164 files changed, 1647 insertions, 999 deletions
diff --git a/Documentation/bcache.txt b/Documentation/bcache.txt
index 77db8809bd96..b3a7e7d384f6 100644
--- a/Documentation/bcache.txt
+++ b/Documentation/bcache.txt
@@ -319,7 +319,10 @@ cache<0..n>
  Symlink to each of the cache devices comprising this cache set. 
 cache_available_percent
-  Percentage of cache device free.
+  Percentage of cache device which doesn't contain dirty data, and could
+  potentially be used for writeback.  This doesn't mean this space isn't used
+  for clean cached data; the unused statistic (in priority_stats) is typically
+  much lower.
 clear_stats
  Clears the statistics associated with this cache
@@ -423,8 +426,11 @@ nbuckets
  Total buckets in this cache
 priority_stats
-  Statistics about how recently data in the cache has been accessed.  This can
+  Statistics about how recently data in the cache has been accessed.
-  reveal your working set size.
+  This can reveal your working set size.  Unused is the percentage of
+  the cache that doesn't contain any data.  Metadata is bcache's
+  metadata overhead.  Average is the average priority of cache buckets.
+  Next is a list of quantiles with the priority threshold of each.
 written
  Sum of all data that has been written to the cache; comparison with
diff --git a/Documentation/devices.txt b/Documentation/devices.txt
index 08f01e79c41a..b9015912bca6 100644
--- a/Documentation/devices.txt
+++ b/Documentation/devices.txt
@@ -498,12 +498,8 @@ Your cooperation is appreciated.
                Each device type has 5 bits (32 minors).
- 13 block       8-bit MFM/RLL/IDE controller
+ 13 block       Previously used for the XT disk (/dev/xdN)
-                  0 = /dev/xda          First XT disk whole disk
+                Deleted in kernel v3.9.
-                 64 = /dev/xdb          Second XT disk whole disk
-                Partitions are handled in the same way as IDE disks
-                (see major number 3).
 14 char        Open Sound System (OSS)
                  0 = /dev/mixer        Mixer control
diff --git a/Documentation/devicetree/bindings/rtc/atmel,at91rm9200-rtc.txt b/Documentation/devicetree/bindings/rtc/atmel,at91rm9200-rtc.txt
index 2a3feabd3b22..34c1505774bf 100644
--- a/Documentation/devicetree/bindings/rtc/atmel,at91rm9200-rtc.txt
+++ b/Documentation/devicetree/bindings/rtc/atmel,at91rm9200-rtc.txt
@@ -1,7 +1,7 @@
 Atmel AT91RM9200 Real Time Clock
 Required properties:
- compatible: should be: "atmel,at91rm9200-rtc"
+- compatible: should be: "atmel,at91rm9200-rtc" or "atmel,at91sam9x5-rtc"
 - reg: physical base address of the controller and length of memory mapped
  region.
 - interrupts: rtc alarm/event interrupt
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 6e3b18a8afc6..2fe6e767b3d6 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3351,9 +3351,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        plus one apbt timer for broadcast timer.
                        x86_mrst_timer=apbt_only | lapic_and_apbt
-        xd=             [HW,XT] Original XT pre-IDE (RLL encoded) disks.
-        xd_geo=         See header of drivers/block/xd.c.
        xen_emul_unplug=                [HW,X86,XEN]
                        Unplug Xen emulated devices
                        Format: [unplug0,][unplug1]
diff --git a/Documentation/m68k/kernel-options.txt b/Documentation/m68k/kernel-options.txt
index 97d45f276fe6..eaf32a1fd0b1 100644
--- a/Documentation/m68k/kernel-options.txt
+++ b/Documentation/m68k/kernel-options.txt
@@ -80,8 +80,6 @@ Valid names are:
  /dev/sdd: -> 0x0830 (forth SCSI disk)
  /dev/sde: -> 0x0840 (fifth SCSI disk)
  /dev/fd : -> 0x0200 (floppy disk)
-  /dev/xda: -> 0x0c00 (first XT disk, unused in Linux/m68k)
-  /dev/xdb: -> 0x0c40 (second XT disk, unused in Linux/m68k)
  The name must be followed by a decimal number, that stands for the
 partition number. Internally, the value of the number is just
diff --git a/MAINTAINERS b/MAINTAINERS
index 250dc970c62d..5be702cc8449 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5766,7 +5766,7 @@ M:	Matthew Wilcox <willy@linux.intel.com>
 L:      linux-nvme@lists.infradead.org
 T:      git git://git.infradead.org/users/willy/linux-nvme.git
 S:      Supported
-F:      drivers/block/nvme.c
+F:      drivers/block/nvme*
 F:      include/linux/nvme.h
 OMAP SUPPORT
@@ -7624,7 +7624,7 @@ F:	drivers/clk/spear/
 SPI SUBSYSTEM
 M:      Mark Brown <broonie@kernel.org>
 M:      Grant Likely <grant.likely@linaro.org>
-L:      spi-devel-general@lists.sourceforge.net
+L:      linux-spi@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git
 Q:      http://patchwork.kernel.org/project/spi-devel-general/list/
 S:      Maintained
@@ -9004,7 +9004,7 @@ S:	Maintained
 F:      drivers/net/wireless/wl3501*
 WM97XX TOUCHSCREEN DRIVERS
-M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
+M:      Mark Brown <broonie@kernel.org>
 M:      Liam Girdwood <lrg@slimlogic.co.uk>
 L:      linux-input@vger.kernel.org
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-touch
@@ -9014,7 +9014,6 @@ F:	drivers/input/touchscreen/*wm97*
 F:      include/linux/wm97xx.h
 WOLFSON MICROELECTRONICS DRIVERS
-M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
 L:      patches@opensource.wolfsonmicro.com
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-asoc
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-audioplus
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 3580d57ea218..79e9bdbfc491 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -124,7 +124,7 @@ KBUILD_CFLAGS = $(subst -pg, , $(ORIG_CFLAGS))
 endif
 ccflags-y := -fpic -mno-single-pic-base -fno-builtin -I$(obj)
-asflags-y := -Wa,-march=all -DZIMAGE
+asflags-y := -DZIMAGE
 # Supply kernel BSS size to the decompressor via a linker symbol.
 KBSS_SZ = $(shell $(CROSS_COMPILE)size $(obj)/../../../../vmlinux | \
diff --git a/arch/arm/boot/compressed/debug.S b/arch/arm/boot/compressed/debug.S
index 6e8382d5b7a4..5392ee63338f 100644
--- a/arch/arm/boot/compressed/debug.S
+++ b/arch/arm/boot/compressed/debug.S
@@ -1,6 +1,8 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#ifndef CONFIG_DEBUG_SEMIHOSTING
 #include CONFIG_DEBUG_LL_INCLUDE
 ENTRY(putc)
@@ -10,3 +12,29 @@ ENTRY(putc)
        busyuart r3, r1
        mov      pc, lr
 ENDPROC(putc)
+#else
+ENTRY(putc)
+        adr     r1, 1f
+        ldmia   r1, {r2, r3}
+        add     r2, r2, r1
+        ldr     r1, [r2, r3]
+        strb    r0, [r1]
+        mov     r0, #0x03               @ SYS_WRITEC
+   ARM( svc     #0x123456       )
+ THUMB( svc     #0xab           )
+        mov     pc, lr
+        .align  2
+1:      .word   _GLOBAL_OFFSET_TABLE_ - .
+        .word   semi_writec_buf(GOT)
+ENDPROC(putc)
+        .bss
+        .global semi_writec_buf
+        .type   semi_writec_buf, %object
+semi_writec_buf:
+        .space  4
+        .size   semi_writec_buf, 4
+#endif
diff --git a/arch/arm/boot/compressed/head-sa1100.S b/arch/arm/boot/compressed/head-sa1100.S
index 6179d94dd5c6..3115e313d9f6 100644
--- a/arch/arm/boot/compressed/head-sa1100.S
+++ b/arch/arm/boot/compressed/head-sa1100.S
@@ -11,6 +11,7 @@
 #include <asm/mach-types.h>
                .section        ".start", "ax"
+                .arch   armv4
 __SA1100_start:
diff --git a/arch/arm/boot/compressed/head-shark.S b/arch/arm/boot/compressed/head-shark.S
index 089c560e07f1..92b56897ed64 100644
--- a/arch/arm/boot/compressed/head-shark.S
+++ b/arch/arm/boot/compressed/head-shark.S
@@ -18,6 +18,7 @@
        
                .section        ".start", "ax"
+                .arch armv4
                b       __beginning
        
 __ofw_data:     .long   0                               @ the number of memory blocks
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index fe4d9c3ad761..032a8d987148 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -11,6 +11,7 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+        .arch   armv7-a
 /*
 * Debugging stuff
 *
@@ -805,8 +806,8 @@ call_cache_fn:	adr	r12, proc_types
                .align  2
                .type   proc_types,#object
 proc_types:
-                .word   0x00000000              @ old ARM ID
+                .word   0x41000000              @ old ARM ID
-                .word   0x0000f000
+                .word   0xff00f000
                mov     pc, lr
 THUMB(         nop                             )
                mov     pc, lr
diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h
index 968c0a14e0a3..209e6504922e 100644
--- a/arch/arm/include/asm/percpu.h
+++ b/arch/arm/include/asm/percpu.h
@@ -30,8 +30,15 @@ static inline void set_my_cpu_offset(unsigned long off)
 static inline unsigned long __my_cpu_offset(void)
 {
        unsigned long off;
-        /* Read TPIDRPRW */
+        register unsigned long *sp asm ("sp");
-        asm("mrc p15, 0, %0, c13, c0, 4" : "=r" (off) : : "memory");
+        /*
+         * Read TPIDRPRW.
+         * We want to allow caching the value, so avoid using volatile and
+         * instead use a fake stack read to hazard against barrier().
+         */
+        asm("mrc p15, 0, %0, c13, c0, 4" : "=r" (off) : "Q" (*sp));
        return off;
 }
 #define __my_cpu_offset __my_cpu_offset()
diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index f10316b4ecdc..c5a59546a256 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -13,6 +13,7 @@
 #include <linux/cpu.h>
 #include <linux/cpumask.h>
+#include <linux/export.h>
 #include <linux/init.h>
 #include <linux/percpu.h>
 #include <linux/node.h>
@@ -200,6 +201,7 @@ static inline void update_cpu_power(unsigned int cpuid, unsigned int mpidr) {}
 * cpu topology table
 */
 struct cputopo_arm cpu_topology[NR_CPUS];
+EXPORT_SYMBOL_GPL(cpu_topology);
 const struct cpumask *cpu_coregroup_mask(int cpu)
 {
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index 820116067c10..516e6e9a5594 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -117,7 +117,7 @@ get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
        if (! ((asid += ASID_INC) & ASID_MASK) ) {
                if (cpu_has_vtag_icache)
                        flush_icache_all();
-#ifdef CONFIG_VIRTUALIZATION
+#ifdef CONFIG_KVM
                kvm_local_flush_tlb_all();      /* start new asid cycle */
 #else
                local_flush_tlb_all();  /* start new asid cycle */
diff --git a/arch/mips/include/uapi/asm/kvm.h b/arch/mips/include/uapi/asm/kvm.h
index 3f424f5217da..f09ff5ae2059 100644
--- a/arch/mips/include/uapi/asm/kvm.h
+++ b/arch/mips/include/uapi/asm/kvm.h
@@ -58,56 +58,53 @@ struct kvm_fpu {
 *  bits[2..0]   - Register 'sel' index.
 *  bits[7..3]   - Register 'rd'  index.
 *  bits[15..8]  - Must be zero.
- *  bits[63..16] - 1 -> CP0 registers.
+ *  bits[31..16] - 1 -> CP0 registers.
+ *  bits[51..32] - Must be zero.
+ *  bits[63..52] - As per linux/kvm.h
 *
 * Other sets registers may be added in the future.  Each set would
- * have its own identifier in bits[63..16].
+ * have its own identifier in bits[31..16].
- *
- * The addr field of struct kvm_one_reg must point to an aligned
- * 64-bit wide location.  For registers that are narrower than
- * 64-bits, the value is stored in the low order bits of the location,
- * and sign extended to 64-bits.
 *
 * The registers defined in struct kvm_regs are also accessible, the
 * id values for these are below.
 */
-#define KVM_REG_MIPS_R0 0
+#define KVM_REG_MIPS_R0 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 0)
-#define KVM_REG_MIPS_R1 1
+#define KVM_REG_MIPS_R1 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 1)
-#define KVM_REG_MIPS_R2 2
+#define KVM_REG_MIPS_R2 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 2)
-#define KVM_REG_MIPS_R3 3
+#define KVM_REG_MIPS_R3 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 3)
-#define KVM_REG_MIPS_R4 4
+#define KVM_REG_MIPS_R4 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 4)
-#define KVM_REG_MIPS_R5 5
+#define KVM_REG_MIPS_R5 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 5)
-#define KVM_REG_MIPS_R6 6
+#define KVM_REG_MIPS_R6 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 6)
-#define KVM_REG_MIPS_R7 7
+#define KVM_REG_MIPS_R7 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 7)
-#define KVM_REG_MIPS_R8 8
+#define KVM_REG_MIPS_R8 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 8)
-#define KVM_REG_MIPS_R9 9
+#define KVM_REG_MIPS_R9 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 9)
-#define KVM_REG_MIPS_R10 10
+#define KVM_REG_MIPS_R10 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 10)
-#define KVM_REG_MIPS_R11 11
+#define KVM_REG_MIPS_R11 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 11)
-#define KVM_REG_MIPS_R12 12
+#define KVM_REG_MIPS_R12 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 12)
-#define KVM_REG_MIPS_R13 13
+#define KVM_REG_MIPS_R13 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 13)
-#define KVM_REG_MIPS_R14 14
+#define KVM_REG_MIPS_R14 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 14)
-#define KVM_REG_MIPS_R15 15
+#define KVM_REG_MIPS_R15 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 15)
-#define KVM_REG_MIPS_R16 16
+#define KVM_REG_MIPS_R16 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 16)
-#define KVM_REG_MIPS_R17 17
+#define KVM_REG_MIPS_R17 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 17)
-#define KVM_REG_MIPS_R18 18
+#define KVM_REG_MIPS_R18 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 18)
-#define KVM_REG_MIPS_R19 19
+#define KVM_REG_MIPS_R19 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 19)
-#define KVM_REG_MIPS_R20 20
+#define KVM_REG_MIPS_R20 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 20)
-#define KVM_REG_MIPS_R21 21
+#define KVM_REG_MIPS_R21 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 21)
-#define KVM_REG_MIPS_R22 22
+#define KVM_REG_MIPS_R22 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 22)
-#define KVM_REG_MIPS_R23 23
+#define KVM_REG_MIPS_R23 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 23)
-#define KVM_REG_MIPS_R24 24
+#define KVM_REG_MIPS_R24 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 24)
-#define KVM_REG_MIPS_R25 25
+#define KVM_REG_MIPS_R25 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 25)
-#define KVM_REG_MIPS_R26 26
+#define KVM_REG_MIPS_R26 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 26)
-#define KVM_REG_MIPS_R27 27
+#define KVM_REG_MIPS_R27 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 27)
-#define KVM_REG_MIPS_R28 28
+#define KVM_REG_MIPS_R28 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 28)
-#define KVM_REG_MIPS_R29 29
+#define KVM_REG_MIPS_R29 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 29)
-#define KVM_REG_MIPS_R30 30
+#define KVM_REG_MIPS_R30 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 30)
-#define KVM_REG_MIPS_R31 31
+#define KVM_REG_MIPS_R31 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 31)
-#define KVM_REG_MIPS_HI 32
+#define KVM_REG_MIPS_HI (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 32)
-#define KVM_REG_MIPS_LO 33
+#define KVM_REG_MIPS_LO (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 33)
-#define KVM_REG_MIPS_PC 34
+#define KVM_REG_MIPS_PC (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 34)
 /*
 * KVM MIPS specific structures and definitions
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index cf5509f13dd5..dba90ec0dc38 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -25,12 +25,16 @@
 #define MCOUNT_OFFSET_INSNS 4
 #endif
+#ifdef CONFIG_DYNAMIC_FTRACE
 /* Arch override because MIPS doesn't need to run this from stop_machine() */
 void arch_ftrace_update_code(int command)
 {
        ftrace_modify_all_code(command);
 }
+#endif
 /*
 * Check if the address is in kernel space
 *
diff --git a/arch/mips/kernel/idle.c b/arch/mips/kernel/idle.c
index 3b09b888afa9..0c655deeea4a 100644
--- a/arch/mips/kernel/idle.c
+++ b/arch/mips/kernel/idle.c
@@ -93,26 +93,27 @@ static void rm7k_wait_irqoff(void)
 }
 /*
- * The Au1xxx wait is available only if using 32khz counter or
+ * Au1 'wait' is only useful when the 32kHz counter is used as timer,
- * external timer source, but specifically not CP0 Counter.
+ * since coreclock (and the cp0 counter) stops upon executing it. Only an
- * alchemy/common/time.c may override cpu_wait!
+ * interrupt can wake it, so they must be enabled before entering idle modes.
 */
 static void au1k_wait(void)
 {
+        unsigned long c0status = read_c0_status() | 1;  /* irqs on */
        __asm__(
        "       .set    mips3                   \n"
        "       cache   0x14, 0(%0)             \n"
        "       cache   0x14, 32(%0)            \n"
        "       sync                            \n"
-        "       nop                             \n"
+        "       mtc0    %1, $12                 \n" /* wr c0status */
        "       wait                            \n"
        "       nop                             \n"
        "       nop                             \n"
        "       nop                             \n"
        "       nop                             \n"
        "       .set    mips0                   \n"
-        : : "r" (au1k_wait));
+        : : "r" (au1k_wait), "r" (c0status));
-        local_irq_enable();
 }
 static int __initdata nowait;
diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
index d934b017f479..dd203e59e6fd 100644
--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -485,29 +485,35 @@ kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
        return -ENOIOCTLCMD;
 }
-#define KVM_REG_MIPS_CP0_INDEX (0x10000 + 8 * 0 + 0)
+#define MIPS_CP0_32(_R, _S)                                     \
-#define KVM_REG_MIPS_CP0_ENTRYLO0 (0x10000 + 8 * 2 + 0)
+        (KVM_REG_MIPS | KVM_REG_SIZE_U32 | 0x10000 | (8 * (_R) + (_S)))
-#define KVM_REG_MIPS_CP0_ENTRYLO1 (0x10000 + 8 * 3 + 0)
-#define KVM_REG_MIPS_CP0_CONTEXT (0x10000 + 8 * 4 + 0)
+#define MIPS_CP0_64(_R, _S)                                     \
-#define KVM_REG_MIPS_CP0_USERLOCAL (0x10000 + 8 * 4 + 2)
+        (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 0x10000 | (8 * (_R) + (_S)))
-#define KVM_REG_MIPS_CP0_PAGEMASK (0x10000 + 8 * 5 + 0)
-#define KVM_REG_MIPS_CP0_PAGEGRAIN (0x10000 + 8 * 5 + 1)
+#define KVM_REG_MIPS_CP0_INDEX          MIPS_CP0_32(0, 0)
-#define KVM_REG_MIPS_CP0_WIRED (0x10000 + 8 * 6 + 0)
+#define KVM_REG_MIPS_CP0_ENTRYLO0       MIPS_CP0_64(2, 0)
-#define KVM_REG_MIPS_CP0_HWRENA (0x10000 + 8 * 7 + 0)
+#define KVM_REG_MIPS_CP0_ENTRYLO1       MIPS_CP0_64(3, 0)
-#define KVM_REG_MIPS_CP0_BADVADDR (0x10000 + 8 * 8 + 0)
+#define KVM_REG_MIPS_CP0_CONTEXT        MIPS_CP0_64(4, 0)
-#define KVM_REG_MIPS_CP0_COUNT (0x10000 + 8 * 9 + 0)
+#define KVM_REG_MIPS_CP0_USERLOCAL      MIPS_CP0_64(4, 2)
-#define KVM_REG_MIPS_CP0_ENTRYHI (0x10000 + 8 * 10 + 0)
+#define KVM_REG_MIPS_CP0_PAGEMASK       MIPS_CP0_32(5, 0)
-#define KVM_REG_MIPS_CP0_COMPARE (0x10000 + 8 * 11 + 0)
+#define KVM_REG_MIPS_CP0_PAGEGRAIN      MIPS_CP0_32(5, 1)
-#define KVM_REG_MIPS_CP0_STATUS (0x10000 + 8 * 12 + 0)
+#define KVM_REG_MIPS_CP0_WIRED          MIPS_CP0_32(6, 0)
-#define KVM_REG_MIPS_CP0_CAUSE (0x10000 + 8 * 13 + 0)
+#define KVM_REG_MIPS_CP0_HWRENA         MIPS_CP0_32(7, 0)
-#define KVM_REG_MIPS_CP0_EBASE (0x10000 + 8 * 15 + 1)
+#define KVM_REG_MIPS_CP0_BADVADDR       MIPS_CP0_64(8, 0)
-#define KVM_REG_MIPS_CP0_CONFIG (0x10000 + 8 * 16 + 0)
+#define KVM_REG_MIPS_CP0_COUNT          MIPS_CP0_32(9, 0)
-#define KVM_REG_MIPS_CP0_CONFIG1 (0x10000 + 8 * 16 + 1)
+#define KVM_REG_MIPS_CP0_ENTRYHI        MIPS_CP0_64(10, 0)
-#define KVM_REG_MIPS_CP0_CONFIG2 (0x10000 + 8 * 16 + 2)
+#define KVM_REG_MIPS_CP0_COMPARE        MIPS_CP0_32(11, 0)
-#define KVM_REG_MIPS_CP0_CONFIG3 (0x10000 + 8 * 16 + 3)
+#define KVM_REG_MIPS_CP0_STATUS         MIPS_CP0_32(12, 0)
-#define KVM_REG_MIPS_CP0_CONFIG7 (0x10000 + 8 * 16 + 7)
+#define KVM_REG_MIPS_CP0_CAUSE          MIPS_CP0_32(13, 0)
-#define KVM_REG_MIPS_CP0_XCONTEXT (0x10000 + 8 * 20 + 0)
+#define KVM_REG_MIPS_CP0_EBASE          MIPS_CP0_64(15, 1)
-#define KVM_REG_MIPS_CP0_ERROREPC (0x10000 + 8 * 30 + 0)
+#define KVM_REG_MIPS_CP0_CONFIG         MIPS_CP0_32(16, 0)
+#define KVM_REG_MIPS_CP0_CONFIG1        MIPS_CP0_32(16, 1)
+#define KVM_REG_MIPS_CP0_CONFIG2        MIPS_CP0_32(16, 2)
+#define KVM_REG_MIPS_CP0_CONFIG3        MIPS_CP0_32(16, 3)
+#define KVM_REG_MIPS_CP0_CONFIG7        MIPS_CP0_32(16, 7)
+#define KVM_REG_MIPS_CP0_XCONTEXT       MIPS_CP0_64(20, 0)
+#define KVM_REG_MIPS_CP0_ERROREPC       MIPS_CP0_64(30, 0)
 static u64 kvm_mips_get_one_regs[] = {
        KVM_REG_MIPS_R0,
@@ -567,8 +573,6 @@ static u64 kvm_mips_get_one_regs[] = {
 static int kvm_mips_get_reg(struct kvm_vcpu *vcpu,
                            const struct kvm_one_reg *reg)
 {
-        u64 __user *uaddr = (u64 __user *)(long)reg->addr;
        struct mips_coproc *cop0 = vcpu->arch.cop0;
        s64 v;
@@ -631,18 +635,39 @@ static int kvm_mips_get_reg(struct kvm_vcpu *vcpu,
        default:
                return -EINVAL;
        }
-        return put_user(v, uaddr);
+        if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64) {
+                u64 __user *uaddr64 = (u64 __user *)(long)reg->addr;
+                return put_user(v, uaddr64);
+        } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32) {
+                u32 __user *uaddr32 = (u32 __user *)(long)reg->addr;
+                u32 v32 = (u32)v;
+                return put_user(v32, uaddr32);
+        } else {
+                return -EINVAL;
+        }
 }
 static int kvm_mips_set_reg(struct kvm_vcpu *vcpu,
                            const struct kvm_one_reg *reg)
 {
-        u64 __user *uaddr = (u64 __user *)(long)reg->addr;
        struct mips_coproc *cop0 = vcpu->arch.cop0;
        u64 v;
-        if (get_user(v, uaddr) != 0)
+        if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64) {
-                return -EFAULT;
+                u64 __user *uaddr64 = (u64 __user *)(long)reg->addr;
+                if (get_user(v, uaddr64) != 0)
+                        return -EFAULT;
+        } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32) {
+                u32 __user *uaddr32 = (u32 __user *)(long)reg->addr;
+                s32 v32;
+                if (get_user(v32, uaddr32) != 0)
+                        return -EFAULT;
+                v = (s64)v32;
+        } else {
+                return -EINVAL;
+        }
        switch (reg->id) {
        case KVM_REG_MIPS_R0:
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index 26807e5aff51..6f3887d884d2 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -176,6 +176,7 @@ extern const char *powerpc_base_platform;
 #define CPU_FTR_CFAR                    LONG_ASM_CONST(0x0100000000000000)
 #define CPU_FTR_HAS_PPR                 LONG_ASM_CONST(0x0200000000000000)
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
+#define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 #ifndef __ASSEMBLY__
@@ -394,19 +395,20 @@ extern const char *powerpc_base_platform;
            CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_201 | \
            CPU_FTR_ALTIVEC_COMP | CPU_FTR_CAN_NAP | CPU_FTR_MMCRA | \
            CPU_FTR_CP_USE_DCBTZ | CPU_FTR_STCX_CHECKS_ADDRESS | \
-            CPU_FTR_HVMODE)
+            CPU_FTR_HVMODE | CPU_FTR_DABRX)
 #define CPU_FTRS_POWER5 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
            CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \
            CPU_FTR_MMCRA | CPU_FTR_SMT | \
            CPU_FTR_COHERENT_ICACHE | CPU_FTR_PURR | \
-            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB)
+            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_DABRX)
 #define CPU_FTRS_POWER6 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
            CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \
            CPU_FTR_MMCRA | CPU_FTR_SMT | \
            CPU_FTR_COHERENT_ICACHE | \
            CPU_FTR_PURR | CPU_FTR_SPURR | CPU_FTR_REAL_LE | \
            CPU_FTR_DSCR | CPU_FTR_UNALIGNED_LD_STD | \
-            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_CFAR)
+            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_CFAR | \
+            CPU_FTR_DABRX)
 #define CPU_FTRS_POWER7 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
            CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_206 |\
            CPU_FTR_MMCRA | CPU_FTR_SMT | \
@@ -415,7 +417,7 @@ extern const char *powerpc_base_platform;
            CPU_FTR_DSCR | CPU_FTR_SAO  | CPU_FTR_ASYM_SMT | \
            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
            CPU_FTR_ICSWX | CPU_FTR_CFAR | CPU_FTR_HVMODE | \
-            CPU_FTR_VMX_COPY | CPU_FTR_HAS_PPR)
+            CPU_FTR_VMX_COPY | CPU_FTR_HAS_PPR | CPU_FTR_DABRX)
 #define CPU_FTRS_POWER8 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
            CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_206 |\
            CPU_FTR_MMCRA | CPU_FTR_SMT | \
@@ -430,14 +432,15 @@ extern const char *powerpc_base_platform;
            CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \
            CPU_FTR_ALTIVEC_COMP | CPU_FTR_MMCRA | CPU_FTR_SMT | \
            CPU_FTR_PAUSE_ZERO  | CPU_FTR_CELL_TB_BUG | CPU_FTR_CP_USE_DCBTZ | \
-            CPU_FTR_UNALIGNED_LD_STD)
+            CPU_FTR_UNALIGNED_LD_STD | CPU_FTR_DABRX)
 #define CPU_FTRS_PA6T (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
            CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_ALTIVEC_COMP | \
-            CPU_FTR_PURR | CPU_FTR_REAL_LE)
+            CPU_FTR_PURR | CPU_FTR_REAL_LE | CPU_FTR_DABRX)
 #define CPU_FTRS_COMPATIBLE     (CPU_FTR_USE_TB | CPU_FTR_PPCAS_ARCH_V2)
 #define CPU_FTRS_A2 (CPU_FTR_USE_TB | CPU_FTR_SMT | CPU_FTR_DBELL | \
-                     CPU_FTR_NOEXECUTE | CPU_FTR_NODSISRALIGN | CPU_FTR_ICSWX)
+                     CPU_FTR_NOEXECUTE | CPU_FTR_NODSISRALIGN | \
+                     CPU_FTR_ICSWX | CPU_FTR_DABRX )
 #ifdef __powerpc64__
 #ifdef CONFIG_PPC_BOOK3E
diff --git a/arch/powerpc/include/asm/kvm_asm.h b/arch/powerpc/include/asm/kvm_asm.h
index b9dd382cb349..851bac7afa4b 100644
--- a/arch/powerpc/include/asm/kvm_asm.h
+++ b/arch/powerpc/include/asm/kvm_asm.h
@@ -54,8 +54,16 @@
 #define BOOKE_INTERRUPT_DEBUG 15
 /* E500 */
-#define BOOKE_INTERRUPT_SPE_UNAVAIL 32
+#define BOOKE_INTERRUPT_SPE_ALTIVEC_UNAVAIL 32
-#define BOOKE_INTERRUPT_SPE_FP_DATA 33
+#define BOOKE_INTERRUPT_SPE_FP_DATA_ALTIVEC_ASSIST 33
+/*
+ * TODO: Unify 32-bit and 64-bit kernel exception handlers to use same defines
+ */
+#define BOOKE_INTERRUPT_SPE_UNAVAIL BOOKE_INTERRUPT_SPE_ALTIVEC_UNAVAIL
+#define BOOKE_INTERRUPT_SPE_FP_DATA BOOKE_INTERRUPT_SPE_FP_DATA_ALTIVEC_ASSIST
+#define BOOKE_INTERRUPT_ALTIVEC_UNAVAIL BOOKE_INTERRUPT_SPE_ALTIVEC_UNAVAIL
+#define BOOKE_INTERRUPT_ALTIVEC_ASSIST \
+                                BOOKE_INTERRUPT_SPE_FP_DATA_ALTIVEC_ASSIST
 #define BOOKE_INTERRUPT_SPE_FP_ROUND 34
 #define BOOKE_INTERRUPT_PERFORMANCE_MONITOR 35
 #define BOOKE_INTERRUPT_DOORBELL 36
@@ -67,10 +75,6 @@
 #define BOOKE_INTERRUPT_HV_SYSCALL 40
 #define BOOKE_INTERRUPT_HV_PRIV 41
-/* altivec */
-#define BOOKE_INTERRUPT_ALTIVEC_UNAVAIL 42
-#define BOOKE_INTERRUPT_ALTIVEC_ASSIST 43
 /* book3s */
 #define BOOK3S_INTERRUPT_SYSTEM_RESET   0x100
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 1f0937d7d4b5..2a45d0f04385 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -452,8 +452,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .mmu_features           = MMU_FTRS_POWER8,
                .icache_bsize           = 128,
                .dcache_bsize           = 128,
-                .oprofile_type          = PPC_OPROFILE_POWER4,
+                .oprofile_type          = PPC_OPROFILE_INVALID,
-                .oprofile_cpu_type      = 0,
+                .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
                .cpu_setup              = __setup_cpu_power8,
                .cpu_restore            = __restore_cpu_power8,
                .platform               = "power8",
@@ -506,8 +506,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .dcache_bsize           = 128,
                .num_pmcs               = 6,
                .pmc_type               = PPC_PMC_IBM,
-                .oprofile_cpu_type      = 0,
+                .oprofile_cpu_type      = "ppc64/power8",
-                .oprofile_type          = PPC_OPROFILE_POWER4,
+                .oprofile_type          = PPC_OPROFILE_INVALID,
                .cpu_setup              = __setup_cpu_power8,
                .cpu_restore            = __restore_cpu_power8,
                .platform               = "power8",
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 246b11c4fe7e..8741c854e03d 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -465,20 +465,6 @@ BEGIN_FTR_SECTION
        std     r0, THREAD_EBBHR(r3)
        mfspr   r0, SPRN_EBBRR
        std     r0, THREAD_EBBRR(r3)
-        /* PMU registers made user read/(write) by EBB */
-        mfspr   r0, SPRN_SIAR
-        std     r0, THREAD_SIAR(r3)
-        mfspr   r0, SPRN_SDAR
-        std     r0, THREAD_SDAR(r3)
-        mfspr   r0, SPRN_SIER
-        std     r0, THREAD_SIER(r3)
-        mfspr   r0, SPRN_MMCR0
-        std     r0, THREAD_MMCR0(r3)
-        mfspr   r0, SPRN_MMCR2
-        std     r0, THREAD_MMCR2(r3)
-        mfspr   r0, SPRN_MMCRA
-        std     r0, THREAD_MMCRA(r3)
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 #endif
@@ -581,20 +567,6 @@ BEGIN_FTR_SECTION
        ld      r0, THREAD_EBBRR(r4)
        mtspr   SPRN_EBBRR, r0
-        /* PMU registers made user read/(write) by EBB */
-        ld      r0, THREAD_SIAR(r4)
-        mtspr   SPRN_SIAR, r0
-        ld      r0, THREAD_SDAR(r4)
-        mtspr   SPRN_SDAR, r0
-        ld      r0, THREAD_SIER(r4)
-        mtspr   SPRN_SIER, r0
-        ld      r0, THREAD_MMCR0(r4)
-        mtspr   SPRN_MMCR0, r0
-        ld      r0, THREAD_MMCR2(r4)
-        mtspr   SPRN_MMCR2, r0
-        ld      r0, THREAD_MMCRA(r4)
-        mtspr   SPRN_MMCRA, r0
        ld      r0,THREAD_TAR(r4)
        mtspr   SPRN_TAR,r0
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index e6eba1bf61ad..e783453f910d 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -454,38 +454,14 @@ BEGIN_FTR_SECTION
        xori    r10,r10,(MSR_FE0|MSR_FE1)
        mtmsrd  r10
        sync
-        fmr     0,0
-        fmr     1,1
+#define FMR2(n)  fmr (n), (n) ; fmr n+1, n+1
-        fmr     2,2
+#define FMR4(n)  FMR2(n) ; FMR2(n+2)
-        fmr     3,3
+#define FMR8(n)  FMR4(n) ; FMR4(n+4)
-        fmr     4,4
+#define FMR16(n) FMR8(n) ; FMR8(n+8)
-        fmr     5,5
+#define FMR32(n) FMR16(n) ; FMR16(n+16)
-        fmr     6,6
+        FMR32(0)
-        fmr     7,7
-        fmr     8,8
-        fmr     9,9
-        fmr     10,10
-        fmr     11,11
-        fmr     12,12
-        fmr     13,13
-        fmr     14,14
-        fmr     15,15
-        fmr     16,16
-        fmr     17,17
-        fmr     18,18
-        fmr     19,19
-        fmr     20,20
-        fmr     21,21
-        fmr     22,22
-        fmr     23,23
-        fmr     24,24
-        fmr     25,25
-        fmr     26,26
-        fmr     27,27
-        fmr     28,28
-        fmr     29,29
-        fmr     30,30
-        fmr     31,31
 FTR_SECTION_ELSE
 /*
 * To denormalise we need to move a copy of the register to itself.
@@ -495,39 +471,25 @@ FTR_SECTION_ELSE
        oris    r10,r10,MSR_VSX@h
        mtmsrd  r10
        sync
-        XVCPSGNDP(0,0,0)
-        XVCPSGNDP(1,1,1)
+#define XVCPSGNDP2(n) XVCPSGNDP(n,n,n) ; XVCPSGNDP(n+1,n+1,n+1)
-        XVCPSGNDP(2,2,2)
+#define XVCPSGNDP4(n) XVCPSGNDP2(n) ; XVCPSGNDP2(n+2)
-        XVCPSGNDP(3,3,3)
+#define XVCPSGNDP8(n) XVCPSGNDP4(n) ; XVCPSGNDP4(n+4)
-        XVCPSGNDP(4,4,4)
+#define XVCPSGNDP16(n) XVCPSGNDP8(n) ; XVCPSGNDP8(n+8)
-        XVCPSGNDP(5,5,5)
+#define XVCPSGNDP32(n) XVCPSGNDP16(n) ; XVCPSGNDP16(n+16)
-        XVCPSGNDP(6,6,6)
+        XVCPSGNDP32(0)
-        XVCPSGNDP(7,7,7)
-        XVCPSGNDP(8,8,8)
-        XVCPSGNDP(9,9,9)
-        XVCPSGNDP(10,10,10)
-        XVCPSGNDP(11,11,11)
-        XVCPSGNDP(12,12,12)
-        XVCPSGNDP(13,13,13)
-        XVCPSGNDP(14,14,14)
-        XVCPSGNDP(15,15,15)
-        XVCPSGNDP(16,16,16)
-        XVCPSGNDP(17,17,17)
-        XVCPSGNDP(18,18,18)
-        XVCPSGNDP(19,19,19)
-        XVCPSGNDP(20,20,20)
-        XVCPSGNDP(21,21,21)
-        XVCPSGNDP(22,22,22)
-        XVCPSGNDP(23,23,23)
-        XVCPSGNDP(24,24,24)
-        XVCPSGNDP(25,25,25)
-        XVCPSGNDP(26,26,26)
-        XVCPSGNDP(27,27,27)
-        XVCPSGNDP(28,28,28)
-        XVCPSGNDP(29,29,29)
-        XVCPSGNDP(30,30,30)
-        XVCPSGNDP(31,31,31)
 ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_206)
+BEGIN_FTR_SECTION
+        b       denorm_done
+END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+/*
+ * To denormalise we need to move a copy of the register to itself.
+ * For POWER8 we need to do that for all 64 VSX registers
+ */
+        XVCPSGNDP32(32)
+denorm_done:
        mtspr   SPRN_HSRR0,r11
        mtcrf   0x80,r9
        ld      r9,PACA_EXGEN+EX_R9(r13)
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index 7f2273cc3c7d..eabeec991016 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -827,6 +827,7 @@ static void pcibios_fixup_resources(struct pci_dev *dev)
        }
        for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
                struct resource *res = dev->resource + i;
+                struct pci_bus_region reg;
                if (!res->flags)
                        continue;
@@ -835,8 +836,9 @@ static void pcibios_fixup_resources(struct pci_dev *dev)
                 * at 0 as unset as well, except if PCI_PROBE_ONLY is also set
                 * since in that case, we don't want to re-assign anything
                 */
+                pcibios_resource_to_bus(dev, &reg, res);
                if (pci_has_flag(PCI_REASSIGN_ALL_RSRC) ||
-                    (res->start == 0 && !pci_has_flag(PCI_PROBE_ONLY))) {
+                    (reg.start == 0 && !pci_has_flag(PCI_PROBE_ONLY))) {
                        /* Only print message if not re-assigning */
                        if (!pci_has_flag(PCI_REASSIGN_ALL_RSRC))
                                pr_debug("PCI:%s Resource %d %016llx-%016llx [%x] "
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index a902723fdc69..b0f3e3f77e72 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -399,7 +399,8 @@ static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
 static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
 {
        mtspr(SPRN_DABR, dabr);
-        mtspr(SPRN_DABRX, dabrx);
+        if (cpu_has_feature(CPU_FTR_DABRX))
+                mtspr(SPRN_DABRX, dabrx);
        return 0;
 }
 #else
diff --git a/arch/powerpc/kvm/44x_tlb.c b/arch/powerpc/kvm/44x_tlb.c
index 5dd3ab469976..ed0385448148 100644
--- a/arch/powerpc/kvm/44x_tlb.c
+++ b/arch/powerpc/kvm/44x_tlb.c
@@ -441,6 +441,7 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
        struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
        struct kvmppc_44x_tlbe *tlbe;
        unsigned int gtlb_index;
+        int idx;
        gtlb_index = kvmppc_get_gpr(vcpu, ra);
        if (gtlb_index >= KVM44x_GUEST_TLB_SIZE) {
@@ -473,6 +474,8 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
                return EMULATE_FAIL;
        }
+        idx = srcu_read_lock(&vcpu->kvm->srcu);
        if (tlbe_is_host_safe(vcpu, tlbe)) {
                gva_t eaddr;
                gpa_t gpaddr;
@@ -489,6 +492,8 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
                kvmppc_mmu_map(vcpu, eaddr, gpaddr, gtlb_index);
        }
+        srcu_read_unlock(&vcpu->kvm->srcu, idx);
        trace_kvm_gtlb_write(gtlb_index, tlbe->tid, tlbe->word0, tlbe->word1,
                             tlbe->word2);
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index 1020119226db..5cd7ad0c1176 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -832,6 +832,18 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
 {
        int r = RESUME_HOST;
        int s;
+        int idx;
+#ifdef CONFIG_PPC64
+        WARN_ON(local_paca->irq_happened != 0);
+#endif
+        /*
+         * We enter with interrupts disabled in hardware, but
+         * we need to call hard_irq_disable anyway to ensure that
+         * the software state is kept in sync.
+         */
+        hard_irq_disable();
        /* update before a new last_exit_type is rewritten */
        kvmppc_update_timing_stats(vcpu);
@@ -1053,6 +1065,8 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                        break;
                }
+                idx = srcu_read_lock(&vcpu->kvm->srcu);
                gpaddr = kvmppc_mmu_xlate(vcpu, gtlb_index, eaddr);
                gfn = gpaddr >> PAGE_SHIFT;
@@ -1075,6 +1089,7 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                        kvmppc_account_exit(vcpu, MMIO_EXITS);
                }
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
                break;
        }
@@ -1098,6 +1113,8 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                kvmppc_account_exit(vcpu, ITLB_VIRT_MISS_EXITS);
+                idx = srcu_read_lock(&vcpu->kvm->srcu);
                gpaddr = kvmppc_mmu_xlate(vcpu, gtlb_index, eaddr);
                gfn = gpaddr >> PAGE_SHIFT;
@@ -1114,6 +1131,7 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                        kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_MACHINE_CHECK);
                }
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
                break;
        }
diff --git a/arch/powerpc/kvm/e500_mmu.c b/arch/powerpc/kvm/e500_mmu.c
index c41a5a96b558..6d6f153b6c1d 100644
--- a/arch/powerpc/kvm/e500_mmu.c
+++ b/arch/powerpc/kvm/e500_mmu.c
@@ -396,6 +396,7 @@ int kvmppc_e500_emul_tlbwe(struct kvm_vcpu *vcpu)
        struct kvm_book3e_206_tlb_entry *gtlbe;
        int tlbsel, esel;
        int recal = 0;
+        int idx;
        tlbsel = get_tlb_tlbsel(vcpu);
        esel = get_tlb_esel(vcpu, tlbsel);
@@ -430,6 +431,8 @@ int kvmppc_e500_emul_tlbwe(struct kvm_vcpu *vcpu)
                        kvmppc_set_tlb1map_range(vcpu, gtlbe);
        }
+        idx = srcu_read_lock(&vcpu->kvm->srcu);
        /* Invalidate shadow mappings for the about-to-be-clobbered TLBE. */
        if (tlbe_is_host_safe(vcpu, gtlbe)) {
                u64 eaddr = get_tlb_eaddr(gtlbe);
@@ -444,6 +447,8 @@ int kvmppc_e500_emul_tlbwe(struct kvm_vcpu *vcpu)
                kvmppc_mmu_map(vcpu, eaddr, raddr, index_of(tlbsel, esel));
        }
+        srcu_read_unlock(&vcpu->kvm->srcu, idx);
        kvmppc_set_exit_type(vcpu, EMULATED_TLBWE_EXITS);
        return EMULATE_DONE;
 }
diff --git a/arch/powerpc/kvm/e500mc.c b/arch/powerpc/kvm/e500mc.c
index 753cc99eff2b..19c8379575f7 100644
--- a/arch/powerpc/kvm/e500mc.c
+++ b/arch/powerpc/kvm/e500mc.c
@@ -177,8 +177,6 @@ int kvmppc_core_check_processor_compat(void)
                r = 0;
        else if (strcmp(cur_cpu_spec->cpu_name, "e5500") == 0)
                r = 0;
-        else if (strcmp(cur_cpu_spec->cpu_name, "e6500") == 0)
-                r = 0;
        else
                r = -ENOTSUPP;
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 845c867444e6..29c6482890c8 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -1758,7 +1758,7 @@ static void perf_event_interrupt(struct pt_regs *regs)
                        }
                }
        }
-        if ((!found) && printk_ratelimit())
+        if (!found && !nmi && printk_ratelimit())
                printk(KERN_WARNING "Can't find PMC that caused IRQ\n");
        /*
diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
index 19506f935737..b456b157d33d 100644
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -83,7 +83,11 @@ static int pseries_eeh_init(void)
        ibm_configure_pe                = rtas_token("ibm,configure-pe");
        ibm_configure_bridge            = rtas_token("ibm,configure-bridge");
-        /* necessary sanity check */
+        /*
+         * Necessary sanity check. We needn't check "get-config-addr-info"
+         * and its variant since the old firmware probably support address
+         * of domain/bus/slot/function for EEH RTAS operations.
+         */
        if (ibm_set_eeh_option == RTAS_UNKNOWN_SERVICE) {
                pr_warning("%s: RTAS service <ibm,set-eeh-option> invalid\n",
                        __func__);
@@ -102,12 +106,6 @@ static int pseries_eeh_init(void)
                pr_warning("%s: RTAS service <ibm,slot-error-detail> invalid\n",
                        __func__);
                return -EINVAL;
-        } else if (ibm_get_config_addr_info2 == RTAS_UNKNOWN_SERVICE &&
-                   ibm_get_config_addr_info == RTAS_UNKNOWN_SERVICE) {
-                pr_warning("%s: RTAS service <ibm,get-config-addr-info2> and "
-                        "<ibm,get-config-addr-info> invalid\n",
-                        __func__);
-                return -EINVAL;
        } else if (ibm_configure_pe == RTAS_UNKNOWN_SERVICE &&
                   ibm_configure_bridge == RTAS_UNKNOWN_SERVICE) {
                pr_warning("%s: RTAS service <ibm,configure-pe> and "
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index ac01463038f1..e8b6e5b8932c 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -623,7 +623,7 @@ static inline pgste_t pgste_get_lock(pte_t *ptep)
                "       csg     %0,%1,%2\n"
                "       jl      0b\n"
                : "=&d" (old), "=&d" (new), "=Q" (ptep[PTRS_PER_PTE])
-                : "Q" (ptep[PTRS_PER_PTE]) : "cc");
+                : "Q" (ptep[PTRS_PER_PTE]) : "cc", "memory");
 #endif
        return __pgste(new);
 }
@@ -635,11 +635,19 @@ static inline void pgste_set_unlock(pte_t *ptep, pgste_t pgste)
                "       nihh    %1,0xff7f\n"    /* clear RCP_PCL_BIT */
                "       stg     %1,%0\n"
                : "=Q" (ptep[PTRS_PER_PTE])
-                : "d" (pgste_val(pgste)), "Q" (ptep[PTRS_PER_PTE]) : "cc");
+                : "d" (pgste_val(pgste)), "Q" (ptep[PTRS_PER_PTE])
+                : "cc", "memory");
        preempt_enable();
 #endif
 }
+static inline void pgste_set(pte_t *ptep, pgste_t pgste)
+{
+#ifdef CONFIG_PGSTE
+        *(pgste_t *)(ptep + PTRS_PER_PTE) = pgste;
+#endif
+}
 static inline pgste_t pgste_update_all(pte_t *ptep, pgste_t pgste)
 {
 #ifdef CONFIG_PGSTE
@@ -704,17 +712,19 @@ static inline void pgste_set_key(pte_t *ptep, pgste_t pgste, pte_t entry)
 {
 #ifdef CONFIG_PGSTE
        unsigned long address;
-        unsigned long okey, nkey;
+        unsigned long nkey;
        if (pte_val(entry) & _PAGE_INVALID)
                return;
+        VM_BUG_ON(!(pte_val(*ptep) & _PAGE_INVALID));
        address = pte_val(entry) & PAGE_MASK;
-        okey = nkey = page_get_storage_key(address);
+        /*
-        nkey &= ~(_PAGE_ACC_BITS | _PAGE_FP_BIT);
+         * Set page access key and fetch protection bit from pgste.
-        /* Set page access key and fetch protection bit from pgste */
+         * The guest C/R information is still in the PGSTE, set real
-        nkey |= (pgste_val(pgste) & (RCP_ACC_BITS | RCP_FP_BIT)) >> 56;
+         * key C/R to 0.
-        if (okey != nkey)
+         */
-                page_set_storage_key(address, nkey, 0);
+        nkey = (pgste_val(pgste) & (RCP_ACC_BITS | RCP_FP_BIT)) >> 56;
+        page_set_storage_key(address, nkey, 0);
 #endif
 }
@@ -1099,8 +1109,10 @@ static inline pte_t ptep_modify_prot_start(struct mm_struct *mm,
        if (!mm_exclusive(mm))
                __ptep_ipte(address, ptep);
-        if (mm_has_pgste(mm))
+        if (mm_has_pgste(mm)) {
                pgste = pgste_update_all(&pte, pgste);
+                pgste_set(ptep, pgste);
+        }
        return pte;
 }
diff --git a/arch/s390/kernel/dumpstack.c b/arch/s390/kernel/dumpstack.c
index 298297477257..87acc38f73c6 100644
--- a/arch/s390/kernel/dumpstack.c
+++ b/arch/s390/kernel/dumpstack.c
@@ -74,6 +74,8 @@ __show_trace(unsigned long sp, unsigned long low, unsigned long high)
 static void show_trace(struct task_struct *task, unsigned long *stack)
 {
+        const unsigned long frame_size =
+                STACK_FRAME_OVERHEAD + sizeof(struct pt_regs);
        register unsigned long __r15 asm ("15");
        unsigned long sp;
@@ -82,11 +84,13 @@ static void show_trace(struct task_struct *task, unsigned long *stack)
                sp = task ? task->thread.ksp : __r15;
        printk("Call Trace:\n");
 #ifdef CONFIG_CHECK_STACK
-        sp = __show_trace(sp, S390_lowcore.panic_stack - 4096,
+        sp = __show_trace(sp,
-                          S390_lowcore.panic_stack);
+                          S390_lowcore.panic_stack + frame_size - 4096,
+                          S390_lowcore.panic_stack + frame_size);
 #endif
-        sp = __show_trace(sp, S390_lowcore.async_stack - ASYNC_SIZE,
+        sp = __show_trace(sp,
-                          S390_lowcore.async_stack);
+                          S390_lowcore.async_stack + frame_size - ASYNC_SIZE,
+                          S390_lowcore.async_stack + frame_size);
        if (task)
                __show_trace(sp, (unsigned long) task_stack_page(task),
                             (unsigned long) task_stack_page(task) + THREAD_SIZE);
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index f7fb58903f6a..408e866ae548 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -311,3 +311,67 @@ void measurement_alert_subclass_unregister(void)
        spin_unlock(&ma_subclass_lock);
 }
 EXPORT_SYMBOL(measurement_alert_subclass_unregister);
+void synchronize_irq(unsigned int irq)
+{
+        /*
+         * Not needed, the handler is protected by a lock and IRQs that occur
+         * after the handler is deleted are just NOPs.
+         */
+}
+EXPORT_SYMBOL_GPL(synchronize_irq);
+#ifndef CONFIG_PCI
+/* Only PCI devices have dynamically-defined IRQ handlers */
+int request_irq(unsigned int irq, irq_handler_t handler,
+                unsigned long irqflags, const char *devname, void *dev_id)
+{
+        return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(request_irq);
+void free_irq(unsigned int irq, void *dev_id)
+{
+        WARN_ON(1);
+}
+EXPORT_SYMBOL_GPL(free_irq);
+void enable_irq(unsigned int irq)
+{
+        WARN_ON(1);
+}
+EXPORT_SYMBOL_GPL(enable_irq);
+void disable_irq(unsigned int irq)
+{
+        WARN_ON(1);
+}
+EXPORT_SYMBOL_GPL(disable_irq);
+#endif /* !CONFIG_PCI */
+void disable_irq_nosync(unsigned int irq)
+{
+        disable_irq(irq);
+}
+EXPORT_SYMBOL_GPL(disable_irq_nosync);
+unsigned long probe_irq_on(void)
+{
+        return 0;
+}
+EXPORT_SYMBOL_GPL(probe_irq_on);
+int probe_irq_off(unsigned long val)
+{
+        return 0;
+}
+EXPORT_SYMBOL_GPL(probe_irq_off);
+unsigned int probe_irq_mask(unsigned long val)
+{
+        return val;
+}
+EXPORT_SYMBOL_GPL(probe_irq_mask);
diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
index b6506ee32a36..29bd7bec4176 100644
--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -225,7 +225,7 @@ _sclp_print:
        ahi     %r2,1
        ltr     %r0,%r0                         # end of string?
        jz      .LfinalizemtoS4
-        chi     %r0,0x15                        # end of line (NL)?
+        chi     %r0,0x0a                        # end of line (NL)?
        jz      .LfinalizemtoS4
        stc     %r0,0(%r6,%r7)                  # copy to mto
        la      %r11,0(%r6,%r7)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index e6f15b5d8b7d..f1e5be85d592 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -302,15 +302,6 @@ static int zpci_cfg_store(struct zpci_dev *zdev, int offset, u32 val, u8 len)
        return rc;
 }
-void synchronize_irq(unsigned int irq)
-{
-        /*
-         * Not needed, the handler is protected by a lock and IRQs that occur
-         * after the handler is deleted are just NOPs.
-         */
-}
-EXPORT_SYMBOL_GPL(synchronize_irq);
 void enable_irq(unsigned int irq)
 {
        struct msi_desc *msi = irq_get_msi_desc(irq);
@@ -327,30 +318,6 @@ void disable_irq(unsigned int irq)
 }
 EXPORT_SYMBOL_GPL(disable_irq);
-void disable_irq_nosync(unsigned int irq)
-{
-        disable_irq(irq);
-}
-EXPORT_SYMBOL_GPL(disable_irq_nosync);
-unsigned long probe_irq_on(void)
-{
-        return 0;
-}
-EXPORT_SYMBOL_GPL(probe_irq_on);
-int probe_irq_off(unsigned long val)
-{
-        return 0;
-}
-EXPORT_SYMBOL_GPL(probe_irq_off);
-unsigned int probe_irq_mask(unsigned long val)
-{
-        return val;
-}
-EXPORT_SYMBOL_GPL(probe_irq_mask);
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
 }
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index fb44426fe931..d99cae8147d1 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -17,6 +17,7 @@
 #include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/irq_work.h>
+#include <linux/tick.h>
 #include <asm/paravirt.h>
 #include <asm/desc.h>
@@ -447,6 +448,13 @@ static void __cpuinit xen_play_dead(void) /* used only with HOTPLUG_CPU */
        play_dead_common();
        HYPERVISOR_vcpu_op(VCPUOP_down, smp_processor_id(), NULL);
        cpu_bringup();
+        /*
+         * commit 4b0c0f294 (tick: Cleanup NOHZ per cpu data on cpu down)
+         * clears certain data that the cpu_idle loop (which called us
+         * and that we return from) expects. The only way to get that
+         * data back is to call:
+         */
+        tick_nohz_idle_enter();
 }
 #else /* !CONFIG_HOTPLUG_CPU */
diff --git a/block/blk-core.c b/block/blk-core.c
index 33c33bc99ddd..d5745b5833c9 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -3164,7 +3164,7 @@ void blk_post_runtime_resume(struct request_queue *q, int err)
                q->rpm_status = RPM_ACTIVE;
                __blk_run_queue(q);
                pm_runtime_mark_last_busy(q->dev);
-                pm_runtime_autosuspend(q->dev);
+                pm_request_autosuspend(q->dev);
        } else {
                q->rpm_status = RPM_SUSPENDED;
        }
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 622d8a48cbe9..bf8148e74e73 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -823,6 +823,7 @@ config CRYPTO_BLOWFISH_X86_64
 config CRYPTO_BLOWFISH_AVX2_X86_64
        tristate "Blowfish cipher algorithm (x86_64/AVX2)"
        depends on X86 && 64BIT
+        depends on BROKEN
        select CRYPTO_ALGAPI
        select CRYPTO_CRYPTD
        select CRYPTO_ABLK_HELPER_X86
@@ -1299,6 +1300,7 @@ config CRYPTO_TWOFISH_AVX_X86_64
 config CRYPTO_TWOFISH_AVX2_X86_64
        tristate "Twofish cipher algorithm (x86_64/AVX2)"
        depends on X86 && 64BIT
+        depends on BROKEN
        select CRYPTO_ALGAPI
        select CRYPTO_CRYPTD
        select CRYPTO_ABLK_HELPER_X86
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index aa0875f6f1b7..02f490bad30f 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -143,7 +143,7 @@ static int rbtree_show(struct seq_file *s, void *ignored)
        int registers = 0;
        int this_registers, average;
-        map->lock(map);
+        map->lock(map->lock_arg);
        mem_size = sizeof(*rbtree_ctx);
        mem_size += BITS_TO_LONGS(map->cache_present_nbits) * sizeof(long);
@@ -170,7 +170,7 @@ static int rbtree_show(struct seq_file *s, void *ignored)
        seq_printf(s, "%d nodes, %d registers, average %d registers, used %zu bytes\n",
                   nodes, registers, average, mem_size);
-        map->unlock(map);
+        map->unlock(map->lock_arg);
        return 0;
 }
@@ -391,8 +391,6 @@ static int regcache_rbtree_sync(struct regmap *map, unsigned int min,
        for (node = rb_first(&rbtree_ctx->root); node; node = rb_next(node)) {
                rbnode = rb_entry(node, struct regcache_rbtree_node, node);
-                if (rbnode->base_reg < min)
-                        continue;
                if (rbnode->base_reg > max)
                        break;
                if (rbnode->base_reg + rbnode->blklen < min)
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 75923f2396bd..507ee2da0f6e 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -270,7 +270,7 @@ int regcache_sync(struct regmap *map)
        BUG_ON(!map->cache_ops || !map->cache_ops->sync);
-        map->lock(map);
+        map->lock(map->lock_arg);
        /* Remember the initial bypass state */
        bypass = map->cache_bypass;
        dev_dbg(map->dev, "Syncing %s cache\n",
@@ -306,7 +306,7 @@ out:
        trace_regcache_sync(map->dev, name, "stop");
        /* Restore the bypass state */
        map->cache_bypass = bypass;
-        map->unlock(map);
+        map->unlock(map->lock_arg);
        return ret;
 }
@@ -333,7 +333,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
        BUG_ON(!map->cache_ops || !map->cache_ops->sync);
-        map->lock(map);
+        map->lock(map->lock_arg);
        /* Remember the initial bypass state */
        bypass = map->cache_bypass;
@@ -352,7 +352,7 @@ out:
        trace_regcache_sync(map->dev, name, "stop region");
        /* Restore the bypass state */
        map->cache_bypass = bypass;
-        map->unlock(map);
+        map->unlock(map->lock_arg);
        return ret;
 }
@@ -372,11 +372,11 @@ EXPORT_SYMBOL_GPL(regcache_sync_region);
 */
 void regcache_cache_only(struct regmap *map, bool enable)
 {
-        map->lock(map);
+        map->lock(map->lock_arg);
        WARN_ON(map->cache_bypass && enable);
        map->cache_only = enable;
        trace_regmap_cache_only(map->dev, enable);
-        map->unlock(map);
+        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_only);
@@ -391,9 +391,9 @@ EXPORT_SYMBOL_GPL(regcache_cache_only);
 */
 void regcache_mark_dirty(struct regmap *map)
 {
-        map->lock(map);
+        map->lock(map->lock_arg);
        map->cache_dirty = true;
-        map->unlock(map);
+        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_mark_dirty);
@@ -410,11 +410,11 @@ EXPORT_SYMBOL_GPL(regcache_mark_dirty);
 */
 void regcache_cache_bypass(struct regmap *map, bool enable)
 {
-        map->lock(map);
+        map->lock(map->lock_arg);
        WARN_ON(map->cache_only && enable);
        map->cache_bypass = enable;
        trace_regmap_cache_bypass(map->dev, enable);
-        map->unlock(map);
+        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_bypass);
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 23b701f5fd2f..975719bc3450 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -265,6 +265,7 @@ static ssize_t regmap_map_write_file(struct file *file,
        char *start = buf;
        unsigned long reg, value;
        struct regmap *map = file->private_data;
+        int ret;
        buf_size = min(count, (sizeof(buf)-1));
        if (copy_from_user(buf, user_buf, buf_size))
@@ -282,7 +283,9 @@ static ssize_t regmap_map_write_file(struct file *file,
        /* Userspace has been fiddling around behind the kernel's back */
        add_taint(TAINT_USER, LOCKDEP_NOW_UNRELIABLE);
-        regmap_write(map, reg, value);
+        ret = regmap_write(map, reg, value);
+        if (ret < 0)
+                return ret;
        return buf_size;
 }
 #else
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 6374dc103521..62b6c2cc80b5 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -168,8 +168,6 @@ static irqreturn_t do_cciss_msix_intr(int irq, void *dev_id);
 static int cciss_open(struct block_device *bdev, fmode_t mode);
 static int cciss_unlocked_open(struct block_device *bdev, fmode_t mode);
 static void cciss_release(struct gendisk *disk, fmode_t mode);
-static int do_ioctl(struct block_device *bdev, fmode_t mode,
-                    unsigned int cmd, unsigned long arg);
 static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
                       unsigned int cmd, unsigned long arg);
 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
@@ -235,7 +233,7 @@ static const struct block_device_operations cciss_fops = {
        .owner = THIS_MODULE,
        .open = cciss_unlocked_open,
        .release = cciss_release,
-        .ioctl = do_ioctl,
+        .ioctl = cciss_ioctl,
        .getgeo = cciss_getgeo,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = cciss_compat_ioctl,
@@ -1143,16 +1141,6 @@ static void cciss_release(struct gendisk *disk, fmode_t mode)
        mutex_unlock(&cciss_mutex);
 }
-static int do_ioctl(struct block_device *bdev, fmode_t mode,
-                    unsigned cmd, unsigned long arg)
-{
-        int ret;
-        mutex_lock(&cciss_mutex);
-        ret = cciss_ioctl(bdev, mode, cmd, arg);
-        mutex_unlock(&cciss_mutex);
-        return ret;
-}
 #ifdef CONFIG_COMPAT
 static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
@@ -1179,7 +1167,7 @@ static int cciss_compat_ioctl(struct block_device *bdev, fmode_t mode,
        case CCISS_REGNEWD:
        case CCISS_RESCANDISK:
        case CCISS_GETLUNINFO:
-                return do_ioctl(bdev, mode, cmd, arg);
+                return cciss_ioctl(bdev, mode, cmd, arg);
        case CCISS_PASSTHRU32:
                return cciss_ioctl32_passthru(bdev, mode, cmd, arg);
@@ -1219,7 +1207,7 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
        if (err)
                return -EFAULT;
-        err = do_ioctl(bdev, mode, CCISS_PASSTHRU, (unsigned long)p);
+        err = cciss_ioctl(bdev, mode, CCISS_PASSTHRU, (unsigned long)p);
        if (err)
                return err;
        err |=
@@ -1261,7 +1249,7 @@ static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
        if (err)
                return -EFAULT;
-        err = do_ioctl(bdev, mode, CCISS_BIG_PASSTHRU, (unsigned long)p);
+        err = cciss_ioctl(bdev, mode, CCISS_BIG_PASSTHRU, (unsigned long)p);
        if (err)
                return err;
        err |=
@@ -1311,11 +1299,14 @@ static int cciss_getpciinfo(ctlr_info_t *h, void __user *argp)
 static int cciss_getintinfo(ctlr_info_t *h, void __user *argp)
 {
        cciss_coalint_struct intinfo;
+        unsigned long flags;
        if (!argp)
                return -EINVAL;
+        spin_lock_irqsave(&h->lock, flags);
        intinfo.delay = readl(&h->cfgtable->HostWrite.CoalIntDelay);
        intinfo.count = readl(&h->cfgtable->HostWrite.CoalIntCount);
+        spin_unlock_irqrestore(&h->lock, flags);
        if (copy_to_user
            (argp, &intinfo, sizeof(cciss_coalint_struct)))
                return -EFAULT;
@@ -1356,12 +1347,15 @@ static int cciss_setintinfo(ctlr_info_t *h, void __user *argp)
 static int cciss_getnodename(ctlr_info_t *h, void __user *argp)
 {
        NodeName_type NodeName;
+        unsigned long flags;
        int i;
        if (!argp)
                return -EINVAL;
+        spin_lock_irqsave(&h->lock, flags);
        for (i = 0; i < 16; i++)
                NodeName[i] = readb(&h->cfgtable->ServerName[i]);
+        spin_unlock_irqrestore(&h->lock, flags);
        if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
                return -EFAULT;
        return 0;
@@ -1398,10 +1392,13 @@ static int cciss_setnodename(ctlr_info_t *h, void __user *argp)
 static int cciss_getheartbeat(ctlr_info_t *h, void __user *argp)
 {
        Heartbeat_type heartbeat;
+        unsigned long flags;
        if (!argp)
                return -EINVAL;
+        spin_lock_irqsave(&h->lock, flags);
        heartbeat = readl(&h->cfgtable->HeartBeat);
+        spin_unlock_irqrestore(&h->lock, flags);
        if (copy_to_user(argp, &heartbeat, sizeof(Heartbeat_type)))
                return -EFAULT;
        return 0;
@@ -1410,10 +1407,13 @@ static int cciss_getheartbeat(ctlr_info_t *h, void __user *argp)
 static int cciss_getbustypes(ctlr_info_t *h, void __user *argp)
 {
        BusTypes_type BusTypes;
+        unsigned long flags;
        if (!argp)
                return -EINVAL;
+        spin_lock_irqsave(&h->lock, flags);
        BusTypes = readl(&h->cfgtable->BusTypes);
+        spin_unlock_irqrestore(&h->lock, flags);
        if (copy_to_user(argp, &BusTypes, sizeof(BusTypes_type)))
                return -EFAULT;
        return 0;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 847107ef0cce..20dd52a2f92f 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3002,7 +3002,8 @@ static int mtip_hw_debugfs_init(struct driver_data *dd)
 static void mtip_hw_debugfs_exit(struct driver_data *dd)
 {
-        debugfs_remove_recursive(dd->dfs_node);
+        if (dd->dfs_node)
+                debugfs_remove_recursive(dd->dfs_node);
 }
@@ -3863,7 +3864,7 @@ static void mtip_make_request(struct request_queue *queue, struct bio *bio)
        struct driver_data *dd = queue->queuedata;
        struct scatterlist *sg;
        struct bio_vec *bvec;
-        int nents = 0;
+        int i, nents = 0;
        int tag = 0, unaligned = 0;
        if (unlikely(dd->dd_flag & MTIP_DDF_STOP_IO)) {
@@ -3921,11 +3922,12 @@ static void mtip_make_request(struct request_queue *queue, struct bio *bio)
                }
                /* Create the scatter list for this bio. */
-                bio_for_each_segment(bvec, bio, nents) {
+                bio_for_each_segment(bvec, bio, i) {
                        sg_set_page(&sg[nents],
                                        bvec->bv_page,
                                        bvec->bv_len,
                                        bvec->bv_offset);
+                        nents++;
                }
                /* Issue the read/write. */
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index 8efdfaa44a59..ce79a590b45b 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -629,7 +629,7 @@ static int nvme_submit_bio_queue(struct nvme_queue *nvmeq, struct nvme_ns *ns,
        struct nvme_command *cmnd;
        struct nvme_iod *iod;
        enum dma_data_direction dma_dir;
-        int cmdid, length, result = -ENOMEM;
+        int cmdid, length, result;
        u16 control;
        u32 dsmgmt;
        int psegs = bio_phys_segments(ns->queue, bio);
@@ -640,6 +640,7 @@ static int nvme_submit_bio_queue(struct nvme_queue *nvmeq, struct nvme_ns *ns,
                        return result;
        }
+        result = -ENOMEM;
        iod = nvme_alloc_iod(psegs, bio->bi_size, GFP_ATOMIC);
        if (!iod)
                goto nomem;
@@ -977,6 +978,8 @@ static void nvme_cancel_ios(struct nvme_queue *nvmeq, bool timeout)
                if (timeout && !time_after(now, info[cmdid].timeout))
                        continue;
+                if (info[cmdid].ctx == CMD_CTX_CANCELLED)
+                        continue;
                dev_warn(nvmeq->q_dmadev, "Cancelling I/O %d\n", cmdid);
                ctx = cancel_cmdid(nvmeq, cmdid, &fn);
                fn(nvmeq->dev, ctx, &cqe);
@@ -1206,7 +1209,7 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
        if (addr & 3)
                return ERR_PTR(-EINVAL);
-        if (!length)
+        if (!length || length > INT_MAX - PAGE_SIZE)
                return ERR_PTR(-EINVAL);
        offset = offset_in_page(addr);
@@ -1227,7 +1230,8 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
        sg_init_table(sg, count);
        for (i = 0; i < count; i++) {
                sg_set_page(&sg[i], pages[i],
-                                min_t(int, length, PAGE_SIZE - offset), offset);
+                            min_t(unsigned, length, PAGE_SIZE - offset),
+                            offset);
                length -= (PAGE_SIZE - offset);
                offset = 0;
        }
@@ -1435,7 +1439,7 @@ static int nvme_user_admin_cmd(struct nvme_dev *dev,
                nvme_free_iod(dev, iod);
        }
-        if (!status && copy_to_user(&ucmd->result, &cmd.result,
+        if ((status >= 0) && copy_to_user(&ucmd->result, &cmd.result,
                                                        sizeof(cmd.result)))
                status = -EFAULT;
@@ -1633,7 +1637,8 @@ static int set_queue_count(struct nvme_dev *dev, int count)
 static int nvme_setup_io_queues(struct nvme_dev *dev)
 {
-        int result, cpu, i, nr_io_queues, db_bar_size, q_depth;
+        struct pci_dev *pdev = dev->pci_dev;
+        int result, cpu, i, nr_io_queues, db_bar_size, q_depth, q_count;
        nr_io_queues = num_online_cpus();
        result = set_queue_count(dev, nr_io_queues);
@@ -1642,14 +1647,14 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
        if (result < nr_io_queues)
                nr_io_queues = result;
+        q_count = nr_io_queues;
        /* Deregister the admin queue's interrupt */
        free_irq(dev->entry[0].vector, dev->queues[0]);
        db_bar_size = 4096 + ((nr_io_queues + 1) << (dev->db_stride + 3));
        if (db_bar_size > 8192) {
                iounmap(dev->bar);
-                dev->bar = ioremap(pci_resource_start(dev->pci_dev, 0),
+                dev->bar = ioremap(pci_resource_start(pdev, 0), db_bar_size);
-                                                                db_bar_size);
                dev->dbs = ((void __iomem *)dev->bar) + 4096;
                dev->queues[0]->q_db = dev->dbs;
        }
@@ -1657,19 +1662,36 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
        for (i = 0; i < nr_io_queues; i++)
                dev->entry[i].entry = i;
        for (;;) {
-                result = pci_enable_msix(dev->pci_dev, dev->entry,
+                result = pci_enable_msix(pdev, dev->entry, nr_io_queues);
-                                                                nr_io_queues);
                if (result == 0) {
                        break;
                } else if (result > 0) {
                        nr_io_queues = result;
                        continue;
                } else {
-                        nr_io_queues = 1;
+                        nr_io_queues = 0;
                        break;
                }
        }
+        if (nr_io_queues == 0) {
+                nr_io_queues = q_count;
+                for (;;) {
+                        result = pci_enable_msi_block(pdev, nr_io_queues);
+                        if (result == 0) {
+                                for (i = 0; i < nr_io_queues; i++)
+                                        dev->entry[i].vector = i + pdev->irq;
+                                break;
+                        } else if (result > 0) {
+                                nr_io_queues = result;
+                                continue;
+                        } else {
+                                nr_io_queues = 1;
+                                break;
+                        }
+                }
+        }
        result = queue_request_irq(dev, dev->queues[0], "nvme admin");
        /* XXX: handle failure here */
@@ -1850,7 +1872,10 @@ static void nvme_free_dev(struct kref *kref)
 {
        struct nvme_dev *dev = container_of(kref, struct nvme_dev, kref);
        nvme_dev_remove(dev);
-        pci_disable_msix(dev->pci_dev);
+        if (dev->pci_dev->msi_enabled)
+                pci_disable_msi(dev->pci_dev);
+        else if (dev->pci_dev->msix_enabled)
+                pci_disable_msix(dev->pci_dev);
        iounmap(dev->bar);
        nvme_release_instance(dev);
        nvme_release_prp_pools(dev);
@@ -1923,8 +1948,14 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        INIT_LIST_HEAD(&dev->namespaces);
        dev->pci_dev = pdev;
        pci_set_drvdata(pdev, dev);
-        dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
-        dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
+        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)))
+                dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
+        else if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)))
+                dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+        else
+                goto disable;
        result = nvme_set_instance(dev);
        if (result)
                goto disable;
@@ -1977,7 +2008,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 unmap:
        iounmap(dev->bar);
 disable_msix:
-        pci_disable_msix(pdev);
+        if (dev->pci_dev->msi_enabled)
+                pci_disable_msi(dev->pci_dev);
+        else if (dev->pci_dev->msix_enabled)
+                pci_disable_msix(dev->pci_dev);
        nvme_release_instance(dev);
        nvme_release_prp_pools(dev);
 disable:
diff --git a/drivers/block/nvme-scsi.c b/drivers/block/nvme-scsi.c
index fed54b039893..102de2f52b5c 100644
--- a/drivers/block/nvme-scsi.c
+++ b/drivers/block/nvme-scsi.c
@@ -44,7 +44,6 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <scsi/sg.h>
 #include <scsi/scsi.h>
@@ -1654,7 +1653,7 @@ static void nvme_trans_modesel_save_bd(struct nvme_ns *ns, u8 *parm_list,
        }
 }
-static u16 nvme_trans_modesel_get_mp(struct nvme_ns *ns, struct sg_io_hdr *hdr,
+static int nvme_trans_modesel_get_mp(struct nvme_ns *ns, struct sg_io_hdr *hdr,
                                        u8 *mode_page, u8 page_code)
 {
        int res = SNTI_TRANSLATION_SUCCESS;
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 3c08983e600a..f5d0ea11d9fd 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -83,7 +83,8 @@
 #define MAX_SPEED 0xffff
-#define ZONE(sector, pd) (((sector) + (pd)->offset) & ~((pd)->settings.size - 1))
+#define ZONE(sector, pd) (((sector) + (pd)->offset) & \
+                        ~(sector_t)((pd)->settings.size - 1))
 static DEFINE_MUTEX(pktcdvd_mutex);
 static struct pktcdvd_device *pkt_devs[MAX_WRITERS];
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index d6d314027b5d..3063452e55da 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -519,8 +519,8 @@ static const struct block_device_operations rbd_bd_ops = {
 };
 /*
- * Initialize an rbd client instance.
+ * Initialize an rbd client instance.  Success or not, this function
- * We own *ceph_opts.
+ * consumes ceph_opts.
 */
 static struct rbd_client *rbd_client_create(struct ceph_options *ceph_opts)
 {
@@ -675,7 +675,8 @@ static int parse_rbd_opts_token(char *c, void *private)
 /*
 * Get a ceph client with specific addr and configuration, if one does
- * not exist create it.
+ * not exist create it.  Either way, ceph_opts is consumed by this
+ * function.
 */
 static struct rbd_client *rbd_get_client(struct ceph_options *ceph_opts)
 {
@@ -4697,8 +4698,10 @@ out:
        return ret;
 }
-/* Undo whatever state changes are made by v1 or v2 image probe */
+/*
+ * Undo whatever state changes are made by v1 or v2 header info
+ * call.
+ */
 static void rbd_dev_unprobe(struct rbd_device *rbd_dev)
 {
        struct rbd_image_header *header;
@@ -4902,9 +4905,10 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
        int tmp;
        /*
-         * Get the id from the image id object.  If it's not a
+         * Get the id from the image id object.  Unless there's an
-         * format 2 image, we'll get ENOENT back, and we'll assume
+         * error, rbd_dev->spec->image_id will be filled in with
-         * it's a format 1 image.
+         * a dynamically-allocated string, and rbd_dev->image_format
+         * will be set to either 1 or 2.
         */
        ret = rbd_dev_image_id(rbd_dev);
        if (ret)
@@ -4992,7 +4996,6 @@ static ssize_t rbd_add(struct bus_type *bus,
                rc = PTR_ERR(rbdc);
                goto err_out_args;
        }
-        ceph_opts = NULL;       /* rbd_dev client now owns this */
        /* pick the pool */
        osdc = &rbdc->client->osdc;
@@ -5027,18 +5030,18 @@ static ssize_t rbd_add(struct bus_type *bus,
        rbd_dev->mapping.read_only = read_only;
        rc = rbd_dev_device_setup(rbd_dev);
-        if (!rc)
+        if (rc) {
-                return count;
+                rbd_dev_image_release(rbd_dev);
+                goto err_out_module;
+        }
+        return count;
-        rbd_dev_image_release(rbd_dev);
 err_out_rbd_dev:
        rbd_dev_destroy(rbd_dev);
 err_out_client:
        rbd_put_client(rbdc);
 err_out_args:
-        if (ceph_opts)
-                ceph_destroy_options(ceph_opts);
-        kfree(rbd_opts);
        rbd_spec_put(spec);
 err_out_module:
        module_put(THIS_MODULE);
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index fdfd61a2d523..11a6104a1e4f 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -201,7 +201,7 @@ config BT_MRVL
          The core driver to support Marvell Bluetooth devices.
          This driver is required if you want to support
-          Marvell Bluetooth devices, such as 8688/8787/8797.
+          Marvell Bluetooth devices, such as 8688/8787/8797/8897.
          Say Y here to compile Marvell Bluetooth driver
          into the kernel or say M to compile it as module.
@@ -214,7 +214,7 @@ config BT_MRVL_SDIO
          The driver for Marvell Bluetooth chipsets with SDIO interface.
          This driver is required if you want to use Marvell Bluetooth
-          devices with SDIO interface. Currently SD8688/SD8787/SD8797
+          devices with SDIO interface. Currently SD8688/SD8787/SD8797/SD8897
          chipsets are supported.
          Say Y here to compile support for Marvell BT-over-SDIO driver
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index c63488c54f4a..13693b7a0d5c 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -82,6 +82,23 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_87xx = {
        .io_port_2 = 0x7a,
 };
+static const struct btmrvl_sdio_card_reg btmrvl_reg_88xx = {
+        .cfg = 0x00,
+        .host_int_mask = 0x02,
+        .host_intstatus = 0x03,
+        .card_status = 0x50,
+        .sq_read_base_addr_a0 = 0x60,
+        .sq_read_base_addr_a1 = 0x61,
+        .card_revision = 0xbc,
+        .card_fw_status0 = 0xc0,
+        .card_fw_status1 = 0xc1,
+        .card_rx_len = 0xc2,
+        .card_rx_unit = 0xc3,
+        .io_port_0 = 0xd8,
+        .io_port_1 = 0xd9,
+        .io_port_2 = 0xda,
+};
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
        .helper         = "mrvl/sd8688_helper.bin",
        .firmware       = "mrvl/sd8688.bin",
@@ -103,6 +120,13 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
        .sd_blksz_fw_dl = 256,
 };
+static const struct btmrvl_sdio_device btmrvl_sdio_sd8897 = {
+        .helper         = NULL,
+        .firmware       = "mrvl/sd8897_uapsta.bin",
+        .reg            = &btmrvl_reg_88xx,
+        .sd_blksz_fw_dl = 256,
+};
 static const struct sdio_device_id btmrvl_sdio_ids[] = {
        /* Marvell SD8688 Bluetooth device */
        { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x9105),
@@ -116,6 +140,9 @@ static const struct sdio_device_id btmrvl_sdio_ids[] = {
        /* Marvell SD8797 Bluetooth device */
        { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x912A),
                        .driver_data = (unsigned long) &btmrvl_sdio_sd8797 },
+        /* Marvell SD8897 Bluetooth device */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x912E),
+                        .driver_data = (unsigned long) &btmrvl_sdio_sd8897 },
        { }     /* Terminating entry */
 };
@@ -1194,3 +1221,4 @@ MODULE_FIRMWARE("mrvl/sd8688_helper.bin");
 MODULE_FIRMWARE("mrvl/sd8688.bin");
 MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin");
 MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin");
+MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin");
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index a97bb6c1596c..c3dc1c04a5df 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -863,7 +863,7 @@ static struct of_device_id sahara_dt_ids[] = {
        { .compatible = "fsl,imx27-sahara" },
        { /* sentinel */ }
 };
-MODULE_DEVICE_TABLE(platform, sahara_dt_ids);
+MODULE_DEVICE_TABLE(of, sahara_dt_ids);
 static int sahara_probe(struct platform_device *pdev)
 {
diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c
index 3cfd0931fbfb..82430ad8ba62 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_display.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_display.c
@@ -1462,7 +1462,7 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
        size_t addr = 0;
        struct gtt_range *gt;
        struct drm_gem_object *obj;
-        int ret;
+        int ret = 0;
        /* if we want to turn of the cursor ignore width and height */
        if (!handle) {
@@ -1499,7 +1499,8 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
        if (obj->size < width * height * 4) {
                dev_dbg(dev->dev, "buffer is to small\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto unref_cursor;
        }
        gt = container_of(obj, struct gtt_range, gem);
@@ -1508,7 +1509,7 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
        ret = psb_gtt_pin(gt);
        if (ret) {
                dev_err(dev->dev, "Can not pin down handle 0x%x\n", handle);
-                return ret;
+                goto unref_cursor;
        }
        addr = gt->offset;      /* Or resource.start ??? */
@@ -1532,9 +1533,14 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
                                                        struct gtt_range, gem);
                psb_gtt_unpin(gt);
                drm_gem_object_unreference(psb_intel_crtc->cursor_obj);
-                psb_intel_crtc->cursor_obj = obj;
        }
-        return 0;
+        psb_intel_crtc->cursor_obj = obj;
+        return ret;
+unref_cursor:
+        drm_gem_object_unreference(obj);
+        return ret;
 }
 static int cdv_intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
@@ -1750,6 +1756,19 @@ static void cdv_intel_crtc_destroy(struct drm_crtc *crtc)
        kfree(psb_intel_crtc);
 }
+static void cdv_intel_crtc_disable(struct drm_crtc *crtc)
+{
+        struct gtt_range *gt;
+        struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+        crtc_funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
+        if (crtc->fb) {
+                gt = to_psb_fb(crtc->fb)->gtt;
+                psb_gtt_unpin(gt);
+        }
+}
 const struct drm_crtc_helper_funcs cdv_intel_helper_funcs = {
        .dpms = cdv_intel_crtc_dpms,
        .mode_fixup = cdv_intel_crtc_mode_fixup,
@@ -1757,6 +1776,7 @@ const struct drm_crtc_helper_funcs cdv_intel_helper_funcs = {
        .mode_set_base = cdv_intel_pipe_set_base,
        .prepare = cdv_intel_crtc_prepare,
        .commit = cdv_intel_crtc_commit,
+        .disable = cdv_intel_crtc_disable,
 };
 const struct drm_crtc_funcs cdv_intel_crtc_funcs = {
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index 1534e220097a..8b1b6d923abe 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -121,8 +121,8 @@ static int psbfb_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        unsigned long address;
        int ret;
        unsigned long pfn;
-        /* FIXME: assumes fb at stolen base which may not be true */
+        unsigned long phys_addr = (unsigned long)dev_priv->stolen_base +
-        unsigned long phys_addr = (unsigned long)dev_priv->stolen_base;
+                                  psbfb->gtt->offset;
        page_num = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
        address = (unsigned long)vmf->virtual_address - (vmf->pgoff << PAGE_SHIFT);
diff --git a/drivers/gpu/drm/gma500/psb_intel_display.c b/drivers/gpu/drm/gma500/psb_intel_display.c
index 6e8f42b61ff6..6666493789d1 100644
--- a/drivers/gpu/drm/gma500/psb_intel_display.c
+++ b/drivers/gpu/drm/gma500/psb_intel_display.c
@@ -843,7 +843,7 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc,
        struct gtt_range *cursor_gt = psb_intel_crtc->cursor_gt;
        struct drm_gem_object *obj;
        void *tmp_dst, *tmp_src;
-        int ret, i, cursor_pages;
+        int ret = 0, i, cursor_pages;
        /* if we want to turn of the cursor ignore width and height */
        if (!handle) {
@@ -880,7 +880,8 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc,
        if (obj->size < width * height * 4) {
                dev_dbg(dev->dev, "buffer is to small\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto unref_cursor;
        }
        gt = container_of(obj, struct gtt_range, gem);
@@ -889,13 +890,14 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc,
        ret = psb_gtt_pin(gt);
        if (ret) {
                dev_err(dev->dev, "Can not pin down handle 0x%x\n", handle);
-                return ret;
+                goto unref_cursor;
        }
        if (dev_priv->ops->cursor_needs_phys) {
                if (cursor_gt == NULL) {
                        dev_err(dev->dev, "No hardware cursor mem available");
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto unref_cursor;
                }
                /* Prevent overflow */
@@ -936,9 +938,14 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc,
                                                        struct gtt_range, gem);
                psb_gtt_unpin(gt);
                drm_gem_object_unreference(psb_intel_crtc->cursor_obj);
-                psb_intel_crtc->cursor_obj = obj;
        }
-        return 0;
+        psb_intel_crtc->cursor_obj = obj;
+        return ret;
+unref_cursor:
+        drm_gem_object_unreference(obj);
+        return ret;
 }
 static int psb_intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
@@ -1150,6 +1157,19 @@ static void psb_intel_crtc_destroy(struct drm_crtc *crtc)
        kfree(psb_intel_crtc);
 }
+static void psb_intel_crtc_disable(struct drm_crtc *crtc)
+{
+        struct gtt_range *gt;
+        struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+        crtc_funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
+        if (crtc->fb) {
+                gt = to_psb_fb(crtc->fb)->gtt;
+                psb_gtt_unpin(gt);
+        }
+}
 const struct drm_crtc_helper_funcs psb_intel_helper_funcs = {
        .dpms = psb_intel_crtc_dpms,
        .mode_fixup = psb_intel_crtc_mode_fixup,
@@ -1157,6 +1177,7 @@ const struct drm_crtc_helper_funcs psb_intel_helper_funcs = {
        .mode_set_base = psb_intel_pipe_set_base,
        .prepare = psb_intel_crtc_prepare,
        .commit = psb_intel_crtc_commit,
+        .disable = psb_intel_crtc_disable,
 };
 const struct drm_crtc_funcs psb_intel_crtc_funcs = {
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 4c47b449b775..d4ea6c265ce1 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1777,10 +1777,13 @@ static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
         * arranged in priority order.
         */
        intel_ddc_get_modes(connector, &intel_sdvo->ddc);
-        if (list_empty(&connector->probed_modes) == false)
-                goto end;
-        /* Fetch modes from VBT */
+        /*
+         * Fetch modes from VBT. For SDVO prefer the VBT mode since some
+         * SDVO->LVDS transcoders can't cope with the EDID mode. Since
+         * drm_mode_probed_add adds the mode at the head of the list we add it
+         * last.
+         */
        if (dev_priv->sdvo_lvds_vbt_mode != NULL) {
                newmode = drm_mode_duplicate(connector->dev,
                                             dev_priv->sdvo_lvds_vbt_mode);
@@ -1792,7 +1795,6 @@ static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
                }
        }
-end:
        list_for_each_entry(newmode, &connector->probed_modes, head) {
                if (newmode->type & DRM_MODE_TYPE_PREFERRED) {
                        intel_sdvo->sdvo_lvds_fixed_mode =
@@ -2790,12 +2792,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                        SDVOB_HOTPLUG_INT_STATUS_I915 : SDVOC_HOTPLUG_INT_STATUS_I915;
        }
-        /* Only enable the hotplug irq if we need it, to work around noisy
-         * hotplug lines.
-         */
-        if (intel_sdvo->hotplug_active)
-                intel_encoder->hpd_pin = HPD_SDVO_B ? HPD_SDVO_B : HPD_SDVO_C;
        intel_encoder->compute_config = intel_sdvo_compute_config;
        intel_encoder->disable = intel_disable_sdvo;
        intel_encoder->mode_set = intel_sdvo_mode_set;
@@ -2814,6 +2810,14 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                goto err_output;
        }
+        /* Only enable the hotplug irq if we need it, to work around noisy
+         * hotplug lines.
+         */
+        if (intel_sdvo->hotplug_active) {
+                intel_encoder->hpd_pin =
+                        intel_sdvo->is_sdvob ?  HPD_SDVO_B : HPD_SDVO_C;
+        }
        /*
         * Cloning SDVO with anything is often impossible, since the SDVO
         * encoder can request a special input timing mode. And even if that's
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index dc3ae5c56f56..d39a5cede0b0 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -264,9 +264,12 @@ static struct mt_class mt_classes[] = {
 static void mt_free_input_name(struct hid_input *hi)
 {
        struct hid_device *hdev = hi->report->device;
+        const char *name = hi->input->name;
-        if (hi->input->name != hdev->name)
+        if (name != hdev->name) {
-                kfree(hi->input->name);
+                hi->input->name = hdev->name;
+                kfree(name);
+        }
 }
 static ssize_t mt_show_quirks(struct device *dev,
@@ -1040,11 +1043,11 @@ static void mt_remove(struct hid_device *hdev)
        struct hid_input *hi;
        sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
-        hid_hw_stop(hdev);
        list_for_each_entry(hi, &hdev->inputs, list)
                mt_free_input_name(hi);
+        hid_hw_stop(hdev);
        kfree(td);
        hid_set_drvdata(hdev, NULL);
 }
diff --git a/drivers/hwmon/adm1021.c b/drivers/hwmon/adm1021.c
index 7e76922a4ba9..f920619cd6da 100644
--- a/drivers/hwmon/adm1021.c
+++ b/drivers/hwmon/adm1021.c
@@ -331,26 +331,68 @@ static int adm1021_detect(struct i2c_client *client,
        man_id = i2c_smbus_read_byte_data(client, ADM1021_REG_MAN_ID);
        dev_id = i2c_smbus_read_byte_data(client, ADM1021_REG_DEV_ID);
+        if (man_id < 0 || dev_id < 0)
+                return -ENODEV;
        if (man_id == 0x4d && dev_id == 0x01)
                type_name = "max1617a";
        else if (man_id == 0x41) {
                if ((dev_id & 0xF0) == 0x30)
                        type_name = "adm1023";
-                else
+                else if ((dev_id & 0xF0) == 0x00)
                        type_name = "adm1021";
+                else
+                        return -ENODEV;
        } else if (man_id == 0x49)
                type_name = "thmc10";
        else if (man_id == 0x23)
                type_name = "gl523sm";
        else if (man_id == 0x54)
                type_name = "mc1066";
-        /* LM84 Mfr ID in a different place, and it has more unused bits */
+        else {
-        else if (conv_rate == 0x00
+                int lte, rte, lhi, rhi, llo, rlo;
-                 && (config & 0x7F) == 0x00
-                 && (status & 0xAB) == 0x00)
+                /* extra checks for LM84 and MAX1617 to avoid misdetections */
-                type_name = "lm84";
-        else
+                llo = i2c_smbus_read_byte_data(client, ADM1021_REG_THYST_R(0));
-                type_name = "max1617";
+                rlo = i2c_smbus_read_byte_data(client, ADM1021_REG_THYST_R(1));
+                /* fail if any of the additional register reads failed */
+                if (llo < 0 || rlo < 0)
+                        return -ENODEV;
+                lte = i2c_smbus_read_byte_data(client, ADM1021_REG_TEMP(0));
+                rte = i2c_smbus_read_byte_data(client, ADM1021_REG_TEMP(1));
+                lhi = i2c_smbus_read_byte_data(client, ADM1021_REG_TOS_R(0));
+                rhi = i2c_smbus_read_byte_data(client, ADM1021_REG_TOS_R(1));
+                /*
+                 * Fail for negative temperatures and negative high limits.
+                 * This check also catches read errors on the tested registers.
+                 */
+                if ((s8)lte < 0 || (s8)rte < 0 || (s8)lhi < 0 || (s8)rhi < 0)
+                        return -ENODEV;
+                /* fail if all registers hold the same value */
+                if (lte == rte && lte == lhi && lte == rhi && lte == llo
+                    && lte == rlo)
+                        return -ENODEV;
+                /*
+                 * LM84 Mfr ID is in a different place,
+                 * and it has more unused bits.
+                 */
+                if (conv_rate == 0x00
+                    && (config & 0x7F) == 0x00
+                    && (status & 0xAB) == 0x00) {
+                        type_name = "lm84";
+                } else {
+                        /* fail if low limits are larger than high limits */
+                        if ((s8)llo > lhi || (s8)rlo > rhi)
+                                return -ENODEV;
+                        type_name = "max1617";
+                }
+        }
        pr_debug("Detected chip %s at adapter %d, address 0x%02x.\n",
                 type_name, i2c_adapter_id(adapter), client->addr);
diff --git a/drivers/md/bcache/Kconfig b/drivers/md/bcache/Kconfig
index 05c220d05e23..f950c9d29f3e 100644
--- a/drivers/md/bcache/Kconfig
+++ b/drivers/md/bcache/Kconfig
@@ -1,7 +1,6 @@
 config BCACHE
        tristate "Block device as cache"
-        select CLOSURES
        ---help---
        Allows a block device to be used as cache for other devices; uses
        a btree for indexing and the layout is optimized for SSDs.
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 340146d7c17f..d3e15b42a4ab 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -1241,7 +1241,7 @@ void bch_cache_set_stop(struct cache_set *);
 struct cache_set *bch_cache_set_alloc(struct cache_sb *);
 void bch_btree_cache_free(struct cache_set *);
 int bch_btree_cache_alloc(struct cache_set *);
-void bch_writeback_init_cached_dev(struct cached_dev *);
+void bch_cached_dev_writeback_init(struct cached_dev *);
 void bch_moving_init_cache_set(struct cache_set *);
 void bch_cache_allocator_exit(struct cache *ca);
diff --git a/drivers/md/bcache/stats.c b/drivers/md/bcache/stats.c
index 64e679449c2a..b8730e714d69 100644
--- a/drivers/md/bcache/stats.c
+++ b/drivers/md/bcache/stats.c
@@ -93,24 +93,6 @@ static struct attribute *bch_stats_files[] = {
 };
 static KTYPE(bch_stats);
-static void scale_accounting(unsigned long data);
-void bch_cache_accounting_init(struct cache_accounting *acc,
-                               struct closure *parent)
-{
-        kobject_init(&acc->total.kobj,          &bch_stats_ktype);
-        kobject_init(&acc->five_minute.kobj,    &bch_stats_ktype);
-        kobject_init(&acc->hour.kobj,           &bch_stats_ktype);
-        kobject_init(&acc->day.kobj,            &bch_stats_ktype);
-        closure_init(&acc->cl, parent);
-        init_timer(&acc->timer);
-        acc->timer.expires      = jiffies + accounting_delay;
-        acc->timer.data         = (unsigned long) acc;
-        acc->timer.function     = scale_accounting;
-        add_timer(&acc->timer);
-}
 int bch_cache_accounting_add_kobjs(struct cache_accounting *acc,
                                   struct kobject *parent)
 {
@@ -244,3 +226,19 @@ void bch_mark_sectors_bypassed(struct search *s, int sectors)
        atomic_add(sectors, &dc->accounting.collector.sectors_bypassed);
        atomic_add(sectors, &s->op.c->accounting.collector.sectors_bypassed);
 }
+void bch_cache_accounting_init(struct cache_accounting *acc,
+                               struct closure *parent)
+{
+        kobject_init(&acc->total.kobj,          &bch_stats_ktype);
+        kobject_init(&acc->five_minute.kobj,    &bch_stats_ktype);
+        kobject_init(&acc->hour.kobj,           &bch_stats_ktype);
+        kobject_init(&acc->day.kobj,            &bch_stats_ktype);
+        closure_init(&acc->cl, parent);
+        init_timer(&acc->timer);
+        acc->timer.expires      = jiffies + accounting_delay;
+        acc->timer.data         = (unsigned long) acc;
+        acc->timer.function     = scale_accounting;
+        add_timer(&acc->timer);
+}
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index c8046bc4aa57..f88e2b653a3f 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -634,11 +634,10 @@ static int open_dev(struct block_device *b, fmode_t mode)
        return 0;
 }
-static int release_dev(struct gendisk *b, fmode_t mode)
+static void release_dev(struct gendisk *b, fmode_t mode)
 {
        struct bcache_device *d = b->private_data;
        closure_put(&d->cl);
-        return 0;
 }
 static int ioctl_dev(struct block_device *b, fmode_t mode,
@@ -732,8 +731,7 @@ static void bcache_device_free(struct bcache_device *d)
        if (d->c)
                bcache_device_detach(d);
+        if (d->disk && d->disk->flags & GENHD_FL_UP)
-        if (d->disk)
                del_gendisk(d->disk);
        if (d->disk && d->disk->queue)
                blk_cleanup_queue(d->disk->queue);
@@ -756,12 +754,9 @@ static int bcache_device_init(struct bcache_device *d, unsigned block_size)
        if (!(d->bio_split = bioset_create(4, offsetof(struct bbio, bio))) ||
            !(d->unaligned_bvec = mempool_create_kmalloc_pool(1,
                                sizeof(struct bio_vec) * BIO_MAX_PAGES)) ||
-            bio_split_pool_init(&d->bio_split_hook))
+            bio_split_pool_init(&d->bio_split_hook) ||
+            !(d->disk = alloc_disk(1)) ||
-                return -ENOMEM;
+            !(q = blk_alloc_queue(GFP_KERNEL)))
-        d->disk = alloc_disk(1);
-        if (!d->disk)
                return -ENOMEM;
        snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", bcache_minor);
@@ -771,10 +766,6 @@ static int bcache_device_init(struct bcache_device *d, unsigned block_size)
        d->disk->fops           = &bcache_ops;
        d->disk->private_data   = d;
-        q = blk_alloc_queue(GFP_KERNEL);
-        if (!q)
-                return -ENOMEM;
        blk_queue_make_request(q, NULL);
        d->disk->queue                  = q;
        q->queuedata                    = d;
@@ -999,14 +990,17 @@ static void cached_dev_free(struct closure *cl)
        mutex_lock(&bch_register_lock);
-        bd_unlink_disk_holder(dc->bdev, dc->disk.disk);
+        if (atomic_read(&dc->running))
+                bd_unlink_disk_holder(dc->bdev, dc->disk.disk);
        bcache_device_free(&dc->disk);
        list_del(&dc->list);
        mutex_unlock(&bch_register_lock);
        if (!IS_ERR_OR_NULL(dc->bdev)) {
-                blk_sync_queue(bdev_get_queue(dc->bdev));
+                if (dc->bdev->bd_disk)
+                        blk_sync_queue(bdev_get_queue(dc->bdev));
                blkdev_put(dc->bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
        }
@@ -1028,73 +1022,67 @@ static void cached_dev_flush(struct closure *cl)
 static int cached_dev_init(struct cached_dev *dc, unsigned block_size)
 {
-        int err;
+        int ret;
        struct io *io;
+        struct request_queue *q = bdev_get_queue(dc->bdev);
-        closure_init(&dc->disk.cl, NULL);
-        set_closure_fn(&dc->disk.cl, cached_dev_flush, system_wq);
        __module_get(THIS_MODULE);
        INIT_LIST_HEAD(&dc->list);
+        closure_init(&dc->disk.cl, NULL);
+        set_closure_fn(&dc->disk.cl, cached_dev_flush, system_wq);
        kobject_init(&dc->disk.kobj, &bch_cached_dev_ktype);
-        bch_cache_accounting_init(&dc->accounting, &dc->disk.cl);
-        err = bcache_device_init(&dc->disk, block_size);
-        if (err)
-                goto err;
-        spin_lock_init(&dc->io_lock);
-        closure_init_unlocked(&dc->sb_write);
        INIT_WORK(&dc->detach, cached_dev_detach_finish);
+        closure_init_unlocked(&dc->sb_write);
+        INIT_LIST_HEAD(&dc->io_lru);
+        spin_lock_init(&dc->io_lock);
+        bch_cache_accounting_init(&dc->accounting, &dc->disk.cl);
        dc->sequential_merge            = true;
        dc->sequential_cutoff           = 4 << 20;
-        INIT_LIST_HEAD(&dc->io_lru);
-        dc->sb_bio.bi_max_vecs  = 1;
-        dc->sb_bio.bi_io_vec    = dc->sb_bio.bi_inline_vecs;
        for (io = dc->io; io < dc->io + RECENT_IO; io++) {
                list_add(&io->lru, &dc->io_lru);
                hlist_add_head(&io->hash, dc->io_hash + RECENT_IO);
        }
-        bch_writeback_init_cached_dev(dc);
+        ret = bcache_device_init(&dc->disk, block_size);
+        if (ret)
+                return ret;
+        set_capacity(dc->disk.disk,
+                     dc->bdev->bd_part->nr_sects - dc->sb.data_offset);
+        dc->disk.disk->queue->backing_dev_info.ra_pages =
+                max(dc->disk.disk->queue->backing_dev_info.ra_pages,
+                    q->backing_dev_info.ra_pages);
+        bch_cached_dev_request_init(dc);
+        bch_cached_dev_writeback_init(dc);
        return 0;
-err:
-        bcache_device_stop(&dc->disk);
-        return err;
 }
 /* Cached device - bcache superblock */
-static const char *register_bdev(struct cache_sb *sb, struct page *sb_page,
+static void register_bdev(struct cache_sb *sb, struct page *sb_page,
                                 struct block_device *bdev,
                                 struct cached_dev *dc)
 {
        char name[BDEVNAME_SIZE];
        const char *err = "cannot allocate memory";
-        struct gendisk *g;
        struct cache_set *c;
-        if (!dc || cached_dev_init(dc, sb->block_size << 9) != 0)
-                return err;
        memcpy(&dc->sb, sb, sizeof(struct cache_sb));
-        dc->sb_bio.bi_io_vec[0].bv_page = sb_page;
        dc->bdev = bdev;
        dc->bdev->bd_holder = dc;
-        g = dc->disk.disk;
+        bio_init(&dc->sb_bio);
+        dc->sb_bio.bi_max_vecs  = 1;
-        set_capacity(g, dc->bdev->bd_part->nr_sects - dc->sb.data_offset);
+        dc->sb_bio.bi_io_vec    = dc->sb_bio.bi_inline_vecs;
+        dc->sb_bio.bi_io_vec[0].bv_page = sb_page;
-        g->queue->backing_dev_info.ra_pages =
+        get_page(sb_page);
-                max(g->queue->backing_dev_info.ra_pages,
-                    bdev->bd_queue->backing_dev_info.ra_pages);
-        bch_cached_dev_request_init(dc);
+        if (cached_dev_init(dc, sb->block_size << 9))
+                goto err;
        err = "error creating kobject";
        if (kobject_add(&dc->disk.kobj, &part_to_dev(bdev->bd_part)->kobj,
@@ -1103,6 +1091,8 @@ static const char *register_bdev(struct cache_sb *sb, struct page *sb_page,
        if (bch_cache_accounting_add_kobjs(&dc->accounting, &dc->disk.kobj))
                goto err;
+        pr_info("registered backing device %s", bdevname(bdev, name));
        list_add(&dc->list, &uncached_devices);
        list_for_each_entry(c, &bch_cache_sets, list)
                bch_cached_dev_attach(dc, c);
@@ -1111,15 +1101,10 @@ static const char *register_bdev(struct cache_sb *sb, struct page *sb_page,
            BDEV_STATE(&dc->sb) == BDEV_STATE_STALE)
                bch_cached_dev_run(dc);
-        return NULL;
+        return;
 err:
-        kobject_put(&dc->disk.kobj);
        pr_notice("error opening %s: %s", bdevname(bdev, name), err);
-        /*
+        bcache_device_stop(&dc->disk);
-         * Return NULL instead of an error because kobject_put() cleans
-         * everything up
-         */
-        return NULL;
 }
 /* Flash only volumes */
@@ -1717,20 +1702,11 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
        size_t free;
        struct bucket *b;
-        if (!ca)
-                return -ENOMEM;
        __module_get(THIS_MODULE);
        kobject_init(&ca->kobj, &bch_cache_ktype);
-        memcpy(&ca->sb, sb, sizeof(struct cache_sb));
        INIT_LIST_HEAD(&ca->discards);
-        bio_init(&ca->sb_bio);
-        ca->sb_bio.bi_max_vecs  = 1;
-        ca->sb_bio.bi_io_vec    = ca->sb_bio.bi_inline_vecs;
        bio_init(&ca->journal.bio);
        ca->journal.bio.bi_max_vecs = 8;
        ca->journal.bio.bi_io_vec = ca->journal.bio.bi_inline_vecs;
@@ -1742,18 +1718,17 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
            !init_fifo(&ca->free_inc,   free << 2, GFP_KERNEL) ||
            !init_fifo(&ca->unused,     free << 2, GFP_KERNEL) ||
            !init_heap(&ca->heap,       free << 3, GFP_KERNEL) ||
-            !(ca->buckets       = vmalloc(sizeof(struct bucket) *
+            !(ca->buckets       = vzalloc(sizeof(struct bucket) *
                                          ca->sb.nbuckets)) ||
            !(ca->prio_buckets  = kzalloc(sizeof(uint64_t) * prio_buckets(ca) *
                                          2, GFP_KERNEL)) ||
            !(ca->disk_buckets  = alloc_bucket_pages(GFP_KERNEL, ca)) ||
            !(ca->alloc_workqueue = alloc_workqueue("bch_allocator", 0, 1)) ||
            bio_split_pool_init(&ca->bio_split_hook))
-                goto err;
+                return -ENOMEM;
        ca->prio_last_buckets = ca->prio_buckets + prio_buckets(ca);
-        memset(ca->buckets, 0, ca->sb.nbuckets * sizeof(struct bucket));
        for_each_bucket(b, ca)
                atomic_set(&b->pin, 0);
@@ -1766,22 +1741,28 @@ err:
        return -ENOMEM;
 }
-static const char *register_cache(struct cache_sb *sb, struct page *sb_page,
+static void register_cache(struct cache_sb *sb, struct page *sb_page,
                                  struct block_device *bdev, struct cache *ca)
 {
        char name[BDEVNAME_SIZE];
        const char *err = "cannot allocate memory";
-        if (cache_alloc(sb, ca) != 0)
+        memcpy(&ca->sb, sb, sizeof(struct cache_sb));
-                return err;
-        ca->sb_bio.bi_io_vec[0].bv_page = sb_page;
        ca->bdev = bdev;
        ca->bdev->bd_holder = ca;
+        bio_init(&ca->sb_bio);
+        ca->sb_bio.bi_max_vecs  = 1;
+        ca->sb_bio.bi_io_vec    = ca->sb_bio.bi_inline_vecs;
+        ca->sb_bio.bi_io_vec[0].bv_page = sb_page;
+        get_page(sb_page);
        if (blk_queue_discard(bdev_get_queue(ca->bdev)))
                ca->discard = CACHE_DISCARD(&ca->sb);
+        if (cache_alloc(sb, ca) != 0)
+                goto err;
        err = "error creating kobject";
        if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache"))
                goto err;
@@ -1791,15 +1772,10 @@ static const char *register_cache(struct cache_sb *sb, struct page *sb_page,
                goto err;
        pr_info("registered cache device %s", bdevname(bdev, name));
+        return;
-        return NULL;
 err:
+        pr_notice("error opening %s: %s", bdevname(bdev, name), err);
        kobject_put(&ca->kobj);
-        pr_info("error opening %s: %s", bdevname(bdev, name), err);
-        /* Return NULL instead of an error because kobject_put() cleans
-         * everything up
-         */
-        return NULL;
 }
 /* Global interfaces/init */
@@ -1833,12 +1809,15 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
        bdev = blkdev_get_by_path(strim(path),
                                  FMODE_READ|FMODE_WRITE|FMODE_EXCL,
                                  sb);
-        if (bdev == ERR_PTR(-EBUSY))
+        if (IS_ERR(bdev)) {
-                err = "device busy";
+                if (bdev == ERR_PTR(-EBUSY))
+                        err = "device busy";
-        if (IS_ERR(bdev) ||
-            set_blocksize(bdev, 4096))
                goto err;
+        }
+        err = "failed to set blocksize";
+        if (set_blocksize(bdev, 4096))
+                goto err_close;
        err = read_super(sb, bdev, &sb_page);
        if (err)
@@ -1846,33 +1825,33 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
        if (SB_IS_BDEV(sb)) {
                struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
+                if (!dc)
+                        goto err_close;
-                err = register_bdev(sb, sb_page, bdev, dc);
+                register_bdev(sb, sb_page, bdev, dc);
        } else {
                struct cache *ca = kzalloc(sizeof(*ca), GFP_KERNEL);
+                if (!ca)
+                        goto err_close;
-                err = register_cache(sb, sb_page, bdev, ca);
+                register_cache(sb, sb_page, bdev, ca);
        }
+out:
-        if (err) {
+        if (sb_page)
-                /* register_(bdev|cache) will only return an error if they
-                 * didn't get far enough to create the kobject - if they did,
-                 * the kobject destructor will do this cleanup.
-                 */
                put_page(sb_page);
-err_close:
-                blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
-err:
-                if (attr != &ksysfs_register_quiet)
-                        pr_info("error opening %s: %s", path, err);
-                ret = -EINVAL;
-        }
        kfree(sb);
        kfree(path);
        mutex_unlock(&bch_register_lock);
        module_put(THIS_MODULE);
        return ret;
+err_close:
+        blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+err:
+        if (attr != &ksysfs_register_quiet)
+                pr_info("error opening %s: %s", path, err);
+        ret = -EINVAL;
+        goto out;
 }
 static int bcache_reboot(struct notifier_block *n, unsigned long code, void *x)
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 93e7e31a4bd3..2714ed3991d1 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -375,7 +375,7 @@ err:
        refill_dirty(cl);
 }
-void bch_writeback_init_cached_dev(struct cached_dev *dc)
+void bch_cached_dev_writeback_init(struct cached_dev *dc)
 {
        closure_init_unlocked(&dc->writeback);
        init_rwsem(&dc->writeback_lock);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 681d1099a2d5..9b82377a833b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5268,8 +5268,8 @@ static void md_clean(struct mddev *mddev)
 static void __md_stop_writes(struct mddev *mddev)
 {
+        set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
        if (mddev->sync_thread) {
-                set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                md_reap_sync_thread(mddev);
        }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 55951182af73..6e17f8181c4b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -417,7 +417,17 @@ static void raid1_end_write_request(struct bio *bio, int error)
                r1_bio->bios[mirror] = NULL;
                to_put = bio;
-                set_bit(R1BIO_Uptodate, &r1_bio->state);
+                /*
+                 * Do not set R1BIO_Uptodate if the current device is
+                 * rebuilding or Faulty. This is because we cannot use
+                 * such device for properly reading the data back (we could
+                 * potentially use it, if the current write would have felt
+                 * before rdev->recovery_offset, but for simplicity we don't
+                 * check this here.
+                 */
+                if (test_bit(In_sync, &conf->mirrors[mirror].rdev->flags) &&
+                    !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags))
+                        set_bit(R1BIO_Uptodate, &r1_bio->state);
                /* Maybe we can clear some bad blocks. */
                if (is_badblock(conf->mirrors[mirror].rdev,
@@ -870,17 +880,17 @@ static void allow_barrier(struct r1conf *conf)
        wake_up(&conf->wait_barrier);
 }
-static void freeze_array(struct r1conf *conf)
+static void freeze_array(struct r1conf *conf, int extra)
 {
        /* stop syncio and normal IO and wait for everything to
         * go quite.
         * We increment barrier and nr_waiting, and then
-         * wait until nr_pending match nr_queued+1
+         * wait until nr_pending match nr_queued+extra
         * This is called in the context of one normal IO request
         * that has failed. Thus any sync request that might be pending
         * will be blocked by nr_pending, and we need to wait for
         * pending IO requests to complete or be queued for re-try.
-         * Thus the number queued (nr_queued) plus this request (1)
+         * Thus the number queued (nr_queued) plus this request (extra)
         * must match the number of pending IOs (nr_pending) before
         * we continue.
         */
@@ -888,7 +898,7 @@ static void freeze_array(struct r1conf *conf)
        conf->barrier++;
        conf->nr_waiting++;
        wait_event_lock_irq_cmd(conf->wait_barrier,
-                                conf->nr_pending == conf->nr_queued+1,
+                                conf->nr_pending == conf->nr_queued+extra,
                                conf->resync_lock,
                                flush_pending_writes(conf));
        spin_unlock_irq(&conf->resync_lock);
@@ -1544,8 +1554,8 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                 * we wait for all outstanding requests to complete.
                 */
                synchronize_sched();
-                raise_barrier(conf);
+                freeze_array(conf, 0);
-                lower_barrier(conf);
+                unfreeze_array(conf);
                clear_bit(Unmerged, &rdev->flags);
        }
        md_integrity_add_rdev(rdev, mddev);
@@ -1595,11 +1605,11 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
                         */
                        struct md_rdev *repl =
                                conf->mirrors[conf->raid_disks + number].rdev;
-                        raise_barrier(conf);
+                        freeze_array(conf, 0);
                        clear_bit(Replacement, &repl->flags);
                        p->rdev = repl;
                        conf->mirrors[conf->raid_disks + number].rdev = NULL;
-                        lower_barrier(conf);
+                        unfreeze_array(conf);
                        clear_bit(WantReplacement, &rdev->flags);
                } else
                        clear_bit(WantReplacement, &rdev->flags);
@@ -2195,7 +2205,7 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
         * frozen
         */
        if (mddev->ro == 0) {
-                freeze_array(conf);
+                freeze_array(conf, 1);
                fix_read_error(conf, r1_bio->read_disk,
                               r1_bio->sector, r1_bio->sectors);
                unfreeze_array(conf);
@@ -2780,8 +2790,8 @@ static int run(struct mddev *mddev)
                return PTR_ERR(conf);
        if (mddev->queue)
-                blk_queue_max_write_same_sectors(mddev->queue,
+                blk_queue_max_write_same_sectors(mddev->queue, 0);
-                                                 mddev->chunk_sectors);
        rdev_for_each(rdev, mddev) {
                if (!mddev->gendisk)
                        continue;
@@ -2963,7 +2973,7 @@ static int raid1_reshape(struct mddev *mddev)
                return -ENOMEM;
        }
-        raise_barrier(conf);
+        freeze_array(conf, 0);
        /* ok, everything is stopped */
        oldpool = conf->r1bio_pool;
@@ -2994,7 +3004,7 @@ static int raid1_reshape(struct mddev *mddev)
        conf->raid_disks = mddev->raid_disks = raid_disks;
        mddev->delta_disks = 0;
-        lower_barrier(conf);
+        unfreeze_array(conf);
        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
        md_wakeup_thread(mddev->thread);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 59d4daa5f4c7..6ddae2501b9a 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -490,7 +490,17 @@ static void raid10_end_write_request(struct bio *bio, int error)
                sector_t first_bad;
                int bad_sectors;
-                set_bit(R10BIO_Uptodate, &r10_bio->state);
+                /*
+                 * Do not set R10BIO_Uptodate if the current device is
+                 * rebuilding or Faulty. This is because we cannot use
+                 * such device for properly reading the data back (we could
+                 * potentially use it, if the current write would have felt
+                 * before rdev->recovery_offset, but for simplicity we don't
+                 * check this here.
+                 */
+                if (test_bit(In_sync, &rdev->flags) &&
+                    !test_bit(Faulty, &rdev->flags))
+                        set_bit(R10BIO_Uptodate, &r10_bio->state);
                /* Maybe we can clear some bad blocks. */
                if (is_badblock(rdev,
@@ -1055,17 +1065,17 @@ static void allow_barrier(struct r10conf *conf)
        wake_up(&conf->wait_barrier);
 }
-static void freeze_array(struct r10conf *conf)
+static void freeze_array(struct r10conf *conf, int extra)
 {
        /* stop syncio and normal IO and wait for everything to
         * go quiet.
         * We increment barrier and nr_waiting, and then
-         * wait until nr_pending match nr_queued+1
+         * wait until nr_pending match nr_queued+extra
         * This is called in the context of one normal IO request
         * that has failed. Thus any sync request that might be pending
         * will be blocked by nr_pending, and we need to wait for
         * pending IO requests to complete or be queued for re-try.
-         * Thus the number queued (nr_queued) plus this request (1)
+         * Thus the number queued (nr_queued) plus this request (extra)
         * must match the number of pending IOs (nr_pending) before
         * we continue.
         */
@@ -1073,7 +1083,7 @@ static void freeze_array(struct r10conf *conf)
        conf->barrier++;
        conf->nr_waiting++;
        wait_event_lock_irq_cmd(conf->wait_barrier,
-                                conf->nr_pending == conf->nr_queued+1,
+                                conf->nr_pending == conf->nr_queued+extra,
                                conf->resync_lock,
                                flush_pending_writes(conf));
@@ -1837,8 +1847,8 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                 * we wait for all outstanding requests to complete.
                 */
                synchronize_sched();
-                raise_barrier(conf, 0);
+                freeze_array(conf, 0);
-                lower_barrier(conf);
+                unfreeze_array(conf);
                clear_bit(Unmerged, &rdev->flags);
        }
        md_integrity_add_rdev(rdev, mddev);
@@ -2612,7 +2622,7 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio)
        r10_bio->devs[slot].bio = NULL;
        if (mddev->ro == 0) {
-                freeze_array(conf);
+                freeze_array(conf, 1);
                fix_read_error(conf, mddev, r10_bio);
                unfreeze_array(conf);
        } else
@@ -3609,8 +3619,7 @@ static int run(struct mddev *mddev)
        if (mddev->queue) {
                blk_queue_max_discard_sectors(mddev->queue,
                                              mddev->chunk_sectors);
-                blk_queue_max_write_same_sectors(mddev->queue,
+                blk_queue_max_write_same_sectors(mddev->queue, 0);
-                                                 mddev->chunk_sectors);
                blk_queue_io_min(mddev->queue, chunk_size);
                if (conf->geo.raid_disks % conf->geo.near_copies)
                        blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 9359828ffe26..05e4a105b9c7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -664,6 +664,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
                                bi->bi_rw |= REQ_FLUSH;
+                        bi->bi_vcnt = 1;
                        bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                        bi->bi_io_vec[0].bv_offset = 0;
                        bi->bi_size = STRIPE_SIZE;
@@ -701,6 +702,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        else
                                rbi->bi_sector = (sh->sector
                                                  + rrdev->data_offset);
+                        rbi->bi_vcnt = 1;
                        rbi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                        rbi->bi_io_vec[0].bv_offset = 0;
                        rbi->bi_size = STRIPE_SIZE;
@@ -5464,7 +5466,7 @@ static int run(struct mddev *mddev)
                if (mddev->major_version == 0 &&
                    mddev->minor_version > 90)
                        rdev->recovery_offset = reshape_offset;
-                        
                if (rdev->recovery_offset < reshape_offset) {
                        /* We need to check old and new layout */
                        if (!only_parity(rdev->raid_disk,
@@ -5587,6 +5589,8 @@ static int run(struct mddev *mddev)
                 */
                mddev->queue->limits.discard_zeroes_data = 0;
+                blk_queue_max_write_same_sectors(mddev->queue, 0);
                rdev_for_each(rdev, mddev) {
                        disk_stack_limits(mddev->gendisk, rdev->bdev,
                                          rdev->data_offset << 9);
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 44d273c5e19d..0535d1e0bc78 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -172,6 +172,7 @@ static long gru_get_config_info(unsigned long arg)
                nodesperblade = 2;
        else
                nodesperblade = 1;
+        memset(&info, 0, sizeof(info));
        info.cpus = num_online_cpus();
        info.nodes = num_online_nodes();
        info.blades = info.nodes / nodesperblade;
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 42e9dd05c936..b4479b5aaee4 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -897,8 +897,8 @@ static int sh_eth_check_reset(struct net_device *ndev)
                mdelay(1);
                cnt--;
        }
-        if (cnt < 0) {
+        if (cnt <= 0) {
-                pr_err("Device reset fail\n");
+                pr_err("Device reset failed\n");
                ret = -ETIMEDOUT;
        }
        return ret;
diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
index 12aec173564c..b2275d1b19b3 100644
--- a/drivers/net/ethernet/ti/davinci_mdio.c
+++ b/drivers/net/ethernet/ti/davinci_mdio.c
@@ -449,10 +449,9 @@ static int davinci_mdio_suspend(struct device *dev)
        __raw_writel(ctrl, &data->regs->control);
        wait_for_idle(data);
-        pm_runtime_put_sync(data->dev);
        data->suspended = true;
        spin_unlock(&data->lock);
+        pm_runtime_put_sync(data->dev);
        return 0;
 }
@@ -462,9 +461,9 @@ static int davinci_mdio_resume(struct device *dev)
        struct davinci_mdio_data *data = dev_get_drvdata(dev);
        u32 ctrl;
-        spin_lock(&data->lock);
        pm_runtime_get_sync(data->dev);
+        spin_lock(&data->lock);
        /* restart the scan state machine */
        ctrl = __raw_readl(&data->regs->control);
        ctrl |= CONTROL_ENABLE;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index d016a76ad44b..b3051052f3ad 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1092,8 +1092,8 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
        }
        port->index = -1;
-        team_port_enable(team, port);
        list_add_tail_rcu(&port->list, &team->port_list);
+        team_port_enable(team, port);
        __team_compute_features(team);
        __team_port_change_port_added(port, !!netif_carrier_ok(port_dev));
        __team_options_change_check(team);
diff --git a/drivers/net/team/team_mode_random.c b/drivers/net/team/team_mode_random.c
index 5ca14d463ba7..7f032e211343 100644
--- a/drivers/net/team/team_mode_random.c
+++ b/drivers/net/team/team_mode_random.c
@@ -28,6 +28,8 @@ static bool rnd_transmit(struct team *team, struct sk_buff *skb)
        port_index = random_N(team->en_port_count);
        port = team_get_port_by_index_rcu(team, port_index);
+        if (unlikely(!port))
+                goto drop;
        port = team_get_first_port_txable_rcu(team, port);
        if (unlikely(!port))
                goto drop;
diff --git a/drivers/net/team/team_mode_roundrobin.c b/drivers/net/team/team_mode_roundrobin.c
index d268e4de781b..472623f8ce3d 100644
--- a/drivers/net/team/team_mode_roundrobin.c
+++ b/drivers/net/team/team_mode_roundrobin.c
@@ -32,6 +32,8 @@ static bool rr_transmit(struct team *team, struct sk_buff *skb)
        port_index = rr_priv(team)->sent_packets++ % team->en_port_count;
        port = team_get_port_by_index_rcu(team, port_index);
+        if (unlikely(!port))
+                goto drop;
        port = team_get_first_port_txable_rcu(team, port);
        if (unlikely(!port))
                goto drop;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 89776c592151..bfa9bb48e42d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -352,7 +352,7 @@ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
        u32 numqueues = 0;
        rcu_read_lock();
-        numqueues = tun->numqueues;
+        numqueues = ACCESS_ONCE(tun->numqueues);
        txq = skb_get_rxhash(skb);
        if (txq) {
@@ -2159,6 +2159,8 @@ static int tun_chr_open(struct inode *inode, struct file * file)
        set_bit(SOCK_EXTERNALLY_ALLOCATED, &tfile->socket.flags);
        INIT_LIST_HEAD(&tfile->next);
+        sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
        return 0;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 078795fe6e31..04ee044dde51 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -627,6 +627,12 @@ static const struct usb_device_id	products [] = {
        .driver_info = 0,
 },
+/* Huawei E1820 - handled by qmi_wwan */
+{
+        USB_DEVICE_INTERFACE_NUMBER(HUAWEI_VENDOR_ID, 0x14ac, 1),
+        .driver_info = 0,
+},
 /* Realtek RTL8152 Based USB 2.0 Ethernet Adapters */
 #if defined(CONFIG_USB_RTL8152) || defined(CONFIG_USB_RTL8152_MODULE)
 {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 86adfa0a912e..d095d0d3056b 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -519,6 +519,7 @@ static const struct usb_device_id products[] = {
        /* 3. Combined interface devices matching on interface number */
        {QMI_FIXED_INTF(0x0408, 0xea42, 4)},    /* Yota / Megafon M100-1 */
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
+        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
        {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
        {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
        {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index f3dc124c60c7..3c2cbc9d6295 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -92,13 +92,17 @@ config ATH9K_MAC_DEBUG
          This option enables collection of statistics for Rx/Tx status
          data and some other MAC related statistics
-config ATH9K_RATE_CONTROL
+config ATH9K_LEGACY_RATE_CONTROL
        bool "Atheros ath9k rate control"
        depends on ATH9K
-        default y
+        default n
        ---help---
          Say Y, if you want to use the ath9k specific rate control
-          module instead of minstrel_ht.
+          module instead of minstrel_ht. Be warned that there are various
+          issues with the ath9k RC and minstrel is a more robust algorithm.
+          Note that even if this option is selected, "ath9k_rate_control"
+          has to be passed to mac80211 using the module parameter,
+          ieee80211_default_rc_algo.
 config ATH9K_HTC
       tristate "Atheros HTC based wireless cards support"
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 2ad8f9474ba1..75ee9e7704ce 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -8,7 +8,7 @@ ath9k-y +=	beacon.o \
                antenna.o
 ath9k-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += mci.o
-ath9k-$(CONFIG_ATH9K_RATE_CONTROL) += rc.o
+ath9k-$(CONFIG_ATH9K_LEGACY_RATE_CONTROL) += rc.o
 ath9k-$(CONFIG_ATH9K_PCI) += pci.o
 ath9k-$(CONFIG_ATH9K_AHB) += ahb.o
 ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index db5ffada2217..7546b9a7dcbf 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -958,11 +958,11 @@ static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
        {0x0000a074, 0x00000000},
        {0x0000a078, 0x00000000},
        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x1a1a1a1a},
+        {0x0000a080, 0x22222229},
-        {0x0000a084, 0x1a1a1a1a},
+        {0x0000a084, 0x1d1d1d1d},
-        {0x0000a088, 0x1a1a1a1a},
+        {0x0000a088, 0x1d1d1d1d},
-        {0x0000a08c, 0x1a1a1a1a},
+        {0x0000a08c, 0x1d1d1d1d},
-        {0x0000a090, 0x171a1a1a},
+        {0x0000a090, 0x171d1d1d},
        {0x0000a094, 0x11111717},
        {0x0000a098, 0x00030311},
        {0x0000a09c, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index aba415103f94..2ba494567777 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -787,8 +787,7 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
        hw->wiphy->iface_combinations = if_comb;
        hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
-        if (AR_SREV_5416(sc->sc_ah))
+        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-                hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
@@ -830,10 +829,6 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
        sc->ant_rx = hw->wiphy->available_antennas_rx;
        sc->ant_tx = hw->wiphy->available_antennas_tx;
-#ifdef CONFIG_ATH9K_RATE_CONTROL
-        hw->rate_control_algorithm = "ath9k_rate_control";
-#endif
        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                        &sc->sbands[IEEE80211_BAND_2GHZ];
diff --git a/drivers/net/wireless/ath/ath9k/rc.h b/drivers/net/wireless/ath/ath9k/rc.h
index 267dbfcfaa96..b9a87383cb43 100644
--- a/drivers/net/wireless/ath/ath9k/rc.h
+++ b/drivers/net/wireless/ath/ath9k/rc.h
@@ -231,7 +231,7 @@ static inline void ath_debug_stat_retries(struct ath_rate_priv *rc, int rix,
 }
 #endif
-#ifdef CONFIG_ATH9K_RATE_CONTROL
+#ifdef CONFIG_ATH9K_LEGACY_RATE_CONTROL
 int ath_rate_control_register(void);
 void ath_rate_control_unregister(void);
 #else
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 6dd07e2ec595..a95b77ab360e 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2458,7 +2458,7 @@ static void b43_request_firmware(struct work_struct *work)
        for (i = 0; i < B43_NR_FWTYPES; i++) {
                errmsg = ctx->errors[i];
                if (strlen(errmsg))
-                        b43err(dev->wl, errmsg);
+                        b43err(dev->wl, "%s", errmsg);
        }
        b43_print_fw_helptext(dev->wl, 1);
        goto out;
diff --git a/drivers/net/wireless/iwlegacy/common.h b/drivers/net/wireless/iwlegacy/common.h
index f8246f2d88f9..4caaf52986a4 100644
--- a/drivers/net/wireless/iwlegacy/common.h
+++ b/drivers/net/wireless/iwlegacy/common.h
@@ -1832,16 +1832,16 @@ u32 il_usecs_to_beacons(struct il_priv *il, u32 usec, u32 beacon_interval);
 __le32 il_add_beacon_time(struct il_priv *il, u32 base, u32 addon,
                          u32 beacon_interval);
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 extern const struct dev_pm_ops il_pm_ops;
 #define IL_LEGACY_PM_OPS        (&il_pm_ops)
-#else /* !CONFIG_PM */
+#else /* !CONFIG_PM_SLEEP */
 #define IL_LEGACY_PM_OPS        NULL
-#endif /* !CONFIG_PM */
+#endif /* !CONFIG_PM_SLEEP */
 /*****************************************************
 *  Error Handling Debugging
diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 753b5682d53f..a5f9875cfd6e 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -26,10 +26,17 @@
 static struct dentry *mwifiex_dfs_dir;
 static char *bss_modes[] = {
-        "Unknown",
+        "UNSPECIFIED",
-        "Ad-hoc",
+        "ADHOC",
-        "Managed",
+        "STATION",
-        "Auto"
+        "AP",
+        "AP_VLAN",
+        "WDS",
+        "MONITOR",
+        "MESH_POINT",
+        "P2P_CLIENT",
+        "P2P_GO",
+        "P2P_DEVICE",
 };
 /* size/addr for mwifiex_debug_info */
@@ -200,7 +207,12 @@ mwifiex_info_read(struct file *file, char __user *ubuf,
        p += sprintf(p, "driver_version = %s", fmt);
        p += sprintf(p, "\nverext = %s", priv->version_str);
        p += sprintf(p, "\ninterface_name=\"%s\"\n", netdev->name);
-        p += sprintf(p, "bss_mode=\"%s\"\n", bss_modes[info.bss_mode]);
+        if (info.bss_mode >= ARRAY_SIZE(bss_modes))
+                p += sprintf(p, "bss_mode=\"%d\"\n", info.bss_mode);
+        else
+                p += sprintf(p, "bss_mode=\"%s\"\n", bss_modes[info.bss_mode]);
        p += sprintf(p, "media_state=\"%s\"\n",
                     (!priv->media_connected ? "Disconnected" : "Connected"));
        p += sprintf(p, "mac_address=\"%pM\"\n", netdev->dev_addr);
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 999ffc12578b..c97e9d327331 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -764,6 +764,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                 "can't alloc skb for rx\n");
                        goto done;
                }
+                kmemleak_not_leak(new_skb);
                pci_unmap_single(rtlpci->pdev,
                                 *((dma_addr_t *) skb->cb),
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 3d0498e69c8c..189ba124a8c6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1973,26 +1973,35 @@ void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
        }
 }
-void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
+static void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
-                                   struct ieee80211_sta *sta,
+                                          struct ieee80211_sta *sta)
-                                   u8 rssi_level)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_phy *rtlphy = &(rtlpriv->phy);
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        u32 ratr_value = (u32) mac->basic_rates;
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        u8 *mcsrate = mac->mcs;
+        u32 ratr_value;
        u8 ratr_index = 0;
        u8 nmode = mac->ht_enable;
-        u8 mimo_ps = 1;
+        u8 mimo_ps = IEEE80211_SMPS_OFF;
-        u16 shortgi_rate = 0;
+        u16 shortgi_rate;
-        u32 tmp_ratr_value = 0;
+        u32 tmp_ratr_value;
        u8 curtxbw_40mhz = mac->bw_40;
-        u8 curshortgi_40mhz = mac->sgi_40;
+        u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
-        u8 curshortgi_20mhz = mac->sgi_20;
+                               1 : 0;
+        u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
+                               1 : 0;
        enum wireless_mode wirelessmode = mac->mode;
-        ratr_value |= ((*(u16 *) (mcsrate))) << 12;
+        if (rtlhal->current_bandtype == BAND_ON_5G)
+                ratr_value = sta->supp_rates[1] << 4;
+        else
+                ratr_value = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_value = 0xfff;
+        ratr_value |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
+                        sta->ht_cap.mcs.rx_mask[0] << 12);
        switch (wirelessmode) {
        case WIRELESS_MODE_B:
                if (ratr_value & 0x0000000c)
@@ -2006,7 +2015,7 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
        case WIRELESS_MODE_N_24G:
        case WIRELESS_MODE_N_5G:
                nmode = 1;
-                if (mimo_ps == 0) {
+                if (mimo_ps == IEEE80211_SMPS_STATIC) {
                        ratr_value &= 0x0007F005;
                } else {
                        u32 ratr_mask;
@@ -2016,8 +2025,7 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
                                ratr_mask = 0x000ff005;
                        else
                                ratr_mask = 0x0f0ff005;
-                        if (curtxbw_40mhz)
-                                ratr_mask |= 0x00000010;
                        ratr_value &= ratr_mask;
                }
                break;
@@ -2026,41 +2034,74 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
                        ratr_value &= 0x000ff0ff;
                else
                        ratr_value &= 0x0f0ff0ff;
                break;
        }
        ratr_value &= 0x0FFFFFFF;
-        if (nmode && ((curtxbw_40mhz && curshortgi_40mhz) ||
-            (!curtxbw_40mhz && curshortgi_20mhz))) {
+        if (nmode && ((curtxbw_40mhz &&
+                         curshortgi_40mhz) || (!curtxbw_40mhz &&
+                                               curshortgi_20mhz))) {
                ratr_value |= 0x10000000;
                tmp_ratr_value = (ratr_value >> 12);
                for (shortgi_rate = 15; shortgi_rate > 0; shortgi_rate--) {
                        if ((1 << shortgi_rate) & tmp_ratr_value)
                                break;
                }
                shortgi_rate = (shortgi_rate << 12) | (shortgi_rate << 8) |
-                               (shortgi_rate << 4) | (shortgi_rate);
+                    (shortgi_rate << 4) | (shortgi_rate);
        }
        rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
+        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
+                 rtl_read_dword(rtlpriv, REG_ARFR0));
 }
-void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
+static void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw,
+                                         struct ieee80211_sta *sta,
+                                         u8 rssi_level)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_phy *rtlphy = &(rtlpriv->phy);
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        u32 ratr_bitmap = (u32) mac->basic_rates;
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        u8 *p_mcsrate = mac->mcs;
+        struct rtl_sta_info *sta_entry = NULL;
-        u8 ratr_index = 0;
+        u32 ratr_bitmap;
-        u8 curtxbw_40mhz = mac->bw_40;
+        u8 ratr_index;
-        u8 curshortgi_40mhz = mac->sgi_40;
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
-        u8 curshortgi_20mhz = mac->sgi_20;
+        u8 curshortgi_40mhz = curtxbw_40mhz &&
-        enum wireless_mode wirelessmode = mac->mode;
+                              (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
+                                1 : 0;
+        u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
+                                1 : 0;
+        enum wireless_mode wirelessmode = 0;
        bool shortgi = false;
        u8 rate_mask[5];
        u8 macid = 0;
-        u8 mimops = 1;
+        u8 mimo_ps = IEEE80211_SMPS_OFF;
-        ratr_bitmap |= (p_mcsrate[1] << 20) | (p_mcsrate[0] << 12);
+        sta_entry = (struct rtl_sta_info *) sta->drv_priv;
+        wirelessmode = sta_entry->wireless_mode;
+        if (mac->opmode == NL80211_IFTYPE_STATION ||
+            mac->opmode == NL80211_IFTYPE_MESH_POINT)
+                curtxbw_40mhz = mac->bw_40;
+        else if (mac->opmode == NL80211_IFTYPE_AP ||
+                mac->opmode == NL80211_IFTYPE_ADHOC)
+                macid = sta->aid + 1;
+        if (rtlhal->current_bandtype == BAND_ON_5G)
+                ratr_bitmap = sta->supp_rates[1] << 4;
+        else
+                ratr_bitmap = sta->supp_rates[0];
+        if (mac->opmode == NL80211_IFTYPE_ADHOC)
+                ratr_bitmap = 0xfff;
+        ratr_bitmap |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
+                        sta->ht_cap.mcs.rx_mask[0] << 12);
        switch (wirelessmode) {
        case WIRELESS_MODE_B:
                ratr_index = RATR_INX_WIRELESS_B;
@@ -2071,6 +2112,7 @@ void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
                break;
        case WIRELESS_MODE_G:
                ratr_index = RATR_INX_WIRELESS_GB;
                if (rssi_level == 1)
                        ratr_bitmap &= 0x00000f00;
                else if (rssi_level == 2)
@@ -2085,7 +2127,8 @@ void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
        case WIRELESS_MODE_N_24G:
        case WIRELESS_MODE_N_5G:
                ratr_index = RATR_INX_WIRELESS_NGB;
-                if (mimops == 0) {
+                if (mimo_ps == IEEE80211_SMPS_STATIC) {
                        if (rssi_level == 1)
                                ratr_bitmap &= 0x00070000;
                        else if (rssi_level == 2)
@@ -2128,8 +2171,10 @@ void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
                                }
                        }
                }
                if ((curtxbw_40mhz && curshortgi_40mhz) ||
                    (!curtxbw_40mhz && curshortgi_20mhz)) {
                        if (macid == 0)
                                shortgi = true;
                        else if (macid == 1)
@@ -2138,21 +2183,42 @@ void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
                break;
        default:
                ratr_index = RATR_INX_WIRELESS_NGB;
                if (rtlphy->rf_type == RF_1T2R)
                        ratr_bitmap &= 0x000ff0ff;
                else
                        ratr_bitmap &= 0x0f0ff0ff;
                break;
        }
-        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "ratr_bitmap :%x\n",
+        sta_entry->ratr_index = ratr_index;
-                 ratr_bitmap);
-        *(u32 *)&rate_mask = ((ratr_bitmap & 0x0fffffff) |
+        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
-                                      ratr_index << 28);
+                 "ratr_bitmap :%x\n", ratr_bitmap);
+        *(u32 *)&rate_mask = (ratr_bitmap & 0x0fffffff) |
+                                     (ratr_index << 28);
        rate_mask[4] = macid | (shortgi ? 0x20 : 0x00) | 0x80;
        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
                 "Rate_index:%x, ratr_val:%x, %5phC\n",
                 ratr_index, ratr_bitmap, rate_mask);
-        rtl92c_fill_h2c_cmd(hw, H2C_RA_MASK, 5, rate_mask);
+        memcpy(rtlpriv->rate_mask, rate_mask, 5);
+        /* rtl92c_fill_h2c_cmd() does USB I/O and will result in a
+         * "scheduled while atomic" if called directly */
+        schedule_work(&rtlpriv->works.fill_h2c_cmd);
+        if (macid != 0)
+                sta_entry->ratr_index = ratr_index;
+}
+void rtl92cu_update_hal_rate_tbl(struct ieee80211_hw *hw,
+                                 struct ieee80211_sta *sta,
+                                 u8 rssi_level)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        if (rtlpriv->dm.useramask)
+                rtl92cu_update_hal_rate_mask(hw, sta, rssi_level);
+        else
+                rtl92cu_update_hal_rate_table(hw, sta);
 }
 void rtl92cu_update_channel_access_setting(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
index f41a3aa4a26f..8e3ec1e25644 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
@@ -98,10 +98,6 @@ void rtl92cu_update_interrupt_mask(struct ieee80211_hw *hw,
                                   u32 add_msr, u32 rm_msr);
 void rtl92cu_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val);
 void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val);
-void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
-                                   struct ieee80211_sta *sta,
-                                   u8 rssi_level);
-void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level);
 void rtl92cu_update_channel_access_setting(struct ieee80211_hw *hw);
 bool rtl92cu_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 * valid);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index 85b6bdb163c0..da4f587199ee 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -289,14 +289,30 @@ void rtl92c_set_key(struct ieee80211_hw *hw, u32 key_index,
                                macaddr = cam_const_broad;
                                entry_id = key_index;
                        } else {
+                                if (mac->opmode == NL80211_IFTYPE_AP ||
+                                    mac->opmode == NL80211_IFTYPE_MESH_POINT) {
+                                        entry_id = rtl_cam_get_free_entry(hw,
+                                                                 p_macaddr);
+                                        if (entry_id >=  TOTAL_CAM_ENTRY) {
+                                                RT_TRACE(rtlpriv, COMP_SEC,
+                                                         DBG_EMERG,
+                                                         "Can not find free hw security cam entry\n");
+                                                return;
+                                        }
+                                } else {
+                                        entry_id = CAM_PAIRWISE_KEY_POSITION;
+                                }
                                key_index = PAIRWISE_KEYIDX;
-                                entry_id = CAM_PAIRWISE_KEY_POSITION;
                                is_pairwise = true;
                        }
                }
                if (rtlpriv->sec.key_len[key_index] == 0) {
                        RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                                 "delete one entry\n");
+                        if (mac->opmode == NL80211_IFTYPE_AP ||
+                            mac->opmode == NL80211_IFTYPE_MESH_POINT)
+                                rtl_cam_del_entry(hw, p_macaddr);
                        rtl_cam_delete_one_entry(hw, p_macaddr, entry_id);
                } else {
                        RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 938b1e670b93..826f085c29dd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -106,8 +106,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
        .update_interrupt_mask = rtl92cu_update_interrupt_mask,
        .get_hw_reg = rtl92cu_get_hw_reg,
        .set_hw_reg = rtl92cu_set_hw_reg,
-        .update_rate_tbl = rtl92cu_update_hal_rate_table,
+        .update_rate_tbl = rtl92cu_update_hal_rate_tbl,
-        .update_rate_mask = rtl92cu_update_hal_rate_mask,
        .fill_tx_desc = rtl92cu_tx_fill_desc,
        .fill_fake_txdesc = rtl92cu_fill_fake_txdesc,
        .fill_tx_cmddesc = rtl92cu_tx_fill_cmddesc,
@@ -137,6 +136,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
        .phy_lc_calibrate = _rtl92cu_phy_lc_calibrate,
        .phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback,
        .dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower,
+        .fill_h2c_cmd = rtl92c_fill_h2c_cmd,
 };
 static struct rtl_mod_params rtl92cu_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.h b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.h
index a1310abd0d54..262e1e4c6e5b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.h
@@ -49,5 +49,8 @@ bool rtl92cu_phy_set_rf_power_state(struct ieee80211_hw *hw,
 u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw,
                            enum radio_path rfpath, u32 regaddr, u32 bitmask);
 void rtl92cu_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
+void rtl92cu_update_hal_rate_tbl(struct ieee80211_hw *hw,
+                                 struct ieee80211_sta *sta,
+                                 u8 rssi_level);
 #endif
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 76732b0cd221..a3532e077871 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -824,6 +824,7 @@ static void rtl_usb_stop(struct ieee80211_hw *hw)
        /* should after adapter start and interrupt enable. */
        set_hal_stop(rtlhal);
+        cancel_work_sync(&rtlpriv->works.fill_h2c_cmd);
        /* Enable software */
        SET_USB_STOP(rtlusb);
        rtl_usb_deinit(hw);
@@ -1026,6 +1027,16 @@ static bool rtl_usb_tx_chk_waitq_insert(struct ieee80211_hw *hw,
        return false;
 }
+static void rtl_fill_h2c_cmd_work_callback(struct work_struct *work)
+{
+        struct rtl_works *rtlworks =
+            container_of(work, struct rtl_works, fill_h2c_cmd);
+        struct ieee80211_hw *hw = rtlworks->hw;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        rtlpriv->cfg->ops->fill_h2c_cmd(hw, H2C_RA_MASK, 5, rtlpriv->rate_mask);
+}
 static struct rtl_intf_ops rtl_usb_ops = {
        .adapter_start = rtl_usb_start,
        .adapter_stop = rtl_usb_stop,
@@ -1057,6 +1068,8 @@ int rtl_usb_probe(struct usb_interface *intf,
        /* this spin lock must be initialized early */
        spin_lock_init(&rtlpriv->locks.usb_lock);
+        INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
+                  rtl_fill_h2c_cmd_work_callback);
        rtlpriv->usb_data_index = 0;
        init_completion(&rtlpriv->firmware_loading_complete);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 44328baa6389..cc03e7c87cbe 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -1736,6 +1736,8 @@ struct rtl_hal_ops {
        void (*bt_wifi_media_status_notify) (struct ieee80211_hw *hw,
                                             bool mstate);
        void (*bt_coex_off_before_lps) (struct ieee80211_hw *hw);
+        void (*fill_h2c_cmd) (struct ieee80211_hw *hw, u8 element_id,
+                              u32 cmd_len, u8 *p_cmdbuffer);
 };
 struct rtl_intf_ops {
@@ -1869,6 +1871,7 @@ struct rtl_works {
        struct delayed_work fwevt_wq;
        struct work_struct lps_change_work;
+        struct work_struct fill_h2c_cmd;
 };
 struct rtl_debug {
@@ -2048,6 +2051,7 @@ struct rtl_priv {
                };
        };
        bool enter_ps;  /* true when entering PS */
+        u8 rate_mask[5];
        /*This must be the last item so
           that it points to the data allocated
diff --git a/drivers/net/wireless/ti/wl12xx/scan.c b/drivers/net/wireless/ti/wl12xx/scan.c
index affdb3ec6225..4a0bbb13806b 100644
--- a/drivers/net/wireless/ti/wl12xx/scan.c
+++ b/drivers/net/wireless/ti/wl12xx/scan.c
@@ -310,7 +310,7 @@ static void wl12xx_adjust_channels(struct wl1271_cmd_sched_scan_config *cmd,
        memcpy(cmd->channels_2, cmd_channels->channels_2,
               sizeof(cmd->channels_2));
        memcpy(cmd->channels_5, cmd_channels->channels_5,
-               sizeof(cmd->channels_2));
+               sizeof(cmd->channels_5));
        /* channels_4 are not supported, so no need to copy them */
 }
diff --git a/drivers/net/wireless/ti/wl12xx/wl12xx.h b/drivers/net/wireless/ti/wl12xx/wl12xx.h
index 222d03540200..9e5484a73667 100644
--- a/drivers/net/wireless/ti/wl12xx/wl12xx.h
+++ b/drivers/net/wireless/ti/wl12xx/wl12xx.h
@@ -36,12 +36,12 @@
 #define WL127X_IFTYPE_SR_VER    3
 #define WL127X_MAJOR_SR_VER     10
 #define WL127X_SUBTYPE_SR_VER   WLCORE_FW_VER_IGNORE
-#define WL127X_MINOR_SR_VER     115
+#define WL127X_MINOR_SR_VER     133
 /* minimum multi-role FW version for wl127x */
 #define WL127X_IFTYPE_MR_VER    5
 #define WL127X_MAJOR_MR_VER     7
 #define WL127X_SUBTYPE_MR_VER   WLCORE_FW_VER_IGNORE
-#define WL127X_MINOR_MR_VER     115
+#define WL127X_MINOR_MR_VER     42
 /* FW chip version for wl128x */
 #define WL128X_CHIP_VER         7
@@ -49,7 +49,7 @@
 #define WL128X_IFTYPE_SR_VER    3
 #define WL128X_MAJOR_SR_VER     10
 #define WL128X_SUBTYPE_SR_VER   WLCORE_FW_VER_IGNORE
-#define WL128X_MINOR_SR_VER     115
+#define WL128X_MINOR_SR_VER     133
 /* minimum multi-role FW version for wl128x */
 #define WL128X_IFTYPE_MR_VER    5
 #define WL128X_MAJOR_MR_VER     7
diff --git a/drivers/net/wireless/ti/wl18xx/scan.c b/drivers/net/wireless/ti/wl18xx/scan.c
index 09d944505ac0..2b642f8c9266 100644
--- a/drivers/net/wireless/ti/wl18xx/scan.c
+++ b/drivers/net/wireless/ti/wl18xx/scan.c
@@ -34,7 +34,7 @@ static void wl18xx_adjust_channels(struct wl18xx_cmd_scan_params *cmd,
        memcpy(cmd->channels_2, cmd_channels->channels_2,
               sizeof(cmd->channels_2));
        memcpy(cmd->channels_5, cmd_channels->channels_5,
-               sizeof(cmd->channels_2));
+               sizeof(cmd->channels_5));
        /* channels_4 are not supported, so no need to copy them */
 }
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 0eab77b22340..f296f3f7db9b 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -25,6 +25,7 @@
 #include <linux/rtc.h>
 #include <linux/bcd.h>
 #include <linux/interrupt.h>
+#include <linux/spinlock.h>
 #include <linux/ioctl.h>
 #include <linux/completion.h>
 #include <linux/io.h>
@@ -42,10 +43,65 @@
 #define AT91_RTC_EPOCH          1900UL  /* just like arch/arm/common/rtctime.c */
+struct at91_rtc_config {
+        bool use_shadow_imr;
+};
+static const struct at91_rtc_config *at91_rtc_config;
 static DECLARE_COMPLETION(at91_rtc_updated);
 static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
 static void __iomem *at91_rtc_regs;
 static int irq;
+static DEFINE_SPINLOCK(at91_rtc_lock);
+static u32 at91_rtc_shadow_imr;
+static void at91_rtc_write_ier(u32 mask)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&at91_rtc_lock, flags);
+        at91_rtc_shadow_imr |= mask;
+        at91_rtc_write(AT91_RTC_IER, mask);
+        spin_unlock_irqrestore(&at91_rtc_lock, flags);
+}
+static void at91_rtc_write_idr(u32 mask)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&at91_rtc_lock, flags);
+        at91_rtc_write(AT91_RTC_IDR, mask);
+        /*
+         * Register read back (of any RTC-register) needed to make sure
+         * IDR-register write has reached the peripheral before updating
+         * shadow mask.
+         *
+         * Note that there is still a possibility that the mask is updated
+         * before interrupts have actually been disabled in hardware. The only
+         * way to be certain would be to poll the IMR-register, which is is
+         * the very register we are trying to emulate. The register read back
+         * is a reasonable heuristic.
+         */
+        at91_rtc_read(AT91_RTC_SR);
+        at91_rtc_shadow_imr &= ~mask;
+        spin_unlock_irqrestore(&at91_rtc_lock, flags);
+}
+static u32 at91_rtc_read_imr(void)
+{
+        unsigned long flags;
+        u32 mask;
+        if (at91_rtc_config->use_shadow_imr) {
+                spin_lock_irqsave(&at91_rtc_lock, flags);
+                mask = at91_rtc_shadow_imr;
+                spin_unlock_irqrestore(&at91_rtc_lock, flags);
+        } else {
+                mask = at91_rtc_read(AT91_RTC_IMR);
+        }
+        return mask;
+}
 /*
 * Decode time/date into rtc_time structure
@@ -110,9 +166,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
        cr = at91_rtc_read(AT91_RTC_CR);
        at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
-        at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
+        at91_rtc_write_ier(AT91_RTC_ACKUPD);
        wait_for_completion(&at91_rtc_updated); /* wait for ACKUPD interrupt */
-        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
+        at91_rtc_write_idr(AT91_RTC_ACKUPD);
        at91_rtc_write(AT91_RTC_TIMR,
                          bin2bcd(tm->tm_sec) << 0
@@ -144,7 +200,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
        tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
        tm->tm_year = at91_alarm_year - 1900;
-        alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
+        alrm->enabled = (at91_rtc_read_imr() & AT91_RTC_ALARM)
                        ? 1 : 0;
        dev_dbg(dev, "%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
@@ -169,7 +225,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        tm.tm_min = alrm->time.tm_min;
        tm.tm_sec = alrm->time.tm_sec;
-        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+        at91_rtc_write_idr(AT91_RTC_ALARM);
        at91_rtc_write(AT91_RTC_TIMALR,
                  bin2bcd(tm.tm_sec) << 0
                | bin2bcd(tm.tm_min) << 8
@@ -182,7 +238,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        if (alrm->enabled) {
                at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-                at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
+                at91_rtc_write_ier(AT91_RTC_ALARM);
        }
        dev_dbg(dev, "%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
@@ -198,9 +254,9 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
        if (enabled) {
                at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-                at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
+                at91_rtc_write_ier(AT91_RTC_ALARM);
        } else
-                at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+                at91_rtc_write_idr(AT91_RTC_ALARM);
        return 0;
 }
@@ -209,7 +265,7 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 */
 static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
 {
-        unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
+        unsigned long imr = at91_rtc_read_imr();
        seq_printf(seq, "update_IRQ\t: %s\n",
                        (imr & AT91_RTC_ACKUPD) ? "yes" : "no");
@@ -229,7 +285,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
        unsigned int rtsr;
        unsigned long events = 0;
-        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
+        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read_imr();
        if (rtsr) {             /* this interrupt is shared!  Is it ours? */
                if (rtsr & AT91_RTC_ALARM)
                        events |= (RTC_AF | RTC_IRQF);
@@ -250,6 +306,43 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
        return IRQ_NONE;                /* not handled */
 }
+static const struct at91_rtc_config at91rm9200_config = {
+};
+static const struct at91_rtc_config at91sam9x5_config = {
+        .use_shadow_imr = true,
+};
+#ifdef CONFIG_OF
+static const struct of_device_id at91_rtc_dt_ids[] = {
+        {
+                .compatible = "atmel,at91rm9200-rtc",
+                .data = &at91rm9200_config,
+        }, {
+                .compatible = "atmel,at91sam9x5-rtc",
+                .data = &at91sam9x5_config,
+        }, {
+                /* sentinel */
+        }
+};
+MODULE_DEVICE_TABLE(of, at91_rtc_dt_ids);
+#endif
+static const struct at91_rtc_config *
+at91_rtc_get_config(struct platform_device *pdev)
+{
+        const struct of_device_id *match;
+        if (pdev->dev.of_node) {
+                match = of_match_node(at91_rtc_dt_ids, pdev->dev.of_node);
+                if (!match)
+                        return NULL;
+                return (const struct at91_rtc_config *)match->data;
+        }
+        return &at91rm9200_config;
+}
 static const struct rtc_class_ops at91_rtc_ops = {
        .read_time      = at91_rtc_readtime,
        .set_time       = at91_rtc_settime,
@@ -268,6 +361,10 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
        struct resource *regs;
        int ret = 0;
+        at91_rtc_config = at91_rtc_get_config(pdev);
+        if (!at91_rtc_config)
+                return -ENODEV;
        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!regs) {
                dev_err(&pdev->dev, "no mmio resource defined\n");
@@ -290,7 +387,7 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
        at91_rtc_write(AT91_RTC_MR, 0);         /* 24 hour mode */
        /* Disable all interrupts */
-        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
+        at91_rtc_write_idr(AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                        AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                        AT91_RTC_CALEV);
@@ -335,7 +432,7 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
        struct rtc_device *rtc = platform_get_drvdata(pdev);
        /* Disable all interrupts */
-        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
+        at91_rtc_write_idr(AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                        AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                        AT91_RTC_CALEV);
        free_irq(irq, pdev);
@@ -358,13 +455,13 @@ static int at91_rtc_suspend(struct device *dev)
        /* this IRQ is shared with DBGU and other hardware which isn't
         * necessarily doing PM like we are...
         */
-        at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
+        at91_rtc_imr = at91_rtc_read_imr()
                        & (AT91_RTC_ALARM|AT91_RTC_SECEV);
        if (at91_rtc_imr) {
                if (device_may_wakeup(dev))
                        enable_irq_wake(irq);
                else
-                        at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
+                        at91_rtc_write_idr(at91_rtc_imr);
        }
        return 0;
 }
@@ -375,7 +472,7 @@ static int at91_rtc_resume(struct device *dev)
                if (device_may_wakeup(dev))
                        disable_irq_wake(irq);
                else
-                        at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
+                        at91_rtc_write_ier(at91_rtc_imr);
        }
        return 0;
 }
@@ -383,12 +480,6 @@ static int at91_rtc_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(at91_rtc_pm_ops, at91_rtc_suspend, at91_rtc_resume);
-static const struct of_device_id at91_rtc_dt_ids[] = {
-        { .compatible = "atmel,at91rm9200-rtc" },
-        { /* sentinel */ }
-};
-MODULE_DEVICE_TABLE(of, at91_rtc_dt_ids);
 static struct platform_driver at91_rtc_driver = {
        .remove         = __exit_p(at91_rtc_remove),
        .driver         = {
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index cc5bea9c4b1c..f1cb706445c7 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -854,6 +854,9 @@ static int cmos_resume(struct device *dev)
                }
                spin_lock_irq(&rtc_lock);
+                if (device_may_wakeup(dev))
+                        hpet_rtc_timer_init();
                do {
                        CMOS_WRITE(tmp, RTC_CONTROL);
                        hpet_set_rtc_irq_bit(tmp & RTC_IRQMASK);
@@ -869,7 +872,6 @@ static int cmos_resume(struct device *dev)
                        rtc_update_irq(cmos->rtc, 1, mask);
                        tmp &= ~RTC_AIE;
                        hpet_mask_rtc_irq_bit(RTC_AIE);
-                        hpet_rtc_timer_init();
                } while (mask & RTC_AIE);
                spin_unlock_irq(&rtc_lock);
        }
diff --git a/drivers/rtc/rtc-tps6586x.c b/drivers/rtc/rtc-tps6586x.c
index 459c2ffc95a6..426901cef14f 100644
--- a/drivers/rtc/rtc-tps6586x.c
+++ b/drivers/rtc/rtc-tps6586x.c
@@ -273,6 +273,8 @@ static int tps6586x_rtc_probe(struct platform_device *pdev)
                return ret;
        }
+        device_init_wakeup(&pdev->dev, 1);
        platform_set_drvdata(pdev, rtc);
        rtc->rtc = devm_rtc_device_register(&pdev->dev, dev_name(&pdev->dev),
                                       &tps6586x_rtc_ops, THIS_MODULE);
@@ -292,7 +294,6 @@ static int tps6586x_rtc_probe(struct platform_device *pdev)
                goto fail_rtc_register;
        }
        disable_irq(rtc->irq);
-        device_set_wakeup_capable(&pdev->dev, 1);
        return 0;
 fail_rtc_register:
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 8751a5240c99..b2eab34f38d9 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -524,6 +524,7 @@ static int twl_rtc_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, rtc);
+        device_init_wakeup(&pdev->dev, 1);
        return 0;
 out2:
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index 60cfae51c713..eab593eaaafa 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -89,7 +89,7 @@ static int hspi_status_check_timeout(struct hspi_priv *hspi, u32 mask, u32 val)
                if ((mask & hspi_read(hspi, SPSR)) == val)
                        return 0;
-                msleep(20);
+                udelay(10);
        }
        dev_err(hspi->dev, "timeout\n");
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 35f60bd252dd..637d728fbeb5 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -1487,7 +1487,7 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
        return 0;
 err_spi_register_master:
-        free_irq(board_dat->pdev->irq, board_dat);
+        free_irq(board_dat->pdev->irq, data);
 err_request_irq:
        pch_spi_free_resources(board_dat, data);
 err_spi_get_resources:
@@ -1667,6 +1667,7 @@ static int pch_spi_probe(struct pci_dev *pdev,
                pd_dev = platform_device_alloc("pch-spi", i);
                if (!pd_dev) {
                        dev_err(&pdev->dev, "platform_device_alloc failed\n");
+                        retval = -ENOMEM;
                        goto err_platform_device;
                }
                pd_dev_save->pd_save[i] = pd_dev;
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index e1d769607425..34d18dcfa0db 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -267,7 +267,6 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
 {
        struct xilinx_spi *xspi = spi_master_get_devdata(spi->master);
        u32 ipif_ier;
-        u16 cr;
        /* We get here with transmitter inhibited */
@@ -276,7 +275,6 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
        xspi->remaining_bytes = t->len;
        INIT_COMPLETION(xspi->done);
-        xilinx_spi_fill_tx_fifo(xspi);
        /* Enable the transmit empty interrupt, which we use to determine
         * progress on the transmission.
@@ -285,12 +283,41 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
        xspi->write_fn(ipif_ier | XSPI_INTR_TX_EMPTY,
                xspi->regs + XIPIF_V123B_IIER_OFFSET);
-        /* Start the transfer by not inhibiting the transmitter any longer */
+        for (;;) {
-        cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET) &
+                u16 cr;
-                ~XSPI_CR_TRANS_INHIBIT;
+                u8 sr;
-        xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
+                xilinx_spi_fill_tx_fifo(xspi);
+                /* Start the transfer by not inhibiting the transmitter any
+                 * longer
+                 */
+                cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET) &
+                                                        ~XSPI_CR_TRANS_INHIBIT;
+                xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
+                wait_for_completion(&xspi->done);
+                /* A transmit has just completed. Process received data and
+                 * check for more data to transmit. Always inhibit the
+                 * transmitter while the Isr refills the transmit register/FIFO,
+                 * or make sure it is stopped if we're done.
+                 */
+                cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET);
+                xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
+                               xspi->regs + XSPI_CR_OFFSET);
+                /* Read out all the data from the Rx FIFO */
+                sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
+                while ((sr & XSPI_SR_RX_EMPTY_MASK) == 0) {
+                        xspi->rx_fn(xspi);
+                        sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
+                }
-        wait_for_completion(&xspi->done);
+                /* See if there is more data to send */
+                if (!xspi->remaining_bytes > 0)
+                        break;
+        }
        /* Disable the transmit empty interrupt */
        xspi->write_fn(ipif_ier, xspi->regs + XIPIF_V123B_IIER_OFFSET);
@@ -314,38 +341,7 @@ static irqreturn_t xilinx_spi_irq(int irq, void *dev_id)
        xspi->write_fn(ipif_isr, xspi->regs + XIPIF_V123B_IISR_OFFSET);
        if (ipif_isr & XSPI_INTR_TX_EMPTY) {    /* Transmission completed */
-                u16 cr;
+                complete(&xspi->done);
-                u8 sr;
-                /* A transmit has just completed. Process received data and
-                 * check for more data to transmit. Always inhibit the
-                 * transmitter while the Isr refills the transmit register/FIFO,
-                 * or make sure it is stopped if we're done.
-                 */
-                cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET);
-                xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
-                        xspi->regs + XSPI_CR_OFFSET);
-                /* Read out all the data from the Rx FIFO */
-                sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
-                while ((sr & XSPI_SR_RX_EMPTY_MASK) == 0) {
-                        xspi->rx_fn(xspi);
-                        sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
-                }
-                /* See if there is more data to send */
-                if (xspi->remaining_bytes > 0) {
-                        xilinx_spi_fill_tx_fifo(xspi);
-                        /* Start the transfer by not inhibiting the
-                         * transmitter any longer
-                         */
-                        xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
-                } else {
-                        /* No more data to send.
-                         * Indicate the transfer is completed.
-                         */
-                        complete(&xspi->done);
-                }
        }
        return IRQ_HANDLED;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 2b51e2336aa2..f80d3dd41d8c 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -155,14 +155,11 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
 static void vhost_net_clear_ubuf_info(struct vhost_net *n)
 {
-        bool zcopy;
        int i;
-        for (i = 0; i < n->dev.nvqs; ++i) {
+        for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
-                zcopy = vhost_net_zcopy_mask & (0x1 << i);
+                kfree(n->vqs[i].ubuf_info);
-                if (zcopy)
+                n->vqs[i].ubuf_info = NULL;
-                        kfree(n->vqs[i].ubuf_info);
        }
 }
@@ -171,7 +168,7 @@ int vhost_net_set_ubuf_info(struct vhost_net *n)
        bool zcopy;
        int i;
-        for (i = 0; i < n->dev.nvqs; ++i) {
+        for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
                zcopy = vhost_net_zcopy_mask & (0x1 << i);
                if (!zcopy)
                        continue;
@@ -183,12 +180,7 @@ int vhost_net_set_ubuf_info(struct vhost_net *n)
        return 0;
 err:
-        while (i--) {
+        vhost_net_clear_ubuf_info(n);
-                zcopy = vhost_net_zcopy_mask & (0x1 << i);
-                if (!zcopy)
-                        continue;
-                kfree(n->vqs[i].ubuf_info);
-        }
        return -ENOMEM;
 }
@@ -196,12 +188,12 @@ void vhost_net_vq_reset(struct vhost_net *n)
 {
        int i;
+        vhost_net_clear_ubuf_info(n);
        for (i = 0; i < VHOST_NET_VQ_MAX; i++) {
                n->vqs[i].done_idx = 0;
                n->vqs[i].upend_idx = 0;
                n->vqs[i].ubufs = NULL;
-                kfree(n->vqs[i].ubuf_info);
-                n->vqs[i].ubuf_info = NULL;
                n->vqs[i].vhost_hlen = 0;
                n->vqs[i].sock_hlen = 0;
        }
@@ -436,7 +428,8 @@ static void handle_tx(struct vhost_net *net)
                                kref_get(&ubufs->kref);
                        }
                        nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV;
-                }
+                } else
+                        msg.msg_control = NULL;
                /* TODO: Check specific error and bomb out unless ENOBUFS? */
                err = sock->ops->sendmsg(NULL, sock, &msg, len);
                if (unlikely(err < 0)) {
@@ -1053,6 +1046,10 @@ static long vhost_net_set_owner(struct vhost_net *n)
        int r;
        mutex_lock(&n->dev.mutex);
+        if (vhost_dev_has_owner(&n->dev)) {
+                r = -EBUSY;
+                goto out;
+        }
        r = vhost_net_set_ubuf_info(n);
        if (r)
                goto out;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index beee7f5787e6..60aa5ad09a2f 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -344,13 +344,19 @@ static int vhost_attach_cgroups(struct vhost_dev *dev)
 }
 /* Caller should have device mutex */
+bool vhost_dev_has_owner(struct vhost_dev *dev)
+{
+        return dev->mm;
+}
+/* Caller should have device mutex */
 long vhost_dev_set_owner(struct vhost_dev *dev)
 {
        struct task_struct *worker;
        int err;
        /* Is there an owner already? */
-        if (dev->mm) {
+        if (vhost_dev_has_owner(dev)) {
                err = -EBUSY;
                goto err_mm;
        }
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index a7ad63592987..64adcf99ff33 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -133,6 +133,7 @@ struct vhost_dev {
 long vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
 long vhost_dev_set_owner(struct vhost_dev *dev);
+bool vhost_dev_has_owner(struct vhost_dev *dev);
 long vhost_dev_check_owner(struct vhost_dev *);
 struct vhost_memory *vhost_dev_reset_owner_prepare(void);
 void vhost_dev_reset_owner(struct vhost_dev *, struct vhost_memory *);
diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c
index cc072c66c766..0f0493c63371 100644
--- a/drivers/xen/tmem.c
+++ b/drivers/xen/tmem.c
@@ -379,10 +379,10 @@ static int xen_tmem_init(void)
 #ifdef CONFIG_FRONTSWAP
        if (tmem_enabled && frontswap) {
                char *s = "";
-                struct frontswap_ops *old_ops =
+                struct frontswap_ops *old_ops;
-                        frontswap_register_ops(&tmem_frontswap_ops);
                tmem_frontswap_poolid = -1;
+                old_ops = frontswap_register_ops(&tmem_frontswap_ops);
                if (IS_ERR(old_ops) || old_ops) {
                        if (IS_ERR(old_ops))
                                return PTR_ERR(old_ops);
diff --git a/fs/aio.c b/fs/aio.c
index 7fe5bdee1630..2bbcacf74d0c 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -141,9 +141,6 @@ static void aio_free_ring(struct kioctx *ctx)
        for (i = 0; i < ctx->nr_pages; i++)
                put_page(ctx->ring_pages[i]);
-        if (ctx->mmap_size)
-                vm_munmap(ctx->mmap_base, ctx->mmap_size);
        if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages)
                kfree(ctx->ring_pages);
 }
@@ -322,11 +319,6 @@ static void free_ioctx(struct kioctx *ctx)
        aio_free_ring(ctx);
-        spin_lock(&aio_nr_lock);
-        BUG_ON(aio_nr - ctx->max_reqs > aio_nr);
-        aio_nr -= ctx->max_reqs;
-        spin_unlock(&aio_nr_lock);
        pr_debug("freeing %p\n", ctx);
        /*
@@ -435,17 +427,24 @@ static void kill_ioctx(struct kioctx *ctx)
 {
        if (!atomic_xchg(&ctx->dead, 1)) {
                hlist_del_rcu(&ctx->list);
-                /* Between hlist_del_rcu() and dropping the initial ref */
-                synchronize_rcu();
                /*
-                 * We can't punt to workqueue here because put_ioctx() ->
+                 * It'd be more correct to do this in free_ioctx(), after all
-                 * free_ioctx() will unmap the ringbuffer, and that has to be
+                 * the outstanding kiocbs have finished - but by then io_destroy
-                 * done in the original process's context. kill_ioctx_rcu/work()
+                 * has already returned, so io_setup() could potentially return
-                 * exist for exit_aio(), as in that path free_ioctx() won't do
+                 * -EAGAIN with no ioctxs actually in use (as far as userspace
-                 * the unmap.
+                 *  could tell).
                 */
-                kill_ioctx_work(&ctx->rcu_work);
+                spin_lock(&aio_nr_lock);
+                BUG_ON(aio_nr - ctx->max_reqs > aio_nr);
+                aio_nr -= ctx->max_reqs;
+                spin_unlock(&aio_nr_lock);
+                if (ctx->mmap_size)
+                        vm_munmap(ctx->mmap_base, ctx->mmap_size);
+                /* Between hlist_del_rcu() and dropping the initial ref */
+                call_rcu(&ctx->rcu_head, kill_ioctx_rcu);
        }
 }
@@ -495,10 +494,7 @@ void exit_aio(struct mm_struct *mm)
                 */
                ctx->mmap_size = 0;
-                if (!atomic_xchg(&ctx->dead, 1)) {
+                kill_ioctx(ctx);
-                        hlist_del_rcu(&ctx->list);
-                        call_rcu(&ctx->rcu_head, kill_ioctx_rcu);
-                }
        }
 }
diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index 202dd3d68be0..ebbf680378e2 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -191,27 +191,23 @@ void ceph_count_locks(struct inode *inode, int *fcntl_count, int *flock_count)
 }
 /**
- * Encode the flock and fcntl locks for the given inode into the pagelist.
+ * Encode the flock and fcntl locks for the given inode into the ceph_filelock
- * Format is: #fcntl locks, sequential fcntl locks, #flock locks,
+ * array. Must be called with lock_flocks() already held.
- * sequential flock locks.
+ * If we encounter more of a specific lock type than expected, return -ENOSPC.
- * Must be called with lock_flocks() already held.
- * If we encounter more of a specific lock type than expected,
- * we return the value 1.
 */
-int ceph_encode_locks(struct inode *inode, struct ceph_pagelist *pagelist,
+int ceph_encode_locks_to_buffer(struct inode *inode,
-                      int num_fcntl_locks, int num_flock_locks)
+                                struct ceph_filelock *flocks,
+                                int num_fcntl_locks, int num_flock_locks)
 {
        struct file_lock *lock;
-        struct ceph_filelock cephlock;
        int err = 0;
        int seen_fcntl = 0;
        int seen_flock = 0;
+        int l = 0;
        dout("encoding %d flock and %d fcntl locks", num_flock_locks,
             num_fcntl_locks);
-        err = ceph_pagelist_append(pagelist, &num_fcntl_locks, sizeof(u32));
-        if (err)
-                goto fail;
        for (lock = inode->i_flock; lock != NULL; lock = lock->fl_next) {
                if (lock->fl_flags & FL_POSIX) {
                        ++seen_fcntl;
@@ -219,19 +215,12 @@ int ceph_encode_locks(struct inode *inode, struct ceph_pagelist *pagelist,
                                err = -ENOSPC;
                                goto fail;
                        }
-                        err = lock_to_ceph_filelock(lock, &cephlock);
+                        err = lock_to_ceph_filelock(lock, &flocks[l]);
                        if (err)
                                goto fail;
-                        err = ceph_pagelist_append(pagelist, &cephlock,
+                        ++l;
-                                           sizeof(struct ceph_filelock));
                }
-                if (err)
-                        goto fail;
        }
-        err = ceph_pagelist_append(pagelist, &num_flock_locks, sizeof(u32));
-        if (err)
-                goto fail;
        for (lock = inode->i_flock; lock != NULL; lock = lock->fl_next) {
                if (lock->fl_flags & FL_FLOCK) {
                        ++seen_flock;
@@ -239,19 +228,51 @@ int ceph_encode_locks(struct inode *inode, struct ceph_pagelist *pagelist,
                                err = -ENOSPC;
                                goto fail;
                        }
-                        err = lock_to_ceph_filelock(lock, &cephlock);
+                        err = lock_to_ceph_filelock(lock, &flocks[l]);
                        if (err)
                                goto fail;
-                        err = ceph_pagelist_append(pagelist, &cephlock,
+                        ++l;
-                                           sizeof(struct ceph_filelock));
                }
-                if (err)
-                        goto fail;
        }
 fail:
        return err;
 }
+/**
+ * Copy the encoded flock and fcntl locks into the pagelist.
+ * Format is: #fcntl locks, sequential fcntl locks, #flock locks,
+ * sequential flock locks.
+ * Returns zero on success.
+ */
+int ceph_locks_to_pagelist(struct ceph_filelock *flocks,
+                           struct ceph_pagelist *pagelist,
+                           int num_fcntl_locks, int num_flock_locks)
+{
+        int err = 0;
+        __le32 nlocks;
+        nlocks = cpu_to_le32(num_fcntl_locks);
+        err = ceph_pagelist_append(pagelist, &nlocks, sizeof(nlocks));
+        if (err)
+                goto out_fail;
+        err = ceph_pagelist_append(pagelist, flocks,
+                                   num_fcntl_locks * sizeof(*flocks));
+        if (err)
+                goto out_fail;
+        nlocks = cpu_to_le32(num_flock_locks);
+        err = ceph_pagelist_append(pagelist, &nlocks, sizeof(nlocks));
+        if (err)
+                goto out_fail;
+        err = ceph_pagelist_append(pagelist,
+                                   &flocks[num_fcntl_locks],
+                                   num_flock_locks * sizeof(*flocks));
+out_fail:
+        return err;
+}
 /*
 * Given a pointer to a lock, convert it to a ceph filelock
 */
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 4f22671a5bd4..4d2920304be8 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2478,39 +2478,44 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
        if (recon_state->flock) {
                int num_fcntl_locks, num_flock_locks;
-                struct ceph_pagelist_cursor trunc_point;
+                struct ceph_filelock *flocks;
-                ceph_pagelist_set_cursor(pagelist, &trunc_point);
+encode_again:
-                do {
+                lock_flocks();
-                        lock_flocks();
+                ceph_count_locks(inode, &num_fcntl_locks, &num_flock_locks);
-                        ceph_count_locks(inode, &num_fcntl_locks,
+                unlock_flocks();
-                                         &num_flock_locks);
+                flocks = kmalloc((num_fcntl_locks+num_flock_locks) *
-                        rec.v2.flock_len = (2*sizeof(u32) +
+                                 sizeof(struct ceph_filelock), GFP_NOFS);
-                                            (num_fcntl_locks+num_flock_locks) *
+                if (!flocks) {
-                                            sizeof(struct ceph_filelock));
+                        err = -ENOMEM;
-                        unlock_flocks();
+                        goto out_free;
+                }
-                        /* pre-alloc pagelist */
+                lock_flocks();
-                        ceph_pagelist_truncate(pagelist, &trunc_point);
+                err = ceph_encode_locks_to_buffer(inode, flocks,
-                        err = ceph_pagelist_append(pagelist, &rec, reclen);
+                                                  num_fcntl_locks,
-                        if (!err)
+                                                  num_flock_locks);
-                                err = ceph_pagelist_reserve(pagelist,
+                unlock_flocks();
-                                                            rec.v2.flock_len);
+                if (err) {
+                        kfree(flocks);
-                        /* encode locks */
+                        if (err == -ENOSPC)
-                        if (!err) {
+                                goto encode_again;
-                                lock_flocks();
+                        goto out_free;
-                                err = ceph_encode_locks(inode,
+                }
-                                                        pagelist,
+                /*
-                                                        num_fcntl_locks,
+                 * number of encoded locks is stable, so copy to pagelist
-                                                        num_flock_locks);
+                 */
-                                unlock_flocks();
+                rec.v2.flock_len = cpu_to_le32(2*sizeof(u32) +
-                        }
+                                    (num_fcntl_locks+num_flock_locks) *
-                } while (err == -ENOSPC);
+                                    sizeof(struct ceph_filelock));
+                err = ceph_pagelist_append(pagelist, &rec, reclen);
+                if (!err)
+                        err = ceph_locks_to_pagelist(flocks, pagelist,
+                                                     num_fcntl_locks,
+                                                     num_flock_locks);
+                kfree(flocks);
        } else {
                err = ceph_pagelist_append(pagelist, &rec, reclen);
        }
 out_free:
        kfree(path);
 out_dput:
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 8696be2ff679..7ccfdb4aea2e 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -822,8 +822,13 @@ extern const struct export_operations ceph_export_ops;
 extern int ceph_lock(struct file *file, int cmd, struct file_lock *fl);
 extern int ceph_flock(struct file *file, int cmd, struct file_lock *fl);
 extern void ceph_count_locks(struct inode *inode, int *p_num, int *f_num);
-extern int ceph_encode_locks(struct inode *i, struct ceph_pagelist *p,
+extern int ceph_encode_locks_to_buffer(struct inode *inode,
-                             int p_locks, int f_locks);
+                                       struct ceph_filelock *flocks,
+                                       int num_fcntl_locks,
+                                       int num_flock_locks);
+extern int ceph_locks_to_pagelist(struct ceph_filelock *flocks,
+                                  struct ceph_pagelist *pagelist,
+                                  int num_fcntl_locks, int num_flock_locks);
 extern int lock_to_ceph_filelock(struct file_lock *fl, struct ceph_filelock *c);
 /* debugfs.c */
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index b3fdd1a323d6..e68588e6b1e8 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1408,6 +1408,7 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                                     mres->lockname_len, mres->lockname);
                                ret = -EFAULT;
                                spin_unlock(&res->spinlock);
+                                dlm_lockres_put(res);
                                goto leave;
                        }
                        res->state |= DLM_LOCK_RES_MIGRATING;
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 04ee1b57c243..b4a5cdf9dbc5 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -947,7 +947,7 @@ leave:
        ocfs2_free_dir_lookup_result(&orphan_insert);
        ocfs2_free_dir_lookup_result(&lookup);
-        if (status)
+        if (status && (status != -ENOTEMPTY))
                mlog_errno(status);
        return status;
@@ -2216,7 +2216,7 @@ out:
        brelse(orphan_dir_bh);
-        return 0;
+        return ret;
 }
 int ocfs2_create_inode_in_orphan(struct inode *dir,
diff --git a/fs/proc/kmsg.c b/fs/proc/kmsg.c
index bd4b5a740ff1..bdfabdaefdce 100644
--- a/fs/proc/kmsg.c
+++ b/fs/proc/kmsg.c
@@ -21,12 +21,12 @@ extern wait_queue_head_t log_wait;
 static int kmsg_open(struct inode * inode, struct file * file)
 {
-        return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_FILE);
+        return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_PROC);
 }
 static int kmsg_release(struct inode * inode, struct file * file)
 {
-        (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_FILE);
+        (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_PROC);
        return 0;
 }
@@ -34,15 +34,15 @@ static ssize_t kmsg_read(struct file *file, char __user *buf,
                         size_t count, loff_t *ppos)
 {
        if ((file->f_flags & O_NONBLOCK) &&
-            !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
+            !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_PROC))
                return -EAGAIN;
-        return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_FILE);
+        return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_PROC);
 }
 static unsigned int kmsg_poll(struct file *file, poll_table *wait)
 {
        poll_wait(file, &log_wait, wait);
-        if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
+        if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_PROC))
                return POLLIN | POLLRDNORM;
        return 0;
 }
diff --git a/include/asm-generic/kvm_para.h b/include/asm-generic/kvm_para.h
index 9d96605f160a..fa25becbdcaf 100644
--- a/include/asm-generic/kvm_para.h
+++ b/include/asm-generic/kvm_para.h
@@ -18,4 +18,9 @@ static inline unsigned int kvm_arch_para_features(void)
        return 0;
 }
+static inline bool kvm_para_available(void)
+{
+        return false;
+}
 #endif
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index c6f6e0839b61..9f3c7e81270a 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -175,6 +175,8 @@ extern struct bus_type cpu_subsys;
 extern void get_online_cpus(void);
 extern void put_online_cpus(void);
+extern void cpu_hotplug_disable(void);
+extern void cpu_hotplug_enable(void);
 #define hotcpu_notifier(fn, pri)        cpu_notifier(fn, pri)
 #define register_hotcpu_notifier(nb)    register_cpu_notifier(nb)
 #define unregister_hotcpu_notifier(nb)  unregister_cpu_notifier(nb)
@@ -198,6 +200,8 @@ static inline void cpu_hotplug_driver_unlock(void)
 #define get_online_cpus()       do { } while (0)
 #define put_online_cpus()       do { } while (0)
+#define cpu_hotplug_disable()   do { } while (0)
+#define cpu_hotplug_enable()    do { } while (0)
 #define hotcpu_notifier(fn, pri)        do { (void)(fn); } while (0)
 /* These aren't inline functions due to a GCC bug. */
 #define register_hotcpu_notifier(nb)    ({ (void)(nb); 0; })
diff --git a/include/linux/filter.h b/include/linux/filter.h
index c050dcc322a4..f65f5a69db8f 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -46,6 +46,7 @@ extern int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
 extern int sk_detach_filter(struct sock *sk);
 extern int sk_chk_filter(struct sock_filter *filter, unsigned int flen);
 extern int sk_get_filter(struct sock *sk, struct sock_filter __user *filter, unsigned len);
+extern void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to);
 #ifdef CONFIG_BPF_JIT
 #include <stdarg.h>
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 4474557904f6..16fae6436d0e 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -249,12 +249,12 @@ team_get_first_port_txable_rcu(struct team *team, struct team_port *port)
                return port;
        cur = port;
        list_for_each_entry_continue_rcu(cur, &team->port_list, list)
-                if (team_port_txable(port))
+                if (team_port_txable(cur))
                        return cur;
        list_for_each_entry_rcu(cur, &team->port_list, list) {
                if (cur == port)
                        break;
-                if (team_port_txable(port))
+                if (team_port_txable(cur))
                        return cur;
        }
        return NULL;
diff --git a/include/linux/math64.h b/include/linux/math64.h
index b8ba85544721..2913b86eb12a 100644
--- a/include/linux/math64.h
+++ b/include/linux/math64.h
@@ -6,7 +6,8 @@
 #if BITS_PER_LONG == 64
-#define div64_long(x,y) div64_s64((x),(y))
+#define div64_long(x, y) div64_s64((x), (y))
+#define div64_ul(x, y)   div64_u64((x), (y))
 /**
 * div_u64_rem - unsigned 64bit divide with 32bit divisor with remainder
@@ -47,7 +48,8 @@ static inline s64 div64_s64(s64 dividend, s64 divisor)
 #elif BITS_PER_LONG == 32
-#define div64_long(x,y) div_s64((x),(y))
+#define div64_long(x, y) div_s64((x), (y))
+#define div64_ul(x, y)   div_u64((x), (y))
 #ifndef div_u64_rem
 static inline u64 div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index 5951e3f38878..26806775b11b 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -111,6 +111,9 @@ static inline struct page *sg_page(struct scatterlist *sg)
 static inline void sg_set_buf(struct scatterlist *sg, const void *buf,
                              unsigned int buflen)
 {
+#ifdef CONFIG_DEBUG_SG
+        BUG_ON(!virt_addr_valid(buf));
+#endif
        sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf));
 }
diff --git a/include/linux/swapops.h b/include/linux/swapops.h
index 47ead515c811..c5fd30d2a415 100644
--- a/include/linux/swapops.h
+++ b/include/linux/swapops.h
@@ -137,6 +137,7 @@ static inline void make_migration_entry_read(swp_entry_t *entry)
 extern void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
                                        unsigned long address);
+extern void migration_entry_wait_huge(struct mm_struct *mm, pte_t *pte);
 #else
 #define make_migration_entry(page, write) swp_entry(0, 0)
@@ -148,6 +149,8 @@ static inline int is_migration_entry(swp_entry_t swp)
 static inline void make_migration_entry_read(swp_entry_t *entryp) { }
 static inline void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
                                         unsigned long address) { }
+static inline void migration_entry_wait_huge(struct mm_struct *mm,
+                                        pte_t *pte) { }
 static inline int is_write_migration_entry(swp_entry_t entry)
 {
        return 0;
diff --git a/include/linux/syslog.h b/include/linux/syslog.h
index 38911391a139..98a3153c0f96 100644
--- a/include/linux/syslog.h
+++ b/include/linux/syslog.h
@@ -44,8 +44,8 @@
 /* Return size of the log buffer */
 #define SYSLOG_ACTION_SIZE_BUFFER   10
-#define SYSLOG_FROM_CALL 0
+#define SYSLOG_FROM_READER           0
-#define SYSLOG_FROM_FILE 1
+#define SYSLOG_FROM_PROC             1
 int do_syslog(int type, char __user *buf, int count, bool from_file);
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 35a57cd1704c..7cb6d360d147 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1117,6 +1117,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_index_added(struct hci_dev *hdev);
 int mgmt_index_removed(struct hci_dev *hdev);
+int mgmt_set_powered_failed(struct hci_dev *hdev, int err);
 int mgmt_powered(struct hci_dev *hdev, u8 powered);
 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 22980a7c3873..9944c3e68c5d 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -42,6 +42,7 @@
 #define MGMT_STATUS_NOT_POWERED         0x0f
 #define MGMT_STATUS_CANCELLED           0x10
 #define MGMT_STATUS_INVALID_INDEX       0x11
+#define MGMT_STATUS_RFKILLED            0x12
 struct mgmt_hdr {
        __le16  opcode;
diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
index d4609029f014..385c6329a967 100644
--- a/include/sound/soc-dapm.h
+++ b/include/sound/soc-dapm.h
@@ -450,7 +450,8 @@ enum snd_soc_dapm_type {
        snd_soc_dapm_aif_in,            /* audio interface input */
        snd_soc_dapm_aif_out,           /* audio interface output */
        snd_soc_dapm_siggen,            /* signal generator */
-        snd_soc_dapm_dai,               /* link to DAI structure */
+        snd_soc_dapm_dai_in,            /* link to DAI structure */
+        snd_soc_dapm_dai_out,
        snd_soc_dapm_dai_link,          /* link between two DAI structures */
 };
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index a5c86fc34a37..d88c8ee00c8b 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -783,6 +783,7 @@ struct kvm_dirty_tlb {
 #define KVM_REG_IA64            0x3000000000000000ULL
 #define KVM_REG_ARM             0x4000000000000000ULL
 #define KVM_REG_S390            0x5000000000000000ULL
+#define KVM_REG_MIPS            0x7000000000000000ULL
 #define KVM_REG_SIZE_SHIFT      52
 #define KVM_REG_SIZE_MASK       0x00f0000000000000ULL
diff --git a/kernel/audit.c b/kernel/audit.c
index 21c7fa615bd3..91e53d04b6a9 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1056,7 +1056,7 @@ static inline void audit_get_stamp(struct audit_context *ctx,
 static void wait_for_auditd(unsigned long sleep_time)
 {
        DECLARE_WAITQUEUE(wait, current);
-        set_current_state(TASK_INTERRUPTIBLE);
+        set_current_state(TASK_UNINTERRUPTIBLE);
        add_wait_queue(&audit_backlog_wait, &wait);
        if (audit_backlog_limit &&
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index a291aa23fb3f..43c307dc9453 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -658,6 +658,7 @@ int audit_add_tree_rule(struct audit_krule *rule)
        struct vfsmount *mnt;
        int err;
+        rule->tree = NULL;
        list_for_each_entry(tree, &tree_list, list) {
                if (!strcmp(seed->pathname, tree->pathname)) {
                        put_tree(seed);
diff --git a/kernel/cpu.c b/kernel/cpu.c
index b5e4ab2d427e..198a38883e64 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -133,6 +133,27 @@ static void cpu_hotplug_done(void)
        mutex_unlock(&cpu_hotplug.lock);
 }
+/*
+ * Wait for currently running CPU hotplug operations to complete (if any) and
+ * disable future CPU hotplug (from sysfs). The 'cpu_add_remove_lock' protects
+ * the 'cpu_hotplug_disabled' flag. The same lock is also acquired by the
+ * hotplug path before performing hotplug operations. So acquiring that lock
+ * guarantees mutual exclusion from any currently running hotplug operations.
+ */
+void cpu_hotplug_disable(void)
+{
+        cpu_maps_update_begin();
+        cpu_hotplug_disabled = 1;
+        cpu_maps_update_done();
+}
+void cpu_hotplug_enable(void)
+{
+        cpu_maps_update_begin();
+        cpu_hotplug_disabled = 0;
+        cpu_maps_update_done();
+}
 #else /* #if CONFIG_HOTPLUG_CPU */
 static void cpu_hotplug_begin(void) {}
 static void cpu_hotplug_done(void) {}
@@ -541,36 +562,6 @@ static int __init alloc_frozen_cpus(void)
 core_initcall(alloc_frozen_cpus);
 /*
- * Prevent regular CPU hotplug from racing with the freezer, by disabling CPU
- * hotplug when tasks are about to be frozen. Also, don't allow the freezer
- * to continue until any currently running CPU hotplug operation gets
- * completed.
- * To modify the 'cpu_hotplug_disabled' flag, we need to acquire the
- * 'cpu_add_remove_lock'. And this same lock is also taken by the regular
- * CPU hotplug path and released only after it is complete. Thus, we
- * (and hence the freezer) will block here until any currently running CPU
- * hotplug operation gets completed.
- */
-void cpu_hotplug_disable_before_freeze(void)
-{
-        cpu_maps_update_begin();
-        cpu_hotplug_disabled = 1;
-        cpu_maps_update_done();
-}
-/*
- * When tasks have been thawed, re-enable regular CPU hotplug (which had been
- * disabled while beginning to freeze tasks).
- */
-void cpu_hotplug_enable_after_thaw(void)
-{
-        cpu_maps_update_begin();
-        cpu_hotplug_disabled = 0;
-        cpu_maps_update_done();
-}
-/*
 * When callbacks for CPU hotplug notifications are being executed, we must
 * ensure that the state of the system with respect to the tasks being frozen
 * or not, as reported by the notification, remains unchanged *throughout the
@@ -589,12 +580,12 @@ cpu_hotplug_pm_callback(struct notifier_block *nb,
        case PM_SUSPEND_PREPARE:
        case PM_HIBERNATION_PREPARE:
-                cpu_hotplug_disable_before_freeze();
+                cpu_hotplug_disable();
                break;
        case PM_POST_SUSPEND:
        case PM_POST_HIBERNATION:
-                cpu_hotplug_enable_after_thaw();
+                cpu_hotplug_enable();
                break;
        default:
diff --git a/kernel/printk.c b/kernel/printk.c
index fa36e1494420..8212c1aef125 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -363,6 +363,53 @@ static void log_store(int facility, int level,
        log_next_seq++;
 }
+#ifdef CONFIG_SECURITY_DMESG_RESTRICT
+int dmesg_restrict = 1;
+#else
+int dmesg_restrict;
+#endif
+static int syslog_action_restricted(int type)
+{
+        if (dmesg_restrict)
+                return 1;
+        /*
+         * Unless restricted, we allow "read all" and "get buffer size"
+         * for everybody.
+         */
+        return type != SYSLOG_ACTION_READ_ALL &&
+               type != SYSLOG_ACTION_SIZE_BUFFER;
+}
+static int check_syslog_permissions(int type, bool from_file)
+{
+        /*
+         * If this is from /proc/kmsg and we've already opened it, then we've
+         * already done the capabilities checks at open time.
+         */
+        if (from_file && type != SYSLOG_ACTION_OPEN)
+                return 0;
+        if (syslog_action_restricted(type)) {
+                if (capable(CAP_SYSLOG))
+                        return 0;
+                /*
+                 * For historical reasons, accept CAP_SYS_ADMIN too, with
+                 * a warning.
+                 */
+                if (capable(CAP_SYS_ADMIN)) {
+                        pr_warn_once("%s (%d): Attempt to access syslog with "
+                                     "CAP_SYS_ADMIN but no CAP_SYSLOG "
+                                     "(deprecated).\n",
+                                 current->comm, task_pid_nr(current));
+                        return 0;
+                }
+                return -EPERM;
+        }
+        return security_syslog(type);
+}
 /* /dev/kmsg - userspace message inject/listen interface */
 struct devkmsg_user {
        u64 seq;
@@ -620,7 +667,8 @@ static int devkmsg_open(struct inode *inode, struct file *file)
        if ((file->f_flags & O_ACCMODE) == O_WRONLY)
                return 0;
-        err = security_syslog(SYSLOG_ACTION_READ_ALL);
+        err = check_syslog_permissions(SYSLOG_ACTION_READ_ALL,
+                                       SYSLOG_FROM_READER);
        if (err)
                return err;
@@ -813,45 +861,6 @@ static inline void boot_delay_msec(int level)
 }
 #endif
-#ifdef CONFIG_SECURITY_DMESG_RESTRICT
-int dmesg_restrict = 1;
-#else
-int dmesg_restrict;
-#endif
-static int syslog_action_restricted(int type)
-{
-        if (dmesg_restrict)
-                return 1;
-        /* Unless restricted, we allow "read all" and "get buffer size" for everybody */
-        return type != SYSLOG_ACTION_READ_ALL && type != SYSLOG_ACTION_SIZE_BUFFER;
-}
-static int check_syslog_permissions(int type, bool from_file)
-{
-        /*
-         * If this is from /proc/kmsg and we've already opened it, then we've
-         * already done the capabilities checks at open time.
-         */
-        if (from_file && type != SYSLOG_ACTION_OPEN)
-                return 0;
-        if (syslog_action_restricted(type)) {
-                if (capable(CAP_SYSLOG))
-                        return 0;
-                /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
-                if (capable(CAP_SYS_ADMIN)) {
-                        printk_once(KERN_WARNING "%s (%d): "
-                                 "Attempt to access syslog with CAP_SYS_ADMIN "
-                                 "but no CAP_SYSLOG (deprecated).\n",
-                                 current->comm, task_pid_nr(current));
-                        return 0;
-                }
-                return -EPERM;
-        }
-        return 0;
-}
 #if defined(CONFIG_PRINTK_TIME)
 static bool printk_time = 1;
 #else
@@ -1249,7 +1258,7 @@ out:
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
 {
-        return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
+        return do_syslog(type, buf, len, SYSLOG_FROM_READER);
 }
 /*
diff --git a/kernel/softirq.c b/kernel/softirq.c
index b5197dcb0dad..3d6833f125d3 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -195,8 +195,12 @@ void local_bh_enable_ip(unsigned long ip)
 EXPORT_SYMBOL(local_bh_enable_ip);
 /*
- * We restart softirq processing for at most 2 ms,
+ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
- * and if need_resched() is not set.
+ * but break the loop if need_resched() is set or after 2 ms.
+ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
+ * certain cases, such as stop_machine(), jiffies may cease to
+ * increment and so we need the MAX_SOFTIRQ_RESTART limit as
+ * well to make sure we eventually return from this method.
 *
 * These limits have been established via experimentation.
 * The two things to balance is latency against fairness -
@@ -204,6 +208,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
 * should not be able to lock up the box.
 */
 #define MAX_SOFTIRQ_TIME  msecs_to_jiffies(2)
+#define MAX_SOFTIRQ_RESTART 10
 asmlinkage void __do_softirq(void)
 {
@@ -212,6 +217,7 @@ asmlinkage void __do_softirq(void)
        unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
        int cpu;
        unsigned long old_flags = current->flags;
+        int max_restart = MAX_SOFTIRQ_RESTART;
        /*
         * Mask out PF_MEMALLOC s current task context is borrowed for the
@@ -265,7 +271,8 @@ restart:
        pending = local_softirq_pending();
        if (pending) {
-                if (time_before(jiffies, end) && !need_resched())
+                if (time_before(jiffies, end) && !need_resched() &&
+                    --max_restart)
                        goto restart;
                wakeup_softirqd();
diff --git a/kernel/sys.c b/kernel/sys.c
index b95d3c72ba21..2bbd9a73b54c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -362,6 +362,29 @@ int unregister_reboot_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_reboot_notifier);
+/* Add backwards compatibility for stable trees. */
+#ifndef PF_NO_SETAFFINITY
+#define PF_NO_SETAFFINITY               PF_THREAD_BOUND
+#endif
+static void migrate_to_reboot_cpu(void)
+{
+        /* The boot cpu is always logical cpu 0 */
+        int cpu = 0;
+        cpu_hotplug_disable();
+        /* Make certain the cpu I'm about to reboot on is online */
+        if (!cpu_online(cpu))
+                cpu = cpumask_first(cpu_online_mask);
+        /* Prevent races with other tasks migrating this task */
+        current->flags |= PF_NO_SETAFFINITY;
+        /* Make certain I only run on the appropriate processor */
+        set_cpus_allowed_ptr(current, cpumask_of(cpu));
+}
 /**
 *      kernel_restart - reboot the system
 *      @cmd: pointer to buffer containing command to execute for restart
@@ -373,7 +396,7 @@ EXPORT_SYMBOL(unregister_reboot_notifier);
 void kernel_restart(char *cmd)
 {
        kernel_restart_prepare(cmd);
-        disable_nonboot_cpus();
+        migrate_to_reboot_cpu();
        syscore_shutdown();
        if (!cmd)
                printk(KERN_EMERG "Restarting system.\n");
@@ -400,7 +423,7 @@ static void kernel_shutdown_prepare(enum system_states state)
 void kernel_halt(void)
 {
        kernel_shutdown_prepare(SYSTEM_HALT);
-        disable_nonboot_cpus();
+        migrate_to_reboot_cpu();
        syscore_shutdown();
        printk(KERN_EMERG "System halted.\n");
        kmsg_dump(KMSG_DUMP_HALT);
@@ -419,7 +442,7 @@ void kernel_power_off(void)
        kernel_shutdown_prepare(SYSTEM_POWER_OFF);
        if (pm_power_off_prepare)
                pm_power_off_prepare();
-        disable_nonboot_cpus();
+        migrate_to_reboot_cpu();
        syscore_shutdown();
        printk(KERN_EMERG "Power down.\n");
        kmsg_dump(KMSG_DUMP_POWEROFF);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1a41023a1f88..e71a8be4a6ee 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -652,8 +652,6 @@ static struct {
        ARCH_TRACE_CLOCKS
 };
-int trace_clock_id;
 /*
 * trace_parser_get_init - gets the buffer for trace parser
 */
@@ -2826,7 +2824,7 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
                iter->iter_flags |= TRACE_FILE_ANNOTATE;
        /* Output in nanoseconds only if we are using a clock in nanoseconds. */
-        if (trace_clocks[trace_clock_id].in_ns)
+        if (trace_clocks[tr->clock_id].in_ns)
                iter->iter_flags |= TRACE_FILE_TIME_IN_NS;
        /* stop the trace while dumping if we are not opening "snapshot" */
@@ -3825,7 +3823,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
                iter->iter_flags |= TRACE_FILE_LAT_FMT;
        /* Output in nanoseconds only if we are using a clock in nanoseconds. */
-        if (trace_clocks[trace_clock_id].in_ns)
+        if (trace_clocks[tr->clock_id].in_ns)
                iter->iter_flags |= TRACE_FILE_TIME_IN_NS;
        iter->cpu_file = tc->cpu;
@@ -5095,7 +5093,7 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
        cnt = ring_buffer_bytes_cpu(trace_buf->buffer, cpu);
        trace_seq_printf(s, "bytes: %ld\n", cnt);
-        if (trace_clocks[trace_clock_id].in_ns) {
+        if (trace_clocks[tr->clock_id].in_ns) {
                /* local or global for trace_clock */
                t = ns2usecs(ring_buffer_oldest_event_ts(trace_buf->buffer, cpu));
                usec_rem = do_div(t, USEC_PER_SEC);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 711ca7d3e7f1..20572ed88c5c 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -700,8 +700,6 @@ enum print_line_t print_trace_line(struct trace_iterator *iter);
 extern unsigned long trace_flags;
-extern int trace_clock_id;
 /* Standard output formatting function used for function return traces */
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 5f9c44cdf1f5..4cc6442733f4 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -37,7 +37,7 @@ MPI mpi_read_raw_data(const void *xbuffer, size_t nbytes)
        mpi_limb_t a;
        MPI val = NULL;
-        while (nbytes >= 0 && buffer[0] == 0) {
+        while (nbytes > 0 && buffer[0] == 0) {
                buffer++;
                nbytes--;
        }
diff --git a/mm/frontswap.c b/mm/frontswap.c
index 538367ef1372..1b24bdcb3197 100644
--- a/mm/frontswap.c
+++ b/mm/frontswap.c
@@ -319,7 +319,7 @@ void __frontswap_invalidate_area(unsigned type)
                        return;
                frontswap_ops->invalidate_area(type);
                atomic_set(&sis->frontswap_pages, 0);
-                memset(sis->frontswap_map, 0, sis->max / sizeof(long));
+                bitmap_zero(sis->frontswap_map, sis->max);
        }
        clear_bit(type, need_init);
 }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index f8feeeca6686..e2bfbf73a551 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2839,7 +2839,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
        if (ptep) {
                entry = huge_ptep_get(ptep);
                if (unlikely(is_hugetlb_entry_migration(entry))) {
-                        migration_entry_wait(mm, (pmd_t *)ptep, address);
+                        migration_entry_wait_huge(mm, ptep);
                        return 0;
                } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
                        return VM_FAULT_HWPOISON_LARGE |
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 010d6c14129a..194721839cf5 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1199,7 +1199,6 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
                        mz = mem_cgroup_zoneinfo(root, nid, zid);
                        iter = &mz->reclaim_iter[reclaim->priority];
-                        last_visited = iter->last_visited;
                        if (prev && reclaim->generation != iter->generation) {
                                iter->last_visited = NULL;
                                goto out_unlock;
@@ -1218,13 +1217,12 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
                         * is alive.
                         */
                        dead_count = atomic_read(&root->dead_count);
-                        smp_rmb();
+                        if (dead_count == iter->last_dead_count) {
-                        last_visited = iter->last_visited;
+                                smp_rmb();
-                        if (last_visited) {
+                                last_visited = iter->last_visited;
-                                if ((dead_count != iter->last_dead_count) ||
+                                if (last_visited &&
-                                        !css_tryget(&last_visited->css)) {
+                                    !css_tryget(&last_visited->css))
                                        last_visited = NULL;
-                                }
                        }
                }
@@ -3141,8 +3139,6 @@ int memcg_update_cache_size(struct kmem_cache *s, int num_groups)
                        return -ENOMEM;
                }
-                INIT_WORK(&s->memcg_params->destroy,
-                                kmem_cache_destroy_work_func);
                s->memcg_params->is_root_cache = true;
                /*
diff --git a/mm/migrate.c b/mm/migrate.c
index b1f57501de9c..6f0c24438bba 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -200,15 +200,14 @@ static void remove_migration_ptes(struct page *old, struct page *new)
 * get to the page and wait until migration is finished.
 * When we return from this function the fault will be retried.
 */
-void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+static void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
-                                unsigned long address)
+                                spinlock_t *ptl)
 {
-        pte_t *ptep, pte;
+        pte_t pte;
-        spinlock_t *ptl;
        swp_entry_t entry;
        struct page *page;
-        ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
+        spin_lock(ptl);
        pte = *ptep;
        if (!is_swap_pte(pte))
                goto out;
@@ -236,6 +235,20 @@ out:
        pte_unmap_unlock(ptep, ptl);
 }
+void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+                                unsigned long address)
+{
+        spinlock_t *ptl = pte_lockptr(mm, pmd);
+        pte_t *ptep = pte_offset_map(pmd, address);
+        __migration_entry_wait(mm, ptep, ptl);
+}
+void migration_entry_wait_huge(struct mm_struct *mm, pte_t *pte)
+{
+        spinlock_t *ptl = &(mm)->page_table_lock;
+        __migration_entry_wait(mm, pte, ptl);
+}
 #ifdef CONFIG_BLOCK
 /* Returns true if all buffers are successfully locked */
 static bool buffer_migrate_lock_buffers(struct buffer_head *head,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 378a15bcd649..c3edb624fccf 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1628,6 +1628,7 @@ static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
        long min = mark;
        long lowmem_reserve = z->lowmem_reserve[classzone_idx];
        int o;
+        long free_cma = 0;
        free_pages -= (1 << order) - 1;
        if (alloc_flags & ALLOC_HIGH)
@@ -1637,9 +1638,10 @@ static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
 #ifdef CONFIG_CMA
        /* If allocation can't use CMA areas don't use free CMA pages */
        if (!(alloc_flags & ALLOC_CMA))
-                free_pages -= zone_page_state(z, NR_FREE_CMA_PAGES);
+                free_cma = zone_page_state(z, NR_FREE_CMA_PAGES);
 #endif
-        if (free_pages <= min + lowmem_reserve)
+        if (free_pages - free_cma <= min + lowmem_reserve)
                return false;
        for (o = 0; o < order; o++) {
                /* At the next order, this order's pages become unavailable */
diff --git a/mm/swap_state.c b/mm/swap_state.c
index b3d40dcf3624..f24ab0dff554 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -336,8 +336,24 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                 * Swap entry may have been freed since our caller observed it.
                 */
                err = swapcache_prepare(entry);
-                if (err == -EEXIST) {   /* seems racy */
+                if (err == -EEXIST) {
                        radix_tree_preload_end();
+                        /*
+                         * We might race against get_swap_page() and stumble
+                         * across a SWAP_HAS_CACHE swap_map entry whose page
+                         * has not been brought into the swapcache yet, while
+                         * the other end is scheduled away waiting on discard
+                         * I/O completion at scan_swap_map().
+                         *
+                         * In order to avoid turning this transitory state
+                         * into a permanent loop around this -EEXIST case
+                         * if !CONFIG_PREEMPT and the I/O completion happens
+                         * to be waiting on the CPU waitqueue where we are now
+                         * busy looping, we just conditionally invoke the
+                         * scheduler here, if there are some more important
+                         * tasks to run.
+                         */
+                        cond_resched();
                        continue;
                }
                if (err) {              /* swp entry is obsolete ? */
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 6c340d908b27..746af55b8455 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2116,7 +2116,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
        }
        /* frontswap enabled? set up bit-per-page map for frontswap */
        if (frontswap_enabled)
-                frontswap_map = vzalloc(maxpages / sizeof(long));
+                frontswap_map = vzalloc(BITS_TO_LONGS(maxpages) * sizeof(long));
        if (p->bdev) {
                if (blk_queue_nonrot(bdev_get_queue(p->bdev))) {
diff --git a/net/9p/client.c b/net/9p/client.c
index 8eb75425e6e6..addc116cecf0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -562,36 +562,19 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
        if (!p9_is_proto_dotl(c)) {
                /* Error is reported in string format */
-                uint16_t len;
+                int len;
-                /* 7 = header size for RERROR, 2 is the size of string len; */
+                /* 7 = header size for RERROR; */
-                int inline_len = in_hdrlen - (7 + 2);
+                int inline_len = in_hdrlen - 7;
-                /* Read the size of error string */
+                len =  req->rc->size - req->rc->offset;
-                err = p9pdu_readf(req->rc, c->proto_version, "w", &len);
+                if (len > (P9_ZC_HDR_SZ - 7)) {
-                if (err)
+                        err = -EFAULT;
-                        goto out_err;
-                ename = kmalloc(len + 1, GFP_NOFS);
-                if (!ename) {
-                        err = -ENOMEM;
                        goto out_err;
                }
-                if (len <= inline_len) {
-                        /* We have error in protocol buffer itself */
-                        if (pdu_read(req->rc, ename, len)) {
-                                err = -EFAULT;
-                                goto out_free;
-                        }
+                ename = &req->rc->sdata[req->rc->offset];
-                } else {
+                if (len > inline_len) {
-                        /*
+                        /* We have error in external buffer */
-                         *  Part of the data is in user space buffer.
-                         */
-                        if (pdu_read(req->rc, ename, inline_len)) {
-                                err = -EFAULT;
-                                goto out_free;
-                        }
                        if (kern_buf) {
                                memcpy(ename + inline_len, uidata,
                                       len - inline_len);
@@ -600,19 +583,19 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
                                                     uidata, len - inline_len);
                                if (err) {
                                        err = -EFAULT;
-                                        goto out_free;
+                                        goto out_err;
                                }
                        }
                }
-                ename[len] = 0;
+                ename = NULL;
-                if (p9_is_proto_dotu(c)) {
+                err = p9pdu_readf(req->rc, c->proto_version, "s?d",
-                        /* For dotu we also have error code */
+                                  &ename, &ecode);
-                        err = p9pdu_readf(req->rc,
+                if (err)
-                                          c->proto_version, "d", &ecode);
+                        goto out_err;
-                        if (err)
-                                goto out_free;
+                if (p9_is_proto_dotu(c))
                        err = -ecode;
-                }
                if (!err || !IS_ERR_VALUE(err)) {
                        err = p9_errstr2errno(ename, strlen(ename));
@@ -628,8 +611,6 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
        }
        return err;
-out_free:
-        kfree(ename);
 out_err:
        p9_debug(P9_DEBUG_ERROR, "couldn't parse error%d\n", err);
        return err;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 33843c5c4939..d817c932d634 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1555,11 +1555,15 @@ static const struct rfkill_ops hci_rfkill_ops = {
 static void hci_power_on(struct work_struct *work)
 {
        struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
+        int err;
        BT_DBG("%s", hdev->name);
-        if (hci_dev_open(hdev->id) < 0)
+        err = hci_dev_open(hdev->id);
+        if (err < 0) {
+                mgmt_set_powered_failed(hdev, err);
                return;
+        }
        if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
                queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a76d1ac0321b..24bee07ee4ce 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3677,10 +3677,14 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
 }
 static inline int l2cap_command_rej(struct l2cap_conn *conn,
-                                    struct l2cap_cmd_hdr *cmd, u8 *data)
+                                    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                    u8 *data)
 {
        struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
+        if (cmd_len < sizeof(*rej))
+                return -EPROTO;
        if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
                return 0;
@@ -3829,11 +3833,14 @@ sendresp:
 }
 static int l2cap_connect_req(struct l2cap_conn *conn,
-                             struct l2cap_cmd_hdr *cmd, u8 *data)
+                             struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
        struct hci_dev *hdev = conn->hcon->hdev;
        struct hci_conn *hcon = conn->hcon;
+        if (cmd_len < sizeof(struct l2cap_conn_req))
+                return -EPROTO;
        hci_dev_lock(hdev);
        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
            !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
@@ -3847,7 +3854,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
 }
 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
-                                    struct l2cap_cmd_hdr *cmd, u8 *data)
+                                    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                    u8 *data)
 {
        struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
        u16 scid, dcid, result, status;
@@ -3855,6 +3863,9 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
        u8 req[128];
        int err;
+        if (cmd_len < sizeof(*rsp))
+                return -EPROTO;
        scid   = __le16_to_cpu(rsp->scid);
        dcid   = __le16_to_cpu(rsp->dcid);
        result = __le16_to_cpu(rsp->result);
@@ -3952,6 +3963,9 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
        struct l2cap_chan *chan;
        int len, err = 0;
+        if (cmd_len < sizeof(*req))
+                return -EPROTO;
        dcid  = __le16_to_cpu(req->dcid);
        flags = __le16_to_cpu(req->flags);
@@ -3975,7 +3989,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
        /* Reject if config buffer is too small. */
        len = cmd_len - sizeof(*req);
-        if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
+        if (chan->conf_len + len > sizeof(chan->conf_req)) {
                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                               l2cap_build_conf_rsp(chan, rsp,
                               L2CAP_CONF_REJECT, flags), rsp);
@@ -4053,14 +4067,18 @@ unlock:
 }
 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
-                                   struct l2cap_cmd_hdr *cmd, u8 *data)
+                                   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                   u8 *data)
 {
        struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
        u16 scid, flags, result;
        struct l2cap_chan *chan;
-        int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
+        int len = cmd_len - sizeof(*rsp);
        int err = 0;
+        if (cmd_len < sizeof(*rsp))
+                return -EPROTO;
        scid   = __le16_to_cpu(rsp->scid);
        flags  = __le16_to_cpu(rsp->flags);
        result = __le16_to_cpu(rsp->result);
@@ -4161,7 +4179,8 @@ done:
 }
 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
-                                       struct l2cap_cmd_hdr *cmd, u8 *data)
+                                       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                       u8 *data)
 {
        struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
        struct l2cap_disconn_rsp rsp;
@@ -4169,6 +4188,9 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
        struct l2cap_chan *chan;
        struct sock *sk;
+        if (cmd_len != sizeof(*req))
+                return -EPROTO;
        scid = __le16_to_cpu(req->scid);
        dcid = __le16_to_cpu(req->dcid);
@@ -4208,12 +4230,16 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
 }
 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
-                                       struct l2cap_cmd_hdr *cmd, u8 *data)
+                                       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                       u8 *data)
 {
        struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
        u16 dcid, scid;
        struct l2cap_chan *chan;
+        if (cmd_len != sizeof(*rsp))
+                return -EPROTO;
        scid = __le16_to_cpu(rsp->scid);
        dcid = __le16_to_cpu(rsp->dcid);
@@ -4243,11 +4269,15 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
 }
 static inline int l2cap_information_req(struct l2cap_conn *conn,
-                                        struct l2cap_cmd_hdr *cmd, u8 *data)
+                                        struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                        u8 *data)
 {
        struct l2cap_info_req *req = (struct l2cap_info_req *) data;
        u16 type;
+        if (cmd_len != sizeof(*req))
+                return -EPROTO;
        type = __le16_to_cpu(req->type);
        BT_DBG("type 0x%4.4x", type);
@@ -4294,11 +4324,15 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
 }
 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
-                                        struct l2cap_cmd_hdr *cmd, u8 *data)
+                                        struct l2cap_cmd_hdr *cmd, u16 cmd_len,
+                                        u8 *data)
 {
        struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
        u16 type, result;
+        if (cmd_len != sizeof(*rsp))
+                return -EPROTO;
        type   = __le16_to_cpu(rsp->type);
        result = __le16_to_cpu(rsp->result);
@@ -5164,16 +5198,16 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
        switch (cmd->code) {
        case L2CAP_COMMAND_REJ:
-                l2cap_command_rej(conn, cmd, data);
+                l2cap_command_rej(conn, cmd, cmd_len, data);
                break;
        case L2CAP_CONN_REQ:
-                err = l2cap_connect_req(conn, cmd, data);
+                err = l2cap_connect_req(conn, cmd, cmd_len, data);
                break;
        case L2CAP_CONN_RSP:
        case L2CAP_CREATE_CHAN_RSP:
-                err = l2cap_connect_create_rsp(conn, cmd, data);
+                err = l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
                break;
        case L2CAP_CONF_REQ:
@@ -5181,15 +5215,15 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                break;
        case L2CAP_CONF_RSP:
-                err = l2cap_config_rsp(conn, cmd, data);
+                err = l2cap_config_rsp(conn, cmd, cmd_len, data);
                break;
        case L2CAP_DISCONN_REQ:
-                err = l2cap_disconnect_req(conn, cmd, data);
+                err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
                break;
        case L2CAP_DISCONN_RSP:
-                err = l2cap_disconnect_rsp(conn, cmd, data);
+                err = l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
                break;
        case L2CAP_ECHO_REQ:
@@ -5200,11 +5234,11 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                break;
        case L2CAP_INFO_REQ:
-                err = l2cap_information_req(conn, cmd, data);
+                err = l2cap_information_req(conn, cmd, cmd_len, data);
                break;
        case L2CAP_INFO_RSP:
-                err = l2cap_information_rsp(conn, cmd, data);
+                err = l2cap_information_rsp(conn, cmd, cmd_len, data);
                break;
        case L2CAP_CREATE_CHAN_REQ:
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 35fef22703e9..f8ecbc70293d 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2700,7 +2700,7 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                break;
        case DISCOV_TYPE_LE:
-                if (!lmp_host_le_capable(hdev)) {
+                if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
                                         MGMT_STATUS_NOT_SUPPORTED);
                        mgmt_pending_remove(cmd);
@@ -3418,6 +3418,27 @@ new_settings:
        return err;
 }
+int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
+{
+        struct pending_cmd *cmd;
+        u8 status;
+        cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+        if (!cmd)
+                return -ENOENT;
+        if (err == -ERFKILL)
+                status = MGMT_STATUS_RFKILLED;
+        else
+                status = MGMT_STATUS_FAILED;
+        err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
+        mgmt_pending_remove(cmd);
+        return err;
+}
 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
 {
        struct cmd_lookup match = { NULL, hdev };
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index b2296d3857a0..b5562abdd6e0 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -770,7 +770,7 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
        BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
-        if (!lmp_host_le_capable(hcon->hdev))
+        if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
                return 1;
        if (sec_level == BT_SECURITY_LOW)
@@ -851,7 +851,7 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
        __u8 reason;
        int err = 0;
-        if (!lmp_host_le_capable(conn->hcon->hdev)) {
+        if (!test_bit(HCI_LE_ENABLED, &conn->hcon->hdev->dev_flags)) {
                err = -ENOTSUPP;
                reason = SMP_PAIRING_NOTSUPP;
                goto done;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index d5953b87918c..3a246a6cab47 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1675,13 +1675,13 @@ static void kick_requests(struct ceph_osd_client *osdc, int force_resend)
                __register_request(osdc, req);
                __unregister_linger_request(osdc, req);
        }
+        reset_changed_osds(osdc);
        mutex_unlock(&osdc->request_mutex);
        if (needmap) {
                dout("%d requests for down osds, need new map\n", needmap);
                ceph_monc_request_next_osdmap(&osdc->client->monc);
        }
-        reset_changed_osds(osdc);
 }
diff --git a/net/core/filter.c b/net/core/filter.c
index dad2a178f9f8..6438f29ff266 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -778,7 +778,7 @@ int sk_detach_filter(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(sk_detach_filter);
-static void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
+void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
 {
        static const u16 decodes[] = {
                [BPF_S_ALU_ADD_K]       = BPF_ALU|BPF_ADD|BPF_K,
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index d5bef0b0f639..a0e9cf6379de 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -73,8 +73,13 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
                goto out;
        }
-        if (filter)
+        if (filter) {
-                memcpy(nla_data(attr), filter->insns, len);
+                struct sock_filter *fb = (struct sock_filter *)nla_data(attr);
+                int i;
+                for (i = 0; i < filter->len; i++, fb++)
+                        sk_decode_filter(&filter->insns[i], fb);
+        }
 out:
        rcu_read_unlock();
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 5b142fb16480..9e6c2a075a4c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2542,6 +2542,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
                struct ip_vs_dest *dest;
                struct ip_vs_dest_entry entry;
+                memset(&entry, 0, sizeof(entry));
                list_for_each_entry(dest, &svc->destinations, n_list) {
                        if (count >= get->num_dests)
                                break;
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index dc3fd5d44464..c7b6d466a662 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -149,9 +149,12 @@ nfnl_acct_dump(struct sk_buff *skb, struct netlink_callback *cb)
        rcu_read_lock();
        list_for_each_entry_rcu(cur, &nfnl_acct_list, head) {
-                if (last && cur != last)
+                if (last) {
-                        continue;
+                        if (cur != last)
+                                continue;
+                        last = NULL;
+                }
                if (nfnl_acct_fill_info(skb, NETLINK_CB(cb->skb).portid,
                                       cb->nlh->nlmsg_seq,
                                       NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 701c88a20fea..65074dfb9383 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -220,9 +220,12 @@ ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
        rcu_read_lock();
        list_for_each_entry_rcu(cur, &cttimeout_list, head) {
-                if (last && cur != last)
+                if (last) {
-                        continue;
+                        if (cur != last)
+                                continue;
+                        last = NULL;
+                }
                if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
                                           cb->nlh->nlmsg_seq,
                                           NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 4e27fa035814..5352b2d2d5bf 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -637,9 +637,6 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
        if (queue->copy_mode == NFQNL_COPY_NONE)
                return -EINVAL;
-        if ((queue->flags & NFQA_CFG_F_GSO) || !skb_is_gso(entry->skb))
-                return __nfqnl_enqueue_packet(net, queue, entry);
        skb = entry->skb;
        switch (entry->pf) {
@@ -651,6 +648,9 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
                break;
        }
+        if ((queue->flags & NFQA_CFG_F_GSO) || !skb_is_gso(skb))
+                return __nfqnl_enqueue_packet(net, queue, entry);
        nf_bridge_adjust_skb_data(skb);
        segs = skb_gso_segment(skb, 0);
        /* Does not use PTR_ERR to limit the number of error codes that can be
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index a75240f0d42b..afaebc766933 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -125,6 +125,12 @@ tcpmss_mangle_packet(struct sk_buff *skb,
        skb_put(skb, TCPOLEN_MSS);
+        /* RFC 879 states that the default MSS is 536 without specific
+         * knowledge that the destination host is prepared to accept larger.
+         * Since no MSS was provided, we MUST NOT set a value > 536.
+         */
+        newmss = min(newmss, (u16)536);
        opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
        memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index d0b3dd60d386..57ee84d21470 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -371,7 +371,7 @@ static int netlink_mmap(struct file *file, struct socket *sock,
        err = 0;
 out:
        mutex_unlock(&nlk->pg_vec_lock);
-        return 0;
+        return err;
 }
 static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 2b935e7cfe7b..281c1bded1f6 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -291,17 +291,18 @@ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, struct nlattr *ta
 {
        struct qdisc_rate_table *rtab;
+        if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
+            nla_len(tab) != TC_RTAB_SIZE)
+                return NULL;
        for (rtab = qdisc_rtab_list; rtab; rtab = rtab->next) {
-                if (memcmp(&rtab->rate, r, sizeof(struct tc_ratespec)) == 0) {
+                if (!memcmp(&rtab->rate, r, sizeof(struct tc_ratespec)) &&
+                    !memcmp(&rtab->data, nla_data(tab), 1024)) {
                        rtab->refcnt++;
                        return rtab;
                }
        }
-        if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
-            nla_len(tab) != TC_RTAB_SIZE)
-                return NULL;
        rtab = kmalloc(sizeof(*rtab), GFP_KERNEL);
        if (rtab) {
                rtab->rate = *r;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f631c5ff4dbf..6abb1caf9836 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4003,6 +4003,12 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
        /* Release our hold on the endpoint. */
        sp = sctp_sk(sk);
+        /* This could happen during socket init, thus we bail out
+         * early, since the rest of the below is not setup either.
+         */
+        if (sp->ep == NULL)
+                return;
        if (sp->do_auto_asconf) {
                sp->do_auto_asconf = 0;
                list_del(&sp->auto_asconf_list);
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index 030f53c96ec0..987f728718c5 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -193,6 +193,8 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0);
 static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0);
+static DECLARE_TLV_DB_SCALE(mix_tlv, -50, 50, 0);
 static const unsigned int limiter_tlv[] = {
        TLV_DB_RANGE_HEAD(2),
        0, 2, TLV_DB_SCALE_ITEM(-3000, 600, 0),
@@ -260,7 +262,7 @@ static const char * const hp_gain_num_text[] = {
 };
 static const struct soc_enum hp_gain_enum =
-        SOC_ENUM_SINGLE(CS42L52_PB_CTL1, 4,
+        SOC_ENUM_SINGLE(CS42L52_PB_CTL1, 5,
                ARRAY_SIZE(hp_gain_num_text), hp_gain_num_text);
 static const char * const beep_pitch_text[] = {
@@ -441,7 +443,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = {
        SOC_DOUBLE_R_SX_TLV("PCM Mixer Volume",
                            CS42L52_PCMA_MIXER_VOL, CS42L52_PCMB_MIXER_VOL,
-                                0, 0x7f, 0x19, hl_tlv),
+                                0, 0x7f, 0x19, mix_tlv),
        SOC_DOUBLE_R("PCM Mixer Switch",
                     CS42L52_PCMA_MIXER_VOL, CS42L52_PCMB_MIXER_VOL, 7, 1, 1),
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 65d09d60b7c6..1514bf845e4b 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -187,14 +187,14 @@ static int snd_soc_dapm_put_volsw_aic3x(struct snd_kcontrol *kcontrol,
                        break;
                }
-                if (found)
-                        snd_soc_dapm_sync(widget->dapm);
        }
-        ret = snd_soc_update_bits(widget->codec, reg, val_mask, val);
        mutex_unlock(&widget->codec->mutex);
+        if (found)
+                snd_soc_dapm_sync(widget->dapm);
+        ret = snd_soc_update_bits_locked(widget->codec, reg, val_mask, val);
        return ret;
 }
diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
index e895d3939eef..100fdadda56a 100644
--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -1120,7 +1120,8 @@ SND_SOC_DAPM_AIF_IN("AIF3RX2", NULL, 0,
 ARIZONA_DSP_WIDGETS(DSP1, "DSP1"),
 SND_SOC_DAPM_VALUE_MUX("AEC Loopback", ARIZONA_DAC_AEC_CONTROL_1,
-                       ARIZONA_AEC_LOOPBACK_ENA, 0, &wm5102_aec_loopback_mux),
+                       ARIZONA_AEC_LOOPBACK_ENA_SHIFT, 0,
+                       &wm5102_aec_loopback_mux),
 SND_SOC_DAPM_PGA_E("OUT1L", SND_SOC_NOPM,
                   ARIZONA_OUT1L_ENA_SHIFT, 0, NULL, 0, arizona_hp_ev,
diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
index ba38f0679662..88ad7db52dde 100644
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -503,7 +503,8 @@ SND_SOC_DAPM_PGA("ASRC2R", ARIZONA_ASRC_ENABLE, ARIZONA_ASRC2R_ENA_SHIFT, 0,
                 NULL, 0),
 SND_SOC_DAPM_VALUE_MUX("AEC Loopback", ARIZONA_DAC_AEC_CONTROL_1,
-                       ARIZONA_AEC_LOOPBACK_ENA, 0, &wm5110_aec_loopback_mux),
+                       ARIZONA_AEC_LOOPBACK_ENA_SHIFT, 0,
+                       &wm5110_aec_loopback_mux),
 SND_SOC_DAPM_AIF_OUT("AIF1TX1", NULL, 0,
                     ARIZONA_AIF1_TX_ENABLES, ARIZONA_AIF1TX1_ENA_SHIFT, 0),
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index dfd997aaadfc..29e95f93d482 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3836,12 +3836,13 @@ static irqreturn_t wm8958_mic_irq(int irq, void *data)
                                ret);
                } else if (!(ret & WM1811_JACKDET_LVL)) {
                        dev_dbg(codec->dev, "Ignoring removed jack\n");
-                        return IRQ_HANDLED;
+                        goto out;
                }
        } else if (!(reg & WM8958_MICD_STS)) {
                snd_soc_jack_report(wm8994->micdet[0].jack, 0,
                                    SND_JACK_MECHANICAL | SND_JACK_HEADSET |
                                    wm8994->btn_mask);
+                wm8994->mic_detecting = true;
                goto out;
        }
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index a80c883bb8be..c7051c457b75 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -55,7 +55,8 @@ static int dapm_up_seq[] = {
        [snd_soc_dapm_clock_supply] = 1,
        [snd_soc_dapm_micbias] = 2,
        [snd_soc_dapm_dai_link] = 2,
-        [snd_soc_dapm_dai] = 3,
+        [snd_soc_dapm_dai_in] = 3,
+        [snd_soc_dapm_dai_out] = 3,
        [snd_soc_dapm_aif_in] = 3,
        [snd_soc_dapm_aif_out] = 3,
        [snd_soc_dapm_mic] = 4,
@@ -92,7 +93,8 @@ static int dapm_down_seq[] = {
        [snd_soc_dapm_value_mux] = 9,
        [snd_soc_dapm_aif_in] = 10,
        [snd_soc_dapm_aif_out] = 10,
-        [snd_soc_dapm_dai] = 10,
+        [snd_soc_dapm_dai_in] = 10,
+        [snd_soc_dapm_dai_out] = 10,
        [snd_soc_dapm_dai_link] = 11,
        [snd_soc_dapm_clock_supply] = 12,
        [snd_soc_dapm_regulator_supply] = 12,
@@ -419,7 +421,8 @@ static void dapm_set_path_status(struct snd_soc_dapm_widget *w,
        case snd_soc_dapm_clock_supply:
        case snd_soc_dapm_aif_in:
        case snd_soc_dapm_aif_out:
-        case snd_soc_dapm_dai:
+        case snd_soc_dapm_dai_in:
+        case snd_soc_dapm_dai_out:
        case snd_soc_dapm_hp:
        case snd_soc_dapm_mic:
        case snd_soc_dapm_spk:
@@ -820,7 +823,7 @@ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
        switch (widget->id) {
        case snd_soc_dapm_adc:
        case snd_soc_dapm_aif_out:
-        case snd_soc_dapm_dai:
+        case snd_soc_dapm_dai_out:
                if (widget->active) {
                        widget->outputs = snd_soc_dapm_suspend_check(widget);
                        return widget->outputs;
@@ -916,7 +919,7 @@ static int is_connected_input_ep(struct snd_soc_dapm_widget *widget,
        switch (widget->id) {
        case snd_soc_dapm_dac:
        case snd_soc_dapm_aif_in:
-        case snd_soc_dapm_dai:
+        case snd_soc_dapm_dai_in:
                if (widget->active) {
                        widget->inputs = snd_soc_dapm_suspend_check(widget);
                        return widget->inputs;
@@ -1135,16 +1138,6 @@ static int dapm_generic_check_power(struct snd_soc_dapm_widget *w)
        return out != 0 && in != 0;
 }
-static int dapm_dai_check_power(struct snd_soc_dapm_widget *w)
-{
-        DAPM_UPDATE_STAT(w, power_checks);
-        if (w->active)
-                return w->active;
-        return dapm_generic_check_power(w);
-}
 /* Check to see if an ADC has power */
 static int dapm_adc_check_power(struct snd_soc_dapm_widget *w)
 {
@@ -2318,7 +2311,8 @@ static int snd_soc_dapm_add_route(struct snd_soc_dapm_context *dapm,
        case snd_soc_dapm_clock_supply:
        case snd_soc_dapm_aif_in:
        case snd_soc_dapm_aif_out:
-        case snd_soc_dapm_dai:
+        case snd_soc_dapm_dai_in:
+        case snd_soc_dapm_dai_out:
        case snd_soc_dapm_dai_link:
                list_add(&path->list, &dapm->card->paths);
                list_add(&path->list_sink, &wsink->sources);
@@ -3129,10 +3123,12 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
                break;
        case snd_soc_dapm_adc:
        case snd_soc_dapm_aif_out:
+        case snd_soc_dapm_dai_out:
                w->power_check = dapm_adc_check_power;
                break;
        case snd_soc_dapm_dac:
        case snd_soc_dapm_aif_in:
+        case snd_soc_dapm_dai_in:
                w->power_check = dapm_dac_check_power;
                break;
        case snd_soc_dapm_pga:
@@ -3152,9 +3148,6 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
        case snd_soc_dapm_clock_supply:
                w->power_check = dapm_supply_check_power;
                break;
-        case snd_soc_dapm_dai:
-                w->power_check = dapm_dai_check_power;
-                break;
        default:
                w->power_check = dapm_always_on_check_power;
                break;
@@ -3375,7 +3368,7 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
        template.reg = SND_SOC_NOPM;
        if (dai->driver->playback.stream_name) {
-                template.id = snd_soc_dapm_dai;
+                template.id = snd_soc_dapm_dai_in;
                template.name = dai->driver->playback.stream_name;
                template.sname = dai->driver->playback.stream_name;
@@ -3393,7 +3386,7 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
        }
        if (dai->driver->capture.stream_name) {
-                template.id = snd_soc_dapm_dai;
+                template.id = snd_soc_dapm_dai_out;
                template.name = dai->driver->capture.stream_name;
                template.sname = dai->driver->capture.stream_name;
@@ -3423,8 +3416,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card)
        /* For each DAI widget... */
        list_for_each_entry(dai_w, &card->widgets, list) {
-                if (dai_w->id != snd_soc_dapm_dai)
+                switch (dai_w->id) {
+                case snd_soc_dapm_dai_in:
+                case snd_soc_dapm_dai_out:
+                        break;
+                default:
                        continue;
+                }
                dai = dai_w->priv;
@@ -3433,8 +3431,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card)
                        if (w->dapm != dai_w->dapm)
                                continue;
-                        if (w->id == snd_soc_dapm_dai)
+                        switch (w->id) {
+                        case snd_soc_dapm_dai_in:
+                        case snd_soc_dapm_dai_out:
                                continue;
+                        default:
+                                break;
+                        }
                        if (!w->sname)
                                continue;
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 73bb8eefa491..ccb6be4d658d 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -928,8 +928,13 @@ static int dpcm_add_paths(struct snd_soc_pcm_runtime *fe, int stream,
        /* Create any new FE <--> BE connections */
        for (i = 0; i < list->num_widgets; i++) {
-                if (list->widgets[i]->id != snd_soc_dapm_dai)
+                switch (list->widgets[i]->id) {
+                case snd_soc_dapm_dai_in:
+                case snd_soc_dapm_dai_out:
+                        break;
+                default:
                        continue;
+                }
                /* is there a valid BE rtd for this widget */
                be = dpcm_get_be(card, list->widgets[i], stream);
@@ -2011,9 +2016,11 @@ int soc_new_pcm(struct snd_soc_pcm_runtime *rtd, int num)
                if (cpu_dai->driver->capture.channels_min)
                        capture = 1;
        } else {
-                if (codec_dai->driver->playback.channels_min)
+                if (codec_dai->driver->playback.channels_min &&
+                    cpu_dai->driver->playback.channels_min)
                        playback = 1;
-                if (codec_dai->driver->capture.channels_min)
+                if (codec_dai->driver->capture.channels_min &&
+                    cpu_dai->driver->capture.channels_min)
                        capture = 1;
        }
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 9e9d34871195..fe702076ca46 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -2191,7 +2191,7 @@ int initialize_counters(int cpu_id)
 void allocate_output_buffer()
 {
-        output_buffer = calloc(1, (1 + topo.num_cpus) * 128);
+        output_buffer = calloc(1, (1 + topo.num_cpus) * 256);
        outp = output_buffer;
        if (outp == NULL) {
                perror("calloc");