on the commit root. Those lookups will
+                 * fail, returning a -ESTALE error, and making send fail with
+                 * that error. So make sure a send does not see any orphans we
+                 * have just removed, and that it will see the same inodes
+                 * regardless of whether a transaction commit happened before
+                 * it started (meaning that the commit root will be the same as
+                 * the current root) or not.
+                 */
+                if (sub_root->node != sub_root->commit_root) {
+                        u64 sub_flags = btrfs_root_flags(&sub_root->root_item);
+
+                        if (sub_flags & BTRFS_ROOT_SUBVOL_RDONLY) {
+                                struct extent_buffer *eb;
+
+                                /*
+                                 * Assert we can't have races between dentry
+                                 * lookup called through the snapshot creation
+                                 * ioctl and the VFS.
+                                 */
+                                ASSERT(mutex_is_locked(&dir->i_mutex));
+
+                                down_write(&root->fs_info->commit_root_sem);
+                                eb = sub_root->commit_root;
+                                sub_root->commit_root =
+                                        btrfs_root_node(sub_root);
+                                up_write(&root->fs_info->commit_root_sem);
+                                free_extent_buffer(eb);
+                        }
+                }
         }
 
         return inode;
@@ -5606,6 +5656,13 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
         }
 
         /*
+         * O_TMPFILE, set link count to 0, so that after this point,
+         * we fill in an inode item with the correct link count.
+         */
+        if (!name)
+                set_nlink(inode, 0);
+
+        /*
          * we have to initialize this early, so we can reclaim the inode
          * number if we fail afterwards in this function.
          */
@@ -6097,14 +6154,14 @@ out_fail:
 static int merge_extent_mapping(struct extent_map_tree *em_tree,
                                 struct extent_map *existing,
                                 struct extent_map *em,
-                                u64 map_start, u64 map_len)
+                                u64 map_start)
 {
         u64 start_diff;
 
         BUG_ON(map_start < em->start || map_start >= extent_map_end(em));
         start_diff = map_start - em->start;
         em->start = map_start;
-        em->len = map_len;
+        em->len = existing->start - em->start;
         if (em->block_start < EXTENT_MAP_LAST_BYTE &&
             !test_bit(EXTENT_FLAG_COMPRESSED, &em->flags)) {
                 em->block_start += start_diff;
@@ -6275,6 +6332,8 @@ next:
                         goto not_found;
                 if (start + len <= found_key.offset)
                         goto not_found;
+                if (start > found_key.offset)
+                        goto next;
                 em->start = start;
                 em->orig_start = start;
                 em->len = found_key.offset - start;
@@ -6390,8 +6449,7 @@ insert:
                                                          em->len);
                         if (existing) {
                                 err = merge_extent_mapping(em_tree, existing,
-                                                           em, start,
-                                                           root->sectorsize);
+                                                           em, start);
                                 free_extent_map(existing);
                                 if (err) {
                                         free_extent_map(em);
@@ -7158,7 +7216,8 @@ again:
         if (!ret)
                 goto out_test;
 
-        btrfs_init_work(&ordered->work, finish_ordered_fn, NULL, NULL);
+        btrfs_init_work(&ordered->work, btrfs_endio_write_helper,
+                        finish_ordered_fn, NULL, NULL);
         btrfs_queue_work(root->fs_info->endio_write_workers,
                          &ordered->work);
 out_test:
@@ -7306,10 +7365,8 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
         map_length = orig_bio->bi_iter.bi_size;
         ret = btrfs_map_block(root->fs_info, rw, start_sector << 9,
                               &map_length, NULL, 0);
-        if (ret) {
-                bio_put(orig_bio);
+        if (ret)
                 return -EIO;
-        }
 
         if (map_length >= orig_bio->bi_iter.bi_size) {
                 bio = orig_bio;
@@ -7326,6 +7383,7 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
         bio = btrfs_dio_bio_alloc(orig_bio->bi_bdev, start_sector, GFP_NOFS);
         if (!bio)
                 return -ENOMEM;
+
         bio->bi_private = dip;
         bio->bi_end_io = btrfs_end_dio_bio;
         atomic_inc(&dip->pending_bios);
@@ -7534,7 +7592,8 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
         count = iov_iter_count(iter);
         if (test_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
                      &BTRFS_I(inode)->runtime_flags))
-                filemap_fdatawrite_range(inode->i_mapping, offset, count);
+                filemap_fdatawrite_range(inode->i_mapping, offset,
+                                         offset + count - 1);
 
         if (rw & WRITE) {
                 /*
@@ -8495,7 +8554,9 @@ struct btrfs_delalloc_work *btrfs_alloc_delalloc_work(struct inode *inode,
         work->inode = inode;
         work->wait = wait;
         work->delay_iput = delay_iput;
-        btrfs_init_work(&work->work, btrfs_run_delalloc_work, NULL, NULL);
+        WARN_ON_ONCE(!inode);
+        btrfs_init_work(&work->work, btrfs_flush_delalloc_helper,
+                        btrfs_run_delalloc_work, NULL, NULL);
 
         return work;
 }
@@ -8979,6 +9040,14 @@ static int btrfs_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode)
         if (ret)
                 goto out;
 
+        /*
+         * We set number of links to 0 in btrfs_new_inode(), and here we set
+         * it to 1 because d_tmpfile() will issue a warning if the count is 0,
+         * through:
+         *
+         *    d_tmpfile() -> inode_dec_link_count() -> drop_nlink()
+         */
+        set_nlink(inode, 1);
         d_tmpfile(dentry, inode);
         mark_inode_dirty(inode);
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 47aceb494d1d..fce6fd0e3f50 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -711,39 +711,6 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
         if (ret)
                 goto fail;
 
-        ret = btrfs_orphan_cleanup(pending_snapshot->snap);
-        if (ret)
-                goto fail;
-
-        /*
-         * If orphan cleanup did remove any orphans, it means the tree was
-         * modified and therefore the commit root is not the same as the
-         * current root anymore. This is a problem, because send uses the
-         * commit root and therefore can see inode items that don't exist
-         * in the current root anymore, and for example make calls to
-         * btrfs_iget, which will do tree lookups based on the current root
-         * and not on the commit root. Those lookups will fail, returning a
-         * -ESTALE error, and making send fail with that error. So make sure
-         * a send does not see any orphans we have just removed, and that it
-         * will see the same inodes regardless of whether a transaction
-         * commit happened before it started (meaning that the commit root
-         * will be the same as the current root) or not.
-         */
-        if (readonly && pending_snapshot->snap->node !=
-            pending_snapshot->snap->commit_root) {
-                trans = btrfs_join_transaction(pending_snapshot->snap);
-                if (IS_ERR(trans) && PTR_ERR(trans) != -ENOENT) {
-                        ret = PTR_ERR(trans);
-                        goto fail;
-                }
-                if (!IS_ERR(trans)) {
-                        ret = btrfs_commit_transaction(trans,
-                                                       pending_snapshot->snap);
-                        if (ret)
-                                goto fail;
-                }
-        }
-
         inode = btrfs_lookup_dentry(dentry->d_parent->d_inode, dentry);
         if (IS_ERR(inode)) {
                 ret = PTR_ERR(inode);
@@ -3527,7 +3494,8 @@ process_slot:
                         btrfs_mark_buffer_dirty(leaf);
                         btrfs_release_path(path);
 
-                        last_dest_end = new_key.offset + datal;
+                        last_dest_end = ALIGN(new_key.offset + datal,
+                                              root->sectorsize);
                         ret = clone_finish_inode_update(trans, inode,
                                                         last_dest_end,
                                                         destoff, olen);
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 963895c1f801..ac734ec4cc20 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -615,6 +615,7 @@ int btrfs_wait_ordered_extents(struct btrfs_root *root, int nr)
                 spin_unlock(&root->ordered_extent_lock);
 
                 btrfs_init_work(&ordered->flush_work,
+                                btrfs_flush_delalloc_helper,
                                 btrfs_run_ordered_extent_work, NULL, NULL);
                 list_add_tail(&ordered->work_list, &works);
                 btrfs_queue_work(root->fs_info->flush_workers,
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index b497498484be..ded5c601d916 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1973,7 +1973,7 @@ static int qgroup_subtree_accounting(struct btrfs_trans_handle *trans,
                                    elem.seq, &roots);
         btrfs_put_tree_mod_seq(fs_info, &elem);
         if (ret < 0)
-                return ret;
+                goto out;
 
         if (roots->nnodes != 1)
                 goto out;
@@ -2720,6 +2720,7 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid,
         memset(&fs_info->qgroup_rescan_work, 0,
                sizeof(fs_info->qgroup_rescan_work));
         btrfs_init_work(&fs_info->qgroup_rescan_work,
+                        btrfs_qgroup_rescan_helper,
                         btrfs_qgroup_rescan_worker, NULL, NULL);
 
         if (ret) {
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 4a88f073fdd7..0a6b6e4bcbb9 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1416,7 +1416,8 @@ cleanup:
 
 static void async_rmw_stripe(struct btrfs_raid_bio *rbio)
 {
-        btrfs_init_work(&rbio->work, rmw_work, NULL, NULL);
+        btrfs_init_work(&rbio->work, btrfs_rmw_helper,
+                        rmw_work, NULL, NULL);
 
         btrfs_queue_work(rbio->fs_info->rmw_workers,
                          &rbio->work);
@@ -1424,7 +1425,8 @@ static void async_rmw_stripe(struct btrfs_raid_bio *rbio)
 
 static void async_read_rebuild(struct btrfs_raid_bio *rbio)
 {
-        btrfs_init_work(&rbio->work, read_rebuild_work, NULL, NULL);
+        btrfs_init_work(&rbio->work, btrfs_rmw_helper,
+                        read_rebuild_work, NULL, NULL);
 
         btrfs_queue_work(rbio->fs_info->rmw_workers,
                          &rbio->work);
@@ -1665,7 +1667,8 @@ static void btrfs_raid_unplug(struct blk_plug_cb *cb, bool from_schedule)
         plug = container_of(cb, struct btrfs_plug_cb, cb);
 
         if (from_schedule) {
-                btrfs_init_work(&plug->work, unplug_work, NULL, NULL);
+                btrfs_init_work(&plug->work, btrfs_rmw_helper,
+                                unplug_work, NULL, NULL);
                 btrfs_queue_work(plug->info->rmw_workers,
                                  &plug->work);
                 return;
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index 09230cf3a244..20408c6b665a 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -798,7 +798,8 @@ static void reada_start_machine(struct btrfs_fs_info *fs_info)
                 /* FIXME we cannot handle this properly right now */
                 BUG();
         }
-        btrfs_init_work(&rmw->work, reada_start_machine_worker, NULL, NULL);
+        btrfs_init_work(&rmw->work, btrfs_readahead_helper,
+                        reada_start_machine_worker, NULL, NULL);
         rmw->fs_info = fs_info;
 
         btrfs_queue_work(fs_info->readahead_workers, &rmw->work);
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index b6d198f5181e..f4a41f37be22 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -428,8 +428,8 @@ struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace)
                 sbio->index = i;
                 sbio->sctx = sctx;
                 sbio->page_count = 0;
-                btrfs_init_work(&sbio->work, scrub_bio_end_io_worker,
-                                NULL, NULL);
+                btrfs_init_work(&sbio->work, btrfs_scrub_helper,
+                                scrub_bio_end_io_worker, NULL, NULL);
 
                 if (i != SCRUB_BIOS_PER_SCTX - 1)
                         sctx->bios[i]->next_free = i + 1;
@@ -999,8 +999,8 @@ nodatasum_case:
                 fixup_nodatasum->root = fs_info->extent_root;
                 fixup_nodatasum->mirror_num = failed_mirror_index + 1;
                 scrub_pending_trans_workers_inc(sctx);
-                btrfs_init_work(&fixup_nodatasum->work, scrub_fixup_nodatasum,
-                                NULL, NULL);
+                btrfs_init_work(&fixup_nodatasum->work, btrfs_scrub_helper,
+                                scrub_fixup_nodatasum, NULL, NULL);
                 btrfs_queue_work(fs_info->scrub_workers,
                                  &fixup_nodatasum->work);
                 goto out;
@@ -1616,7 +1616,8 @@ static void scrub_wr_bio_end_io(struct bio *bio, int err)
         sbio->err = err;
         sbio->bio = bio;
 
-        btrfs_init_work(&sbio->work, scrub_wr_bio_end_io_worker, NULL, NULL);
+        btrfs_init_work(&sbio->work, btrfs_scrubwrc_helper,
+                         scrub_wr_bio_end_io_worker, NULL, NULL);
         btrfs_queue_work(fs_info->scrub_wr_completion_workers, &sbio->work);
 }
 
@@ -2904,6 +2905,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
         struct scrub_ctx *sctx;
         int ret;
         struct btrfs_device *dev;
+        struct rcu_string *name;
 
         if (btrfs_fs_closing(fs_info))
                 return -EINVAL;
@@ -2965,6 +2967,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
                 return -ENODEV;
         }
 
+        if (!is_dev_replace && !readonly && !dev->writeable) {
+                mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+                rcu_read_lock();
+                name = rcu_dereference(dev->name);
+                btrfs_err(fs_info, "scrub: device %s is not writable",
+                          name->str);
+                rcu_read_unlock();
+                return -EROFS;
+        }
+
         mutex_lock(&fs_info->scrub_lock);
         if (!dev->in_fs_metadata || dev->is_tgtdev_for_dev_replace) {
                 mutex_unlock(&fs_info->scrub_lock);
@@ -3203,7 +3215,8 @@ static int copy_nocow_pages(struct scrub_ctx *sctx, u64 logical, u64 len,
         nocow_ctx->len = len;
         nocow_ctx->mirror_num = mirror_num;
         nocow_ctx->physical_for_dev_replace = physical_for_dev_replace;
-        btrfs_init_work(&nocow_ctx->work, copy_nocow_pages_worker, NULL, NULL);
+        btrfs_init_work(&nocow_ctx->work, btrfs_scrubnc_helper,
+                        copy_nocow_pages_worker, NULL, NULL);
         INIT_LIST_HEAD(&nocow_ctx->inodes);
         btrfs_queue_work(fs_info->scrub_nocow_workers,
                          &nocow_ctx->work);
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index 78699364f537..12e53556e214 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -614,7 +614,7 @@ int btrfs_kobj_rm_device(struct btrfs_fs_info *fs_info,
         if (!fs_info->device_dir_kobj)
                 return -EINVAL;
 
-        if (one_device) {
+        if (one_device && one_device->bdev) {
                 disk = one_device->bdev->bd_part;
                 disk_kobj = &part_to_dev(disk)->kobj;
 
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 9e1f2cd5e67a..7e0e6e3029dd 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3298,7 +3298,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
         struct list_head ordered_sums;
         int skip_csum = BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM;
         bool has_extents = false;
-        bool need_find_last_extent = (*last_extent == 0);
+        bool need_find_last_extent = true;
         bool done = false;
 
         INIT_LIST_HEAD(&ordered_sums);
@@ -3352,8 +3352,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
                  */
                 if (ins_keys[i].type == BTRFS_EXTENT_DATA_KEY) {
                         has_extents = true;
-                        if (need_find_last_extent &&
-                            first_key.objectid == (u64)-1)
+                        if (first_key.objectid == (u64)-1)
                                 first_key = ins_keys[i];
                 } else {
                         need_find_last_extent = false;
@@ -3427,6 +3426,16 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
         if (!has_extents)
                 return ret;
 
+        if (need_find_last_extent && *last_extent == first_key.offset) {
+                /*
+                 * We don't have any leafs between our current one and the one
+                 * we processed before that can have file extent items for our
+                 * inode (and have a generation number smaller than our current
+                 * transaction id).
+                 */
+                need_find_last_extent = false;
+        }
+
         /*
          * Because we use btrfs_search_forward we could skip leaves that were
          * not modified and then assume *last_extent is valid when it really
@@ -3537,7 +3546,7 @@ fill_holes:
                                                0, 0);
                 if (ret)
                         break;
-                *last_extent = offset + len;
+                *last_extent = extent_end;
         }
         /*
          * Need to let the callers know we dropped the path so they should
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 6cb82f62cb7c..340a92d08e84 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -508,6 +508,44 @@ static noinline int device_list_add(const char *path,
                 ret = 1;
                 device->fs_devices = fs_devices;
         } else if (!device->name || strcmp(device->name->str, path)) {
+                /*
+                 * When FS is already mounted.
+                 * 1. If you are here and if the device->name is NULL that
+                 *    means this device was missing at time of FS mount.
+                 * 2. If you are here and if the device->name is different
+                 *    from 'path' that means either
+                 *      a. The same device disappeared and reappeared with
+                 *         different name. or
+                 *      b. The missing-disk-which-was-replaced, has
+                 *         reappeared now.
+                 *
+                 * We must allow 1 and 2a above. But 2b would be a spurious
+                 * and unintentional.
+                 *
+                 * Further in case of 1 and 2a above, the disk at 'path'
+                 * would have missed some transaction when it was away and
+                 * in case of 2a the stale bdev has to be updated as well.
+                 * 2b must not be allowed at all time.
+                 */
+
+                /*
+                 * As of now don't allow update to btrfs_fs_device through
+                 * the btrfs dev scan cli, after FS has been mounted.
+                 */
+                if (fs_devices->opened) {
+                        return -EBUSY;
+                } else {
+                        /*
+                         * That is if the FS is _not_ mounted and if you
+                         * are here, that means there is more than one
+                         * disk with same uuid and devid.We keep the one
+                         * with larger generation number or the last-in if
+                         * generation are equal.
+                         */
+                        if (found_transid < device->generation)
+                                return -EEXIST;
+                }
+
                 name = rcu_string_strdup(path, GFP_NOFS);
                 if (!name)
                         return -ENOMEM;
@@ -519,6 +557,15 @@ static noinline int device_list_add(const char *path,
                 }
         }
 
+        /*
+         * Unmount does not free the btrfs_device struct but would zero
+         * generation along with most of the other members. So just update
+         * it back. We need it to pick the disk with largest generation
+         * (as above).
+         */
+        if (!fs_devices->opened)
+                device->generation = found_transid;
+
         if (found_transid > fs_devices->latest_trans) {
                 fs_devices->latest_devid = devid;
                 fs_devices->latest_trans = found_transid;
@@ -1436,7 +1483,7 @@ static int btrfs_add_device(struct btrfs_trans_handle *trans,
         btrfs_set_device_io_align(leaf, dev_item, device->io_align);
         btrfs_set_device_io_width(leaf, dev_item, device->io_width);
         btrfs_set_device_sector_size(leaf, dev_item, device->sector_size);
-        btrfs_set_device_total_bytes(leaf, dev_item, device->total_bytes);
+        btrfs_set_device_total_bytes(leaf, dev_item, device->disk_total_bytes);
         btrfs_set_device_bytes_used(leaf, dev_item, device->bytes_used);
         btrfs_set_device_group(leaf, dev_item, 0);
         btrfs_set_device_seek_speed(leaf, dev_item, 0);
@@ -1671,7 +1718,7 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         device->fs_devices->total_devices--;
 
         if (device->missing)
-                root->fs_info->fs_devices->missing_devices--;
+                device->fs_devices->missing_devices--;
 
         next_device = list_entry(root->fs_info->fs_devices->devices.next,
                                  struct btrfs_device, dev_list);
@@ -1801,8 +1848,12 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
         if (srcdev->bdev) {
                 fs_info->fs_devices->open_devices--;
 
-                /* zero out the old super */
-                btrfs_scratch_superblock(srcdev);
+                /*
+                 * zero out the old super if it is not writable
+                 * (e.g. seed device)
+                 */
+                if (srcdev->writeable)
+                        btrfs_scratch_superblock(srcdev);
         }
 
         call_rcu(&srcdev->rcu, free_device);
@@ -1941,6 +1992,9 @@ static int btrfs_prepare_sprout(struct btrfs_root *root)
         fs_devices->seeding = 0;
         fs_devices->num_devices = 0;
         fs_devices->open_devices = 0;
+        fs_devices->missing_devices = 0;
+        fs_devices->num_can_discard = 0;
+        fs_devices->rotating = 0;
         fs_devices->seed = seed_devices;
 
         generate_random_uuid(fs_devices->fsid);
@@ -5800,7 +5854,8 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info,
         else
                 generate_random_uuid(dev->uuid);
 
-        btrfs_init_work(&dev->work, pending_bios_fn, NULL, NULL);
+        btrfs_init_work(&dev->work, btrfs_submit_helper,
+                        pending_bios_fn, NULL, NULL);
 
         return dev;
 }
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 5b19760b1de5..b0c225cdb52c 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1825,7 +1825,7 @@ ext4_group_first_block_no(struct super_block *sb, ext4_group_t group_no)
 /*
  * Special error return code only used by dx_probe() and its callers.
  */
-#define ERR_BAD_DX_DIR  -75000
+#define ERR_BAD_DX_DIR  (-(MAX_ERRNO - 1))
 
 /*
  * Timeout and state flag for lazy initialization inode thread.
@@ -2454,6 +2454,22 @@ static inline void ext4_update_i_disksize(struct inode *inode, loff_t newsize)
         up_write(&EXT4_I(inode)->i_data_sem);
 }
 
+/* Update i_size, i_disksize. Requires i_mutex to avoid races with truncate */
+static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize)
+{
+        int changed = 0;
+
+        if (newsize > inode->i_size) {
+                i_size_write(inode, newsize);
+                changed = 1;
+        }
+        if (newsize > EXT4_I(inode)->i_disksize) {
+                ext4_update_i_disksize(inode, newsize);
+                changed |= 2;
+        }
+        return changed;
+}
+
 struct ext4_group_info {
         unsigned long   bb_state;
         struct rb_root  bb_free_root;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 76c2df382b7d..74292a71b384 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4665,7 +4665,8 @@ retry:
 }
 
 static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
-                                  ext4_lblk_t len, int flags, int mode)
+                                  ext4_lblk_t len, loff_t new_size,
+                                  int flags, int mode)
 {
         struct inode *inode = file_inode(file);
         handle_t *handle;
@@ -4674,8 +4675,10 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
         int retries = 0;
         struct ext4_map_blocks map;
         unsigned int credits;
+        loff_t epos;
 
         map.m_lblk = offset;
+        map.m_len = len;
         /*
          * Don't normalize the request if it can fit in one extent so
          * that it doesn't get unnecessarily split into multiple
@@ -4690,9 +4693,7 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
         credits = ext4_chunk_trans_blocks(inode, len);
 
 retry:
-        while (ret >= 0 && ret < len) {
-                map.m_lblk = map.m_lblk + ret;
-                map.m_len = len = len - ret;
+        while (ret >= 0 && len) {
                 handle = ext4_journal_start(inode, EXT4_HT_MAP_BLOCKS,
                                             credits);
                 if (IS_ERR(handle)) {
@@ -4709,6 +4710,21 @@ retry:
                         ret2 = ext4_journal_stop(handle);
                         break;
                 }
+                map.m_lblk += ret;
+                map.m_len = len = len - ret;
+                epos = (loff_t)map.m_lblk << inode->i_blkbits;
+                inode->i_ctime = ext4_current_time(inode);
+                if (new_size) {
+                        if (epos > new_size)
+                                epos = new_size;
+                        if (ext4_update_inode_size(inode, epos) & 0x1)
+                                inode->i_mtime = inode->i_ctime;
+                } else {
+                        if (epos > inode->i_size)
+                                ext4_set_inode_flag(inode,
+                                                    EXT4_INODE_EOFBLOCKS);
+                }
+                ext4_mark_inode_dirty(handle, inode);
                 ret2 = ext4_journal_stop(handle);
                 if (ret2)
                         break;
@@ -4731,7 +4747,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
         loff_t new_size = 0;
         int ret = 0;
         int flags;
-        int partial;
+        int credits;
+        int partial_begin, partial_end;
         loff_t start, end;
         ext4_lblk_t lblk;
         struct address_space *mapping = inode->i_mapping;
@@ -4771,7 +4788,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
 
         if (start < offset || end > offset + len)
                 return -EINVAL;
-        partial = (offset + len) & ((1 << blkbits) - 1);
+        partial_begin = offset & ((1 << blkbits) - 1);
+        partial_end = (offset + len) & ((1 << blkbits) - 1);
 
         lblk = start >> blkbits;
         max_blocks = (end >> blkbits);
@@ -4805,7 +4823,7 @@ static long ext4_zero_range(struct file *file, loff_t offset,
                  * If we have a partial block after EOF we have to allocate
                  * the entire block.
                  */
-                if (partial)
+                if (partial_end)
                         max_blocks += 1;
         }
 
@@ -4813,6 +4831,7 @@ static long ext4_zero_range(struct file *file, loff_t offset,
 
                 /* Now release the pages and zero block aligned part of pages*/
                 truncate_pagecache_range(inode, start, end - 1);
+                inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
 
                 /* Wait all existing dio workers, newcomers will block on i_mutex */
                 ext4_inode_block_unlocked_dio(inode);
@@ -4825,13 +4844,22 @@ static long ext4_zero_range(struct file *file, loff_t offset,
                 if (ret)
                         goto out_dio;
 
-                ret = ext4_alloc_file_blocks(file, lblk, max_blocks, flags,
-                                             mode);
+                ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size,
+                                             flags, mode);
                 if (ret)
                         goto out_dio;
         }
+        if (!partial_begin && !partial_end)
+                goto out_dio;
 
-        handle = ext4_journal_start(inode, EXT4_HT_MISC, 4);
+        /*
+         * In worst case we have to writeout two nonadjacent unwritten
+         * blocks and update the inode
+         */
+        credits = (2 * ext4_ext_index_trans_blocks(inode, 2)) + 1;
+        if (ext4_should_journal_data(inode))
+                credits += 2;
+        handle = ext4_journal_start(inode, EXT4_HT_MISC, credits);
         if (IS_ERR(handle)) {
                 ret = PTR_ERR(handle);
                 ext4_std_error(inode->i_sb, ret);
@@ -4839,12 +4867,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
         }
 
         inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
-
         if (new_size) {
-                if (new_size > i_size_read(inode))
-                        i_size_write(inode, new_size);
-                if (new_size > EXT4_I(inode)->i_disksize)
-                        ext4_update_i_disksize(inode, new_size);
+                ext4_update_inode_size(inode, new_size);
         } else {
                 /*
                 * Mark that we allocate beyond EOF so the subsequent truncate
@@ -4853,7 +4877,6 @@ static long ext4_zero_range(struct file *file, loff_t offset,
                 if ((offset + len) > i_size_read(inode))
                         ext4_set_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
         }
-
         ext4_mark_inode_dirty(handle, inode);
 
         /* Zero out partial block at the edges of the range */
@@ -4880,13 +4903,11 @@ out_mutex:
 long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 {
         struct inode *inode = file_inode(file);
-        handle_t *handle;
         loff_t new_size = 0;
         unsigned int max_blocks;
         int ret = 0;
         int flags;
         ext4_lblk_t lblk;
-        struct timespec tv;
         unsigned int blkbits = inode->i_blkbits;
 
         /* Return error if mode is not supported */
@@ -4937,36 +4958,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
                         goto out;
         }
 
-        ret = ext4_alloc_file_blocks(file, lblk, max_blocks, flags, mode);
+        ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size,
+                                     flags, mode);
         if (ret)
                 goto out;
 
-        handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
-        if (IS_ERR(handle))
-                goto out;
-
-        tv = inode->i_ctime = ext4_current_time(inode);
-
-        if (new_size) {
-                if (new_size > i_size_read(inode)) {
-                        i_size_write(inode, new_size);
-                        inode->i_mtime = tv;
-                }
-                if (new_size > EXT4_I(inode)->i_disksize)
-                        ext4_update_i_disksize(inode, new_size);
-        } else {
-                /*
-                * Mark that we allocate beyond EOF so the subsequent truncate
-                * can proceed even if the new size is the same as i_size.
-                */
-                if ((offset + len) > i_size_read(inode))
-                        ext4_set_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
+        if (file->f_flags & O_SYNC && EXT4_SB(inode->i_sb)->s_journal) {
+                ret = jbd2_complete_transaction(EXT4_SB(inode->i_sb)->s_journal,
+                                                EXT4_I(inode)->i_sync_tid);
         }
-        ext4_mark_inode_dirty(handle, inode);
-        if (file->f_flags & O_SYNC)
-                ext4_handle_sync(handle);
-
-        ext4_journal_stop(handle);
 out:
         mutex_unlock(&inode->i_mutex);
         trace_ext4_fallocate_exit(inode, offset, max_blocks, ret);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 367a60c07cf0..3aa26e9117c4 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1055,27 +1055,11 @@ static int ext4_write_end(struct file *file,
         } else
                 copied = block_write_end(file, mapping, pos,
                                          len, copied, page, fsdata);
-
         /*
-         * No need to use i_size_read() here, the i_size
-         * cannot change under us because we hole i_mutex.
-         *
-         * But it's important to update i_size while still holding page lock:
+         * it's important to update i_size while still holding page lock:
          * page writeout could otherwise come in and zero beyond i_size.
          */
-        if (pos + copied > inode->i_size) {
-                i_size_write(inode, pos + copied);
-                i_size_changed = 1;
-        }
-
-        if (pos + copied > EXT4_I(inode)->i_disksize) {
-                /* We need to mark inode dirty even if
-                 * new_i_size is less that inode->i_size
-                 * but greater than i_disksize. (hint delalloc)
-                 */
-                ext4_update_i_disksize(inode, (pos + copied));
-                i_size_changed = 1;
-        }
+        i_size_changed = ext4_update_inode_size(inode, pos + copied);
         unlock_page(page);
         page_cache_release(page);
 
@@ -1123,7 +1107,7 @@ static int ext4_journalled_write_end(struct file *file,
         int ret = 0, ret2;
         int partial = 0;
         unsigned from, to;
-        loff_t new_i_size;
+        int size_changed = 0;
 
         trace_ext4_journalled_write_end(inode, pos, len, copied);
         from = pos & (PAGE_CACHE_SIZE - 1);
@@ -1146,20 +1130,18 @@ static int ext4_journalled_write_end(struct file *file,
                 if (!partial)
                         SetPageUptodate(page);
         }
-        new_i_size = pos + copied;
-        if (new_i_size > inode->i_size)
-                i_size_write(inode, pos+copied);
+        size_changed = ext4_update_inode_size(inode, pos + copied);
         ext4_set_inode_state(inode, EXT4_STATE_JDATA);
         EXT4_I(inode)->i_datasync_tid = handle->h_transaction->t_tid;
-        if (new_i_size > EXT4_I(inode)->i_disksize) {
-                ext4_update_i_disksize(inode, new_i_size);
+        unlock_page(page);
+        page_cache_release(page);
+
+        if (size_changed) {
                 ret2 = ext4_mark_inode_dirty(handle, inode);
                 if (!ret)
                         ret = ret2;
         }
 
-        unlock_page(page);
-        page_cache_release(page);
         if (pos + len > inode->i_size && ext4_can_truncate(inode))
                 /* if we have allocated more blocks and copied
                  * less. We will have blocks allocated outside
@@ -2095,6 +2077,7 @@ static int mpage_map_and_submit_extent(handle_t *handle,
         struct ext4_map_blocks *map = &mpd->map;
         int err;
         loff_t disksize;
+        int progress = 0;
 
         mpd->io_submit.io_end->offset =
                                 ((loff_t)map->m_lblk) << inode->i_blkbits;
@@ -2111,8 +2094,11 @@ static int mpage_map_and_submit_extent(handle_t *handle,
                          * is non-zero, a commit should free up blocks.
                          */
                         if ((err == -ENOMEM) ||
-                            (err == -ENOSPC && ext4_count_free_clusters(sb)))
+                            (err == -ENOSPC && ext4_count_free_clusters(sb))) {
+                                if (progress)
+                                        goto update_disksize;
                                 return err;
+                        }
                         ext4_msg(sb, KERN_CRIT,
                                  "Delayed block allocation failed for "
                                  "inode %lu at logical offset %llu with"
@@ -2129,15 +2115,17 @@ static int mpage_map_and_submit_extent(handle_t *handle,
                         *give_up_on_write = true;
                         return err;
                 }
+                progress = 1;
                 /*
                  * Update buffer state, submit mapped pages, and get us new
                  * extent to map
                  */
                 err = mpage_map_and_submit_buffers(mpd);
                 if (err < 0)
-                        return err;
+                        goto update_disksize;
         } while (map->m_len);
 
+update_disksize:
         /*
          * Update on-disk size after IO is submitted.  Races with
          * truncate are avoided by checking i_size under i_data_sem.
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 956027711faf..8b0f9ef517d6 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1412,6 +1412,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
         int last = first + count - 1;
         struct super_block *sb = e4b->bd_sb;
 
+        if (WARN_ON(count == 0))
+                return;
         BUG_ON(last >= (sb->s_blocksize << 3));
         assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group));
         /* Don't bother if the block group is corrupt. */
@@ -3221,6 +3223,8 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
         int err;
 
         if (pa == NULL) {
+                if (ac->ac_f_ex.fe_len == 0)
+                        return;
                 err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
                 if (err) {
                         /*
@@ -3235,6 +3239,7 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
                 mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
                                ac->ac_f_ex.fe_len);
                 ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
+                ext4_mb_unload_buddy(&e4b);
                 return;
         }
         if (pa->pa_type == MB_INODE_PA)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index b147a67baa0d..90a3cdca3f88 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1227,7 +1227,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
                                    buffer */
         int num = 0;
         ext4_lblk_t  nblocks;
-        int i, err;
+        int i, err = 0;
         int namelen;
 
         *res_dir = NULL;
@@ -1264,7 +1264,11 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
                  * return.  Otherwise, fall back to doing a search the
                  * old fashioned way.
                  */
-                if (bh || (err != ERR_BAD_DX_DIR))
+                if (err == -ENOENT)
+                        return NULL;
+                if (err && err != ERR_BAD_DX_DIR)
+                        return ERR_PTR(err);
+                if (bh)
                         return bh;
                 dxtrace(printk(KERN_DEBUG "ext4_find_entry: dx failed, "
                                "falling back\n"));
@@ -1295,6 +1299,11 @@ restart:
                                 }
                                 num++;
                                 bh = ext4_getblk(NULL, dir, b++, 0, &err);
+                                if (unlikely(err)) {
+                                        if (ra_max == 0)
+                                                return ERR_PTR(err);
+                                        break;
+                                }
                                 bh_use[ra_max] = bh;
                                 if (bh)
                                         ll_rw_block(READ | REQ_META | REQ_PRIO,
@@ -1417,6 +1426,8 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
                 return ERR_PTR(-ENAMETOOLONG);
 
         bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return (struct dentry *) bh;
         inode = NULL;
         if (bh) {
                 __u32 ino = le32_to_cpu(de->inode);
@@ -1450,6 +1461,8 @@ struct dentry *ext4_get_parent(struct dentry *child)
         struct buffer_head *bh;
 
         bh = ext4_find_entry(child->d_inode, &dotdot, &de, NULL);
+        if (IS_ERR(bh))
+                return (struct dentry *) bh;
         if (!bh)
                 return ERR_PTR(-ENOENT);
         ino = le32_to_cpu(de->inode);
@@ -2727,6 +2740,8 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
 
         retval = -ENOENT;
         bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return PTR_ERR(bh);
         if (!bh)
                 goto end_rmdir;
 
@@ -2794,6 +2809,8 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
 
         retval = -ENOENT;
         bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return PTR_ERR(bh);
         if (!bh)
                 goto end_unlink;
 
@@ -3121,6 +3138,8 @@ static int ext4_find_delete_entry(handle_t *handle, struct inode *dir,
         struct ext4_dir_entry_2 *de;
 
         bh = ext4_find_entry(dir, d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return PTR_ERR(bh);
         if (bh) {
                 retval = ext4_delete_entry(handle, dir, de, bh);
                 brelse(bh);
@@ -3128,7 +3147,8 @@ static int ext4_find_delete_entry(handle_t *handle, struct inode *dir,
         return retval;
 }
 
-static void ext4_rename_delete(handle_t *handle, struct ext4_renament *ent)
+static void ext4_rename_delete(handle_t *handle, struct ext4_renament *ent,
+                               int force_reread)
 {
         int retval;
         /*
@@ -3140,7 +3160,8 @@ static void ext4_rename_delete(handle_t *handle, struct ext4_renament *ent)
         if (le32_to_cpu(ent->de->inode) != ent->inode->i_ino ||
             ent->de->name_len != ent->dentry->d_name.len ||
             strncmp(ent->de->name, ent->dentry->d_name.name,
-                    ent->de->name_len)) {
+                    ent->de->name_len) ||
+            force_reread) {
                 retval = ext4_find_delete_entry(handle, ent->dir,
                                                 &ent->dentry->d_name);
         } else {
@@ -3191,6 +3212,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 .dentry = new_dentry,
                 .inode = new_dentry->d_inode,
         };
+        int force_reread;
         int retval;
 
         dquot_initialize(old.dir);
@@ -3202,6 +3224,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 dquot_initialize(new.inode);
 
         old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL);
+        if (IS_ERR(old.bh))
+                return PTR_ERR(old.bh);
         /*
          *  Check for inode number is _not_ due to possible IO errors.
          *  We might rmdir the source, keep it as pwd of some process
@@ -3214,6 +3238,10 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         new.bh = ext4_find_entry(new.dir, &new.dentry->d_name,
                                  &new.de, &new.inlined);
+        if (IS_ERR(new.bh)) {
+                retval = PTR_ERR(new.bh);
+                goto end_rename;
+        }
         if (new.bh) {
                 if (!new.inode) {
                         brelse(new.bh);
@@ -3246,6 +3274,15 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (retval)
                         goto end_rename;
         }
+        /*
+         * If we're renaming a file within an inline_data dir and adding or
+         * setting the new dirent causes a conversion from inline_data to
+         * extents/blockmap, we need to force the dirent delete code to
+         * re-read the directory, or else we end up trying to delete a dirent
+         * from what is now the extent tree root (or a block map).
+         */
+        force_reread = (new.dir->i_ino == old.dir->i_ino &&
+                        ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA));
         if (!new.bh) {
                 retval = ext4_add_entry(handle, new.dentry, old.inode);
                 if (retval)
@@ -3256,6 +3293,9 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (retval)
                         goto end_rename;
         }
+        if (force_reread)
+                force_reread = !ext4_test_inode_flag(new.dir,
+                                                     EXT4_INODE_INLINE_DATA);
 
         /*
          * Like most other Unix systems, set the ctime for inodes on a
@@ -3267,7 +3307,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
         /*
          * ok, that's it
          */
-        ext4_rename_delete(handle, &old);
+        ext4_rename_delete(handle, &old, force_reread);
 
         if (new.inode) {
                 ext4_dec_count(handle, new.inode);
@@ -3330,6 +3370,8 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         old.bh = ext4_find_entry(old.dir, &old.dentry->d_name,
                                  &old.de, &old.inlined);
+        if (IS_ERR(old.bh))
+                return PTR_ERR(old.bh);
         /*
          *  Check for inode number is _not_ due to possible IO errors.
          *  We might rmdir the source, keep it as pwd of some process
@@ -3342,6 +3384,10 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         new.bh = ext4_find_entry(new.dir, &new.dentry->d_name,
                                  &new.de, &new.inlined);
+        if (IS_ERR(new.bh)) {
+                retval = PTR_ERR(new.bh);
+                goto end_rename;
+        }
 
         /* RENAME_EXCHANGE case: old *and* new must both exist */
         if (!new.bh || le32_to_cpu(new.de->inode) != new.inode->i_ino)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 32b43ad154b9..0b28b36e7915 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3181,9 +3181,9 @@ static int set_journal_csum_feature_set(struct super_block *sb)
 
         if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                        EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) {
-                /* journal checksum v2 */
+                /* journal checksum v3 */
                 compat = 0;
-                incompat = JBD2_FEATURE_INCOMPAT_CSUM_V2;
+                incompat = JBD2_FEATURE_INCOMPAT_CSUM_V3;
         } else {
                 /* journal checksum v1 */
                 compat = JBD2_FEATURE_COMPAT_CHECKSUM;
@@ -3205,6 +3205,7 @@ static int set_journal_csum_feature_set(struct super_block *sb)
                 jbd2_journal_clear_features(sbi->s_journal,
                                 JBD2_FEATURE_COMPAT_CHECKSUM, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT |
+                                JBD2_FEATURE_INCOMPAT_CSUM_V3 |
                                 JBD2_FEATURE_INCOMPAT_CSUM_V2);
         }
 
diff --git a/fs/f2fs/Kconfig b/fs/f2fs/Kconfig
index 214fe1054fce..736a348509f7 100644
--- a/fs/f2fs/Kconfig
+++ b/fs/f2fs/Kconfig
@@ -23,7 +23,7 @@ config F2FS_STAT_FS
           mounted as f2fs. Each file shows the whole f2fs information.
 
           /sys/kernel/debug/f2fs/status includes:
-            - major file system information managed by f2fs currently
+            - major filesystem information managed by f2fs currently
             - average SIT information about whole segments
             - current memory footprint consumed by f2fs.
 
@@ -68,6 +68,6 @@ config F2FS_CHECK_FS
         bool "F2FS consistency checking feature"
         depends on F2FS_FS
         help
-          Enables BUG_ONs which check the file system consistency in runtime.
+          Enables BUG_ONs which check the filesystem consistency in runtime.
 
           If you want to improve the performance, say N.
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 6aeed5bada52..ec3b7a5381fa 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -160,14 +160,11 @@ static int f2fs_write_meta_page(struct page *page,
                 goto redirty_out;
         if (wbc->for_reclaim)
                 goto redirty_out;
-
-        /* Should not write any meta pages, if any IO error was occurred */
-        if (unlikely(is_set_ckpt_flags(F2FS_CKPT(sbi), CP_ERROR_FLAG)))
-                goto no_write;
+        if (unlikely(f2fs_cp_error(sbi)))
+                goto redirty_out;
 
         f2fs_wait_on_page_writeback(page, META);
         write_meta_page(sbi, page);
-no_write:
         dec_page_count(sbi, F2FS_DIRTY_META);
         unlock_page(page);
         return 0;
@@ -348,7 +345,7 @@ bool exist_written_data(struct f2fs_sb_info *sbi, nid_t ino, int mode)
         return e ? true : false;
 }
 
-static void release_dirty_inode(struct f2fs_sb_info *sbi)
+void release_dirty_inode(struct f2fs_sb_info *sbi)
 {
         struct ino_entry *e, *tmp;
         int i;
@@ -446,8 +443,8 @@ static void write_orphan_inodes(struct f2fs_sb_info *sbi, block_t start_blk)
         struct f2fs_orphan_block *orphan_blk = NULL;
         unsigned int nentries = 0;
         unsigned short index;
-        unsigned short orphan_blocks = (unsigned short)((sbi->n_orphans +
-                (F2FS_ORPHANS_PER_BLOCK - 1)) / F2FS_ORPHANS_PER_BLOCK);
+        unsigned short orphan_blocks =
+                        (unsigned short)GET_ORPHAN_BLOCKS(sbi->n_orphans);
         struct page *page = NULL;
         struct ino_entry *orphan = NULL;
 
@@ -737,7 +734,7 @@ retry:
 /*
  * Freeze all the FS-operations for checkpoint.
  */
-static void block_operations(struct f2fs_sb_info *sbi)
+static int block_operations(struct f2fs_sb_info *sbi)
 {
         struct writeback_control wbc = {
                 .sync_mode = WB_SYNC_ALL,
@@ -745,6 +742,7 @@ static void block_operations(struct f2fs_sb_info *sbi)
                 .for_reclaim = 0,
         };
         struct blk_plug plug;
+        int err = 0;
 
         blk_start_plug(&plug);
 
@@ -754,11 +752,15 @@ retry_flush_dents:
         if (get_pages(sbi, F2FS_DIRTY_DENTS)) {
                 f2fs_unlock_all(sbi);
                 sync_dirty_dir_inodes(sbi);
+                if (unlikely(f2fs_cp_error(sbi))) {
+                        err = -EIO;
+                        goto out;
+                }
                 goto retry_flush_dents;
         }
 
         /*
-         * POR: we should ensure that there is no dirty node pages
+         * POR: we should ensure that there are no dirty node pages
          * until finishing nat/sit flush.
          */
 retry_flush_nodes:
@@ -767,9 +769,16 @@ retry_flush_nodes:
         if (get_pages(sbi, F2FS_DIRTY_NODES)) {
                 up_write(&sbi->node_write);
                 sync_node_pages(sbi, 0, &wbc);
+                if (unlikely(f2fs_cp_error(sbi))) {
+                        f2fs_unlock_all(sbi);
+                        err = -EIO;
+                        goto out;
+                }
                 goto retry_flush_nodes;
         }
+out:
         blk_finish_plug(&plug);
+        return err;
 }
 
 static void unblock_operations(struct f2fs_sb_info *sbi)
@@ -813,8 +822,11 @@ static void do_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
         discard_next_dnode(sbi, NEXT_FREE_BLKADDR(sbi, curseg));
 
         /* Flush all the NAT/SIT pages */
-        while (get_pages(sbi, F2FS_DIRTY_META))
+        while (get_pages(sbi, F2FS_DIRTY_META)) {
                 sync_meta_pages(sbi, META, LONG_MAX);
+                if (unlikely(f2fs_cp_error(sbi)))
+                        return;
+        }
 
         next_free_nid(sbi, &last_nid);
 
@@ -825,7 +837,7 @@ static void do_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
         ckpt->elapsed_time = cpu_to_le64(get_mtime(sbi));
         ckpt->valid_block_count = cpu_to_le64(valid_user_blocks(sbi));
         ckpt->free_segment_count = cpu_to_le32(free_segments(sbi));
-        for (i = 0; i < 3; i++) {
+        for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
                 ckpt->cur_node_segno[i] =
                         cpu_to_le32(curseg_segno(sbi, i + CURSEG_HOT_NODE));
                 ckpt->cur_node_blkoff[i] =
@@ -833,7 +845,7 @@ static void do_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
                 ckpt->alloc_type[i + CURSEG_HOT_NODE] =
                                 curseg_alloc_type(sbi, i + CURSEG_HOT_NODE);
         }
-        for (i = 0; i < 3; i++) {
+        for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
                 ckpt->cur_data_segno[i] =
                         cpu_to_le32(curseg_segno(sbi, i + CURSEG_HOT_DATA));
                 ckpt->cur_data_blkoff[i] =
@@ -848,24 +860,23 @@ static void do_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
 
         /* 2 cp  + n data seg summary + orphan inode blocks */
         data_sum_blocks = npages_for_summary_flush(sbi);
-        if (data_sum_blocks < 3)
+        if (data_sum_blocks < NR_CURSEG_DATA_TYPE)
                 set_ckpt_flags(ckpt, CP_COMPACT_SUM_FLAG);
         else
                 clear_ckpt_flags(ckpt, CP_COMPACT_SUM_FLAG);
 
-        orphan_blocks = (sbi->n_orphans + F2FS_ORPHANS_PER_BLOCK - 1)
-                                        / F2FS_ORPHANS_PER_BLOCK;
+        orphan_blocks = GET_ORPHAN_BLOCKS(sbi->n_orphans);
         ckpt->cp_pack_start_sum = cpu_to_le32(1 + cp_payload_blks +
                         orphan_blocks);
 
         if (is_umount) {
                 set_ckpt_flags(ckpt, CP_UMOUNT_FLAG);
-                ckpt->cp_pack_total_block_count = cpu_to_le32(2 +
+                ckpt->cp_pack_total_block_count = cpu_to_le32(F2FS_CP_PACKS+
                                 cp_payload_blks + data_sum_blocks +
                                 orphan_blocks + NR_CURSEG_NODE_TYPE);
         } else {
                 clear_ckpt_flags(ckpt, CP_UMOUNT_FLAG);
-                ckpt->cp_pack_total_block_count = cpu_to_le32(2 +
+                ckpt->cp_pack_total_block_count = cpu_to_le32(F2FS_CP_PACKS +
                                 cp_payload_blks + data_sum_blocks +
                                 orphan_blocks);
         }
@@ -924,6 +935,9 @@ static void do_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
         /* wait for previous submitted node/meta pages writeback */
         wait_on_all_pages_writeback(sbi);
 
+        if (unlikely(f2fs_cp_error(sbi)))
+                return;
+
         filemap_fdatawait_range(NODE_MAPPING(sbi), 0, LONG_MAX);
         filemap_fdatawait_range(META_MAPPING(sbi), 0, LONG_MAX);
 
@@ -934,15 +948,17 @@ static void do_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
         /* Here, we only have one bio having CP pack */
         sync_meta_pages(sbi, META_FLUSH, LONG_MAX);
 
-        if (!is_set_ckpt_flags(ckpt, CP_ERROR_FLAG)) {
-                clear_prefree_segments(sbi);
-                release_dirty_inode(sbi);
-                F2FS_RESET_SB_DIRT(sbi);
-        }
+        release_dirty_inode(sbi);
+
+        if (unlikely(f2fs_cp_error(sbi)))
+                return;
+
+        clear_prefree_segments(sbi);
+        F2FS_RESET_SB_DIRT(sbi);
 }
 
 /*
- * We guarantee that this checkpoint procedure should not fail.
+ * We guarantee that this checkpoint procedure will not fail.
  */
 void write_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
 {
@@ -952,7 +968,13 @@ void write_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
         trace_f2fs_write_checkpoint(sbi->sb, is_umount, "start block_ops");
 
         mutex_lock(&sbi->cp_mutex);
-        block_operations(sbi);
+
+        if (!sbi->s_dirty)
+                goto out;
+        if (unlikely(f2fs_cp_error(sbi)))
+                goto out;
+        if (block_operations(sbi))
+                goto out;
 
         trace_f2fs_write_checkpoint(sbi->sb, is_umount, "finish block_ops");
 
@@ -976,9 +998,9 @@ void write_checkpoint(struct f2fs_sb_info *sbi, bool is_umount)
         do_checkpoint(sbi, is_umount);
 
         unblock_operations(sbi);
-        mutex_unlock(&sbi->cp_mutex);
-
         stat_inc_cp_count(sbi->stat_info);
+out:
+        mutex_unlock(&sbi->cp_mutex);
         trace_f2fs_write_checkpoint(sbi->sb, is_umount, "finish checkpoint");
 }
 
@@ -999,8 +1021,8 @@ void init_ino_entry_info(struct f2fs_sb_info *sbi)
          * for cp pack we can have max 1020*504 orphan entries
          */
         sbi->n_orphans = 0;
-        sbi->max_orphans = (sbi->blocks_per_seg - 2 - NR_CURSEG_TYPE)
-                                * F2FS_ORPHANS_PER_BLOCK;
+        sbi->max_orphans = (sbi->blocks_per_seg - F2FS_CP_PACKS -
+                        NR_CURSEG_TYPE) * F2FS_ORPHANS_PER_BLOCK;
 }
 
 int __init create_checkpoint_caches(void)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 03313099c51c..76de83e25a89 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -53,7 +53,7 @@ static void f2fs_write_end_io(struct bio *bio, int err)
                 struct page *page = bvec->bv_page;
 
                 if (unlikely(err)) {
-                        SetPageError(page);
+                        set_page_dirty(page);
                         set_bit(AS_EIO, &page->mapping->flags);
                         f2fs_stop_checkpoint(sbi);
                 }
@@ -691,7 +691,7 @@ get_next:
                         allocated = true;
                         blkaddr = dn.data_blkaddr;
                 }
-                /* Give more consecutive addresses for the read ahead */
+                /* Give more consecutive addresses for the readahead */
                 if (blkaddr == (bh_result->b_blocknr + ofs)) {
                         ofs++;
                         dn.ofs_in_node++;
@@ -739,7 +739,7 @@ static int f2fs_read_data_page(struct file *file, struct page *page)
 
         trace_f2fs_readpage(page, DATA);
 
-        /* If the file has inline data, try to read it directlly */
+        /* If the file has inline data, try to read it directly */
         if (f2fs_has_inline_data(inode))
                 ret = f2fs_read_inline_data(inode, page);
         else
@@ -836,10 +836,19 @@ write:
 
         /* Dentry blocks are controlled by checkpoint */
         if (S_ISDIR(inode->i_mode)) {
+                if (unlikely(f2fs_cp_error(sbi)))
+                        goto redirty_out;
                 err = do_write_data_page(page, &fio);
                 goto done;
         }
 
+        /* we should bypass data pages to proceed the kworkder jobs */
+        if (unlikely(f2fs_cp_error(sbi))) {
+                SetPageError(page);
+                unlock_page(page);
+                return 0;
+        }
+
         if (!wbc->for_reclaim)
                 need_balance_fs = true;
         else if (has_not_enough_free_secs(sbi, 0))
@@ -927,7 +936,7 @@ static void f2fs_write_failed(struct address_space *mapping, loff_t to)
 
         if (to > inode->i_size) {
                 truncate_pagecache(inode, inode->i_size);
-                truncate_blocks(inode, inode->i_size);
+                truncate_blocks(inode, inode->i_size, true);
         }
 }
 
@@ -946,7 +955,7 @@ static int f2fs_write_begin(struct file *file, struct address_space *mapping,
 
         f2fs_balance_fs(sbi);
 repeat:
-        err = f2fs_convert_inline_data(inode, pos + len);
+        err = f2fs_convert_inline_data(inode, pos + len, NULL);
         if (err)
                 goto fail;
 
diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
index a441ba33be11..fecebdbfd781 100644
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -32,7 +32,7 @@ static void update_general_status(struct f2fs_sb_info *sbi)
         struct f2fs_stat_info *si = F2FS_STAT(sbi);
         int i;
 
-        /* valid check of the segment numbers */
+        /* validation check of the segment numbers */
         si->hit_ext = sbi->read_hit_ext;
         si->total_ext = sbi->total_hit_ext;
         si->ndirty_node = get_pages(sbi, F2FS_DIRTY_NODES);
@@ -152,7 +152,7 @@ static void update_mem_info(struct f2fs_sb_info *sbi)
         si->base_mem += NR_DIRTY_TYPE * f2fs_bitmap_size(TOTAL_SEGS(sbi));
         si->base_mem += f2fs_bitmap_size(TOTAL_SECS(sbi));
 
-        /* buld nm */
+        /* build nm */
         si->base_mem += sizeof(struct f2fs_nm_info);
         si->base_mem += __bitmap_size(sbi, NAT_BITMAP);
 
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index bcf893c3d903..155fb056b7f1 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -124,7 +124,7 @@ static struct f2fs_dir_entry *find_in_block(struct page *dentry_page,
 
                 /*
                  * For the most part, it should be a bug when name_len is zero.
-                 * We stop here for figuring out where the bugs are occurred.
+                 * We stop here for figuring out where the bugs has occurred.
                  */
                 f2fs_bug_on(!de->name_len);
 
@@ -391,7 +391,7 @@ put_error:
 error:
         /* once the failed inode becomes a bad inode, i_mode is S_IFREG */
         truncate_inode_pages(&inode->i_data, 0);
-        truncate_blocks(inode, 0);
+        truncate_blocks(inode, 0, false);
         remove_dirty_dir_inode(inode);
         remove_inode_page(inode);
         return ERR_PTR(err);
@@ -563,7 +563,7 @@ fail:
 }
 
 /*
- * It only removes the dentry from the dentry page,corresponding name
+ * It only removes the dentry from the dentry page, corresponding name
  * entry in name page does not need to be touched during deletion.
  */
 void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 4dab5338a97a..e921242186f6 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -24,7 +24,7 @@
 #define f2fs_bug_on(condition)  BUG_ON(condition)
 #define f2fs_down_write(x, y)   down_write_nest_lock(x, y)
 #else
-#define f2fs_bug_on(condition)
+#define f2fs_bug_on(condition)  WARN_ON(condition)
 #define f2fs_down_write(x, y)   down_write(x)
 #endif
 
@@ -395,7 +395,7 @@ enum count_type {
 };
 
 /*
- * The below are the page types of bios used in submti_bio().
+ * The below are the page types of bios used in submit_bio().
  * The available types are:
  * DATA                 User data pages. It operates as async mode.
  * NODE                 Node pages. It operates as async mode.
@@ -470,7 +470,7 @@ struct f2fs_sb_info {
         struct list_head dir_inode_list;        /* dir inode list */
         spinlock_t dir_inode_lock;              /* for dir inode list lock */
 
-        /* basic file system units */
+        /* basic filesystem units */
         unsigned int log_sectors_per_block;     /* log2 sectors per block */
         unsigned int log_blocksize;             /* log2 block size */
         unsigned int blocksize;                 /* block size */
@@ -799,7 +799,7 @@ static inline block_t __start_cp_addr(struct f2fs_sb_info *sbi)
 
         /*
          * odd numbered checkpoint should at cp segment 0
-         * and even segent must be at cp segment 1
+         * and even segment must be at cp segment 1
          */
         if (!(ckpt_version & 1))
                 start_addr += sbi->blocks_per_seg;
@@ -1096,6 +1096,11 @@ static inline int f2fs_readonly(struct super_block *sb)
         return sb->s_flags & MS_RDONLY;
 }
 
+static inline bool f2fs_cp_error(struct f2fs_sb_info *sbi)
+{
+        return is_set_ckpt_flags(sbi->ckpt, CP_ERROR_FLAG);
+}
+
 static inline void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi)
 {
         set_ckpt_flags(sbi->ckpt, CP_ERROR_FLAG);
@@ -1117,7 +1122,7 @@ static inline void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi)
  */
 int f2fs_sync_file(struct file *, loff_t, loff_t, int);
 void truncate_data_blocks(struct dnode_of_data *);
-int truncate_blocks(struct inode *, u64);
+int truncate_blocks(struct inode *, u64, bool);
 void f2fs_truncate(struct inode *);
 int f2fs_getattr(struct vfsmount *, struct dentry *, struct kstat *);
 int f2fs_setattr(struct dentry *, struct iattr *);
@@ -1202,10 +1207,8 @@ int sync_node_pages(struct f2fs_sb_info *, nid_t, struct writeback_control *);
 bool alloc_nid(struct f2fs_sb_info *, nid_t *);
 void alloc_nid_done(struct f2fs_sb_info *, nid_t);
 void alloc_nid_failed(struct f2fs_sb_info *, nid_t);
-void recover_node_page(struct f2fs_sb_info *, struct page *,
-                struct f2fs_summary *, struct node_info *, block_t);
 void recover_inline_xattr(struct inode *, struct page *);
-bool recover_xattr_data(struct inode *, struct page *, block_t);
+void recover_xattr_data(struct inode *, struct page *, block_t);
 int recover_inode_page(struct f2fs_sb_info *, struct page *);
 int restore_node_summary(struct f2fs_sb_info *, unsigned int,
                                 struct f2fs_summary_block *);
@@ -1238,8 +1241,6 @@ void write_data_page(struct page *, struct dnode_of_data *, block_t *,
 void rewrite_data_page(struct page *, block_t, struct f2fs_io_info *);
 void recover_data_page(struct f2fs_sb_info *, struct page *,
                                 struct f2fs_summary *, block_t, block_t);
-void rewrite_node_page(struct f2fs_sb_info *, struct page *,
-                                struct f2fs_summary *, block_t, block_t);
 void allocate_data_block(struct f2fs_sb_info *, struct page *,
                 block_t, block_t *, struct f2fs_summary *, int);
 void f2fs_wait_on_page_writeback(struct page *, enum page_type);
@@ -1262,6 +1263,7 @@ int ra_meta_pages(struct f2fs_sb_info *, int, int, int);
 long sync_meta_pages(struct f2fs_sb_info *, enum page_type, long);
 void add_dirty_inode(struct f2fs_sb_info *, nid_t, int type);
 void remove_dirty_inode(struct f2fs_sb_info *, nid_t, int type);
+void release_dirty_inode(struct f2fs_sb_info *);
 bool exist_written_data(struct f2fs_sb_info *, nid_t, int);
 int acquire_orphan_inode(struct f2fs_sb_info *);
 void release_orphan_inode(struct f2fs_sb_info *);
@@ -1439,8 +1441,8 @@ extern const struct inode_operations f2fs_special_inode_operations;
  */
 bool f2fs_may_inline(struct inode *);
 int f2fs_read_inline_data(struct inode *, struct page *);
-int f2fs_convert_inline_data(struct inode *, pgoff_t);
+int f2fs_convert_inline_data(struct inode *, pgoff_t, struct page *);
 int f2fs_write_inline_data(struct inode *, struct page *, unsigned int);
 void truncate_inline_data(struct inode *, u64);
-int recover_inline_data(struct inode *, struct page *);
+bool recover_inline_data(struct inode *, struct page *);
 #endif
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 208f1a9bd569..060aee65aee8 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -41,6 +41,11 @@ static int f2fs_vm_page_mkwrite(struct vm_area_struct *vma,
 
         sb_start_pagefault(inode->i_sb);
 
+        /* force to convert with normal data indices */
+        err = f2fs_convert_inline_data(inode, MAX_INLINE_DATA + 1, page);
+        if (err)
+                goto out;
+
         /* block allocation */
         f2fs_lock_op(sbi);
         set_new_dnode(&dn, inode, NULL, NULL, 0);
@@ -110,6 +115,25 @@ static int get_parent_ino(struct inode *inode, nid_t *pino)
         return 1;
 }
 
+static inline bool need_do_checkpoint(struct inode *inode)
+{
+        struct f2fs_sb_info *sbi = F2FS_SB(inode->i_sb);
+        bool need_cp = false;
+
+        if (!S_ISREG(inode->i_mode) || inode->i_nlink != 1)
+                need_cp = true;
+        else if (file_wrong_pino(inode))
+                need_cp = true;
+        else if (!space_for_roll_forward(sbi))
+                need_cp = true;
+        else if (!is_checkpointed_node(sbi, F2FS_I(inode)->i_pino))
+                need_cp = true;
+        else if (F2FS_I(inode)->xattr_ver == cur_cp_version(F2FS_CKPT(sbi)))
+                need_cp = true;
+
+        return need_cp;
+}
+
 int f2fs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
 {
         struct inode *inode = file->f_mapping->host;
@@ -154,23 +178,12 @@ int f2fs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         /* guarantee free sections for fsync */
         f2fs_balance_fs(sbi);
 
-        down_read(&fi->i_sem);
-
         /*
          * Both of fdatasync() and fsync() are able to be recovered from
          * sudden-power-off.
          */
-        if (!S_ISREG(inode->i_mode) || inode->i_nlink != 1)
-                need_cp = true;
-        else if (file_wrong_pino(inode))
-                need_cp = true;
-        else if (!space_for_roll_forward(sbi))
-                need_cp = true;
-        else if (!is_checkpointed_node(sbi, F2FS_I(inode)->i_pino))
-                need_cp = true;
-        else if (F2FS_I(inode)->xattr_ver == cur_cp_version(F2FS_CKPT(sbi)))
-                need_cp = true;
-
+        down_read(&fi->i_sem);
+        need_cp = need_do_checkpoint(inode);
         up_read(&fi->i_sem);
 
         if (need_cp) {
@@ -288,7 +301,7 @@ static loff_t f2fs_seek_block(struct file *file, loff_t offset, int whence)
                 if (err && err != -ENOENT) {
                         goto fail;
                 } else if (err == -ENOENT) {
-                        /* direct node is not exist */
+                        /* direct node does not exists */
                         if (whence == SEEK_DATA) {
                                 pgofs = PGOFS_OF_NEXT_DNODE(pgofs,
                                                         F2FS_I(inode));
@@ -417,7 +430,7 @@ out:
         f2fs_put_page(page, 1);
 }
 
-int truncate_blocks(struct inode *inode, u64 from)
+int truncate_blocks(struct inode *inode, u64 from, bool lock)
 {
         struct f2fs_sb_info *sbi = F2FS_SB(inode->i_sb);
         unsigned int blocksize = inode->i_sb->s_blocksize;
@@ -433,14 +446,16 @@ int truncate_blocks(struct inode *inode, u64 from)
         free_from = (pgoff_t)
                         ((from + blocksize - 1) >> (sbi->log_blocksize));
 
-        f2fs_lock_op(sbi);
+        if (lock)
+                f2fs_lock_op(sbi);
 
         set_new_dnode(&dn, inode, NULL, NULL, 0);
         err = get_dnode_of_data(&dn, free_from, LOOKUP_NODE);
         if (err) {
                 if (err == -ENOENT)
                         goto free_next;
-                f2fs_unlock_op(sbi);
+                if (lock)
+                        f2fs_unlock_op(sbi);
                 trace_f2fs_truncate_blocks_exit(inode, err);
                 return err;
         }
@@ -458,7 +473,8 @@ int truncate_blocks(struct inode *inode, u64 from)
         f2fs_put_dnode(&dn);
 free_next:
         err = truncate_inode_blocks(inode, free_from);
-        f2fs_unlock_op(sbi);
+        if (lock)
+                f2fs_unlock_op(sbi);
 done:
         /* lastly zero out the first data page */
         truncate_partial_data_page(inode, from);
@@ -475,7 +491,7 @@ void f2fs_truncate(struct inode *inode)
 
         trace_f2fs_truncate(inode);
 
-        if (!truncate_blocks(inode, i_size_read(inode))) {
+        if (!truncate_blocks(inode, i_size_read(inode), true)) {
                 inode->i_mtime = inode->i_ctime = CURRENT_TIME;
                 mark_inode_dirty(inode);
         }
@@ -533,7 +549,7 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
 
         if ((attr->ia_valid & ATTR_SIZE) &&
                         attr->ia_size != i_size_read(inode)) {
-                err = f2fs_convert_inline_data(inode, attr->ia_size);
+                err = f2fs_convert_inline_data(inode, attr->ia_size, NULL);
                 if (err)
                         return err;
 
@@ -622,7 +638,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
         loff_t off_start, off_end;
         int ret = 0;
 
-        ret = f2fs_convert_inline_data(inode, MAX_INLINE_DATA + 1);
+        ret = f2fs_convert_inline_data(inode, MAX_INLINE_DATA + 1, NULL);
         if (ret)
                 return ret;
 
@@ -678,7 +694,7 @@ static int expand_inode_data(struct inode *inode, loff_t offset,
         if (ret)
                 return ret;
 
-        ret = f2fs_convert_inline_data(inode, offset + len);
+        ret = f2fs_convert_inline_data(inode, offset + len, NULL);
         if (ret)
                 return ret;
 
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index d7947d90ccc3..943a31db7cc3 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -58,7 +58,7 @@ static int gc_thread_func(void *data)
                  * 3. IO subsystem is idle by checking the # of requests in
                  *    bdev's request list.
                  *
-                 * Note) We have to avoid triggering GCs too much frequently.
+                 * Note) We have to avoid triggering GCs frequently.
                  * Because it is possible that some segments can be
                  * invalidated soon after by user update or deletion.
                  * So, I'd like to wait some time to collect dirty segments.
@@ -222,7 +222,7 @@ static unsigned int get_cb_cost(struct f2fs_sb_info *sbi, unsigned int segno)
 
         u = (vblocks * 100) >> sbi->log_blocks_per_seg;
 
-        /* Handle if the system time is changed by user */
+        /* Handle if the system time has changed by the user */
         if (mtime < sit_i->min_mtime)
                 sit_i->min_mtime = mtime;
         if (mtime > sit_i->max_mtime)
@@ -593,7 +593,7 @@ next_step:
 
                 if (phase == 2) {
                         inode = f2fs_iget(sb, dni.ino);
-                        if (IS_ERR(inode))
+                        if (IS_ERR(inode) || is_bad_inode(inode))
                                 continue;
 
                         start_bidx = start_bidx_of_node(nofs, F2FS_I(inode));
@@ -693,7 +693,7 @@ int f2fs_gc(struct f2fs_sb_info *sbi)
 gc_more:
         if (unlikely(!(sbi->sb->s_flags & MS_ACTIVE)))
                 goto stop;
-        if (unlikely(is_set_ckpt_flags(F2FS_CKPT(sbi), CP_ERROR_FLAG)))
+        if (unlikely(f2fs_cp_error(sbi)))
                 goto stop;
 
         if (gc_type == BG_GC && has_not_enough_free_secs(sbi, nfree)) {
diff --git a/fs/f2fs/gc.h b/fs/f2fs/gc.h
index 5d5eb6047bf4..16f0b2b22999 100644
--- a/fs/f2fs/gc.h
+++ b/fs/f2fs/gc.h
@@ -91,7 +91,7 @@ static inline bool has_enough_invalid_blocks(struct f2fs_sb_info *sbi)
         block_t invalid_user_blocks = sbi->user_block_count -
                                         written_block_count(sbi);
         /*
-         * Background GC is triggered with the following condition.
+         * Background GC is triggered with the following conditions.
          * 1. There are a number of invalid blocks.
          * 2. There is not enough free space.
          */
diff --git a/fs/f2fs/hash.c b/fs/f2fs/hash.c
index 948d17bf7281..a844fcfb9a8d 100644
--- a/fs/f2fs/hash.c
+++ b/fs/f2fs/hash.c
@@ -42,7 +42,8 @@ static void TEA_transform(unsigned int buf[4], unsigned int const in[])
         buf[1] += b1;
 }
 
-static void str2hashbuf(const char *msg, size_t len, unsigned int *buf, int num)
+static void str2hashbuf(const unsigned char *msg, size_t len,
+                                unsigned int *buf, int num)
 {
         unsigned pad, val;
         int i;
@@ -73,9 +74,9 @@ f2fs_hash_t f2fs_dentry_hash(const struct qstr *name_info)
 {
         __u32 hash;
         f2fs_hash_t f2fs_hash;
-        const char *p;
+        const unsigned char *p;
         __u32 in[8], buf[4];
-        const char *name = name_info->name;
+        const unsigned char *name = name_info->name;
         size_t len = name_info->len;
 
         if ((len <= 2) && (name[0] == '.') &&
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 5beeccef9ae1..3e8ecdf3742b 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -68,7 +68,7 @@ out:
 
 static int __f2fs_convert_inline_data(struct inode *inode, struct page *page)
 {
-        int err;
+        int err = 0;
         struct page *ipage;
         struct dnode_of_data dn;
         void *src_addr, *dst_addr;
@@ -86,6 +86,10 @@ static int __f2fs_convert_inline_data(struct inode *inode, struct page *page)
                 goto out;
         }
 
+        /* someone else converted inline_data already */
+        if (!f2fs_has_inline_data(inode))
+                goto out;
+
         /*
          * i_addr[0] is not used for inline data,
          * so reserving new block will not destroy inline data
@@ -124,9 +128,10 @@ out:
         return err;
 }
 
-int f2fs_convert_inline_data(struct inode *inode, pgoff_t to_size)
+int f2fs_convert_inline_data(struct inode *inode, pgoff_t to_size,
+                                                struct page *page)
 {
-        struct page *page;
+        struct page *new_page = page;
         int err;
 
         if (!f2fs_has_inline_data(inode))
@@ -134,17 +139,20 @@ int f2fs_convert_inline_data(struct inode *inode, pgoff_t to_size)
         else if (to_size <= MAX_INLINE_DATA)
                 return 0;
 
-        page = grab_cache_page(inode->i_mapping, 0);
-        if (!page)
-                return -ENOMEM;
+        if (!page || page->index != 0) {
+                new_page = grab_cache_page(inode->i_mapping, 0);
+                if (!new_page)
+                        return -ENOMEM;
+        }
 
-        err = __f2fs_convert_inline_data(inode, page);
-        f2fs_put_page(page, 1);
+        err = __f2fs_convert_inline_data(inode, new_page);
+        if (!page || page->index != 0)
+                f2fs_put_page(new_page, 1);
         return err;
 }
 
 int f2fs_write_inline_data(struct inode *inode,
-                           struct page *page, unsigned size)
+                                struct page *page, unsigned size)
 {
         void *src_addr, *dst_addr;
         struct page *ipage;
@@ -199,7 +207,7 @@ void truncate_inline_data(struct inode *inode, u64 from)
         f2fs_put_page(ipage, 1);
 }
 
-int recover_inline_data(struct inode *inode, struct page *npage)
+bool recover_inline_data(struct inode *inode, struct page *npage)
 {
         struct f2fs_sb_info *sbi = F2FS_SB(inode->i_sb);
         struct f2fs_inode *ri = NULL;
@@ -218,7 +226,7 @@ int recover_inline_data(struct inode *inode, struct page *npage)
                 ri = F2FS_INODE(npage);
 
         if (f2fs_has_inline_data(inode) &&
-                        ri && ri->i_inline & F2FS_INLINE_DATA) {
+                        ri && (ri->i_inline & F2FS_INLINE_DATA)) {
 process_inline:
                 ipage = get_node_page(sbi, inode->i_ino);
                 f2fs_bug_on(IS_ERR(ipage));
@@ -230,7 +238,7 @@ process_inline:
                 memcpy(dst_addr, src_addr, MAX_INLINE_DATA);
                 update_inode(inode, ipage);
                 f2fs_put_page(ipage, 1);
-                return -1;
+                return true;
         }
 
         if (f2fs_has_inline_data(inode)) {
@@ -242,10 +250,10 @@ process_inline:
                 clear_inode_flag(F2FS_I(inode), FI_INLINE_DATA);
                 update_inode(inode, ipage);
                 f2fs_put_page(ipage, 1);
-        } else if (ri && ri->i_inline & F2FS_INLINE_DATA) {
-                truncate_blocks(inode, 0);
+        } else if (ri && (ri->i_inline & F2FS_INLINE_DATA)) {
+                truncate_blocks(inode, 0, false);
                 set_inode_flag(F2FS_I(inode), FI_INLINE_DATA);
                 goto process_inline;
         }
-        return 0;
+        return false;
 }
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 27b03776ffd2..ee103fd7283c 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -134,9 +134,7 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
         return 0;
 out:
         clear_nlink(inode);
-        unlock_new_inode(inode);
-        make_bad_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         alloc_nid_failed(sbi, ino);
         return err;
 }
@@ -229,7 +227,7 @@ static int f2fs_unlink(struct inode *dir, struct dentry *dentry)
         f2fs_delete_entry(de, page, inode);
         f2fs_unlock_op(sbi);
 
-        /* In order to evict this inode,  we set it dirty */
+        /* In order to evict this inode, we set it dirty */
         mark_inode_dirty(inode);
 fail:
         trace_f2fs_unlink_exit(inode, err);
@@ -267,9 +265,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
         return err;
 out:
         clear_nlink(inode);
-        unlock_new_inode(inode);
-        make_bad_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         alloc_nid_failed(sbi, inode->i_ino);
         return err;
 }
@@ -308,9 +304,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 out_fail:
         clear_inode_flag(F2FS_I(inode), FI_INC_LINK);
         clear_nlink(inode);
-        unlock_new_inode(inode);
-        make_bad_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         alloc_nid_failed(sbi, inode->i_ino);
         return err;
 }
@@ -354,9 +348,7 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry,
         return 0;
 out:
         clear_nlink(inode);
-        unlock_new_inode(inode);
-        make_bad_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         alloc_nid_failed(sbi, inode->i_ino);
         return err;
 }
@@ -688,9 +680,7 @@ release_out:
 out:
         f2fs_unlock_op(sbi);
         clear_nlink(inode);
-        unlock_new_inode(inode);
-        make_bad_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         alloc_nid_failed(sbi, inode->i_ino);
         return err;
 }
@@ -704,7 +694,6 @@ const struct inode_operations f2fs_dir_inode_operations = {
         .mkdir          = f2fs_mkdir,
         .rmdir          = f2fs_rmdir,
         .mknod          = f2fs_mknod,
-        .rename         = f2fs_rename,
         .rename2        = f2fs_rename2,
         .tmpfile        = f2fs_tmpfile,
         .getattr        = f2fs_getattr,
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index d3d90d284631..45378196e19a 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -237,7 +237,7 @@ retry:
                         nat_get_blkaddr(e) != NULL_ADDR &&
                         new_blkaddr == NEW_ADDR);
 
-        /* increament version no as node is removed */
+        /* increment version no as node is removed */
         if (nat_get_blkaddr(e) != NEW_ADDR && new_blkaddr == NULL_ADDR) {
                 unsigned char version = nat_get_version(e);
                 nat_set_version(e, inc_node_version(version));
@@ -274,7 +274,7 @@ int try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink)
 }
 
 /*
- * This function returns always success
+ * This function always returns success
  */
 void get_node_info(struct f2fs_sb_info *sbi, nid_t nid, struct node_info *ni)
 {
@@ -650,7 +650,7 @@ static int truncate_partial_nodes(struct dnode_of_data *dn,
 
         /* get indirect nodes in the path */
         for (i = 0; i < idx + 1; i++) {
-                /* refernece count'll be increased */
+                /* reference count'll be increased */
                 pages[i] = get_node_page(sbi, nid[i]);
                 if (IS_ERR(pages[i])) {
                         err = PTR_ERR(pages[i]);
@@ -823,22 +823,26 @@ int truncate_xattr_node(struct inode *inode, struct page *page)
  */
 void remove_inode_page(struct inode *inode)
 {
-        struct f2fs_sb_info *sbi = F2FS_SB(inode->i_sb);
-        struct page *page;
-        nid_t ino = inode->i_ino;
         struct dnode_of_data dn;
 
-        page = get_node_page(sbi, ino);
-        if (IS_ERR(page))
+        set_new_dnode(&dn, inode, NULL, NULL, inode->i_ino);
+        if (get_dnode_of_data(&dn, 0, LOOKUP_NODE))
                 return;
 
-        if (truncate_xattr_node(inode, page)) {
-                f2fs_put_page(page, 1);
+        if (truncate_xattr_node(inode, dn.inode_page)) {
+                f2fs_put_dnode(&dn);
                 return;
         }
-        /* 0 is possible, after f2fs_new_inode() is failed */
+
+        /* remove potential inline_data blocks */
+        if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                                S_ISLNK(inode->i_mode))
+                truncate_data_blocks_range(&dn, 1);
+
+        /* 0 is possible, after f2fs_new_inode() has failed */
         f2fs_bug_on(inode->i_blocks != 0 && inode->i_blocks != 1);
-        set_new_dnode(&dn, inode, page, page, ino);
+
+        /* will put inode & node pages */
         truncate_node(&dn);
 }
 
@@ -1129,8 +1133,11 @@ continue_unlock:
                                 set_fsync_mark(page, 0);
                                 set_dentry_mark(page, 0);
                         }
-                        NODE_MAPPING(sbi)->a_ops->writepage(page, wbc);
-                        wrote++;
+
+                        if (NODE_MAPPING(sbi)->a_ops->writepage(page, wbc))
+                                unlock_page(page);
+                        else
+                                wrote++;
 
                         if (--wbc->nr_to_write == 0)
                                 break;
@@ -1212,6 +1219,8 @@ static int f2fs_write_node_page(struct page *page,
 
         if (unlikely(sbi->por_doing))
                 goto redirty_out;
+        if (unlikely(f2fs_cp_error(sbi)))
+                goto redirty_out;
 
         f2fs_wait_on_page_writeback(page, NODE);
 
@@ -1540,15 +1549,6 @@ void alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid)
                 kmem_cache_free(free_nid_slab, i);
 }
 
-void recover_node_page(struct f2fs_sb_info *sbi, struct page *page,
-                struct f2fs_summary *sum, struct node_info *ni,
-                block_t new_blkaddr)
-{
-        rewrite_node_page(sbi, page, sum, ni->blk_addr, new_blkaddr);
-        set_node_addr(sbi, ni, new_blkaddr, false);
-        clear_node_page_dirty(page);
-}
-
 void recover_inline_xattr(struct inode *inode, struct page *page)
 {
         struct f2fs_sb_info *sbi = F2FS_SB(inode->i_sb);
@@ -1557,40 +1557,33 @@ void recover_inline_xattr(struct inode *inode, struct page *page)
         struct page *ipage;
         struct f2fs_inode *ri;
 
-        if (!f2fs_has_inline_xattr(inode))
-                return;
-
-        if (!IS_INODE(page))
-                return;
-
-        ri = F2FS_INODE(page);
-        if (!(ri->i_inline & F2FS_INLINE_XATTR))
-                return;
-
         ipage = get_node_page(sbi, inode->i_ino);
         f2fs_bug_on(IS_ERR(ipage));
 
+        ri = F2FS_INODE(page);
+        if (!(ri->i_inline & F2FS_INLINE_XATTR)) {
+                clear_inode_flag(F2FS_I(inode), FI_INLINE_XATTR);
+                goto update_inode;
+        }
+
         dst_addr = inline_xattr_addr(ipage);
         src_addr = inline_xattr_addr(page);
         inline_size = inline_xattr_size(inode);
 
         f2fs_wait_on_page_writeback(ipage, NODE);
         memcpy(dst_addr, src_addr, inline_size);
-
+update_inode:
         update_inode(inode, ipage);
         f2fs_put_page(ipage, 1);
 }
 
-bool recover_xattr_data(struct inode *inode, struct page *page, block_t blkaddr)
+void recover_xattr_data(struct inode *inode, struct page *page, block_t blkaddr)
 {
         struct f2fs_sb_info *sbi = F2FS_SB(inode->i_sb);
         nid_t prev_xnid = F2FS_I(inode)->i_xattr_nid;
         nid_t new_xnid = nid_of_node(page);
         struct node_info ni;
 
-        if (!f2fs_has_xattr_block(ofs_of_node(page)))
-                return false;
-
         /* 1: invalidate the previous xattr nid */
         if (!prev_xnid)
                 goto recover_xnid;
@@ -1618,7 +1611,6 @@ recover_xnid:
         set_node_addr(sbi, &ni, blkaddr, false);
 
         update_inode_page(inode);
-        return true;
 }
 
 int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page)
@@ -1637,7 +1629,7 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page)
         if (!ipage)
                 return -ENOMEM;
 
-        /* Should not use this inode  from free nid list */
+        /* Should not use this inode from free nid list */
         remove_free_nid(NM_I(sbi), ino);
 
         SetPageUptodate(ipage);
@@ -1651,6 +1643,7 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page)
         dst->i_blocks = cpu_to_le64(1);
         dst->i_links = cpu_to_le32(1);
         dst->i_xattr_nid = 0;
+        dst->i_inline = src->i_inline & F2FS_INLINE_XATTR;
 
         new_ni = old_ni;
         new_ni.ino = ino;
@@ -1659,13 +1652,14 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page)
                 WARN_ON(1);
         set_node_addr(sbi, &new_ni, NEW_ADDR, false);
         inc_valid_inode_count(sbi);
+        set_page_dirty(ipage);
         f2fs_put_page(ipage, 1);
         return 0;
 }
 
 /*
  * ra_sum_pages() merge contiguous pages into one bio and submit.
- * these pre-readed pages are alloced in bd_inode's mapping tree.
+ * these pre-read pages are allocated in bd_inode's mapping tree.
  */
 static int ra_sum_pages(struct f2fs_sb_info *sbi, struct page **pages,
                                 int start, int nrpages)
@@ -1709,7 +1703,7 @@ int restore_node_summary(struct f2fs_sb_info *sbi,
         for (i = 0; !err && i < last_offset; i += nrpages, addr += nrpages) {
                 nrpages = min(last_offset - i, bio_blocks);
 
-                /* read ahead node pages */
+                /* readahead node pages */
                 nrpages = ra_sum_pages(sbi, pages, addr, nrpages);
                 if (!nrpages)
                         return -ENOMEM;
@@ -1967,7 +1961,7 @@ static int init_node_manager(struct f2fs_sb_info *sbi)
         nm_i->max_nid = NAT_ENTRY_PER_BLOCK * nat_blocks;
 
         /* not used nids: 0, node, meta, (and root counted as valid node) */
-        nm_i->available_nids = nm_i->max_nid - 3;
+        nm_i->available_nids = nm_i->max_nid - F2FS_RESERVED_NODE_NUM;
         nm_i->fcnt = 0;
         nm_i->nat_cnt = 0;
         nm_i->ram_thresh = DEF_RAM_THRESHOLD;
diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
index fe1c6d921ba2..756c41cd2582 100644
--- a/fs/f2fs/recovery.c
+++ b/fs/f2fs/recovery.c
@@ -62,8 +62,10 @@ static int recover_dentry(struct page *ipage, struct inode *inode)
         }
 retry:
         de = f2fs_find_entry(dir, &name, &page);
-        if (de && inode->i_ino == le32_to_cpu(de->ino))
+        if (de && inode->i_ino == le32_to_cpu(de->ino)) {
+                clear_inode_flag(F2FS_I(inode), FI_INC_LINK);
                 goto out_unmap_put;
+        }
         if (de) {
                 einode = f2fs_iget(inode->i_sb, le32_to_cpu(de->ino));
                 if (IS_ERR(einode)) {
@@ -300,14 +302,19 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
         struct node_info ni;
         int err = 0, recovered = 0;
 
-        recover_inline_xattr(inode, page);
-
-        if (recover_inline_data(inode, page))
+        /* step 1: recover xattr */
+        if (IS_INODE(page)) {
+                recover_inline_xattr(inode, page);
+        } else if (f2fs_has_xattr_block(ofs_of_node(page))) {
+                recover_xattr_data(inode, page, blkaddr);
                 goto out;
+        }
 
-        if (recover_xattr_data(inode, page, blkaddr))
+        /* step 2: recover inline data */
+        if (recover_inline_data(inode, page))
                 goto out;
 
+        /* step 3: recover data indices */
         start = start_bidx_of_node(ofs_of_node(page), fi);
         end = start + ADDRS_PER_PAGE(page, fi);
 
@@ -364,8 +371,6 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
         fill_node_footer(dn.node_page, dn.nid, ni.ino,
                                         ofs_of_node(page), false);
         set_page_dirty(dn.node_page);
-
-        recover_node_page(sbi, dn.node_page, &sum, &ni, blkaddr);
 err:
         f2fs_put_dnode(&dn);
         f2fs_unlock_op(sbi);
@@ -452,6 +457,9 @@ int recover_fsync_data(struct f2fs_sb_info *sbi)
         /* step #1: find fsynced inode numbers */
         sbi->por_doing = true;
 
+        /* prevent checkpoint */
+        mutex_lock(&sbi->cp_mutex);
+
         blkaddr = NEXT_FREE_BLKADDR(sbi, curseg);
 
         err = find_fsync_dnodes(sbi, &inode_list);
@@ -465,7 +473,8 @@ int recover_fsync_data(struct f2fs_sb_info *sbi)
 
         /* step #2: recover data */
         err = recover_data(sbi, &inode_list, CURSEG_WARM_NODE);
-        f2fs_bug_on(!list_empty(&inode_list));
+        if (!err)
+                f2fs_bug_on(!list_empty(&inode_list));
 out:
         destroy_fsync_dnodes(&inode_list);
         kmem_cache_destroy(fsync_entry_slab);
@@ -482,8 +491,13 @@ out:
                 /* Flush all the NAT/SIT pages */
                 while (get_pages(sbi, F2FS_DIRTY_META))
                         sync_meta_pages(sbi, META, LONG_MAX);
+                set_ckpt_flags(sbi->ckpt, CP_ERROR_FLAG);
+                mutex_unlock(&sbi->cp_mutex);
         } else if (need_writecp) {
+                mutex_unlock(&sbi->cp_mutex);
                 write_checkpoint(sbi, false);
+        } else {
+                mutex_unlock(&sbi->cp_mutex);
         }
         return err;
 }
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 0dfeebae2a50..0aa337cd5bba 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -62,7 +62,7 @@ static inline unsigned long __reverse_ffs(unsigned long word)
 }
 
 /*
- * __find_rev_next(_zero)_bit is copied from lib/find_next_bit.c becasue
+ * __find_rev_next(_zero)_bit is copied from lib/find_next_bit.c because
  * f2fs_set_bit makes MSB and LSB reversed in a byte.
  * Example:
  *                             LSB <--> MSB
@@ -808,7 +808,7 @@ static void __refresh_next_blkoff(struct f2fs_sb_info *sbi,
 }
 
 /*
- * This function always allocates a used segment (from dirty seglist) by SSR
+ * This function always allocates a used segment(from dirty seglist) by SSR
  * manner, so it should recover the existing segment information of valid blocks
  */
 static void change_curseg(struct f2fs_sb_info *sbi, int type, bool reuse)
@@ -1103,55 +1103,6 @@ void recover_data_page(struct f2fs_sb_info *sbi,
         mutex_unlock(&curseg->curseg_mutex);
 }
 
-void rewrite_node_page(struct f2fs_sb_info *sbi,
-                        struct page *page, struct f2fs_summary *sum,
-                        block_t old_blkaddr, block_t new_blkaddr)
-{
-        struct sit_info *sit_i = SIT_I(sbi);
-        int type = CURSEG_WARM_NODE;
-        struct curseg_info *curseg;
-        unsigned int segno, old_cursegno;
-        block_t next_blkaddr = next_blkaddr_of_node(page);
-        unsigned int next_segno = GET_SEGNO(sbi, next_blkaddr);
-        struct f2fs_io_info fio = {
-                .type = NODE,
-                .rw = WRITE_SYNC,
-        };
-
-        curseg = CURSEG_I(sbi, type);
-
-        mutex_lock(&curseg->curseg_mutex);
-        mutex_lock(&sit_i->sentry_lock);
-
-        segno = GET_SEGNO(sbi, new_blkaddr);
-        old_cursegno = curseg->segno;
-
-        /* change the current segment */
-        if (segno != curseg->segno) {
-                curseg->next_segno = segno;
-                change_curseg(sbi, type, true);
-        }
-        curseg->next_blkoff = GET_BLKOFF_FROM_SEG0(sbi, new_blkaddr);
-        __add_sum_entry(sbi, type, sum);
-
-        /* change the current log to the next block addr in advance */
-        if (next_segno != segno) {
-                curseg->next_segno = next_segno;
-                change_curseg(sbi, type, true);
-        }
-        curseg->next_blkoff = GET_BLKOFF_FROM_SEG0(sbi, next_blkaddr);
-
-        /* rewrite node page */
-        set_page_writeback(page);
-        f2fs_submit_page_mbio(sbi, page, new_blkaddr, &fio);
-        f2fs_submit_merged_bio(sbi, NODE, WRITE);
-        refresh_sit_entry(sbi, old_blkaddr, new_blkaddr);
-        locate_dirty_segment(sbi, old_cursegno);
-
-        mutex_unlock(&sit_i->sentry_lock);
-        mutex_unlock(&curseg->curseg_mutex);
-}
-
 static inline bool is_merged_page(struct f2fs_sb_info *sbi,
                                         struct page *page, enum page_type type)
 {
diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
index 55973f7b0330..ff483257283b 100644
--- a/fs/f2fs/segment.h
+++ b/fs/f2fs/segment.h
@@ -549,7 +549,7 @@ static inline void verify_block_addr(struct f2fs_sb_info *sbi, block_t blk_addr)
 }
 
 /*
- * Summary block is always treated as invalid block
+ * Summary block is always treated as an invalid block
  */
 static inline void check_block_count(struct f2fs_sb_info *sbi,
                 int segno, struct f2fs_sit_entry *raw_sit)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 657582fc7601..41bdf511003d 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -432,9 +432,15 @@ static void f2fs_put_super(struct super_block *sb)
         stop_gc_thread(sbi);
 
         /* We don't need to do checkpoint when it's clean */
-        if (sbi->s_dirty && get_pages(sbi, F2FS_DIRTY_NODES))
+        if (sbi->s_dirty)
                 write_checkpoint(sbi, true);
 
+        /*
+         * normally superblock is clean, so we need to release this.
+         * In addition, EIO will skip do checkpoint, we need this as well.
+         */
+        release_dirty_inode(sbi);
+
         iput(sbi->node_inode);
         iput(sbi->meta_inode);
 
@@ -457,9 +463,6 @@ int f2fs_sync_fs(struct super_block *sb, int sync)
 
         trace_f2fs_sync_fs(sb, sync);
 
-        if (!sbi->s_dirty && !get_pages(sbi, F2FS_DIRTY_NODES))
-                return 0;
-
         if (sync) {
                 mutex_lock(&sbi->gc_mutex);
                 write_checkpoint(sbi, false);
@@ -505,8 +508,8 @@ static int f2fs_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bfree = buf->f_blocks - valid_user_blocks(sbi) - ovp_count;
         buf->f_bavail = user_block_count - valid_user_blocks(sbi);
 
-        buf->f_files = sbi->total_node_count;
-        buf->f_ffree = sbi->total_node_count - valid_inode_count(sbi);
+        buf->f_files = sbi->total_node_count - F2FS_RESERVED_NODE_NUM;
+        buf->f_ffree = buf->f_files - valid_inode_count(sbi);
 
         buf->f_namelen = F2FS_NAME_LEN;
         buf->f_fsid.val[0] = (u32)id;
@@ -663,7 +666,7 @@ restore_gc:
         if (need_restart_gc) {
                 if (start_gc_thread(sbi))
                         f2fs_msg(sbi->sb, KERN_WARNING,
-                                "background gc thread is stop");
+                                "background gc thread has stopped");
         } else if (need_stop_gc) {
                 stop_gc_thread(sbi);
         }
@@ -812,7 +815,7 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi)
         if (unlikely(fsmeta >= total))
                 return 1;
 
-        if (unlikely(is_set_ckpt_flags(ckpt, CP_ERROR_FLAG))) {
+        if (unlikely(f2fs_cp_error(sbi))) {
                 f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
                 return 1;
         }
@@ -899,8 +902,10 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
         struct buffer_head *raw_super_buf;
         struct inode *root;
         long err = -EINVAL;
+        bool retry = true;
         int i;
 
+try_onemore:
         /* allocate memory for f2fs-specific super block info */
         sbi = kzalloc(sizeof(struct f2fs_sb_info), GFP_KERNEL);
         if (!sbi)
@@ -1080,9 +1085,11 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
         /* recover fsynced data */
         if (!test_opt(sbi, DISABLE_ROLL_FORWARD)) {
                 err = recover_fsync_data(sbi);
-                if (err)
+                if (err) {
                         f2fs_msg(sb, KERN_ERR,
                                 "Cannot recover all fsync data errno=%ld", err);
+                        goto free_kobj;
+                }
         }
 
         /*
@@ -1123,6 +1130,13 @@ free_sb_buf:
         brelse(raw_super_buf);
 free_sbi:
         kfree(sbi);
+
+        /* give only one another chance */
+        if (retry) {
+                retry = 0;
+                shrink_dcache_sb(sb);
+                goto try_onemore;
+        }
         return err;
 }
 
diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
index 8bea941ee309..728a5dc3dc16 100644
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c
@@ -528,7 +528,7 @@ static int __f2fs_setxattr(struct inode *inode, int index,
                 int free;
                 /*
                  * If value is NULL, it is remove operation.
-                 * In case of update operation, we caculate free.
+                 * In case of update operation, we calculate free.
                  */
                 free = MIN_OFFSET(inode) - ((char *)last - (char *)base_addr);
                 if (found)
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 6fac74349856..b73e0215baa7 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -97,7 +97,7 @@ static void jbd2_commit_block_csum_set(journal_t *j, struct buffer_head *bh)
         struct commit_header *h;
         __u32 csum;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         h = (struct commit_header *)(bh->b_data);
@@ -313,11 +313,11 @@ static __u32 jbd2_checksum_data(__u32 crc32_sum, struct buffer_head *bh)
         return checksum;
 }
 
-static void write_tag_block(int tag_bytes, journal_block_tag_t *tag,
+static void write_tag_block(journal_t *j, journal_block_tag_t *tag,
                                    unsigned long long block)
 {
         tag->t_blocknr = cpu_to_be32(block & (u32)~0);
-        if (tag_bytes > JBD2_TAG_SIZE32)
+        if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_64BIT))
                 tag->t_blocknr_high = cpu_to_be32((block >> 31) >> 1);
 }
 
@@ -327,7 +327,7 @@ static void jbd2_descr_block_csum_set(journal_t *j,
         struct jbd2_journal_block_tail *tail;
         __u32 csum;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         tail = (struct jbd2_journal_block_tail *)(bh->b_data + j->j_blocksize -
@@ -340,12 +340,13 @@ static void jbd2_descr_block_csum_set(journal_t *j,
 static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
                                     struct buffer_head *bh, __u32 sequence)
 {
+        journal_block_tag3_t *tag3 = (journal_block_tag3_t *)tag;
         struct page *page = bh->b_page;
         __u8 *addr;
         __u32 csum32;
         __be32 seq;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         seq = cpu_to_be32(sequence);
@@ -355,8 +356,10 @@ static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
                              bh->b_size);
         kunmap_atomic(addr);
 
-        /* We only have space to store the lower 16 bits of the crc32c. */
-        tag->t_checksum = cpu_to_be16(csum32);
+        if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                tag3->t_checksum = cpu_to_be32(csum32);
+        else
+                tag->t_checksum = cpu_to_be16(csum32);
 }
 /*
  * jbd2_journal_commit_transaction
@@ -396,7 +399,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
         LIST_HEAD(io_bufs);
         LIST_HEAD(log_bufs);
 
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 csum_size = sizeof(struct jbd2_journal_block_tail);
 
         /*
@@ -690,7 +693,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
                         tag_flag |= JBD2_FLAG_SAME_UUID;
 
                 tag = (journal_block_tag_t *) tagp;
-                write_tag_block(tag_bytes, tag, jh2bh(jh)->b_blocknr);
+                write_tag_block(journal, tag, jh2bh(jh)->b_blocknr);
                 tag->t_flags = cpu_to_be16(tag_flag);
                 jbd2_block_tag_csum_set(journal, tag, wbuf[bufs],
                                         commit_transaction->t_tid);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 67b8e303946c..19d74d86d99c 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -124,7 +124,7 @@ EXPORT_SYMBOL(__jbd2_debug);
 /* Checksumming functions */
 static int jbd2_verify_csum_type(journal_t *j, journal_superblock_t *sb)
 {
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         return sb->s_checksum_type == JBD2_CRC32C_CHKSUM;
@@ -145,7 +145,7 @@ static __be32 jbd2_superblock_csum(journal_t *j, journal_superblock_t *sb)
 
 static int jbd2_superblock_csum_verify(journal_t *j, journal_superblock_t *sb)
 {
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         return sb->s_checksum == jbd2_superblock_csum(j, sb);
@@ -153,7 +153,7 @@ static int jbd2_superblock_csum_verify(journal_t *j, journal_superblock_t *sb)
 
 static void jbd2_superblock_csum_set(journal_t *j, journal_superblock_t *sb)
 {
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         sb->s_checksum = jbd2_superblock_csum(j, sb);
@@ -1522,21 +1522,29 @@ static int journal_get_superblock(journal_t *journal)
                 goto out;
         }
 
-        if (JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM) &&
-            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+        if (jbd2_journal_has_csum_v2or3(journal) &&
+            JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM)) {
                 /* Can't have checksum v1 and v2 on at the same time! */
                 printk(KERN_ERR "JBD2: Can't enable checksumming v1 and v2 "
                        "at the same time!\n");
                 goto out;
         }
 
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2) &&
+            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
+                /* Can't have checksum v2 and v3 at the same time! */
+                printk(KERN_ERR "JBD2: Can't enable checksumming v2 and v3 "
+                       "at the same time!\n");
+                goto out;
+        }
+
         if (!jbd2_verify_csum_type(journal, sb)) {
                 printk(KERN_ERR "JBD2: Unknown checksum type\n");
                 goto out;
         }
 
         /* Load the checksum driver */
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+        if (jbd2_journal_has_csum_v2or3(journal)) {
                 journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
                 if (IS_ERR(journal->j_chksum_driver)) {
                         printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n");
@@ -1553,7 +1561,7 @@ static int journal_get_superblock(journal_t *journal)
         }
 
         /* Precompute checksum seed for all metadata */
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid,
                                                    sizeof(sb->s_uuid));
 
@@ -1813,8 +1821,14 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
         if (!jbd2_journal_check_available_features(journal, compat, ro, incompat))
                 return 0;
 
-        /* Asking for checksumming v2 and v1?  Only give them v2. */
-        if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V2 &&
+        /* If enabling v2 checksums, turn on v3 instead */
+        if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V2) {
+                incompat &= ~JBD2_FEATURE_INCOMPAT_CSUM_V2;
+                incompat |= JBD2_FEATURE_INCOMPAT_CSUM_V3;
+        }
+
+        /* Asking for checksumming v3 and v1?  Only give them v3. */
+        if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V3 &&
             compat & JBD2_FEATURE_COMPAT_CHECKSUM)
                 compat &= ~JBD2_FEATURE_COMPAT_CHECKSUM;
 
@@ -1823,8 +1837,8 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
 
         sb = journal->j_superblock;
 
-        /* If enabling v2 checksums, update superblock */
-        if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+        /* If enabling v3 checksums, update superblock */
+        if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
                 sb->s_checksum_type = JBD2_CRC32C_CHKSUM;
                 sb->s_feature_compat &=
                         ~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM);
@@ -1842,8 +1856,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                 }
 
                 /* Precompute checksum seed for all metadata */
-                if (JBD2_HAS_INCOMPAT_FEATURE(journal,
-                                              JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                if (jbd2_journal_has_csum_v2or3(journal))
                         journal->j_csum_seed = jbd2_chksum(journal, ~0,
                                                            sb->s_uuid,
                                                            sizeof(sb->s_uuid));
@@ -1852,7 +1865,8 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
         /* If enabling v1 checksums, downgrade superblock */
         if (COMPAT_FEATURE_ON(JBD2_FEATURE_COMPAT_CHECKSUM))
                 sb->s_feature_incompat &=
-                        ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_CSUM_V2);
+                        ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_CSUM_V2 |
+                                     JBD2_FEATURE_INCOMPAT_CSUM_V3);
 
         sb->s_feature_compat    |= cpu_to_be32(compat);
         sb->s_feature_ro_compat |= cpu_to_be32(ro);
@@ -2165,16 +2179,20 @@ int jbd2_journal_blocks_per_page(struct inode *inode)
  */
 size_t journal_tag_bytes(journal_t *journal)
 {
-        journal_block_tag_t tag;
-        size_t x = 0;
+        size_t sz;
+
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                return sizeof(journal_block_tag3_t);
+
+        sz = sizeof(journal_block_tag_t);
 
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
-                x += sizeof(tag.t_checksum);
+                sz += sizeof(__u16);
 
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
-                return x + JBD2_TAG_SIZE64;
+                return sz;
         else
-                return x + JBD2_TAG_SIZE32;
+                return sz - sizeof(__u32);
 }
 
 /*
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 3b6bb19d60b1..9b329b55ffe3 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -181,7 +181,7 @@ static int jbd2_descr_block_csum_verify(journal_t *j,
         __be32 provided;
         __u32 calculated;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         tail = (struct jbd2_journal_block_tail *)(buf + j->j_blocksize -
@@ -205,7 +205,7 @@ static int count_tags(journal_t *journal, struct buffer_head *bh)
         int                     nr = 0, size = journal->j_blocksize;
         int                     tag_bytes = journal_tag_bytes(journal);
 
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 size -= sizeof(struct jbd2_journal_block_tail);
 
         tagp = &bh->b_data[sizeof(journal_header_t)];
@@ -338,10 +338,11 @@ int jbd2_journal_skip_recovery(journal_t *journal)
         return err;
 }
 
-static inline unsigned long long read_tag_block(int tag_bytes, journal_block_tag_t *tag)
+static inline unsigned long long read_tag_block(journal_t *journal,
+                                                journal_block_tag_t *tag)
 {
         unsigned long long block = be32_to_cpu(tag->t_blocknr);
-        if (tag_bytes > JBD2_TAG_SIZE32)
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
                 block |= (u64)be32_to_cpu(tag->t_blocknr_high) << 32;
         return block;
 }
@@ -384,7 +385,7 @@ static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
         __be32 provided;
         __u32 calculated;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         h = buf;
@@ -399,17 +400,21 @@ static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
 static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
                                       void *buf, __u32 sequence)
 {
+        journal_block_tag3_t *tag3 = (journal_block_tag3_t *)tag;
         __u32 csum32;
         __be32 seq;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         seq = cpu_to_be32(sequence);
         csum32 = jbd2_chksum(j, j->j_csum_seed, (__u8 *)&seq, sizeof(seq));
         csum32 = jbd2_chksum(j, csum32, buf, j->j_blocksize);
 
-        return tag->t_checksum == cpu_to_be16(csum32);
+        if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                return tag3->t_checksum == cpu_to_be32(csum32);
+        else
+                return tag->t_checksum == cpu_to_be16(csum32);
 }
 
 static int do_one_pass(journal_t *journal,
@@ -426,6 +431,7 @@ static int do_one_pass(journal_t *journal,
         int                     tag_bytes = journal_tag_bytes(journal);
         __u32                   crc32_sum = ~0; /* Transactional Checksums */
         int                     descr_csum_size = 0;
+        int                     block_error = 0;
 
         /*
          * First thing is to establish what we expect to find in the log
@@ -512,8 +518,7 @@ static int do_one_pass(journal_t *journal,
                 switch(blocktype) {
                 case JBD2_DESCRIPTOR_BLOCK:
                         /* Verify checksum first */
-                        if (JBD2_HAS_INCOMPAT_FEATURE(journal,
-                                        JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                        if (jbd2_journal_has_csum_v2or3(journal))
                                 descr_csum_size =
                                         sizeof(struct jbd2_journal_block_tail);
                         if (descr_csum_size > 0 &&
@@ -574,7 +579,7 @@ static int do_one_pass(journal_t *journal,
                                         unsigned long long blocknr;
 
                                         J_ASSERT(obh != NULL);
-                                        blocknr = read_tag_block(tag_bytes,
+                                        blocknr = read_tag_block(journal,
                                                                  tag);
 
                                         /* If the block has been
@@ -598,7 +603,8 @@ static int do_one_pass(journal_t *journal,
                                                        "checksum recovering "
                                                        "block %llu in log\n",
                                                        blocknr);
-                                                continue;
+                                                block_error = 1;
+                                                goto skip_write;
                                         }
 
                                         /* Find a buffer for the new
@@ -797,7 +803,8 @@ static int do_one_pass(journal_t *journal,
                                 success = -EIO;
                 }
         }
-
+        if (block_error && success == 0)
+                success = -EIO;
         return success;
 
  failed:
@@ -811,7 +818,7 @@ static int jbd2_revoke_block_csum_verify(journal_t *j,
         __be32 provided;
         __u32 calculated;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         tail = (struct jbd2_journal_revoke_tail *)(buf + j->j_blocksize -
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index 198c9c10276d..d5e95a175c92 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -91,8 +91,8 @@
 #include <linux/list.h>
 #include <linux/init.h>
 #include <linux/bio.h>
-#endif
 #include <linux/log2.h>
+#endif
 
 static struct kmem_cache *jbd2_revoke_record_cache;
 static struct kmem_cache *jbd2_revoke_table_cache;
@@ -597,7 +597,7 @@ static void write_one_revoke_record(journal_t *journal,
         offset = *offsetp;
 
         /* Do we need to leave space at the end for a checksum? */
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 csum_size = sizeof(struct jbd2_journal_revoke_tail);
 
         /* Make sure we have a descriptor with space left for the record */
@@ -644,7 +644,7 @@ static void jbd2_revoke_csum_set(journal_t *j, struct buffer_head *bh)
         struct jbd2_journal_revoke_tail *tail;
         __u32 csum;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         tail = (struct jbd2_journal_revoke_tail *)(bh->b_data + j->j_blocksize -
diff --git a/fs/locks.c b/fs/locks.c
index cb66fb05ad4a..bb08857f90b5 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1619,7 +1619,7 @@ static int generic_add_lease(struct file *filp, long arg, struct file_lock **flp
         smp_mb();
         error = check_conflicting_open(dentry, arg);
         if (error)
-                locks_unlink_lock(flp);
+                locks_unlink_lock(before);
 out:
         if (is_deleg)
                 mutex_unlock(&inode->i_mutex);
diff --git a/fs/namespace.c b/fs/namespace.c
index a01c7730e9af..ef42d9bee212 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1217,6 +1217,11 @@ static void namespace_unlock(void)
         head.first->pprev = &head.first;
         INIT_HLIST_HEAD(&unmounted);
 
+        /* undo decrements we'd done in umount_tree() */
+        hlist_for_each_entry(mnt, &head, mnt_hash)
+                if (mnt->mnt_ex_mountpoint.mnt)
+                        mntget(mnt->mnt_ex_mountpoint.mnt);
+
         up_write(&namespace_sem);
 
         synchronize_rcu();
@@ -1253,6 +1258,9 @@ void umount_tree(struct mount *mnt, int how)
                 hlist_add_head(&p->mnt_hash, &tmp_list);
         }
 
+        hlist_for_each_entry(p, &tmp_list, mnt_hash)
+                list_del_init(&p->mnt_child);
+
         if (how)
                 propagate_umount(&tmp_list);
 
@@ -1263,9 +1271,9 @@ void umount_tree(struct mount *mnt, int how)
                 p->mnt_ns = NULL;
                 if (how < 2)
                         p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
-                list_del_init(&p->mnt_child);
                 if (mnt_has_parent(p)) {
                         put_mountpoint(p->mnt_mp);
+                        mnt_add_count(p->mnt_parent, -1);
                         /* move the reference to mountpoint into ->mnt_ex_mountpoint */
                         p->mnt_ex_mountpoint.dentry = p->mnt_mountpoint;
                         p->mnt_ex_mountpoint.mnt = &p->mnt_parent->mnt;
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index d0fec260132a..24c6898159cc 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -129,7 +129,10 @@ static int __nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                 .rpc_argp       = &args,
                 .rpc_resp       = &fattr,
         };
-        int status;
+        int status = 0;
+
+        if (acl == NULL && (!S_ISDIR(inode->i_mode) || dfacl == NULL))
+                goto out;
 
         status = -EOPNOTSUPP;
         if (!nfs_server_capable(inode, NFS_CAP_ACLS))
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 75ae8d22f067..7dd8aca31c29 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2560,6 +2560,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
         struct nfs4_closedata *calldata = data;
         struct nfs4_state *state = calldata->state;
         struct nfs_server *server = NFS_SERVER(calldata->inode);
+        nfs4_stateid *res_stateid = NULL;
 
         dprintk("%s: begin!\n", __func__);
         if (!nfs4_sequence_done(task, &calldata->res.seq_res))
@@ -2570,12 +2571,12 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
          */
         switch (task->tk_status) {
                 case 0:
-                        if (calldata->roc)
+                        res_stateid = &calldata->res.stateid;
+                        if (calldata->arg.fmode == 0 && calldata->roc)
                                 pnfs_roc_set_barrier(state->inode,
                                                      calldata->roc_barrier);
-                        nfs_clear_open_stateid(state, &calldata->res.stateid, 0);
                         renew_lease(server, calldata->timestamp);
-                        goto out_release;
+                        break;
                 case -NFS4ERR_ADMIN_REVOKED:
                 case -NFS4ERR_STALE_STATEID:
                 case -NFS4ERR_OLD_STATEID:
@@ -2589,7 +2590,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                                 goto out_release;
                         }
         }
-        nfs_clear_open_stateid(state, NULL, calldata->arg.fmode);
+        nfs_clear_open_stateid(state, res_stateid, calldata->arg.fmode);
 out_release:
         nfs_release_seqid(calldata->arg.seqid);
         nfs_refresh_inode(calldata->inode, calldata->res.fattr);
@@ -2601,6 +2602,7 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
         struct nfs4_closedata *calldata = data;
         struct nfs4_state *state = calldata->state;
         struct inode *inode = calldata->inode;
+        bool is_rdonly, is_wronly, is_rdwr;
         int call_close = 0;
 
         dprintk("%s: begin!\n", __func__);
@@ -2608,18 +2610,24 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                 goto out_wait;
 
         task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
-        calldata->arg.fmode = FMODE_READ|FMODE_WRITE;
         spin_lock(&state->owner->so_lock);
+        is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
+        is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
+        is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
+        /* Calculate the current open share mode */
+        calldata->arg.fmode = 0;
+        if (is_rdonly || is_rdwr)
+                calldata->arg.fmode |= FMODE_READ;
+        if (is_wronly || is_rdwr)
+                calldata->arg.fmode |= FMODE_WRITE;
         /* Calculate the change in open mode */
         if (state->n_rdwr == 0) {
                 if (state->n_rdonly == 0) {
-                        call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags);
-                        call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+                        call_close |= is_rdonly || is_rdwr;
                         calldata->arg.fmode &= ~FMODE_READ;
                 }
                 if (state->n_wronly == 0) {
-                        call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags);
-                        call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+                        call_close |= is_wronly || is_rdwr;
                         calldata->arg.fmode &= ~FMODE_WRITE;
                 }
         }
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ba491926df5f..be7cbce6e4c7 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -116,7 +116,7 @@ __nfs_iocounter_wait(struct nfs_io_counter *c)
                 if (atomic_read(&c->io_count) == 0)
                         break;
                 ret = nfs_wait_bit_killable(&q.key);
-        } while (atomic_read(&c->io_count) != 0);
+        } while (atomic_read(&c->io_count) != 0 && !ret);
         finish_wait(wq, &q.wait);
         return ret;
 }
@@ -139,26 +139,49 @@ nfs_iocounter_wait(struct nfs_io_counter *c)
 /*
  * nfs_page_group_lock - lock the head of the page group
  * @req - request in group that is to be locked
+ * @nonblock - if true don't block waiting for lock
  *
  * this lock must be held if modifying the page group list
  *
- * returns result from wait_on_bit_lock: 0 on success, < 0 on error
+ * return 0 on success, < 0 on error: -EDELAY if nonblocking or the
+ * result from wait_on_bit_lock
+ *
+ * NOTE: calling with nonblock=false should always have set the
+ *       lock bit (see fs/buffer.c and other uses of wait_on_bit_lock
+ *       with TASK_UNINTERRUPTIBLE), so there is no need to check the result.
  */
 int
-nfs_page_group_lock(struct nfs_page *req, bool wait)
+nfs_page_group_lock(struct nfs_page *req, bool nonblock)
 {
         struct nfs_page *head = req->wb_head;
-        int ret;
 
         WARN_ON_ONCE(head != head->wb_head);
 
-        do {
-                ret = wait_on_bit_lock(&head->wb_flags, PG_HEADLOCK,
-                        TASK_UNINTERRUPTIBLE);
-        } while (wait && ret != 0);
+        if (!test_and_set_bit(PG_HEADLOCK, &head->wb_flags))
+                return 0;
 
-        WARN_ON_ONCE(ret > 0);
-        return ret;
+        if (!nonblock)
+                return wait_on_bit_lock(&head->wb_flags, PG_HEADLOCK,
+                                TASK_UNINTERRUPTIBLE);
+
+        return -EAGAIN;
+}
+
+/*
+ * nfs_page_group_lock_wait - wait for the lock to clear, but don't grab it
+ * @req - a request in the group
+ *
+ * This is a blocking call to wait for the group lock to be cleared.
+ */
+void
+nfs_page_group_lock_wait(struct nfs_page *req)
+{
+        struct nfs_page *head = req->wb_head;
+
+        WARN_ON_ONCE(head != head->wb_head);
+
+        wait_on_bit(&head->wb_flags, PG_HEADLOCK,
+                TASK_UNINTERRUPTIBLE);
 }
 
 /*
@@ -219,7 +242,7 @@ bool nfs_page_group_sync_on_bit(struct nfs_page *req, unsigned int bit)
 {
         bool ret;
 
-        nfs_page_group_lock(req, true);
+        nfs_page_group_lock(req, false);
         ret = nfs_page_group_sync_on_bit_locked(req, bit);
         nfs_page_group_unlock(req);
 
@@ -701,10 +724,11 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *desc,
                      struct nfs_pgio_header *hdr)
 {
         struct nfs_page         *req;
-        struct page             **pages;
+        struct page             **pages,
+                                *last_page;
         struct list_head *head = &desc->pg_list;
         struct nfs_commit_info cinfo;
-        unsigned int pagecount;
+        unsigned int pagecount, pageused;
 
         pagecount = nfs_page_array_len(desc->pg_base, desc->pg_count);
         if (!nfs_pgarray_set(&hdr->page_array, pagecount))
@@ -712,12 +736,23 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *desc,
 
         nfs_init_cinfo(&cinfo, desc->pg_inode, desc->pg_dreq);
         pages = hdr->page_array.pagevec;
+        last_page = NULL;
+        pageused = 0;
         while (!list_empty(head)) {
                 req = nfs_list_entry(head->next);
                 nfs_list_remove_request(req);
                 nfs_list_add_request(req, &hdr->pages);
-                *pages++ = req->wb_page;
+
+                if (WARN_ON_ONCE(pageused >= pagecount))
+                        return nfs_pgio_error(desc, hdr);
+
+                if (!last_page || last_page != req->wb_page) {
+                        *pages++ = last_page = req->wb_page;
+                        pageused++;
+                }
         }
+        if (WARN_ON_ONCE(pageused != pagecount))
+                return nfs_pgio_error(desc, hdr);
 
         if ((desc->pg_ioflags & FLUSH_COND_STABLE) &&
             (desc->pg_moreio || nfs_reqs_to_commit(&cinfo)))
@@ -788,6 +823,14 @@ static bool nfs_can_coalesce_requests(struct nfs_page *prev,
                         return false;
                 if (req_offset(req) != req_offset(prev) + prev->wb_bytes)
                         return false;
+                if (req->wb_page == prev->wb_page) {
+                        if (req->wb_pgbase != prev->wb_pgbase + prev->wb_bytes)
+                                return false;
+                } else {
+                        if (req->wb_pgbase != 0 ||
+                            prev->wb_pgbase + prev->wb_bytes != PAGE_CACHE_SIZE)
+                                return false;
+                }
         }
         size = pgio->pg_ops->pg_test(pgio, prev, req);
         WARN_ON_ONCE(size > req->wb_bytes);
@@ -858,13 +901,8 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
         struct nfs_page *subreq;
         unsigned int bytes_left = 0;
         unsigned int offset, pgbase;
-        int ret;
 
-        ret = nfs_page_group_lock(req, false);
-        if (ret < 0) {
-                desc->pg_error = ret;
-                return 0;
-        }
+        nfs_page_group_lock(req, false);
 
         subreq = req;
         bytes_left = subreq->wb_bytes;
@@ -886,11 +924,7 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
                         if (desc->pg_recoalesce)
                                 return 0;
                         /* retry add_request for this subreq */
-                        ret = nfs_page_group_lock(req, false);
-                        if (ret < 0) {
-                                desc->pg_error = ret;
-                                return 0;
-                        }
+                        nfs_page_group_lock(req, false);
                         continue;
                 }
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e3b5cf28bdc5..175d5d073ccf 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -241,7 +241,7 @@ static bool nfs_page_group_covers_page(struct nfs_page *req)
         unsigned int pos = 0;
         unsigned int len = nfs_page_length(req->wb_page);
 
-        nfs_page_group_lock(req, true);
+        nfs_page_group_lock(req, false);
 
         do {
                 tmp = nfs_page_group_search_locked(req->wb_head, pos);
@@ -478,10 +478,23 @@ try_again:
                 return NULL;
         }
 
-        /* lock each request in the page group */
-        ret = nfs_page_group_lock(head, false);
-        if (ret < 0)
+        /* holding inode lock, so always make a non-blocking call to try the
+         * page group lock */
+        ret = nfs_page_group_lock(head, true);
+        if (ret < 0) {
+                spin_unlock(&inode->i_lock);
+
+                if (!nonblock && ret == -EAGAIN) {
+                        nfs_page_group_lock_wait(head);
+                        nfs_release_request(head);
+                        goto try_again;
+                }
+
+                nfs_release_request(head);
                 return ERR_PTR(ret);
+        }
+
+        /* lock each request in the page group */
         subreq = head;
         do {
                 /*
diff --git a/fs/ocfs2/cluster/quorum.c b/fs/ocfs2/cluster/quorum.c
index 1ec141e758d7..62e8ec619b4c 100644
--- a/fs/ocfs2/cluster/quorum.c
+++ b/fs/ocfs2/cluster/quorum.c
@@ -160,9 +160,18 @@ static void o2quo_make_decision(struct work_struct *work)
         }
 
 out:
-        spin_unlock(&qs->qs_lock);
-        if (fence)
+        if (fence) {
+                spin_unlock(&qs->qs_lock);
                 o2quo_fence_self();
+        } else {
+                mlog(ML_NOTICE, "not fencing this node, heartbeating: %d, "
+                        "connected: %d, lowest: %d (%sreachable)\n",
+                        qs->qs_heartbeating, qs->qs_connected, lowest_hb,
+                        lowest_reachable ? "" : "un");
+                spin_unlock(&qs->qs_lock);
+
+        }
+
 }
 
 static void o2quo_set_hold(struct o2quo_state *qs, u8 node)
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 681691bc233a..ea34952f9496 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1480,6 +1480,14 @@ static int o2net_set_nodelay(struct socket *sock)
         return ret;
 }
 
+static int o2net_set_usertimeout(struct socket *sock)
+{
+        int user_timeout = O2NET_TCP_USER_TIMEOUT;
+
+        return kernel_setsockopt(sock, SOL_TCP, TCP_USER_TIMEOUT,
+                                (char *)&user_timeout, sizeof(user_timeout));
+}
+
 static void o2net_initialize_handshake(void)
 {
         o2net_hand->o2hb_heartbeat_timeout_ms = cpu_to_be32(
@@ -1536,16 +1544,20 @@ static void o2net_idle_timer(unsigned long data)
 #endif
 
         printk(KERN_NOTICE "o2net: Connection to " SC_NODEF_FMT " has been "
-               "idle for %lu.%lu secs, shutting it down.\n", SC_NODEF_ARGS(sc),
-               msecs / 1000, msecs % 1000);
+               "idle for %lu.%lu secs.\n",
+               SC_NODEF_ARGS(sc), msecs / 1000, msecs % 1000);
 
-        /*
-         * Initialize the nn_timeout so that the next connection attempt
-         * will continue in o2net_start_connect.
+        /* idle timerout happen, don't shutdown the connection, but
+         * make fence decision. Maybe the connection can recover before
+         * the decision is made.
          */
         atomic_set(&nn->nn_timeout, 1);
+        o2quo_conn_err(o2net_num_from_nn(nn));
+        queue_delayed_work(o2net_wq, &nn->nn_still_up,
+                        msecs_to_jiffies(O2NET_QUORUM_DELAY_MS));
+
+        o2net_sc_reset_idle_timer(sc);
 
-        o2net_sc_queue_work(sc, &sc->sc_shutdown_work);
 }
 
 static void o2net_sc_reset_idle_timer(struct o2net_sock_container *sc)
@@ -1560,6 +1572,15 @@ static void o2net_sc_reset_idle_timer(struct o2net_sock_container *sc)
 
 static void o2net_sc_postpone_idle(struct o2net_sock_container *sc)
 {
+        struct o2net_node *nn = o2net_nn_from_num(sc->sc_node->nd_num);
+
+        /* clear fence decision since the connection recover from timeout*/
+        if (atomic_read(&nn->nn_timeout)) {
+                o2quo_conn_up(o2net_num_from_nn(nn));
+                cancel_delayed_work(&nn->nn_still_up);
+                atomic_set(&nn->nn_timeout, 0);
+        }
+
         /* Only push out an existing timer */
         if (timer_pending(&sc->sc_idle_timeout))
                 o2net_sc_reset_idle_timer(sc);
@@ -1650,6 +1671,12 @@ static void o2net_start_connect(struct work_struct *work)
                 goto out;
         }
 
+        ret = o2net_set_usertimeout(sock);
+        if (ret) {
+                mlog(ML_ERROR, "set TCP_USER_TIMEOUT failed with %d\n", ret);
+                goto out;
+        }
+
         o2net_register_callbacks(sc->sc_sock->sk, sc);
 
         spin_lock(&nn->nn_lock);
@@ -1831,6 +1858,12 @@ static int o2net_accept_one(struct socket *sock, int *more)
                 goto out;
         }
 
+        ret = o2net_set_usertimeout(new_sock);
+        if (ret) {
+                mlog(ML_ERROR, "set TCP_USER_TIMEOUT failed with %d\n", ret);
+                goto out;
+        }
+
         slen = sizeof(sin);
         ret = new_sock->ops->getname(new_sock, (struct sockaddr *) &sin,
                                        &slen, 1);
diff --git a/fs/ocfs2/cluster/tcp.h b/fs/ocfs2/cluster/tcp.h
index 5bada2a69b50..c571e849fda4 100644
--- a/fs/ocfs2/cluster/tcp.h
+++ b/fs/ocfs2/cluster/tcp.h
@@ -63,6 +63,7 @@ typedef void (o2net_post_msg_handler_func)(int status, void *data,
 #define O2NET_KEEPALIVE_DELAY_MS_DEFAULT        2000
 #define O2NET_IDLE_TIMEOUT_MS_DEFAULT           30000
 
+#define O2NET_TCP_USER_TIMEOUT                  0x7fffffff
 
 /* TODO: figure this out.... */
 static inline int o2net_link_down(int err, struct socket *sock)
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index 6f66b3751ace..53e6c40ed4c6 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -35,9 +35,8 @@
                 copy_to_user((typeof(a) __user *)b, &(a), sizeof(a))
 
 /*
- * This call is void because we are already reporting an error that may
- * be -EFAULT.  The error will be returned from the ioctl(2) call.  It's
- * just a best-effort to tell userspace that this request caused the error.
+ * This is just a best-effort to tell userspace that this request
+ * caused the error.
  */
 static inline void o2info_set_request_error(struct ocfs2_info_request *kreq,
                                         struct ocfs2_info_request __user *req)
@@ -146,136 +145,105 @@ bail:
 static int ocfs2_info_handle_blocksize(struct inode *inode,
                                        struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_blocksize oib;
 
         if (o2info_from_user(oib, req))
-                goto bail;
+                return -EFAULT;
 
         oib.ib_blocksize = inode->i_sb->s_blocksize;
 
         o2info_set_request_filled(&oib.ib_req);
 
         if (o2info_to_user(oib, req))
-                goto bail;
-
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oib.ib_req, req);
+                return -EFAULT;
 
-        return status;
+        return 0;
 }
 
 static int ocfs2_info_handle_clustersize(struct inode *inode,
                                          struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_clustersize oic;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
         if (o2info_from_user(oic, req))
-                goto bail;
+                return -EFAULT;
 
         oic.ic_clustersize = osb->s_clustersize;
 
         o2info_set_request_filled(&oic.ic_req);
 
         if (o2info_to_user(oic, req))
-                goto bail;
-
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oic.ic_req, req);
+                return -EFAULT;
 
-        return status;
+        return 0;
 }
 
 static int ocfs2_info_handle_maxslots(struct inode *inode,
                                       struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_maxslots oim;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
         if (o2info_from_user(oim, req))
-                goto bail;
+                return -EFAULT;
 
         oim.im_max_slots = osb->max_slots;
 
         o2info_set_request_filled(&oim.im_req);
 
         if (o2info_to_user(oim, req))
-                goto bail;
+                return -EFAULT;
 
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oim.im_req, req);
-
-        return status;
+        return 0;
 }
 
 static int ocfs2_info_handle_label(struct inode *inode,
                                    struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_label oil;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
         if (o2info_from_user(oil, req))
-                goto bail;
+                return -EFAULT;
 
         memcpy(oil.il_label, osb->vol_label, OCFS2_MAX_VOL_LABEL_LEN);
 
         o2info_set_request_filled(&oil.il_req);
 
         if (o2info_to_user(oil, req))
-                goto bail;
+                return -EFAULT;
 
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oil.il_req, req);
-
-        return status;
+        return 0;
 }
 
 static int ocfs2_info_handle_uuid(struct inode *inode,
                                   struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_uuid oiu;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
         if (o2info_from_user(oiu, req))
-                goto bail;
+                return -EFAULT;
 
         memcpy(oiu.iu_uuid_str, osb->uuid_str, OCFS2_TEXT_UUID_LEN + 1);
 
         o2info_set_request_filled(&oiu.iu_req);
 
         if (o2info_to_user(oiu, req))
-                goto bail;
-
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oiu.iu_req, req);
+                return -EFAULT;
 
-        return status;
+        return 0;
 }
 
 static int ocfs2_info_handle_fs_features(struct inode *inode,
                                          struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_fs_features oif;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
         if (o2info_from_user(oif, req))
-                goto bail;
+                return -EFAULT;
 
         oif.if_compat_features = osb->s_feature_compat;
         oif.if_incompat_features = osb->s_feature_incompat;
@@ -284,39 +252,28 @@ static int ocfs2_info_handle_fs_features(struct inode *inode,
         o2info_set_request_filled(&oif.if_req);
 
         if (o2info_to_user(oif, req))
-                goto bail;
+                return -EFAULT;
 
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oif.if_req, req);
-
-        return status;
+        return 0;
 }
 
 static int ocfs2_info_handle_journal_size(struct inode *inode,
                                           struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_journal_size oij;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
         if (o2info_from_user(oij, req))
-                goto bail;
+                return -EFAULT;
 
         oij.ij_journal_size = i_size_read(osb->journal->j_inode);
 
         o2info_set_request_filled(&oij.ij_req);
 
         if (o2info_to_user(oij, req))
-                goto bail;
+                return -EFAULT;
 
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oij.ij_req, req);
-
-        return status;
+        return 0;
 }
 
 static int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb,
@@ -373,7 +330,7 @@ static int ocfs2_info_handle_freeinode(struct inode *inode,
         u32 i;
         u64 blkno = -1;
         char namebuf[40];
-        int status = -EFAULT, type = INODE_ALLOC_SYSTEM_INODE;
+        int status, type = INODE_ALLOC_SYSTEM_INODE;
         struct ocfs2_info_freeinode *oifi = NULL;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         struct inode *inode_alloc = NULL;
@@ -385,8 +342,10 @@ static int ocfs2_info_handle_freeinode(struct inode *inode,
                 goto out_err;
         }
 
-        if (o2info_from_user(*oifi, req))
-                goto bail;
+        if (o2info_from_user(*oifi, req)) {
+                status = -EFAULT;
+                goto out_free;
+        }
 
         oifi->ifi_slotnum = osb->max_slots;
 
@@ -424,14 +383,16 @@ static int ocfs2_info_handle_freeinode(struct inode *inode,
 
         o2info_set_request_filled(&oifi->ifi_req);
 
-        if (o2info_to_user(*oifi, req))
-                goto bail;
+        if (o2info_to_user(*oifi, req)) {
+                status = -EFAULT;
+                goto out_free;
+        }
 
         status = 0;
 bail:
         if (status)
                 o2info_set_request_error(&oifi->ifi_req, req);
-
+out_free:
         kfree(oifi);
 out_err:
         return status;
@@ -658,7 +619,7 @@ static int ocfs2_info_handle_freefrag(struct inode *inode,
 {
         u64 blkno = -1;
         char namebuf[40];
-        int status = -EFAULT, type = GLOBAL_BITMAP_SYSTEM_INODE;
+        int status, type = GLOBAL_BITMAP_SYSTEM_INODE;
 
         struct ocfs2_info_freefrag *oiff;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
@@ -671,8 +632,10 @@ static int ocfs2_info_handle_freefrag(struct inode *inode,
                 goto out_err;
         }
 
-        if (o2info_from_user(*oiff, req))
-                goto bail;
+        if (o2info_from_user(*oiff, req)) {
+                status = -EFAULT;
+                goto out_free;
+        }
         /*
          * chunksize from userspace should be power of 2.
          */
@@ -711,14 +674,14 @@ static int ocfs2_info_handle_freefrag(struct inode *inode,
 
         if (o2info_to_user(*oiff, req)) {
                 status = -EFAULT;
-                goto bail;
+                goto out_free;
         }
 
         status = 0;
 bail:
         if (status)
                 o2info_set_request_error(&oiff->iff_req, req);
-
+out_free:
         kfree(oiff);
 out_err:
         return status;
@@ -727,23 +690,17 @@ out_err:
 static int ocfs2_info_handle_unknown(struct inode *inode,
                                      struct ocfs2_info_request __user *req)
 {
-        int status = -EFAULT;
         struct ocfs2_info_request oir;
 
         if (o2info_from_user(oir, req))
-                goto bail;
+                return -EFAULT;
 
         o2info_clear_request_filled(&oir);
 
         if (o2info_to_user(oir, req))
-                goto bail;
+                return -EFAULT;
 
-        status = 0;
-bail:
-        if (status)
-                o2info_set_request_error(&oir, req);
-
-        return status;
+        return 0;
 }
 
 /*
diff --git a/fs/pnode.c b/fs/pnode.c
index 302bf22c4a30..aae331a5d03b 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -381,6 +381,7 @@ static void __propagate_umount(struct mount *mnt)
                  * other children
                  */
                 if (child && list_empty(&child->mnt_mounts)) {
+                        list_del_init(&child->mnt_child);
                         hlist_del_init_rcu(&child->mnt_hash);
                         hlist_add_before_rcu(&child->mnt_hash, &mnt->mnt_hash);
                 }
diff --git a/fs/sync.c b/fs/sync.c
index b28d1dd10e8b..bdc729d80e5e 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -65,7 +65,7 @@ int sync_filesystem(struct super_block *sb)
                 return ret;
         return __sync_filesystem(sb, 1);
 }
-EXPORT_SYMBOL_GPL(sync_filesystem);
+EXPORT_SYMBOL(sync_filesystem);
 
 static void sync_inodes_one_sb(struct super_block *sb, void *arg)
 {
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 7c580c97990e..be7d42c7d938 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -902,9 +902,6 @@ void ufs_evict_inode(struct inode * inode)
         invalidate_inode_buffers(inode);
         clear_inode(inode);
 
-        if (want_delete) {
-                lock_ufs(inode->i_sb);
-                ufs_free_inode (inode);
-                unlock_ufs(inode->i_sb);
-        }
+        if (want_delete)
+                ufs_free_inode(inode);
 }
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 90d74b8f8eba..2df62a73f20c 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -126,12 +126,12 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry,
         if (l > sb->s_blocksize)
                 goto out_notlocked;
 
-        lock_ufs(dir->i_sb);
         inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO);
         err = PTR_ERR(inode);
         if (IS_ERR(inode))
-                goto out;
+                goto out_notlocked;
 
+        lock_ufs(dir->i_sb);
         if (l > UFS_SB(sb)->s_uspi->s_maxsymlinklen) {
                 /* slow symlink */
                 inode->i_op = &ufs_symlink_inode_operations;
@@ -181,13 +181,9 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
         struct inode * inode;
         int err;
 
-        lock_ufs(dir->i_sb);
-        inode_inc_link_count(dir);
-
         inode = ufs_new_inode(dir, S_IFDIR|mode);
-        err = PTR_ERR(inode);
         if (IS_ERR(inode))
-                goto out_dir;
+                return PTR_ERR(inode);
 
         inode->i_op = &ufs_dir_inode_operations;
         inode->i_fop = &ufs_dir_operations;
@@ -195,6 +191,9 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
 
         inode_inc_link_count(inode);
 
+        lock_ufs(dir->i_sb);
+        inode_inc_link_count(dir);
+
         err = ufs_make_empty(inode, dir);
         if (err)
                 goto out_fail;
@@ -212,7 +211,6 @@ out_fail:
         inode_dec_link_count(inode);
         inode_dec_link_count(inode);
         iput (inode);
-out_dir:
         inode_dec_link_count(dir);
         unlock_ufs(dir->i_sb);
         goto out;
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index de2d26d32844..86df952d3e24 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -5424,7 +5424,7 @@ xfs_bmap_shift_extents(
         struct xfs_bmap_free    *flist,
         int                     num_exts)
 {
-        struct xfs_btree_cur            *cur;
+        struct xfs_btree_cur            *cur = NULL;
         struct xfs_bmbt_rec_host        *gotp;
         struct xfs_bmbt_irec            got;
         struct xfs_bmbt_irec            left;
@@ -5435,7 +5435,7 @@ xfs_bmap_shift_extents(
         int                             error = 0;
         int                             i;
         int                             whichfork = XFS_DATA_FORK;
-        int                             logflags;
+        int                             logflags = 0;
         xfs_filblks_t                   blockcount = 0;
         int                             total_extents;
 
@@ -5478,16 +5478,11 @@ xfs_bmap_shift_extents(
                 }
         }
 
-        /* We are going to change core inode */
-        logflags = XFS_ILOG_CORE;
         if (ifp->if_flags & XFS_IFBROOT) {
                 cur = xfs_bmbt_init_cursor(mp, tp, ip, whichfork);
                 cur->bc_private.b.firstblock = *firstblock;
                 cur->bc_private.b.flist = flist;
                 cur->bc_private.b.flags = 0;
-        } else {
-                cur = NULL;
-                logflags |= XFS_ILOG_DEXT;
         }
 
         /*
@@ -5545,11 +5540,14 @@ xfs_bmap_shift_extents(
                         blockcount = left.br_blockcount +
                                 got.br_blockcount;
                         xfs_iext_remove(ip, *current_ext, 1, 0);
+                        logflags |= XFS_ILOG_CORE;
                         if (cur) {
                                 error = xfs_btree_delete(cur, &i);
                                 if (error)
                                         goto del_cursor;
                                 XFS_WANT_CORRUPTED_GOTO(i == 1, del_cursor);
+                        } else {
+                                logflags |= XFS_ILOG_DEXT;
                         }
                         XFS_IFORK_NEXT_SET(ip, whichfork,
                                 XFS_IFORK_NEXTENTS(ip, whichfork) - 1);
@@ -5575,6 +5573,7 @@ xfs_bmap_shift_extents(
                         got.br_startoff = startoff;
                 }
 
+                logflags |= XFS_ILOG_CORE;
                 if (cur) {
                         error = xfs_bmbt_update(cur, got.br_startoff,
                                                 got.br_startblock,
@@ -5582,6 +5581,8 @@ xfs_bmap_shift_extents(
                                                 got.br_state);
                         if (error)
                                 goto del_cursor;
+                } else {
+                        logflags |= XFS_ILOG_DEXT;
                 }
 
                 (*current_ext)++;
@@ -5597,6 +5598,7 @@ del_cursor:
                 xfs_btree_del_cursor(cur,
                         error ? XFS_BTREE_ERROR : XFS_BTREE_NOERROR);
 
-        xfs_trans_log_inode(tp, ip, logflags);
+        if (logflags)
+                xfs_trans_log_inode(tp, ip, logflags);
         return error;
 }
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 11e9b4caa54f..b984647c24db 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1753,11 +1753,72 @@ xfs_vm_readpages(
         return mpage_readpages(mapping, pages, nr_pages, xfs_get_blocks);
 }
 
+/*
+ * This is basically a copy of __set_page_dirty_buffers() with one
+ * small tweak: buffers beyond EOF do not get marked dirty. If we mark them
+ * dirty, we'll never be able to clean them because we don't write buffers
+ * beyond EOF, and that means we can't invalidate pages that span EOF
+ * that have been marked dirty. Further, the dirty state can leak into
+ * the file interior if the file is extended, resulting in all sorts of
+ * bad things happening as the state does not match the underlying data.
+ *
+ * XXX: this really indicates that bufferheads in XFS need to die. Warts like
+ * this only exist because of bufferheads and how the generic code manages them.
+ */
+STATIC int
+xfs_vm_set_page_dirty(
+        struct page             *page)
+{
+        struct address_space    *mapping = page->mapping;
+        struct inode            *inode = mapping->host;
+        loff_t                  end_offset;
+        loff_t                  offset;
+        int                     newly_dirty;
+
+        if (unlikely(!mapping))
+                return !TestSetPageDirty(page);
+
+        end_offset = i_size_read(inode);
+        offset = page_offset(page);
+
+        spin_lock(&mapping->private_lock);
+        if (page_has_buffers(page)) {
+                struct buffer_head *head = page_buffers(page);
+                struct buffer_head *bh = head;
+
+                do {
+                        if (offset < end_offset)
+                                set_buffer_dirty(bh);
+                        bh = bh->b_this_page;
+                        offset += 1 << inode->i_blkbits;
+                } while (bh != head);
+        }
+        newly_dirty = !TestSetPageDirty(page);
+        spin_unlock(&mapping->private_lock);
+
+        if (newly_dirty) {
+                /* sigh - __set_page_dirty() is static, so copy it here, too */
+                unsigned long flags;
+
+                spin_lock_irqsave(&mapping->tree_lock, flags);
+                if (page->mapping) {    /* Race with truncate? */
+                        WARN_ON_ONCE(!PageUptodate(page));
+                        account_page_dirtied(page, mapping);
+                        radix_tree_tag_set(&mapping->page_tree,
+                                        page_index(page), PAGECACHE_TAG_DIRTY);
+                }
+                spin_unlock_irqrestore(&mapping->tree_lock, flags);
+                __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
+        }
+        return newly_dirty;
+}
+
 const struct address_space_operations xfs_address_space_operations = {
         .readpage               = xfs_vm_readpage,
         .readpages              = xfs_vm_readpages,
         .writepage              = xfs_vm_writepage,
         .writepages             = xfs_vm_writepages,
+        .set_page_dirty         = xfs_vm_set_page_dirty,
         .releasepage            = xfs_vm_releasepage,
         .invalidatepage         = xfs_vm_invalidatepage,
         .write_begin            = xfs_vm_write_begin,
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 2f1e30d39a35..1707980f9a4b 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1470,6 +1470,26 @@ xfs_collapse_file_space(
         start_fsb = XFS_B_TO_FSB(mp, offset + len);
         shift_fsb = XFS_B_TO_FSB(mp, len);
 
+        /*
+         * Writeback the entire file and force remove any post-eof blocks. The
+         * writeback prevents changes to the extent list via concurrent
+         * writeback and the eofblocks trim prevents the extent shift algorithm
+         * from running into a post-eof delalloc extent.
+         *
+         * XXX: This is a temporary fix until the extent shift loop below is
+         * converted to use offsets and lookups within the ILOCK rather than
+         * carrying around the index into the extent list for the next
+         * iteration.
+         */
+        error = filemap_write_and_wait(VFS_I(ip)->i_mapping);
+        if (error)
+                return error;
+        if (xfs_can_free_eofblocks(ip, true)) {
+                error = xfs_free_eofblocks(mp, ip, false);
+                if (error)
+                        return error;
+        }
+
         error = xfs_free_file_space(ip, offset, len);
         if (error)
                 return error;
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 076b1708d134..de5368c803f9 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -291,12 +291,22 @@ xfs_file_read_iter(
                 if (inode->i_mapping->nrpages) {
                         ret = filemap_write_and_wait_range(
                                                         VFS_I(ip)->i_mapping,
-                                                        pos, -1);
+                                                        pos, pos + size - 1);
                         if (ret) {
                                 xfs_rw_iunlock(ip, XFS_IOLOCK_EXCL);
                                 return ret;
                         }
-                        truncate_pagecache_range(VFS_I(ip), pos, -1);
+
+                        /*
+                         * Invalidate whole pages. This can return an error if
+                         * we fail to invalidate a page, but this should never
+                         * happen on XFS. Warn if it does fail.
+                         */
+                        ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+                                        pos >> PAGE_CACHE_SHIFT,
+                                        (pos + size - 1) >> PAGE_CACHE_SHIFT);
+                        WARN_ON_ONCE(ret);
+                        ret = 0;
                 }
                 xfs_rw_ilock_demote(ip, XFS_IOLOCK_EXCL);
         }
@@ -632,10 +642,19 @@ xfs_file_dio_aio_write(
 
         if (mapping->nrpages) {
                 ret = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
-                                                    pos, -1);
+                                                    pos, pos + count - 1);
                 if (ret)
                         goto out;
-                truncate_pagecache_range(VFS_I(ip), pos, -1);
+                /*
+                 * Invalidate whole pages. This can return an error if
+                 * we fail to invalidate a page, but this should never
+                 * happen on XFS. Warn if it does fail.
+                 */
+                ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+                                        pos >> PAGE_CACHE_SHIFT,
+                                        (pos + count - 1) >> PAGE_CACHE_SHIFT);
+                WARN_ON_ONCE(ret);
+                ret = 0;
         }
 
         /*
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index bcfd808b1098..c1c9de19edbe 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -246,7 +246,6 @@ struct acpi_device_pnp {
         acpi_device_name device_name;   /* Driver-determined */
         acpi_device_class device_class; /*        "          */
         union acpi_object *str_obj;     /* unicode string for _STR method */
-        unsigned long sun;              /* _SUN */
 };
 
 #define acpi_device_bid(d)      ((d)->pnp.bus_id)
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 6dfd64b3a604..e973540cd15b 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -17,6 +17,7 @@
         {0x1002, 0x1315, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x1316, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x1317, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x1318, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x131B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x131C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x131D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
@@ -164,8 +165,11 @@
         {0x1002, 0x6601, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6602, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6603, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6604, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6605, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6606, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6607, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6608, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6610, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6611, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6613, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
@@ -175,6 +179,8 @@
         {0x1002, 0x6631, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6640, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6641, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6646, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6647, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6650, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6651, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
@@ -297,6 +303,7 @@
         {0x1002, 0x6829, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x682C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6830, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index eb726b9c5762..a1e31f274fcd 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -127,10 +127,9 @@ enum {
         BLK_MQ_RQ_QUEUE_ERROR   = 2,    /* end IO with error */
 
         BLK_MQ_F_SHOULD_MERGE   = 1 << 0,
-        BLK_MQ_F_SHOULD_SORT    = 1 << 1,
-        BLK_MQ_F_TAG_SHARED     = 1 << 2,
-        BLK_MQ_F_SG_MERGE       = 1 << 3,
-        BLK_MQ_F_SYSFS_UP       = 1 << 4,
+        BLK_MQ_F_TAG_SHARED     = 1 << 1,
+        BLK_MQ_F_SG_MERGE       = 1 << 2,
+        BLK_MQ_F_SYSFS_UP       = 1 << 3,
 
         BLK_MQ_S_STOPPED        = 0,
         BLK_MQ_S_TAG_ACTIVE     = 1,
diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
index 6ff0b0b42d47..08ed2b0a96e6 100644
--- a/include/linux/f2fs_fs.h
+++ b/include/linux/f2fs_fs.h
@@ -24,6 +24,9 @@
 #define NULL_ADDR               ((block_t)0)    /* used as block_t addresses */
 #define NEW_ADDR                ((block_t)-1)   /* used as block_t addresses */
 
+/* 0, 1(node nid), 2(meta nid) are reserved node id */
+#define F2FS_RESERVED_NODE_NUM          3
+
 #define F2FS_ROOT_INO(sbi)      (sbi->root_ino_num)
 #define F2FS_NODE_INO(sbi)      (sbi->node_ino_num)
 #define F2FS_META_INO(sbi)      (sbi->meta_ino_num)
@@ -87,6 +90,8 @@ struct f2fs_super_block {
 #define CP_ORPHAN_PRESENT_FLAG  0x00000002
 #define CP_UMOUNT_FLAG          0x00000001
 
+#define F2FS_CP_PACKS           2       /* # of checkpoint packs */
+
 struct f2fs_checkpoint {
         __le64 checkpoint_ver;          /* checkpoint block version number */
         __le64 user_block_count;        /* # of user blocks */
@@ -123,6 +128,9 @@ struct f2fs_checkpoint {
  */
 #define F2FS_ORPHANS_PER_BLOCK  1020
 
+#define GET_ORPHAN_BLOCKS(n)    ((n + F2FS_ORPHANS_PER_BLOCK - 1) / \
+                                        F2FS_ORPHANS_PER_BLOCK)
+
 struct f2fs_orphan_block {
         __le32 ino[F2FS_ORPHANS_PER_BLOCK];     /* inode numbers */
         __le32 reserved;        /* reserved */
@@ -144,6 +152,7 @@ struct f2fs_extent {
 #define F2FS_NAME_LEN           255
 #define F2FS_INLINE_XATTR_ADDRS 50      /* 200 bytes for inline xattrs */
 #define DEF_ADDRS_PER_INODE     923     /* Address Pointers in an Inode */
+#define DEF_NIDS_PER_INODE      5       /* Node IDs in an Inode */
 #define ADDRS_PER_INODE(fi)     addrs_per_inode(fi)
 #define ADDRS_PER_BLOCK         1018    /* Address Pointers in a Direct Block */
 #define NIDS_PER_BLOCK          1018    /* Node IDs in an Indirect Block */
@@ -163,8 +172,9 @@ struct f2fs_extent {
 #define MAX_INLINE_DATA         (sizeof(__le32) * (DEF_ADDRS_PER_INODE - \
                                                 F2FS_INLINE_XATTR_ADDRS - 1))
 
-#define INLINE_DATA_OFFSET      (PAGE_CACHE_SIZE - sizeof(struct node_footer) \
-                        - sizeof(__le32) * (DEF_ADDRS_PER_INODE + 5 - 1))
+#define INLINE_DATA_OFFSET      (PAGE_CACHE_SIZE - sizeof(struct node_footer) -\
+                                sizeof(__le32) * (DEF_ADDRS_PER_INODE + \
+                                DEF_NIDS_PER_INODE - 1))
 
 struct f2fs_inode {
         __le16 i_mode;                  /* file mode */
@@ -194,7 +204,7 @@ struct f2fs_inode {
 
         __le32 i_addr[DEF_ADDRS_PER_INODE];     /* Pointers to data blocks */
 
-        __le32 i_nid[5];                /* direct(2), indirect(2),
+        __le32 i_nid[DEF_NIDS_PER_INODE];       /* direct(2), indirect(2),
                                                 double_indirect(1) node id */
 } __packed;
 
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 6bb5e3f2a3b4..f0b0edbf55a9 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -102,6 +102,15 @@ enum {
         FTRACE_OPS_FL_DELETED                   = 1 << 8,
 };
 
+#ifdef CONFIG_DYNAMIC_FTRACE
+/* The hash used to know what functions callbacks trace */
+struct ftrace_ops_hash {
+        struct ftrace_hash              *notrace_hash;
+        struct ftrace_hash              *filter_hash;
+        struct mutex                    regex_lock;
+};
+#endif
+
 /*
  * Note, ftrace_ops can be referenced outside of RCU protection.
  * (Although, for perf, the control ops prevent that). If ftrace_ops is
@@ -121,10 +130,9 @@ struct ftrace_ops {
         int __percpu                    *disabled;
 #ifdef CONFIG_DYNAMIC_FTRACE
         int                             nr_trampolines;
-        struct ftrace_hash              *notrace_hash;
-        struct ftrace_hash              *filter_hash;
+        struct ftrace_ops_hash          local_hash;
+        struct ftrace_ops_hash          *func_hash;
         struct ftrace_hash              *tramp_hash;
-        struct mutex                    regex_lock;
         unsigned long                   trampoline;
 #endif
 };
diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
index b7ce0c64c6f3..12f146fa6604 100644
--- a/include/linux/gpio/consumer.h
+++ b/include/linux/gpio/consumer.h
@@ -16,8 +16,6 @@ struct device;
  */
 struct gpio_desc;
 
-#ifdef CONFIG_GPIOLIB
-
 #define GPIOD_FLAGS_BIT_DIR_SET         BIT(0)
 #define GPIOD_FLAGS_BIT_DIR_OUT         BIT(1)
 #define GPIOD_FLAGS_BIT_DIR_VAL         BIT(2)
@@ -34,64 +32,38 @@ enum gpiod_flags {
                           GPIOD_FLAGS_BIT_DIR_VAL,
 };
 
+#ifdef CONFIG_GPIOLIB
+
 /* Acquire and dispose GPIOs */
 struct gpio_desc *__must_check __gpiod_get(struct device *dev,
                                          const char *con_id,
                                          enum gpiod_flags flags);
-#define __gpiod_get(dev, con_id, flags, ...) __gpiod_get(dev, con_id, flags)
-#define gpiod_get(varargs...) __gpiod_get(varargs, 0)
 struct gpio_desc *__must_check __gpiod_get_index(struct device *dev,
                                                const char *con_id,
                                                unsigned int idx,
                                                enum gpiod_flags flags);
-#define __gpiod_get_index(dev, con_id, index, flags, ...)               \
-        __gpiod_get_index(dev, con_id, index, flags)
-#define gpiod_get_index(varargs...) __gpiod_get_index(varargs, 0)
 struct gpio_desc *__must_check __gpiod_get_optional(struct device *dev,
                                                   const char *con_id,
                                                   enum gpiod_flags flags);
-#define __gpiod_get_optional(dev, con_id, flags, ...)                   \
-        __gpiod_get_optional(dev, con_id, flags)
-#define gpiod_get_optional(varargs...) __gpiod_get_optional(varargs, 0)
 struct gpio_desc *__must_check __gpiod_get_index_optional(struct device *dev,
                                                         const char *con_id,
                                                         unsigned int index,
                                                         enum gpiod_flags flags);
-#define __gpiod_get_index_optional(dev, con_id, index, flags, ...)      \
-        __gpiod_get_index_optional(dev, con_id, index, flags)
-#define gpiod_get_index_optional(varargs...)                            \
-        __gpiod_get_index_optional(varargs, 0)
-
 void gpiod_put(struct gpio_desc *desc);
 
 struct gpio_desc *__must_check __devm_gpiod_get(struct device *dev,
                                               const char *con_id,
                                               enum gpiod_flags flags);
-#define __devm_gpiod_get(dev, con_id, flags, ...)                       \
-        __devm_gpiod_get(dev, con_id, flags)
-#define devm_gpiod_get(varargs...) __devm_gpiod_get(varargs, 0)
 struct gpio_desc *__must_check __devm_gpiod_get_index(struct device *dev,
                                                     const char *con_id,
                                                     unsigned int idx,
                                                     enum gpiod_flags flags);
-#define __devm_gpiod_get_index(dev, con_id, index, flags, ...)          \
-        __devm_gpiod_get_index(dev, con_id, index, flags)
-#define devm_gpiod_get_index(varargs...) __devm_gpiod_get_index(varargs, 0)
 struct gpio_desc *__must_check __devm_gpiod_get_optional(struct device *dev,
                                                        const char *con_id,
                                                        enum gpiod_flags flags);
-#define __devm_gpiod_get_optional(dev, con_id, flags, ...)              \
-        __devm_gpiod_get_optional(dev, con_id, flags)
-#define devm_gpiod_get_optional(varargs...)                             \
-        __devm_gpiod_get_optional(varargs, 0)
 struct gpio_desc *__must_check
 __devm_gpiod_get_index_optional(struct device *dev, const char *con_id,
                               unsigned int index, enum gpiod_flags flags);
-#define __devm_gpiod_get_index_optional(dev, con_id, index, flags, ...) \
-        __devm_gpiod_get_index_optional(dev, con_id, index, flags)
-#define devm_gpiod_get_index_optional(varargs...)                       \
-        __devm_gpiod_get_index_optional(varargs, 0)
-
 void devm_gpiod_put(struct device *dev, struct gpio_desc *desc);
 
 int gpiod_get_direction(const struct gpio_desc *desc);
@@ -124,27 +96,31 @@ int desc_to_gpio(const struct gpio_desc *desc);
 
 #else /* CONFIG_GPIOLIB */
 
-static inline struct gpio_desc *__must_check gpiod_get(struct device *dev,
-                                                       const char *con_id)
+static inline struct gpio_desc *__must_check __gpiod_get(struct device *dev,
+                                                const char *con_id,
+                                                enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
-static inline struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
-                                                             const char *con_id,
-                                                             unsigned int idx)
+static inline struct gpio_desc *__must_check
+__gpiod_get_index(struct device *dev,
+                  const char *con_id,
+                  unsigned int idx,
+                  enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
 
 static inline struct gpio_desc *__must_check
-gpiod_get_optional(struct device *dev, const char *con_id)
+__gpiod_get_optional(struct device *dev, const char *con_id,
+                     enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
 
 static inline struct gpio_desc *__must_check
-gpiod_get_index_optional(struct device *dev, const char *con_id,
-                         unsigned int index)
+__gpiod_get_index_optional(struct device *dev, const char *con_id,
+                           unsigned int index, enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
@@ -157,28 +133,33 @@ static inline void gpiod_put(struct gpio_desc *desc)
         WARN_ON(1);
 }
 
-static inline struct gpio_desc *__must_check devm_gpiod_get(struct device *dev,
-                                                            const char *con_id)
+static inline struct gpio_desc *__must_check
+__devm_gpiod_get(struct device *dev,
+                 const char *con_id,
+                 enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
 static inline
-struct gpio_desc *__must_check devm_gpiod_get_index(struct device *dev,
-                                                    const char *con_id,
-                                                    unsigned int idx)
+struct gpio_desc *__must_check
+__devm_gpiod_get_index(struct device *dev,
+                       const char *con_id,
+                       unsigned int idx,
+                       enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
 
 static inline struct gpio_desc *__must_check
-devm_gpiod_get_optional(struct device *dev, const char *con_id)
+__devm_gpiod_get_optional(struct device *dev, const char *con_id,
+                          enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
 
 static inline struct gpio_desc *__must_check
-devm_gpiod_get_index_optional(struct device *dev, const char *con_id,
-                              unsigned int index)
+__devm_gpiod_get_index_optional(struct device *dev, const char *con_id,
+                                unsigned int index, enum gpiod_flags flags)
 {
         return ERR_PTR(-ENOSYS);
 }
@@ -303,9 +284,43 @@ static inline int desc_to_gpio(const struct gpio_desc *desc)
         return -EINVAL;
 }
 
-
 #endif /* CONFIG_GPIOLIB */
 
+/*
+ * Vararg-hacks! This is done to transition the kernel to always pass
+ * the options flags argument to the below functions. During a transition
+ * phase these vararg macros make both old-and-newstyle code compile,
+ * but when all calls to the elder API are removed, these should go away
+ * and the __gpiod_get() etc functions above be renamed just gpiod_get()
+ * etc.
+ */
+#define __gpiod_get(dev, con_id, flags, ...) __gpiod_get(dev, con_id, flags)
+#define gpiod_get(varargs...) __gpiod_get(varargs, 0)
+#define __gpiod_get_index(dev, con_id, index, flags, ...)               \
+        __gpiod_get_index(dev, con_id, index, flags)
+#define gpiod_get_index(varargs...) __gpiod_get_index(varargs, 0)
+#define __gpiod_get_optional(dev, con_id, flags, ...)                   \
+        __gpiod_get_optional(dev, con_id, flags)
+#define gpiod_get_optional(varargs...) __gpiod_get_optional(varargs, 0)
+#define __gpiod_get_index_optional(dev, con_id, index, flags, ...)      \
+        __gpiod_get_index_optional(dev, con_id, index, flags)
+#define gpiod_get_index_optional(varargs...)                            \
+        __gpiod_get_index_optional(varargs, 0)
+#define __devm_gpiod_get(dev, con_id, flags, ...)                       \
+        __devm_gpiod_get(dev, con_id, flags)
+#define devm_gpiod_get(varargs...) __devm_gpiod_get(varargs, 0)
+#define __devm_gpiod_get_index(dev, con_id, index, flags, ...)          \
+        __devm_gpiod_get_index(dev, con_id, index, flags)
+#define devm_gpiod_get_index(varargs...) __devm_gpiod_get_index(varargs, 0)
+#define __devm_gpiod_get_optional(dev, con_id, flags, ...)              \
+        __devm_gpiod_get_optional(dev, con_id, flags)
+#define devm_gpiod_get_optional(varargs...)                             \
+        __devm_gpiod_get_optional(varargs, 0)
+#define __devm_gpiod_get_index_optional(dev, con_id, index, flags, ...) \
+        __devm_gpiod_get_index_optional(dev, con_id, index, flags)
+#define devm_gpiod_get_index_optional(varargs...)                       \
+        __devm_gpiod_get_index_optional(varargs, 0)
+
 #if IS_ENABLED(CONFIG_GPIOLIB) && IS_ENABLED(CONFIG_GPIO_SYSFS)
 
 int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index d5b50a19463c..0dae71e9971c 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -159,7 +159,11 @@ typedef struct journal_header_s
  * journal_block_tag (in the descriptor).  The other h_chksum* fields are
  * not used.
  *
- * Checksum v1 and v2 are mutually exclusive features.
+ * If FEATURE_INCOMPAT_CSUM_V3 is set, the descriptor block uses
+ * journal_block_tag3_t to store a full 32-bit checksum.  Everything else
+ * is the same as v2.
+ *
+ * Checksum v1, v2, and v3 are mutually exclusive features.
  */
 struct commit_header {
         __be32          h_magic;
@@ -179,6 +183,14 @@ struct commit_header {
  * raw struct shouldn't be used for pointer math or sizeof() - use
  * journal_tag_bytes(journal) instead to compute this.
  */
+typedef struct journal_block_tag3_s
+{
+        __be32          t_blocknr;      /* The on-disk block number */
+        __be32          t_flags;        /* See below */
+        __be32          t_blocknr_high; /* most-significant high 32bits. */
+        __be32          t_checksum;     /* crc32c(uuid+seq+block) */
+} journal_block_tag3_t;
+
 typedef struct journal_block_tag_s
 {
         __be32          t_blocknr;      /* The on-disk block number */
@@ -187,9 +199,6 @@ typedef struct journal_block_tag_s
         __be32          t_blocknr_high; /* most-significant high 32bits. */
 } journal_block_tag_t;
 
-#define JBD2_TAG_SIZE32 (offsetof(journal_block_tag_t, t_blocknr_high))
-#define JBD2_TAG_SIZE64 (sizeof(journal_block_tag_t))
-
 /* Tail of descriptor block, for checksumming */
 struct jbd2_journal_block_tail {
         __be32          t_checksum;     /* crc32c(uuid+descr_block) */
@@ -284,6 +293,7 @@ typedef struct journal_superblock_s
 #define JBD2_FEATURE_INCOMPAT_64BIT             0x00000002
 #define JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT      0x00000004
 #define JBD2_FEATURE_INCOMPAT_CSUM_V2           0x00000008
+#define JBD2_FEATURE_INCOMPAT_CSUM_V3           0x00000010
 
 /* Features known to this kernel version: */
 #define JBD2_KNOWN_COMPAT_FEATURES      JBD2_FEATURE_COMPAT_CHECKSUM
@@ -291,7 +301,8 @@ typedef struct journal_superblock_s
 #define JBD2_KNOWN_INCOMPAT_FEATURES    (JBD2_FEATURE_INCOMPAT_REVOKE | \
                                         JBD2_FEATURE_INCOMPAT_64BIT | \
                                         JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT | \
-                                        JBD2_FEATURE_INCOMPAT_CSUM_V2)
+                                        JBD2_FEATURE_INCOMPAT_CSUM_V2 | \
+                                        JBD2_FEATURE_INCOMPAT_CSUM_V3)
 
 #ifdef __KERNEL__
 
@@ -1296,6 +1307,15 @@ static inline int tid_geq(tid_t x, tid_t y)
 extern int jbd2_journal_blocks_per_page(struct inode *inode);
 extern size_t journal_tag_bytes(journal_t *journal);
 
+static inline int jbd2_journal_has_csum_v2or3(journal_t *journal)
+{
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2) ||
+            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                return 1;
+
+        return 0;
+}
+
 /*
  * We reserve t_outstanding_credits >> JBD2_CONTROL_BLOCKS_SHIFT for
  * transaction control blocks.
diff --git a/include/linux/leds.h b/include/linux/leds.h
index 6a599dce7f9d..e43686472197 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -15,6 +15,7 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/rwsem.h>
+#include <linux/timer.h>
 #include <linux/workqueue.h>
 
 struct device;
@@ -68,7 +69,7 @@ struct led_classdev {
         const char              *default_trigger;       /* Trigger to use */
 
         unsigned long            blink_delay_on, blink_delay_off;
-        struct delayed_work      blink_work;
+        struct timer_list        blink_timer;
         int                      blink_brightness;
 
         struct work_struct      set_brightness_work;
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 783dd099abd1..1befd8df9cfc 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -1197,6 +1197,9 @@ int mlx4_map_sw_to_hw_steering_id(struct mlx4_dev *dev,
                                   enum mlx4_net_trans_rule_id id);
 int mlx4_hw_rule_sz(struct mlx4_dev *dev, enum mlx4_net_trans_rule_id id);
 
+int mlx4_tunnel_steer_add(struct mlx4_dev *dev, unsigned char *addr,
+                          int port, int qpn, u16 prio, u64 *reg_id);
+
 void mlx4_sync_pkey_table(struct mlx4_dev *dev, int slave, int port,
                           int i, int val);
 
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index 3083c53e0270..c300db3ae285 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -949,7 +949,7 @@ static inline int jedec_feature(struct nand_chip *chip)
                 : 0;
 }
 
-/**
+/*
  * struct nand_sdr_timings - SDR NAND chip timings
  *
  * This struct defines the timing requirements of a SDR NAND chip.
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5be20a7bbb0d..ba72f6baae1a 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3272,7 +3272,7 @@ static inline int __dev_uc_sync(struct net_device *dev,
 }
 
 /**
- *  __dev_uc_unsync - Remove synchonized addresses from device
+ *  __dev_uc_unsync - Remove synchronized addresses from device
  *  @dev:  device to sync
  *  @unsync: function to call if address should be removed
  *
@@ -3316,7 +3316,7 @@ static inline int __dev_mc_sync(struct net_device *dev,
 }
 
 /**
- *  __dev_mc_unsync - Remove synchonized addresses from device
+ *  __dev_mc_unsync - Remove synchronized addresses from device
  *  @dev:  device to sync
  *  @unsync: function to call if address should be removed
  *
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 2077489f9887..2517ece98820 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -9,6 +9,7 @@
 #include <linux/in6.h>
 #include <linux/wait.h>
 #include <linux/list.h>
+#include <linux/static_key.h>
 #include <uapi/linux/netfilter.h>
 #ifdef CONFIG_NETFILTER
 static inline int NF_DROP_GETERR(int verdict)
@@ -99,9 +100,9 @@ void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
 
 extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
 
-#if defined(CONFIG_JUMP_LABEL)
-#include <linux/static_key.h>
+#ifdef HAVE_JUMP_LABEL
 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
+
 static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook)
 {
         if (__builtin_constant_p(pf) &&
diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
index 6ad2bbcad405..6c3e06ee2fb7 100644
--- a/include/linux/nfs_page.h
+++ b/include/linux/nfs_page.h
@@ -123,6 +123,7 @@ extern  int nfs_wait_on_request(struct nfs_page *);
 extern  void nfs_unlock_request(struct nfs_page *req);
 extern  void nfs_unlock_and_release_request(struct nfs_page *);
 extern int nfs_page_group_lock(struct nfs_page *, bool);
+extern void nfs_page_group_lock_wait(struct nfs_page *);
 extern void nfs_page_group_unlock(struct nfs_page *);
 extern bool nfs_page_group_sync_on_bit(struct nfs_page *, unsigned int);
 
diff --git a/include/linux/platform_data/mtd-nand-omap2.h b/include/linux/platform_data/mtd-nand-omap2.h
index 660c029d694f..16ec262dfcc8 100644
--- a/include/linux/platform_data/mtd-nand-omap2.h
+++ b/include/linux/platform_data/mtd-nand-omap2.h
@@ -21,8 +21,17 @@ enum nand_io {
 };
 
 enum omap_ecc {
-        /* 1-bit  ECC calculation by GPMC, Error detection by Software */
-        OMAP_ECC_HAM1_CODE_HW = 0,
+        /*
+         * 1-bit ECC: calculation and correction by SW
+         * ECC stored at end of spare area
+         */
+        OMAP_ECC_HAM1_CODE_SW = 0,
+
+        /*
+         * 1-bit ECC: calculation by GPMC, Error detection by Software
+         * ECC layout compatible with ROM code layout
+         */
+        OMAP_ECC_HAM1_CODE_HW,
         /* 4-bit  ECC calculation by GPMC, Error detection by Software */
         OMAP_ECC_BCH4_CODE_HW_DETECTION_SW,
         /* 4-bit  ECC calculation by GPMC, Error detection by ELM */
diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
index 7c1d252b20c0..ebc4c76ffb73 100644
--- a/include/linux/pm_domain.h
+++ b/include/linux/pm_domain.h
@@ -60,7 +60,7 @@ struct generic_pm_domain {
         struct mutex lock;
         struct dev_power_governor *gov;
         struct work_struct power_off_work;
-        char *name;
+        const char *name;
         unsigned int in_progress;       /* Number of devices being suspended now */
         atomic_t sd_count;      /* Number of subdomains with power "on" */
         enum gpd_status status; /* Current state of the domain */
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index bbe03a1924c0..4efa1ed8a2b0 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -218,6 +218,8 @@ enum regulator_type {
  * @linear_min_sel: Minimal selector for starting linear mapping
  * @fixed_uV: Fixed voltage of rails.
  * @ramp_delay: Time to settle down after voltage change (unit: uV/us)
+ * @linear_ranges: A constant table of possible voltage ranges.
+ * @n_linear_ranges: Number of entries in the @linear_ranges table.
  * @volt_table: Voltage mapping table (if table based mapping)
  *
  * @vsel_reg: Register for selector when using regulator_regmap_X_voltage_
diff --git a/include/linux/regulator/machine.h b/include/linux/regulator/machine.h
index 730e638c5589..0b08d05d470b 100644
--- a/include/linux/regulator/machine.h
+++ b/include/linux/regulator/machine.h
@@ -85,6 +85,7 @@ struct regulator_state {
  *           bootloader then it will be enabled when the constraints are
  *           applied.
  * @apply_uV: Apply the voltage constraint when initialising.
+ * @ramp_disable: Disable ramp delay when initialising or when setting voltage.
  *
  * @input_uV: Input voltage for regulator when supplied by another regulator.
  *
diff --git a/include/linux/seqno-fence.h b/include/linux/seqno-fence.h
index 3d6003de4b0d..a1ba6a5ccdd6 100644
--- a/include/linux/seqno-fence.h
+++ b/include/linux/seqno-fence.h
@@ -62,6 +62,7 @@ to_seqno_fence(struct fence *fence)
  * @context: the execution context this fence is a part of
  * @seqno_ofs: the offset within @sync_buf
  * @seqno: the sequence # to signal on
+ * @cond: fence wait condition
  * @ops: the fence_ops for operations on this seqno fence
  *
  * This function initializes a struct seqno_fence with passed parameters,
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index e713543336f1..46d188a9947c 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -253,6 +253,7 @@ static inline void spi_unregister_driver(struct spi_driver *sdrv)
  *      the device whose settings are being modified.
  * @transfer: adds a message to the controller's transfer queue.
  * @cleanup: frees controller-specific state
+ * @can_dma: determine whether this master supports DMA
  * @queued: whether this master is providing an internal message queue
  * @kworker: thread struct for message pump
  * @kworker_task: pointer to task for message pump kworker thread
@@ -262,6 +263,7 @@ static inline void spi_unregister_driver(struct spi_driver *sdrv)
  * @cur_msg: the currently in-flight message
  * @cur_msg_prepared: spi_prepare_message was called for the currently
  *                    in-flight message
+ * @cur_msg_mapped: message has been mapped for DMA
  * @xfer_completion: used by core transfer_one_message()
  * @busy: message pump is busy
  * @running: message pump is running
@@ -299,6 +301,10 @@ static inline void spi_unregister_driver(struct spi_driver *sdrv)
  * @cs_gpios: Array of GPIOs to use as chip select lines; one per CS
  *      number. Any individual value may be -ENOENT for CS lines that
  *      are not GPIOs (driven by the SPI controller itself).
+ * @dma_tx: DMA transmit channel
+ * @dma_rx: DMA receive channel
+ * @dummy_rx: dummy receive buffer for full-duplex devices
+ * @dummy_tx: dummy transmit buffer for full-duplex devices
  *
  * Each SPI master controller can communicate with one or more @spi_device
  * children.  These make a small bus, sharing MOSI, MISO and SCK signals
@@ -632,6 +638,7 @@ struct spi_transfer {
  *      addresses for each transfer buffer
  * @complete: called to report transaction completions
  * @context: the argument to complete() when it's called
+ * @frame_length: the total number of bytes in the message
  * @actual_length: the total number of bytes that were transferred in all
  *      successful segments
  * @status: zero for success, else negative errno
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 059052306831..9a82c7dc3fdd 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -183,13 +183,8 @@ static inline bool tick_nohz_full_cpu(int cpu)
 
 extern void tick_nohz_init(void);
 extern void __tick_nohz_full_check(void);
+extern void tick_nohz_full_kick(void);
 extern void tick_nohz_full_kick_cpu(int cpu);
-
-static inline void tick_nohz_full_kick(void)
-{
-        tick_nohz_full_kick_cpu(smp_processor_id());
-}
-
 extern void tick_nohz_full_kick_all(void);
 extern void __tick_nohz_task_switch(struct task_struct *tsk);
 #else
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index b5d5af3aa469..6f884e6c731e 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -464,6 +464,8 @@ struct hci_conn_params {
                 HCI_AUTO_CONN_ALWAYS,
                 HCI_AUTO_CONN_LINK_LOSS,
         } auto_connect;
+
+        struct hci_conn *conn;
 };
 
 extern struct list_head hci_dev_list;
diff --git a/include/net/netns/ieee802154_6lowpan.h b/include/net/netns/ieee802154_6lowpan.h
index e2070960bac0..8170f8d7052b 100644
--- a/include/net/netns/ieee802154_6lowpan.h
+++ b/include/net/netns/ieee802154_6lowpan.h
@@ -16,7 +16,6 @@ struct netns_sysctl_lowpan {
 struct netns_ieee802154_lowpan {
         struct netns_sysctl_lowpan sysctl;
         struct netns_frags      frags;
-        int                     max_dsize;
 };
 
 #endif
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 259992444e80..dad7ab20a8cb 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -167,7 +167,7 @@ struct ieee80211_reg_rule {
 struct ieee80211_regdomain {
         struct rcu_head rcu_head;
         u32 n_reg_rules;
-        char alpha2[2];
+        char alpha2[3];
         enum nl80211_dfs_regions dfs_region;
         struct ieee80211_reg_rule reg_rules[];
 };
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index f6e7397e799d..9fbd856e6713 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -320,6 +320,19 @@ static inline sctp_assoc_t sctp_assoc2id(const struct sctp_association *asoc)
         return asoc ? asoc->assoc_id : 0;
 }
 
+static inline enum sctp_sstat_state
+sctp_assoc_to_state(const struct sctp_association *asoc)
+{
+        /* SCTP's uapi always had SCTP_EMPTY(=0) as a dummy state, but we
+         * got rid of it in kernel space. Therefore SCTP_CLOSED et al
+         * start at =1 in user space, but actually as =0 in kernel space.
+         * Now that we can not break user space and SCTP_EMPTY is exposed
+         * there, we need to fix it up with an ugly offset not to break
+         * applications. :(
+         */
+        return asoc->state + 1;
+}
+
 /* Look up the association by its id.  */
 struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id);
 
diff --git a/include/net/sock.h b/include/net/sock.h
index ad23e80cb8d3..049ab1b732a6 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2171,9 +2171,7 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
          */
         if (sock_flag(sk, SOCK_RCVTSTAMP) ||
             (sk->sk_tsflags & SOF_TIMESTAMPING_RX_SOFTWARE) ||
-            (kt.tv64 &&
-             (sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE ||
-              skb_shinfo(skb)->tx_flags & SKBTX_ANY_SW_TSTAMP)) ||
+            (kt.tv64 && sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) ||
             (hwtstamps->hwtstamp.tv64 &&
              (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE)))
                 __sock_recv_timestamp(msg, sk, skb);
diff --git a/include/net/wimax.h b/include/net/wimax.h
index e52ef5357e08..c52b68577cb0 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -290,7 +290,7 @@ struct wimax_dev;
  *     This operation has to be synchronous, and return only when the
  *     reset is complete. In case of having had to resort to bus/cold
  *     reset implying a device disconnection, the call is allowed to
- *     return inmediately.
+ *     return immediately.
  *     NOTE: wimax_dev->mutex is NOT locked when this op is being
  *     called; however, wimax_dev->mutex_reset IS locked to ensure
  *     serialization of calls to wimax_reset().
diff --git a/include/sound/soc.h b/include/sound/soc.h
index be6ecae247b0..c83a334dd00f 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -277,7 +277,7 @@
         .access = SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE | \
                   SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK, \
         .tlv.c = (snd_soc_bytes_tlv_callback), \
-        .info = snd_soc_info_bytes_ext, \
+        .info = snd_soc_bytes_info_ext, \
         .private_value = (unsigned long)&(struct soc_bytes_ext) \
                 {.max = xcount, .get = xhandler_get, .put = xhandler_put, } }
 #define SOC_SINGLE_XR_SX(xname, xregbase, xregcount, xnbits, \
diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
index 1c09820df585..3608bebd3d9c 100644
--- a/include/trace/events/irq.h
+++ b/include/trace/events/irq.h
@@ -107,7 +107,7 @@ DECLARE_EVENT_CLASS(softirq,
  * @vec_nr:  softirq vector number
  *
  * When used in combination with the softirq_exit tracepoint
- * we can determine the softirq handler runtine.
+ * we can determine the softirq handler routine.
  */
 DEFINE_EVENT(softirq, softirq_entry,
 
@@ -121,7 +121,7 @@ DEFINE_EVENT(softirq, softirq_entry,
  * @vec_nr:  softirq vector number
  *
  * When used in combination with the softirq_entry tracepoint
- * we can determine the softirq handler runtine.
+ * we can determine the softirq handler routine.
  */
 DEFINE_EVENT(softirq, softirq_exit,
 
diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h
index 509b2d7a41b7..fea6099608ef 100644
--- a/include/uapi/drm/radeon_drm.h
+++ b/include/uapi/drm/radeon_drm.h
@@ -944,6 +944,7 @@ struct drm_radeon_cs_chunk {
 };
 
 /* drm_radeon_cs_reloc.flags */
+#define RADEON_RELOC_PRIO_MASK          (0xf << 0)
 
 struct drm_radeon_cs_reloc {
         uint32_t                handle;
diff --git a/drivers/staging/usbip/uapi/usbip.h b/include/uapi/linux/usbip.h
index fa5db30ede36..fa5db30ede36 100644
--- a/drivers/staging/usbip/uapi/usbip.h
+++ b/include/uapi/linux/usbip.h
diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index c38355c1f3c9..1590c49cae57 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -13,7 +13,7 @@
 #ifndef _UAPI_LINUX_XATTR_H
 #define _UAPI_LINUX_XATTR_H
 
-#ifdef __UAPI_DEF_XATTR
+#if __UAPI_DEF_XATTR
 #define __USE_KERNEL_XATTR_DEFS
 
 #define XATTR_CREATE    0x1     /* set value, fail if attr already exists */
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 7dc8788cfd52..940aced4ed00 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1035,6 +1035,11 @@ static void cgroup_get(struct cgroup *cgrp)
         css_get(&cgrp->self);
 }
 
+static bool cgroup_tryget(struct cgroup *cgrp)
+{
+        return css_tryget(&cgrp->self);
+}
+
 static void cgroup_put(struct cgroup *cgrp)
 {
         css_put(&cgrp->self);
@@ -1147,7 +1152,8 @@ static struct cgroup *cgroup_kn_lock_live(struct kernfs_node *kn)
          * protection against removal.  Ensure @cgrp stays accessible and
          * break the active_ref protection.
          */
-        cgroup_get(cgrp);
+        if (!cgroup_tryget(cgrp))
+                return NULL;
         kernfs_break_active_protection(kn);
 
         mutex_lock(&cgroup_mutex);
@@ -3271,8 +3277,17 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
 {
         struct cftype *cft;
 
-        for (cft = cfts; cft && cft->name[0] != '\0'; cft++)
-                cft->flags |= __CFTYPE_NOT_ON_DFL;
+        /*
+         * If legacy_flies_on_dfl, we want to show the legacy files on the
+         * dfl hierarchy but iff the target subsystem hasn't been updated
+         * for the dfl hierarchy yet.
+         */
+        if (!cgroup_legacy_files_on_dfl ||
+            ss->dfl_cftypes != ss->legacy_cftypes) {
+                for (cft = cfts; cft && cft->name[0] != '\0'; cft++)
+                        cft->flags |= __CFTYPE_NOT_ON_DFL;
+        }
+
         return cgroup_add_cftypes(ss, cfts);
 }
 
@@ -4387,6 +4402,15 @@ static void css_release_work_fn(struct work_struct *work)
                 /* cgroup release path */
                 cgroup_idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
                 cgrp->id = -1;
+
+                /*
+                 * There are two control paths which try to determine
+                 * cgroup from dentry without going through kernfs -
+                 * cgroupstats_build() and css_tryget_online_from_dir().
+                 * Those are supported by RCU protecting clearing of
+                 * cgrp->kn->priv backpointer.
+                 */
+                RCU_INIT_POINTER(*(void __rcu __force **)&cgrp->kn->priv, NULL);
         }
 
         mutex_unlock(&cgroup_mutex);
@@ -4543,6 +4567,11 @@ static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
         struct cftype *base_files;
         int ssid, ret;
 
+        /* Do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable.
+         */
+        if (strchr(name, '\n'))
+                return -EINVAL;
+
         parent = cgroup_kn_lock_live(parent_kn);
         if (!parent)
                 return -ENODEV;
@@ -4820,16 +4849,6 @@ static int cgroup_rmdir(struct kernfs_node *kn)
 
         cgroup_kn_unlock(kn);
 
-        /*
-         * There are two control paths which try to determine cgroup from
-         * dentry without going through kernfs - cgroupstats_build() and
-         * css_tryget_online_from_dir().  Those are supported by RCU
-         * protecting clearing of cgrp->kn->priv backpointer, which should
-         * happen after all files under it have been removed.
-         */
-        if (!ret)
-                RCU_INIT_POINTER(*(void __rcu __force **)&kn->priv, NULL);
-
         cgroup_put(cgrp);
         return ret;
 }
@@ -5416,7 +5435,7 @@ struct cgroup_subsys_state *css_tryget_online_from_dir(struct dentry *dentry,
         /*
          * This path doesn't originate from kernfs and @kn could already
          * have been or be removed at any point.  @kn->priv is RCU
-         * protected for this access.  See cgroup_rmdir() for details.
+         * protected for this access.  See css_release_work_fn() for details.
          */
         cgrp = rcu_dereference(kn->priv);
         if (cgrp)
diff --git a/kernel/compat.c b/kernel/compat.c
index 633394f442f8..ebb3c369d03d 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -226,7 +226,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
         ret = hrtimer_nanosleep_restart(restart);
         set_fs(oldfs);
 
-        if (ret) {
+        if (ret == -ERESTART_RESTARTBLOCK) {
                 rmtp = restart->nanosleep.compat_rmtp;
 
                 if (rmtp && compat_put_timespec(&rmt, rmtp))
@@ -256,7 +256,26 @@ COMPAT_SYSCALL_DEFINE2(nanosleep, struct compat_timespec __user *, rqtp,
                                 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
         set_fs(oldfs);
 
-        if (ret) {
+        /*
+         * hrtimer_nanosleep() can only return 0 or
+         * -ERESTART_RESTARTBLOCK here because:
+         *
+         * - we call it with HRTIMER_MODE_REL and therefor exclude the
+         *   -ERESTARTNOHAND return path.
+         *
+         * - we supply the rmtp argument from the task stack (due to
+         *   the necessary compat conversion. So the update cannot
+         *   fail, which excludes the -EFAULT return path as well. If
+         *   it fails nevertheless we have a bigger problem and wont
+         *   reach this place anymore.
+         *
+         * - if the return value is 0, we do not have to update rmtp
+         *    because there is no remaining time.
+         *
+         * We check for -ERESTART_RESTARTBLOCK nevertheless if the
+         * core implementation decides to return random nonsense.
+         */
+        if (ret == -ERESTART_RESTARTBLOCK) {
                 struct restart_block *restart
                         = &current_thread_info()->restart_block;
 
@@ -266,7 +285,6 @@ COMPAT_SYSCALL_DEFINE2(nanosleep, struct compat_timespec __user *, rqtp,
                 if (rmtp && compat_put_timespec(&rmt, rmtp))
                         return -EFAULT;
         }
-
         return ret;
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1cf24b3e42ec..f9c1ed002dbc 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -41,6 +41,7 @@
 #include <linux/cgroup.h>
 #include <linux/module.h>
 #include <linux/mman.h>
+#include <linux/compat.h>
 
 #include "internal.h"
 
@@ -3717,6 +3718,26 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         return 0;
 }
 
+#ifdef CONFIG_COMPAT
+static long perf_compat_ioctl(struct file *file, unsigned int cmd,
+                                unsigned long arg)
+{
+        switch (_IOC_NR(cmd)) {
+        case _IOC_NR(PERF_EVENT_IOC_SET_FILTER):
+        case _IOC_NR(PERF_EVENT_IOC_ID):
+                /* Fix up pointer size (usually 4 -> 8 in 32-on-64-bit case */
+                if (_IOC_SIZE(cmd) == sizeof(compat_uptr_t)) {
+                        cmd &= ~IOCSIZE_MASK;
+                        cmd |= sizeof(void *) << IOCSIZE_SHIFT;
+                }
+                break;
+        }
+        return perf_ioctl(file, cmd, arg);
+}
+#else
+# define perf_compat_ioctl NULL
+#endif
+
 int perf_event_task_enable(void)
 {
         struct perf_event *event;
@@ -4222,7 +4243,7 @@ static const struct file_operations perf_fops = {
         .read                   = perf_read,
         .poll                   = perf_poll,
         .unlocked_ioctl         = perf_ioctl,
-        .compat_ioctl           = perf_ioctl,
+        .compat_ioctl           = perf_compat_ioctl,
         .mmap                   = perf_mmap,
         .fasync                 = perf_fasync,
 };
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index a2b28a2fd7b1..6223fab9a9d2 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -517,6 +517,7 @@ out:
                 chip->irq_eoi(&desc->irq_data);
         raw_spin_unlock(&desc->lock);
 }
+EXPORT_SYMBOL_GPL(handle_fasteoi_irq);
 
 /**
  *      handle_edge_irq - edge type IRQ handler
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 0b49a0a58102..2bee072268d9 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -64,7 +64,9 @@ bool kexec_in_progress = false;
 char __weak kexec_purgatory[0];
 size_t __weak kexec_purgatory_size = 0;
 
+#ifdef CONFIG_KEXEC_FILE
 static int kexec_calculate_store_digests(struct kimage *image);
+#endif
 
 /* Location of the reserved area for the crash kernel */
 struct resource crashk_res = {
@@ -341,6 +343,7 @@ out_free_image:
         return ret;
 }
 
+#ifdef CONFIG_KEXEC_FILE
 static int copy_file_from_fd(int fd, void **buf, unsigned long *buf_len)
 {
         struct fd f = fdget(fd);
@@ -612,6 +615,9 @@ out_free_image:
         kfree(image);
         return ret;
 }
+#else /* CONFIG_KEXEC_FILE */
+static inline void kimage_file_post_load_cleanup(struct kimage *image) { }
+#endif /* CONFIG_KEXEC_FILE */
 
 static int kimage_is_destination_range(struct kimage *image,
                                         unsigned long start,
@@ -1375,6 +1381,7 @@ COMPAT_SYSCALL_DEFINE4(kexec_load, compat_ulong_t, entry,
 }
 #endif
 
+#ifdef CONFIG_KEXEC_FILE
 SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
                 unsigned long, cmdline_len, const char __user *, cmdline_ptr,
                 unsigned long, flags)
@@ -1451,6 +1458,8 @@ out:
         return ret;
 }
 
+#endif /* CONFIG_KEXEC_FILE */
+
 void crash_kexec(struct pt_regs *regs)
 {
         /* Take the kexec_mutex here to prevent sys_kexec_load
@@ -2006,6 +2015,7 @@ static int __init crash_save_vmcoreinfo_init(void)
 
 subsys_initcall(crash_save_vmcoreinfo_init);
 
+#ifdef CONFIG_KEXEC_FILE
 static int __kexec_add_segment(struct kimage *image, char *buf,
                                unsigned long bufsz, unsigned long mem,
                                unsigned long memsz)
@@ -2682,6 +2692,7 @@ int kexec_purgatory_get_set_symbol(struct kimage *image, const char *name,
 
         return 0;
 }
+#endif /* CONFIG_KEXEC_FILE */
 
 /*
  * Move into place and start executing a preloaded standalone
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 734e9a7d280b..3995f546d0f3 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1778,7 +1778,18 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs)
         unsigned long hash, flags = 0;
         struct kretprobe_instance *ri;
 
-        /*TODO: consider to only swap the RA after the last pre_handler fired */
+        /*
+         * To avoid deadlocks, prohibit return probing in NMI contexts,
+         * just skip the probe and increase the (inexact) 'nmissed'
+         * statistical counter, so that the user is informed that
+         * something happened:
+         */
+        if (unlikely(in_nmi())) {
+                rp->nmissed++;
+                return 0;
+        }
+
+        /* TODO: consider to only swap the RA after the last pre_handler fired */
         hash = hash_ptr(current, KPROBE_HASH_BITS);
         raw_spin_lock_irqsave(&rp->lock, flags);
         if (!hlist_empty(&rp->free_instances)) {
diff --git a/kernel/power/power.h b/kernel/power/power.h
index 5d49dcac2537..2df883a9d3cb 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -179,6 +179,7 @@ extern void swsusp_show_speed(struct timeval *, struct timeval *,
 
 #ifdef CONFIG_SUSPEND
 /* kernel/power/suspend.c */
+extern const char *pm_labels[];
 extern const char *pm_states[];
 
 extern int suspend_devices_and_enter(suspend_state_t state);
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 6dadb25cb0d8..18c62195660f 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -31,7 +31,7 @@
 
 #include "power.h"
 
-static const char *pm_labels[] = { "mem", "standby", "freeze", };
+const char *pm_labels[] = { "mem", "standby", "freeze", NULL };
 const char *pm_states[PM_SUSPEND_MAX];
 
 static const struct platform_suspend_ops *suspend_ops;
diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
index 2f524928b6aa..bd91bc177c93 100644
--- a/kernel/power/suspend_test.c
+++ b/kernel/power/suspend_test.c
@@ -129,20 +129,20 @@ static int __init has_wakealarm(struct device *dev, const void *data)
  * at startup time.  They're normally disabled, for faster boot and because
  * we can't know which states really work on this particular system.
  */
-static suspend_state_t test_state __initdata = PM_SUSPEND_ON;
+static const char *test_state_label __initdata;
 
 static char warn_bad_state[] __initdata =
         KERN_WARNING "PM: can't test '%s' suspend state\n";
 
 static int __init setup_test_suspend(char *value)
 {
-        suspend_state_t i;
+        int i;
 
         /* "=mem" ==> "mem" */
         value++;
-        for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
-                if (!strcmp(pm_states[i], value)) {
-                        test_state = i;
+        for (i = 0; pm_labels[i]; i++)
+                if (!strcmp(pm_labels[i], value)) {
+                        test_state_label = pm_labels[i];
                         return 0;
                 }
 
@@ -158,13 +158,21 @@ static int __init test_suspend(void)
 
         struct rtc_device       *rtc = NULL;
         struct device           *dev;
+        suspend_state_t test_state;
 
         /* PM is initialized by now; is that state testable? */
-        if (test_state == PM_SUSPEND_ON)
-                goto done;
-        if (!pm_states[test_state]) {
-                printk(warn_bad_state, pm_states[test_state]);
-                goto done;
+        if (!test_state_label)
+                return 0;
+
+        for (test_state = PM_SUSPEND_MIN; test_state < PM_SUSPEND_MAX; test_state++) {
+                const char *state_label = pm_states[test_state];
+
+                if (state_label && !strcmp(test_state_label, state_label))
+                        break;
+        }
+        if (test_state == PM_SUSPEND_MAX) {
+                printk(warn_bad_state, test_state_label);
+                return 0;
         }
 
         /* RTCs have initialized by now too ... can we use one? */
@@ -173,13 +181,12 @@ static int __init test_suspend(void)
                 rtc = rtc_class_open(dev_name(dev));
         if (!rtc) {
                 printk(warn_no_rtc);
-                goto done;
+                return 0;
         }
 
         /* go for it */
         test_wakealarm(rtc, test_state);
         rtc_class_close(rtc);
-done:
         return 0;
 }
 late_initcall(test_suspend);
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index 71e64c718f75..6a86eb7bac45 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -358,7 +358,7 @@ struct rcu_data {
         struct rcu_head **nocb_gp_tail;
         long nocb_gp_count;
         long nocb_gp_count_lazy;
-        bool nocb_leader_wake;          /* Is the nocb leader thread awake? */
+        bool nocb_leader_sleep;         /* Is the nocb leader thread asleep? */
         struct rcu_data *nocb_next_follower;
                                         /* Next follower in wakeup chain. */
 
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 00dc411e9676..a7997e272564 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2074,9 +2074,9 @@ static void wake_nocb_leader(struct rcu_data *rdp, bool force)
 
         if (!ACCESS_ONCE(rdp_leader->nocb_kthread))
                 return;
-        if (!ACCESS_ONCE(rdp_leader->nocb_leader_wake) || force) {
+        if (ACCESS_ONCE(rdp_leader->nocb_leader_sleep) || force) {
                 /* Prior xchg orders against prior callback enqueue. */
-                ACCESS_ONCE(rdp_leader->nocb_leader_wake) = true;
+                ACCESS_ONCE(rdp_leader->nocb_leader_sleep) = false;
                 wake_up(&rdp_leader->nocb_wq);
         }
 }
@@ -2253,7 +2253,7 @@ wait_again:
         if (!rcu_nocb_poll) {
                 trace_rcu_nocb_wake(my_rdp->rsp->name, my_rdp->cpu, "Sleep");
                 wait_event_interruptible(my_rdp->nocb_wq,
-                                         ACCESS_ONCE(my_rdp->nocb_leader_wake));
+                                !ACCESS_ONCE(my_rdp->nocb_leader_sleep));
                 /* Memory barrier handled by smp_mb() calls below and repoll. */
         } else if (firsttime) {
                 firsttime = false; /* Don't drown trace log with "Poll"! */
@@ -2292,12 +2292,12 @@ wait_again:
                 schedule_timeout_interruptible(1);
 
                 /* Rescan in case we were a victim of memory ordering. */
-                my_rdp->nocb_leader_wake = false;
-                smp_mb();  /* Ensure _wake false before scan. */
+                my_rdp->nocb_leader_sleep = true;
+                smp_mb();  /* Ensure _sleep true before scan. */
                 for (rdp = my_rdp; rdp; rdp = rdp->nocb_next_follower)
                         if (ACCESS_ONCE(rdp->nocb_head)) {
                                 /* Found CB, so short-circuit next wait. */
-                                my_rdp->nocb_leader_wake = true;
+                                my_rdp->nocb_leader_sleep = false;
                                 break;
                         }
                 goto wait_again;
@@ -2307,17 +2307,17 @@ wait_again:
         rcu_nocb_wait_gp(my_rdp);
 
         /*
-         * We left ->nocb_leader_wake set to reduce cache thrashing.
-         * We clear it now, but recheck for new callbacks while
+         * We left ->nocb_leader_sleep unset to reduce cache thrashing.
+         * We set it now, but recheck for new callbacks while
          * traversing our follower list.
          */
-        my_rdp->nocb_leader_wake = false;
-        smp_mb(); /* Ensure _wake false before scan of ->nocb_head. */
+        my_rdp->nocb_leader_sleep = true;
+        smp_mb(); /* Ensure _sleep true before scan of ->nocb_head. */
 
         /* Each pass through the following loop wakes a follower, if needed. */
         for (rdp = my_rdp; rdp; rdp = rdp->nocb_next_follower) {
                 if (ACCESS_ONCE(rdp->nocb_head))
-                        my_rdp->nocb_leader_wake = true; /* No need to wait. */
+                        my_rdp->nocb_leader_sleep = false;/* No need to sleep.*/
                 if (!rdp->nocb_gp_head)
                         continue; /* No CBs, so no need to wake follower. */
 
diff --git a/kernel/resource.c b/kernel/resource.c
index da14b8d09296..60c5a3856ab7 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -351,15 +351,12 @@ static int find_next_iomem_res(struct resource *res, char *name,
         end = res->end;
         BUG_ON(start >= end);
 
-        read_lock(&resource_lock);
-
-        if (first_level_children_only) {
-                p = iomem_resource.child;
+        if (first_level_children_only)
                 sibling_only = true;
-        } else
-                p = &iomem_resource;
 
-        while ((p = next_resource(p, sibling_only))) {
+        read_lock(&resource_lock);
+
+        for (p = iomem_resource.child; p; p = next_resource(p, sibling_only)) {
                 if (p->flags != res->flags)
                         continue;
                 if (name && strcmp(p->name, name))
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 99aa6ee3908f..f654a8a298fa 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -225,6 +225,20 @@ static DEFINE_PER_CPU(struct irq_work, nohz_full_kick_work) = {
 };
 
 /*
+ * Kick this CPU if it's full dynticks in order to force it to
+ * re-evaluate its dependency on the tick and restart it if necessary.
+ * This kick, unlike tick_nohz_full_kick_cpu() and tick_nohz_full_kick_all(),
+ * is NMI safe.
+ */
+void tick_nohz_full_kick(void)
+{
+        if (!tick_nohz_full_cpu(smp_processor_id()))
+                return;
+
+        irq_work_queue(&__get_cpu_var(nohz_full_kick_work));
+}
+
+/*
  * Kick the CPU if it's full dynticks in order to force it to
  * re-evaluate its dependency on the tick and restart it if necessary.
  */
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index fb4a9c2cf8d9..ec1791fae965 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -442,11 +442,12 @@ static void timekeeping_update(struct timekeeper *tk, unsigned int action)
                 tk->ntp_error = 0;
                 ntp_clear();
         }
-        update_vsyscall(tk);
-        update_pvclock_gtod(tk, action & TK_CLOCK_WAS_SET);
 
         tk_update_ktime_data(tk);
 
+        update_vsyscall(tk);
+        update_pvclock_gtod(tk, action & TK_CLOCK_WAS_SET);
+
         if (action & TK_MIRROR)
                 memcpy(&shadow_timekeeper, &tk_core.timekeeper,
                        sizeof(tk_core.timekeeper));
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 1654b12c891a..5916a8e59e87 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -65,15 +65,21 @@
 #define FL_GLOBAL_CONTROL_MASK (FTRACE_OPS_FL_CONTROL)
 
 #ifdef CONFIG_DYNAMIC_FTRACE
-#define INIT_REGEX_LOCK(opsname)        \
-        .regex_lock     = __MUTEX_INITIALIZER(opsname.regex_lock),
+#define INIT_OPS_HASH(opsname)  \
+        .func_hash              = &opsname.local_hash,                  \
+        .local_hash.regex_lock  = __MUTEX_INITIALIZER(opsname.local_hash.regex_lock),
+#define ASSIGN_OPS_HASH(opsname, val) \
+        .func_hash              = val, \
+        .local_hash.regex_lock  = __MUTEX_INITIALIZER(opsname.local_hash.regex_lock),
 #else
-#define INIT_REGEX_LOCK(opsname)
+#define INIT_OPS_HASH(opsname)
+#define ASSIGN_OPS_HASH(opsname, val)
 #endif
 
 static struct ftrace_ops ftrace_list_end __read_mostly = {
         .func           = ftrace_stub,
         .flags          = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_STUB,
+        INIT_OPS_HASH(ftrace_list_end)
 };
 
 /* ftrace_enabled is a method to turn ftrace on or off */
@@ -140,7 +146,8 @@ static inline void ftrace_ops_init(struct ftrace_ops *ops)
 {
 #ifdef CONFIG_DYNAMIC_FTRACE
         if (!(ops->flags & FTRACE_OPS_FL_INITIALIZED)) {
-                mutex_init(&ops->regex_lock);
+                mutex_init(&ops->local_hash.regex_lock);
+                ops->func_hash = &ops->local_hash;
                 ops->flags |= FTRACE_OPS_FL_INITIALIZED;
         }
 #endif
@@ -899,7 +906,7 @@ static void unregister_ftrace_profiler(void)
 static struct ftrace_ops ftrace_profile_ops __read_mostly = {
         .func           = function_profile_call,
         .flags          = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
-        INIT_REGEX_LOCK(ftrace_profile_ops)
+        INIT_OPS_HASH(ftrace_profile_ops)
 };
 
 static int register_ftrace_profiler(void)
@@ -1081,11 +1088,12 @@ static const struct ftrace_hash empty_hash = {
 #define EMPTY_HASH      ((struct ftrace_hash *)&empty_hash)
 
 static struct ftrace_ops global_ops = {
-        .func                   = ftrace_stub,
-        .notrace_hash           = EMPTY_HASH,
-        .filter_hash            = EMPTY_HASH,
-        .flags                  = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
-        INIT_REGEX_LOCK(global_ops)
+        .func                           = ftrace_stub,
+        .local_hash.notrace_hash        = EMPTY_HASH,
+        .local_hash.filter_hash         = EMPTY_HASH,
+        INIT_OPS_HASH(global_ops)
+        .flags                          = FTRACE_OPS_FL_RECURSION_SAFE |
+                                          FTRACE_OPS_FL_INITIALIZED,
 };
 
 struct ftrace_page {
@@ -1226,8 +1234,8 @@ static void free_ftrace_hash_rcu(struct ftrace_hash *hash)
 void ftrace_free_filter(struct ftrace_ops *ops)
 {
         ftrace_ops_init(ops);
-        free_ftrace_hash(ops->filter_hash);
-        free_ftrace_hash(ops->notrace_hash);
+        free_ftrace_hash(ops->func_hash->filter_hash);
+        free_ftrace_hash(ops->func_hash->notrace_hash);
 }
 
 static struct ftrace_hash *alloc_ftrace_hash(int size_bits)
@@ -1288,9 +1296,9 @@ alloc_and_copy_ftrace_hash(int size_bits, struct ftrace_hash *hash)
 }
 
 static void
-ftrace_hash_rec_disable(struct ftrace_ops *ops, int filter_hash);
+ftrace_hash_rec_disable_modify(struct ftrace_ops *ops, int filter_hash);
 static void
-ftrace_hash_rec_enable(struct ftrace_ops *ops, int filter_hash);
+ftrace_hash_rec_enable_modify(struct ftrace_ops *ops, int filter_hash);
 
 static int
 ftrace_hash_move(struct ftrace_ops *ops, int enable,
@@ -1342,13 +1350,13 @@ update:
          * Remove the current set, update the hash and add
          * them back.
          */
-        ftrace_hash_rec_disable(ops, enable);
+        ftrace_hash_rec_disable_modify(ops, enable);
 
         old_hash = *dst;
         rcu_assign_pointer(*dst, new_hash);
         free_ftrace_hash_rcu(old_hash);
 
-        ftrace_hash_rec_enable(ops, enable);
+        ftrace_hash_rec_enable_modify(ops, enable);
 
         return 0;
 }
@@ -1382,8 +1390,8 @@ ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip, void *regs)
                 return 0;
 #endif
 
-        filter_hash = rcu_dereference_raw_notrace(ops->filter_hash);
-        notrace_hash = rcu_dereference_raw_notrace(ops->notrace_hash);
+        filter_hash = rcu_dereference_raw_notrace(ops->func_hash->filter_hash);
+        notrace_hash = rcu_dereference_raw_notrace(ops->func_hash->notrace_hash);
 
         if ((ftrace_hash_empty(filter_hash) ||
              ftrace_lookup_ip(filter_hash, ip)) &&
@@ -1503,25 +1511,38 @@ static bool test_rec_ops_needs_regs(struct dyn_ftrace *rec)
 static void ftrace_remove_tramp(struct ftrace_ops *ops,
                                 struct dyn_ftrace *rec)
 {
-        struct ftrace_func_entry *entry;
-
-        entry = ftrace_lookup_ip(ops->tramp_hash, rec->ip);
-        if (!entry)
+        /* If TRAMP is not set, no ops should have a trampoline for this */
+        if (!(rec->flags & FTRACE_FL_TRAMP))
                 return;
 
+        rec->flags &= ~FTRACE_FL_TRAMP;
+
+        if ((!ftrace_hash_empty(ops->func_hash->filter_hash) &&
+             !ftrace_lookup_ip(ops->func_hash->filter_hash, rec->ip)) ||
+            ftrace_lookup_ip(ops->func_hash->notrace_hash, rec->ip))
+                return;
         /*
          * The tramp_hash entry will be removed at time
          * of update.
          */
         ops->nr_trampolines--;
-        rec->flags &= ~FTRACE_FL_TRAMP;
 }
 
-static void ftrace_clear_tramps(struct dyn_ftrace *rec)
+static void ftrace_clear_tramps(struct dyn_ftrace *rec, struct ftrace_ops *ops)
 {
         struct ftrace_ops *op;
 
+        /* If TRAMP is not set, no ops should have a trampoline for this */
+        if (!(rec->flags & FTRACE_FL_TRAMP))
+                return;
+
         do_for_each_ftrace_op(op, ftrace_ops_list) {
+                /*
+                 * This function is called to clear other tramps
+                 * not the one that is being updated.
+                 */
+                if (op == ops)
+                        continue;
                 if (op->nr_trampolines)
                         ftrace_remove_tramp(op, rec);
         } while_for_each_ftrace_op(op);
@@ -1554,14 +1575,14 @@ static void __ftrace_hash_rec_update(struct ftrace_ops *ops,
          *   gets inversed.
          */
         if (filter_hash) {
-                hash = ops->filter_hash;
-                other_hash = ops->notrace_hash;
+                hash = ops->func_hash->filter_hash;
+                other_hash = ops->func_hash->notrace_hash;
                 if (ftrace_hash_empty(hash))
                         all = 1;
         } else {
                 inc = !inc;
-                hash = ops->notrace_hash;
-                other_hash = ops->filter_hash;
+                hash = ops->func_hash->notrace_hash;
+                other_hash = ops->func_hash->filter_hash;
                 /*
                  * If the notrace hash has no items,
                  * then there's nothing to do.
@@ -1622,13 +1643,10 @@ static void __ftrace_hash_rec_update(struct ftrace_ops *ops,
                                 /*
                                  * If we are adding another function callback
                                  * to this function, and the previous had a
-                                 * trampoline used, then we need to go back to
-                                 * the default trampoline.
+                                 * custom trampoline in use, then we need to go
+                                 * back to the default trampoline.
                                  */
-                                rec->flags &= ~FTRACE_FL_TRAMP;
-
-                                /* remove trampolines from any ops for this rec */
-                                ftrace_clear_tramps(rec);
+                                ftrace_clear_tramps(rec, ops);
                         }
 
                         /*
@@ -1682,6 +1700,41 @@ static void ftrace_hash_rec_enable(struct ftrace_ops *ops,
         __ftrace_hash_rec_update(ops, filter_hash, 1);
 }
 
+static void ftrace_hash_rec_update_modify(struct ftrace_ops *ops,
+                                          int filter_hash, int inc)
+{
+        struct ftrace_ops *op;
+
+        __ftrace_hash_rec_update(ops, filter_hash, inc);
+
+        if (ops->func_hash != &global_ops.local_hash)
+                return;
+
+        /*
+         * If the ops shares the global_ops hash, then we need to update
+         * all ops that are enabled and use this hash.
+         */
+        do_for_each_ftrace_op(op, ftrace_ops_list) {
+                /* Already done */
+                if (op == ops)
+                        continue;
+                if (op->func_hash == &global_ops.local_hash)
+                        __ftrace_hash_rec_update(op, filter_hash, inc);
+        } while_for_each_ftrace_op(op);
+}
+
+static void ftrace_hash_rec_disable_modify(struct ftrace_ops *ops,
+                                           int filter_hash)
+{
+        ftrace_hash_rec_update_modify(ops, filter_hash, 0);
+}
+
+static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops,
+                                          int filter_hash)
+{
+        ftrace_hash_rec_update_modify(ops, filter_hash, 1);
+}
+
 static void print_ip_ins(const char *fmt, unsigned char *p)
 {
         int i;
@@ -1896,8 +1949,8 @@ unsigned long ftrace_get_addr_new(struct dyn_ftrace *rec)
         if (rec->flags & FTRACE_FL_TRAMP) {
                 ops = ftrace_find_tramp_ops_new(rec);
                 if (FTRACE_WARN_ON(!ops || !ops->trampoline)) {
-                        pr_warning("Bad trampoline accounting at: %p (%pS)\n",
-                                    (void *)rec->ip, (void *)rec->ip);
+                        pr_warn("Bad trampoline accounting at: %p (%pS) (%lx)\n",
+                                (void *)rec->ip, (void *)rec->ip, rec->flags);
                         /* Ftrace is shutting down, return anything */
                         return (unsigned long)FTRACE_ADDR;
                 }
@@ -1964,7 +2017,7 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
                 return ftrace_make_call(rec, ftrace_addr);
 
         case FTRACE_UPDATE_MAKE_NOP:
-                return ftrace_make_nop(NULL, rec, ftrace_addr);
+                return ftrace_make_nop(NULL, rec, ftrace_old_addr);
 
         case FTRACE_UPDATE_MODIFY_CALL:
                 return ftrace_modify_call(rec, ftrace_old_addr, ftrace_addr);
@@ -2227,7 +2280,10 @@ static int ftrace_save_ops_tramp_hash(struct ftrace_ops *ops)
         } while_for_each_ftrace_rec();
 
         /* The number of recs in the hash must match nr_trampolines */
-        FTRACE_WARN_ON(ops->tramp_hash->count != ops->nr_trampolines);
+        if (FTRACE_WARN_ON(ops->tramp_hash->count != ops->nr_trampolines))
+                pr_warn("count=%ld trampolines=%d\n",
+                        ops->tramp_hash->count,
+                        ops->nr_trampolines);
 
         return 0;
 }
@@ -2436,8 +2492,8 @@ static inline int ops_traces_mod(struct ftrace_ops *ops)
          * Filter_hash being empty will default to trace module.
          * But notrace hash requires a test of individual module functions.
          */
-        return ftrace_hash_empty(ops->filter_hash) &&
-                ftrace_hash_empty(ops->notrace_hash);
+        return ftrace_hash_empty(ops->func_hash->filter_hash) &&
+                ftrace_hash_empty(ops->func_hash->notrace_hash);
 }
 
 /*
@@ -2459,12 +2515,12 @@ ops_references_rec(struct ftrace_ops *ops, struct dyn_ftrace *rec)
                 return 0;
 
         /* The function must be in the filter */
-        if (!ftrace_hash_empty(ops->filter_hash) &&
-            !ftrace_lookup_ip(ops->filter_hash, rec->ip))
+        if (!ftrace_hash_empty(ops->func_hash->filter_hash) &&
+            !ftrace_lookup_ip(ops->func_hash->filter_hash, rec->ip))
                 return 0;
 
         /* If in notrace hash, we ignore it too */
-        if (ftrace_lookup_ip(ops->notrace_hash, rec->ip))
+        if (ftrace_lookup_ip(ops->func_hash->notrace_hash, rec->ip))
                 return 0;
 
         return 1;
@@ -2785,10 +2841,10 @@ t_next(struct seq_file *m, void *v, loff_t *pos)
         } else {
                 rec = &iter->pg->records[iter->idx++];
                 if (((iter->flags & FTRACE_ITER_FILTER) &&
-                     !(ftrace_lookup_ip(ops->filter_hash, rec->ip))) ||
+                     !(ftrace_lookup_ip(ops->func_hash->filter_hash, rec->ip))) ||
 
                     ((iter->flags & FTRACE_ITER_NOTRACE) &&
-                     !ftrace_lookup_ip(ops->notrace_hash, rec->ip)) ||
+                     !ftrace_lookup_ip(ops->func_hash->notrace_hash, rec->ip)) ||
 
                     ((iter->flags & FTRACE_ITER_ENABLED) &&
                      !(rec->flags & FTRACE_FL_ENABLED))) {
@@ -2837,9 +2893,9 @@ static void *t_start(struct seq_file *m, loff_t *pos)
          * functions are enabled.
          */
         if ((iter->flags & FTRACE_ITER_FILTER &&
-             ftrace_hash_empty(ops->filter_hash)) ||
+             ftrace_hash_empty(ops->func_hash->filter_hash)) ||
             (iter->flags & FTRACE_ITER_NOTRACE &&
-             ftrace_hash_empty(ops->notrace_hash))) {
+             ftrace_hash_empty(ops->func_hash->notrace_hash))) {
                 if (*pos > 0)
                         return t_hash_start(m, pos);
                 iter->flags |= FTRACE_ITER_PRINTALL;
@@ -3001,12 +3057,12 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
         iter->ops = ops;
         iter->flags = flag;
 
-        mutex_lock(&ops->regex_lock);
+        mutex_lock(&ops->func_hash->regex_lock);
 
         if (flag & FTRACE_ITER_NOTRACE)
-                hash = ops->notrace_hash;
+                hash = ops->func_hash->notrace_hash;
         else
-                hash = ops->filter_hash;
+                hash = ops->func_hash->filter_hash;
 
         if (file->f_mode & FMODE_WRITE) {
                 const int size_bits = FTRACE_HASH_DEFAULT_BITS;
@@ -3041,7 +3097,7 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
                 file->private_data = iter;
 
  out_unlock:
-        mutex_unlock(&ops->regex_lock);
+        mutex_unlock(&ops->func_hash->regex_lock);
 
         return ret;
 }
@@ -3279,7 +3335,7 @@ static struct ftrace_ops trace_probe_ops __read_mostly =
 {
         .func           = function_trace_probe_call,
         .flags          = FTRACE_OPS_FL_INITIALIZED,
-        INIT_REGEX_LOCK(trace_probe_ops)
+        INIT_OPS_HASH(trace_probe_ops)
 };
 
 static int ftrace_probe_registered;
@@ -3342,7 +3398,7 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                               void *data)
 {
         struct ftrace_func_probe *entry;
-        struct ftrace_hash **orig_hash = &trace_probe_ops.filter_hash;
+        struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
         struct ftrace_hash *hash;
         struct ftrace_page *pg;
         struct dyn_ftrace *rec;
@@ -3359,7 +3415,7 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
         if (WARN_ON(not))
                 return -EINVAL;
 
-        mutex_lock(&trace_probe_ops.regex_lock);
+        mutex_lock(&trace_probe_ops.func_hash->regex_lock);
 
         hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
         if (!hash) {
@@ -3428,7 +3484,7 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
  out_unlock:
         mutex_unlock(&ftrace_lock);
  out:
-        mutex_unlock(&trace_probe_ops.regex_lock);
+        mutex_unlock(&trace_probe_ops.func_hash->regex_lock);
         free_ftrace_hash(hash);
 
         return count;
@@ -3446,7 +3502,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
         struct ftrace_func_entry *rec_entry;
         struct ftrace_func_probe *entry;
         struct ftrace_func_probe *p;
-        struct ftrace_hash **orig_hash = &trace_probe_ops.filter_hash;
+        struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
         struct list_head free_list;
         struct ftrace_hash *hash;
         struct hlist_node *tmp;
@@ -3468,7 +3524,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                         return;
         }
 
-        mutex_lock(&trace_probe_ops.regex_lock);
+        mutex_lock(&trace_probe_ops.func_hash->regex_lock);
 
         hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
         if (!hash)
@@ -3521,7 +3577,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
         mutex_unlock(&ftrace_lock);
                 
  out_unlock:
-        mutex_unlock(&trace_probe_ops.regex_lock);
+        mutex_unlock(&trace_probe_ops.func_hash->regex_lock);
         free_ftrace_hash(hash);
 }
 
@@ -3717,12 +3773,12 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
         if (unlikely(ftrace_disabled))
                 return -ENODEV;
 
-        mutex_lock(&ops->regex_lock);
+        mutex_lock(&ops->func_hash->regex_lock);
 
         if (enable)
-                orig_hash = &ops->filter_hash;
+                orig_hash = &ops->func_hash->filter_hash;
         else
-                orig_hash = &ops->notrace_hash;
+                orig_hash = &ops->func_hash->notrace_hash;
 
         if (reset)
                 hash = alloc_ftrace_hash(FTRACE_HASH_DEFAULT_BITS);
@@ -3752,7 +3808,7 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
         mutex_unlock(&ftrace_lock);
 
  out_regex_unlock:
-        mutex_unlock(&ops->regex_lock);
+        mutex_unlock(&ops->func_hash->regex_lock);
 
         free_ftrace_hash(hash);
         return ret;
@@ -3975,15 +4031,15 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
 
         trace_parser_put(parser);
 
-        mutex_lock(&iter->ops->regex_lock);
+        mutex_lock(&iter->ops->func_hash->regex_lock);
 
         if (file->f_mode & FMODE_WRITE) {
                 filter_hash = !!(iter->flags & FTRACE_ITER_FILTER);
 
                 if (filter_hash)
-                        orig_hash = &iter->ops->filter_hash;
+                        orig_hash = &iter->ops->func_hash->filter_hash;
                 else
-                        orig_hash = &iter->ops->notrace_hash;
+                        orig_hash = &iter->ops->func_hash->notrace_hash;
 
                 mutex_lock(&ftrace_lock);
                 ret = ftrace_hash_move(iter->ops, filter_hash,
@@ -3994,7 +4050,7 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
                 mutex_unlock(&ftrace_lock);
         }
 
-        mutex_unlock(&iter->ops->regex_lock);
+        mutex_unlock(&iter->ops->func_hash->regex_lock);
         free_ftrace_hash(iter->hash);
         kfree(iter);
 
@@ -4611,7 +4667,6 @@ void __init ftrace_init(void)
 static struct ftrace_ops global_ops = {
         .func                   = ftrace_stub,
         .flags                  = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
-        INIT_REGEX_LOCK(global_ops)
 };
 
 static int __init ftrace_nodyn_init(void)
@@ -4713,7 +4768,7 @@ ftrace_ops_control_func(unsigned long ip, unsigned long parent_ip,
 static struct ftrace_ops control_ops = {
         .func   = ftrace_ops_control_func,
         .flags  = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
-        INIT_REGEX_LOCK(control_ops)
+        INIT_OPS_HASH(control_ops)
 };
 
 static inline void
@@ -5145,6 +5200,17 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
+static struct ftrace_ops graph_ops = {
+        .func                   = ftrace_stub,
+        .flags                  = FTRACE_OPS_FL_RECURSION_SAFE |
+                                   FTRACE_OPS_FL_INITIALIZED |
+                                   FTRACE_OPS_FL_STUB,
+#ifdef FTRACE_GRAPH_TRAMP_ADDR
+        .trampoline             = FTRACE_GRAPH_TRAMP_ADDR,
+#endif
+        ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
+};
+
 static int ftrace_graph_active;
 
 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
@@ -5307,12 +5373,28 @@ static int ftrace_graph_entry_test(struct ftrace_graph_ent *trace)
  */
 static void update_function_graph_func(void)
 {
-        if (ftrace_ops_list == &ftrace_list_end ||
-            (ftrace_ops_list == &global_ops &&
-             global_ops.next == &ftrace_list_end))
-                ftrace_graph_entry = __ftrace_graph_entry;
-        else
+        struct ftrace_ops *op;
+        bool do_test = false;
+
+        /*
+         * The graph and global ops share the same set of functions
+         * to test. If any other ops is on the list, then
+         * the graph tracing needs to test if its the function
+         * it should call.
+         */
+        do_for_each_ftrace_op(op, ftrace_ops_list) {
+                if (op != &global_ops && op != &graph_ops &&
+                    op != &ftrace_list_end) {
+                        do_test = true;
+                        /* in double loop, break out with goto */
+                        goto out;
+                }
+        } while_for_each_ftrace_op(op);
+ out:
+        if (do_test)
                 ftrace_graph_entry = ftrace_graph_entry_test;
+        else
+                ftrace_graph_entry = __ftrace_graph_entry;
 }
 
 static struct notifier_block ftrace_suspend_notifier = {
@@ -5353,16 +5435,7 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
         ftrace_graph_entry = ftrace_graph_entry_test;
         update_function_graph_func();
 
-        /* Function graph doesn't use the .func field of global_ops */
-        global_ops.flags |= FTRACE_OPS_FL_STUB;
-
-#ifdef CONFIG_DYNAMIC_FTRACE
-        /* Optimize function graph calling (if implemented by arch) */
-        if (FTRACE_GRAPH_TRAMP_ADDR != 0)
-                global_ops.trampoline = FTRACE_GRAPH_TRAMP_ADDR;
-#endif
-
-        ret = ftrace_startup(&global_ops, FTRACE_START_FUNC_RET);
+        ret = ftrace_startup(&graph_ops, FTRACE_START_FUNC_RET);
 
 out:
         mutex_unlock(&ftrace_lock);
@@ -5380,12 +5453,7 @@ void unregister_ftrace_graph(void)
         ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
         ftrace_graph_entry = ftrace_graph_entry_stub;
         __ftrace_graph_entry = ftrace_graph_entry_stub;
-        ftrace_shutdown(&global_ops, FTRACE_STOP_FUNC_RET);
-        global_ops.flags &= ~FTRACE_OPS_FL_STUB;
-#ifdef CONFIG_DYNAMIC_FTRACE
-        if (FTRACE_GRAPH_TRAMP_ADDR != 0)
-                global_ops.trampoline = 0;
-#endif
+        ftrace_shutdown(&graph_ops, FTRACE_STOP_FUNC_RET);
         unregister_pm_notifier(&ftrace_suspend_notifier);
         unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
 
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index afb04b9b818a..b38fb2b9e237 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -626,8 +626,22 @@ int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
                 work = &cpu_buffer->irq_work;
         }
 
-        work->waiters_pending = true;
         poll_wait(filp, &work->waiters, poll_table);
+        work->waiters_pending = true;
+        /*
+         * There's a tight race between setting the waiters_pending and
+         * checking if the ring buffer is empty.  Once the waiters_pending bit
+         * is set, the next event will wake the task up, but we can get stuck
+         * if there's only a single event in.
+         *
+         * FIXME: Ideally, we need a memory barrier on the writer side as well,
+         * but adding a memory barrier to all events will cause too much of a
+         * performance hit in the fast path.  We only need a memory barrier when
+         * the buffer goes from empty to having content.  But as this race is
+         * extremely small, and it's not a problem if another event comes in, we
+         * will fix it later.
+         */
+        smp_mb();
 
         if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) ||
             (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu)))
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 07c28323f88f..a28590083622 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -892,6 +892,10 @@ config DEBUG_WW_MUTEX_SLOWPATH
          the full mutex checks enabled with (CONFIG_PROVE_LOCKING) this
          will test all possible w/w mutex interface abuse with the
          exception of simply not acquiring all the required locks.
+         Note that this feature can introduce significant overhead, so
+         it really should not be enabled in a production or distro kernel,
+         even a debug kernel.  If you are a driver writer, enable it.  If
+         you are a distro, do not.
 
 config DEBUG_LOCK_ALLOC
         bool "Lock debugging: detect incorrect freeing of live locks"
@@ -1032,8 +1036,13 @@ config TRACE_IRQFLAGS
           either tracing or lock debugging.
 
 config STACKTRACE
-        bool
+        bool "Stack backtrace support"
         depends on STACKTRACE_SUPPORT
+        help
+          This option causes the kernel to create a /proc/pid/stack for
+          every process, showing its current stack trace.
+          It is also used by various kernel debugging features that require
+          stack trace generation.
 
 config DEBUG_KOBJECT
         bool "kobject debugging"
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index c0b1007011e1..ae146f0734eb 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -1735,7 +1735,7 @@ ascend_old_tree:
 gc_complete:
         edit->set[0].to = new_root;
         assoc_array_apply_edit(edit);
-        edit->array->nr_leaves_on_tree = nr_leaves_on_tree;
+        array->nr_leaves_on_tree = nr_leaves_on_tree;
         return 0;
 
 enomem:
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index 9eebfadeeee1..a67c26e0f360 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -217,7 +217,7 @@ void hugetlb_cgroup_uncharge_page(int idx, unsigned long nr_pages,
 
         if (hugetlb_cgroup_disabled())
                 return;
-        VM_BUG_ON(!spin_is_locked(&hugetlb_lock));
+        lockdep_assert_held(&hugetlb_lock);
         h_cg = hugetlb_cgroup_from_page(page);
         if (unlikely(!h_cg))
                 return;
diff --git a/mm/memblock.c b/mm/memblock.c
index 6d2f219a48b0..70fad0c0dafb 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -192,8 +192,7 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
                                         phys_addr_t align, phys_addr_t start,
                                         phys_addr_t end, int nid)
 {
-        int ret;
-        phys_addr_t kernel_end;
+        phys_addr_t kernel_end, ret;
 
         /* pump up @end */
         if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ec4dcf1b9562..085dc6d2f876 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2534,6 +2534,8 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
         unsigned long long size;
         int ret = 0;
 
+        if (mem_cgroup_is_root(memcg))
+                goto done;
 retry:
         if (consume_stock(memcg, nr_pages))
                 goto done;
@@ -2611,9 +2613,7 @@ nomem:
         if (!(gfp_mask & __GFP_NOFAIL))
                 return -ENOMEM;
 bypass:
-        memcg = root_mem_cgroup;
-        ret = -EINTR;
-        goto retry;
+        return -EINTR;
 
 done_restock:
         if (batch > nr_pages)
@@ -2626,6 +2626,9 @@ static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
         unsigned long bytes = nr_pages * PAGE_SIZE;
 
+        if (mem_cgroup_is_root(memcg))
+                return;
+
         res_counter_uncharge(&memcg->res, bytes);
         if (do_swap_account)
                 res_counter_uncharge(&memcg->memsw, bytes);
@@ -2640,6 +2643,9 @@ static void __mem_cgroup_cancel_local_charge(struct mem_cgroup *memcg,
 {
         unsigned long bytes = nr_pages * PAGE_SIZE;
 
+        if (mem_cgroup_is_root(memcg))
+                return;
+
         res_counter_uncharge_until(&memcg->res, memcg->res.parent, bytes);
         if (do_swap_account)
                 res_counter_uncharge_until(&memcg->memsw,
@@ -4093,6 +4099,46 @@ out:
         return retval;
 }
 
+static unsigned long mem_cgroup_recursive_stat(struct mem_cgroup *memcg,
+                                               enum mem_cgroup_stat_index idx)
+{
+        struct mem_cgroup *iter;
+        long val = 0;
+
+        /* Per-cpu values can be negative, use a signed accumulator */
+        for_each_mem_cgroup_tree(iter, memcg)
+                val += mem_cgroup_read_stat(iter, idx);
+
+        if (val < 0) /* race ? */
+                val = 0;
+        return val;
+}
+
+static inline u64 mem_cgroup_usage(struct mem_cgroup *memcg, bool swap)
+{
+        u64 val;
+
+        if (!mem_cgroup_is_root(memcg)) {
+                if (!swap)
+                        return res_counter_read_u64(&memcg->res, RES_USAGE);
+                else
+                        return res_counter_read_u64(&memcg->memsw, RES_USAGE);
+        }
+
+        /*
+         * Transparent hugepages are still accounted for in MEM_CGROUP_STAT_RSS
+         * as well as in MEM_CGROUP_STAT_RSS_HUGE.
+         */
+        val = mem_cgroup_recursive_stat(memcg, MEM_CGROUP_STAT_CACHE);
+        val += mem_cgroup_recursive_stat(memcg, MEM_CGROUP_STAT_RSS);
+
+        if (swap)
+                val += mem_cgroup_recursive_stat(memcg, MEM_CGROUP_STAT_SWAP);
+
+        return val << PAGE_SHIFT;
+}
+
+
 static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
                                struct cftype *cft)
 {
@@ -4102,8 +4148,12 @@ static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
 
         switch (type) {
         case _MEM:
+                if (name == RES_USAGE)
+                        return mem_cgroup_usage(memcg, false);
                 return res_counter_read_u64(&memcg->res, name);
         case _MEMSWAP:
+                if (name == RES_USAGE)
+                        return mem_cgroup_usage(memcg, true);
                 return res_counter_read_u64(&memcg->memsw, name);
         case _KMEM:
                 return res_counter_read_u64(&memcg->kmem, name);
@@ -4572,10 +4622,7 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
         if (!t)
                 goto unlock;
 
-        if (!swap)
-                usage = res_counter_read_u64(&memcg->res, RES_USAGE);
-        else
-                usage = res_counter_read_u64(&memcg->memsw, RES_USAGE);
+        usage = mem_cgroup_usage(memcg, swap);
 
         /*
          * current_threshold points to threshold just below or equal to usage.
@@ -4673,10 +4720,10 @@ static int __mem_cgroup_usage_register_event(struct mem_cgroup *memcg,
 
         if (type == _MEM) {
                 thresholds = &memcg->thresholds;
-                usage = res_counter_read_u64(&memcg->res, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, false);
         } else if (type == _MEMSWAP) {
                 thresholds = &memcg->memsw_thresholds;
-                usage = res_counter_read_u64(&memcg->memsw, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, true);
         } else
                 BUG();
 
@@ -4762,10 +4809,10 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
 
         if (type == _MEM) {
                 thresholds = &memcg->thresholds;
-                usage = res_counter_read_u64(&memcg->res, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, false);
         } else if (type == _MEMSWAP) {
                 thresholds = &memcg->memsw_thresholds;
-                usage = res_counter_read_u64(&memcg->memsw, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, true);
         } else
                 BUG();
 
@@ -5525,9 +5572,9 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
                  * core guarantees its existence.
                  */
         } else {
-                res_counter_init(&memcg->res, &root_mem_cgroup->res);
-                res_counter_init(&memcg->memsw, &root_mem_cgroup->memsw);
-                res_counter_init(&memcg->kmem, &root_mem_cgroup->kmem);
+                res_counter_init(&memcg->res, NULL);
+                res_counter_init(&memcg->memsw, NULL);
+                res_counter_init(&memcg->kmem, NULL);
                 /*
                  * Deeper hierachy with use_hierarchy == false doesn't make
                  * much sense so let cgroup subsystem know about this
@@ -5969,8 +6016,9 @@ static void __mem_cgroup_clear_mc(void)
         /* we must fixup refcnts and charges */
         if (mc.moved_swap) {
                 /* uncharge swap account from the old cgroup */
-                res_counter_uncharge(&mc.from->memsw,
-                                     PAGE_SIZE * mc.moved_swap);
+                if (!mem_cgroup_is_root(mc.from))
+                        res_counter_uncharge(&mc.from->memsw,
+                                             PAGE_SIZE * mc.moved_swap);
 
                 for (i = 0; i < mc.moved_swap; i++)
                         css_put(&mc.from->css);
@@ -5979,8 +6027,9 @@ static void __mem_cgroup_clear_mc(void)
                  * we charged both to->res and to->memsw, so we should
                  * uncharge to->res.
                  */
-                res_counter_uncharge(&mc.to->res,
-                                     PAGE_SIZE * mc.moved_swap);
+                if (!mem_cgroup_is_root(mc.to))
+                        res_counter_uncharge(&mc.to->res,
+                                             PAGE_SIZE * mc.moved_swap);
                 /* we've already done css_get(mc.to) */
                 mc.moved_swap = 0;
         }
@@ -6345,7 +6394,8 @@ void mem_cgroup_uncharge_swap(swp_entry_t entry)
         rcu_read_lock();
         memcg = mem_cgroup_lookup(id);
         if (memcg) {
-                res_counter_uncharge(&memcg->memsw, PAGE_SIZE);
+                if (!mem_cgroup_is_root(memcg))
+                        res_counter_uncharge(&memcg->memsw, PAGE_SIZE);
                 mem_cgroup_swap_statistics(memcg, false);
                 css_put(&memcg->css);
         }
@@ -6509,12 +6559,15 @@ static void uncharge_batch(struct mem_cgroup *memcg, unsigned long pgpgout,
 {
         unsigned long flags;
 
-        if (nr_mem)
-                res_counter_uncharge(&memcg->res, nr_mem * PAGE_SIZE);
-        if (nr_memsw)
-                res_counter_uncharge(&memcg->memsw, nr_memsw * PAGE_SIZE);
-
-        memcg_oom_recover(memcg);
+        if (!mem_cgroup_is_root(memcg)) {
+                if (nr_mem)
+                        res_counter_uncharge(&memcg->res,
+                                             nr_mem * PAGE_SIZE);
+                if (nr_memsw)
+                        res_counter_uncharge(&memcg->memsw,
+                                             nr_memsw * PAGE_SIZE);
+                memcg_oom_recover(memcg);
+        }
 
         local_irq_save(flags);
         __this_cpu_sub(memcg->stat->count[MEM_CGROUP_STAT_RSS], nr_anon);
diff --git a/mm/memory.c b/mm/memory.c
index ab3537bcfed2..adeac306610f 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -751,7 +751,7 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
         unsigned long pfn = pte_pfn(pte);
 
         if (HAVE_PTE_SPECIAL) {
-                if (likely(!pte_special(pte) || pte_numa(pte)))
+                if (likely(!pte_special(pte)))
                         goto check_pfn;
                 if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
                         return NULL;
@@ -777,15 +777,14 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
                 }
         }
 
+        if (is_zero_pfn(pfn))
+                return NULL;
 check_pfn:
         if (unlikely(pfn > highest_memmap_pfn)) {
                 print_bad_pte(vma, addr, pte, NULL);
                 return NULL;
         }
 
-        if (is_zero_pfn(pfn))
-                return NULL;
-
         /*
          * NOTE! We still have PageReserved() pages in the page tables.
          * eg. VDSO mappings can cause them to exist.
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 3707c71ae4cd..51108165f829 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
                             int page_start, int page_end)
 {
         const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
-        unsigned int cpu;
+        unsigned int cpu, tcpu;
         int i;
 
         for_each_possible_cpu(cpu) {
@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
                         struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
 
                         *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
-                        if (!*pagep) {
-                                pcpu_free_pages(chunk, pages, populated,
-                                                page_start, page_end);
-                                return -ENOMEM;
-                        }
+                        if (!*pagep)
+                                goto err;
                 }
         }
         return 0;
+
+err:
+        while (--i >= page_start)
+                __free_page(pages[pcpu_page_idx(cpu, i)]);
+
+        for_each_possible_cpu(tcpu) {
+                if (tcpu == cpu)
+                        break;
+                for (i = page_start; i < page_end; i++)
+                        __free_page(pages[pcpu_page_idx(tcpu, i)]);
+        }
+        return -ENOMEM;
 }
 
 /**
@@ -263,6 +272,7 @@ err:
                 __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
                                    page_end - page_start);
         }
+        pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
         return err;
 }
 
diff --git a/mm/percpu.c b/mm/percpu.c
index 2139e30a4b44..da997f9800bd 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1932,6 +1932,8 @@ void __init setup_per_cpu_areas(void)
 
         if (pcpu_setup_first_chunk(ai, fc) < 0)
                 panic("Failed to initialize percpu areas.");
+
+        pcpu_free_alloc_info(ai);
 }
 
 #endif  /* CONFIG_SMP */
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index a8b919925934..dfb79e028ecb 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -195,7 +195,7 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
         pmd_t entry = *pmdp;
         if (pmd_numa(entry))
                 entry = pmd_mknonnuma(entry);
-        set_pmd_at(vma->vm_mm, address, pmdp, pmd_mknotpresent(*pmdp));
+        set_pmd_at(vma->vm_mm, address, pmdp, pmd_mknotpresent(entry));
         flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
diff --git a/mm/zbud.c b/mm/zbud.c
index a05790b1915e..f26e7fcc7fa2 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -195,6 +195,7 @@ static struct zpool_driver zbud_zpool_driver = {
         .total_size =   zbud_zpool_total_size,
 };
 
+MODULE_ALIAS("zpool-zbud");
 #endif /* CONFIG_ZPOOL */
 
 /*****************
diff --git a/mm/zpool.c b/mm/zpool.c
index e40612a1df00..739cdf0d183a 100644
--- a/mm/zpool.c
+++ b/mm/zpool.c
@@ -150,7 +150,7 @@ struct zpool *zpool_create_pool(char *type, gfp_t gfp, struct zpool_ops *ops)
         driver = zpool_get_driver(type);
 
         if (!driver) {
-                request_module(type);
+                request_module("zpool-%s", type);
                 driver = zpool_get_driver(type);
         }
 
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 4e2fc83cb394..94f38fac5e81 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -315,6 +315,7 @@ static struct zpool_driver zs_zpool_driver = {
         .total_size =   zs_zpool_total_size,
 };
 
+MODULE_ALIAS("zpool-zsmalloc");
 #endif /* CONFIG_ZPOOL */
 
 /* per-cpu VM mapping areas for zspage accesses that cross page boundaries */
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b50dabb3f86a..faff6247ac8f 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -589,6 +589,14 @@ EXPORT_SYMBOL(hci_get_route);
 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 {
         struct hci_dev *hdev = conn->hdev;
+        struct hci_conn_params *params;
+
+        params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
+                                           conn->dst_type);
+        if (params && params->conn) {
+                hci_conn_drop(params->conn);
+                params->conn = NULL;
+        }
 
         conn->state = BT_CLOSED;
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c32d361c0cf7..1d9c29a00568 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2536,8 +2536,13 @@ static void hci_pend_le_actions_clear(struct hci_dev *hdev)
 {
         struct hci_conn_params *p;
 
-        list_for_each_entry(p, &hdev->le_conn_params, list)
+        list_for_each_entry(p, &hdev->le_conn_params, list) {
+                if (p->conn) {
+                        hci_conn_drop(p->conn);
+                        p->conn = NULL;
+                }
                 list_del_init(&p->action);
+        }
 
         BT_DBG("All LE pending actions cleared");
 }
@@ -2578,8 +2583,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         hci_dev_lock(hdev);
         hci_inquiry_cache_flush(hdev);
-        hci_conn_hash_flush(hdev);
         hci_pend_le_actions_clear(hdev);
+        hci_conn_hash_flush(hdev);
         hci_dev_unlock(hdev);
 
         hci_notify(hdev, HCI_DEV_DOWN);
@@ -3727,6 +3732,9 @@ void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
         if (!params)
                 return;
 
+        if (params->conn)
+                hci_conn_drop(params->conn);
+
         list_del(&params->action);
         list_del(&params->list);
         kfree(params);
@@ -3757,6 +3765,8 @@ void hci_conn_params_clear_all(struct hci_dev *hdev)
         struct hci_conn_params *params, *tmp;
 
         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
+                if (params->conn)
+                        hci_conn_drop(params->conn);
                 list_del(&params->action);
                 list_del(&params->list);
                 kfree(params);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index be35598984d9..a6000823f0ff 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4221,8 +4221,13 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         hci_proto_connect_cfm(conn, ev->status);
 
         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
-        if (params)
+        if (params) {
                 list_del_init(&params->action);
+                if (params->conn) {
+                        hci_conn_drop(params->conn);
+                        params->conn = NULL;
+                }
+        }
 
 unlock:
         hci_update_background_scan(hdev);
@@ -4304,8 +4309,16 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
 
         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
-        if (!IS_ERR(conn))
+        if (!IS_ERR(conn)) {
+                /* Store the pointer since we don't really have any
+                 * other owner of the object besides the params that
+                 * triggered it. This way we can abort the connection if
+                 * the parameters get removed and keep the reference
+                 * count consistent once the connection is established.
+                 */
+                params->conn = conn;
                 return;
+        }
 
         switch (PTR_ERR(conn)) {
         case -EBUSY:
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 488dd1a825c0..fdbc9a81d4c2 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -775,7 +775,7 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
 EXPORT_SYMBOL(__skb_checksum_complete);
 
 /**
- *      skb_copy_and_csum_datagram_iovec - Copy and checkum skb to user iovec.
+ *      skb_copy_and_csum_datagram_iovec - Copy and checksum skb to user iovec.
  *      @skb: skbuff
  *      @hlen: hardware length
  *      @iov: io vector
diff --git a/net/core/dev.c b/net/core/dev.c
index 2f3dbd657570..3c6a967e5830 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2541,13 +2541,19 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
                 return harmonize_features(skb, features);
         }
 
-        features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
-                                               NETIF_F_HW_VLAN_STAG_TX);
+        features = netdev_intersect_features(features,
+                                             skb->dev->vlan_features |
+                                             NETIF_F_HW_VLAN_CTAG_TX |
+                                             NETIF_F_HW_VLAN_STAG_TX);
 
         if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD))
-                features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
-                                NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_CTAG_TX |
-                                NETIF_F_HW_VLAN_STAG_TX;
+                features = netdev_intersect_features(features,
+                                                     NETIF_F_SG |
+                                                     NETIF_F_HIGHDMA |
+                                                     NETIF_F_FRAGLIST |
+                                                     NETIF_F_GEN_CSUM |
+                                                     NETIF_F_HW_VLAN_CTAG_TX |
+                                                     NETIF_F_HW_VLAN_STAG_TX);
 
         return harmonize_features(skb, features);
 }
@@ -4894,7 +4900,8 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev,
         if (adj->master)
                 sysfs_remove_link(&(dev->dev.kobj), "master");
 
-        if (netdev_adjacent_is_neigh_list(dev, dev_list))
+        if (netdev_adjacent_is_neigh_list(dev, dev_list) &&
+            net_eq(dev_net(dev),dev_net(adj_dev)))
                 netdev_adjacent_sysfs_del(dev, adj_dev->name, dev_list);
 
         list_del_rcu(&adj->list);
@@ -5164,11 +5171,65 @@ void netdev_upper_dev_unlink(struct net_device *dev,
 }
 EXPORT_SYMBOL(netdev_upper_dev_unlink);
 
+void netdev_adjacent_add_links(struct net_device *dev)
+{
+        struct netdev_adjacent *iter;
+
+        struct net *net = dev_net(dev);
+
+        list_for_each_entry(iter, &dev->adj_list.upper, list) {
+                if (!net_eq(net,dev_net(iter->dev)))
+                        continue;
+                netdev_adjacent_sysfs_add(iter->dev, dev,
+                                          &iter->dev->adj_list.lower);
+                netdev_adjacent_sysfs_add(dev, iter->dev,
+                                          &dev->adj_list.upper);
+        }
+
+        list_for_each_entry(iter, &dev->adj_list.lower, list) {
+                if (!net_eq(net,dev_net(iter->dev)))
+                        continue;
+                netdev_adjacent_sysfs_add(iter->dev, dev,
+                                          &iter->dev->adj_list.upper);
+                netdev_adjacent_sysfs_add(dev, iter->dev,
+                                          &dev->adj_list.lower);
+        }
+}
+
+void netdev_adjacent_del_links(struct net_device *dev)
+{
+        struct netdev_adjacent *iter;
+
+        struct net *net = dev_net(dev);
+
+        list_for_each_entry(iter, &dev->adj_list.upper, list) {
+                if (!net_eq(net,dev_net(iter->dev)))
+                        continue;
+                netdev_adjacent_sysfs_del(iter->dev, dev->name,
+                                          &iter->dev->adj_list.lower);
+                netdev_adjacent_sysfs_del(dev, iter->dev->name,
+                                          &dev->adj_list.upper);
+        }
+
+        list_for_each_entry(iter, &dev->adj_list.lower, list) {
+                if (!net_eq(net,dev_net(iter->dev)))
+                        continue;
+                netdev_adjacent_sysfs_del(iter->dev, dev->name,
+                                          &iter->dev->adj_list.upper);
+                netdev_adjacent_sysfs_del(dev, iter->dev->name,
+                                          &dev->adj_list.lower);
+        }
+}
+
 void netdev_adjacent_rename_links(struct net_device *dev, char *oldname)
 {
         struct netdev_adjacent *iter;
 
+        struct net *net = dev_net(dev);
+
         list_for_each_entry(iter, &dev->adj_list.upper, list) {
+                if (!net_eq(net,dev_net(iter->dev)))
+                        continue;
                 netdev_adjacent_sysfs_del(iter->dev, oldname,
                                           &iter->dev->adj_list.lower);
                 netdev_adjacent_sysfs_add(iter->dev, dev,
@@ -5176,6 +5237,8 @@ void netdev_adjacent_rename_links(struct net_device *dev, char *oldname)
         }
 
         list_for_each_entry(iter, &dev->adj_list.lower, list) {
+                if (!net_eq(net,dev_net(iter->dev)))
+                        continue;
                 netdev_adjacent_sysfs_del(iter->dev, oldname,
                                           &iter->dev->adj_list.upper);
                 netdev_adjacent_sysfs_add(iter->dev, dev,
@@ -6778,6 +6841,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
 
         /* Send a netdev-removed uevent to the old namespace */
         kobject_uevent(&dev->dev.kobj, KOBJ_REMOVE);
+        netdev_adjacent_del_links(dev);
 
         /* Actually switch the network namespace */
         dev_net_set(dev, net);
@@ -6792,6 +6856,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
 
         /* Send a netdev-add uevent to the new namespace */
         kobject_uevent(&dev->dev.kobj, KOBJ_ADD);
+        netdev_adjacent_add_links(dev);
 
         /* Fixup kobjects */
         err = device_rename(&dev->dev, dev->name);
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 6b5b6e7013ca..9d33dfffca19 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -197,7 +197,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats
  * as destination. A new timer with the interval specified in the
  * configuration TLV is created. Upon each interval, the latest statistics
  * will be read from &bstats and the estimated rate will be stored in
- * &rate_est with the statistics lock grabed during this period.
+ * &rate_est with the statistics lock grabbed during this period.
  *
  * Returns 0 on success or a negative error code.
  *
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 9d3d9e78397b..2ddbce4cce14 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -206,7 +206,7 @@ EXPORT_SYMBOL(gnet_stats_copy_queue);
  * @st: application specific statistics data
  * @len: length of data
  *
- * Appends the application sepecific statistics to the top level TLV created by
+ * Appends the application specific statistics to the top level TLV created by
  * gnet_stats_start_copy() and remembers the data for XSTATS if the dumping
  * handle is in backward compatibility mode.
  *
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a936a401564e..a18dfb02d944 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2647,7 +2647,7 @@ EXPORT_SYMBOL(skb_prepare_seq_read);
  * skb_seq_read() will return the remaining part of the block.
  *
  * Note 1: The size of each block of data returned can be arbitrary,
- *       this limitation is the cost for zerocopy seqeuental
+ *       this limitation is the cost for zerocopy sequential
  *       reads of potentially non linear data.
  *
  * Note 2: Fragment lists within fragments are not implemented
@@ -2781,7 +2781,7 @@ EXPORT_SYMBOL(skb_find_text);
 /**
  * skb_append_datato_frags - append the user data to a skb
  * @sk: sock  structure
- * @skb: skb structure to be appened with user data.
+ * @skb: skb structure to be appended with user data.
  * @getfrag: call back function to be used for getting the user data
  * @from: pointer to user message iov
  * @length: length of the iov message
diff --git a/net/core/sock.c b/net/core/sock.c
index 69592cb66e3b..6f436b5e4961 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -166,7 +166,7 @@ EXPORT_SYMBOL(sk_ns_capable);
 /**
  * sk_capable - Socket global capability test
  * @sk: Socket to use a capability on or through
- * @cap: The global capbility to use
+ * @cap: The global capability to use
  *
  * Test to see if the opener of the socket had when the socket was
  * created and the current process has the capability @cap in all user
@@ -183,7 +183,7 @@ EXPORT_SYMBOL(sk_capable);
  * @sk: Socket to use a capability on or through
  * @cap: The capability to use
  *
- * Test to see if the opener of the socket had when the socke was created
+ * Test to see if the opener of the socket had when the socket was created
  * and the current process has the capability @cap over the network namespace
  * the socket is a member of.
  */
@@ -1820,6 +1820,9 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                                                            order);
                                         if (page)
                                                 goto fill_page;
+                                        /* Do not retry other high order allocations */
+                                        order = 1;
+                                        max_page_order = 0;
                                 }
                                 order--;
                         }
@@ -1867,10 +1870,8 @@ EXPORT_SYMBOL(sock_alloc_send_skb);
  * no guarantee that allocations succeed. Therefore, @sz MUST be
  * less or equal than PAGE_SIZE.
  */
-bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
+bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t gfp)
 {
-        int order;
-
         if (pfrag->page) {
                 if (atomic_read(&pfrag->page->_count) == 1) {
                         pfrag->offset = 0;
@@ -1881,20 +1882,21 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
                 put_page(pfrag->page);
         }
 
-        order = SKB_FRAG_PAGE_ORDER;
-        do {
-                gfp_t gfp = prio;
-
-                if (order)
-                        gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
-                pfrag->page = alloc_pages(gfp, order);
+        pfrag->offset = 0;
+        if (SKB_FRAG_PAGE_ORDER) {
+                pfrag->page = alloc_pages(gfp | __GFP_COMP |
+                                          __GFP_NOWARN | __GFP_NORETRY,
+                                          SKB_FRAG_PAGE_ORDER);
                 if (likely(pfrag->page)) {
-                        pfrag->offset = 0;
-                        pfrag->size = PAGE_SIZE << order;
+                        pfrag->size = PAGE_SIZE << SKB_FRAG_PAGE_ORDER;
                         return true;
                 }
-        } while (--order >= 0);
-
+        }
+        pfrag->page = alloc_page(gfp);
+        if (likely(pfrag->page)) {
+                pfrag->size = PAGE_SIZE;
+                return true;
+        }
         return false;
 }
 EXPORT_SYMBOL(skb_page_frag_refill);
diff --git a/net/ieee802154/6lowpan_rtnl.c b/net/ieee802154/6lowpan_rtnl.c
index 016b77ee88f0..6591d27e53a4 100644
--- a/net/ieee802154/6lowpan_rtnl.c
+++ b/net/ieee802154/6lowpan_rtnl.c
@@ -246,7 +246,7 @@ lowpan_alloc_frag(struct sk_buff *skb, int size,
                         return ERR_PTR(-rc);
                 }
         } else {
-                frag = ERR_PTR(ENOMEM);
+                frag = ERR_PTR(-ENOMEM);
         }
 
         return frag;
@@ -437,7 +437,7 @@ static void lowpan_setup(struct net_device *dev)
         /* Frame Control + Sequence Number + Address fields + Security Header */
         dev->hard_header_len    = 2 + 1 + 20 + 14;
         dev->needed_tailroom    = 2; /* FCS */
-        dev->mtu                = 1281;
+        dev->mtu                = IPV6_MIN_MTU;
         dev->tx_queue_len       = 0;
         dev->flags              = IFF_BROADCAST | IFF_MULTICAST;
         dev->watchdog_timeo     = 0;
diff --git a/net/ieee802154/reassembly.c b/net/ieee802154/reassembly.c
index ffec6ce51005..32755cb7e64e 100644
--- a/net/ieee802154/reassembly.c
+++ b/net/ieee802154/reassembly.c
@@ -355,8 +355,6 @@ int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type)
         struct net *net = dev_net(skb->dev);
         struct lowpan_frag_info *frag_info = lowpan_cb(skb);
         struct ieee802154_addr source, dest;
-        struct netns_ieee802154_lowpan *ieee802154_lowpan =
-                net_ieee802154_lowpan(net);
         int err;
 
         source = mac_cb(skb)->source;
@@ -366,8 +364,10 @@ int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type)
         if (err < 0)
                 goto err;
 
-        if (frag_info->d_size > ieee802154_lowpan->max_dsize)
+        if (frag_info->d_size > IPV6_MIN_MTU) {
+                net_warn_ratelimited("lowpan_frag_rcv: datagram size exceeds MTU\n");
                 goto err;
+        }
 
         fq = fq_find(net, frag_info, &source, &dest);
         if (fq != NULL) {
@@ -415,13 +415,6 @@ static struct ctl_table lowpan_frags_ns_ctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .procname       = "6lowpanfrag_max_datagram_size",
-                .data           = &init_net.ieee802154_lowpan.max_dsize,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
         { }
 };
 
@@ -458,7 +451,6 @@ static int __net_init lowpan_frags_ns_sysctl_register(struct net *net)
                 table[1].data = &ieee802154_lowpan->frags.low_thresh;
                 table[1].extra2 = &ieee802154_lowpan->frags.high_thresh;
                 table[2].data = &ieee802154_lowpan->frags.timeout;
-                table[3].data = &ieee802154_lowpan->max_dsize;
 
                 /* Don't export sysctls to unprivileged users */
                 if (net->user_ns != &init_user_ns)
@@ -533,7 +525,6 @@ static int __net_init lowpan_frags_init_net(struct net *net)
         ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
         ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH;
         ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT;
-        ieee802154_lowpan->max_dsize = 0xFFFF;
 
         inet_frags_init_net(&ieee802154_lowpan->frags);
 
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index fb173126f03d..7cbcaf4f0194 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -82,6 +82,52 @@ config NF_TABLES_ARP
         help
           This option enables the ARP support for nf_tables.
 
+config NF_NAT_IPV4
+        tristate "IPv4 NAT"
+        depends on NF_CONNTRACK_IPV4
+        default m if NETFILTER_ADVANCED=n
+        select NF_NAT
+        help
+          The IPv4 NAT option allows masquerading, port forwarding and other
+          forms of full Network Address Port Translation. This can be
+          controlled by iptables or nft.
+
+if NF_NAT_IPV4
+
+config NF_NAT_SNMP_BASIC
+        tristate "Basic SNMP-ALG support"
+        depends on NF_CONNTRACK_SNMP
+        depends on NETFILTER_ADVANCED
+        default NF_NAT && NF_CONNTRACK_SNMP
+        ---help---
+
+          This module implements an Application Layer Gateway (ALG) for
+          SNMP payloads.  In conjunction with NAT, it allows a network
+          management system to access multiple private networks with
+          conflicting addresses.  It works by modifying IP addresses
+          inside SNMP payloads to match IP-layer NAT mapping.
+
+          This is the "basic" form of SNMP-ALG, as described in RFC 2962
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
+config NF_NAT_PROTO_GRE
+        tristate
+        depends on NF_CT_PROTO_GRE
+
+config NF_NAT_PPTP
+        tristate
+        depends on NF_CONNTRACK
+        default NF_CONNTRACK_PPTP
+        select NF_NAT_PROTO_GRE
+
+config NF_NAT_H323
+        tristate
+        depends on NF_CONNTRACK
+        default NF_CONNTRACK_H323
+
+endif # NF_NAT_IPV4
+
 config IP_NF_IPTABLES
         tristate "IP tables support (required for filtering/masq/NAT)"
         default m if NETFILTER_ADVANCED=n
@@ -170,19 +216,21 @@ config IP_NF_TARGET_SYNPROXY
           To compile it as a module, choose M here. If unsure, say N.
 
 # NAT + specific targets: nf_conntrack
-config NF_NAT_IPV4
-        tristate "IPv4 NAT"
+config IP_NF_NAT
+        tristate "iptables NAT support"
         depends on NF_CONNTRACK_IPV4
         default m if NETFILTER_ADVANCED=n
         select NF_NAT
+        select NF_NAT_IPV4
+        select NETFILTER_XT_NAT
         help
-          The IPv4 NAT option allows masquerading, port forwarding and other
-          forms of full Network Address Port Translation.  It is controlled by
-          the `nat' table in iptables: see the man page for iptables(8).
+          This enables the `nat' table in iptables. This allows masquerading,
+          port forwarding and other forms of full Network Address Port
+          Translation.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-if NF_NAT_IPV4
+if IP_NF_NAT
 
 config IP_NF_TARGET_MASQUERADE
         tristate "MASQUERADE target support"
@@ -214,47 +262,7 @@ config IP_NF_TARGET_REDIRECT
         (e.g. when running oldconfig). It selects
         CONFIG_NETFILTER_XT_TARGET_REDIRECT.
 
-endif
-
-config NF_NAT_SNMP_BASIC
-        tristate "Basic SNMP-ALG support"
-        depends on NF_CONNTRACK_SNMP && NF_NAT_IPV4
-        depends on NETFILTER_ADVANCED
-        default NF_NAT && NF_CONNTRACK_SNMP
-        ---help---
-
-          This module implements an Application Layer Gateway (ALG) for
-          SNMP payloads.  In conjunction with NAT, it allows a network
-          management system to access multiple private networks with
-          conflicting addresses.  It works by modifying IP addresses
-          inside SNMP payloads to match IP-layer NAT mapping.
-
-          This is the "basic" form of SNMP-ALG, as described in RFC 2962
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
-# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
-# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
-# From kconfig-language.txt:
-#
-#           <expr> '&&' <expr>                   (6)
-#
-# (6) Returns the result of min(/expr/, /expr/).
-
-config NF_NAT_PROTO_GRE
-        tristate
-        depends on NF_NAT_IPV4 && NF_CT_PROTO_GRE
-
-config NF_NAT_PPTP
-        tristate
-        depends on NF_CONNTRACK && NF_NAT_IPV4
-        default NF_NAT_IPV4 && NF_CONNTRACK_PPTP
-        select NF_NAT_PROTO_GRE
-
-config NF_NAT_H323
-        tristate
-        depends on NF_CONNTRACK && NF_NAT_IPV4
-        default NF_NAT_IPV4 && NF_CONNTRACK_H323
+endif # IP_NF_NAT
 
 # mangle + specific targets
 config IP_NF_MANGLE
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 33001621465b..edf4af32e9f2 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -43,7 +43,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 # the three instances of ip_tables
 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
-obj-$(CONFIG_NF_NAT_IPV4) += iptable_nat.o
+obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
 obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 267ce3caee24..ad4598fcc416 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1690,14 +1690,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
         addrconf_mod_dad_work(ifp, 0);
 }
 
-/* Join to solicited addr multicast group. */
-
+/* Join to solicited addr multicast group.
+ * caller must hold RTNL */
 void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
 {
         struct in6_addr maddr;
 
-        ASSERT_RTNL();
-
         if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
                 return;
 
@@ -1705,12 +1703,11 @@ void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
         ipv6_dev_mc_inc(dev, &maddr);
 }
 
+/* caller must hold RTNL */
 void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 {
         struct in6_addr maddr;
 
-        ASSERT_RTNL();
-
         if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
                 return;
 
@@ -1718,12 +1715,11 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
         __ipv6_dev_mc_dec(idev, &maddr);
 }
 
+/* caller must hold RTNL */
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 {
         struct in6_addr addr;
 
-        ASSERT_RTNL();
-
         if (ifp->prefix_len >= 127) /* RFC 6164 */
                 return;
         ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -1732,12 +1728,11 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
         ipv6_dev_ac_inc(ifp->idev->dev, &addr);
 }
 
+/* caller must hold RTNL */
 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
 {
         struct in6_addr addr;
 
-        ASSERT_RTNL();
-
         if (ifp->prefix_len >= 127) /* RFC 6164 */
                 return;
         ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -4773,15 +4768,11 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
                 if (!ipv6_addr_any(&ifp->peer_addr)) {
                         struct rt6_info *rt;
-                        struct net_device *dev = ifp->idev->dev;
-
-                        rt = rt6_lookup(dev_net(dev), &ifp->peer_addr, NULL,
-                                        dev->ifindex, 1);
-                        if (rt) {
-                                dst_hold(&rt->dst);
-                                if (ip6_del_rt(rt))
-                                        dst_free(&rt->dst);
-                        }
+
+                        rt = addrconf_get_prefix_route(&ifp->peer_addr, 128,
+                                                       ifp->idev->dev, 0, 0);
+                        if (rt && ip6_del_rt(rt))
+                                dst_free(&rt->dst);
                 }
                 dst_hold(&ifp->rt->dst);
 
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 210183244689..ff2de7d9d8e6 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -77,6 +77,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         pac->acl_next = NULL;
         pac->acl_addr = *addr;
 
+        rtnl_lock();
         rcu_read_lock();
         if (ifindex == 0) {
                 struct rt6_info *rt;
@@ -137,6 +138,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 
 error:
         rcu_read_unlock();
+        rtnl_unlock();
         if (pac)
                 sock_kfree_s(sk, pac, sizeof(*pac));
         return err;
@@ -171,11 +173,13 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 
         spin_unlock_bh(&ipv6_sk_ac_lock);
 
+        rtnl_lock();
         rcu_read_lock();
         dev = dev_get_by_index_rcu(net, pac->acl_ifindex);
         if (dev)
                 ipv6_dev_ac_dec(dev, &pac->acl_addr);
         rcu_read_unlock();
+        rtnl_unlock();
 
         sock_kfree_s(sk, pac, sizeof(*pac));
         return 0;
@@ -198,6 +202,7 @@ void ipv6_sock_ac_close(struct sock *sk)
         spin_unlock_bh(&ipv6_sk_ac_lock);
 
         prev_index = 0;
+        rtnl_lock();
         rcu_read_lock();
         while (pac) {
                 struct ipv6_ac_socklist *next = pac->acl_next;
@@ -212,6 +217,7 @@ void ipv6_sock_ac_close(struct sock *sk)
                 pac = next;
         }
         rcu_read_unlock();
+        rtnl_unlock();
 }
 
 static void aca_put(struct ifacaddr6 *ac)
@@ -233,6 +239,8 @@ int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr)
         struct rt6_info *rt;
         int err;
 
+        ASSERT_RTNL();
+
         idev = in6_dev_get(dev);
 
         if (idev == NULL)
@@ -302,6 +310,8 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr)
 {
         struct ifacaddr6 *aca, *prev_aca;
 
+        ASSERT_RTNL();
+
         write_lock_bh(&idev->lock);
         prev_aca = NULL;
         for (aca = idev->ac_list; aca; aca = aca->aca_next) {
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 64919425f1ab..6833dd07b2c2 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -173,6 +173,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         mc_lst->next = NULL;
         mc_lst->addr = *addr;
 
+        rtnl_lock();
         rcu_read_lock();
         if (ifindex == 0) {
                 struct rt6_info *rt;
@@ -186,6 +187,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 
         if (dev == NULL) {
                 rcu_read_unlock();
+                rtnl_unlock();
                 sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
                 return -ENODEV;
         }
@@ -203,6 +205,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 
         if (err) {
                 rcu_read_unlock();
+                rtnl_unlock();
                 sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
                 return err;
         }
@@ -213,6 +216,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         spin_unlock(&ipv6_sk_mc_lock);
 
         rcu_read_unlock();
+        rtnl_unlock();
 
         return 0;
 }
@@ -230,6 +234,7 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
         if (!ipv6_addr_is_multicast(addr))
                 return -EINVAL;
 
+        rtnl_lock();
         spin_lock(&ipv6_sk_mc_lock);
         for (lnk = &np->ipv6_mc_list;
              (mc_lst = rcu_dereference_protected(*lnk,
@@ -253,12 +258,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
                         } else
                                 (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                         rcu_read_unlock();
+                        rtnl_unlock();
+
                         atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
                         kfree_rcu(mc_lst, rcu);
                         return 0;
                 }
         }
         spin_unlock(&ipv6_sk_mc_lock);
+        rtnl_unlock();
 
         return -EADDRNOTAVAIL;
 }
@@ -303,6 +311,7 @@ void ipv6_sock_mc_close(struct sock *sk)
         if (!rcu_access_pointer(np->ipv6_mc_list))
                 return;
 
+        rtnl_lock();
         spin_lock(&ipv6_sk_mc_lock);
         while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list,
                                 lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) {
@@ -329,6 +338,7 @@ void ipv6_sock_mc_close(struct sock *sk)
                 spin_lock(&ipv6_sk_mc_lock);
         }
         spin_unlock(&ipv6_sk_mc_lock);
+        rtnl_unlock();
 }
 
 int ip6_mc_source(int add, int omode, struct sock *sk,
@@ -846,6 +856,8 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
         struct ifmcaddr6 *mc;
         struct inet6_dev *idev;
 
+        ASSERT_RTNL();
+
         /* we need to take a reference on idev */
         idev = in6_dev_get(dev);
 
@@ -917,6 +929,8 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
 {
         struct ifmcaddr6 *ma, **map;
 
+        ASSERT_RTNL();
+
         write_lock_bh(&idev->lock);
         for (map = &idev->mc_list; (ma = *map) != NULL; map = &ma->next) {
                 if (ipv6_addr_equal(&ma->mca_addr, addr)) {
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index ac93df16f5af..2812816aabdc 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -57,9 +57,19 @@ config NFT_REJECT_IPV6
 
 config NF_LOG_IPV6
         tristate "IPv6 packet logging"
-        depends on NETFILTER_ADVANCED
+        default m if NETFILTER_ADVANCED=n
         select NF_LOG_COMMON
 
+config NF_NAT_IPV6
+        tristate "IPv6 NAT"
+        depends on NF_CONNTRACK_IPV6
+        depends on NETFILTER_ADVANCED
+        select NF_NAT
+        help
+          The IPv6 NAT option allows masquerading, port forwarding and other
+          forms of full Network Address Port Translation. This can be
+          controlled by iptables or nft.
+
 config IP6_NF_IPTABLES
         tristate "IP6 tables support (required for filtering)"
         depends on INET && IPV6
@@ -232,19 +242,21 @@ config IP6_NF_SECURITY
 
          If unsure, say N.
 
-config NF_NAT_IPV6
-        tristate "IPv6 NAT"
+config IP6_NF_NAT
+        tristate "ip6tables NAT support"
         depends on NF_CONNTRACK_IPV6
         depends on NETFILTER_ADVANCED
         select NF_NAT
+        select NF_NAT_IPV6
+        select NETFILTER_XT_NAT
         help
-          The IPv6 NAT option allows masquerading, port forwarding and other
-          forms of full Network Address Port Translation. It is controlled by
-          the `nat' table in ip6tables, see the man page for ip6tables(8).
+          This enables the `nat' table in ip6tables. This allows masquerading,
+          port forwarding and other forms of full Network Address Port
+          Translation.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-if NF_NAT_IPV6
+if IP6_NF_NAT
 
 config IP6_NF_TARGET_MASQUERADE
         tristate "MASQUERADE target support"
@@ -265,7 +277,7 @@ config IP6_NF_TARGET_NPT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-endif # NF_NAT_IPV6
+endif # IP6_NF_NAT
 
 endif # IP6_NF_IPTABLES
 
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index c0b263104ed2..c3d3286db4bb 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -8,7 +8,7 @@ obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
-obj-$(CONFIG_NF_NAT_IPV6) += ip6table_nat.o
+obj-$(CONFIG_IP6_NF_NAT) += ip6table_nat.o
 
 # objects for l3 independent conntrack
 nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 13752d96275e..b704a9356208 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -755,7 +755,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         /* If PMTU discovery was enabled, use the MTU that was discovered */
         dst = sk_dst_get(tunnel->sock);
         if (dst != NULL) {
-                u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
+                u32 pmtu = dst_mtu(dst);
+
                 if (pmtu != 0)
                         session->mtu = session->mru = pmtu -
                                 PPPOL2TP_HEADER_OVERHEAD;
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 0375009ddc0d..399ad82c997f 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -541,6 +541,8 @@ static void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
                         continue;
                 if (rcu_access_pointer(sdata->vif.chanctx_conf) != conf)
                         continue;
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        continue;
 
                 if (!compat)
                         compat = &sdata->vif.bss_conf.chandef;
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 3db96648b45a..86173c0de40e 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -167,7 +167,7 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
                         sta->ampdu_mlme.dialog_token_allocator + 1);
         p += scnprintf(p, sizeof(buf) + buf - p,
-                       "TID\t\tRX active\tDTKN\tSSN\t\tTX\tDTKN\tpending\n");
+                       "TID\t\tRX\tDTKN\tSSN\t\tTX\tDTKN\tpending\n");
 
         for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
                 tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[i]);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 01eede7406a5..f75e5f132c5a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1175,8 +1175,8 @@ static void ieee80211_iface_work(struct work_struct *work)
                         if (sta) {
                                 u16 last_seq;
 
-                                last_seq = le16_to_cpu(
-                                        sta->last_seq_ctrl[rx_agg->tid]);
+                                last_seq = IEEE80211_SEQ_TO_SN(le16_to_cpu(
+                                        sta->last_seq_ctrl[rx_agg->tid]));
 
                                 __ieee80211_start_rx_ba_session(sta,
                                                 0, 0,
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 63b874101b27..c47194d27149 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -959,7 +959,8 @@ mesh_plink_get_event(struct ieee80211_sub_if_data *sdata,
                 if (!matches_local)
                         event = CNF_RJCT;
                 if (!mesh_plink_free_count(sdata) ||
-                    (sta->llid != llid || sta->plid != plid))
+                    sta->llid != llid ||
+                    (sta->plid && sta->plid != plid))
                         event = CNF_IGNR;
                 else
                         event = CNF_ACPT;
@@ -1080,6 +1081,10 @@ mesh_process_plink_frame(struct ieee80211_sub_if_data *sdata,
                 goto unlock_rcu;
         }
 
+        /* 802.11-2012 13.3.7.2 - update plid on CNF if not set */
+        if (!sta->plid && event == CNF_ACPT)
+                sta->plid = plid;
+
         changed |= mesh_plink_fsm(sdata, sta, event);
 
 unlock_rcu:
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 31a8afaf7332..b82a12a9f0f1 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -4376,8 +4376,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 
         if (bss->wmm_used && bss->uapsd_supported &&
-            (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD) &&
-            sdata->wmm_acm != 0xff) {
+            (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
                 assoc_data->uapsd = true;
                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
         } else {
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c6ee2139fbc5..441875f03750 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1094,8 +1094,11 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         unsigned long flags;
         struct ps_data *ps;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP ||
-            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
+                                     u.ap);
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP)
                 ps = &sdata->bss->ps;
         else if (ieee80211_vif_is_mesh(&sdata->vif))
                 ps = &sdata->u.mesh.ps;
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index 3c3069fd6971..547838822d5e 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -462,7 +462,10 @@ mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb,
                         skb->pkt_type = PACKET_OTHERHOST;
                 break;
         default:
-                break;
+                spin_unlock_bh(&sdata->mib_lock);
+                pr_debug("invalid dest mode\n");
+                kfree_skb(skb);
+                return NET_RX_DROP;
         }
 
         spin_unlock_bh(&sdata->mib_lock);
@@ -573,6 +576,7 @@ void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)
         ret = mac802154_parse_frame_start(skb, &hdr);
         if (ret) {
                 pr_debug("got invalid frame\n");
+                kfree_skb(skb);
                 return;
         }
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index ad751fe2e82b..b5c1d3aadb41 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -499,7 +499,7 @@ config NFT_LIMIT
 config NFT_NAT
         depends on NF_TABLES
         depends on NF_CONNTRACK
-        depends on NF_NAT
+        select NF_NAT
         tristate "Netfilter nf_tables nat module"
         help
           This option adds the "nat" expression that you can use to perform
@@ -747,7 +747,9 @@ config NETFILTER_XT_TARGET_LED
 
 config NETFILTER_XT_TARGET_LOG
         tristate "LOG target support"
-        depends on NF_LOG_IPV4 && NF_LOG_IPV6
+        select NF_LOG_COMMON
+        select NF_LOG_IPV4
+        select NF_LOG_IPV6 if IPV6
         default m if NETFILTER_ADVANCED=n
         help
           This option adds a `LOG' target, which allows you to create rules in
@@ -764,6 +766,14 @@ config NETFILTER_XT_TARGET_MARK
         (e.g. when running oldconfig). It selects
         CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
 
+config NETFILTER_XT_NAT
+        tristate '"SNAT and DNAT" targets support'
+        depends on NF_NAT
+        ---help---
+        This option enables the SNAT and DNAT targets.
+
+        To compile it as a module, choose M here. If unsure, say N.
+
 config NETFILTER_XT_TARGET_NETMAP
         tristate '"NETMAP" target support'
         depends on NF_NAT
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 8308624a406a..fad5fdba34e5 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -95,7 +95,7 @@ obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
 obj-$(CONFIG_NETFILTER_XT_MARK) += xt_mark.o
 obj-$(CONFIG_NETFILTER_XT_CONNMARK) += xt_connmark.o
 obj-$(CONFIG_NETFILTER_XT_SET) += xt_set.o
-obj-$(CONFIG_NF_NAT) += xt_nat.o
+obj-$(CONFIG_NETFILTER_XT_NAT) += xt_nat.o
 
 # targets
 obj-$(CONFIG_NETFILTER_XT_TARGET_AUDIT) += xt_AUDIT.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index a93c97f106d4..024a2e25c8a4 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -54,7 +54,7 @@ EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
 struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;
 EXPORT_SYMBOL(nf_hooks);
 
-#if defined(CONFIG_JUMP_LABEL)
+#ifdef HAVE_JUMP_LABEL
 struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
 EXPORT_SYMBOL(nf_hooks_needed);
 #endif
@@ -72,7 +72,7 @@ int nf_register_hook(struct nf_hook_ops *reg)
         }
         list_add_rcu(&reg->list, elem->list.prev);
         mutex_unlock(&nf_hook_mutex);
-#if defined(CONFIG_JUMP_LABEL)
+#ifdef HAVE_JUMP_LABEL
         static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
 #endif
         return 0;
@@ -84,7 +84,7 @@ void nf_unregister_hook(struct nf_hook_ops *reg)
         mutex_lock(&nf_hook_mutex);
         list_del_rcu(&reg->list);
         mutex_unlock(&nf_hook_mutex);
-#if defined(CONFIG_JUMP_LABEL)
+#ifdef HAVE_JUMP_LABEL
         static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
 #endif
         synchronize_net();
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index e6836755c45d..5c34e8d42e01 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1906,7 +1906,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
         {
                 .hook           = ip_vs_local_reply6,
                 .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP6_PRI_NAT_DST + 1,
         },
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 6f70bdd3a90a..56896a412bce 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -38,6 +38,7 @@
 #include <net/route.h>                  /* for ip_route_output */
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
+#include <net/ip_tunnels.h>
 #include <net/addrconf.h>
 #include <linux/icmpv6.h>
 #include <linux/netfilter.h>
@@ -862,11 +863,15 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                 old_iph = ip_hdr(skb);
         }
 
-        skb->transport_header = skb->network_header;
-
         /* fix old IP header checksum */
         ip_send_check(old_iph);
 
+        skb = iptunnel_handle_offloads(skb, false, SKB_GSO_IPIP);
+        if (IS_ERR(skb))
+                goto tx_error;
+
+        skb->transport_header = skb->network_header;
+
         skb_push(skb, sizeof(struct iphdr));
         skb_reset_network_header(skb);
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
@@ -900,7 +905,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         return NF_STOLEN;
 
   tx_error:
-        kfree_skb(skb);
+        if (!IS_ERR(skb))
+                kfree_skb(skb);
         rcu_read_unlock();
         LeaveFunction(10);
         return NF_STOLEN;
@@ -953,6 +959,11 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
                 old_iph = ipv6_hdr(skb);
         }
 
+        /* GSO: we need to provide proper SKB_GSO_ value for IPv6 */
+        skb = iptunnel_handle_offloads(skb, false, 0); /* SKB_GSO_SIT/IPV6 */
+        if (IS_ERR(skb))
+                goto tx_error;
+
         skb->transport_header = skb->network_header;
 
         skb_push(skb, sizeof(struct ipv6hdr));
@@ -988,7 +999,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         return NF_STOLEN;
 
 tx_error:
-        kfree_skb(skb);
+        if (!IS_ERR(skb))
+                kfree_skb(skb);
         rcu_read_unlock();
         LeaveFunction(10);
         return NF_STOLEN;
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index f4e833005320..7198d660b4de 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -31,7 +31,7 @@ static int cgroup_mt_check(const struct xt_mtchk_param *par)
         if (info->invert & ~1)
                 return -EINVAL;
 
-        return info->id ? 0 : -EINVAL;
+        return 0;
 }
 
 static bool
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 7228ec3faf19..91d66b7e64ac 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -265,8 +265,11 @@ void ovs_dp_process_received_packet(struct vport *p, struct sk_buff *skb)
                 upcall.key = &key;
                 upcall.userdata = NULL;
                 upcall.portid = ovs_vport_find_upcall_portid(p, skb);
-                ovs_dp_upcall(dp, skb, &upcall);
-                consume_skb(skb);
+                error = ovs_dp_upcall(dp, skb, &upcall);
+                if (unlikely(error))
+                        kfree_skb(skb);
+                else
+                        consume_skb(skb);
                 stats_counter = &stats->n_missed;
                 goto out;
         }
@@ -404,7 +407,7 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
 {
         struct ovs_header *upcall;
         struct sk_buff *nskb = NULL;
-        struct sk_buff *user_skb; /* to be queued to userspace */
+        struct sk_buff *user_skb = NULL; /* to be queued to userspace */
         struct nlattr *nla;
         struct genl_info info = {
                 .dst_sk = ovs_dp_get_net(dp)->genl_sock,
@@ -494,9 +497,11 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
         ((struct nlmsghdr *) user_skb->data)->nlmsg_len = user_skb->len;
 
         err = genlmsg_unicast(ovs_dp_get_net(dp), user_skb, upcall_info->portid);
+        user_skb = NULL;
 out:
         if (err)
                 skb_tx_error(skb);
+        kfree_skb(user_skb);
         kfree_skb(nskb);
         return err;
 }
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index 14c98e48f261..02a86a27fd84 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -158,6 +158,7 @@ static const struct acpi_device_id rfkill_acpi_match[] = {
         { "BCM2E1A", RFKILL_TYPE_BLUETOOTH },
         { "BCM2E39", RFKILL_TYPE_BLUETOOTH },
         { "BCM2E3D", RFKILL_TYPE_BLUETOOTH },
+        { "BCM2E64", RFKILL_TYPE_BLUETOOTH },
         { "BCM4752", RFKILL_TYPE_GPS },
         { "LNV4752", RFKILL_TYPE_GPS },
         { },
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index eb71d49e7653..634a2abb5f3a 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4243,7 +4243,7 @@ static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
         transport = asoc->peer.primary_path;
 
         status.sstat_assoc_id = sctp_assoc2id(asoc);
-        status.sstat_state = asoc->state;
+        status.sstat_state = sctp_assoc_to_state(asoc);
         status.sstat_rwnd =  asoc->peer.rwnd;
         status.sstat_unackdata = asoc->unack_data;
 
diff --git a/net/socket.c b/net/socket.c
index 95ee7d8682e7..2e2586e2dee1 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -734,8 +734,7 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
         }
 
         memset(&tss, 0, sizeof(tss));
-        if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE ||
-             skb_shinfo(skb)->tx_flags & SKBTX_ANY_SW_TSTAMP) &&
+        if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
             ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
                 empty = 0;
         if (shhwtstamps &&
@@ -2602,7 +2601,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
  *
  *      This function is called by a protocol handler that wants to
  *      advertise its address family, and have it linked into the
- *      socket interface. The value ops->family coresponds to the
+ *      socket interface. The value ops->family corresponds to the
  *      socket system call protocol family.
  */
 int sock_register(const struct net_proto_family *ops)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 31a731e06f50..b385bcbbf2f5 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2133,7 +2133,7 @@ sub process {
 # Check for improperly formed commit descriptions
                 if ($in_commit_log &&
                     $line =~ /\bcommit\s+[0-9a-f]{5,}/i &&
-                    $line !~ /\b[Cc]ommit [0-9a-f]{12,16} \("/) {
+                    $line !~ /\b[Cc]ommit [0-9a-f]{12,40} \("/) {
                         $line =~ /\b(c)ommit\s+([0-9a-f]{5,})/i;
                         my $init_char = $1;
                         my $orig_commit = lc($2);
@@ -2141,7 +2141,7 @@ sub process {
                         my $desc = 'commit description';
                         ($id, $desc) = git_commit_info($orig_commit, $id, $desc);
                         ERROR("GIT_COMMIT_ID",
-                              "Please use 12 to 16 chars for the git commit ID like: '${init_char}ommit $id (\"$desc\")'\n" . $herecurr);
+                              "Please use 12 or more chars for the git commit ID like: '${init_char}ommit $id (\"$desc\")'\n" . $herecurr);
                 }
 
 # Check for added, moved or deleted files
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 16a07cfa4d34..70bea942b413 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -2085,6 +2085,7 @@ sub dump_function($$) {
     $prototype =~ s/^noinline +//;
     $prototype =~ s/__init +//;
     $prototype =~ s/__init_or_module +//;
+    $prototype =~ s/__meminit +//;
     $prototype =~ s/__must_check +//;
     $prototype =~ s/__weak +//;
     my $define = $prototype =~ s/^#\s*define\s+//; #ak added
diff --git a/security/keys/key.c b/security/keys/key.c
index b90a68c4e2c4..6d0cad16f002 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -27,8 +27,8 @@ DEFINE_SPINLOCK(key_serial_lock);
 struct rb_root  key_user_tree; /* tree of quota records indexed by UID */
 DEFINE_SPINLOCK(key_user_lock);
 
-unsigned int key_quota_root_maxkeys = 200;      /* root's key count quota */
-unsigned int key_quota_root_maxbytes = 20000;   /* root's key space quota */
+unsigned int key_quota_root_maxkeys = 1000000;  /* root's key count quota */
+unsigned int key_quota_root_maxbytes = 25000000; /* root's key space quota */
 unsigned int key_quota_maxkeys = 200;           /* general key count quota */
 unsigned int key_quota_maxbytes = 20000;        /* general key space quota */
 
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index a3386d119425..bed745c8b1a3 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -173,7 +173,7 @@ static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
                  * Use filesystem name if filesystem does not support rename()
                  * operation.
                  */
-                if (!inode->i_op->rename)
+                if (!inode->i_op->rename && !inode->i_op->rename2)
                         goto prepend_filesystem_name;
         }
         /* Prepend device name. */
@@ -282,7 +282,8 @@ char *tomoyo_realpath_from_path(struct path *path)
                  * Get local name for filesystems without rename() operation
                  * or dentry without vfsmount.
                  */
-                if (!path->mnt || !inode->i_op->rename)
+                if (!path->mnt ||
+                    (!inode->i_op->rename && !inode->i_op->rename2))
                         pos = tomoyo_get_local_path(path->dentry, buf,
                                                     buf_len - 1);
                 /* Get absolute name for the rest. */
diff --git a/sound/core/info.c b/sound/core/info.c
index 051d55b05521..9f404e965ea2 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -684,7 +684,7 @@ int snd_info_card_free(struct snd_card *card)
  * snd_info_get_line - read one line from the procfs buffer
  * @buffer: the procfs buffer
  * @line: the buffer to store
- * @len: the max. buffer size - 1
+ * @len: the max. buffer size
  *
  * Reads one line from the buffer and stores the string.
  *
@@ -704,7 +704,7 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
                         buffer->stop = 1;
                 if (c == '\n')
                         break;
-                if (len) {
+                if (len > 1) {
                         len--;
                         *line++ = c;
                 }
diff --git a/sound/core/pcm_misc.c b/sound/core/pcm_misc.c
index 4560ca0e5651..2c6fd80e0bd1 100644
--- a/sound/core/pcm_misc.c
+++ b/sound/core/pcm_misc.c
@@ -142,11 +142,11 @@ static struct pcm_format_data pcm_formats[(INT)SNDRV_PCM_FORMAT_LAST+1] = {
         },
         [SNDRV_PCM_FORMAT_DSD_U8] = {
                 .width = 8, .phys = 8, .le = 1, .signd = 0,
-                .silence = {},
+                .silence = { 0x69 },
         },
         [SNDRV_PCM_FORMAT_DSD_U16_LE] = {
                 .width = 16, .phys = 16, .le = 1, .signd = 0,
-                .silence = {},
+                .silence = { 0x69, 0x69 },
         },
         /* FIXME: the following three formats are not defined properly yet */
         [SNDRV_PCM_FORMAT_MPEG] = {
diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
index f96bf4c7c232..95fc2eaf11dc 100644
--- a/sound/firewire/amdtp.c
+++ b/sound/firewire/amdtp.c
@@ -507,7 +507,16 @@ static void amdtp_pull_midi(struct amdtp_stream *s,
 static void update_pcm_pointers(struct amdtp_stream *s,
                                 struct snd_pcm_substream *pcm,
                                 unsigned int frames)
-{       unsigned int ptr;
+{
+        unsigned int ptr;
+
+        /*
+         * In IEC 61883-6, one data block represents one event. In ALSA, one
+         * event equals to one PCM frame. But Dice has a quirk to transfer
+         * two PCM frames in one data block.
+         */
+        if (s->double_pcm_frames)
+                frames *= 2;
 
         ptr = s->pcm_buffer_pointer + frames;
         if (ptr >= pcm->runtime->buffer_size)
diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
index d8ee7b0e9386..4823c08196ac 100644
--- a/sound/firewire/amdtp.h
+++ b/sound/firewire/amdtp.h
@@ -125,6 +125,7 @@ struct amdtp_stream {
         unsigned int pcm_buffer_pointer;
         unsigned int pcm_period_pointer;
         bool pointer_flush;
+        bool double_pcm_frames;
 
         struct snd_rawmidi_substream *midi[AMDTP_MAX_CHANNELS_FOR_MIDI * 8];
 
diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
index a9a30c0161f1..e3a04d69c853 100644
--- a/sound/firewire/dice.c
+++ b/sound/firewire/dice.c
@@ -567,10 +567,14 @@ static int dice_hw_params(struct snd_pcm_substream *substream,
                 return err;
 
         /*
-         * At rates above 96 kHz, pretend that the stream runs at half the
-         * actual sample rate with twice the number of channels; two samples
-         * of a channel are stored consecutively in the packet. Requires
-         * blocking mode and PCM buffer size should be aligned to SYT_INTERVAL.
+         * At 176.4/192.0 kHz, Dice has a quirk to transfer two PCM frames in
+         * one data block of AMDTP packet. Thus sampling transfer frequency is
+         * a half of PCM sampling frequency, i.e. PCM frames at 192.0 kHz are
+         * transferred on AMDTP packets at 96 kHz. Two successive samples of a
+         * channel are stored consecutively in the packet. This quirk is called
+         * as 'Dual Wire'.
+         * For this quirk, blocking mode is required and PCM buffer size should
+         * be aligned to SYT_INTERVAL.
          */
         channels = params_channels(hw_params);
         if (rate_index > 4) {
@@ -579,18 +583,25 @@ static int dice_hw_params(struct snd_pcm_substream *substream,
                         return err;
                 }
 
-                for (i = 0; i < channels; i++) {
-                        dice->stream.pcm_positions[i * 2] = i;
-                        dice->stream.pcm_positions[i * 2 + 1] = i + channels;
-                }
-
                 rate /= 2;
                 channels *= 2;
+                dice->stream.double_pcm_frames = true;
+        } else {
+                dice->stream.double_pcm_frames = false;
         }
 
         mode = rate_index_to_mode(rate_index);
         amdtp_stream_set_parameters(&dice->stream, rate, channels,
                                     dice->rx_midi_ports[mode]);
+        if (rate_index > 4) {
+                channels /= 2;
+
+                for (i = 0; i < channels; i++) {
+                        dice->stream.pcm_positions[i] = i * 2;
+                        dice->stream.pcm_positions[i + channels] = i * 2 + 1;
+                }
+        }
+
         amdtp_stream_set_pcm_format(&dice->stream,
                                     params_format(hw_params));
 
diff --git a/sound/pci/ctxfi/ct20k1reg.h b/sound/pci/ctxfi/ct20k1reg.h
index f2e34e3f27ee..5851249f11d9 100644
--- a/sound/pci/ctxfi/ct20k1reg.h
+++ b/sound/pci/ctxfi/ct20k1reg.h
@@ -7,7 +7,7 @@
  */
 
 #ifndef CT20K1REG_H
-#define CT20k1REG_H
+#define CT20K1REG_H
 
 /* 20k1 registers */
 #define         DSPXRAM_START                   0x000000
@@ -632,5 +632,3 @@
 #define I2SD_R    0x19L
 
 #endif /* CT20K1REG_H */
-
-
diff --git a/sound/pci/hda/ca0132_regs.h b/sound/pci/hda/ca0132_regs.h
index 07e760937d3c..8371274aa811 100644
--- a/sound/pci/hda/ca0132_regs.h
+++ b/sound/pci/hda/ca0132_regs.h
@@ -20,7 +20,7 @@
  */
 
 #ifndef __CA0132_REGS_H
-#define __CA0312_REGS_H
+#define __CA0132_REGS_H
 
 #define DSP_CHIP_OFFSET                0x100000
 #define DSP_DBGCNTL_MODULE_OFFSET      0xE30
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 6f2fa838b635..6e5d0cb4e3d7 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -217,6 +217,7 @@ enum {
         CXT_FIXUP_HEADPHONE_MIC_PIN,
         CXT_FIXUP_HEADPHONE_MIC,
         CXT_FIXUP_GPIO1,
+        CXT_FIXUP_ASPIRE_DMIC,
         CXT_FIXUP_THINKPAD_ACPI,
         CXT_FIXUP_OLPC_XO,
         CXT_FIXUP_CAP_MIX_AMP,
@@ -664,6 +665,12 @@ static const struct hda_fixup cxt_fixups[] = {
                         { }
                 },
         },
+        [CXT_FIXUP_ASPIRE_DMIC] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = cxt_fixup_stereo_dmic,
+                .chained = true,
+                .chain_id = CXT_FIXUP_GPIO1,
+        },
         [CXT_FIXUP_THINKPAD_ACPI] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = hda_fixup_thinkpad_acpi,
@@ -744,7 +751,7 @@ static const struct hda_model_fixup cxt5051_fixup_models[] = {
 
 static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
-        SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_GPIO1),
+        SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
         SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
         SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d71270a3f73f..1ba22fb527c2 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -328,6 +328,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
                 case 0x10ec0885:
                 case 0x10ec0887:
                 /*case 0x10ec0889:*/ /* this causes an SPDIF problem */
+                case 0x10ec0900:
                         alc889_coef_init(codec);
                         break;
                 case 0x10ec0888:
@@ -2350,6 +2351,7 @@ static int patch_alc882(struct hda_codec *codec)
         switch (codec->vendor_id) {
         case 0x10ec0882:
         case 0x10ec0885:
+        case 0x10ec0900:
                 break;
         default:
                 /* ALC883 and variants */
@@ -4408,6 +4410,7 @@ enum {
         ALC292_FIXUP_TPT440_DOCK,
         ALC283_FIXUP_BXBT2807_MIC,
         ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
+        ALC282_FIXUP_ASPIRE_V5_PINS,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -4855,6 +4858,22 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained_before = true,
                 .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
         },
+        [ALC282_FIXUP_ASPIRE_V5_PINS] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x12, 0x90a60130 },
+                        { 0x14, 0x90170110 },
+                        { 0x17, 0x40000008 },
+                        { 0x18, 0x411111f0 },
+                        { 0x19, 0x411111f0 },
+                        { 0x1a, 0x411111f0 },
+                        { 0x1b, 0x411111f0 },
+                        { 0x1d, 0x40f89b2d },
+                        { 0x1e, 0x411111f0 },
+                        { 0x21, 0x0321101f },
+                        { },
+                },
+        },
 
 };
 
@@ -4866,6 +4885,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
         SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
         SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+        SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x05bd, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x05be, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
index a20b30ca52c0..98523209f739 100644
--- a/sound/soc/codecs/cs4265.c
+++ b/sound/soc/codecs/cs4265.c
@@ -282,10 +282,10 @@ static const struct cs4265_clk_para clk_map_table[] = {
 
         /*64k*/
         {8192000, 64000, 1, 0},
-        {1228800, 64000, 1, 1},
-        {1693440, 64000, 1, 2},
-        {2457600, 64000, 1, 3},
-        {3276800, 64000, 1, 4},
+        {12288000, 64000, 1, 1},
+        {16934400, 64000, 1, 2},
+        {24576000, 64000, 1, 3},
+        {32768000, 64000, 1, 4},
 
         /* 88.2k */
         {11289600, 88200, 1, 0},
@@ -435,10 +435,10 @@ static int cs4265_pcm_hw_params(struct snd_pcm_substream *substream,
         index = cs4265_get_clk_index(cs4265->sysclk, params_rate(params));
         if (index >= 0) {
                 snd_soc_update_bits(codec, CS4265_ADC_CTL,
-                        CS4265_ADC_FM, clk_map_table[index].fm_mode);
+                        CS4265_ADC_FM, clk_map_table[index].fm_mode << 6);
                 snd_soc_update_bits(codec, CS4265_MCLK_FREQ,
                         CS4265_MCLK_FREQ_MASK,
-                        clk_map_table[index].mclkdiv);
+                        clk_map_table[index].mclkdiv << 4);
 
         } else {
                 dev_err(codec->dev, "can't get correct mclk\n");
diff --git a/sound/soc/codecs/da732x.h b/sound/soc/codecs/da732x.h
index 1dceafeec415..f586cbd30b77 100644
--- a/sound/soc/codecs/da732x.h
+++ b/sound/soc/codecs/da732x.h
@@ -11,7 +11,7 @@
  */
 
 #ifndef __DA732X_H_
-#define __DA732X_H
+#define __DA732X_H_
 
 #include <sound/soc.h>
 
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index 6bc6efdec550..f1ec6e6bd08a 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -2059,6 +2059,7 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5640 = {
 static const struct regmap_config rt5640_regmap = {
         .reg_bits = 8,
         .val_bits = 16,
+        .use_single_rw = true,
 
         .max_register = RT5640_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5640_ranges) *
                                                RT5640_PR_SPACING),
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index 67f14556462f..5337c448b5e3 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -2135,10 +2135,10 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "BST2", NULL, "IN2P" },
         { "BST2", NULL, "IN2N" },
 
-        { "IN1P", NULL, "micbias1" },
-        { "IN1N", NULL, "micbias1" },
-        { "IN2P", NULL, "micbias1" },
-        { "IN2N", NULL, "micbias1" },
+        { "IN1P", NULL, "MICBIAS1" },
+        { "IN1N", NULL, "MICBIAS1" },
+        { "IN2P", NULL, "MICBIAS1" },
+        { "IN2N", NULL, "MICBIAS1" },
 
         { "ADC 1", NULL, "BST1" },
         { "ADC 1", NULL, "ADC 1 power" },
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 159e517fa09a..cef7776b712c 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -481,12 +481,19 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         snd_soc_card_set_drvdata(&priv->snd_card, priv);
 
         ret = devm_snd_soc_register_card(&pdev->dev, &priv->snd_card);
+        if (ret >= 0)
+                return ret;
 
 err:
         asoc_simple_card_unref(pdev);
         return ret;
 }
 
+static int asoc_simple_card_remove(struct platform_device *pdev)
+{
+        return asoc_simple_card_unref(pdev);
+}
+
 static const struct of_device_id asoc_simple_of_match[] = {
         { .compatible = "simple-audio-card", },
         {},
@@ -500,6 +507,7 @@ static struct platform_driver asoc_simple_card = {
                 .of_match_table = asoc_simple_of_match,
         },
         .probe = asoc_simple_card_probe,
+        .remove = asoc_simple_card_remove,
 };
 
 module_platform_driver(asoc_simple_card);
diff --git a/sound/soc/omap/omap-twl4030.c b/sound/soc/omap/omap-twl4030.c
index f8a6adc2d81c..4336d1831485 100644
--- a/sound/soc/omap/omap-twl4030.c
+++ b/sound/soc/omap/omap-twl4030.c
@@ -260,7 +260,7 @@ static struct snd_soc_dai_link omap_twl4030_dai_links[] = {
                 .stream_name = "TWL4030 Voice",
                 .cpu_dai_name = "omap-mcbsp.3",
                 .codec_dai_name = "twl4030-voice",
-                .platform_name = "omap-mcbsp.2",
+                .platform_name = "omap-mcbsp.3",
                 .codec_name = "twl4030-codec",
                 .dai_fmt = SND_SOC_DAIFMT_DSP_A | SND_SOC_DAIFMT_IB_NF |
                            SND_SOC_DAIFMT_CBM_CFM,
diff --git a/sound/soc/sh/rcar/gen.c b/sound/soc/sh/rcar/gen.c
index 3fdf3be7b99a..f95e7ab135e8 100644
--- a/sound/soc/sh/rcar/gen.c
+++ b/sound/soc/sh/rcar/gen.c
@@ -247,7 +247,7 @@ rsnd_gen2_dma_addr(struct rsnd_priv *priv,
         };
 
         /* it shouldn't happen */
-        if (use_dvc & !use_src)
+        if (use_dvc && !use_src)
                 dev_err(dev, "DVC is selected without SRC\n");
 
         /* use SSIU or SSI ? */
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index d4bfd4a9076f..889f4e3d35dc 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1325,7 +1325,7 @@ static int soc_post_component_init(struct snd_soc_pcm_runtime *rtd,
         device_initialize(rtd->dev);
         rtd->dev->parent = rtd->card->dev;
         rtd->dev->release = rtd_release;
-        rtd->dev->init_name = name;
+        dev_set_name(rtd->dev, "%s", name);
         dev_set_drvdata(rtd->dev, rtd);
         mutex_init(&rtd->pcm_mutex);
         INIT_LIST_HEAD(&rtd->dpcm[SNDRV_PCM_STREAM_PLAYBACK].be_clients);
diff --git a/sound/soc/tegra/tegra_asoc_utils.h b/sound/soc/tegra/tegra_asoc_utils.h
index 9577121ce971..ca8037634100 100644
--- a/sound/soc/tegra/tegra_asoc_utils.h
+++ b/sound/soc/tegra/tegra_asoc_utils.h
@@ -21,7 +21,7 @@
  */
 
 #ifndef __TEGRA_ASOC_UTILS_H__
-#define __TEGRA_ASOC_UTILS_H_
+#define __TEGRA_ASOC_UTILS_H__
 
 struct clk;
 struct device;
diff --git a/tools/testing/selftests/ipc/Makefile b/tools/testing/selftests/ipc/Makefile
index 5386fd7c43ae..74bbefdeaf4c 100644
--- a/tools/testing/selftests/ipc/Makefile
+++ b/tools/testing/selftests/ipc/Makefile
@@ -1,18 +1,18 @@
 uname_M := $(shell uname -m 2>/dev/null || echo not)
 ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/)
 ifeq ($(ARCH),i386)
-        ARCH := X86
+        ARCH := x86
         CFLAGS := -DCONFIG_X86_32 -D__i386__
 endif
 ifeq ($(ARCH),x86_64)
-        ARCH := X86
+        ARCH := x86
         CFLAGS := -DCONFIG_X86_64 -D__x86_64__
 endif
 
 CFLAGS += -I../../../../usr/include/
 
 all:
-ifeq ($(ARCH),X86)
+ifeq ($(ARCH),x86)
         gcc $(CFLAGS) msgque.c -o msgque_test
 else
         echo "Not an x86 target, can't build msgque selftest"
diff --git a/tools/testing/selftests/kcmp/Makefile b/tools/testing/selftests/kcmp/Makefile
index d7d6bbeeff2f..8aabd82db9e4 100644
--- a/tools/testing/selftests/kcmp/Makefile
+++ b/tools/testing/selftests/kcmp/Makefile
@@ -1,11 +1,11 @@
 uname_M := $(shell uname -m 2>/dev/null || echo not)
 ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/)
 ifeq ($(ARCH),i386)
-        ARCH := X86
+        ARCH := x86
         CFLAGS := -DCONFIG_X86_32 -D__i386__
 endif
 ifeq ($(ARCH),x86_64)
-        ARCH := X86
+        ARCH := x86
         CFLAGS := -DCONFIG_X86_64 -D__x86_64__
 endif
 
@@ -15,7 +15,7 @@ CFLAGS += -I../../../../usr/include/
 CFLAGS += -I../../../../arch/x86/include/
 
 all:
-ifeq ($(ARCH),X86)
+ifeq ($(ARCH),x86)
         gcc $(CFLAGS) kcmp_test.c -o kcmp_test
 else
         echo "Not an x86 target, can't build kcmp selftest"
diff --git a/tools/testing/selftests/memfd/Makefile b/tools/testing/selftests/memfd/Makefile
index 6816c491c5ff..ad4ab01cd28f 100644
--- a/tools/testing/selftests/memfd/Makefile
+++ b/tools/testing/selftests/memfd/Makefile
@@ -1,10 +1,10 @@
 uname_M := $(shell uname -m 2>/dev/null || echo not)
 ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/)
 ifeq ($(ARCH),i386)
-        ARCH := X86
+        ARCH := x86
 endif
 ifeq ($(ARCH),x86_64)
-        ARCH := X86
+        ARCH := x86
 endif
 
 CFLAGS += -D_FILE_OFFSET_BITS=64
@@ -14,20 +14,20 @@ CFLAGS += -I../../../../include/uapi/
 CFLAGS += -I../../../../include/
 
 all:
-ifeq ($(ARCH),X86)
+ifeq ($(ARCH),x86)
         gcc $(CFLAGS) memfd_test.c -o memfd_test
 else
         echo "Not an x86 target, can't build memfd selftest"
 endif
 
 run_tests: all
-ifeq ($(ARCH),X86)
+ifeq ($(ARCH),x86)
         gcc $(CFLAGS) memfd_test.c -o memfd_test
 endif
         @./memfd_test || echo "memfd_test: [FAIL]"
 
 build_fuse:
-ifeq ($(ARCH),X86)
+ifeq ($(ARCH),x86)
         gcc $(CFLAGS) fuse_mnt.c `pkg-config fuse --cflags --libs` -o fuse_mnt
         gcc $(CFLAGS) fuse_test.c -o fuse_test
 else
diff --git a/drivers/staging/usbip/userspace/.gitignore b/tools/usb/usbip/.gitignore
index 9aad9e30a8ba..9aad9e30a8ba 100644
--- a/drivers/staging/usbip/userspace/.gitignore
+++ b/tools/usb/usbip/.gitignore
diff --git a/drivers/staging/usbip/userspace/AUTHORS b/tools/usb/usbip/AUTHORS
index a27ea8d03aec..a27ea8d03aec 100644
--- a/drivers/staging/usbip/userspace/AUTHORS
+++ b/tools/usb/usbip/AUTHORS
diff --git a/drivers/staging/usbip/userspace/COPYING b/tools/usb/usbip/COPYING
index c5611e48a8e1..c5611e48a8e1 100644
--- a/drivers/staging/usbip/userspace/COPYING
+++ b/tools/usb/usbip/COPYING
diff --git a/drivers/staging/usbip/userspace/INSTALL b/tools/usb/usbip/INSTALL
index d3c5b40a9409..d3c5b40a9409 100644
--- a/drivers/staging/usbip/userspace/INSTALL
+++ b/tools/usb/usbip/INSTALL
diff --git a/drivers/staging/usbip/userspace/Makefile.am b/tools/usb/usbip/Makefile.am
index 66f8bf038c9f..66f8bf038c9f 100644
--- a/drivers/staging/usbip/userspace/Makefile.am
+++ b/tools/usb/usbip/Makefile.am
diff --git a/drivers/staging/usbip/userspace/README b/tools/usb/usbip/README
index 831f49fea3ce..831f49fea3ce 100644
--- a/drivers/staging/usbip/userspace/README
+++ b/tools/usb/usbip/README
diff --git a/drivers/staging/usbip/userspace/autogen.sh b/tools/usb/usbip/autogen.sh
index e1112d3fcbf6..e1112d3fcbf6 100755
--- a/drivers/staging/usbip/userspace/autogen.sh
+++ b/tools/usb/usbip/autogen.sh
diff --git a/drivers/staging/usbip/userspace/cleanup.sh b/tools/usb/usbip/cleanup.sh
index 955c3ccb729a..955c3ccb729a 100755
--- a/drivers/staging/usbip/userspace/cleanup.sh
+++ b/tools/usb/usbip/cleanup.sh
diff --git a/drivers/staging/usbip/userspace/configure.ac b/tools/usb/usbip/configure.ac
index 607d05c5ccfd..607d05c5ccfd 100644
--- a/drivers/staging/usbip/userspace/configure.ac
+++ b/tools/usb/usbip/configure.ac
diff --git a/drivers/staging/usbip/userspace/doc/usbip.8 b/tools/usb/usbip/doc/usbip.8
index a6097be25d28..a6097be25d28 100644
--- a/drivers/staging/usbip/userspace/doc/usbip.8
+++ b/tools/usb/usbip/doc/usbip.8
diff --git a/drivers/staging/usbip/userspace/doc/usbipd.8 b/tools/usb/usbip/doc/usbipd.8
index ac4635db3f03..ac4635db3f03 100644
--- a/drivers/staging/usbip/userspace/doc/usbipd.8
+++ b/tools/usb/usbip/doc/usbipd.8
diff --git a/drivers/staging/usbip/userspace/libsrc/Makefile.am b/tools/usb/usbip/libsrc/Makefile.am
index 7c8f8a4d54e4..7c8f8a4d54e4 100644
--- a/drivers/staging/usbip/userspace/libsrc/Makefile.am
+++ b/tools/usb/usbip/libsrc/Makefile.am
diff --git a/drivers/staging/usbip/userspace/libsrc/list.h b/tools/usb/usbip/libsrc/list.h
index 8d0c936e184f..8d0c936e184f 100644
--- a/drivers/staging/usbip/userspace/libsrc/list.h
+++ b/tools/usb/usbip/libsrc/list.h
diff --git a/drivers/staging/usbip/userspace/libsrc/names.c b/tools/usb/usbip/libsrc/names.c
index 81ff8522405c..81ff8522405c 100644
--- a/drivers/staging/usbip/userspace/libsrc/names.c
+++ b/tools/usb/usbip/libsrc/names.c
diff --git a/drivers/staging/usbip/userspace/libsrc/names.h b/tools/usb/usbip/libsrc/names.h
index 680926512de2..680926512de2 100644
--- a/drivers/staging/usbip/userspace/libsrc/names.h
+++ b/tools/usb/usbip/libsrc/names.h
diff --git a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.c b/tools/usb/usbip/libsrc/sysfs_utils.c
index 36ac88ece0b8..36ac88ece0b8 100644
--- a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.c
+++ b/tools/usb/usbip/libsrc/sysfs_utils.c
diff --git a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.h b/tools/usb/usbip/libsrc/sysfs_utils.h
index 32ac1d105d18..32ac1d105d18 100644
--- a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.h
+++ b/tools/usb/usbip/libsrc/sysfs_utils.h
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_common.c b/tools/usb/usbip/libsrc/usbip_common.c
index ac73710473de..ac73710473de 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_common.c
+++ b/tools/usb/usbip/libsrc/usbip_common.c
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_common.h b/tools/usb/usbip/libsrc/usbip_common.h
index 5a0e95edf4df..5a0e95edf4df 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_common.h
+++ b/tools/usb/usbip/libsrc/usbip_common.h
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c b/tools/usb/usbip/libsrc/usbip_host_driver.c
index bef08d5c44e8..bef08d5c44e8 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
+++ b/tools/usb/usbip/libsrc/usbip_host_driver.c
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.h b/tools/usb/usbip/libsrc/usbip_host_driver.h
index 2a31f855c616..2a31f855c616 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.h
+++ b/tools/usb/usbip/libsrc/usbip_host_driver.h
diff --git a/drivers/staging/usbip/userspace/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c
index ad9204773533..ad9204773533 100644
--- a/drivers/staging/usbip/userspace/libsrc/vhci_driver.c
+++ b/tools/usb/usbip/libsrc/vhci_driver.c
diff --git a/drivers/staging/usbip/userspace/libsrc/vhci_driver.h b/tools/usb/usbip/libsrc/vhci_driver.h
index fa2316cf2cac..fa2316cf2cac 100644
--- a/drivers/staging/usbip/userspace/libsrc/vhci_driver.h
+++ b/tools/usb/usbip/libsrc/vhci_driver.h
diff --git a/drivers/staging/usbip/userspace/src/Makefile.am b/tools/usb/usbip/src/Makefile.am
index e81a4ebadeff..e81a4ebadeff 100644
--- a/drivers/staging/usbip/userspace/src/Makefile.am
+++ b/tools/usb/usbip/src/Makefile.am
diff --git a/drivers/staging/usbip/userspace/src/usbip.c b/tools/usb/usbip/src/usbip.c
index d7599d943529..d7599d943529 100644
--- a/drivers/staging/usbip/userspace/src/usbip.c
+++ b/tools/usb/usbip/src/usbip.c
diff --git a/drivers/staging/usbip/userspace/src/usbip.h b/tools/usb/usbip/src/usbip.h
index 84fe66a9d8ad..84fe66a9d8ad 100644
--- a/drivers/staging/usbip/userspace/src/usbip.h
+++ b/tools/usb/usbip/src/usbip.h
diff --git a/drivers/staging/usbip/userspace/src/usbip_attach.c b/tools/usb/usbip/src/usbip_attach.c
index d58a14dfc094..d58a14dfc094 100644
--- a/drivers/staging/usbip/userspace/src/usbip_attach.c
+++ b/tools/usb/usbip/src/usbip_attach.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_bind.c b/tools/usb/usbip/src/usbip_bind.c
index fa46141ae68b..fa46141ae68b 100644
--- a/drivers/staging/usbip/userspace/src/usbip_bind.c
+++ b/tools/usb/usbip/src/usbip_bind.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_detach.c b/tools/usb/usbip/src/usbip_detach.c
index 05c6d15856eb..05c6d15856eb 100644
--- a/drivers/staging/usbip/userspace/src/usbip_detach.c
+++ b/tools/usb/usbip/src/usbip_detach.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_list.c b/tools/usb/usbip/src/usbip_list.c
index d5ce34a410e7..d5ce34a410e7 100644
--- a/drivers/staging/usbip/userspace/src/usbip_list.c
+++ b/tools/usb/usbip/src/usbip_list.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_network.c b/tools/usb/usbip/src/usbip_network.c
index b4c37e76a6e0..b4c37e76a6e0 100644
--- a/drivers/staging/usbip/userspace/src/usbip_network.c
+++ b/tools/usb/usbip/src/usbip_network.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_network.h b/tools/usb/usbip/src/usbip_network.h
index c1e875cf1078..c1e875cf1078 100644
--- a/drivers/staging/usbip/userspace/src/usbip_network.h
+++ b/tools/usb/usbip/src/usbip_network.h
diff --git a/drivers/staging/usbip/userspace/src/usbip_port.c b/tools/usb/usbip/src/usbip_port.c
index a2e884fd9226..a2e884fd9226 100644
--- a/drivers/staging/usbip/userspace/src/usbip_port.c
+++ b/tools/usb/usbip/src/usbip_port.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_unbind.c b/tools/usb/usbip/src/usbip_unbind.c
index a4a496c9cbaf..a4a496c9cbaf 100644
--- a/drivers/staging/usbip/userspace/src/usbip_unbind.c
+++ b/tools/usb/usbip/src/usbip_unbind.c
diff --git a/drivers/staging/usbip/userspace/src/usbipd.c b/tools/usb/usbip/src/usbipd.c
index 2f87f2d348ba..2f87f2d348ba 100644
--- a/drivers/staging/usbip/userspace/src/usbipd.c
+++ b/tools/usb/usbip/src/usbipd.c
diff --git a/drivers/staging/usbip/userspace/src/utils.c b/tools/usb/usbip/src/utils.c
index 2b3d6d235015..2b3d6d235015 100644
--- a/drivers/staging/usbip/userspace/src/utils.c
+++ b/tools/usb/usbip/src/utils.c
diff --git a/drivers/staging/usbip/userspace/src/utils.h b/tools/usb/usbip/src/utils.h
index 5916fd3e02a6..5916fd3e02a6 100644
--- a/drivers/staging/usbip/userspace/src/utils.h
+++ b/tools/usb/usbip/src/utils.h