148 files changed, 1300 insertions, 608 deletions
diff --git a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
index dc2a18f0b3a1..ddbe304beb21 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
@@ -15,10 +15,8 @@ Optional properties:
  - phys: phandle + phy specifier pair
  - phy-names: must be "usb"
  - dmas: Must contain a list of references to DMA specifiers.
-  - dma-names : Must contain a list of DMA names:
+  - dma-names : named "ch%d", where %d is the channel number ranging from zero
-   - tx0 ... tx<n>
+                to the number of channels (DnFIFOs) minus one.
-   - rx0 ... rx<n>
-    - This <n> means DnFIFO in USBHS module.
 Example:
        usbhs: usb@e6590000 {
diff --git a/MAINTAINERS b/MAINTAINERS
index af802b357b6a..d8afd2953678 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -51,9 +51,9 @@ trivial patch so apply some common sense.
        or does something very odd once a month document it.
        PLEASE remember that submissions must be made under the terms
-        of the OSDL certificate of contribution and should include a
+        of the Linux Foundation certificate of contribution and should
-        Signed-off-by: line.  The current version of this "Developer's
+        include a Signed-off-by: line.  The current version of this
-        Certificate of Origin" (DCO) is listed in the file
+        "Developer's Certificate of Origin" (DCO) is listed in the file
        Documentation/SubmittingPatches.
 6.      Make sure you have the right to send any changes you make. If you
@@ -7575,6 +7575,7 @@ F:	drivers/pci/host/pci-exynos.c
 PCI DRIVER FOR SYNOPSIS DESIGNWARE
 M:      Jingoo Han <jingoohan1@gmail.com>
+M:      Pratyush Anand <pratyush.anand@gmail.com>
 L:      linux-pci@vger.kernel.org
 S:      Maintained
 F:      drivers/pci/host/*designware*
@@ -7588,8 +7589,9 @@ F:	Documentation/devicetree/bindings/pci/host-generic-pci.txt
 F:      drivers/pci/host/pci-host-generic.c
 PCIE DRIVER FOR ST SPEAR13XX
+M:      Pratyush Anand <pratyush.anand@gmail.com>
 L:      linux-pci@vger.kernel.org
-S:      Orphan
+S:      Maintained
 F:      drivers/pci/host/*spear*
 PCMCIA SUBSYSTEM
@@ -10587,8 +10589,7 @@ F:	drivers/virtio/virtio_input.c
 F:      include/uapi/linux/virtio_input.h
 VIA RHINE NETWORK DRIVER
-M:      Roger Luethi <rl@hellgate.ch>
+S:      Orphan
-S:      Maintained
 F:      drivers/net/ethernet/via/via-rhine.c
 VIA SD/MMC CARD CONTROLLER DRIVER
diff --git a/Makefile b/Makefile
index aee7e5cb4c15..40a8b068ac26 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Hurr durr I'ma sheep
 # *DOCUMENTATION*
diff --git a/arch/ia64/kernel/smpboot.c b/arch/ia64/kernel/smpboot.c
index 15051e9c2c6f..b054c5c6e713 100644
--- a/arch/ia64/kernel/smpboot.c
+++ b/arch/ia64/kernel/smpboot.c
@@ -127,7 +127,7 @@ int smp_num_siblings = 1;
 volatile int ia64_cpu_to_sapicid[NR_CPUS];
 EXPORT_SYMBOL(ia64_cpu_to_sapicid);
-static volatile cpumask_t cpu_callin_map;
+static cpumask_t cpu_callin_map;
 struct smp_boot_data smp_boot_data __initdata;
@@ -477,6 +477,7 @@ do_boot_cpu (int sapicid, int cpu, struct task_struct *idle)
        for (timeout = 0; timeout < 100000; timeout++) {
                if (cpumask_test_cpu(cpu, &cpu_callin_map))
                        break;  /* It has booted */
+                barrier(); /* Make sure we re-read cpu_callin_map */
                udelay(100);
        }
        Dprintk("\n");
diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
index a73c93c3d44a..7fc8397d16f2 100644
--- a/arch/mips/ath79/setup.c
+++ b/arch/mips/ath79/setup.c
@@ -225,7 +225,7 @@ void __init plat_time_init(void)
        ddr_clk_rate = ath79_get_sys_clk_rate("ddr");
        ref_clk_rate = ath79_get_sys_clk_rate("ref");
-        pr_info("Clocks: CPU:%lu.%03luMHz, DDR:%lu.%03luMHz, AHB:%lu.%03luMHz, Ref:%lu.%03luMHz",
+        pr_info("Clocks: CPU:%lu.%03luMHz, DDR:%lu.%03luMHz, AHB:%lu.%03luMHz, Ref:%lu.%03luMHz\n",
                cpu_clk_rate / 1000000, (cpu_clk_rate / 1000) % 1000,
                ddr_clk_rate / 1000000, (ddr_clk_rate / 1000) % 1000,
                ahb_clk_rate / 1000000, (ahb_clk_rate / 1000) % 1000,
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index e36515dcd3b2..209e5b76c1bc 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -74,13 +74,12 @@ static inline void cpu_set_fpu_fcsr_mask(struct cpuinfo_mips *c)
 {
        unsigned long sr, mask, fcsr, fcsr0, fcsr1;
+        fcsr = c->fpu_csr31;
        mask = FPU_CSR_ALL_X | FPU_CSR_ALL_E | FPU_CSR_ALL_S | FPU_CSR_RM;
        sr = read_c0_status();
        __enable_fpu(FPU_AS_IS);
-        fcsr = read_32bit_cp1_register(CP1_STATUS);
        fcsr0 = fcsr & mask;
        write_32bit_cp1_register(CP1_STATUS, fcsr0);
        fcsr0 = read_32bit_cp1_register(CP1_STATUS);
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
index 51f57d841662..3c8a18a00a65 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
@@ -109,7 +109,7 @@ void __init init_IRQ(void)
 #endif
 }
-#ifdef DEBUG_STACKOVERFLOW
+#ifdef CONFIG_DEBUG_STACKOVERFLOW
 static inline void check_stack_overflow(void)
 {
        unsigned long sp;
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index 4b50c5787e25..d5fa3eaf39a1 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -2409,7 +2409,7 @@ enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu,
                if (vcpu->mmio_needed == 2)
                        *gpr = *(int16_t *) run->mmio.data;
                else
-                        *gpr = *(int16_t *) run->mmio.data;
+                        *gpr = *(uint16_t *)run->mmio.data;
                break;
        case 1:
diff --git a/arch/mips/loongson/loongson-3/smp.c b/arch/mips/loongson/loongson-3/smp.c
index e3c68b5da18d..509877c6e9d9 100644
--- a/arch/mips/loongson/loongson-3/smp.c
+++ b/arch/mips/loongson/loongson-3/smp.c
@@ -272,7 +272,7 @@ void loongson3_ipi_interrupt(struct pt_regs *regs)
        if (action & SMP_ASK_C0COUNT) {
                BUG_ON(cpu != 0);
                c0count = read_c0_count();
-                for (i = 1; i < loongson_sysconf.nr_cpus; i++)
+                for (i = 1; i < num_possible_cpus(); i++)
                        per_cpu(core0_c0count, i) = c0count;
        }
 }
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 0dbb65a51ce5..2e03ab173591 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1372,7 +1372,7 @@ static int probe_scache(void)
        scache_size = addr;
        c->scache.linesz = 16 << ((config & R4K_CONF_SB) >> 22);
        c->scache.ways = 1;
-        c->dcache.waybit = 0;           /* does not matter */
+        c->scache.waybit = 0;           /* does not matter */
        return 1;
 }
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index 5d6139390bf8..e23fdf2a9c80 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -681,11 +681,7 @@ static unsigned int get_stack_depth(struct jit_ctx *ctx)
                sp_off += config_enabled(CONFIG_64BIT) ?
                        (ARGS_USED_BY_JIT + 1) * RSIZE : RSIZE;
-        /*
+        return sp_off;
-         * Subtract the bytes for the last registers since we only care about
-         * the location on the stack pointer.
-         */
-        return sp_off - RSIZE;
 }
 static void build_prologue(struct jit_ctx *ctx)
diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c
index e20b02e3ae28..e10d10b9e82a 100644
--- a/arch/mips/ralink/ill_acc.c
+++ b/arch/mips/ralink/ill_acc.c
@@ -41,7 +41,7 @@ static irqreturn_t ill_acc_irq_handler(int irq, void *_priv)
                addr, (type >> ILL_ACC_OFF_S) & ILL_ACC_OFF_M,
                type & ILL_ACC_LEN_M);
-        rt_memc_w32(REG_ILL_ACC_TYPE, REG_ILL_ACC_TYPE);
+        rt_memc_w32(ILL_INT_STATUS, REG_ILL_ACC_TYPE);
        return IRQ_HANDLED;
 }
diff --git a/arch/sparc/include/asm/cpudata_64.h b/arch/sparc/include/asm/cpudata_64.h
index a6e424d185d0..a6cfdabb6054 100644
--- a/arch/sparc/include/asm/cpudata_64.h
+++ b/arch/sparc/include/asm/cpudata_64.h
@@ -24,7 +24,8 @@ typedef struct {
        unsigned int    icache_line_size;
        unsigned int    ecache_size;
        unsigned int    ecache_line_size;
-        int             core_id;
+        unsigned short  sock_id;
+        unsigned short  core_id;
        int             proc_id;
 } cpuinfo_sparc;
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index dc165ebdf05a..2a52c91d2c8a 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -308,12 +308,26 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t prot)
        "       sllx            %1, 32, %1\n"
        "       or              %0, %1, %0\n"
        "       .previous\n"
+        "       .section        .sun_m7_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%4), %1\n"
+        "       sethi           %%hi(%4), %0\n"
+        "       .word           662b\n"
+        "       or              %1, %%ulo(%4), %1\n"
+        "       or              %0, %%lo(%4), %0\n"
+        "       .word           663b\n"
+        "       sllx            %1, 32, %1\n"
+        "       or              %0, %1, %0\n"
+        "       .previous\n"
        : "=r" (mask), "=r" (tmp)
        : "i" (_PAGE_PADDR_4U | _PAGE_MODIFIED_4U | _PAGE_ACCESSED_4U |
               _PAGE_CP_4U | _PAGE_CV_4U | _PAGE_E_4U |
               _PAGE_SPECIAL | _PAGE_PMD_HUGE | _PAGE_SZALL_4U),
          "i" (_PAGE_PADDR_4V | _PAGE_MODIFIED_4V | _PAGE_ACCESSED_4V |
               _PAGE_CP_4V | _PAGE_CV_4V | _PAGE_E_4V |
+               _PAGE_SPECIAL | _PAGE_PMD_HUGE | _PAGE_SZALL_4V),
+          "i" (_PAGE_PADDR_4V | _PAGE_MODIFIED_4V | _PAGE_ACCESSED_4V |
+               _PAGE_CP_4V | _PAGE_E_4V |
               _PAGE_SPECIAL | _PAGE_PMD_HUGE | _PAGE_SZALL_4V));
        return __pte((pte_val(pte) & mask) | (pgprot_val(prot) & ~mask));
@@ -342,9 +356,15 @@ static inline pgprot_t pgprot_noncached(pgprot_t prot)
        "       andn            %0, %4, %0\n"
        "       or              %0, %5, %0\n"
        "       .previous\n"
+        "       .section        .sun_m7_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       andn            %0, %6, %0\n"
+        "       or              %0, %5, %0\n"
+        "       .previous\n"
        : "=r" (val)
        : "0" (val), "i" (_PAGE_CP_4U | _PAGE_CV_4U), "i" (_PAGE_E_4U),
-                     "i" (_PAGE_CP_4V | _PAGE_CV_4V), "i" (_PAGE_E_4V));
+                     "i" (_PAGE_CP_4V | _PAGE_CV_4V), "i" (_PAGE_E_4V),
+                     "i" (_PAGE_CP_4V));
        return __pgprot(val);
 }
diff --git a/arch/sparc/include/asm/topology_64.h b/arch/sparc/include/asm/topology_64.h
index ed8f071132e4..d1761df5cca6 100644
--- a/arch/sparc/include/asm/topology_64.h
+++ b/arch/sparc/include/asm/topology_64.h
@@ -40,11 +40,12 @@ static inline int pcibus_to_node(struct pci_bus *pbus)
 #ifdef CONFIG_SMP
 #define topology_physical_package_id(cpu)       (cpu_data(cpu).proc_id)
 #define topology_core_id(cpu)                   (cpu_data(cpu).core_id)
-#define topology_core_cpumask(cpu)              (&cpu_core_map[cpu])
+#define topology_core_cpumask(cpu)              (&cpu_core_sib_map[cpu])
 #define topology_thread_cpumask(cpu)            (&per_cpu(cpu_sibling_map, cpu))
 #endif /* CONFIG_SMP */
 extern cpumask_t cpu_core_map[NR_CPUS];
+extern cpumask_t cpu_core_sib_map[NR_CPUS];
 static inline const struct cpumask *cpu_coregroup_mask(int cpu)
 {
        return &cpu_core_map[cpu];
diff --git a/arch/sparc/include/asm/trap_block.h b/arch/sparc/include/asm/trap_block.h
index 6fd4436d32f0..ec9c04de3664 100644
--- a/arch/sparc/include/asm/trap_block.h
+++ b/arch/sparc/include/asm/trap_block.h
@@ -79,6 +79,8 @@ struct sun4v_2insn_patch_entry {
 };
 extern struct sun4v_2insn_patch_entry __sun4v_2insn_patch,
        __sun4v_2insn_patch_end;
+extern struct sun4v_2insn_patch_entry __sun_m7_2insn_patch,
+        __sun_m7_2insn_patch_end;
 #endif /* !(__ASSEMBLY__) */
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index 07cc49e541f4..0f679421b468 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -69,6 +69,8 @@ void sun4v_patch_1insn_range(struct sun4v_1insn_patch_entry *,
                             struct sun4v_1insn_patch_entry *);
 void sun4v_patch_2insn_range(struct sun4v_2insn_patch_entry *,
                             struct sun4v_2insn_patch_entry *);
+void sun_m7_patch_2insn_range(struct sun4v_2insn_patch_entry *,
+                             struct sun4v_2insn_patch_entry *);
 extern unsigned int dcache_parity_tl1_occurred;
 extern unsigned int icache_parity_tl1_occurred;
diff --git a/arch/sparc/kernel/leon_pci_grpci2.c b/arch/sparc/kernel/leon_pci_grpci2.c
index 94e392bdee7d..814fb1729b12 100644
--- a/arch/sparc/kernel/leon_pci_grpci2.c
+++ b/arch/sparc/kernel/leon_pci_grpci2.c
@@ -723,7 +723,6 @@ static int grpci2_of_probe(struct platform_device *ofdev)
                err = -ENOMEM;
                goto err1;
        }
-        memset(grpci2priv, 0, sizeof(*grpci2priv));
        priv->regs = regs;
        priv->irq = ofdev->archdata.irqs[0]; /* BASE IRQ */
        priv->irq_mode = (capability & STS_IRQMODE) >> STS_IRQMODE_BIT;
diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
index 26c80e18d7b1..6f80936e0eea 100644
--- a/arch/sparc/kernel/mdesc.c
+++ b/arch/sparc/kernel/mdesc.c
@@ -614,45 +614,68 @@ static void fill_in_one_cache(cpuinfo_sparc *c, struct mdesc_handle *hp, u64 mp)
        }
 }
-static void mark_core_ids(struct mdesc_handle *hp, u64 mp, int core_id)
+static void find_back_node_value(struct mdesc_handle *hp, u64 node,
+                                 char *srch_val,
+                                 void (*func)(struct mdesc_handle *, u64, int),
+                                 u64 val, int depth)
 {
-        u64 a;
+        u64 arc;
-        mdesc_for_each_arc(a, hp, mp, MDESC_ARC_TYPE_BACK) {
-                u64 t = mdesc_arc_target(hp, a);
-                const char *name;
-                const u64 *id;
-                name = mdesc_node_name(hp, t);
+        /* Since we have an estimate of recursion depth, do a sanity check. */
-                if (!strcmp(name, "cpu")) {
+        if (depth == 0)
-                        id = mdesc_get_property(hp, t, "id", NULL);
+                return;
-                        if (*id < NR_CPUS)
-                                cpu_data(*id).core_id = core_id;
-                } else {
-                        u64 j;
-                        mdesc_for_each_arc(j, hp, t, MDESC_ARC_TYPE_BACK) {
+        mdesc_for_each_arc(arc, hp, node, MDESC_ARC_TYPE_BACK) {
-                                u64 n = mdesc_arc_target(hp, j);
+                u64 n = mdesc_arc_target(hp, arc);
-                                const char *n_name;
+                const char *name = mdesc_node_name(hp, n);
-                                n_name = mdesc_node_name(hp, n);
+                if (!strcmp(srch_val, name))
-                                if (strcmp(n_name, "cpu"))
+                        (*func)(hp, n, val);
-                                        continue;
-                                id = mdesc_get_property(hp, n, "id", NULL);
+                find_back_node_value(hp, n, srch_val, func, val, depth-1);
-                                if (*id < NR_CPUS)
-                                        cpu_data(*id).core_id = core_id;
-                        }
-                }
        }
 }
+static void __mark_core_id(struct mdesc_handle *hp, u64 node,
+                           int core_id)
+{
+        const u64 *id = mdesc_get_property(hp, node, "id", NULL);
+        if (*id < num_possible_cpus())
+                cpu_data(*id).core_id = core_id;
+}
+static void __mark_sock_id(struct mdesc_handle *hp, u64 node,
+                           int sock_id)
+{
+        const u64 *id = mdesc_get_property(hp, node, "id", NULL);
+        if (*id < num_possible_cpus())
+                cpu_data(*id).sock_id = sock_id;
+}
+static void mark_core_ids(struct mdesc_handle *hp, u64 mp,
+                          int core_id)
+{
+        find_back_node_value(hp, mp, "cpu", __mark_core_id, core_id, 10);
+}
+static void mark_sock_ids(struct mdesc_handle *hp, u64 mp,
+                          int sock_id)
+{
+        find_back_node_value(hp, mp, "cpu", __mark_sock_id, sock_id, 10);
+}
 static void set_core_ids(struct mdesc_handle *hp)
 {
        int idx;
        u64 mp;
        idx = 1;
+        /* Identify unique cores by looking for cpus backpointed to by
+         * level 1 instruction caches.
+         */
        mdesc_for_each_node_by_name(hp, mp, "cache") {
                const u64 *level;
                const char *type;
@@ -667,11 +690,72 @@ static void set_core_ids(struct mdesc_handle *hp)
                        continue;
                mark_core_ids(hp, mp, idx);
+                idx++;
+        }
+}
+static int set_sock_ids_by_cache(struct mdesc_handle *hp, int level)
+{
+        u64 mp;
+        int idx = 1;
+        int fnd = 0;
+        /* Identify unique sockets by looking for cpus backpointed to by
+         * shared level n caches.
+         */
+        mdesc_for_each_node_by_name(hp, mp, "cache") {
+                const u64 *cur_lvl;
+                cur_lvl = mdesc_get_property(hp, mp, "level", NULL);
+                if (*cur_lvl != level)
+                        continue;
+                mark_sock_ids(hp, mp, idx);
+                idx++;
+                fnd = 1;
+        }
+        return fnd;
+}
+static void set_sock_ids_by_socket(struct mdesc_handle *hp, u64 mp)
+{
+        int idx = 1;
+        mdesc_for_each_node_by_name(hp, mp, "socket") {
+                u64 a;
+                mdesc_for_each_arc(a, hp, mp, MDESC_ARC_TYPE_FWD) {
+                        u64 t = mdesc_arc_target(hp, a);
+                        const char *name;
+                        const u64 *id;
+                        name = mdesc_node_name(hp, t);
+                        if (strcmp(name, "cpu"))
+                                continue;
+                        id = mdesc_get_property(hp, t, "id", NULL);
+                        if (*id < num_possible_cpus())
+                                cpu_data(*id).sock_id = idx;
+                }
                idx++;
        }
 }
+static void set_sock_ids(struct mdesc_handle *hp)
+{
+        u64 mp;
+        /* If machine description exposes sockets data use it.
+         * Otherwise fallback to use shared L3 or L2 caches.
+         */
+        mp = mdesc_node_by_name(hp, MDESC_NODE_NULL, "sockets");
+        if (mp != MDESC_NODE_NULL)
+                return set_sock_ids_by_socket(hp, mp);
+        if (!set_sock_ids_by_cache(hp, 3))
+                set_sock_ids_by_cache(hp, 2);
+}
 static void mark_proc_ids(struct mdesc_handle *hp, u64 mp, int proc_id)
 {
        u64 a;
@@ -707,7 +791,6 @@ static void __set_proc_ids(struct mdesc_handle *hp, const char *exec_unit_name)
                        continue;
                mark_proc_ids(hp, mp, idx);
                idx++;
        }
 }
@@ -900,6 +983,7 @@ void mdesc_fill_in_cpu_data(cpumask_t *mask)
        set_core_ids(hp);
        set_proc_ids(hp);
+        set_sock_ids(hp);
        mdesc_release(hp);
diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
index 6f7251fd2eab..c928bc64b4ba 100644
--- a/arch/sparc/kernel/pci.c
+++ b/arch/sparc/kernel/pci.c
@@ -1002,6 +1002,38 @@ static int __init pcibios_init(void)
 subsys_initcall(pcibios_init);
 #ifdef CONFIG_SYSFS
+#define SLOT_NAME_SIZE  11  /* Max decimal digits + null in u32 */
+static void pcie_bus_slot_names(struct pci_bus *pbus)
+{
+        struct pci_dev *pdev;
+        struct pci_bus *bus;
+        list_for_each_entry(pdev, &pbus->devices, bus_list) {
+                char name[SLOT_NAME_SIZE];
+                struct pci_slot *pci_slot;
+                const u32 *slot_num;
+                int len;
+                slot_num = of_get_property(pdev->dev.of_node,
+                                           "physical-slot#", &len);
+                if (slot_num == NULL || len != 4)
+                        continue;
+                snprintf(name, sizeof(name), "%u", slot_num[0]);
+                pci_slot = pci_create_slot(pbus, slot_num[0], name, NULL);
+                if (IS_ERR(pci_slot))
+                        pr_err("PCI: pci_create_slot returned %ld.\n",
+                               PTR_ERR(pci_slot));
+        }
+        list_for_each_entry(bus, &pbus->children, node)
+                pcie_bus_slot_names(bus);
+}
 static void pci_bus_slot_names(struct device_node *node, struct pci_bus *bus)
 {
        const struct pci_slot_names {
@@ -1053,18 +1085,29 @@ static int __init of_pci_slot_init(void)
        while ((pbus = pci_find_next_bus(pbus)) != NULL) {
                struct device_node *node;
+                struct pci_dev *pdev;
+                pdev = list_first_entry(&pbus->devices, struct pci_dev,
+                                        bus_list);
-                if (pbus->self) {
+                if (pdev && pci_is_pcie(pdev)) {
-                        /* PCI->PCI bridge */
+                        pcie_bus_slot_names(pbus);
-                        node = pbus->self->dev.of_node;
                } else {
-                        struct pci_pbm_info *pbm = pbus->sysdata;
-                        /* Host PCI controller */
+                        if (pbus->self) {
-                        node = pbm->op->dev.of_node;
-                }
+                                /* PCI->PCI bridge */
+                                node = pbus->self->dev.of_node;
+                        } else {
+                                struct pci_pbm_info *pbm = pbus->sysdata;
-                pci_bus_slot_names(node, pbus);
+                                /* Host PCI controller */
+                                node = pbm->op->dev.of_node;
+                        }
+                        pci_bus_slot_names(node, pbus);
+                }
        }
        return 0;
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index c38d19fc27ba..f7b261749383 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -255,6 +255,24 @@ void sun4v_patch_2insn_range(struct sun4v_2insn_patch_entry *start,
        }
 }
+void sun_m7_patch_2insn_range(struct sun4v_2insn_patch_entry *start,
+                             struct sun4v_2insn_patch_entry *end)
+{
+        while (start < end) {
+                unsigned long addr = start->addr;
+                *(unsigned int *) (addr +  0) = start->insns[0];
+                wmb();
+                __asm__ __volatile__("flush     %0" : : "r" (addr +  0));
+                *(unsigned int *) (addr +  4) = start->insns[1];
+                wmb();
+                __asm__ __volatile__("flush     %0" : : "r" (addr +  4));
+                start++;
+        }
+}
 static void __init sun4v_patch(void)
 {
        extern void sun4v_hvapi_init(void);
@@ -267,6 +285,9 @@ static void __init sun4v_patch(void)
        sun4v_patch_2insn_range(&__sun4v_2insn_patch,
                                &__sun4v_2insn_patch_end);
+        if (sun4v_chip_type == SUN4V_CHIP_SPARC_M7)
+                sun_m7_patch_2insn_range(&__sun_m7_2insn_patch,
+                                         &__sun_m7_2insn_patch_end);
        sun4v_hvapi_init();
 }
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 61139d9924ca..19cd08d18672 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -60,8 +60,12 @@ DEFINE_PER_CPU(cpumask_t, cpu_sibling_map) = CPU_MASK_NONE;
 cpumask_t cpu_core_map[NR_CPUS] __read_mostly =
        { [0 ... NR_CPUS-1] = CPU_MASK_NONE };
+cpumask_t cpu_core_sib_map[NR_CPUS] __read_mostly = {
+        [0 ... NR_CPUS-1] = CPU_MASK_NONE };
 EXPORT_PER_CPU_SYMBOL(cpu_sibling_map);
 EXPORT_SYMBOL(cpu_core_map);
+EXPORT_SYMBOL(cpu_core_sib_map);
 static cpumask_t smp_commenced_mask;
@@ -1243,6 +1247,15 @@ void smp_fill_in_sib_core_maps(void)
                }
        }
+        for_each_present_cpu(i)  {
+                unsigned int j;
+                for_each_present_cpu(j)  {
+                        if (cpu_data(i).sock_id == cpu_data(j).sock_id)
+                                cpumask_set_cpu(j, &cpu_core_sib_map[i]);
+                }
+        }
        for_each_present_cpu(i) {
                unsigned int j;
diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
index 09243057cb0b..f1a2f688b28a 100644
--- a/arch/sparc/kernel/vmlinux.lds.S
+++ b/arch/sparc/kernel/vmlinux.lds.S
@@ -138,6 +138,11 @@ SECTIONS
                *(.pause_3insn_patch)
                __pause_3insn_patch_end = .;
        }
+        .sun_m7_2insn_patch : {
+                __sun_m7_2insn_patch = .;
+                *(.sun_m7_2insn_patch)
+                __sun_m7_2insn_patch_end = .;
+        }
        PERCPU_SECTION(SMP_CACHE_BYTES)
        . = ALIGN(PAGE_SIZE);
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 4ca0d6ba5ec8..559cb744112c 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -54,6 +54,7 @@
 #include "init_64.h"
 unsigned long kern_linear_pte_xor[4] __read_mostly;
+static unsigned long page_cache4v_flag;
 /* A bitmap, two bits for every 256MB of physical memory.  These two
 * bits determine what page size we use for kernel linear
@@ -1909,11 +1910,24 @@ static void __init sun4u_linear_pte_xor_finalize(void)
 static void __init sun4v_linear_pte_xor_finalize(void)
 {
+        unsigned long pagecv_flag;
+        /* Bit 9 of TTE is no longer CV bit on M7 processor and it instead
+         * enables MCD error. Do not set bit 9 on M7 processor.
+         */
+        switch (sun4v_chip_type) {
+        case SUN4V_CHIP_SPARC_M7:
+                pagecv_flag = 0x00;
+                break;
+        default:
+                pagecv_flag = _PAGE_CV_4V;
+                break;
+        }
 #ifndef CONFIG_DEBUG_PAGEALLOC
        if (cpu_pgsz_mask & HV_PGSZ_MASK_256MB) {
                kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZ256MB_4V) ^
                        PAGE_OFFSET;
-                kern_linear_pte_xor[1] |= (_PAGE_CP_4V | _PAGE_CV_4V |
+                kern_linear_pte_xor[1] |= (_PAGE_CP_4V | pagecv_flag |
                                           _PAGE_P_4V | _PAGE_W_4V);
        } else {
                kern_linear_pte_xor[1] = kern_linear_pte_xor[0];
@@ -1922,7 +1936,7 @@ static void __init sun4v_linear_pte_xor_finalize(void)
        if (cpu_pgsz_mask & HV_PGSZ_MASK_2GB) {
                kern_linear_pte_xor[2] = (_PAGE_VALID | _PAGE_SZ2GB_4V) ^
                        PAGE_OFFSET;
-                kern_linear_pte_xor[2] |= (_PAGE_CP_4V | _PAGE_CV_4V |
+                kern_linear_pte_xor[2] |= (_PAGE_CP_4V | pagecv_flag |
                                           _PAGE_P_4V | _PAGE_W_4V);
        } else {
                kern_linear_pte_xor[2] = kern_linear_pte_xor[1];
@@ -1931,7 +1945,7 @@ static void __init sun4v_linear_pte_xor_finalize(void)
        if (cpu_pgsz_mask & HV_PGSZ_MASK_16GB) {
                kern_linear_pte_xor[3] = (_PAGE_VALID | _PAGE_SZ16GB_4V) ^
                        PAGE_OFFSET;
-                kern_linear_pte_xor[3] |= (_PAGE_CP_4V | _PAGE_CV_4V |
+                kern_linear_pte_xor[3] |= (_PAGE_CP_4V | pagecv_flag |
                                           _PAGE_P_4V | _PAGE_W_4V);
        } else {
                kern_linear_pte_xor[3] = kern_linear_pte_xor[2];
@@ -1958,6 +1972,13 @@ static phys_addr_t __init available_memory(void)
        return available;
 }
+#define _PAGE_CACHE_4U  (_PAGE_CP_4U | _PAGE_CV_4U)
+#define _PAGE_CACHE_4V  (_PAGE_CP_4V | _PAGE_CV_4V)
+#define __DIRTY_BITS_4U  (_PAGE_MODIFIED_4U | _PAGE_WRITE_4U | _PAGE_W_4U)
+#define __DIRTY_BITS_4V  (_PAGE_MODIFIED_4V | _PAGE_WRITE_4V | _PAGE_W_4V)
+#define __ACCESS_BITS_4U (_PAGE_ACCESSED_4U | _PAGE_READ_4U | _PAGE_R)
+#define __ACCESS_BITS_4V (_PAGE_ACCESSED_4V | _PAGE_READ_4V | _PAGE_R)
 /* We need to exclude reserved regions. This exclusion will include
 * vmlinux and initrd. To be more precise the initrd size could be used to
 * compute a new lower limit because it is freed later during initialization.
@@ -2034,6 +2055,25 @@ void __init paging_init(void)
        memset(swapper_4m_tsb, 0x40, sizeof(swapper_4m_tsb));
 #endif
+        /* TTE.cv bit on sparc v9 occupies the same position as TTE.mcde
+         * bit on M7 processor. This is a conflicting usage of the same
+         * bit. Enabling TTE.cv on M7 would turn on Memory Corruption
+         * Detection error on all pages and this will lead to problems
+         * later. Kernel does not run with MCD enabled and hence rest
+         * of the required steps to fully configure memory corruption
+         * detection are not taken. We need to ensure TTE.mcde is not
+         * set on M7 processor. Compute the value of cacheability
+         * flag for use later taking this into consideration.
+         */
+        switch (sun4v_chip_type) {
+        case SUN4V_CHIP_SPARC_M7:
+                page_cache4v_flag = _PAGE_CP_4V;
+                break;
+        default:
+                page_cache4v_flag = _PAGE_CACHE_4V;
+                break;
+        }
        if (tlb_type == hypervisor)
                sun4v_pgprot_init();
        else
@@ -2274,13 +2314,6 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 }
 #endif
-#define _PAGE_CACHE_4U  (_PAGE_CP_4U | _PAGE_CV_4U)
-#define _PAGE_CACHE_4V  (_PAGE_CP_4V | _PAGE_CV_4V)
-#define __DIRTY_BITS_4U  (_PAGE_MODIFIED_4U | _PAGE_WRITE_4U | _PAGE_W_4U)
-#define __DIRTY_BITS_4V  (_PAGE_MODIFIED_4V | _PAGE_WRITE_4V | _PAGE_W_4V)
-#define __ACCESS_BITS_4U (_PAGE_ACCESSED_4U | _PAGE_READ_4U | _PAGE_R)
-#define __ACCESS_BITS_4V (_PAGE_ACCESSED_4V | _PAGE_READ_4V | _PAGE_R)
 pgprot_t PAGE_KERNEL __read_mostly;
 EXPORT_SYMBOL(PAGE_KERNEL);
@@ -2312,8 +2345,7 @@ int __meminit vmemmap_populate(unsigned long vstart, unsigned long vend,
                    _PAGE_P_4U | _PAGE_W_4U);
        if (tlb_type == hypervisor)
                pte_base = (_PAGE_VALID | _PAGE_SZ4MB_4V |
-                            _PAGE_CP_4V | _PAGE_CV_4V |
+                            page_cache4v_flag | _PAGE_P_4V | _PAGE_W_4V);
-                            _PAGE_P_4V | _PAGE_W_4V);
        pte_base |= _PAGE_PMD_HUGE;
@@ -2450,14 +2482,14 @@ static void __init sun4v_pgprot_init(void)
        int i;
        PAGE_KERNEL = __pgprot (_PAGE_PRESENT_4V | _PAGE_VALID |
-                                _PAGE_CACHE_4V | _PAGE_P_4V |
+                                page_cache4v_flag | _PAGE_P_4V |
                                __ACCESS_BITS_4V | __DIRTY_BITS_4V |
                                _PAGE_EXEC_4V);
        PAGE_KERNEL_LOCKED = PAGE_KERNEL;
        _PAGE_IE = _PAGE_IE_4V;
        _PAGE_E = _PAGE_E_4V;
-        _PAGE_CACHE = _PAGE_CACHE_4V;
+        _PAGE_CACHE = page_cache4v_flag;
 #ifdef CONFIG_DEBUG_PAGEALLOC
        kern_linear_pte_xor[0] = _PAGE_VALID ^ PAGE_OFFSET;
@@ -2465,8 +2497,8 @@ static void __init sun4v_pgprot_init(void)
        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4V) ^
                PAGE_OFFSET;
 #endif
-        kern_linear_pte_xor[0] |= (_PAGE_CP_4V | _PAGE_CV_4V |
+        kern_linear_pte_xor[0] |= (page_cache4v_flag | _PAGE_P_4V |
-                                   _PAGE_P_4V | _PAGE_W_4V);
+                                   _PAGE_W_4V);
        for (i = 1; i < 4; i++)
                kern_linear_pte_xor[i] = kern_linear_pte_xor[0];
@@ -2479,12 +2511,12 @@ static void __init sun4v_pgprot_init(void)
                             _PAGE_SZ4MB_4V | _PAGE_SZ512K_4V |
                             _PAGE_SZ64K_4V | _PAGE_SZ8K_4V);
-        page_none = _PAGE_PRESENT_4V | _PAGE_ACCESSED_4V | _PAGE_CACHE_4V;
+        page_none = _PAGE_PRESENT_4V | _PAGE_ACCESSED_4V | page_cache4v_flag;
-        page_shared = (_PAGE_VALID | _PAGE_PRESENT_4V | _PAGE_CACHE_4V |
+        page_shared = (_PAGE_VALID | _PAGE_PRESENT_4V | page_cache4v_flag |
                       __ACCESS_BITS_4V | _PAGE_WRITE_4V | _PAGE_EXEC_4V);
-        page_copy   = (_PAGE_VALID | _PAGE_PRESENT_4V | _PAGE_CACHE_4V |
+        page_copy   = (_PAGE_VALID | _PAGE_PRESENT_4V | page_cache4v_flag |
                       __ACCESS_BITS_4V | _PAGE_EXEC_4V);
-        page_readonly = (_PAGE_VALID | _PAGE_PRESENT_4V | _PAGE_CACHE_4V |
+        page_readonly = (_PAGE_VALID | _PAGE_PRESENT_4V | page_cache4v_flag |
                         __ACCESS_BITS_4V | _PAGE_EXEC_4V);
        page_exec_bit = _PAGE_EXEC_4V;
@@ -2542,7 +2574,7 @@ static unsigned long kern_large_tte(unsigned long paddr)
               _PAGE_EXEC_4U | _PAGE_L_4U | _PAGE_W_4U);
        if (tlb_type == hypervisor)
                val = (_PAGE_VALID | _PAGE_SZ4MB_4V |
-                       _PAGE_CP_4V | _PAGE_CV_4V | _PAGE_P_4V |
+                       page_cache4v_flag | _PAGE_P_4V |
                       _PAGE_EXEC_4V | _PAGE_W_4V);
        return val | paddr;
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index 89dd0d78013a..805d25ca5f1d 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -2,15 +2,14 @@
 #define BOOT_COMPRESSED_MISC_H
 /*
- * we have to be careful, because no indirections are allowed here, and
+ * Special hack: we have to be careful, because no indirections are allowed here,
- * paravirt_ops is a kind of one. As it will only run in baremetal anyway,
+ * and paravirt_ops is a kind of one. As it will only run in baremetal anyway,
- * we just keep it from happening
+ * we just keep it from happening. (This list needs to be extended when new
+ * paravirt and debugging variants are added.)
 */
 #undef CONFIG_PARAVIRT
+#undef CONFIG_PARAVIRT_SPINLOCKS
 #undef CONFIG_KASAN
-#ifdef CONFIG_X86_32
-#define _ASM_X86_DESC_H 1
-#endif
 #include <linux/linkage.h>
 #include <linux/screen_info.h>
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 19507ffa5d28..5fabf1362942 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -107,7 +107,7 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
 static inline int user_mode(struct pt_regs *regs)
 {
 #ifdef CONFIG_X86_32
-        return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
+        return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >= USER_RPL;
 #else
        return !!(regs->cs & 3);
 #endif
diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
index 5a9856eb12ba..7d5a1929d76b 100644
--- a/arch/x86/include/asm/segment.h
+++ b/arch/x86/include/asm/segment.h
@@ -231,11 +231,21 @@
 #define TLS_SIZE                        (GDT_ENTRY_TLS_ENTRIES* 8)
 #ifdef __KERNEL__
+/*
+ * early_idt_handler_array is an array of entry points referenced in the
+ * early IDT.  For simplicity, it's a real array with one entry point
+ * every nine bytes.  That leaves room for an optional 'push $0' if the
+ * vector has no error code (two bytes), a 'push $vector_number' (two
+ * bytes), and a jump to the common entry code (up to five bytes).
+ */
+#define EARLY_IDT_HANDLER_SIZE 9
 #ifndef __ASSEMBLY__
-extern const char early_idt_handlers[NUM_EXCEPTION_VECTORS][2+2+5];
+extern const char early_idt_handler_array[NUM_EXCEPTION_VECTORS][EARLY_IDT_HANDLER_SIZE];
 #ifdef CONFIG_TRACING
-# define trace_early_idt_handlers early_idt_handlers
+# define trace_early_idt_handler_array early_idt_handler_array
 #endif
 /*
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 87848ebe2bb7..4f7001f28936 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -190,6 +190,7 @@ static bool check_hw_exists(void)
        u64 val, val_fail, val_new= ~0;
        int i, reg, reg_fail, ret = 0;
        int bios_fail = 0;
+        int reg_safe = -1;
        /*
         * Check to see if the BIOS enabled any of the counters, if so
@@ -204,6 +205,8 @@ static bool check_hw_exists(void)
                        bios_fail = 1;
                        val_fail = val;
                        reg_fail = reg;
+                } else {
+                        reg_safe = i;
                }
        }
@@ -222,11 +225,22 @@ static bool check_hw_exists(void)
        }
        /*
+         * If all the counters are enabled, the below test will always
+         * fail.  The tools will also become useless in this scenario.
+         * Just fail and disable the hardware counters.
+         */
+        if (reg_safe == -1) {
+                reg = reg_safe;
+                goto msr_fail;
+        }
+        /*
         * Read the current value, change it and read it back to see if it
         * matches, this is needed to detect certain hardware emulators
         * (qemu/kvm) that don't trap on the MSR access and always return 0s.
         */
-        reg = x86_pmu_event_addr(0);
+        reg = x86_pmu_event_addr(reg_safe);
        if (rdmsrl_safe(reg, &val))
                goto msr_fail;
        val ^= 0xffffUL;
@@ -611,6 +625,7 @@ struct sched_state {
        int     event;          /* event index */
        int     counter;        /* counter index */
        int     unassigned;     /* number of events to be assigned left */
+        int     nr_gp;          /* number of GP counters used */
        unsigned long used[BITS_TO_LONGS(X86_PMC_IDX_MAX)];
 };
@@ -620,27 +635,29 @@ struct sched_state {
 struct perf_sched {
        int                     max_weight;
        int                     max_events;
-        struct perf_event       **events;
+        int                     max_gp;
-        struct sched_state      state;
        int                     saved_states;
+        struct event_constraint **constraints;
+        struct sched_state      state;
        struct sched_state      saved[SCHED_STATES_MAX];
 };
 /*
 * Initialize interator that runs through all events and counters.
 */
-static void perf_sched_init(struct perf_sched *sched, struct perf_event **events,
+static void perf_sched_init(struct perf_sched *sched, struct event_constraint **constraints,
-                            int num, int wmin, int wmax)
+                            int num, int wmin, int wmax, int gpmax)
 {
        int idx;
        memset(sched, 0, sizeof(*sched));
        sched->max_events       = num;
        sched->max_weight       = wmax;
-        sched->events           = events;
+        sched->max_gp           = gpmax;
+        sched->constraints      = constraints;
        for (idx = 0; idx < num; idx++) {
-                if (events[idx]->hw.constraint->weight == wmin)
+                if (constraints[idx]->weight == wmin)
                        break;
        }
@@ -687,7 +704,7 @@ static bool __perf_sched_find_counter(struct perf_sched *sched)
        if (sched->state.event >= sched->max_events)
                return false;
-        c = sched->events[sched->state.event]->hw.constraint;
+        c = sched->constraints[sched->state.event];
        /* Prefer fixed purpose counters */
        if (c->idxmsk64 & (~0ULL << INTEL_PMC_IDX_FIXED)) {
                idx = INTEL_PMC_IDX_FIXED;
@@ -696,11 +713,16 @@ static bool __perf_sched_find_counter(struct perf_sched *sched)
                                goto done;
                }
        }
        /* Grab the first unused counter starting with idx */
        idx = sched->state.counter;
        for_each_set_bit_from(idx, c->idxmsk, INTEL_PMC_IDX_FIXED) {
-                if (!__test_and_set_bit(idx, sched->state.used))
+                if (!__test_and_set_bit(idx, sched->state.used)) {
+                        if (sched->state.nr_gp++ >= sched->max_gp)
+                                return false;
                        goto done;
+                }
        }
        return false;
@@ -745,7 +767,7 @@ static bool perf_sched_next_event(struct perf_sched *sched)
                        if (sched->state.weight > sched->max_weight)
                                return false;
                }
-                c = sched->events[sched->state.event]->hw.constraint;
+                c = sched->constraints[sched->state.event];
        } while (c->weight != sched->state.weight);
        sched->state.counter = 0;       /* start with first counter */
@@ -756,12 +778,12 @@ static bool perf_sched_next_event(struct perf_sched *sched)
 /*
 * Assign a counter for each event.
 */
-int perf_assign_events(struct perf_event **events, int n,
+int perf_assign_events(struct event_constraint **constraints, int n,
-                        int wmin, int wmax, int *assign)
+                        int wmin, int wmax, int gpmax, int *assign)
 {
        struct perf_sched sched;
-        perf_sched_init(&sched, events, n, wmin, wmax);
+        perf_sched_init(&sched, constraints, n, wmin, wmax, gpmax);
        do {
                if (!perf_sched_find_counter(&sched))
@@ -788,9 +810,9 @@ int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
                x86_pmu.start_scheduling(cpuc);
        for (i = 0, wmin = X86_PMC_IDX_MAX, wmax = 0; i < n; i++) {
-                hwc = &cpuc->event_list[i]->hw;
+                cpuc->event_constraint[i] = NULL;
                c = x86_pmu.get_event_constraints(cpuc, i, cpuc->event_list[i]);
-                hwc->constraint = c;
+                cpuc->event_constraint[i] = c;
                wmin = min(wmin, c->weight);
                wmax = max(wmax, c->weight);
@@ -801,7 +823,7 @@ int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
         */
        for (i = 0; i < n; i++) {
                hwc = &cpuc->event_list[i]->hw;
-                c = hwc->constraint;
+                c = cpuc->event_constraint[i];
                /* never assigned */
                if (hwc->idx == -1)
@@ -821,9 +843,26 @@ int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
        }
        /* slow path */
-        if (i != n)
+        if (i != n) {
-                unsched = perf_assign_events(cpuc->event_list, n, wmin,
+                int gpmax = x86_pmu.num_counters;
-                                             wmax, assign);
+                /*
+                 * Do not allow scheduling of more than half the available
+                 * generic counters.
+                 *
+                 * This helps avoid counter starvation of sibling thread by
+                 * ensuring at most half the counters cannot be in exclusive
+                 * mode. There is no designated counters for the limits. Any
+                 * N/2 counters can be used. This helps with events with
+                 * specific counter constraints.
+                 */
+                if (is_ht_workaround_enabled() && !cpuc->is_fake &&
+                    READ_ONCE(cpuc->excl_cntrs->exclusive_present))
+                        gpmax /= 2;
+                unsched = perf_assign_events(cpuc->event_constraint, n, wmin,
+                                             wmax, gpmax, assign);
+        }
        /*
         * In case of success (unsched = 0), mark events as committed,
@@ -840,7 +879,7 @@ int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
                        e = cpuc->event_list[i];
                        e->hw.flags |= PERF_X86_EVENT_COMMITTED;
                        if (x86_pmu.commit_scheduling)
-                                x86_pmu.commit_scheduling(cpuc, e, assign[i]);
+                                x86_pmu.commit_scheduling(cpuc, i, assign[i]);
                }
        }
@@ -1292,8 +1331,10 @@ static void x86_pmu_del(struct perf_event *event, int flags)
                x86_pmu.put_event_constraints(cpuc, event);
        /* Delete the array entry. */
-        while (++i < cpuc->n_events)
+        while (++i < cpuc->n_events) {
                cpuc->event_list[i-1] = cpuc->event_list[i];
+                cpuc->event_constraint[i-1] = cpuc->event_constraint[i];
+        }
        --cpuc->n_events;
        perf_event_update_userpage(event);
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 6ac5cb7a9e14..ef78516850fb 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -74,6 +74,7 @@ struct event_constraint {
 #define PERF_X86_EVENT_EXCL             0x0040 /* HT exclusivity on counter */
 #define PERF_X86_EVENT_DYNAMIC          0x0080 /* dynamic alloc'd constraint */
 #define PERF_X86_EVENT_RDPMC_ALLOWED    0x0100 /* grant rdpmc permission */
+#define PERF_X86_EVENT_EXCL_ACCT        0x0200 /* accounted EXCL event */
 struct amd_nb {
@@ -134,8 +135,6 @@ enum intel_excl_state_type {
 struct intel_excl_states {
        enum intel_excl_state_type init_state[X86_PMC_IDX_MAX];
        enum intel_excl_state_type state[X86_PMC_IDX_MAX];
-        int  num_alloc_cntrs;/* #counters allocated */
-        int  max_alloc_cntrs;/* max #counters allowed */
        bool sched_started; /* true if scheduling has started */
 };
@@ -144,6 +143,11 @@ struct intel_excl_cntrs {
        struct intel_excl_states states[2];
+        union {
+                u16     has_exclusive[2];
+                u32     exclusive_present;
+        };
        int             refcnt;         /* per-core: #HT threads */
        unsigned        core_id;        /* per-core: core id */
 };
@@ -172,7 +176,11 @@ struct cpu_hw_events {
                                             added in the current transaction */
        int                     assign[X86_PMC_IDX_MAX]; /* event to counter assignment */
        u64                     tags[X86_PMC_IDX_MAX];
        struct perf_event       *event_list[X86_PMC_IDX_MAX]; /* in enabled order */
+        struct event_constraint *event_constraint[X86_PMC_IDX_MAX];
+        int                     n_excl; /* the number of exclusive events */
        unsigned int            group_flag;
        int                     is_fake;
@@ -519,9 +527,7 @@ struct x86_pmu {
        void            (*put_event_constraints)(struct cpu_hw_events *cpuc,
                                                 struct perf_event *event);
-        void            (*commit_scheduling)(struct cpu_hw_events *cpuc,
+        void            (*commit_scheduling)(struct cpu_hw_events *cpuc, int idx, int cntr);
-                                             struct perf_event *event,
-                                             int cntr);
        void            (*start_scheduling)(struct cpu_hw_events *cpuc);
@@ -717,8 +723,8 @@ static inline void __x86_pmu_enable_event(struct hw_perf_event *hwc,
 void x86_pmu_enable_all(int added);
-int perf_assign_events(struct perf_event **events, int n,
+int perf_assign_events(struct event_constraint **constraints, int n,
-                        int wmin, int wmax, int *assign);
+                        int wmin, int wmax, int gpmax, int *assign);
 int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign);
 void x86_pmu_stop(struct perf_event *event, int flags);
@@ -929,4 +935,8 @@ static inline struct intel_shared_regs *allocate_shared_regs(int cpu)
        return NULL;
 }
+static inline int is_ht_workaround_enabled(void)
+{
+        return 0;
+}
 #endif /* CONFIG_CPU_SUP_INTEL */
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 3998131d1a68..a1e35c9f06b9 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1923,7 +1923,6 @@ intel_start_scheduling(struct cpu_hw_events *cpuc)
        xl = &excl_cntrs->states[tid];
        xl->sched_started = true;
-        xl->num_alloc_cntrs = 0;
        /*
         * lock shared state until we are done scheduling
         * in stop_event_scheduling()
@@ -2000,6 +1999,11 @@ intel_get_excl_constraints(struct cpu_hw_events *cpuc, struct perf_event *event,
         * across HT threads
         */
        is_excl = c->flags & PERF_X86_EVENT_EXCL;
+        if (is_excl && !(event->hw.flags & PERF_X86_EVENT_EXCL_ACCT)) {
+                event->hw.flags |= PERF_X86_EVENT_EXCL_ACCT;
+                if (!cpuc->n_excl++)
+                        WRITE_ONCE(excl_cntrs->has_exclusive[tid], 1);
+        }
        /*
         * xl = state of current HT
@@ -2008,18 +2012,6 @@ intel_get_excl_constraints(struct cpu_hw_events *cpuc, struct perf_event *event,
        xl = &excl_cntrs->states[tid];
        xlo = &excl_cntrs->states[o_tid];
-        /*
-         * do not allow scheduling of more than max_alloc_cntrs
-         * which is set to half the available generic counters.
-         * this helps avoid counter starvation of sibling thread
-         * by ensuring at most half the counters cannot be in
-         * exclusive mode. There is not designated counters for the
-         * limits. Any N/2 counters can be used. This helps with
-         * events with specifix counter constraints
-         */
-        if (xl->num_alloc_cntrs++ == xl->max_alloc_cntrs)
-                return &emptyconstraint;
        cx = c;
        /*
@@ -2106,7 +2098,7 @@ static struct event_constraint *
 intel_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
                            struct perf_event *event)
 {
-        struct event_constraint *c1 = event->hw.constraint;
+        struct event_constraint *c1 = cpuc->event_constraint[idx];
        struct event_constraint *c2;
        /*
@@ -2150,6 +2142,11 @@ static void intel_put_excl_constraints(struct cpu_hw_events *cpuc,
        xl = &excl_cntrs->states[tid];
        xlo = &excl_cntrs->states[o_tid];
+        if (hwc->flags & PERF_X86_EVENT_EXCL_ACCT) {
+                hwc->flags &= ~PERF_X86_EVENT_EXCL_ACCT;
+                if (!--cpuc->n_excl)
+                        WRITE_ONCE(excl_cntrs->has_exclusive[tid], 0);
+        }
        /*
         * put_constraint may be called from x86_schedule_events()
@@ -2188,8 +2185,6 @@ intel_put_shared_regs_event_constraints(struct cpu_hw_events *cpuc,
 static void intel_put_event_constraints(struct cpu_hw_events *cpuc,
                                        struct perf_event *event)
 {
-        struct event_constraint *c = event->hw.constraint;
        intel_put_shared_regs_event_constraints(cpuc, event);
        /*
@@ -2197,19 +2192,14 @@ static void intel_put_event_constraints(struct cpu_hw_events *cpuc,
         * all events are subject to and must call the
         * put_excl_constraints() routine
         */
-        if (c && cpuc->excl_cntrs)
+        if (cpuc->excl_cntrs)
                intel_put_excl_constraints(cpuc, event);
-        /* cleanup dynamic constraint */
-        if (c && (c->flags & PERF_X86_EVENT_DYNAMIC))
-                event->hw.constraint = NULL;
 }
-static void intel_commit_scheduling(struct cpu_hw_events *cpuc,
+static void intel_commit_scheduling(struct cpu_hw_events *cpuc, int idx, int cntr)
-                                    struct perf_event *event, int cntr)
 {
        struct intel_excl_cntrs *excl_cntrs = cpuc->excl_cntrs;
-        struct event_constraint *c = event->hw.constraint;
+        struct event_constraint *c = cpuc->event_constraint[idx];
        struct intel_excl_states *xlo, *xl;
        int tid = cpuc->excl_thread_id;
        int o_tid = 1 - tid;
@@ -2639,8 +2629,6 @@ static void intel_pmu_cpu_starting(int cpu)
                cpuc->lbr_sel = &cpuc->shared_regs->regs[EXTRA_REG_LBR];
        if (x86_pmu.flags & PMU_FL_EXCL_CNTRS) {
-                int h = x86_pmu.num_counters >> 1;
                for_each_cpu(i, topology_thread_cpumask(cpu)) {
                        struct intel_excl_cntrs *c;
@@ -2654,11 +2642,6 @@ static void intel_pmu_cpu_starting(int cpu)
                }
                cpuc->excl_cntrs->core_id = core_id;
                cpuc->excl_cntrs->refcnt++;
-                /*
-                 * set hard limit to half the number of generic counters
-                 */
-                cpuc->excl_cntrs->states[0].max_alloc_cntrs = h;
-                cpuc->excl_cntrs->states[1].max_alloc_cntrs = h;
        }
 }
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 813f75d71175..7f73b3553e2e 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -706,9 +706,9 @@ void intel_pmu_pebs_disable(struct perf_event *event)
        cpuc->pebs_enabled &= ~(1ULL << hwc->idx);
-        if (event->hw.constraint->flags & PERF_X86_EVENT_PEBS_LDLAT)
+        if (event->hw.flags & PERF_X86_EVENT_PEBS_LDLAT)
                cpuc->pebs_enabled &= ~(1ULL << (hwc->idx + 32));
-        else if (event->hw.constraint->flags & PERF_X86_EVENT_PEBS_ST)
+        else if (event->hw.flags & PERF_X86_EVENT_PEBS_ST)
                cpuc->pebs_enabled &= ~(1ULL << 63);
        if (cpuc->enabled)
diff --git a/arch/x86/kernel/cpu/perf_event_intel_pt.c b/arch/x86/kernel/cpu/perf_event_intel_pt.c
index ffe666c2c6b5..123ff1bb2f60 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_pt.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_pt.c
@@ -151,7 +151,7 @@ static int __init pt_pmu_hw_init(void)
                de_attr->attr.attr.name = pt_caps[i].name;
-                sysfs_attr_init(&de_attrs->attr.attr);
+                sysfs_attr_init(&de_attr->attr.attr);
                de_attr->attr.attr.mode         = S_IRUGO;
                de_attr->attr.show              = pt_cap_show;
@@ -615,7 +615,8 @@ static int pt_buffer_reset_markers(struct pt_buffer *buf,
                                   struct perf_output_handle *handle)
 {
-        unsigned long idx, npages, end;
+        unsigned long head = local64_read(&buf->head);
+        unsigned long idx, npages, wakeup;
        if (buf->snapshot)
                return 0;
@@ -634,17 +635,26 @@ static int pt_buffer_reset_markers(struct pt_buffer *buf,
        buf->topa_index[buf->stop_pos]->stop = 0;
        buf->topa_index[buf->intr_pos]->intr = 0;
-        if (pt_cap_get(PT_CAP_topa_multiple_entries)) {
+        /* how many pages till the STOP marker */
-                npages = (handle->size + 1) >> PAGE_SHIFT;
+        npages = handle->size >> PAGE_SHIFT;
-                end = (local64_read(&buf->head) >> PAGE_SHIFT) + npages;
-                /*if (end > handle->wakeup >> PAGE_SHIFT)
+        /* if it's on a page boundary, fill up one more page */
-                  end = handle->wakeup >> PAGE_SHIFT;*/
+        if (!offset_in_page(head + handle->size + 1))
-                idx = end & (buf->nr_pages - 1);
+                npages++;
-                buf->stop_pos = idx;
-                idx = (local64_read(&buf->head) >> PAGE_SHIFT) + npages - 1;
+        idx = (head >> PAGE_SHIFT) + npages;
-                idx &= buf->nr_pages - 1;
+        idx &= buf->nr_pages - 1;
-                buf->intr_pos = idx;
+        buf->stop_pos = idx;
-        }
+        wakeup = handle->wakeup >> PAGE_SHIFT;
+        /* in the worst case, wake up the consumer one page before hard stop */
+        idx = (head >> PAGE_SHIFT) + npages - 1;
+        if (idx > wakeup)
+                idx = wakeup;
+        idx &= buf->nr_pages - 1;
+        buf->intr_pos = idx;
        buf->topa_index[buf->stop_pos]->stop = 1;
        buf->topa_index[buf->intr_pos]->intr = 1;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index c635b8b49e93..dd319e59246b 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -365,9 +365,8 @@ static int uncore_assign_events(struct intel_uncore_box *box, int assign[], int
        bitmap_zero(used_mask, UNCORE_PMC_IDX_MAX);
        for (i = 0, wmin = UNCORE_PMC_IDX_MAX, wmax = 0; i < n; i++) {
-                hwc = &box->event_list[i]->hw;
                c = uncore_get_event_constraint(box, box->event_list[i]);
-                hwc->constraint = c;
+                box->event_constraint[i] = c;
                wmin = min(wmin, c->weight);
                wmax = max(wmax, c->weight);
        }
@@ -375,7 +374,7 @@ static int uncore_assign_events(struct intel_uncore_box *box, int assign[], int
        /* fastpath, try to reuse previous register */
        for (i = 0; i < n; i++) {
                hwc = &box->event_list[i]->hw;
-                c = hwc->constraint;
+                c = box->event_constraint[i];
                /* never assigned */
                if (hwc->idx == -1)
@@ -395,8 +394,8 @@ static int uncore_assign_events(struct intel_uncore_box *box, int assign[], int
        }
        /* slow path */
        if (i != n)
-                ret = perf_assign_events(box->event_list, n,
+                ret = perf_assign_events(box->event_constraint, n,
-                                         wmin, wmax, assign);
+                                         wmin, wmax, n, assign);
        if (!assign || ret) {
                for (i = 0; i < n; i++)
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
index 6c8c1e7e69d8..f789ec9a0133 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
@@ -97,6 +97,7 @@ struct intel_uncore_box {
        atomic_t refcnt;
        struct perf_event *events[UNCORE_PMC_IDX_MAX];
        struct perf_event *event_list[UNCORE_PMC_IDX_MAX];
+        struct event_constraint *event_constraint[UNCORE_PMC_IDX_MAX];
        unsigned long active_mask[BITS_TO_LONGS(UNCORE_PMC_IDX_MAX)];
        u64 tags[UNCORE_PMC_IDX_MAX];
        struct pci_dev *pci_dev;
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 2b55ee6db053..5a4668136e98 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -167,7 +167,7 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
        clear_bss();
        for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
-                set_intr_gate(i, early_idt_handlers[i]);
+                set_intr_gate(i, early_idt_handler_array[i]);
        load_idt((const struct desc_ptr *)&idt_descr);
        copy_bootdata(__va(real_mode_data));
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index d031bad9e07e..53eeb226657c 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -478,21 +478,22 @@ is486:
 __INIT
 setup_once:
        /*
-         * Set up a idt with 256 entries pointing to ignore_int,
+         * Set up a idt with 256 interrupt gates that push zero if there
-         * interrupt gates. It doesn't actually load idt - that needs
+         * is no error code and then jump to early_idt_handler_common.
-         * to be done on each CPU. Interrupts are enabled elsewhere,
+         * It doesn't actually load the idt - that needs to be done on
-         * when we can be relatively sure everything is ok.
+         * each CPU. Interrupts are enabled elsewhere, when we can be
+         * relatively sure everything is ok.
         */
        movl $idt_table,%edi
-        movl $early_idt_handlers,%eax
+        movl $early_idt_handler_array,%eax
        movl $NUM_EXCEPTION_VECTORS,%ecx
 1:
        movl %eax,(%edi)
        movl %eax,4(%edi)
        /* interrupt gate, dpl=0, present */
        movl $(0x8E000000 + __KERNEL_CS),2(%edi)
-        addl $9,%eax
+        addl $EARLY_IDT_HANDLER_SIZE,%eax
        addl $8,%edi
        loop 1b
@@ -524,26 +525,28 @@ setup_once:
        andl $0,setup_once_ref  /* Once is enough, thanks */
        ret
-ENTRY(early_idt_handlers)
+ENTRY(early_idt_handler_array)
        # 36(%esp) %eflags
        # 32(%esp) %cs
        # 28(%esp) %eip
        # 24(%rsp) error code
        i = 0
        .rept NUM_EXCEPTION_VECTORS
-        .if (EXCEPTION_ERRCODE_MASK >> i) & 1
+        .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1
-        ASM_NOP2
-        .else
        pushl $0                # Dummy error code, to make stack frame uniform
        .endif
        pushl $i                # 20(%esp) Vector number
-        jmp early_idt_handler
+        jmp early_idt_handler_common
        i = i + 1
+        .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc
        .endr
-ENDPROC(early_idt_handlers)
+ENDPROC(early_idt_handler_array)
        
-        /* This is global to keep gas from relaxing the jumps */
+early_idt_handler_common:
-ENTRY(early_idt_handler)
+        /*
+         * The stack is the hardware frame, an error code or zero, and the
+         * vector number.
+         */
        cld
        cmpl $2,(%esp)          # X86_TRAP_NMI
@@ -603,7 +606,7 @@ ex_entry:
 is_nmi:
        addl $8,%esp            /* drop vector number and error code */
        iret
-ENDPROC(early_idt_handler)
+ENDPROC(early_idt_handler_common)
 /* This is the default interrupt "handler" :-) */
        ALIGN
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index ae6588b301c2..df7e78057ae0 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -321,26 +321,28 @@ bad_address:
        jmp bad_address
        __INIT
-        .globl early_idt_handlers
+ENTRY(early_idt_handler_array)
-early_idt_handlers:
        # 104(%rsp) %rflags
        #  96(%rsp) %cs
        #  88(%rsp) %rip
        #  80(%rsp) error code
        i = 0
        .rept NUM_EXCEPTION_VECTORS
-        .if (EXCEPTION_ERRCODE_MASK >> i) & 1
+        .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1
-        ASM_NOP2
-        .else
        pushq $0                # Dummy error code, to make stack frame uniform
        .endif
        pushq $i                # 72(%rsp) Vector number
-        jmp early_idt_handler
+        jmp early_idt_handler_common
        i = i + 1
+        .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc
        .endr
+ENDPROC(early_idt_handler_array)
-/* This is global to keep gas from relaxing the jumps */
+early_idt_handler_common:
-ENTRY(early_idt_handler)
+        /*
+         * The stack is the hardware frame, an error code or zero, and the
+         * vector number.
+         */
        cld
        cmpl $2,(%rsp)          # X86_TRAP_NMI
@@ -412,7 +414,7 @@ ENTRY(early_idt_handler)
 is_nmi:
        addq $16,%rsp           # drop vector number and error code
        INTERRUPT_RETURN
-ENDPROC(early_idt_handler)
+ENDPROC(early_idt_handler_common)
        __INITDATA
diff --git a/block/genhd.c b/block/genhd.c
index 0a536dc05f3b..666e11b83983 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -653,7 +653,6 @@ void del_gendisk(struct gendisk *disk)
        disk->flags &= ~GENHD_FL_UP;
        sysfs_remove_link(&disk_to_dev(disk)->kobj, "bdi");
-        bdi_unregister(&disk->queue->backing_dev_info);
        blk_unregister_queue(disk);
        blk_unregister_region(disk_devt(disk), disk->minors);
diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
index 23716dd8a7ec..5928d0746a27 100644
--- a/drivers/ata/ahci_mvebu.c
+++ b/drivers/ata/ahci_mvebu.c
@@ -45,7 +45,7 @@ static void ahci_mvebu_mbus_config(struct ahci_host_priv *hpriv,
                writel((cs->mbus_attr << 8) |
                       (dram->mbus_dram_target_id << 4) | 1,
                       hpriv->mmio + AHCI_WINDOW_CTRL(i));
-                writel(cs->base, hpriv->mmio + AHCI_WINDOW_BASE(i));
+                writel(cs->base >> 16, hpriv->mmio + AHCI_WINDOW_BASE(i));
                writel(((cs->size - 1) & 0xffff0000),
                       hpriv->mmio + AHCI_WINDOW_SIZE(i));
        }
diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
index 80a80548ad0a..27245957eee3 100644
--- a/drivers/ata/pata_octeon_cf.c
+++ b/drivers/ata/pata_octeon_cf.c
@@ -1053,7 +1053,7 @@ static struct of_device_id octeon_cf_match[] = {
        },
        {},
 };
-MODULE_DEVICE_TABLE(of, octeon_i2c_match);
+MODULE_DEVICE_TABLE(of, octeon_cf_match);
 static struct platform_driver octeon_cf_driver = {
        .probe          = octeon_cf_probe,
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index 9c2ba1c97c42..df0c66cb7ad3 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -179,7 +179,7 @@ static int detect_cache_attributes(unsigned int cpu)
 {
        int ret;
-        if (init_cache_level(cpu))
+        if (init_cache_level(cpu) || !cache_leaves(cpu))
                return -ENOENT;
        per_cpu_cacheinfo(cpu) = kcalloc(cache_leaves(cpu),
diff --git a/drivers/base/init.c b/drivers/base/init.c
index da033d3bab3c..48c0e220acc0 100644
--- a/drivers/base/init.c
+++ b/drivers/base/init.c
@@ -8,6 +8,7 @@
 #include <linux/device.h>
 #include <linux/init.h>
 #include <linux/memory.h>
+#include <linux/of.h>
 #include "base.h"
@@ -34,4 +35,5 @@ void __init driver_init(void)
        cpu_dev_init();
        memory_dev_init();
        container_dev_init();
+        of_core_init();
 }
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index 85b8036deaa3..683dff272562 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -1750,6 +1750,7 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
        struct nvme_iod *iod;
        dma_addr_t meta_dma = 0;
        void *meta = NULL;
+        void __user *metadata;
        if (copy_from_user(&io, uio, sizeof(io)))
                return -EFAULT;
@@ -1763,6 +1764,8 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
                meta_len = 0;
        }
+        metadata = (void __user *)(unsigned long)io.metadata;
        write = io.opcode & 1;
        switch (io.opcode) {
@@ -1786,13 +1789,13 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
        if (meta_len) {
                meta = dma_alloc_coherent(&dev->pci_dev->dev, meta_len,
                                                &meta_dma, GFP_KERNEL);
                if (!meta) {
                        status = -ENOMEM;
                        goto unmap;
                }
                if (write) {
-                        if (copy_from_user(meta, (void __user *)io.metadata,
+                        if (copy_from_user(meta, metadata, meta_len)) {
-                                                                meta_len)) {
                                status = -EFAULT;
                                goto unmap;
                        }
@@ -1819,8 +1822,7 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
        nvme_free_iod(dev, iod);
        if (meta) {
                if (status == NVME_SC_SUCCESS && !write) {
-                        if (copy_to_user((void __user *)io.metadata, meta,
+                        if (copy_to_user(metadata, meta, meta_len))
-                                                                meta_len))
                                status = -EFAULT;
                }
                dma_free_coherent(&dev->pci_dev->dev, meta_len, meta, meta_dma);
diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
index 9b84def7a353..f42f71e37e73 100644
--- a/drivers/dma/hsu/hsu.c
+++ b/drivers/dma/hsu/hsu.c
@@ -384,7 +384,10 @@ static int hsu_dma_terminate_all(struct dma_chan *chan)
        spin_lock_irqsave(&hsuc->vchan.lock, flags);
        hsu_dma_stop_channel(hsuc);
-        hsuc->desc = NULL;
+        if (hsuc->desc) {
+                hsu_dma_desc_free(&hsuc->desc->vdesc);
+                hsuc->desc = NULL;
+        }
        vchan_get_all_descriptors(&hsuc->vchan, &head);
        spin_unlock_irqrestore(&hsuc->vchan.lock, flags);
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index a7d9d3029b14..340f9e607cd8 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2127,6 +2127,7 @@ static int pl330_terminate_all(struct dma_chan *chan)
        struct pl330_dmac *pl330 = pch->dmac;
        LIST_HEAD(list);
+        pm_runtime_get_sync(pl330->ddma.dev);
        spin_lock_irqsave(&pch->lock, flags);
        spin_lock(&pl330->lock);
        _stop(pch->thread);
@@ -2151,6 +2152,8 @@ static int pl330_terminate_all(struct dma_chan *chan)
        list_splice_tail_init(&pch->work_list, &pl330->desc_pool);
        list_splice_tail_init(&pch->completed_list, &pl330->desc_pool);
        spin_unlock_irqrestore(&pch->lock, flags);
+        pm_runtime_mark_last_busy(pl330->ddma.dev);
+        pm_runtime_put_autosuspend(pl330->ddma.dev);
        return 0;
 }
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index 071c2c969eec..72791232e46b 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -186,8 +186,20 @@ struct ibft_kobject {
 static struct iscsi_boot_kset *boot_kset;
+/* fully null address */
 static const char nulls[16];
+/* IPv4-mapped IPv6 ::ffff:0.0.0.0 */
+static const char mapped_nulls[16] = { 0x00, 0x00, 0x00, 0x00,
+                                       0x00, 0x00, 0x00, 0x00,
+                                       0x00, 0x00, 0xff, 0xff,
+                                       0x00, 0x00, 0x00, 0x00 };
+static int address_not_null(u8 *ip)
+{
+        return (memcmp(ip, nulls, 16) && memcmp(ip, mapped_nulls, 16));
+}
 /*
 * Helper functions to parse data properly.
 */
@@ -445,7 +457,7 @@ static umode_t ibft_check_nic_for(void *data, int type)
                rc = S_IRUGO;
                break;
        case ISCSI_BOOT_ETH_IP_ADDR:
-                if (memcmp(nic->ip_addr, nulls, sizeof(nic->ip_addr)))
+                if (address_not_null(nic->ip_addr))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_ETH_SUBNET_MASK:
@@ -456,21 +468,19 @@ static umode_t ibft_check_nic_for(void *data, int type)
                rc = S_IRUGO;
                break;
        case ISCSI_BOOT_ETH_GATEWAY:
-                if (memcmp(nic->gateway, nulls, sizeof(nic->gateway)))
+                if (address_not_null(nic->gateway))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_ETH_PRIMARY_DNS:
-                if (memcmp(nic->primary_dns, nulls,
+                if (address_not_null(nic->primary_dns))
-                           sizeof(nic->primary_dns)))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_ETH_SECONDARY_DNS:
-                if (memcmp(nic->secondary_dns, nulls,
+                if (address_not_null(nic->secondary_dns))
-                           sizeof(nic->secondary_dns)))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_ETH_DHCP:
-                if (memcmp(nic->dhcp, nulls, sizeof(nic->dhcp)))
+                if (address_not_null(nic->dhcp))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_ETH_VLAN:
@@ -536,23 +546,19 @@ static umode_t __init ibft_check_initiator_for(void *data, int type)
                rc = S_IRUGO;
                break;
        case ISCSI_BOOT_INI_ISNS_SERVER:
-                if (memcmp(init->isns_server, nulls,
+                if (address_not_null(init->isns_server))
-                           sizeof(init->isns_server)))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_INI_SLP_SERVER:
-                if (memcmp(init->slp_server, nulls,
+                if (address_not_null(init->slp_server))
-                           sizeof(init->slp_server)))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_INI_PRI_RADIUS_SERVER:
-                if (memcmp(init->pri_radius_server, nulls,
+                if (address_not_null(init->pri_radius_server))
-                           sizeof(init->pri_radius_server)))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_INI_SEC_RADIUS_SERVER:
-                if (memcmp(init->sec_radius_server, nulls,
+                if (address_not_null(init->sec_radius_server))
-                           sizeof(init->sec_radius_server)))
                        rc = S_IRUGO;
                break;
        case ISCSI_BOOT_INI_INITIATOR_NAME:
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index e469c4b2e8cc..c25728bc388a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -684,8 +684,6 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
                        dev->node_props.cpu_core_id_base);
        sysfs_show_32bit_prop(buffer, "simd_id_base",
                        dev->node_props.simd_id_base);
-        sysfs_show_32bit_prop(buffer, "capability",
-                        dev->node_props.capability);
        sysfs_show_32bit_prop(buffer, "max_waves_per_simd",
                        dev->node_props.max_waves_per_simd);
        sysfs_show_32bit_prop(buffer, "lds_size_in_kb",
@@ -736,6 +734,8 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
                        dev->gpu->kfd2kgd->get_fw_version(
                                                dev->gpu->kgd,
                                                KGD_ENGINE_MEC1));
+                sysfs_show_32bit_prop(buffer, "capability",
+                                dev->node_props.capability);
        }
        return sysfs_show_32bit_prop(buffer, "max_engine_clk_ccompute",
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index ffc305fc2076..eb7e61078a5b 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -217,7 +217,7 @@ static ssize_t status_store(struct device *device,
        mutex_unlock(&dev->mode_config.mutex);
-        return ret;
+        return ret ? ret : count;
 }
 static ssize_t status_show(struct device *device,
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 007c7d7d8295..dc55c51964ab 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1667,12 +1667,15 @@ static int i915_sr_status(struct seq_file *m, void *unused)
        if (HAS_PCH_SPLIT(dev))
                sr_enabled = I915_READ(WM1_LP_ILK) & WM1_LP_SR_EN;
-        else if (IS_CRESTLINE(dev) || IS_I945G(dev) || IS_I945GM(dev))
+        else if (IS_CRESTLINE(dev) || IS_G4X(dev) ||
+                 IS_I945G(dev) || IS_I945GM(dev))
                sr_enabled = I915_READ(FW_BLC_SELF) & FW_BLC_SELF_EN;
        else if (IS_I915GM(dev))
                sr_enabled = I915_READ(INSTPM) & INSTPM_SELF_EN;
        else if (IS_PINEVIEW(dev))
                sr_enabled = I915_READ(DSPFW3) & PINEVIEW_SELF_REFRESH_EN;
+        else if (IS_VALLEYVIEW(dev))
+                sr_enabled = I915_READ(FW_BLC_SELF_VLV) & FW_CSPWRDWNEN;
        intel_runtime_pm_put(dev_priv);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 53394f998a1f..851b585987f9 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2656,9 +2656,6 @@ void i915_gem_reset(struct drm_device *dev)
 void
 i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
 {
-        if (list_empty(&ring->request_list))
-                return;
        WARN_ON(i915_verify_lists(ring->dev));
        /* Retire requests first as we use it above for the early return.
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index f27346e907b1..d714a4b5711e 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -880,10 +880,8 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
                                      DP_AUX_CH_CTL_RECEIVE_ERROR))
                                continue;
                        if (status & DP_AUX_CH_CTL_DONE)
-                                break;
+                                goto done;
                }
-                if (status & DP_AUX_CH_CTL_DONE)
-                        break;
        }
        if ((status & DP_AUX_CH_CTL_DONE) == 0) {
@@ -892,6 +890,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
                goto out;
        }
+done:
        /* Check for timeout or receive error.
         * Timeouts occur when the sink is not connected
         */
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 09df74b8e917..424e62197787 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1134,6 +1134,12 @@ static int gen8_init_common_ring(struct intel_engine_cs *ring)
        I915_WRITE_IMR(ring, ~(ring->irq_enable_mask | ring->irq_keep_mask));
        I915_WRITE(RING_HWSTAM(ring->mmio_base), 0xffffffff);
+        if (ring->status_page.obj) {
+                I915_WRITE(RING_HWS_PGA(ring->mmio_base),
+                           (u32)ring->status_page.gfx_addr);
+                POSTING_READ(RING_HWS_PGA(ring->mmio_base));
+        }
        I915_WRITE(RING_MODE_GEN7(ring),
                   _MASKED_BIT_DISABLE(GFX_REPLAY_MODE) |
                   _MASKED_BIT_ENABLE(GFX_RUN_LIST_ENABLE));
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 441e2502b889..005b5e04de4d 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -901,13 +901,6 @@ static int chv_init_workarounds(struct intel_engine_cs *ring)
                            GEN6_WIZ_HASHING_MASK,
                            GEN6_WIZ_HASHING_16x4);
-        if (INTEL_REVID(dev) == SKL_REVID_C0 ||
-            INTEL_REVID(dev) == SKL_REVID_D0)
-                /* WaBarrierPerformanceFixDisable:skl */
-                WA_SET_BIT_MASKED(HDC_CHICKEN0,
-                                  HDC_FENCE_DEST_SLM_DISABLE |
-                                  HDC_BARRIER_PERFORMANCE_DISABLE);
        return 0;
 }
@@ -1024,6 +1017,13 @@ static int skl_init_workarounds(struct intel_engine_cs *ring)
                WA_SET_BIT_MASKED(HIZ_CHICKEN,
                                  BDW_HIZ_POWER_COMPILER_CLOCK_GATING_DISABLE);
+        if (INTEL_REVID(dev) == SKL_REVID_C0 ||
+            INTEL_REVID(dev) == SKL_REVID_D0)
+                /* WaBarrierPerformanceFixDisable:skl */
+                WA_SET_BIT_MASKED(HDC_CHICKEN0,
+                                  HDC_FENCE_DEST_SLM_DISABLE |
+                                  HDC_BARRIER_PERFORMANCE_DISABLE);
        return skl_tune_iz_hashing(ring);
 }
diff --git a/drivers/gpu/drm/radeon/dce3_1_afmt.c b/drivers/gpu/drm/radeon/dce3_1_afmt.c
index f04205170b8a..cfa3a84a2af0 100644
--- a/drivers/gpu/drm/radeon/dce3_1_afmt.c
+++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c
@@ -173,7 +173,7 @@ void dce3_2_hdmi_update_acr(struct drm_encoder *encoder, long offset,
        struct drm_device *dev = encoder->dev;
        struct radeon_device *rdev = dev->dev_private;
-        WREG32(HDMI0_ACR_PACKET_CONTROL + offset,
+        WREG32(DCE3_HDMI0_ACR_PACKET_CONTROL + offset,
                HDMI0_ACR_SOURCE |              /* select SW CTS value */
                HDMI0_ACR_AUTO_SEND);   /* allow hw to sent ACR packets when required */
diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c
index 8fe78d08e01c..7c6966434ee7 100644
--- a/drivers/i2c/busses/i2c-hix5hd2.c
+++ b/drivers/i2c/busses/i2c-hix5hd2.c
@@ -554,4 +554,4 @@ module_platform_driver(hix5hd2_i2c_driver);
 MODULE_DESCRIPTION("Hix5hd2 I2C Bus driver");
 MODULE_AUTHOR("Wei Yan <sledge.yanwei@huawei.com>");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:i2c-hix5hd2");
+MODULE_ALIAS("platform:hix5hd2-i2c");
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 958c8db4ec30..297e9c9ac943 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1143,6 +1143,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
                return -ENOMEM;
        i2c->quirks = s3c24xx_get_device_quirks(pdev);
+        i2c->sysreg = ERR_PTR(-ENOENT);
        if (pdata)
                memcpy(i2c->pdata, pdata, sizeof(*pdata));
        else
diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c
index 89d8aa1d2818..df12c57e6ce0 100644
--- a/drivers/iio/adc/twl6030-gpadc.c
+++ b/drivers/iio/adc/twl6030-gpadc.c
@@ -1001,7 +1001,7 @@ static struct platform_driver twl6030_gpadc_driver = {
 module_platform_driver(twl6030_gpadc_driver);
-MODULE_ALIAS("platform: " DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_AUTHOR("Balaji T K <balajitk@ti.com>");
 MODULE_AUTHOR("Graeme Gregory <gg@slimlogic.co.uk>");
 MODULE_AUTHOR("Oleksandr Kozaruk <oleksandr.kozaruk@ti.com");
diff --git a/drivers/iio/imu/adis16400.h b/drivers/iio/imu/adis16400.h
index 0916bf6b6c31..73b189c1c0fb 100644
--- a/drivers/iio/imu/adis16400.h
+++ b/drivers/iio/imu/adis16400.h
@@ -139,6 +139,7 @@
 #define ADIS16400_NO_BURST              BIT(1)
 #define ADIS16400_HAS_SLOW_MODE         BIT(2)
 #define ADIS16400_HAS_SERIAL_NUMBER     BIT(3)
+#define ADIS16400_BURST_DIAG_STAT       BIT(4)
 struct adis16400_state;
@@ -165,6 +166,7 @@ struct adis16400_state {
        int                             filt_int;
        struct adis adis;
+        unsigned long avail_scan_mask[2];
 };
 /* At the moment triggers are only used for ring buffer
diff --git a/drivers/iio/imu/adis16400_buffer.c b/drivers/iio/imu/adis16400_buffer.c
index 6e727ffe5262..90c24a23c679 100644
--- a/drivers/iio/imu/adis16400_buffer.c
+++ b/drivers/iio/imu/adis16400_buffer.c
@@ -18,7 +18,8 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev,
 {
        struct adis16400_state *st = iio_priv(indio_dev);
        struct adis *adis = &st->adis;
-        uint16_t *tx;
+        unsigned int burst_length;
+        u8 *tx;
        if (st->variant->flags & ADIS16400_NO_BURST)
                return adis_update_scan_mode(indio_dev, scan_mask);
@@ -26,26 +27,29 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev,
        kfree(adis->xfer);
        kfree(adis->buffer);
+        /* All but the timestamp channel */
+        burst_length = (indio_dev->num_channels - 1) * sizeof(u16);
+        if (st->variant->flags & ADIS16400_BURST_DIAG_STAT)
+                burst_length += sizeof(u16);
        adis->xfer = kcalloc(2, sizeof(*adis->xfer), GFP_KERNEL);
        if (!adis->xfer)
                return -ENOMEM;
-        adis->buffer = kzalloc(indio_dev->scan_bytes + sizeof(u16),
+        adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL);
-                GFP_KERNEL);
        if (!adis->buffer)
                return -ENOMEM;
-        tx = adis->buffer + indio_dev->scan_bytes;
+        tx = adis->buffer + burst_length;
        tx[0] = ADIS_READ_REG(ADIS16400_GLOB_CMD);
        tx[1] = 0;
        adis->xfer[0].tx_buf = tx;
        adis->xfer[0].bits_per_word = 8;
        adis->xfer[0].len = 2;
-        adis->xfer[1].tx_buf = tx;
+        adis->xfer[1].rx_buf = adis->buffer;
        adis->xfer[1].bits_per_word = 8;
-        adis->xfer[1].len = indio_dev->scan_bytes;
+        adis->xfer[1].len = burst_length;
        spi_message_init(&adis->msg);
        spi_message_add_tail(&adis->xfer[0], &adis->msg);
@@ -61,6 +65,7 @@ irqreturn_t adis16400_trigger_handler(int irq, void *p)
        struct adis16400_state *st = iio_priv(indio_dev);
        struct adis *adis = &st->adis;
        u32 old_speed_hz = st->adis.spi->max_speed_hz;
+        void *buffer;
        int ret;
        if (!adis->buffer)
@@ -81,7 +86,12 @@ irqreturn_t adis16400_trigger_handler(int irq, void *p)
                spi_setup(st->adis.spi);
        }
-        iio_push_to_buffers_with_timestamp(indio_dev, adis->buffer,
+        if (st->variant->flags & ADIS16400_BURST_DIAG_STAT)
+                buffer = adis->buffer + sizeof(u16);
+        else
+                buffer = adis->buffer;
+        iio_push_to_buffers_with_timestamp(indio_dev, buffer,
                pf->timestamp);
        iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index fa795dcd5f75..2fd68f2219a7 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -405,6 +405,11 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
                        *val = st->variant->temp_scale_nano / 1000000;
                        *val2 = (st->variant->temp_scale_nano % 1000000);
                        return IIO_VAL_INT_PLUS_MICRO;
+                case IIO_PRESSURE:
+                        /* 20 uBar = 0.002kPascal */
+                        *val = 0;
+                        *val2 = 2000;
+                        return IIO_VAL_INT_PLUS_MICRO;
                default:
                        return -EINVAL;
                }
@@ -454,10 +459,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
        }
 }
-#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si) { \
+#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si, chn) { \
        .type = IIO_VOLTAGE, \
        .indexed = 1, \
-        .channel = 0, \
+        .channel = chn, \
        .extend_name = name, \
        .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | \
                BIT(IIO_CHAN_INFO_SCALE), \
@@ -474,10 +479,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
 }
 #define ADIS16400_SUPPLY_CHAN(addr, bits) \
-        ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY)
+        ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY, 0)
 #define ADIS16400_AUX_ADC_CHAN(addr, bits) \
-        ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC)
+        ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC, 1)
 #define ADIS16400_GYRO_CHAN(mod, addr, bits) { \
        .type = IIO_ANGL_VEL, \
@@ -773,7 +778,8 @@ static struct adis16400_chip_info adis16400_chips[] = {
                .channels = adis16448_channels,
                .num_channels = ARRAY_SIZE(adis16448_channels),
                .flags = ADIS16400_HAS_PROD_ID |
-                                ADIS16400_HAS_SERIAL_NUMBER,
+                                ADIS16400_HAS_SERIAL_NUMBER |
+                                ADIS16400_BURST_DIAG_STAT,
                .gyro_scale_micro = IIO_DEGREE_TO_RAD(10000), /* 0.01 deg/s */
                .accel_scale_micro = IIO_G_TO_M_S_2(833), /* 1/1200 g */
                .temp_scale_nano = 73860000, /* 0.07386 C */
@@ -791,11 +797,6 @@ static const struct iio_info adis16400_info = {
        .debugfs_reg_access = adis_debugfs_reg_access,
 };
-static const unsigned long adis16400_burst_scan_mask[] = {
-        ~0UL,
-        0,
-};
 static const char * const adis16400_status_error_msgs[] = {
        [ADIS16400_DIAG_STAT_ZACCL_FAIL] = "Z-axis accelerometer self-test failure",
        [ADIS16400_DIAG_STAT_YACCL_FAIL] = "Y-axis accelerometer self-test failure",
@@ -843,6 +844,20 @@ static const struct adis_data adis16400_data = {
                BIT(ADIS16400_DIAG_STAT_POWER_LOW),
 };
+static void adis16400_setup_chan_mask(struct adis16400_state *st)
+{
+        const struct adis16400_chip_info *chip_info = st->variant;
+        unsigned i;
+        for (i = 0; i < chip_info->num_channels; i++) {
+                const struct iio_chan_spec *ch = &chip_info->channels[i];
+                if (ch->scan_index >= 0 &&
+                    ch->scan_index != ADIS16400_SCAN_TIMESTAMP)
+                        st->avail_scan_mask[0] |= BIT(ch->scan_index);
+        }
+}
 static int adis16400_probe(struct spi_device *spi)
 {
        struct adis16400_state *st;
@@ -866,8 +881,10 @@ static int adis16400_probe(struct spi_device *spi)
        indio_dev->info = &adis16400_info;
        indio_dev->modes = INDIO_DIRECT_MODE;
-        if (!(st->variant->flags & ADIS16400_NO_BURST))
+        if (!(st->variant->flags & ADIS16400_NO_BURST)) {
-                indio_dev->available_scan_masks = adis16400_burst_scan_mask;
+                adis16400_setup_chan_mask(st);
+                indio_dev->available_scan_masks = st->avail_scan_mask;
+        }
        ret = adis_init(&st->adis, indio_dev, spi, &adis16400_data);
        if (ret)
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 7752bd59d4b7..a353b7de6d22 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1063,9 +1063,8 @@ static void alps_process_trackstick_packet_v7(struct psmouse *psmouse)
        right = (packet[1] & 0x02) >> 1;
        middle = (packet[1] & 0x04) >> 2;
-        /* Divide 2 since trackpoint's speed is too fast */
+        input_report_rel(dev2, REL_X, (char)x);
-        input_report_rel(dev2, REL_X, (char)x / 2);
+        input_report_rel(dev2, REL_Y, -((char)y));
-        input_report_rel(dev2, REL_Y, -((char)y / 2));
        input_report_key(dev2, BTN_LEFT, left);
        input_report_key(dev2, BTN_RIGHT, right);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 79363b687195..ce3d40004458 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1376,10 +1376,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
                return true;
        /*
-         * Some models have a revision higher then 20. Meaning param[2] may
+         * Some hw_version >= 4 models have a revision higher then 20. Meaning
-         * be 10 or 20, skip the rates check for these.
+         * that param[2] may be 10 or 20, skip the rates check for these.
         */
-        if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
+        if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
+            param[2] < 40)
                return true;
        for (i = 0; i < ARRAY_SIZE(rates); i++)
@@ -1555,6 +1556,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                case 9:
                case 10:
                case 13:
+                case 14:
                        etd->hw_version = 4;
                        break;
                default:
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index e43d48956dea..e1c7e9e51045 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2930,6 +2930,7 @@ static void *alloc_coherent(struct device *dev, size_t size,
        size      = PAGE_ALIGN(size);
        dma_mask  = dev->coherent_dma_mask;
        flag     &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+        flag     |= __GFP_ZERO;
        page = alloc_pages(flag | __GFP_NOWARN,  get_order(size));
        if (!page) {
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 68d43beccb7e..2ffe58969944 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -696,6 +696,11 @@ static inline struct context_entry *iommu_context_addr(struct intel_iommu *iommu
        return &context[devfn];
 }
+static int iommu_dummy(struct device *dev)
+{
+        return dev->archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO;
+}
 static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devfn)
 {
        struct dmar_drhd_unit *drhd = NULL;
@@ -705,6 +710,9 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
        u16 segment = 0;
        int i;
+        if (iommu_dummy(dev))
+                return NULL;
        if (dev_is_pci(dev)) {
                pdev = to_pci_dev(dev);
                segment = pci_domain_nr(pdev->bus);
@@ -2969,11 +2977,6 @@ static inline struct dmar_domain *get_valid_domain_for_dev(struct device *dev)
        return __get_valid_domain_for_dev(dev);
 }
-static int iommu_dummy(struct device *dev)
-{
-        return dev->archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO;
-}
 /* Check if the dev needs to go through non-identity map and unmap process.*/
 static int iommu_no_mapping(struct device *dev)
 {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index a3b0f7a0c61e..1f82a04ce01a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1774,7 +1774,7 @@ struct bnx2x {
        int                     stats_state;
        /* used for synchronization of concurrent threads statistics handling */
-        struct mutex            stats_lock;
+        struct semaphore        stats_lock;
        /* used by dmae command loader */
        struct dmae_command     stats_dmae;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index fd52ce95127e..33501bcddc48 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12054,7 +12054,7 @@ static int bnx2x_init_bp(struct bnx2x *bp)
        mutex_init(&bp->port.phy_mutex);
        mutex_init(&bp->fw_mb_mutex);
        mutex_init(&bp->drv_info_mutex);
-        mutex_init(&bp->stats_lock);
+        sema_init(&bp->stats_lock, 1);
        bp->drv_info_mng_owner = false;
        INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
@@ -13690,9 +13690,10 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
        cancel_delayed_work_sync(&bp->sp_task);
        cancel_delayed_work_sync(&bp->period_task);
-        mutex_lock(&bp->stats_lock);
+        if (!down_timeout(&bp->stats_lock, HZ / 10)) {
-        bp->stats_state = STATS_STATE_DISABLED;
+                bp->stats_state = STATS_STATE_DISABLED;
-        mutex_unlock(&bp->stats_lock);
+                up(&bp->stats_lock);
+        }
        bnx2x_save_statistics(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 266b055c2360..69d699f0730a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -1372,19 +1372,23 @@ void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
         * that context in case someone is in the middle of a transition.
         * For other events, wait a bit until lock is taken.
         */
-        if (!mutex_trylock(&bp->stats_lock)) {
+        if (down_trylock(&bp->stats_lock)) {
                if (event == STATS_EVENT_UPDATE)
                        return;
                DP(BNX2X_MSG_STATS,
                   "Unlikely stats' lock contention [event %d]\n", event);
-                mutex_lock(&bp->stats_lock);
+                if (unlikely(down_timeout(&bp->stats_lock, HZ / 10))) {
+                        BNX2X_ERR("Failed to take stats lock [event %d]\n",
+                                  event);
+                        return;
+                }
        }
        bnx2x_stats_stm[state][event].action(bp);
        bp->stats_state = bnx2x_stats_stm[state][event].next_state;
-        mutex_unlock(&bp->stats_lock);
+        up(&bp->stats_lock);
        if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
@@ -1970,7 +1974,11 @@ int bnx2x_stats_safe_exec(struct bnx2x *bp,
        /* Wait for statistics to end [while blocking further requests],
         * then run supplied function 'safely'.
         */
-        mutex_lock(&bp->stats_lock);
+        rc = down_timeout(&bp->stats_lock, HZ / 10);
+        if (unlikely(rc)) {
+                BNX2X_ERR("Failed to take statistics lock for safe execution\n");
+                goto out_no_lock;
+        }
        bnx2x_stats_comp(bp);
        while (bp->stats_pending && cnt--)
@@ -1988,7 +1996,7 @@ out:
        /* No need to restart statistics - if they're enabled, the timer
         * will restart the statistics.
         */
-        mutex_unlock(&bp->stats_lock);
+        up(&bp->stats_lock);
+out_no_lock:
        return rc;
 }
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 594a2ab36d31..68f3c13c9ef6 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -2414,7 +2414,7 @@ bfa_ioc_boot(struct bfa_ioc *ioc, enum bfi_fwboot_type boot_type,
        if (status == BFA_STATUS_OK)
                bfa_ioc_lpu_start(ioc);
        else
-                bfa_nw_iocpf_timeout(ioc);
+                bfa_fsm_send_event(&ioc->iocpf, IOCPF_E_TIMEOUT);
        return status;
 }
@@ -3029,7 +3029,7 @@ bfa_ioc_poll_fwinit(struct bfa_ioc *ioc)
        }
        if (ioc->iocpf.poll_time >= BFA_IOC_TOV) {
-                bfa_nw_iocpf_timeout(ioc);
+                bfa_fsm_send_event(&ioc->iocpf, IOCPF_E_TIMEOUT);
        } else {
                ioc->iocpf.poll_time += BFA_IOC_POLL_TOV;
                mod_timer(&ioc->iocpf_timer, jiffies +
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 37072a83f9d6..caae6cb2bc1a 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3701,10 +3701,6 @@ bnad_pci_probe(struct pci_dev *pdev,
        setup_timer(&bnad->bna.ioceth.ioc.sem_timer, bnad_iocpf_sem_timeout,
                                ((unsigned long)bnad));
-        /* Now start the timer before calling IOC */
-        mod_timer(&bnad->bna.ioceth.ioc.iocpf_timer,
-                  jiffies + msecs_to_jiffies(BNA_IOC_TIMER_FREQ));
        /*
         * Start the chip
         * If the call back comes with error, we bail out.
diff --git a/drivers/net/ethernet/brocade/bna/cna_fwimg.c b/drivers/net/ethernet/brocade/bna/cna_fwimg.c
index ebf462d8082f..badea368bdc8 100644
--- a/drivers/net/ethernet/brocade/bna/cna_fwimg.c
+++ b/drivers/net/ethernet/brocade/bna/cna_fwimg.c
@@ -30,6 +30,7 @@ cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
                        u32 *bfi_image_size, char *fw_name)
 {
        const struct firmware *fw;
+        u32 n;
        if (request_firmware(&fw, fw_name, &pdev->dev)) {
                pr_alert("Can't locate firmware %s\n", fw_name);
@@ -40,6 +41,12 @@ cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
        *bfi_image_size = fw->size/sizeof(u32);
        bfi_fw = fw;
+        /* Convert loaded firmware to host order as it is stored in file
+         * as sequence of LE32 integers.
+         */
+        for (n = 0; n < *bfi_image_size; n++)
+                le32_to_cpus(*bfi_image + n);
        return *bfi_image;
 error:
        return NULL;
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index c0ad95d2f63d..809ea4610a77 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -224,12 +224,17 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
        }
 }
-static void efx_free_rx_buffer(struct efx_rx_buffer *rx_buf)
+static void efx_free_rx_buffers(struct efx_rx_queue *rx_queue,
+                                struct efx_rx_buffer *rx_buf,
+                                unsigned int num_bufs)
 {
-        if (rx_buf->page) {
+        do {
-                put_page(rx_buf->page);
+                if (rx_buf->page) {
-                rx_buf->page = NULL;
+                        put_page(rx_buf->page);
-        }
+                        rx_buf->page = NULL;
+                }
+                rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
+        } while (--num_bufs);
 }
 /* Attempt to recycle the page if there is an RX recycle ring; the page can
@@ -278,7 +283,7 @@ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
        /* If this is the last buffer in a page, unmap and free it. */
        if (rx_buf->flags & EFX_RX_BUF_LAST_IN_PAGE) {
                efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
-                efx_free_rx_buffer(rx_buf);
+                efx_free_rx_buffers(rx_queue, rx_buf, 1);
        }
        rx_buf->page = NULL;
 }
@@ -304,10 +309,7 @@ static void efx_discard_rx_packet(struct efx_channel *channel,
        efx_recycle_rx_pages(channel, rx_buf, n_frags);
-        do {
+        efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
-                efx_free_rx_buffer(rx_buf);
-                rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
-        } while (--n_frags);
 }
 /**
@@ -431,11 +433,10 @@ efx_rx_packet_gro(struct efx_channel *channel, struct efx_rx_buffer *rx_buf,
        skb = napi_get_frags(napi);
        if (unlikely(!skb)) {
-                while (n_frags--) {
+                struct efx_rx_queue *rx_queue;
-                        put_page(rx_buf->page);
-                        rx_buf->page = NULL;
+                rx_queue = efx_channel_get_rx_queue(channel);
-                        rx_buf = efx_rx_buf_next(&channel->rx_queue, rx_buf);
+                efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
-                }
                return;
        }
@@ -622,7 +623,10 @@ static void efx_rx_deliver(struct efx_channel *channel, u8 *eh,
        skb = efx_rx_mk_skb(channel, rx_buf, n_frags, eh, hdr_len);
        if (unlikely(skb == NULL)) {
-                efx_free_rx_buffer(rx_buf);
+                struct efx_rx_queue *rx_queue;
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
                return;
        }
        skb_record_rx_queue(skb, channel->rx_queue.core_index);
@@ -661,8 +665,12 @@ void __efx_rx_packet(struct efx_channel *channel)
         * loopback layer, and free the rx_buf here
         */
        if (unlikely(efx->loopback_selftest)) {
+                struct efx_rx_queue *rx_queue;
                efx_loopback_rx_packet(efx, eh, rx_buf->len);
-                efx_free_rx_buffer(rx_buf);
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf,
+                                    channel->rx_pkt_n_frags);
                goto out;
        }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 4ec9811f49c8..65efb1468988 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -511,11 +511,9 @@ static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
                                     msgbuf->rx_pktids,
                                     msgbuf->ioctl_resp_pktid);
        if (msgbuf->ioctl_resp_ret_len != 0) {
-                if (!skb) {
+                if (!skb)
-                        brcmf_err("Invalid packet id idx recv'd %d\n",
-                                  msgbuf->ioctl_resp_pktid);
                        return -EBADF;
-                }
                memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
                                       len : msgbuf->ioctl_resp_ret_len);
        }
@@ -874,10 +872,8 @@ brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
        flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
        skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
                                     msgbuf->tx_pktids, idx);
-        if (!skb) {
+        if (!skb)
-                brcmf_err("Invalid packet id idx recv'd %d\n", idx);
                return;
-        }
        set_bit(flowid, msgbuf->txstatus_done_map);
        commonring = msgbuf->flowrings[flowid];
@@ -1156,6 +1152,8 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
        skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
                                     msgbuf->rx_pktids, idx);
+        if (!skb)
+                return;
        if (data_offset)
                skb_pull(skb, data_offset);
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 75e96db6626b..8e604a3931ca 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -471,7 +471,7 @@ static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
        if (cfg->device_family != IWL_DEVICE_FAMILY_8000)
                return le16_to_cpup(nvm_sw + RADIO_CFG);
-        return le32_to_cpup((__le32 *)(nvm_sw + RADIO_CFG_FAMILY_8000));
+        return le32_to_cpup((__le32 *)(phy_sku + RADIO_CFG_FAMILY_8000));
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 01996c9d98a7..376b84e54ad7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -1,7 +1,7 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2015 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -320,7 +320,7 @@ struct iwl_trans_pcie {
        /*protect hw register */
        spinlock_t reg_lock;
-        bool cmd_in_flight;
+        bool cmd_hold_nic_awake;
        bool ref_cmd_in_flight;
        /* protect ref counter */
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index d6f6515fe663..dc179094e6a0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1372,7 +1372,7 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
        spin_lock_irqsave(&trans_pcie->reg_lock, *flags);
-        if (trans_pcie->cmd_in_flight)
+        if (trans_pcie->cmd_hold_nic_awake)
                goto out;
        /* this bit wakes up the NIC */
@@ -1438,7 +1438,7 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
         */
        __acquire(&trans_pcie->reg_lock);
-        if (trans_pcie->cmd_in_flight)
+        if (trans_pcie->cmd_hold_nic_awake)
                goto out;
        __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 06952aadfd7b..5ef8044c2ea3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1039,18 +1039,14 @@ static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
                iwl_trans_pcie_ref(trans);
        }
-        if (trans_pcie->cmd_in_flight)
-                return 0;
-        trans_pcie->cmd_in_flight = true;
        /*
         * wake up the NIC to make sure that the firmware will see the host
         * command - we will let the NIC sleep once all the host commands
         * returned. This needs to be done only on NICs that have
         * apmg_wake_up_wa set.
         */
-        if (trans->cfg->base_params->apmg_wake_up_wa) {
+        if (trans->cfg->base_params->apmg_wake_up_wa &&
+            !trans_pcie->cmd_hold_nic_awake) {
                __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
                                         CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
                if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
@@ -1064,10 +1060,10 @@ static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
                if (ret < 0) {
                        __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-                        trans_pcie->cmd_in_flight = false;
                        IWL_ERR(trans, "Failed to wake NIC for hcmd\n");
                        return -EIO;
                }
+                trans_pcie->cmd_hold_nic_awake = true;
        }
        return 0;
@@ -1085,15 +1081,14 @@ static int iwl_pcie_clear_cmd_in_flight(struct iwl_trans *trans)
                iwl_trans_pcie_unref(trans);
        }
-        if (WARN_ON(!trans_pcie->cmd_in_flight))
+        if (trans->cfg->base_params->apmg_wake_up_wa) {
-                return 0;
+                if (WARN_ON(!trans_pcie->cmd_hold_nic_awake))
+                        return 0;
-        trans_pcie->cmd_in_flight = false;
-        if (trans->cfg->base_params->apmg_wake_up_wa)
+                trans_pcie->cmd_hold_nic_awake = false;
                __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
-                                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                                           CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+        }
        return 0;
 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 4de46aa61d95..0d2594395ffb 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1250,7 +1250,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                        netdev_err(queue->vif->dev,
                                   "txreq.offset: %x, size: %u, end: %lu\n",
                                   txreq.offset, txreq.size,
-                                   (txreq.offset&~PAGE_MASK) + txreq.size);
+                                   (unsigned long)(txreq.offset&~PAGE_MASK) + txreq.size);
                        xenvif_fatal_tx_err(queue->vif);
                        break;
                }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index fee02414529e..968787abf78d 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -34,6 +34,8 @@ struct backend_info {
        enum xenbus_state frontend_state;
        struct xenbus_watch hotplug_status_watch;
        u8 have_hotplug_status_watch:1;
+        const char *hotplug_script;
 };
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue);
@@ -238,6 +240,7 @@ static int netback_remove(struct xenbus_device *dev)
                xenvif_free(be->vif);
                be->vif = NULL;
        }
+        kfree(be->hotplug_script);
        kfree(be);
        dev_set_drvdata(&dev->dev, NULL);
        return 0;
@@ -255,6 +258,7 @@ static int netback_probe(struct xenbus_device *dev,
        struct xenbus_transaction xbt;
        int err;
        int sg;
+        const char *script;
        struct backend_info *be = kzalloc(sizeof(struct backend_info),
                                          GFP_KERNEL);
        if (!be) {
@@ -347,6 +351,15 @@ static int netback_probe(struct xenbus_device *dev,
        if (err)
                pr_debug("Error writing multi-queue-max-queues\n");
+        script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
+        if (IS_ERR(script)) {
+                err = PTR_ERR(script);
+                xenbus_dev_fatal(dev, err, "reading script");
+                goto fail;
+        }
+        be->hotplug_script = script;
        err = xenbus_switch_state(dev, XenbusStateInitWait);
        if (err)
                goto fail;
@@ -379,22 +392,14 @@ static int netback_uevent(struct xenbus_device *xdev,
                          struct kobj_uevent_env *env)
 {
        struct backend_info *be = dev_get_drvdata(&xdev->dev);
-        char *val;
-        val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
+        if (!be)
-        if (IS_ERR(val)) {
+                return 0;
-                int err = PTR_ERR(val);
-                xenbus_dev_fatal(xdev, err, "reading script");
+        if (add_uevent_var(env, "script=%s", be->hotplug_script))
-                return err;
+                return -ENOMEM;
-        } else {
-                if (add_uevent_var(env, "script=%s", val)) {
-                        kfree(val);
-                        return -ENOMEM;
-                }
-                kfree(val);
-        }
-        if (!be || !be->vif)
+        if (!be->vif)
                return 0;
        return add_uevent_var(env, "vif=%s", be->vif->dev->name);
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 99764db0875a..f0650265febf 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -189,7 +189,7 @@ int __of_attach_node_sysfs(struct device_node *np)
        return 0;
 }
-static int __init of_init(void)
+void __init of_core_init(void)
 {
        struct device_node *np;
@@ -198,7 +198,8 @@ static int __init of_init(void)
        of_kset = kset_create_and_add("devicetree", NULL, firmware_kobj);
        if (!of_kset) {
                mutex_unlock(&of_mutex);
-                return -ENOMEM;
+                pr_err("devicetree: failed to register existing nodes\n");
+                return;
        }
        for_each_of_allnodes(np)
                __of_attach_node_sysfs(np);
@@ -207,10 +208,7 @@ static int __init of_init(void)
        /* Symlink in /proc as required by userspace ABI */
        if (of_root)
                proc_symlink("device-tree", NULL, "/sys/firmware/devicetree/base");
-        return 0;
 }
-core_initcall(of_init);
 static struct property *__of_find_property(const struct device_node *np,
                                           const char *name, int *lenp)
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index 3351ef408125..53826b84e0ec 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -225,7 +225,7 @@ void __of_attach_node(struct device_node *np)
        phandle = __of_get_property(np, "phandle", &sz);
        if (!phandle)
                phandle = __of_get_property(np, "linux,phandle", &sz);
-        if (IS_ENABLED(PPC_PSERIES) && !phandle)
+        if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle)
                phandle = __of_get_property(np, "ibm,phandle", &sz);
        np->phandle = (phandle && (sz >= 4)) ? be32_to_cpup(phandle) : 0;
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 4fd0cacf7ca0..508cc56130e3 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -428,16 +428,19 @@ static void __assign_resources_sorted(struct list_head *head,
                 * consistent.
                 */
                if (add_align > dev_res->res->start) {
+                        resource_size_t r_size = resource_size(dev_res->res);
                        dev_res->res->start = add_align;
-                        dev_res->res->end = add_align +
+                        dev_res->res->end = add_align + r_size - 1;
-                                            resource_size(dev_res->res);
                        list_for_each_entry(dev_res2, head, list) {
                                align = pci_resource_alignment(dev_res2->dev,
                                                               dev_res2->res);
-                                if (add_align > align)
+                                if (add_align > align) {
                                        list_move_tail(&dev_res->list,
                                                       &dev_res2->list);
+                                        break;
+                                }
                        }
               }
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index a53bd5b52df9..fc9b9f0ea91e 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -38,7 +38,9 @@ config ARMADA375_USBCLUSTER_PHY
 config PHY_DM816X_USB
        tristate "TI dm816x USB PHY driver"
        depends on ARCH_OMAP2PLUS
+        depends on USB_SUPPORT
        select GENERIC_PHY
+        select USB_PHY
        help
          Enable this for dm816x USB to work.
@@ -97,8 +99,9 @@ config OMAP_CONTROL_PHY
 config OMAP_USB2
        tristate "OMAP USB2 PHY Driver"
        depends on ARCH_OMAP2PLUS
-        depends on USB_PHY
+        depends on USB_SUPPORT
        select GENERIC_PHY
+        select USB_PHY
        select OMAP_CONTROL_PHY
        depends on OMAP_OCP2SCP
        help
@@ -122,8 +125,9 @@ config TI_PIPE3
 config TWL4030_USB
        tristate "TWL4030 USB Transceiver Driver"
        depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
-        depends on USB_PHY
+        depends on USB_SUPPORT
        select GENERIC_PHY
+        select USB_PHY
        help
          Enable this to support the USB OTG transceiver on TWL4030
          family chips (including the TWL5030 and TPS659x0 devices).
@@ -304,7 +308,7 @@ config PHY_STIH41X_USB
 config PHY_QCOM_UFS
        tristate "Qualcomm UFS PHY driver"
-        depends on OF && ARCH_MSM
+        depends on OF && ARCH_QCOM
        select GENERIC_PHY
        help
          Support for UFS PHY on QCOM chipsets.
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 3791838f4bd4..63bc12d7a73e 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -530,7 +530,7 @@ struct phy *phy_optional_get(struct device *dev, const char *string)
 {
        struct phy *phy = phy_get(dev, string);
-        if (PTR_ERR(phy) == -ENODEV)
+        if (IS_ERR(phy) && (PTR_ERR(phy) == -ENODEV))
                phy = NULL;
        return phy;
@@ -584,7 +584,7 @@ struct phy *devm_phy_optional_get(struct device *dev, const char *string)
 {
        struct phy *phy = devm_phy_get(dev, string);
-        if (PTR_ERR(phy) == -ENODEV)
+        if (IS_ERR(phy) && (PTR_ERR(phy) == -ENODEV))
                phy = NULL;
        return phy;
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 183ef4368101..c1a468686bdc 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -275,6 +275,7 @@ static int omap_usb2_probe(struct platform_device *pdev)
                phy->wkupclk = devm_clk_get(phy->dev, "usb_phy_cm_clk32k");
                if (IS_ERR(phy->wkupclk)) {
                        dev_err(&pdev->dev, "unable to get usb_phy_cm_clk32k\n");
+                        pm_runtime_disable(phy->dev);
                        return PTR_ERR(phy->wkupclk);
                } else {
                        dev_warn(&pdev->dev,
diff --git a/drivers/phy/phy-rcar-gen2.c b/drivers/phy/phy-rcar-gen2.c
index 778276aba3aa..97d45f47d1ad 100644
--- a/drivers/phy/phy-rcar-gen2.c
+++ b/drivers/phy/phy-rcar-gen2.c
@@ -23,7 +23,7 @@
 #define USBHS_LPSTS                     0x02
 #define USBHS_UGCTRL                    0x80
 #define USBHS_UGCTRL2                   0x84
-#define USBHS_UGSTS                     0x88    /* The manuals have 0x90 */
+#define USBHS_UGSTS                     0x88    /* From technical update */
 /* Low Power Status register (LPSTS) */
 #define USBHS_LPSTS_SUSPM               0x4000
@@ -41,7 +41,7 @@
 #define USBHS_UGCTRL2_USB0SEL_HS_USB    0x00000030
 /* USB General status register (UGSTS) */
-#define USBHS_UGSTS_LOCK                0x00000300 /* The manuals have 0x3 */
+#define USBHS_UGSTS_LOCK                0x00000100 /* From technical update */
 #define PHYS_PER_CHANNEL        2
diff --git a/drivers/staging/ozwpan/ozhcd.c b/drivers/staging/ozwpan/ozhcd.c
index 5ff4716b72c3..784b5ecfa849 100644
--- a/drivers/staging/ozwpan/ozhcd.c
+++ b/drivers/staging/ozwpan/ozhcd.c
@@ -746,8 +746,8 @@ void oz_hcd_pd_reset(void *hpd, void *hport)
 /*
 * Context: softirq
 */
-void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status, const u8 *desc,
+void oz_hcd_get_desc_cnf(void *hport, u8 req_id, u8 status, const u8 *desc,
-                        int length, int offset, int total_size)
+                        u8 length, u16 offset, u16 total_size)
 {
        struct oz_port *port = hport;
        struct urb *urb;
@@ -759,8 +759,8 @@ void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status, const u8 *desc,
        if (!urb)
                return;
        if (status == 0) {
-                int copy_len;
+                unsigned int copy_len;
-                int required_size = urb->transfer_buffer_length;
+                unsigned int required_size = urb->transfer_buffer_length;
                if (required_size > total_size)
                        required_size = total_size;
diff --git a/drivers/staging/ozwpan/ozusbif.h b/drivers/staging/ozwpan/ozusbif.h
index 4249fa374012..d2a6085345be 100644
--- a/drivers/staging/ozwpan/ozusbif.h
+++ b/drivers/staging/ozwpan/ozusbif.h
@@ -29,8 +29,8 @@ void oz_usb_request_heartbeat(void *hpd);
 /* Confirmation functions.
 */
-void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status,
+void oz_hcd_get_desc_cnf(void *hport, u8 req_id, u8 status,
-        const u8 *desc, int length, int offset, int total_size);
+        const u8 *desc, u8 length, u16 offset, u16 total_size);
 void oz_hcd_control_cnf(void *hport, u8 req_id, u8 rcode,
        const u8 *data, int data_len);
diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
index d434d8c6fff6..f660bb198c65 100644
--- a/drivers/staging/ozwpan/ozusbsvc1.c
+++ b/drivers/staging/ozwpan/ozusbsvc1.c
@@ -326,7 +326,11 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx,
                        struct oz_multiple_fixed *body =
                                (struct oz_multiple_fixed *)data_hdr;
                        u8 *data = body->data;
-                        int n = (len - sizeof(struct oz_multiple_fixed)+1)
+                        unsigned int n;
+                        if (!body->unit_size ||
+                                len < sizeof(struct oz_multiple_fixed) - 1)
+                                break;
+                        n = (len - (sizeof(struct oz_multiple_fixed) - 1))
                                / body->unit_size;
                        while (n--) {
                                oz_hcd_data_ind(usb_ctx->hport, body->endpoint,
@@ -390,10 +394,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt)
        case OZ_GET_DESC_RSP: {
                        struct oz_get_desc_rsp *body =
                                (struct oz_get_desc_rsp *)usb_hdr;
-                        int data_len = elt->length -
+                        u16 offs, total_size;
-                                        sizeof(struct oz_get_desc_rsp) + 1;
+                        u8 data_len;
-                        u16 offs = le16_to_cpu(get_unaligned(&body->offset));
-                        u16 total_size =
+                        if (elt->length < sizeof(struct oz_get_desc_rsp) - 1)
+                                break;
+                        data_len = elt->length -
+                                        (sizeof(struct oz_get_desc_rsp) - 1);
+                        offs = le16_to_cpu(get_unaligned(&body->offset));
+                        total_size =
                                le16_to_cpu(get_unaligned(&body->total_size));
                        oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n");
                        oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id,
diff --git a/drivers/staging/rtl8712/rtl8712_led.c b/drivers/staging/rtl8712/rtl8712_led.c
index f1d47a0676c3..ada8d5dafd49 100644
--- a/drivers/staging/rtl8712/rtl8712_led.c
+++ b/drivers/staging/rtl8712/rtl8712_led.c
@@ -898,11 +898,11 @@ static void SwLedControlMode1(struct _adapter *padapter,
                          IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedNoLinkBlinkInProgress = true;
@@ -921,11 +921,11 @@ static void SwLedControlMode1(struct _adapter *padapter,
                            IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedLinkBlinkInProgress = true;
@@ -946,15 +946,15 @@ static void SwLedControlMode1(struct _adapter *padapter,
                        if (IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                 pLed->bLedLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedScanBlinkInProgress = true;
@@ -975,11 +975,11 @@ static void SwLedControlMode1(struct _adapter *padapter,
                            IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedLinkBlinkInProgress = false;
                        }
                        pLed->bLedBlinkInProgress = true;
@@ -998,19 +998,19 @@ static void SwLedControlMode1(struct _adapter *padapter,
        case LED_CTL_START_WPS_BOTTON:
                 if (pLed->bLedWPSBlinkInProgress == false) {
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                 pLed->bLedLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        if (pLed->bLedScanBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedScanBlinkInProgress = false;
                        }
                        pLed->bLedWPSBlinkInProgress = true;
@@ -1025,23 +1025,23 @@ static void SwLedControlMode1(struct _adapter *padapter,
                break;
        case LED_CTL_STOP_WPS:
                if (pLed->bLedNoLinkBlinkInProgress == true) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedNoLinkBlinkInProgress = false;
                }
                if (pLed->bLedLinkBlinkInProgress == true) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                         pLed->bLedLinkBlinkInProgress = false;
                }
                if (pLed->bLedBlinkInProgress == true) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedScanBlinkInProgress == true) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedScanBlinkInProgress = false;
                }
                if (pLed->bLedWPSBlinkInProgress)
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                else
                        pLed->bLedWPSBlinkInProgress = true;
                pLed->CurrLedState = LED_BLINK_WPS_STOP;
@@ -1057,7 +1057,7 @@ static void SwLedControlMode1(struct _adapter *padapter,
                break;
        case LED_CTL_STOP_WPS_FAIL:
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                pLed->bLedNoLinkBlinkInProgress = true;
@@ -1073,23 +1073,23 @@ static void SwLedControlMode1(struct _adapter *padapter,
                pLed->CurrLedState = LED_OFF;
                pLed->BlinkingLedState = LED_OFF;
                if (pLed->bLedNoLinkBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedNoLinkBlinkInProgress = false;
                }
                if (pLed->bLedLinkBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedLinkBlinkInProgress = false;
                }
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                if (pLed->bLedScanBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedScanBlinkInProgress = false;
                }
                mod_timer(&pLed->BlinkTimer,
@@ -1116,7 +1116,7 @@ static void SwLedControlMode2(struct _adapter *padapter,
                                return;
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedScanBlinkInProgress = true;
@@ -1154,11 +1154,11 @@ static void SwLedControlMode2(struct _adapter *padapter,
                pLed->CurrLedState = LED_ON;
                pLed->BlinkingLedState = LED_ON;
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedScanBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedScanBlinkInProgress = false;
                }
@@ -1170,11 +1170,11 @@ static void SwLedControlMode2(struct _adapter *padapter,
        case LED_CTL_START_WPS_BOTTON:
                if (pLed->bLedWPSBlinkInProgress == false) {
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        if (pLed->bLedScanBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedScanBlinkInProgress = false;
                        }
                        pLed->bLedWPSBlinkInProgress = true;
@@ -1214,15 +1214,15 @@ static void SwLedControlMode2(struct _adapter *padapter,
                pLed->CurrLedState = LED_OFF;
                pLed->BlinkingLedState = LED_OFF;
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedScanBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedScanBlinkInProgress = false;
                }
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                mod_timer(&pLed->BlinkTimer,
@@ -1248,7 +1248,7 @@ static void SwLedControlMode3(struct _adapter *padapter,
                        if (IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedScanBlinkInProgress = true;
@@ -1286,11 +1286,11 @@ static void SwLedControlMode3(struct _adapter *padapter,
                pLed->CurrLedState = LED_ON;
                pLed->BlinkingLedState = LED_ON;
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedScanBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedScanBlinkInProgress = false;
                }
                mod_timer(&pLed->BlinkTimer,
@@ -1300,11 +1300,11 @@ static void SwLedControlMode3(struct _adapter *padapter,
        case LED_CTL_START_WPS_BOTTON:
                if (pLed->bLedWPSBlinkInProgress == false) {
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        if (pLed->bLedScanBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedScanBlinkInProgress = false;
                        }
                        pLed->bLedWPSBlinkInProgress = true;
@@ -1319,7 +1319,7 @@ static void SwLedControlMode3(struct _adapter *padapter,
                break;
        case LED_CTL_STOP_WPS:
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&(pLed->BlinkTimer));
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                } else
                        pLed->bLedWPSBlinkInProgress = true;
@@ -1336,7 +1336,7 @@ static void SwLedControlMode3(struct _adapter *padapter,
                break;
        case LED_CTL_STOP_WPS_FAIL:
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                pLed->CurrLedState = LED_OFF;
@@ -1357,15 +1357,15 @@ static void SwLedControlMode3(struct _adapter *padapter,
                pLed->CurrLedState = LED_OFF;
                pLed->BlinkingLedState = LED_OFF;
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedScanBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedScanBlinkInProgress = false;
                }
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                mod_timer(&pLed->BlinkTimer,
@@ -1388,7 +1388,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
        case LED_CTL_START_TO_LINK:
                if (pLed1->bLedWPSBlinkInProgress) {
                        pLed1->bLedWPSBlinkInProgress = false;
-                        del_timer_sync(&pLed1->BlinkTimer);
+                        del_timer(&pLed1->BlinkTimer);
                        pLed1->BlinkingLedState = LED_OFF;
                        pLed1->CurrLedState = LED_OFF;
                        if (pLed1->bLedOn)
@@ -1400,11 +1400,11 @@ static void SwLedControlMode4(struct _adapter *padapter,
                            IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        pLed->bLedStartToLinkBlinkInProgress = true;
@@ -1426,7 +1426,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                if (LedAction == LED_CTL_LINK) {
                        if (pLed1->bLedWPSBlinkInProgress) {
                                pLed1->bLedWPSBlinkInProgress = false;
-                                del_timer_sync(&pLed1->BlinkTimer);
+                                del_timer(&pLed1->BlinkTimer);
                                pLed1->BlinkingLedState = LED_OFF;
                                pLed1->CurrLedState = LED_OFF;
                                if (pLed1->bLedOn)
@@ -1439,7 +1439,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                            IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedNoLinkBlinkInProgress = true;
@@ -1460,11 +1460,11 @@ static void SwLedControlMode4(struct _adapter *padapter,
                        if (IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedScanBlinkInProgress = true;
@@ -1485,7 +1485,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                            IS_LED_WPS_BLINKING(pLed))
                                return;
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        pLed->bLedBlinkInProgress = true;
@@ -1503,7 +1503,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
        case LED_CTL_START_WPS_BOTTON:
                if (pLed1->bLedWPSBlinkInProgress) {
                        pLed1->bLedWPSBlinkInProgress = false;
-                        del_timer_sync(&(pLed1->BlinkTimer));
+                        del_timer(&pLed1->BlinkTimer);
                        pLed1->BlinkingLedState = LED_OFF;
                        pLed1->CurrLedState = LED_OFF;
                        if (pLed1->bLedOn)
@@ -1512,15 +1512,15 @@ static void SwLedControlMode4(struct _adapter *padapter,
                }
                if (pLed->bLedWPSBlinkInProgress == false) {
                        if (pLed->bLedNoLinkBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedNoLinkBlinkInProgress = false;
                        }
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        if (pLed->bLedScanBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedScanBlinkInProgress = false;
                        }
                        pLed->bLedWPSBlinkInProgress = true;
@@ -1538,7 +1538,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                break;
        case LED_CTL_STOP_WPS:  /*WPS connect success*/
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                pLed->bLedNoLinkBlinkInProgress = true;
@@ -1552,7 +1552,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                break;
        case LED_CTL_STOP_WPS_FAIL:     /*WPS authentication fail*/
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                pLed->bLedNoLinkBlinkInProgress = true;
@@ -1565,7 +1565,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                          msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
                /*LED1 settings*/
                if (pLed1->bLedWPSBlinkInProgress)
-                        del_timer_sync(&pLed1->BlinkTimer);
+                        del_timer(&pLed1->BlinkTimer);
                else
                        pLed1->bLedWPSBlinkInProgress = true;
                pLed1->CurrLedState = LED_BLINK_WPS_STOP;
@@ -1578,7 +1578,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                break;
        case LED_CTL_STOP_WPS_FAIL_OVERLAP:     /*WPS session overlap*/
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                pLed->bLedNoLinkBlinkInProgress = true;
@@ -1591,7 +1591,7 @@ static void SwLedControlMode4(struct _adapter *padapter,
                          msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
                /*LED1 settings*/
                if (pLed1->bLedWPSBlinkInProgress)
-                        del_timer_sync(&pLed1->BlinkTimer);
+                        del_timer(&pLed1->BlinkTimer);
                else
                        pLed1->bLedWPSBlinkInProgress = true;
                pLed1->CurrLedState = LED_BLINK_WPS_STOP_OVERLAP;
@@ -1607,31 +1607,31 @@ static void SwLedControlMode4(struct _adapter *padapter,
                pLed->CurrLedState = LED_OFF;
                pLed->BlinkingLedState = LED_OFF;
                if (pLed->bLedNoLinkBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedNoLinkBlinkInProgress = false;
                }
                if (pLed->bLedLinkBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedLinkBlinkInProgress = false;
                }
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                if (pLed->bLedScanBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedScanBlinkInProgress = false;
                }
                if (pLed->bLedStartToLinkBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedStartToLinkBlinkInProgress = false;
                }
                if (pLed1->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed1->BlinkTimer);
+                        del_timer(&pLed1->BlinkTimer);
                        pLed1->bLedWPSBlinkInProgress = false;
                }
                pLed1->BlinkingLedState = LED_UNKNOWN;
@@ -1671,7 +1671,7 @@ static void SwLedControlMode5(struct _adapter *padapter,
                        ; /* dummy branch */
                else if (pLed->bLedScanBlinkInProgress == false) {
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedScanBlinkInProgress = true;
@@ -1705,7 +1705,7 @@ static void SwLedControlMode5(struct _adapter *padapter,
                pLed->CurrLedState = LED_OFF;
                pLed->BlinkingLedState = LED_OFF;
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                SwLedOff(padapter, pLed);
@@ -1756,7 +1756,7 @@ static void SwLedControlMode6(struct _adapter *padapter,
        case LED_CTL_START_WPS_BOTTON:
                if (pLed->bLedWPSBlinkInProgress == false) {
                        if (pLed->bLedBlinkInProgress == true) {
-                                del_timer_sync(&pLed->BlinkTimer);
+                                del_timer(&pLed->BlinkTimer);
                                pLed->bLedBlinkInProgress = false;
                        }
                        pLed->bLedWPSBlinkInProgress = true;
@@ -1772,7 +1772,7 @@ static void SwLedControlMode6(struct _adapter *padapter,
        case LED_CTL_STOP_WPS_FAIL:
        case LED_CTL_STOP_WPS:
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                pLed->CurrLedState = LED_ON;
@@ -1784,11 +1784,11 @@ static void SwLedControlMode6(struct _adapter *padapter,
                pLed->CurrLedState = LED_OFF;
                pLed->BlinkingLedState = LED_OFF;
                if (pLed->bLedBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedBlinkInProgress = false;
                }
                if (pLed->bLedWPSBlinkInProgress) {
-                        del_timer_sync(&pLed->BlinkTimer);
+                        del_timer(&pLed->BlinkTimer);
                        pLed->bLedWPSBlinkInProgress = false;
                }
                SwLedOff(padapter, pLed);
diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c b/drivers/staging/rtl8712/rtl871x_cmd.c
index 1a1c38f885d6..e35854d28f90 100644
--- a/drivers/staging/rtl8712/rtl871x_cmd.c
+++ b/drivers/staging/rtl8712/rtl871x_cmd.c
@@ -910,7 +910,7 @@ void r8712_createbss_cmd_callback(struct _adapter *padapter,
        if (pcmd->res != H2C_SUCCESS)
                mod_timer(&pmlmepriv->assoc_timer,
                          jiffies + msecs_to_jiffies(1));
-        del_timer_sync(&pmlmepriv->assoc_timer);
+        del_timer(&pmlmepriv->assoc_timer);
 #ifdef __BIG_ENDIAN
        /* endian_convert */
        pnetwork->Length = le32_to_cpu(pnetwork->Length);
diff --git a/drivers/staging/rtl8712/rtl871x_mlme.c b/drivers/staging/rtl8712/rtl871x_mlme.c
index fb2b195b90af..c044b0e55ba9 100644
--- a/drivers/staging/rtl8712/rtl871x_mlme.c
+++ b/drivers/staging/rtl8712/rtl871x_mlme.c
@@ -582,7 +582,7 @@ void r8712_surveydone_event_callback(struct _adapter *adapter, u8 *pbuf)
        spin_lock_irqsave(&pmlmepriv->lock, irqL);
        if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == true) {
-                del_timer_sync(&pmlmepriv->scan_to_timer);
+                del_timer(&pmlmepriv->scan_to_timer);
                _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
        }
@@ -696,7 +696,7 @@ void r8712_ind_disconnect(struct _adapter *padapter)
        }
        if (padapter->pwrctrlpriv.pwr_mode !=
            padapter->registrypriv.power_mgnt) {
-                del_timer_sync(&pmlmepriv->dhcp_timer);
+                del_timer(&pmlmepriv->dhcp_timer);
                r8712_set_ps_mode(padapter, padapter->registrypriv.power_mgnt,
                                  padapter->registrypriv.smart_ps);
        }
@@ -910,7 +910,7 @@ void r8712_joinbss_event_callback(struct _adapter *adapter, u8 *pbuf)
                        if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)
                                == true)
                                r8712_indicate_connect(adapter);
-                        del_timer_sync(&pmlmepriv->assoc_timer);
+                        del_timer(&pmlmepriv->assoc_timer);
                } else
                        goto ignore_joinbss_callback;
        } else {
diff --git a/drivers/staging/rtl8712/rtl871x_pwrctrl.c b/drivers/staging/rtl8712/rtl871x_pwrctrl.c
index aaa584435c87..9bc04f474d18 100644
--- a/drivers/staging/rtl8712/rtl871x_pwrctrl.c
+++ b/drivers/staging/rtl8712/rtl871x_pwrctrl.c
@@ -103,7 +103,7 @@ void r8712_cpwm_int_hdl(struct _adapter *padapter,
        if (pwrpriv->cpwm_tog == ((preportpwrstate->state) & 0x80))
                return;
-        del_timer_sync(&padapter->pwrctrlpriv.rpwm_check_timer);
+        del_timer(&padapter->pwrctrlpriv.rpwm_check_timer);
        _enter_pwrlock(&pwrpriv->lock);
        pwrpriv->cpwm = (preportpwrstate->state) & 0xf;
        if (pwrpriv->cpwm >= PS_STATE_S2) {
diff --git a/drivers/staging/rtl8712/rtl871x_sta_mgt.c b/drivers/staging/rtl8712/rtl871x_sta_mgt.c
index 7bb96c47f188..a9b93d0f6f56 100644
--- a/drivers/staging/rtl8712/rtl871x_sta_mgt.c
+++ b/drivers/staging/rtl8712/rtl871x_sta_mgt.c
@@ -198,7 +198,7 @@ void r8712_free_stainfo(struct _adapter *padapter, struct sta_info *psta)
         * cancel reordering_ctrl_timer */
        for (i = 0; i < 16; i++) {
                preorder_ctrl = &psta->recvreorder_ctrl[i];
-                del_timer_sync(&preorder_ctrl->reordering_ctrl_timer);
+                del_timer(&preorder_ctrl->reordering_ctrl_timer);
        }
        spin_lock(&(pfree_sta_queue->lock));
        /* insert into free_sta_queue; 20061114 */
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index cc57a3a6b02b..396344cb011f 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -162,6 +162,17 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
        return put_user(x, ptr);
 }
+static inline int tty_copy_to_user(struct tty_struct *tty,
+                                        void __user *to,
+                                        const void *from,
+                                        unsigned long n)
+{
+        struct n_tty_data *ldata = tty->disc_data;
+        tty_audit_add_data(tty, to, n, ldata->icanon);
+        return copy_to_user(to, from, n);
+}
 /**
 *      n_tty_kick_worker - start input worker (if required)
 *      @tty: terminal
@@ -2070,8 +2081,8 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
        size = N_TTY_BUF_SIZE - tail;
        n = eol - tail;
-        if (n > 4096)
+        if (n > N_TTY_BUF_SIZE)
-                n += 4096;
+                n += N_TTY_BUF_SIZE;
        n += found;
        c = n;
@@ -2084,12 +2095,12 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
                    __func__, eol, found, n, c, size, more);
        if (n > size) {
-                ret = copy_to_user(*b, read_buf_addr(ldata, tail), size);
+                ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), size);
                if (ret)
                        return -EFAULT;
-                ret = copy_to_user(*b + size, ldata->read_buf, n - size);
+                ret = tty_copy_to_user(tty, *b + size, ldata->read_buf, n - size);
        } else
-                ret = copy_to_user(*b, read_buf_addr(ldata, tail), n);
+                ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), n);
        if (ret)
                return -EFAULT;
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 9289999cb7c6..dce1a23706e8 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -562,12 +562,36 @@ static irqreturn_t omap_wake_irq(int irq, void *dev_id)
        return IRQ_NONE;
 }
+#ifdef CONFIG_SERIAL_8250_DMA
+static int omap_8250_dma_handle_irq(struct uart_port *port);
+#endif
+static irqreturn_t omap8250_irq(int irq, void *dev_id)
+{
+        struct uart_port *port = dev_id;
+        struct uart_8250_port *up = up_to_u8250p(port);
+        unsigned int iir;
+        int ret;
+#ifdef CONFIG_SERIAL_8250_DMA
+        if (up->dma) {
+                ret = omap_8250_dma_handle_irq(port);
+                return IRQ_RETVAL(ret);
+        }
+#endif
+        serial8250_rpm_get(up);
+        iir = serial_port_in(port, UART_IIR);
+        ret = serial8250_handle_irq(port, iir);
+        serial8250_rpm_put(up);
+        return IRQ_RETVAL(ret);
+}
 static int omap_8250_startup(struct uart_port *port)
 {
-        struct uart_8250_port *up =
+        struct uart_8250_port *up = up_to_u8250p(port);
-                container_of(port, struct uart_8250_port, port);
        struct omap8250_priv *priv = port->private_data;
        int ret;
        if (priv->wakeirq) {
@@ -580,10 +604,31 @@ static int omap_8250_startup(struct uart_port *port)
        pm_runtime_get_sync(port->dev);
-        ret = serial8250_do_startup(port);
+        up->mcr = 0;
-        if (ret)
+        serial_out(up, UART_FCR, UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
+        serial_out(up, UART_LCR, UART_LCR_WLEN8);
+        up->lsr_saved_flags = 0;
+        up->msr_saved_flags = 0;
+        if (up->dma) {
+                ret = serial8250_request_dma(up);
+                if (ret) {
+                        dev_warn_ratelimited(port->dev,
+                                             "failed to request DMA\n");
+                        up->dma = NULL;
+                }
+        }
+        ret = request_irq(port->irq, omap8250_irq, IRQF_SHARED,
+                          dev_name(port->dev), port);
+        if (ret < 0)
                goto err;
+        up->ier = UART_IER_RLSI | UART_IER_RDI;
+        serial_out(up, UART_IER, up->ier);
 #ifdef CONFIG_PM
        up->capabilities |= UART_CAP_RPM;
 #endif
@@ -610,8 +655,7 @@ err:
 static void omap_8250_shutdown(struct uart_port *port)
 {
-        struct uart_8250_port *up =
+        struct uart_8250_port *up = up_to_u8250p(port);
-                container_of(port, struct uart_8250_port, port);
        struct omap8250_priv *priv = port->private_data;
        flush_work(&priv->qos_work);
@@ -621,11 +665,24 @@ static void omap_8250_shutdown(struct uart_port *port)
        pm_runtime_get_sync(port->dev);
        serial_out(up, UART_OMAP_WER, 0);
-        serial8250_do_shutdown(port);
+        up->ier = 0;
+        serial_out(up, UART_IER, 0);
+        if (up->dma)
+                serial8250_release_dma(up);
+        /*
+         * Disable break condition and FIFOs
+         */
+        if (up->lcr & UART_LCR_SBC)
+                serial_out(up, UART_LCR, up->lcr & ~UART_LCR_SBC);
+        serial_out(up, UART_FCR, UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
        pm_runtime_mark_last_busy(port->dev);
        pm_runtime_put_autosuspend(port->dev);
+        free_irq(port->irq, port);
        if (priv->wakeirq)
                free_irq(priv->wakeirq, port);
 }
@@ -974,6 +1031,13 @@ static inline int omap_8250_rx_dma(struct uart_8250_port *p, unsigned int iir)
 }
 #endif
+static int omap8250_no_handle_irq(struct uart_port *port)
+{
+        /* IRQ has not been requested but handling irq? */
+        WARN_ONCE(1, "Unexpected irq handling before port startup\n");
+        return 0;
+}
 static int omap8250_probe(struct platform_device *pdev)
 {
        struct resource *regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1075,6 +1139,7 @@ static int omap8250_probe(struct platform_device *pdev)
        pm_runtime_get_sync(&pdev->dev);
        omap_serial_fill_features_erratas(&up, priv);
+        up.port.handle_irq = omap8250_no_handle_irq;
 #ifdef CONFIG_SERIAL_8250_DMA
        if (pdev->dev.of_node) {
                /*
@@ -1088,7 +1153,6 @@ static int omap8250_probe(struct platform_device *pdev)
                ret = of_property_count_strings(pdev->dev.of_node, "dma-names");
                if (ret == 2) {
                        up.dma = &priv->omap8250_dma;
-                        up.port.handle_irq = omap_8250_dma_handle_irq;
                        priv->omap8250_dma.fn = the_no_dma_filter_fn;
                        priv->omap8250_dma.tx_dma = omap_8250_tx_dma;
                        priv->omap8250_dma.rx_dma = omap_8250_rx_dma;
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 6f5a0720a8c8..763eb20fe321 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1249,20 +1249,19 @@ __acquires(&uap->port.lock)
 /*
 * Transmit a character
- * There must be at least one free entry in the TX FIFO to accept the char.
 *
- * Returns true if the FIFO might have space in it afterwards;
+ * Returns true if the character was successfully queued to the FIFO.
- * returns false if the FIFO definitely became full.
+ * Returns false otherwise.
 */
 static bool pl011_tx_char(struct uart_amba_port *uap, unsigned char c)
 {
+        if (readw(uap->port.membase + UART01x_FR) & UART01x_FR_TXFF)
+                return false; /* unable to transmit character */
        writew(c, uap->port.membase + UART01x_DR);
        uap->port.icount.tx++;
-        if (likely(uap->tx_irq_seen > 1))
+        return true;
-                return true;
-        return !(readw(uap->port.membase + UART01x_FR) & UART01x_FR_TXFF);
 }
 static bool pl011_tx_chars(struct uart_amba_port *uap)
@@ -1296,7 +1295,8 @@ static bool pl011_tx_chars(struct uart_amba_port *uap)
                return false;
        if (uap->port.x_char) {
-                pl011_tx_char(uap, uap->port.x_char);
+                if (!pl011_tx_char(uap, uap->port.x_char))
+                        goto done;
                uap->port.x_char = 0;
                --count;
        }
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index c8cfa0637128..88250395b0ce 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -911,6 +911,14 @@ static void dma_rx_callback(void *data)
        status = dmaengine_tx_status(chan, (dma_cookie_t)0, &state);
        count = RX_BUF_SIZE - state.residue;
+        if (readl(sport->port.membase + USR2) & USR2_IDLE) {
+                /* In condition [3] the SDMA counted up too early */
+                count--;
+                writel(USR2_IDLE, sport->port.membase + USR2);
+        }
        dev_dbg(sport->port.dev, "We get %d bytes.\n", count);
        if (count) {
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index fdab715a0631..c0eafa6fd403 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -339,7 +339,7 @@
 #define DWC3_DGCMD_SET_ENDPOINT_NRDY    0x0c
 #define DWC3_DGCMD_RUN_SOC_BUS_LOOPBACK 0x10
-#define DWC3_DGCMD_STATUS(n)            (((n) >> 15) & 1)
+#define DWC3_DGCMD_STATUS(n)            (((n) >> 12) & 0x0F)
 #define DWC3_DGCMD_CMDACT               (1 << 10)
 #define DWC3_DGCMD_CMDIOC               (1 << 8)
@@ -355,7 +355,7 @@
 #define DWC3_DEPCMD_PARAM_SHIFT         16
 #define DWC3_DEPCMD_PARAM(x)            ((x) << DWC3_DEPCMD_PARAM_SHIFT)
 #define DWC3_DEPCMD_GET_RSC_IDX(x)      (((x) >> DWC3_DEPCMD_PARAM_SHIFT) & 0x7f)
-#define DWC3_DEPCMD_STATUS(x)           (((x) >> 15) & 1)
+#define DWC3_DEPCMD_STATUS(x)           (((x) >> 12) & 0x0F)
 #define DWC3_DEPCMD_HIPRI_FORCERM       (1 << 11)
 #define DWC3_DEPCMD_CMDACT              (1 << 10)
 #define DWC3_DEPCMD_CMDIOC              (1 << 8)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 6bdb57069044..3507f880eb74 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -315,7 +315,6 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
                                return ret;
                        }
-                        set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
                        return len;
                }
                break;
@@ -847,7 +846,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                                ret = ep->status;
                                if (io_data->read && ret > 0) {
                                        ret = copy_to_iter(data, ret, &io_data->data);
-                                        if (unlikely(iov_iter_count(&io_data->data)))
+                                        if (!ret)
                                                ret = -EFAULT;
                                }
                        }
@@ -1463,8 +1462,7 @@ static void ffs_data_clear(struct ffs_data *ffs)
 {
        ENTER();
-        if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags))
+        ffs_closed(ffs);
-                ffs_closed(ffs);
        BUG_ON(ffs->gadget);
@@ -3422,9 +3420,13 @@ static int ffs_ready(struct ffs_data *ffs)
        ffs_obj->desc_ready = true;
        ffs_obj->ffs_data = ffs;
-        if (ffs_obj->ffs_ready_callback)
+        if (ffs_obj->ffs_ready_callback) {
                ret = ffs_obj->ffs_ready_callback(ffs);
+                if (ret)
+                        goto done;
+        }
+        set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
 done:
        ffs_dev_unlock();
        return ret;
@@ -3443,7 +3445,8 @@ static void ffs_closed(struct ffs_data *ffs)
        ffs_obj->desc_ready = false;
-        if (ffs_obj->ffs_closed_callback)
+        if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
+            ffs_obj->ffs_closed_callback)
                ffs_obj->ffs_closed_callback(ffs);
        if (!ffs_obj->opts || ffs_obj->opts->no_configfs
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 259b656c0b3e..6316aa5b1c49 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -973,7 +973,13 @@ static ssize_t f_midi_opts_id_show(struct f_midi_opts *opts, char *page)
        int result;
        mutex_lock(&opts->lock);
-        result = strlcpy(page, opts->id, PAGE_SIZE);
+        if (opts->id) {
+                result = strlcpy(page, opts->id, PAGE_SIZE);
+        } else {
+                page[0] = 0;
+                result = 0;
+        }
        mutex_unlock(&opts->lock);
        return result;
diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 9719abfb6145..7856b3394494 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -588,7 +588,10 @@ static int f_audio_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
        if (intf == 1) {
                if (alt == 1) {
-                        config_ep_by_speed(cdev->gadget, f, out_ep);
+                        err = config_ep_by_speed(cdev->gadget, f, out_ep);
+                        if (err)
+                                return err;
                        usb_ep_enable(out_ep);
                        out_ep->driver_data = audio;
                        audio->copy_buf = f_audio_buffer_alloc(audio_buf_size);
diff --git a/drivers/usb/gadget/legacy/g_ffs.c b/drivers/usb/gadget/legacy/g_ffs.c
index 7b9ef7e257d2..e821931c965c 100644
--- a/drivers/usb/gadget/legacy/g_ffs.c
+++ b/drivers/usb/gadget/legacy/g_ffs.c
@@ -304,8 +304,10 @@ static int functionfs_ready_callback(struct ffs_data *ffs)
        gfs_registered = true;
        ret = usb_composite_probe(&gfs_driver);
-        if (unlikely(ret < 0))
+        if (unlikely(ret < 0)) {
+                ++missing_funcs;
                gfs_registered = false;
+        }
        
        return ret;
 }
diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
index b808951491cc..99fd9a5667df 100644
--- a/drivers/usb/gadget/udc/s3c2410_udc.c
+++ b/drivers/usb/gadget/udc/s3c2410_udc.c
@@ -1487,7 +1487,7 @@ static int s3c2410_udc_pullup(struct usb_gadget *gadget, int is_on)
        dprintk(DEBUG_NORMAL, "%s()\n", __func__);
-        s3c2410_udc_set_pullup(udc, is_on ? 0 : 1);
+        s3c2410_udc_set_pullup(udc, is_on);
        return 0;
 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index ec8ac1674854..36bf089b708f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3682,18 +3682,21 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        unsigned long flags;
-        int ret;
+        int ret, slot_id;
        struct xhci_command *command;
        command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
        if (!command)
                return 0;
+        /* xhci->slot_id and xhci->addr_dev are not thread-safe */
+        mutex_lock(&xhci->mutex);
        spin_lock_irqsave(&xhci->lock, flags);
        command->completion = &xhci->addr_dev;
        ret = xhci_queue_slot_control(xhci, command, TRB_ENABLE_SLOT, 0);
        if (ret) {
                spin_unlock_irqrestore(&xhci->lock, flags);
+                mutex_unlock(&xhci->mutex);
                xhci_dbg(xhci, "FIXME: allocate a command ring segment\n");
                kfree(command);
                return 0;
@@ -3702,8 +3705,10 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
        spin_unlock_irqrestore(&xhci->lock, flags);
        wait_for_completion(command->completion);
+        slot_id = xhci->slot_id;
+        mutex_unlock(&xhci->mutex);
-        if (!xhci->slot_id || command->status != COMP_SUCCESS) {
+        if (!slot_id || command->status != COMP_SUCCESS) {
                xhci_err(xhci, "Error while assigning device slot ID\n");
                xhci_err(xhci, "Max number of devices this xHCI host supports is %u.\n",
                                HCS_MAX_SLOTS(
@@ -3728,11 +3733,11 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
         * xhci_discover_or_reset_device(), which may be called as part of
         * mass storage driver error handling.
         */
-        if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_NOIO)) {
+        if (!xhci_alloc_virt_device(xhci, slot_id, udev, GFP_NOIO)) {
                xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n");
                goto disable_slot;
        }
-        udev->slot_id = xhci->slot_id;
+        udev->slot_id = slot_id;
 #ifndef CONFIG_USB_DEFAULT_PERSIST
        /*
@@ -3778,12 +3783,15 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
        struct xhci_slot_ctx *slot_ctx;
        struct xhci_input_control_ctx *ctrl_ctx;
        u64 temp_64;
-        struct xhci_command *command;
+        struct xhci_command *command = NULL;
+        mutex_lock(&xhci->mutex);
        if (!udev->slot_id) {
                xhci_dbg_trace(xhci, trace_xhci_dbg_address,
                                "Bad Slot ID %d", udev->slot_id);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
        }
        virt_dev = xhci->devs[udev->slot_id];
@@ -3796,7 +3804,8 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
                 */
                xhci_warn(xhci, "Virt dev invalid for slot_id 0x%x!\n",
                        udev->slot_id);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
        }
        if (setup == SETUP_CONTEXT_ONLY) {
@@ -3804,13 +3813,15 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
                if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) ==
                    SLOT_STATE_DEFAULT) {
                        xhci_dbg(xhci, "Slot already in default state\n");
-                        return 0;
+                        goto out;
                }
        }
        command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
-        if (!command)
+        if (!command) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out;
+        }
        command->in_ctx = virt_dev->in_ctx;
        command->completion = &xhci->addr_dev;
@@ -3820,8 +3831,8 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
        if (!ctrl_ctx) {
                xhci_warn(xhci, "%s: Could not get input context, bad type.\n",
                                __func__);
-                kfree(command);
+                ret = -EINVAL;
-                return -EINVAL;
+                goto out;
        }
        /*
         * If this is the first Set Address since device plug-in or
@@ -3848,8 +3859,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
                spin_unlock_irqrestore(&xhci->lock, flags);
                xhci_dbg_trace(xhci, trace_xhci_dbg_address,
                                "FIXME: allocate a command ring segment");
-                kfree(command);
+                goto out;
-                return ret;
        }
        xhci_ring_cmd_db(xhci);
        spin_unlock_irqrestore(&xhci->lock, flags);
@@ -3896,10 +3906,8 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
                ret = -EINVAL;
                break;
        }
-        if (ret) {
+        if (ret)
-                kfree(command);
+                goto out;
-                return ret;
-        }
        temp_64 = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr);
        xhci_dbg_trace(xhci, trace_xhci_dbg_address,
                        "Op regs DCBAA ptr = %#016llx", temp_64);
@@ -3932,8 +3940,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
        xhci_dbg_trace(xhci, trace_xhci_dbg_address,
                       "Internal device address = %d",
                       le32_to_cpu(slot_ctx->dev_state) & DEV_ADDR_MASK);
+out:
+        mutex_unlock(&xhci->mutex);
        kfree(command);
-        return 0;
+        return ret;
 }
 int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
@@ -4855,6 +4865,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
                return 0;
        }
+        mutex_init(&xhci->mutex);
        xhci->cap_regs = hcd->regs;
        xhci->op_regs = hcd->regs +
                HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));
@@ -5011,4 +5022,12 @@ static int __init xhci_hcd_init(void)
        BUILD_BUG_ON(sizeof(struct xhci_run_regs) != (8+8*128)*32/8);
        return 0;
 }
+/*
+ * If an init function is provided, an exit function must also be provided
+ * to allow module unload.
+ */
+static void __exit xhci_hcd_fini(void) { }
 module_init(xhci_hcd_init);
+module_exit(xhci_hcd_fini);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index ea75e8ccd3c1..6977f8491fa7 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1497,6 +1497,8 @@ struct xhci_hcd {
        struct list_head        lpm_failed_devs;
        /* slot enabling and address device helpers */
+        /* these are not thread safe so use mutex */
+        struct mutex mutex;
        struct completion       addr_dev;
        int slot_id;
        /* For USB 3.0 LPM enable/disable. */
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 3789b08ef67b..6dca3d794ced 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2021,13 +2021,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        if (musb->ops->quirks)
                musb->io.quirks = musb->ops->quirks;
-        /* At least tusb6010 has it's own offsets.. */
+        /* Most devices use indexed offset or flat offset */
-        if (musb->ops->ep_offset)
-                musb->io.ep_offset = musb->ops->ep_offset;
-        if (musb->ops->ep_select)
-                musb->io.ep_select = musb->ops->ep_select;
-        /* ..and some devices use indexed offset or flat offset */
        if (musb->io.quirks & MUSB_INDEXED_EP) {
                musb->io.ep_offset = musb_indexed_ep_offset;
                musb->io.ep_select = musb_indexed_ep_select;
@@ -2036,6 +2030,12 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
                musb->io.ep_select = musb_flat_ep_select;
        }
+        /* At least tusb6010 has its own offsets */
+        if (musb->ops->ep_offset)
+                musb->io.ep_offset = musb->ops->ep_offset;
+        if (musb->ops->ep_select)
+                musb->io.ep_select = musb->ops->ep_select;
        if (musb->ops->fifo_mode)
                fifo_mode = musb->ops->fifo_mode;
        else
diff --git a/drivers/usb/phy/phy-ab8500-usb.c b/drivers/usb/phy/phy-ab8500-usb.c
index 7225d526df04..03ab0c699f74 100644
--- a/drivers/usb/phy/phy-ab8500-usb.c
+++ b/drivers/usb/phy/phy-ab8500-usb.c
@@ -1179,7 +1179,7 @@ static int ab8500_usb_irq_setup(struct platform_device *pdev,
                }
                err = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                ab8500_usb_link_status_irq,
-                                IRQF_NO_SUSPEND | IRQF_SHARED,
+                                IRQF_NO_SUSPEND | IRQF_SHARED | IRQF_ONESHOT,
                                "usb-link-status", ab);
                if (err < 0) {
                        dev_err(ab->dev, "request_irq failed for link status irq\n");
@@ -1195,7 +1195,7 @@ static int ab8500_usb_irq_setup(struct platform_device *pdev,
                }
                err = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                ab8500_usb_disconnect_irq,
-                                IRQF_NO_SUSPEND | IRQF_SHARED,
+                                IRQF_NO_SUSPEND | IRQF_SHARED | IRQF_ONESHOT,
                                "usb-id-fall", ab);
                if (err < 0) {
                        dev_err(ab->dev, "request_irq failed for ID fall irq\n");
@@ -1211,7 +1211,7 @@ static int ab8500_usb_irq_setup(struct platform_device *pdev,
                }
                err = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                ab8500_usb_disconnect_irq,
-                                IRQF_NO_SUSPEND | IRQF_SHARED,
+                                IRQF_NO_SUSPEND | IRQF_SHARED | IRQF_ONESHOT,
                                "usb-vbus-fall", ab);
                if (err < 0) {
                        dev_err(ab->dev, "request_irq failed for Vbus fall irq\n");
diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
index 845f658276b1..2b28443d07b9 100644
--- a/drivers/usb/phy/phy-tahvo.c
+++ b/drivers/usb/phy/phy-tahvo.c
@@ -401,7 +401,8 @@ static int tahvo_usb_probe(struct platform_device *pdev)
        dev_set_drvdata(&pdev->dev, tu);
        tu->irq = platform_get_irq(pdev, 0);
-        ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, 0,
+        ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
+                                   IRQF_ONESHOT,
                                   "tahvo-vbus", tu);
        if (ret) {
                dev_err(&pdev->dev, "could not register tahvo-vbus irq: %d\n",
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 8597cf9cfceb..c0f5c652d272 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -611,6 +611,8 @@ struct usbhs_pkt_handle usbhs_fifo_pio_push_handler = {
 static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done)
 {
        struct usbhs_pipe *pipe = pkt->pipe;
+        struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+        struct usbhs_fifo *fifo = usbhsf_get_cfifo(priv);
        if (usbhs_pipe_is_busy(pipe))
                return 0;
@@ -624,6 +626,9 @@ static int usbhsf_prepare_pop(struct usbhs_pkt *pkt, int *is_done)
        usbhs_pipe_data_sequence(pipe, pkt->sequence);
        pkt->sequence = -1; /* -1 sequence will be ignored */
+        if (usbhs_pipe_is_dcp(pipe))
+                usbhsf_fifo_clear(pipe, fifo);
        usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->length);
        usbhs_pipe_enable(pipe);
        usbhs_pipe_running(pipe, 1);
@@ -673,7 +678,14 @@ static int usbhsf_pio_try_pop(struct usbhs_pkt *pkt, int *is_done)
                *is_done = 1;
                usbhsf_rx_irq_ctrl(pipe, 0);
                usbhs_pipe_running(pipe, 0);
-                usbhs_pipe_disable(pipe);       /* disable pipe first */
+                /*
+                 * If function mode, since this controller is possible to enter
+                 * Control Write status stage at this timing, this driver
+                 * should not disable the pipe. If such a case happens, this
+                 * controller is not able to complete the status stage.
+                 */
+                if (!usbhs_mod_is_host(priv) && !usbhs_pipe_is_dcp(pipe))
+                        usbhs_pipe_disable(pipe);       /* disable pipe first */
        }
        /*
@@ -1227,15 +1239,21 @@ static void usbhsf_dma_init_dt(struct device *dev, struct usbhs_fifo *fifo,
 {
        char name[16];
-        snprintf(name, sizeof(name), "tx%d", channel);
+        /*
-        fifo->tx_chan = dma_request_slave_channel_reason(dev, name);
+         * To avoid complex handing for DnFIFOs, the driver uses each
-        if (IS_ERR(fifo->tx_chan))
+         * DnFIFO as TX or RX direction (not bi-direction).
-                fifo->tx_chan = NULL;
+         * So, the driver uses odd channels for TX, even channels for RX.
+         */
-        snprintf(name, sizeof(name), "rx%d", channel);
+        snprintf(name, sizeof(name), "ch%d", channel);
-        fifo->rx_chan = dma_request_slave_channel_reason(dev, name);
+        if (channel & 1) {
-        if (IS_ERR(fifo->rx_chan))
+                fifo->tx_chan = dma_request_slave_channel_reason(dev, name);
-                fifo->rx_chan = NULL;
+                if (IS_ERR(fifo->tx_chan))
+                        fifo->tx_chan = NULL;
+        } else {
+                fifo->rx_chan = dma_request_slave_channel_reason(dev, name);
+                if (IS_ERR(fifo->rx_chan))
+                        fifo->rx_chan = NULL;
+        }
 }
 static void usbhsf_dma_init(struct usbhs_priv *priv, struct usbhs_fifo *fifo,
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 9031750e7404..ffd739e31bfc 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -128,6 +128,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
        { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
        { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
+        { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8eb68a31cab6..4c8b3b82103d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -699,6 +699,7 @@ static const struct usb_device_id id_table_combined[] = {
        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
        { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
+        { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
        { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
        { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 4e4f46f3c89c..792e054126de 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -155,6 +155,7 @@
 #define XSENS_AWINDA_STATION_PID 0x0101
 #define XSENS_AWINDA_DONGLE_PID 0x0102
 #define XSENS_MTW_PID           0x0200  /* Xsens MTw */
+#define XSENS_MTDEVBOARD_PID    0x0300  /* Motion Tracker Development Board */
 #define XSENS_CONVERTER_PID     0xD00D  /* Xsens USB-serial converter */
 /* Xsens devices using FTDI VID */
diff --git a/fs/fhandle.c b/fs/fhandle.c
index 999ff5c3cab0..d59712dfa3e7 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
                goto out_err;
        }
        /* copy the full handle */
-        if (copy_from_user(handle, ufh,
+        *handle = f_handle;
-                           sizeof(struct file_handle) +
+        if (copy_from_user(&handle->f_handle,
+                           &ufh->f_handle,
                           f_handle.handle_bytes)) {
                retval = -EFAULT;
                goto out_handle;
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index aff923ae8c4b..d87d8eced064 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -116,7 +116,6 @@ __printf(3, 4)
 int bdi_register(struct backing_dev_info *bdi, struct device *parent,
                const char *fmt, ...);
 int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
-void bdi_unregister(struct backing_dev_info *bdi);
 int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
 void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
                        enum wb_reason reason);
diff --git a/include/linux/of.h b/include/linux/of.h
index ddeaae6d2083..b871ff9d81d7 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -121,6 +121,8 @@ extern struct device_node *of_stdout;
 extern raw_spinlock_t devtree_lock;
 #ifdef CONFIG_OF
+void of_core_init(void);
 static inline bool is_of_node(struct fwnode_handle *fwnode)
 {
        return fwnode && fwnode->type == FWNODE_OF;
@@ -376,6 +378,10 @@ bool of_console_check(struct device_node *dn, char *name, int index);
 #else /* CONFIG_OF */
+static inline void of_core_init(void)
+{
+}
 static inline bool is_of_node(struct fwnode_handle *fwnode)
 {
        return false;
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 61992cf2e977..d8a82a89f35a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -92,8 +92,6 @@ struct hw_perf_event_extra {
        int             idx;    /* index in shared_regs->regs[] */
 };
-struct event_constraint;
 /**
 * struct hw_perf_event - performance event hardware details:
 */
@@ -112,8 +110,6 @@ struct hw_perf_event {
                        struct hw_perf_event_extra extra_reg;
                        struct hw_perf_event_extra branch_reg;
-                        struct event_constraint *constraint;
                };
                struct { /* software */
                        struct hrtimer  hrtimer;
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 497bc14cdb85..0320bbb7d7b5 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -98,7 +98,8 @@ struct inet_connection_sock {
        const struct tcp_congestion_ops *icsk_ca_ops;
        const struct inet_connection_sock_af_ops *icsk_af_ops;
        unsigned int              (*icsk_sync_mss)(struct sock *sk, u32 pmtu);
-        __u8                      icsk_ca_state:7,
+        __u8                      icsk_ca_state:6,
+                                  icsk_ca_setsockopt:1,
                                  icsk_ca_dst_locked:1;
        __u8                      icsk_retransmits;
        __u8                      icsk_pending;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 8e3668b44c29..fc57f6b82fc5 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -354,7 +354,7 @@ enum ieee80211_rssi_event_data {
 };
 /**
- * enum ieee80211_rssi_event - data attached to an %RSSI_EVENT
+ * struct ieee80211_rssi_event - data attached to an %RSSI_EVENT
 * @data: See &enum ieee80211_rssi_event_data
 */
 struct ieee80211_rssi_event {
@@ -388,7 +388,7 @@ enum ieee80211_mlme_event_status {
 };
 /**
- * enum ieee80211_mlme_event - data attached to an %MLME_EVENT
+ * struct ieee80211_mlme_event - data attached to an %MLME_EVENT
 * @data: See &enum ieee80211_mlme_event_data
 * @status: See &enum ieee80211_mlme_event_status
 * @reason: the reason code if applicable
@@ -401,9 +401,10 @@ struct ieee80211_mlme_event {
 /**
 * struct ieee80211_event - event to be sent to the driver
- * @type The event itself. See &enum ieee80211_event_type.
+ * @type: The event itself. See &enum ieee80211_event_type.
 * @rssi: relevant if &type is %RSSI_EVENT
 * @mlme: relevant if &type is %AUTH_EVENT
+ * @u:    union holding the above two fields
 */
 struct ieee80211_event {
        enum ieee80211_event_type type;
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index 880dd7437172..c178d13d6f4c 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -250,7 +250,6 @@ DEFINE_EVENT(writeback_class, name, \
 DEFINE_WRITEBACK_EVENT(writeback_nowork);
 DEFINE_WRITEBACK_EVENT(writeback_wake_background);
 DEFINE_WRITEBACK_EVENT(writeback_bdi_register);
-DEFINE_WRITEBACK_EVENT(writeback_bdi_unregister);
 DECLARE_EVENT_CLASS(wbc_class,
        TP_PROTO(struct writeback_control *wbc, struct backing_dev_info *bdi),
diff --git a/include/uapi/linux/virtio_balloon.h b/include/uapi/linux/virtio_balloon.h
index 984169a819ee..d7f1cbc3766c 100644
--- a/include/uapi/linux/virtio_balloon.h
+++ b/include/uapi/linux/virtio_balloon.h
@@ -26,6 +26,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE. */
 #include <linux/types.h>
+#include <linux/virtio_types.h>
 #include <linux/virtio_ids.h>
 #include <linux/virtio_config.h>
diff --git a/kernel/compat.c b/kernel/compat.c
index 24f00610c575..333d364be29d 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -912,7 +912,8 @@ long compat_get_bitmap(unsigned long *mask, const compat_ulong_t __user *umask,
                         * bitmap. We must however ensure the end of the
                         * kernel bitmap is zeroed.
                         */
-                        if (nr_compat_longs-- > 0) {
+                        if (nr_compat_longs) {
+                                nr_compat_longs--;
                                if (__get_user(um, umask))
                                        return -EFAULT;
                        } else {
@@ -954,7 +955,8 @@ long compat_put_bitmap(compat_ulong_t __user *umask, unsigned long *mask,
                         * We dont want to write past the end of the userspace
                         * bitmap.
                         */
-                        if (nr_compat_longs-- > 0) {
+                        if (nr_compat_longs) {
+                                nr_compat_longs--;
                                if (__put_user(um, umask))
                                        return -EFAULT;
                        }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1a3bf48743ce..eddf1ed4155e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3442,7 +3442,6 @@ static void free_event_rcu(struct rcu_head *head)
        if (event->ns)
                put_pid_ns(event->ns);
        perf_event_free_filter(event);
-        perf_event_free_bpf_prog(event);
        kfree(event);
 }
@@ -3573,6 +3572,8 @@ static void __free_event(struct perf_event *event)
                        put_callchain_buffers();
        }
+        perf_event_free_bpf_prog(event);
        if (event->destroy)
                event->destroy(event);
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 232f00f273cb..725c416085e3 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -493,6 +493,20 @@ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
                        rb->aux_pages[rb->aux_nr_pages] = page_address(page++);
        }
+        /*
+         * In overwrite mode, PMUs that don't support SG may not handle more
+         * than one contiguous allocation, since they rely on PMI to do double
+         * buffering. In this case, the entire buffer has to be one contiguous
+         * chunk.
+         */
+        if ((event->pmu->capabilities & PERF_PMU_CAP_AUX_NO_SG) &&
+            overwrite) {
+                struct page *page = virt_to_page(rb->aux_pages[0]);
+                if (page_private(page) != max_order)
+                        goto out;
+        }
        rb->aux_priv = event->pmu->setup_aux(event->cpu, rb->aux_pages, nr_pages,
                                             overwrite);
        if (!rb->aux_priv)
diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
index a28df5206d95..fe9a32591c24 100644
--- a/lib/strnlen_user.c
+++ b/lib/strnlen_user.c
@@ -57,7 +57,8 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
                        return res + find_zero(data) + 1 - align;
                }
                res += sizeof(unsigned long);
-                if (unlikely(max < sizeof(unsigned long)))
+                /* We already handled 'unsigned long' bytes. Did we do it all ? */
+                if (unlikely(max <= sizeof(unsigned long)))
                        break;
                max -= sizeof(unsigned long);
                if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
@@ -89,8 +90,15 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
 * Get the size of a NUL-terminated string in user space.
 *
 * Returns the size of the string INCLUDING the terminating NUL.
- * If the string is too long, returns 'count+1'.
+ * If the string is too long, returns a number larger than @count. User
+ * has to check the return value against "> count".
 * On exception (or invalid count), returns 0.
+ *
+ * NOTE! You should basically never use this function. There is
+ * almost never any valid case for using the length of a user space
+ * string, since the string can be changed at any time by other
+ * threads. Use "strncpy_from_user()" instead to get a stable copy
+ * of the string.
 */
 long strnlen_user(const char __user *str, long count)
 {
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 4abda074ea45..3c365ab6cf5f 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -537,8 +537,9 @@ EXPORT_SYMBOL_GPL(swiotlb_tbl_map_single);
 * Allocates bounce buffer and returns its kernel virtual address.
 */
-phys_addr_t map_single(struct device *hwdev, phys_addr_t phys, size_t size,
+static phys_addr_t
-                       enum dma_data_direction dir)
+map_single(struct device *hwdev, phys_addr_t phys, size_t size,
+           enum dma_data_direction dir)
 {
        dma_addr_t start_dma_addr = phys_to_dma(hwdev, io_tlb_start);
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 6dc4580df2af..000e7b3b9896 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -359,23 +359,6 @@ static void bdi_wb_shutdown(struct backing_dev_info *bdi)
        flush_delayed_work(&bdi->wb.dwork);
 }
-/*
- * Called when the device behind @bdi has been removed or ejected.
- *
- * We can't really do much here except for reducing the dirty ratio at
- * the moment.  In the future we should be able to set a flag so that
- * the filesystem can handle errors at mark_inode_dirty time instead
- * of only at writeback time.
- */
-void bdi_unregister(struct backing_dev_info *bdi)
-{
-        if (WARN_ON_ONCE(!bdi->dev))
-                return;
-        bdi_set_min_ratio(bdi, 0);
-}
-EXPORT_SYMBOL(bdi_unregister);
 static void bdi_wb_init(struct bdi_writeback *wb, struct backing_dev_info *bdi)
 {
        memset(wb, 0, sizeof(*wb));
@@ -443,6 +426,7 @@ void bdi_destroy(struct backing_dev_info *bdi)
        int i;
        bdi_wb_shutdown(bdi);
+        bdi_set_min_ratio(bdi, 0);
        WARN_ON(!list_empty(&bdi->work_list));
        WARN_ON(delayed_work_pending(&bdi->wb.dwork));
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a3abe6ed111e..22fd0419b314 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1822,7 +1822,7 @@ static void br_multicast_query_expired(struct net_bridge *br,
        if (query->startup_sent < br->multicast_startup_query_count)
                query->startup_sent++;
-        RCU_INIT_POINTER(querier, NULL);
+        RCU_INIT_POINTER(querier->port, NULL);
        br_multicast_send_query(br, NULL, query);
        spin_unlock(&br->multicast_lock);
 }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 24c7c96bf5f8..91180a7fc943 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1117,8 +1117,6 @@ static int do_replace(struct net *net, const void __user *user,
                return -ENOMEM;
        if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
                return -ENOMEM;
-        if (tmp.num_counters == 0)
-                return -EINVAL;
        tmp.name[sizeof(tmp.name) - 1] = 0;
@@ -2161,8 +2159,6 @@ static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
                return -ENOMEM;
        if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
                return -ENOMEM;
-        if (tmp.num_counters == 0)
-                return -EINVAL;
        memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 1347e11f5cc9..1d00b8922902 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -359,15 +359,7 @@ static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
        int err;
        struct ethtool_cmd cmd;
-        if (!dev->ethtool_ops->get_settings)
+        err = __ethtool_get_settings(dev, &cmd);
-                return -EOPNOTSUPP;
-        if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
-                return -EFAULT;
-        cmd.cmd = ETHTOOL_GSET;
-        err = dev->ethtool_ops->get_settings(dev, &cmd);
        if (err < 0)
                return err;
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index e6f6cc3a1bcf..392e29a0227d 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -359,7 +359,7 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
         */
        ds = kzalloc(sizeof(*ds) + drv->priv_size, GFP_KERNEL);
        if (ds == NULL)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        ds->dst = dst;
        ds->index = index;
@@ -370,7 +370,7 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
        ret = dsa_switch_setup_one(ds, parent);
        if (ret)
-                return NULL;
+                return ERR_PTR(ret);
        return ds;
 }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 421a80b09b62..30b544f025ac 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -256,7 +256,8 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
        aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
        aead_givcrypt_set_assoc(req, asg, assoclen);
        aead_givcrypt_set_giv(req, esph->enc_data,
-                              XFRM_SKB_CB(skb)->seq.output.low);
+                              XFRM_SKB_CB(skb)->seq.output.low +
+                              ((u64)XFRM_SKB_CB(skb)->seq.output.hi << 32));
        ESP_SKB_CB(skb)->tmp = tmp;
        err = crypto_aead_givencrypt(req);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 9f7269f3c54a..0c152087ca15 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -65,7 +65,6 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
                        goto drop;
                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
-                skb->mark = be32_to_cpu(tunnel->parms.i_key);
                return xfrm_input(skb, nexthdr, spi, encap_type);
        }
@@ -91,6 +90,8 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
        struct pcpu_sw_netstats *tstats;
        struct xfrm_state *x;
        struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
+        u32 orig_mark = skb->mark;
+        int ret;
        if (!tunnel)
                return 1;
@@ -107,7 +108,11 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
        x = xfrm_input_state(skb);
        family = x->inner_mode->afinfo->family;
-        if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+        skb->mark = be32_to_cpu(tunnel->parms.i_key);
+        ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
+        skb->mark = orig_mark;
+        if (!ret)
                return -EPERM;
        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
@@ -216,8 +221,6 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        memset(&fl, 0, sizeof(fl));
-        skb->mark = be32_to_cpu(tunnel->parms.o_key);
        switch (skb->protocol) {
        case htons(ETH_P_IP):
                xfrm_decode_session(skb, &fl, AF_INET);
@@ -233,6 +236,9 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                return NETDEV_TX_OK;
        }
+        /* override mark with tunnel output key */
+        fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key);
        return vti_xmit(skb, dev, &fl);
 }
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 7a5ae50c80c8..84be008c945c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -187,6 +187,7 @@ static void tcp_reinit_congestion_control(struct sock *sk,
        tcp_cleanup_congestion_control(sk);
        icsk->icsk_ca_ops = ca;
+        icsk->icsk_ca_setsockopt = 1;
        if (sk->sk_state != TCP_CLOSE && icsk->icsk_ca_ops->init)
                icsk->icsk_ca_ops->init(sk);
@@ -335,8 +336,10 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
        rcu_read_lock();
        ca = __tcp_ca_find_autoload(name);
        /* No change asking for existing value */
-        if (ca == icsk->icsk_ca_ops)
+        if (ca == icsk->icsk_ca_ops) {
+                icsk->icsk_ca_setsockopt = 1;
                goto out;
+        }
        if (!ca)
                err = -ENOENT;
        else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index b5732a54f2ad..17e7339ee5ca 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -420,7 +420,10 @@ void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
                rcu_read_unlock();
        }
-        if (!ca_got_dst && !try_module_get(icsk->icsk_ca_ops->owner))
+        /* If no valid choice made yet, assign current system default ca. */
+        if (!ca_got_dst &&
+            (!icsk->icsk_ca_setsockopt ||
+             !try_module_get(icsk->icsk_ca_ops->owner)))
                tcp_assign_congestion_control(sk);
        tcp_set_ca_state(sk, TCP_CA_Open);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d10b7e0112eb..1c92ea67baef 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1345,10 +1345,8 @@ csum_copy_err:
        }
        unlock_sock_fast(sk, slow);
-        if (noblock)
+        /* starting over for a new packet, but check if we need to yield */
-                return -EAGAIN;
+        cond_resched();
-        /* starting over for a new packet */
        msg->msg_flags &= ~MSG_TRUNC;
        goto try_again;
 }
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 31f1b5d5e2ef..7c07ce36aae2 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -248,7 +248,8 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
        aead_givcrypt_set_assoc(req, asg, assoclen);
        aead_givcrypt_set_giv(req, esph->enc_data,
-                              XFRM_SKB_CB(skb)->seq.output.low);
+                              XFRM_SKB_CB(skb)->seq.output.low +
+                              ((u64)XFRM_SKB_CB(skb)->seq.output.hi << 32));
        ESP_SKB_CB(skb)->tmp = tmp;
        err = crypto_aead_givencrypt(req);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index ed9d681207fa..0224c032dca5 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -322,7 +322,6 @@ static int vti6_rcv(struct sk_buff *skb)
                }
                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
-                skb->mark = be32_to_cpu(t->parms.i_key);
                rcu_read_unlock();
@@ -342,6 +341,8 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
        struct pcpu_sw_netstats *tstats;
        struct xfrm_state *x;
        struct ip6_tnl *t = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6;
+        u32 orig_mark = skb->mark;
+        int ret;
        if (!t)
                return 1;
@@ -358,7 +359,11 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
        x = xfrm_input_state(skb);
        family = x->inner_mode->afinfo->family;
-        if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+        skb->mark = be32_to_cpu(t->parms.i_key);
+        ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
+        skb->mark = orig_mark;
+        if (!ret)
                return -EPERM;
        skb_scrub_packet(skb, !net_eq(t->net, dev_net(skb->dev)));
@@ -430,6 +435,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
        struct net_device *tdev;
        struct xfrm_state *x;
        int err = -1;
+        int mtu;
        if (!dst)
                goto tx_err_link_failure;
@@ -463,6 +469,19 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
        skb_dst_set(skb, dst);
        skb->dev = skb_dst(skb)->dev;
+        mtu = dst_mtu(dst);
+        if (!skb->ignore_df && skb->len > mtu) {
+                skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
+                if (skb->protocol == htons(ETH_P_IPV6))
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                else
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+                                  htonl(mtu));
+                return -EMSGSIZE;
+        }
        err = dst_output(skb);
        if (net_xmit_eval(err) == 0) {
                struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
@@ -495,7 +514,6 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        int ret;
        memset(&fl, 0, sizeof(fl));
-        skb->mark = be32_to_cpu(t->parms.o_key);
        switch (skb->protocol) {
        case htons(ETH_P_IPV6):
@@ -516,6 +534,9 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                goto tx_err;
        }
+        /* override mark with tunnel output key */
+        fl.flowi_mark = be32_to_cpu(t->parms.o_key);
        ret = vti6_xmit(skb, dev, &fl);
        if (ret < 0)
                goto tx_err;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index c2ec41617a35..e51fc3eee6db 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -525,10 +525,8 @@ csum_copy_err:
        }
        unlock_sock_fast(sk, slow);
-        if (noblock)
+        /* starting over for a new packet, but check if we need to yield */
-                return -EAGAIN;
+        cond_resched();
-        /* starting over for a new packet */
        msg->msg_flags &= ~MSG_TRUNC;
        goto try_again;
 }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 526c4feb3b50..b58286ecd156 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -13,6 +13,8 @@
 #include <net/dst.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
+#include <net/ip_tunnels.h>
+#include <net/ip6_tunnel.h>
 static struct kmem_cache *secpath_cachep __read_mostly;
@@ -186,6 +188,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
        struct xfrm_state *x = NULL;
        xfrm_address_t *daddr;
        struct xfrm_mode *inner_mode;
+        u32 mark = skb->mark;
        unsigned int family;
        int decaps = 0;
        int async = 0;
@@ -203,6 +206,18 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                                   XFRM_SPI_SKB_CB(skb)->daddroff);
        family = XFRM_SPI_SKB_CB(skb)->family;
+        /* if tunnel is present override skb->mark value with tunnel i_key */
+        if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
+                switch (family) {
+                case AF_INET:
+                        mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
+                        break;
+                case AF_INET6:
+                        mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
+                        break;
+                }
+        }
        /* Allocate new secpath or COW existing one. */
        if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
                struct sec_path *sp;
@@ -229,7 +244,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                        goto drop;
                }
-                x = xfrm_state_lookup(net, skb->mark, daddr, spi, nexthdr, family);
+                x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family);
                if (x == NULL) {
                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
                        xfrm_audit_state_notfound(skb, family, spi, seq);
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index dab57daae408..4fd725a0c500 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -99,6 +99,7 @@ static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
        if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
                XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
+                XFRM_SKB_CB(skb)->seq.output.hi = 0;
                if (unlikely(x->replay.oseq == 0)) {
                        x->replay.oseq--;
                        xfrm_audit_state_replay_overflow(x, skb);
@@ -177,6 +178,7 @@ static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
        if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
                XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
+                XFRM_SKB_CB(skb)->seq.output.hi = 0;
                if (unlikely(replay_esn->oseq == 0)) {
                        replay_esn->oseq--;
                        xfrm_audit_state_replay_overflow(x, skb);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f5e39e35d73a..96688cd0f6f1 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -927,8 +927,8 @@ struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
                        x->id.spi != spi)
                        continue;
-                spin_unlock_bh(&net->xfrm.xfrm_state_lock);
                xfrm_state_hold(x);
+                spin_unlock_bh(&net->xfrm.xfrm_state_lock);
                return x;
        }
        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 464168426465..0320cb523d9e 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2168,6 +2168,7 @@ static const struct hda_fixup alc882_fixups[] = {
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD),
        SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
+        SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
        SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD),
        SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
        SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD),
@@ -5377,6 +5378,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                {0x1d, 0x40700001},
                {0x21, 0x02211040}),
        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC255_STANDARD_PINS,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170120},
+                {0x17, 0x40000000},
+                {0x1d, 0x40700001},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                ALC256_STANDARD_PINS,
                {0x13, 0x40000000}),
        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 31a95cca015d..bab6c04932aa 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -449,6 +449,15 @@ static int via_suspend(struct hda_codec *codec)
        return 0;
 }
+static int via_resume(struct hda_codec *codec)
+{
+        /* some delay here to make jack detection working (bko#98921) */
+        msleep(10);
+        codec->patch_ops.init(codec);
+        regcache_sync(codec->core.regmap);
+        return 0;
+}
 #endif
 #ifdef CONFIG_PM
@@ -475,6 +484,7 @@ static const struct hda_codec_ops via_patch_ops = {
        .stream_pm = snd_hda_gen_stream_pm,
 #ifdef CONFIG_PM
        .suspend = via_suspend,
+        .resume = via_resume,
        .check_power_status = via_check_power_status,
 #endif
 };
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 3e2ef61c627b..8b7e391dd0b8 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -918,6 +918,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
        case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
        case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
        case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
+        case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
        case USB_ID(0x046d, 0x0991):
        /* Most audio usb devices lie about volume resolution.
         * Most Logitech webcams have res = 384.
@@ -1582,12 +1583,6 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
                              unitid);
                return -EINVAL;
        }
-        /* no bmControls field (e.g. Maya44) -> ignore */
-        if (desc->bLength <= 10 + input_pins) {
-                usb_audio_dbg(state->chip, "MU %d has no bmControls field\n",
-                              unitid);
-                return 0;
-        }
        num_ins = 0;
        ich = 0;
@@ -1595,6 +1590,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
                err = parse_audio_unit(state, desc->baSourceID[pin]);
                if (err < 0)
                        continue;
+                /* no bmControls field (e.g. Maya44) -> ignore */
+                if (desc->bLength <= 10 + input_pins)
+                        continue;
                err = check_input_term(state, desc->baSourceID[pin], &iterm);
                if (err < 0)
                        return err;
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index b703cb3cda19..e5000da9e9d7 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -437,6 +437,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
                .map = ebox44_map,
        },
        {
+                /* MAYA44 USB+ */
+                .id = USB_ID(0x2573, 0x0008),
+                .map = maya44_map,
+        },
+        {
                /* KEF X300A */
                .id = USB_ID(0x27ac, 0x1000),
                .map = scms_usb3318_map,
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 29175346cc4f..b8c97d092a47 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1120,6 +1120,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
        case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
        case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
        case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+        case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
                return true;
        }
        return false;
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 5bdb781163d1..9b0d8baf2934 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -5,8 +5,10 @@ include ../lib.mk
 .PHONY: all all_32 all_64 warn_32bit_failure clean
 TARGETS_C_BOTHBITS := sigreturn single_step_syscall
+TARGETS_C_32BIT_ONLY := entry_from_vm86
-BINARIES_32 := $(TARGETS_C_BOTHBITS:%=%_32)
+TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
+BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
 BINARIES_64 := $(TARGETS_C_BOTHBITS:%=%_64)
 CFLAGS := -O2 -g -std=gnu99 -pthread -Wall
@@ -32,7 +34,7 @@ all_64: $(BINARIES_64)
 clean:
        $(RM) $(BINARIES_32) $(BINARIES_64)
-$(TARGETS_C_BOTHBITS:%=%_32): %_32: %.c
+$(TARGETS_C_32BIT_ALL:%=%_32): %_32: %.c
        $(CC) -m32 -o $@ $(CFLAGS) $(EXTRA_CFLAGS) $^ -lrt -ldl
 $(TARGETS_C_BOTHBITS:%=%_64): %_64: %.c
diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c
new file mode 100644
index 000000000000..5c38a187677b
--- /dev/null
+++ b/tools/testing/selftests/x86/entry_from_vm86.c
@@ -0,0 +1,114 @@
+/*
+ * entry_from_vm86.c - tests kernel entries from vm86 mode
+ * Copyright (c) 2014-2015 Andrew Lutomirski
+ *
+ * This exercises a few paths that need to special-case vm86 mode.
+ *
+ * GPL v2.
+ */
+#define _GNU_SOURCE
+#include <assert.h>
+#include <stdlib.h>
+#include <sys/syscall.h>
+#include <sys/signal.h>
+#include <sys/ucontext.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include <sys/mman.h>
+#include <err.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <errno.h>
+#include <sys/vm86.h>
+static unsigned long load_addr = 0x10000;
+static int nerrs = 0;
+asm (
+        ".pushsection .rodata\n\t"
+        ".type vmcode_bound, @object\n\t"
+        "vmcode:\n\t"
+        "vmcode_bound:\n\t"
+        ".code16\n\t"
+        "bound %ax, (2048)\n\t"
+        "int3\n\t"
+        "vmcode_sysenter:\n\t"
+        "sysenter\n\t"
+        ".size vmcode, . - vmcode\n\t"
+        "end_vmcode:\n\t"
+        ".code32\n\t"
+        ".popsection"
+        );
+extern unsigned char vmcode[], end_vmcode[];
+extern unsigned char vmcode_bound[], vmcode_sysenter[];
+static void do_test(struct vm86plus_struct *v86, unsigned long eip,
+                    const char *text)
+{
+        long ret;
+        printf("[RUN]\t%s from vm86 mode\n", text);
+        v86->regs.eip = eip;
+        ret = vm86(VM86_ENTER, v86);
+        if (ret == -1 && errno == ENOSYS) {
+                printf("[SKIP]\tvm86 not supported\n");
+                return;
+        }
+        if (VM86_TYPE(ret) == VM86_INTx) {
+                char trapname[32];
+                int trapno = VM86_ARG(ret);
+                if (trapno == 13)
+                        strcpy(trapname, "GP");
+                else if (trapno == 5)
+                        strcpy(trapname, "BR");
+                else if (trapno == 14)
+                        strcpy(trapname, "PF");
+                else
+                        sprintf(trapname, "%d", trapno);
+                printf("[OK]\tExited vm86 mode due to #%s\n", trapname);
+        } else if (VM86_TYPE(ret) == VM86_UNKNOWN) {
+                printf("[OK]\tExited vm86 mode due to unhandled GP fault\n");
+        } else {
+                printf("[OK]\tExited vm86 mode due to type %ld, arg %ld\n",
+                       VM86_TYPE(ret), VM86_ARG(ret));
+        }
+}
+int main(void)
+{
+        struct vm86plus_struct v86;
+        unsigned char *addr = mmap((void *)load_addr, 4096,
+                                   PROT_READ | PROT_WRITE | PROT_EXEC,
+                                   MAP_ANONYMOUS | MAP_PRIVATE, -1,0);
+        if (addr != (unsigned char *)load_addr)
+                err(1, "mmap");
+        memcpy(addr, vmcode, end_vmcode - vmcode);
+        addr[2048] = 2;
+        addr[2050] = 3;
+        memset(&v86, 0, sizeof(v86));
+        v86.regs.cs = load_addr / 16;
+        v86.regs.ss = load_addr / 16;
+        v86.regs.ds = load_addr / 16;
+        v86.regs.es = load_addr / 16;
+        assert((v86.regs.cs & 3) == 0); /* Looks like RPL = 0 */
+        /* #BR -- should deliver SIG??? */
+        do_test(&v86, vmcode_bound - vmcode, "#BR");
+        /* SYSENTER -- should cause #GP or #UD depending on CPU */
+        do_test(&v86, vmcode_sysenter - vmcode, "SYSENTER");
+        return (nerrs == 0 ? 0 : 1);
+}