367 files changed, 4142 insertions, 1503 deletions

diff --git a/Documentation/Changes b/Documentation/Changes
index b17580885273..07c75d18154e 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -196,13 +196,6 @@ chmod 0644 /dev/cpu/microcode
 as root before you can use this.  You'll probably also want to
 get the user-space microcode_ctl utility to use with this.
 
-Powertweak
-----------
-
-If you are running v0.1.17 or earlier, you should upgrade to
-version v0.99.0 or higher. Running old versions may cause problems
-with programs using shared memory.
-
 udev
 ----
 udev is a userspace application for populating /dev dynamically with
@@ -366,10 +359,6 @@ Intel P6 microcode
 ------------------
 o  <http://www.urbanmyth.org/microcode/>
 
-Powertweak
-----------
-o  <http://powertweak.sourceforge.net/>
-
 udev
 ----
 o <http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html>
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index 6c9d9d37c83a..f5170082bdb3 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -58,7 +58,7 @@
      </sect1>
      <sect1><title>Wait queues and Wake events</title>
 !Iinclude/linux/wait.h
-!Ekernel/wait.c
+!Ekernel/sched/wait.c
      </sect1>
      <sect1><title>High-resolution timers</title>
 !Iinclude/linux/ktime.h
diff --git a/Documentation/devicetree/bindings/mmc/ti-omap.txt b/Documentation/devicetree/bindings/mmc/ti-omap.txt
new file mode 100644
index 000000000000..8de579969763
--- /dev/null
+++ b/Documentation/devicetree/bindings/mmc/ti-omap.txt
@@ -0,0 +1,54 @@
+* TI MMC host controller for OMAP1 and 2420
+
+The MMC Host Controller on TI OMAP1 and 2420 family provides
+an interface for MMC, SD, and SDIO types of memory cards.
+
+This file documents differences between the core properties described
+by mmc.txt and the properties used by the omap mmc driver.
+
+Note that this driver will not work with omap2430 or later omaps,
+please see the omap hsmmc driver for the current omaps.
+
+Required properties:
+- compatible: Must be "ti,omap2420-mmc", for OMAP2420 controllers
+- ti,hwmods: For 2420, must be "msdi<n>", where n is controller
+  instance starting 1
+
+Examples:
+
+        msdi1: mmc@4809c000 {
+                compatible = "ti,omap2420-mmc";
+                ti,hwmods = "msdi1";
+                reg = <0x4809c000 0x80>;
+                interrupts = <83>;
+                dmas = <&sdma 61 &sdma 62>;
+                dma-names = "tx", "rx";
+        };
+
+* TI MMC host controller for OMAP1 and 2420
+
+The MMC Host Controller on TI OMAP1 and 2420 family provides
+an interface for MMC, SD, and SDIO types of memory cards.
+
+This file documents differences between the core properties described
+by mmc.txt and the properties used by the omap mmc driver.
+
+Note that this driver will not work with omap2430 or later omaps,
+please see the omap hsmmc driver for the current omaps.
+
+Required properties:
+- compatible: Must be "ti,omap2420-mmc", for OMAP2420 controllers
+- ti,hwmods: For 2420, must be "msdi<n>", where n is controller
+  instance starting 1
+
+Examples:
+
+        msdi1: mmc@4809c000 {
+                compatible = "ti,omap2420-mmc";
+                ti,hwmods = "msdi1";
+                reg = <0x4809c000 0x80>;
+                interrupts = <83>;
+                dmas = <&sdma 61 &sdma 62>;
+                dma-names = "tx", "rx";
+        };
+
diff --git a/Documentation/gpio/00-INDEX b/Documentation/gpio/00-INDEX
new file mode 100644
index 000000000000..1de43ae46ae6
--- /dev/null
+++ b/Documentation/gpio/00-INDEX
@@ -0,0 +1,14 @@
+00-INDEX
+        - This file
+gpio.txt
+        - Introduction to GPIOs and their kernel interfaces
+consumer.txt
+        - How to obtain and use GPIOs in a driver
+driver.txt
+        - How to write a GPIO driver
+board.txt
+        - How to assign GPIOs to a consumer device and a function
+sysfs.txt
+        - Information about the GPIO sysfs interface
+gpio-legacy.txt
+        - Historical documentation of the deprecated GPIO integer interface
diff --git a/Documentation/gpio/board.txt b/Documentation/gpio/board.txt
new file mode 100644
index 000000000000..0d03506f2cc5
--- /dev/null
+++ b/Documentation/gpio/board.txt
@@ -0,0 +1,115 @@
+GPIO Mappings
+=============
+
+This document explains how GPIOs can be assigned to given devices and functions.
+Note that it only applies to the new descriptor-based interface. For a
+description of the deprecated integer-based GPIO interface please refer to
+gpio-legacy.txt (actually, there is no real mapping possible with the old
+interface; you just fetch an integer from somewhere and request the
+corresponding GPIO.
+
+Platforms that make use of GPIOs must select ARCH_REQUIRE_GPIOLIB (if GPIO usage
+is mandatory) or ARCH_WANT_OPTIONAL_GPIOLIB (if GPIO support can be omitted) in
+their Kconfig. Then, how GPIOs are mapped depends on what the platform uses to
+describe its hardware layout. Currently, mappings can be defined through device
+tree, ACPI, and platform data.
+
+Device Tree
+-----------
+GPIOs can easily be mapped to devices and functions in the device tree. The
+exact way to do it depends on the GPIO controller providing the GPIOs, see the
+device tree bindings for your controller.
+
+GPIOs mappings are defined in the consumer device's node, in a property named
+<function>-gpios, where <function> is the function the driver will request
+through gpiod_get(). For example:
+
+        foo_device {
+                compatible = "acme,foo";
+                ...
+                led-gpios = <&gpio 15 GPIO_ACTIVE_HIGH>, /* red */
+                            <&gpio 16 GPIO_ACTIVE_HIGH>, /* green */
+                            <&gpio 17 GPIO_ACTIVE_HIGH>; /* blue */
+
+                power-gpio = <&gpio 1 GPIO_ACTIVE_LOW>;
+        };
+
+This property will make GPIOs 15, 16 and 17 available to the driver under the
+"led" function, and GPIO 1 as the "power" GPIO:
+
+        struct gpio_desc *red, *green, *blue, *power;
+
+        red = gpiod_get_index(dev, "led", 0);
+        green = gpiod_get_index(dev, "led", 1);
+        blue = gpiod_get_index(dev, "led", 2);
+
+        power = gpiod_get(dev, "power");
+
+The led GPIOs will be active-high, while the power GPIO will be active-low (i.e.
+gpiod_is_active_low(power) will be true).
+
+ACPI
+----
+ACPI does not support function names for GPIOs. Therefore, only the "idx"
+argument of gpiod_get_index() is useful to discriminate between GPIOs assigned
+to a device. The "con_id" argument can still be set for debugging purposes (it
+will appear under error messages as well as debug and sysfs nodes).
+
+Platform Data
+-------------
+Finally, GPIOs can be bound to devices and functions using platform data. Board
+files that desire to do so need to include the following header:
+
+        #include <linux/gpio/driver.h>
+
+GPIOs are mapped by the means of tables of lookups, containing instances of the
+gpiod_lookup structure. Two macros are defined to help declaring such mappings:
+
+        GPIO_LOOKUP(chip_label, chip_hwnum, dev_id, con_id, flags)
+        GPIO_LOOKUP_IDX(chip_label, chip_hwnum, dev_id, con_id, idx, flags)
+
+where
+
+  - chip_label is the label of the gpiod_chip instance providing the GPIO
+  - chip_hwnum is the hardware number of the GPIO within the chip
+  - dev_id is the identifier of the device that will make use of this GPIO. If
+        NULL, the GPIO will be available to all devices.
+  - con_id is the name of the GPIO function from the device point of view. It
+        can be NULL.
+  - idx is the index of the GPIO within the function.
+  - flags is defined to specify the following properties:
+        * GPIOF_ACTIVE_LOW      - to configure the GPIO as active-low
+        * GPIOF_OPEN_DRAIN      - GPIO pin is open drain type.
+        * GPIOF_OPEN_SOURCE     - GPIO pin is open source type.
+
+In the future, these flags might be extended to support more properties.
+
+Note that GPIO_LOOKUP() is just a shortcut to GPIO_LOOKUP_IDX() where idx = 0.
+
+A lookup table can then be defined as follows:
+
+        struct gpiod_lookup gpios_table[] = {
+        GPIO_LOOKUP_IDX("gpio.0", 15, "foo.0", "led", 0, GPIO_ACTIVE_HIGH),
+        GPIO_LOOKUP_IDX("gpio.0", 16, "foo.0", "led", 1, GPIO_ACTIVE_HIGH),
+        GPIO_LOOKUP_IDX("gpio.0", 17, "foo.0", "led", 2, GPIO_ACTIVE_HIGH),
+        GPIO_LOOKUP("gpio.0", 1, "foo.0", "power", GPIO_ACTIVE_LOW),
+        };
+
+And the table can be added by the board code as follows:
+
+        gpiod_add_table(gpios_table, ARRAY_SIZE(gpios_table));
+
+The driver controlling "foo.0" will then be able to obtain its GPIOs as follows:
+
+        struct gpio_desc *red, *green, *blue, *power;
+
+        red = gpiod_get_index(dev, "led", 0);
+        green = gpiod_get_index(dev, "led", 1);
+        blue = gpiod_get_index(dev, "led", 2);
+
+        power = gpiod_get(dev, "power");
+        gpiod_direction_output(power, 1);
+
+Since the "power" GPIO is mapped as active-low, its actual signal will be 0
+after this code. Contrary to the legacy integer GPIO interface, the active-low
+property is handled during mapping and is thus transparent to GPIO consumers.
diff --git a/Documentation/gpio/consumer.txt b/Documentation/gpio/consumer.txt
new file mode 100644
index 000000000000..07c74a3765a0
--- /dev/null
+++ b/Documentation/gpio/consumer.txt
@@ -0,0 +1,197 @@
+GPIO Descriptor Consumer Interface
+==================================
+
+This document describes the consumer interface of the GPIO framework. Note that
+it describes the new descriptor-based interface. For a description of the
+deprecated integer-based GPIO interface please refer to gpio-legacy.txt.
+
+
+Guidelines for GPIOs consumers
+==============================
+
+Drivers that can't work without standard GPIO calls should have Kconfig entries
+that depend on GPIOLIB. The functions that allow a driver to obtain and use
+GPIOs are available by including the following file:
+
+        #include <linux/gpio/consumer.h>
+
+All the functions that work with the descriptor-based GPIO interface are
+prefixed with gpiod_. The gpio_ prefix is used for the legacy interface. No
+other function in the kernel should use these prefixes.
+
+
+Obtaining and Disposing GPIOs
+=============================
+
+With the descriptor-based interface, GPIOs are identified with an opaque,
+non-forgeable handler that must be obtained through a call to one of the
+gpiod_get() functions. Like many other kernel subsystems, gpiod_get() takes the
+device that will use the GPIO and the function the requested GPIO is supposed to
+fulfill:
+
+        struct gpio_desc *gpiod_get(struct device *dev, const char *con_id)
+
+If a function is implemented by using several GPIOs together (e.g. a simple LED
+device that displays digits), an additional index argument can be specified:
+
+        struct gpio_desc *gpiod_get_index(struct device *dev,
+                                          const char *con_id, unsigned int idx)
+
+Both functions return either a valid GPIO descriptor, or an error code checkable
+with IS_ERR(). They will never return a NULL pointer.
+
+Device-managed variants of these functions are also defined:
+
+        struct gpio_desc *devm_gpiod_get(struct device *dev, const char *con_id)
+
+        struct gpio_desc *devm_gpiod_get_index(struct device *dev,
+                                               const char *con_id,
+                                               unsigned int idx)
+
+A GPIO descriptor can be disposed of using the gpiod_put() function:
+
+        void gpiod_put(struct gpio_desc *desc)
+
+It is strictly forbidden to use a descriptor after calling this function. The
+device-managed variant is, unsurprisingly:
+
+        void devm_gpiod_put(struct device *dev, struct gpio_desc *desc)
+
+
+Using GPIOs
+===========
+
+Setting Direction
+-----------------
+The first thing a driver must do with a GPIO is setting its direction. This is
+done by invoking one of the gpiod_direction_*() functions:
+
+        int gpiod_direction_input(struct gpio_desc *desc)
+        int gpiod_direction_output(struct gpio_desc *desc, int value)
+
+The return value is zero for success, else a negative errno. It should be
+checked, since the get/set calls don't return errors and since misconfiguration
+is possible. You should normally issue these calls from a task context. However,
+for spinlock-safe GPIOs it is OK to use them before tasking is enabled, as part
+of early board setup.
+
+For output GPIOs, the value provided becomes the initial output value. This
+helps avoid signal glitching during system startup.
+
+A driver can also query the current direction of a GPIO:
+
+        int gpiod_get_direction(const struct gpio_desc *desc)
+
+This function will return either GPIOF_DIR_IN or GPIOF_DIR_OUT.
+
+Be aware that there is no default direction for GPIOs. Therefore, **using a GPIO
+without setting its direction first is illegal and will result in undefined
+behavior!**
+
+
+Spinlock-Safe GPIO Access
+-------------------------
+Most GPIO controllers can be accessed with memory read/write instructions. Those
+don't need to sleep, and can safely be done from inside hard (non-threaded) IRQ
+handlers and similar contexts.
+
+Use the following calls to access GPIOs from an atomic context:
+
+        int gpiod_get_value(const struct gpio_desc *desc);
+        void gpiod_set_value(struct gpio_desc *desc, int value);
+
+The values are boolean, zero for low, nonzero for high. When reading the value
+of an output pin, the value returned should be what's seen on the pin. That
+won't always match the specified output value, because of issues including
+open-drain signaling and output latencies.
+
+The get/set calls do not return errors because "invalid GPIO" should have been
+reported earlier from gpiod_direction_*(). However, note that not all platforms
+can read the value of output pins; those that can't should always return zero.
+Also, using these calls for GPIOs that can't safely be accessed without sleeping
+(see below) is an error.
+
+
+GPIO Access That May Sleep
+--------------------------
+Some GPIO controllers must be accessed using message based buses like I2C or
+SPI. Commands to read or write those GPIO values require waiting to get to the
+head of a queue to transmit a command and get its response. This requires
+sleeping, which can't be done from inside IRQ handlers.
+
+Platforms that support this type of GPIO distinguish them from other GPIOs by
+returning nonzero from this call:
+
+        int gpiod_cansleep(const struct gpio_desc *desc)
+
+To access such GPIOs, a different set of accessors is defined:
+
+        int gpiod_get_value_cansleep(const struct gpio_desc *desc)
+        void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
+
+Accessing such GPIOs requires a context which may sleep, for example a threaded
+IRQ handler, and those accessors must be used instead of spinlock-safe
+accessors without the cansleep() name suffix.
+
+Other than the fact that these accessors might sleep, and will work on GPIOs
+that can't be accessed from hardIRQ handlers, these calls act the same as the
+spinlock-safe calls.
+
+
+Active-low State and Raw GPIO Values
+------------------------------------
+Device drivers like to manage the logical state of a GPIO, i.e. the value their
+device will actually receive, no matter what lies between it and the GPIO line.
+In some cases, it might make sense to control the actual GPIO line value. The
+following set of calls ignore the active-low property of a GPIO and work on the
+raw line value:
+
+        int gpiod_get_raw_value(const struct gpio_desc *desc)
+        void gpiod_set_raw_value(struct gpio_desc *desc, int value)
+        int gpiod_get_raw_value_cansleep(const struct gpio_desc *desc)
+        void gpiod_set_raw_value_cansleep(struct gpio_desc *desc, int value)
+
+The active-low state of a GPIO can also be queried using the following call:
+
+        int gpiod_is_active_low(const struct gpio_desc *desc)
+
+Note that these functions should only be used with great moderation ; a driver
+should not have to care about the physical line level.
+
+GPIOs mapped to IRQs
+--------------------
+GPIO lines can quite often be used as IRQs. You can get the IRQ number
+corresponding to a given GPIO using the following call:
+
+        int gpiod_to_irq(const struct gpio_desc *desc)
+
+It will return an IRQ number, or an negative errno code if the mapping can't be
+done (most likely because that particular GPIO cannot be used as IRQ). It is an
+unchecked error to use a GPIO that wasn't set up as an input using
+gpiod_direction_input(), or to use an IRQ number that didn't originally come
+from gpiod_to_irq(). gpiod_to_irq() is not allowed to sleep.
+
+Non-error values returned from gpiod_to_irq() can be passed to request_irq() or
+free_irq(). They will often be stored into IRQ resources for platform devices,
+by the board-specific initialization code. Note that IRQ trigger options are
+part of the IRQ interface, e.g. IRQF_TRIGGER_FALLING, as are system wakeup
+capabilities.
+
+
+Interacting With the Legacy GPIO Subsystem
+==========================================
+Many kernel subsystems still handle GPIOs using the legacy integer-based
+interface. Although it is strongly encouraged to upgrade them to the safer
+descriptor-based API, the following two functions allow you to convert a GPIO
+descriptor into the GPIO integer namespace and vice-versa:
+
+        int desc_to_gpio(const struct gpio_desc *desc)
+        struct gpio_desc *gpio_to_desc(unsigned gpio)
+
+The GPIO number returned by desc_to_gpio() can be safely used as long as the
+GPIO descriptor has not been freed. All the same, a GPIO number passed to
+gpio_to_desc() must have been properly acquired, and usage of the returned GPIO
+descriptor is only possible after the GPIO number has been released.
+
+Freeing a GPIO obtained by one API with the other API is forbidden and an
+unchecked error.
diff --git a/Documentation/gpio/driver.txt b/Documentation/gpio/driver.txt
new file mode 100644
index 000000000000..9da0bfa74781
--- /dev/null
+++ b/Documentation/gpio/driver.txt
@@ -0,0 +1,75 @@
+GPIO Descriptor Driver Interface
+================================
+
+This document serves as a guide for GPIO chip drivers writers. Note that it
+describes the new descriptor-based interface. For a description of the
+deprecated integer-based GPIO interface please refer to gpio-legacy.txt.
+
+Each GPIO controller driver needs to include the following header, which defines
+the structures used to define a GPIO driver:
+
+        #include <linux/gpio/driver.h>
+
+
+Internal Representation of GPIOs
+================================
+
+Inside a GPIO driver, individual GPIOs are identified by their hardware number,
+which is a unique number between 0 and n, n being the number of GPIOs managed by
+the chip. This number is purely internal: the hardware number of a particular
+GPIO descriptor is never made visible outside of the driver.
+
+On top of this internal number, each GPIO also need to have a global number in
+the integer GPIO namespace so that it can be used with the legacy GPIO
+interface. Each chip must thus have a "base" number (which can be automatically
+assigned), and for each GPIO the global number will be (base + hardware number).
+Although the integer representation is considered deprecated, it still has many
+users and thus needs to be maintained.
+
+So for example one platform could use numbers 32-159 for GPIOs, with a
+controller defining 128 GPIOs at a "base" of 32 ; while another platform uses
+numbers 0..63 with one set of GPIO controllers, 64-79 with another type of GPIO
+controller, and on one particular board 80-95 with an FPGA. The numbers need not
+be contiguous; either of those platforms could also use numbers 2000-2063 to
+identify GPIOs in a bank of I2C GPIO expanders.
+
+
+Controller Drivers: gpio_chip
+=============================
+
+In the gpiolib framework each GPIO controller is packaged as a "struct
+gpio_chip" (see linux/gpio/driver.h for its complete definition) with members
+common to each controller of that type:
+
+ - methods to establish GPIO direction
+ - methods used to access GPIO values
+ - method to return the IRQ number associated to a given GPIO
+ - flag saying whether calls to its methods may sleep
+ - optional debugfs dump method (showing extra state like pullup config)
+ - optional base number (will be automatically assigned if omitted)
+ - label for diagnostics and GPIOs mapping using platform data
+
+The code implementing a gpio_chip should support multiple instances of the
+controller, possibly using the driver model. That code will configure each
+gpio_chip and issue gpiochip_add(). Removing a GPIO controller should be rare;
+use gpiochip_remove() when it is unavoidable.
+
+Most often a gpio_chip is part of an instance-specific structure with state not
+exposed by the GPIO interfaces, such as addressing, power management, and more.
+Chips such as codecs will have complex non-GPIO state.
+
+Any debugfs dump method should normally ignore signals which haven't been
+requested as GPIOs. They can use gpiochip_is_requested(), which returns either
+NULL or the label associated with that GPIO when it was requested.
+
+Locking IRQ usage
+-----------------
+Input GPIOs can be used as IRQ signals. When this happens, a driver is requested
+to mark the GPIO as being used as an IRQ:
+
+        int gpiod_lock_as_irq(struct gpio_desc *desc)
+
+This will prevent the use of non-irq related GPIO APIs until the GPIO IRQ lock
+is released:
+
+        void gpiod_unlock_as_irq(struct gpio_desc *desc)
diff --git a/Documentation/gpio.txt b/Documentation/gpio/gpio-legacy.txt
index 6f83fa965b4b..6f83fa965b4b 100644
--- a/Documentation/gpio.txt
+++ b/Documentation/gpio/gpio-legacy.txt
diff --git a/Documentation/gpio/gpio.txt b/Documentation/gpio/gpio.txt
new file mode 100644
index 000000000000..cd9b356e88cd
--- /dev/null
+++ b/Documentation/gpio/gpio.txt
@@ -0,0 +1,119 @@
+GPIO Interfaces
+===============
+
+The documents in this directory give detailed instructions on how to access
+GPIOs in drivers, and how to write a driver for a device that provides GPIOs
+itself.
+
+Due to the history of GPIO interfaces in the kernel, there are two different
+ways to obtain and use GPIOs:
+
+  - The descriptor-based interface is the preferred way to manipulate GPIOs,
+and is described by all the files in this directory excepted gpio-legacy.txt.
+  - The legacy integer-based interface which is considered deprecated (but still
+usable for compatibility reasons) is documented in gpio-legacy.txt.
+
+The remainder of this document applies to the new descriptor-based interface.
+gpio-legacy.txt contains the same information applied to the legacy
+integer-based interface.
+
+
+What is a GPIO?
+===============
+
+A "General Purpose Input/Output" (GPIO) is a flexible software-controlled
+digital signal. They are provided from many kinds of chip, and are familiar
+to Linux developers working with embedded and custom hardware. Each GPIO
+represents a bit connected to a particular pin, or "ball" on Ball Grid Array
+(BGA) packages. Board schematics show which external hardware connects to
+which GPIOs. Drivers can be written generically, so that board setup code
+passes such pin configuration data to drivers.
+
+System-on-Chip (SOC) processors heavily rely on GPIOs. In some cases, every
+non-dedicated pin can be configured as a GPIO; and most chips have at least
+several dozen of them. Programmable logic devices (like FPGAs) can easily
+provide GPIOs; multifunction chips like power managers, and audio codecs
+often have a few such pins to help with pin scarcity on SOCs; and there are
+also "GPIO Expander" chips that connect using the I2C or SPI serial buses.
+Most PC southbridges have a few dozen GPIO-capable pins (with only the BIOS
+firmware knowing how they're used).
+
+The exact capabilities of GPIOs vary between systems. Common options:
+
+  - Output values are writable (high=1, low=0). Some chips also have
+    options about how that value is driven, so that for example only one
+    value might be driven, supporting "wire-OR" and similar schemes for the
+    other value (notably, "open drain" signaling).
+
+  - Input values are likewise readable (1, 0). Some chips support readback
+    of pins configured as "output", which is very useful in such "wire-OR"
+    cases (to support bidirectional signaling). GPIO controllers may have
+    input de-glitch/debounce logic, sometimes with software controls.
+
+  - Inputs can often be used as IRQ signals, often edge triggered but
+    sometimes level triggered. Such IRQs may be configurable as system
+    wakeup events, to wake the system from a low power state.
+
+  - Usually a GPIO will be configurable as either input or output, as needed
+    by different product boards; single direction ones exist too.
+
+  - Most GPIOs can be accessed while holding spinlocks, but those accessed
+    through a serial bus normally can't. Some systems support both types.
+
+On a given board each GPIO is used for one specific purpose like monitoring
+MMC/SD card insertion/removal, detecting card write-protect status, driving
+a LED, configuring a transceiver, bit-banging a serial bus, poking a hardware
+watchdog, sensing a switch, and so on.
+
+
+Common GPIO Properties
+======================
+
+These properties are met through all the other documents of the GPIO interface
+and it is useful to understand them, especially if you need to define GPIO
+mappings.
+
+Active-High and Active-Low
+--------------------------
+It is natural to assume that a GPIO is "active" when its output signal is 1
+("high"), and inactive when it is 0 ("low"). However in practice the signal of a
+GPIO may be inverted before is reaches its destination, or a device could decide
+to have different conventions about what "active" means. Such decisions should
+be transparent to device drivers, therefore it is possible to define a GPIO as
+being either active-high ("1" means "active", the default) or active-low ("0"
+means "active") so that drivers only need to worry about the logical signal and
+not about what happens at the line level.
+
+Open Drain and Open Source
+--------------------------
+Sometimes shared signals need to use "open drain" (where only the low signal
+level is actually driven), or "open source" (where only the high signal level is
+driven) signaling. That term applies to CMOS transistors; "open collector" is
+used for TTL. A pullup or pulldown resistor causes the high or low signal level.
+This is sometimes called a "wire-AND"; or more practically, from the negative
+logic (low=true) perspective this is a "wire-OR".
+
+One common example of an open drain signal is a shared active-low IRQ line.
+Also, bidirectional data bus signals sometimes use open drain signals.
+
+Some GPIO controllers directly support open drain and open source outputs; many
+don't. When you need open drain signaling but your hardware doesn't directly
+support it, there's a common idiom you can use to emulate it with any GPIO pin
+that can be used as either an input or an output:
+
+ LOW:   gpiod_direction_output(gpio, 0) ... this drives the signal and overrides
+        the pullup.
+
+ HIGH:  gpiod_direction_input(gpio) ... this turns off the output, so the pullup
+        (or some other device) controls the signal.
+
+The same logic can be applied to emulate open source signaling, by driving the
+high signal and configuring the GPIO as input for low. This open drain/open
+source emulation can be handled transparently by the GPIO framework.
+
+If you are "driving" the signal high but gpiod_get_value(gpio) reports a low
+value (after the appropriate rise time passes), you know some other component is
+driving the shared signal low. That's not necessarily an error. As one common
+example, that's how I2C clocks are stretched:  a slave that needs a slower clock
+delays the rising edge of SCK, and the I2C master adjusts its signaling rate
+accordingly.
diff --git a/Documentation/gpio/sysfs.txt b/Documentation/gpio/sysfs.txt
new file mode 100644
index 000000000000..c2c3a97f8ff7
--- /dev/null
+++ b/Documentation/gpio/sysfs.txt
@@ -0,0 +1,155 @@
+GPIO Sysfs Interface for Userspace
+==================================
+
+Platforms which use the "gpiolib" implementors framework may choose to
+configure a sysfs user interface to GPIOs. This is different from the
+debugfs interface, since it provides control over GPIO direction and
+value instead of just showing a gpio state summary. Plus, it could be
+present on production systems without debugging support.
+
+Given appropriate hardware documentation for the system, userspace could
+know for example that GPIO #23 controls the write protect line used to
+protect boot loader segments in flash memory. System upgrade procedures
+may need to temporarily remove that protection, first importing a GPIO,
+then changing its output state, then updating the code before re-enabling
+the write protection. In normal use, GPIO #23 would never be touched,
+and the kernel would have no need to know about it.
+
+Again depending on appropriate hardware documentation, on some systems
+userspace GPIO can be used to determine system configuration data that
+standard kernels won't know about. And for some tasks, simple userspace
+GPIO drivers could be all that the system really needs.
+
+Note that standard kernel drivers exist for common "LEDs and Buttons"
+GPIO tasks:  "leds-gpio" and "gpio_keys", respectively. Use those
+instead of talking directly to the GPIOs; they integrate with kernel
+frameworks better than your userspace code could.
+
+
+Paths in Sysfs
+--------------
+There are three kinds of entry in /sys/class/gpio:
+
+   -    Control interfaces used to get userspace control over GPIOs;
+
+   -    GPIOs themselves; and
+
+   -    GPIO controllers ("gpio_chip" instances).
+
+That's in addition to standard files including the "device" symlink.
+
+The control interfaces are write-only:
+
+    /sys/class/gpio/
+
+        "export" ... Userspace may ask the kernel to export control of
+                a GPIO to userspace by writing its number to this file.
+
+                Example:  "echo 19 > export" will create a "gpio19" node
+                for GPIO #19, if that's not requested by kernel code.
+
+        "unexport" ... Reverses the effect of exporting to userspace.
+
+                Example:  "echo 19 > unexport" will remove a "gpio19"
+                node exported using the "export" file.
+
+GPIO signals have paths like /sys/class/gpio/gpio42/ (for GPIO #42)
+and have the following read/write attributes:
+
+    /sys/class/gpio/gpioN/
+
+        "direction" ... reads as either "in" or "out". This value may
+                normally be written. Writing as "out" defaults to
+                initializing the value as low. To ensure glitch free
+                operation, values "low" and "high" may be written to
+                configure the GPIO as an output with that initial value.
+
+                Note that this attribute *will not exist* if the kernel
+                doesn't support changing the direction of a GPIO, or
+                it was exported by kernel code that didn't explicitly
+                allow userspace to reconfigure this GPIO's direction.
+
+        "value" ... reads as either 0 (low) or 1 (high). If the GPIO
+                is configured as an output, this value may be written;
+                any nonzero value is treated as high.
+
+                If the pin can be configured as interrupt-generating interrupt
+                and if it has been configured to generate interrupts (see the
+                description of "edge"), you can poll(2) on that file and
+                poll(2) will return whenever the interrupt was triggered. If
+                you use poll(2), set the events POLLPRI and POLLERR. If you
+                use select(2), set the file descriptor in exceptfds. After
+                poll(2) returns, either lseek(2) to the beginning of the sysfs
+                file and read the new value or close the file and re-open it
+                to read the value.
+
+        "edge" ... reads as either "none", "rising", "falling", or
+                "both". Write these strings to select the signal edge(s)
+                that will make poll(2) on the "value" file return.
+
+                This file exists only if the pin can be configured as an
+                interrupt generating input pin.
+
+        "active_low" ... reads as either 0 (false) or 1 (true). Write
+                any nonzero value to invert the value attribute both
+                for reading and writing. Existing and subsequent
+                poll(2) support configuration via the edge attribute
+                for "rising" and "falling" edges will follow this
+                setting.
+
+GPIO controllers have paths like /sys/class/gpio/gpiochip42/ (for the
+controller implementing GPIOs starting at #42) and have the following
+read-only attributes:
+
+    /sys/class/gpio/gpiochipN/
+
+        "base" ... same as N, the first GPIO managed by this chip
+
+        "label" ... provided for diagnostics (not always unique)
+
+        "ngpio" ... how many GPIOs this manges (N to N + ngpio - 1)
+
+Board documentation should in most cases cover what GPIOs are used for
+what purposes. However, those numbers are not always stable; GPIOs on
+a daughtercard might be different depending on the base board being used,
+or other cards in the stack. In such cases, you may need to use the
+gpiochip nodes (possibly in conjunction with schematics) to determine
+the correct GPIO number to use for a given signal.
+
+
+Exporting from Kernel code
+--------------------------
+Kernel code can explicitly manage exports of GPIOs which have already been
+requested using gpio_request():
+
+        /* export the GPIO to userspace */
+        int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
+
+        /* reverse gpio_export() */
+        void gpiod_unexport(struct gpio_desc *desc);
+
+        /* create a sysfs link to an exported GPIO node */
+        int gpiod_export_link(struct device *dev, const char *name,
+                      struct gpio_desc *desc);
+
+        /* change the polarity of a GPIO node in sysfs */
+        int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value);
+
+After a kernel driver requests a GPIO, it may only be made available in
+the sysfs interface by gpiod_export(). The driver can control whether the
+signal direction may change. This helps drivers prevent userspace code
+from accidentally clobbering important system state.
+
+This explicit exporting can help with debugging (by making some kinds
+of experiments easier), or can provide an always-there interface that's
+suitable for documenting as part of a board support package.
+
+After the GPIO has been exported, gpiod_export_link() allows creating
+symlinks from elsewhere in sysfs to the GPIO sysfs node. Drivers can
+use this to provide the interface under their own device in sysfs with
+a descriptive name.
+
+Drivers can use gpiod_sysfs_set_active_low() to hide GPIO line polarity
+differences between boards from user space. Polarity change can be done both
+before and after gpiod_export(), and previously enabled poll(2) support for
+either rising or falling edge will be reconfigured to follow this setting.
diff --git a/MAINTAINERS b/MAINTAINERS
index f216db847022..4afcfb4c892b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4049,6 +4049,12 @@ W:	http://www.pharscape.org
 S:      Maintained
 F:      drivers/net/usb/hso.c
 
+HSR NETWORK PROTOCOL
+M:      Arvid Brodin <arvid.brodin@alten.se>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      net/hsr/
+
 HTCPEN TOUCHSCREEN DRIVER
 M:      Pau Oliva Fora <pof@eslack.org>
 L:      linux-input@vger.kernel.org
@@ -5261,7 +5267,7 @@ S:	Maintained
 F:      Documentation/lockdep*.txt
 F:      Documentation/lockstat.txt
 F:      include/linux/lockdep.h
-F:      kernel/lockdep*
+F:      kernel/locking/
 
 LOGICAL DISK MANAGER SUPPORT (LDM, Windows 2000/XP/Vista Dynamic Disks)
 M:      "Richard Russon (FlatCap)" <ldm@flatcap.org>
@@ -7385,7 +7391,6 @@ S:	Maintained
 F:      kernel/sched/
 F:      include/linux/sched.h
 F:      include/uapi/linux/sched.h
-F:      kernel/wait.c
 F:      include/linux/wait.h
 
 SCORE ARCHITECTURE
diff --git a/Makefile b/Makefile
index c0c2d58e3998..2c88e44a1dd4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = One Giant Leap for Frogkind
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/am335x-base0033.dts b/arch/arm/boot/dts/am335x-base0033.dts
index b4f95c2bbf74..72a9b3fc4251 100644
--- a/arch/arm/boot/dts/am335x-base0033.dts
+++ b/arch/arm/boot/dts/am335x-base0033.dts
@@ -13,4 +13,83 @@
 / {
         model = "IGEP COM AM335x on AQUILA Expansion";
         compatible = "isee,am335x-base0033", "isee,am335x-igep0033", "ti,am33xx";
+
+        hdmi {
+                compatible = "ti,tilcdc,slave";
+                i2c = <&i2c0>;
+                pinctrl-names = "default", "off";
+                pinctrl-0 = <&nxp_hdmi_pins>;
+                pinctrl-1 = <&nxp_hdmi_off_pins>;
+                status = "okay";
+        };
+
+        leds_base {
+                pinctrl-names = "default";
+                pinctrl-0 = <&leds_base_pins>;
+
+                compatible = "gpio-leds";
+
+                led@0 {
+                        label = "base:red:user";
+                        gpios = <&gpio1 21 GPIO_ACTIVE_HIGH>;   /* gpio1_21 */
+                        default-state = "off";
+                };
+
+                led@1 {
+                        label = "base:green:user";
+                        gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;    /* gpio2_0 */
+                        default-state = "off";
+                };
+        };
+};
+
+&am33xx_pinmux {
+        nxp_hdmi_pins: pinmux_nxp_hdmi_pins {
+                pinctrl-single,pins = <
+                        0x1b0 (PIN_OUTPUT | MUX_MODE3)  /* xdma_event_intr0.clkout1 */
+                        0xa0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data0 */
+                        0xa4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data1 */
+                        0xa8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data2 */
+                        0xac (PIN_OUTPUT | MUX_MODE0)   /* lcd_data3 */
+                        0xb0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data4 */
+                        0xb4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data5 */
+                        0xb8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data6 */
+                        0xbc (PIN_OUTPUT | MUX_MODE0)   /* lcd_data7 */
+                        0xc0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data8 */
+                        0xc4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data9 */
+                        0xc8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data10 */
+                        0xcc (PIN_OUTPUT | MUX_MODE0)   /* lcd_data11 */
+                        0xd0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data12 */
+                        0xd4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data13 */
+                        0xd8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data14 */
+                        0xdc (PIN_OUTPUT | MUX_MODE0)   /* lcd_data15 */
+                        0xe0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_vsync */
+                        0xe4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_hsync */
+                        0xe8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_pclk */
+                        0xec (PIN_OUTPUT | MUX_MODE0)   /* lcd_ac_bias_en */
+                >;
+        };
+        nxp_hdmi_off_pins: pinmux_nxp_hdmi_off_pins {
+                pinctrl-single,pins = <
+                        0x1b0 (PIN_OUTPUT | MUX_MODE3)  /* xdma_event_intr0.clkout1 */
+                >;
+        };
+
+        leds_base_pins: pinmux_leds_base_pins {
+                pinctrl-single,pins = <
+                        0x54 (PIN_OUTPUT_PULLDOWN | MUX_MODE7)  /* gpmc_a5.gpio1_21 */
+                        0x88 (PIN_OUTPUT_PULLDOWN | MUX_MODE7)  /* gpmc_csn3.gpio2_0 */
+                >;
+        };
+};
+
+&lcdc {
+        status = "okay";
+};
+
+&i2c0 {
+        eeprom: eeprom@50 {
+                compatible = "at,24c256";
+                reg = <0x50>;
+        };
 };
diff --git a/arch/arm/boot/dts/am335x-igep0033.dtsi b/arch/arm/boot/dts/am335x-igep0033.dtsi
index 619624479311..7063311a58d9 100644
--- a/arch/arm/boot/dts/am335x-igep0033.dtsi
+++ b/arch/arm/boot/dts/am335x-igep0033.dtsi
@@ -199,6 +199,35 @@
         pinctrl-0 = <&uart0_pins>;
 };
 
+&usb {
+        status = "okay";
+
+        control@44e10000 {
+                status = "okay";
+        };
+
+        usb-phy@47401300 {
+                status = "okay";
+        };
+
+        usb-phy@47401b00 {
+                status = "okay";
+        };
+
+        usb@47401000 {
+                status = "okay";
+        };
+
+        usb@47401800 {
+                status = "okay";
+                dr_mode = "host";
+        };
+
+        dma-controller@07402000  {
+                status = "okay";
+        };
+};
+
 #include "tps65910.dtsi"
 
 &tps {
diff --git a/arch/arm/boot/dts/armada-370-db.dts b/arch/arm/boot/dts/armada-370-db.dts
index 90ce29dbe119..08a56bcfc724 100644
--- a/arch/arm/boot/dts/armada-370-db.dts
+++ b/arch/arm/boot/dts/armada-370-db.dts
@@ -99,22 +99,22 @@
                                         spi-max-frequency = <50000000>;
                                 };
                         };
+                };
 
-                        pcie-controller {
+                pcie-controller {
+                        status = "okay";
+                        /*
+                         * The two PCIe units are accessible through
+                         * both standard PCIe slots and mini-PCIe
+                         * slots on the board.
+                         */
+                        pcie@1,0 {
+                                /* Port 0, Lane 0 */
+                                status = "okay";
+                        };
+                        pcie@2,0 {
+                                /* Port 1, Lane 0 */
                                 status = "okay";
-                                /*
-                                 * The two PCIe units are accessible through
-                                 * both standard PCIe slots and mini-PCIe
-                                 * slots on the board.
-                                 */
-                                pcie@1,0 {
-                                        /* Port 0, Lane 0 */
-                                        status = "okay";
-                                };
-                                pcie@2,0 {
-                                        /* Port 1, Lane 0 */
-                                        status = "okay";
-                                };
                         };
                 };
         };
diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
index 00d6a798c705..7f10f627ae5b 100644
--- a/arch/arm/boot/dts/armada-370-xp.dtsi
+++ b/arch/arm/boot/dts/armada-370-xp.dtsi
@@ -118,7 +118,7 @@
 
                         coherency-fabric@20200 {
                                 compatible = "marvell,coherency-fabric";
-                                reg = <0x20200 0xb0>, <0x21810 0x1c>;
+                                reg = <0x20200 0xb0>, <0x21010 0x1c>;
                         };
 
                         serial@12000 {
diff --git a/arch/arm/boot/dts/armada-xp-mv78230.dtsi b/arch/arm/boot/dts/armada-xp-mv78230.dtsi
index 3f5e6121c730..98335fb34b7a 100644
--- a/arch/arm/boot/dts/armada-xp-mv78230.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78230.dtsi
@@ -47,7 +47,7 @@
                 /*
                  * MV78230 has 2 PCIe units Gen2.0: One unit can be
                  * configured as x4 or quad x1 lanes. One unit is
-                 * x4/x1.
+                 * x1 only.
                  */
                 pcie-controller {
                         compatible = "marvell,armada-xp-pcie";
@@ -62,10 +62,10 @@
 
                         ranges =
                                <0x82000000 0 0x40000 MBUS_ID(0xf0, 0x01) 0x40000 0 0x00002000   /* Port 0.0 registers */
-                                0x82000000 0 0x42000 MBUS_ID(0xf0, 0x01) 0x42000 0 0x00002000   /* Port 2.0 registers */
                                 0x82000000 0 0x44000 MBUS_ID(0xf0, 0x01) 0x44000 0 0x00002000   /* Port 0.1 registers */
                                 0x82000000 0 0x48000 MBUS_ID(0xf0, 0x01) 0x48000 0 0x00002000   /* Port 0.2 registers */
                                 0x82000000 0 0x4c000 MBUS_ID(0xf0, 0x01) 0x4c000 0 0x00002000   /* Port 0.3 registers */
+                                0x82000000 0 0x80000 MBUS_ID(0xf0, 0x01) 0x80000 0 0x00002000   /* Port 1.0 registers */
                                 0x82000000 0x1 0       MBUS_ID(0x04, 0xe8) 0 1 0 /* Port 0.0 MEM */
                                 0x81000000 0x1 0       MBUS_ID(0x04, 0xe0) 0 1 0 /* Port 0.0 IO  */
                                 0x82000000 0x2 0       MBUS_ID(0x04, 0xd8) 0 1 0 /* Port 0.1 MEM */
@@ -74,8 +74,8 @@
                                 0x81000000 0x3 0       MBUS_ID(0x04, 0xb0) 0 1 0 /* Port 0.2 IO  */
                                 0x82000000 0x4 0       MBUS_ID(0x04, 0x78) 0 1 0 /* Port 0.3 MEM */
                                 0x81000000 0x4 0       MBUS_ID(0x04, 0x70) 0 1 0 /* Port 0.3 IO  */
-                                0x82000000 0x9 0       MBUS_ID(0x04, 0xf8) 0 1 0 /* Port 2.0 MEM */
-                                0x81000000 0x9 0       MBUS_ID(0x04, 0xf0) 0 1 0 /* Port 2.0 IO  */>;
+                                0x82000000 0x5 0       MBUS_ID(0x08, 0xe8) 0 1 0 /* Port 1.0 MEM */
+                                0x81000000 0x5 0       MBUS_ID(0x08, 0xe0) 0 1 0 /* Port 1.0 IO  */>;
 
                         pcie@1,0 {
                                 device_type = "pci";
@@ -145,20 +145,20 @@
                                 status = "disabled";
                         };
 
-                        pcie@9,0 {
+                        pcie@5,0 {
                                 device_type = "pci";
-                                assigned-addresses = <0x82000800 0 0x42000 0 0x2000>;
-                                reg = <0x4800 0 0 0 0>;
+                                assigned-addresses = <0x82000800 0 0x80000 0 0x2000>;
+                                reg = <0x2800 0 0 0 0>;
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0x9 0 1 0
-                                          0x81000000 0 0 0x81000000 0x9 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x5 0 1 0
+                                          0x81000000 0 0 0x81000000 0x5 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
-                                interrupt-map = <0 0 0 0 &mpic 99>;
-                                marvell,pcie-port = <2>;
+                                interrupt-map = <0 0 0 0 &mpic 62>;
+                                marvell,pcie-port = <1>;
                                 marvell,pcie-lane = <0>;
-                                clocks = <&gateclk 26>;
+                                clocks = <&gateclk 9>;
                                 status = "disabled";
                         };
                 };
diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
index 3e9fd1353f89..66609684d41b 100644
--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
@@ -48,7 +48,7 @@
                 /*
                  * MV78260 has 3 PCIe units Gen2.0: Two units can be
                  * configured as x4 or quad x1 lanes. One unit is
-                 * x4/x1.
+                 * x4 only.
                  */
                 pcie-controller {
                         compatible = "marvell,armada-xp-pcie";
@@ -68,7 +68,9 @@
                                 0x82000000 0 0x48000 MBUS_ID(0xf0, 0x01) 0x48000 0 0x00002000   /* Port 0.2 registers */
                                 0x82000000 0 0x4c000 MBUS_ID(0xf0, 0x01) 0x4c000 0 0x00002000   /* Port 0.3 registers */
                                 0x82000000 0 0x80000 MBUS_ID(0xf0, 0x01) 0x80000 0 0x00002000   /* Port 1.0 registers */
-                                0x82000000 0 0x82000 MBUS_ID(0xf0, 0x01) 0x82000 0 0x00002000   /* Port 3.0 registers */
+                                0x82000000 0 0x84000 MBUS_ID(0xf0, 0x01) 0x84000 0 0x00002000   /* Port 1.1 registers */
+                                0x82000000 0 0x88000 MBUS_ID(0xf0, 0x01) 0x88000 0 0x00002000   /* Port 1.2 registers */
+                                0x82000000 0 0x8c000 MBUS_ID(0xf0, 0x01) 0x8c000 0 0x00002000   /* Port 1.3 registers */
                                 0x82000000 0x1 0     MBUS_ID(0x04, 0xe8) 0 1 0 /* Port 0.0 MEM */
                                 0x81000000 0x1 0     MBUS_ID(0x04, 0xe0) 0 1 0 /* Port 0.0 IO  */
                                 0x82000000 0x2 0     MBUS_ID(0x04, 0xd8) 0 1 0 /* Port 0.1 MEM */
@@ -77,10 +79,18 @@
                                 0x81000000 0x3 0     MBUS_ID(0x04, 0xb0) 0 1 0 /* Port 0.2 IO  */
                                 0x82000000 0x4 0     MBUS_ID(0x04, 0x78) 0 1 0 /* Port 0.3 MEM */
                                 0x81000000 0x4 0     MBUS_ID(0x04, 0x70) 0 1 0 /* Port 0.3 IO  */
-                                0x82000000 0x9 0     MBUS_ID(0x08, 0xe8) 0 1 0 /* Port 1.0 MEM */
-                                0x81000000 0x9 0     MBUS_ID(0x08, 0xe0) 0 1 0 /* Port 1.0 IO  */
-                                0x82000000 0xa 0     MBUS_ID(0x08, 0xf8) 0 1 0 /* Port 3.0 MEM */
-                                0x81000000 0xa 0     MBUS_ID(0x08, 0xf0) 0 1 0 /* Port 3.0 IO  */>;
+
+                                0x82000000 0x5 0     MBUS_ID(0x08, 0xe8) 0 1 0 /* Port 1.0 MEM */
+                                0x81000000 0x5 0     MBUS_ID(0x08, 0xe0) 0 1 0 /* Port 1.0 IO  */
+                                0x82000000 0x6 0     MBUS_ID(0x08, 0xd8) 0 1 0 /* Port 1.1 MEM */
+                                0x81000000 0x6 0     MBUS_ID(0x08, 0xd0) 0 1 0 /* Port 1.1 IO  */
+                                0x82000000 0x7 0     MBUS_ID(0x08, 0xb8) 0 1 0 /* Port 1.2 MEM */
+                                0x81000000 0x7 0     MBUS_ID(0x08, 0xb0) 0 1 0 /* Port 1.2 IO  */
+                                0x82000000 0x8 0     MBUS_ID(0x08, 0x78) 0 1 0 /* Port 1.3 MEM */
+                                0x81000000 0x8 0     MBUS_ID(0x08, 0x70) 0 1 0 /* Port 1.3 IO  */
+
+                                0x82000000 0x9 0     MBUS_ID(0x04, 0xf8) 0 1 0 /* Port 2.0 MEM */
+                                0x81000000 0x9 0     MBUS_ID(0x04, 0xf0) 0 1 0 /* Port 2.0 IO  */>;
 
                         pcie@1,0 {
                                 device_type = "pci";
@@ -106,8 +116,8 @@
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0x2 0 1 0
-                                          0x81000000 0 0 0x81000000 0x2 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x2 0 1 0
+                                          0x81000000 0 0 0x81000000 0x2 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
                                 interrupt-map = <0 0 0 0 &mpic 59>;
                                 marvell,pcie-port = <0>;
@@ -150,37 +160,88 @@
                                 status = "disabled";
                         };
 
-                        pcie@9,0 {
+                        pcie@5,0 {
                                 device_type = "pci";
-                                assigned-addresses = <0x82000800 0 0x42000 0 0x2000>;
-                                reg = <0x4800 0 0 0 0>;
+                                assigned-addresses = <0x82000800 0 0x80000 0 0x2000>;
+                                reg = <0x2800 0 0 0 0>;
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0x9 0 1 0
-                                          0x81000000 0 0 0x81000000 0x9 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x5 0 1 0
+                                          0x81000000 0 0 0x81000000 0x5 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
-                                interrupt-map = <0 0 0 0 &mpic 99>;
-                                marvell,pcie-port = <2>;
+                                interrupt-map = <0 0 0 0 &mpic 62>;
+                                marvell,pcie-port = <1>;
                                 marvell,pcie-lane = <0>;
-                                clocks = <&gateclk 26>;
+                                clocks = <&gateclk 9>;
                                 status = "disabled";
                         };
 
-                        pcie@10,0 {
+                        pcie@6,0 {
                                 device_type = "pci";
-                                assigned-addresses = <0x82000800 0 0x82000 0 0x2000>;
-                                reg = <0x5000 0 0 0 0>;
+                                assigned-addresses = <0x82000800 0 0x84000 0 0x2000>;
+                                reg = <0x3000 0 0 0 0>;
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0xa 0 1 0
-                                          0x81000000 0 0 0x81000000 0xa 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x6 0 1 0
+                                          0x81000000 0 0 0x81000000 0x6 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
-                                interrupt-map = <0 0 0 0 &mpic 103>;
-                                marvell,pcie-port = <3>;
+                                interrupt-map = <0 0 0 0 &mpic 63>;
+                                marvell,pcie-port = <1>;
+                                marvell,pcie-lane = <1>;
+                                clocks = <&gateclk 10>;
+                                status = "disabled";
+                        };
+
+                        pcie@7,0 {
+                                device_type = "pci";
+                                assigned-addresses = <0x82000800 0 0x88000 0 0x2000>;
+                                reg = <0x3800 0 0 0 0>;
+                                #address-cells = <3>;
+                                #size-cells = <2>;
+                                #interrupt-cells = <1>;
+                                ranges = <0x82000000 0 0 0x82000000 0x7 0 1 0
+                                          0x81000000 0 0 0x81000000 0x7 0 1 0>;
+                                interrupt-map-mask = <0 0 0 0>;
+                                interrupt-map = <0 0 0 0 &mpic 64>;
+                                marvell,pcie-port = <1>;
+                                marvell,pcie-lane = <2>;
+                                clocks = <&gateclk 11>;
+                                status = "disabled";
+                        };
+
+                        pcie@8,0 {
+                                device_type = "pci";
+                                assigned-addresses = <0x82000800 0 0x8c000 0 0x2000>;
+                                reg = <0x4000 0 0 0 0>;
+                                #address-cells = <3>;
+                                #size-cells = <2>;
+                                #interrupt-cells = <1>;
+                                ranges = <0x82000000 0 0 0x82000000 0x8 0 1 0
+                                          0x81000000 0 0 0x81000000 0x8 0 1 0>;
+                                interrupt-map-mask = <0 0 0 0>;
+                                interrupt-map = <0 0 0 0 &mpic 65>;
+                                marvell,pcie-port = <1>;
+                                marvell,pcie-lane = <3>;
+                                clocks = <&gateclk 12>;
+                                status = "disabled";
+                        };
+
+                        pcie@9,0 {
+                                device_type = "pci";
+                                assigned-addresses = <0x82000800 0 0x42000 0 0x2000>;
+                                reg = <0x4800 0 0 0 0>;
+                                #address-cells = <3>;
+                                #size-cells = <2>;
+                                #interrupt-cells = <1>;
+                                ranges = <0x82000000 0 0 0x82000000 0x9 0 1 0
+                                          0x81000000 0 0 0x81000000 0x9 0 1 0>;
+                                interrupt-map-mask = <0 0 0 0>;
+                                interrupt-map = <0 0 0 0 &mpic 99>;
+                                marvell,pcie-port = <2>;
                                 marvell,pcie-lane = <0>;
-                                clocks = <&gateclk 27>;
+                                clocks = <&gateclk 26>;
                                 status = "disabled";
                         };
                 };
diff --git a/arch/arm/boot/dts/at91sam9x5_usart3.dtsi b/arch/arm/boot/dts/at91sam9x5_usart3.dtsi
index 2347e9563cef..6801106fa1f8 100644
--- a/arch/arm/boot/dts/at91sam9x5_usart3.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5_usart3.dtsi
@@ -11,6 +11,10 @@
 #include <dt-bindings/interrupt-controller/irq.h>
 
 / {
+        aliases {
+                serial4 = &usart3;
+        };
+
         ahb {
                 apb {
                         pinctrl@fffff400 {
diff --git a/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
index 9c18adf788f7..f577b7df9a29 100644
--- a/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
+++ b/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
@@ -44,8 +44,8 @@
                 gpmc,wr-access-ns = <186>;
                 gpmc,cycle2cycle-samecsen;
                 gpmc,cycle2cycle-diffcsen;
-                vmmc-supply = <&vddvario>;
-                vmmc_aux-supply = <&vdd33a>;
+                vddvario-supply = <&vddvario>;
+                vdd33a-supply = <&vdd33a>;
                 reg-io-width = <4>;
                 smsc,save-mac-address;
         };
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index 31a632f7effb..df33a50bc070 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -215,3 +215,10 @@
 &usbhsehci {
         phys = <0 &hsusb2_phy>;
 };
+
+&vaux2 {
+        regulator-name = "usb_1v8";
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-always-on;
+};
diff --git a/arch/arm/boot/dts/omap3-beagle.dts b/arch/arm/boot/dts/omap3-beagle.dts
index fa532aaacc68..3ba4a625ea5b 100644
--- a/arch/arm/boot/dts/omap3-beagle.dts
+++ b/arch/arm/boot/dts/omap3-beagle.dts
@@ -61,6 +61,14 @@
                 vcc-supply = <&hsusb2_power>;
         };
 
+        sound {
+                compatible = "ti,omap-twl4030";
+                ti,model = "omap3beagle";
+
+                ti,mcbsp = <&mcbsp2>;
+                ti,codec = <&twl_audio>;
+        };
+
         gpio_keys {
                 compatible = "gpio-keys";
 
@@ -120,6 +128,12 @@
                 reg = <0x48>;
                 interrupts = <7>; /* SYS_NIRQ cascaded to intc */
                 interrupt-parent = <&intc>;
+
+                twl_audio: audio {
+                        compatible = "ti,twl4030-audio";
+                        codec {
+                        };
+                };
         };
 };
 
@@ -178,3 +192,10 @@
         mode = <3>;
         power = <50>;
 };
+
+&vaux2 {
+        regulator-name = "vdd_ehci";
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-always-on;
+};
diff --git a/arch/arm/boot/dts/omap3-igep.dtsi b/arch/arm/boot/dts/omap3-igep.dtsi
index ba1e58b7b7e3..165aaf7591ba 100644
--- a/arch/arm/boot/dts/omap3-igep.dtsi
+++ b/arch/arm/boot/dts/omap3-igep.dtsi
@@ -1,5 +1,5 @@
 /*
- * Device Tree Source for IGEP Technology devices
+ * Common device tree for IGEP boards based on AM/DM37x
  *
  * Copyright (C) 2012 Javier Martinez Canillas <javier@collabora.co.uk>
  * Copyright (C) 2012 Enric Balletbo i Serra <eballetbo@gmail.com>
@@ -10,7 +10,7 @@
  */
 /dts-v1/;
 
-#include "omap34xx.dtsi"
+#include "omap36xx.dtsi"
 
 / {
         memory {
@@ -24,6 +24,25 @@
                 ti,mcbsp = <&mcbsp2>;
                 ti,codec = <&twl_audio>;
         };
+
+        vdd33: regulator-vdd33 {
+                compatible = "regulator-fixed";
+                regulator-name = "vdd33";
+                regulator-always-on;
+        };
+
+        lbee1usjyc_vmmc: lbee1usjyc_vmmc {
+                pinctrl-names = "default";
+                pinctrl-0 = <&lbee1usjyc_pins>;
+                compatible = "regulator-fixed";
+                regulator-name = "regulator-lbee1usjyc";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio5 10 GPIO_ACTIVE_HIGH>;    /* gpio_138 WIFI_PDN */
+                startup-delay-us = <10000>;
+                enable-active-high;
+                vin-supply = <&vdd33>;
+        };
 };
 
 &omap3_pmx_core {
@@ -48,6 +67,15 @@
                 >;
         };
 
+        /* WiFi/BT combo */
+        lbee1usjyc_pins: pinmux_lbee1usjyc_pins {
+                pinctrl-single,pins = <
+                        0x136 (PIN_OUTPUT | MUX_MODE4)  /* sdmmc2_dat5.gpio_137 */
+                        0x138 (PIN_OUTPUT | MUX_MODE4)  /* sdmmc2_dat6.gpio_138 */
+                        0x13a (PIN_OUTPUT | MUX_MODE4)  /* sdmmc2_dat7.gpio_139 */
+                >;
+        };
+
         mcbsp2_pins: pinmux_mcbsp2_pins {
                 pinctrl-single,pins = <
                         0x10c (PIN_INPUT | MUX_MODE0)           /* mcbsp2_fsx.mcbsp2_fsx */
@@ -65,10 +93,17 @@
                         0x11a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc1_dat1.sdmmc1_dat1 */
                         0x11c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc1_dat2.sdmmc1_dat2 */
                         0x11e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc1_dat3.sdmmc1_dat3 */
-                        0x120 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat4.sdmmc1_dat4 */
-                        0x122 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat5.sdmmc1_dat5 */
-                        0x124 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat6.sdmmc1_dat6 */
-                        0x126 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat7.sdmmc1_dat7 */
+                >;
+        };
+
+        mmc2_pins: pinmux_mmc2_pins {
+                pinctrl-single,pins = <
+                        0x128 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_clk.sdmmc2_clk */
+                        0x12a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_cmd.sdmmc2_cmd */
+                        0x12c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat0.sdmmc2_dat0 */
+                        0x12e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat1.sdmmc2_dat1 */
+                        0x130 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat2.sdmmc2_dat2 */
+                        0x132 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat3.sdmmc2_dat3 */
                 >;
         };
 
@@ -78,10 +113,33 @@
                 >;
         };
 
+        i2c1_pins: pinmux_i2c1_pins {
+                pinctrl-single,pins = <
+                        0x18a (PIN_INPUT | MUX_MODE0)   /* i2c1_scl.i2c1_scl */
+                        0x18c (PIN_INPUT | MUX_MODE0)   /* i2c1_sda.i2c1_sda */
+                >;
+        };
+
+        i2c2_pins: pinmux_i2c2_pins {
+                pinctrl-single,pins = <
+                        0x18e (PIN_INPUT | MUX_MODE0)   /* i2c2_scl.i2c2_scl */
+                        0x190 (PIN_INPUT | MUX_MODE0)   /* i2c2_sda.i2c2_sda */
+                >;
+        };
+
+        i2c3_pins: pinmux_i2c3_pins {
+                pinctrl-single,pins = <
+                        0x192 (PIN_INPUT | MUX_MODE0)   /* i2c3_scl.i2c3_scl */
+                        0x194 (PIN_INPUT | MUX_MODE0)   /* i2c3_sda.i2c3_sda */
+                >;
+        };
+
         leds_pins: pinmux_leds_pins { };
 };
 
 &i2c1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c1_pins>;
         clock-frequency = <2600000>;
 
         twl: twl@48 {
@@ -101,9 +159,16 @@
 #include "twl4030_omap3.dtsi"
 
 &i2c2 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c2_pins>;
         clock-frequency = <400000>;
 };
 
+&i2c3 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c3_pins>;
+};
+
 &mcbsp2 {
         pinctrl-names = "default";
         pinctrl-0 = <&mcbsp2_pins>;
@@ -114,11 +179,15 @@
       pinctrl-0 = <&mmc1_pins>;
       vmmc-supply = <&vmmc1>;
       vmmc_aux-supply = <&vsim>;
-      bus-width = <8>;
+      bus-width = <4>;
 };
 
 &mmc2 {
-        status = "disabled";
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc2_pins>;
+        vmmc-supply = <&lbee1usjyc_vmmc>;
+        bus-width = <4>;
+        non-removable;
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/omap3-igep0020.dts b/arch/arm/boot/dts/omap3-igep0020.dts
index d5cc79267250..1c7e74d2d2bc 100644
--- a/arch/arm/boot/dts/omap3-igep0020.dts
+++ b/arch/arm/boot/dts/omap3-igep0020.dts
@@ -1,5 +1,5 @@
 /*
- * Device Tree Source for IGEPv2 board
+ * Device Tree Source for IGEPv2 Rev. (TI OMAP AM/DM37x)
  *
  * Copyright (C) 2012 Javier Martinez Canillas <javier@collabora.co.uk>
  * Copyright (C) 2012 Enric Balletbo i Serra <eballetbo@gmail.com>
@@ -13,7 +13,7 @@
 #include "omap-gpmc-smsc911x.dtsi"
 
 / {
-        model = "IGEPv2";
+        model = "IGEPv2 (TI OMAP AM/DM37x)";
         compatible = "isee,omap3-igep0020", "ti,omap3";
 
         leds {
@@ -67,6 +67,8 @@
         pinctrl-names = "default";
         pinctrl-0 = <
                 &hsusbb1_pins
+                &tfp410_pins
+                &dss_pins
         >;
 
         hsusbb1_pins: pinmux_hsusbb1_pins {
@@ -85,6 +87,45 @@
                         0x5ba (PIN_INPUT_PULLDOWN | MUX_MODE3)  /* etk_d7.hsusb1_data3 */
                 >;
         };
+
+        tfp410_pins: tfp410_dvi_pins {
+                pinctrl-single,pins = <
+                        0x196 (PIN_OUTPUT | MUX_MODE4)   /* hdq_sio.gpio_170 */
+                >;
+        };
+
+        dss_pins: pinmux_dss_dvi_pins {
+                pinctrl-single,pins = <
+                        0x0a4 (PIN_OUTPUT | MUX_MODE0)   /* dss_pclk.dss_pclk */
+                        0x0a6 (PIN_OUTPUT | MUX_MODE0)   /* dss_hsync.dss_hsync */
+                        0x0a8 (PIN_OUTPUT | MUX_MODE0)   /* dss_vsync.dss_vsync */
+                        0x0aa (PIN_OUTPUT | MUX_MODE0)   /* dss_acbias.dss_acbias */
+                        0x0ac (PIN_OUTPUT | MUX_MODE0)   /* dss_data0.dss_data0 */
+                        0x0ae (PIN_OUTPUT | MUX_MODE0)   /* dss_data1.dss_data1 */
+                        0x0b0 (PIN_OUTPUT | MUX_MODE0)   /* dss_data2.dss_data2 */
+                        0x0b2 (PIN_OUTPUT | MUX_MODE0)   /* dss_data3.dss_data3 */
+                        0x0b4 (PIN_OUTPUT | MUX_MODE0)   /* dss_data4.dss_data4 */
+                        0x0b6 (PIN_OUTPUT | MUX_MODE0)   /* dss_data5.dss_data5 */
+                        0x0b8 (PIN_OUTPUT | MUX_MODE0)   /* dss_data6.dss_data6 */
+                        0x0ba (PIN_OUTPUT | MUX_MODE0)   /* dss_data7.dss_data7 */
+                        0x0bc (PIN_OUTPUT | MUX_MODE0)   /* dss_data8.dss_data8 */
+                        0x0be (PIN_OUTPUT | MUX_MODE0)   /* dss_data9.dss_data9 */
+                        0x0c0 (PIN_OUTPUT | MUX_MODE0)   /* dss_data10.dss_data10 */
+                        0x0c2 (PIN_OUTPUT | MUX_MODE0)   /* dss_data11.dss_data11 */
+                        0x0c4 (PIN_OUTPUT | MUX_MODE0)   /* dss_data12.dss_data12 */
+                        0x0c6 (PIN_OUTPUT | MUX_MODE0)   /* dss_data13.dss_data13 */
+                        0x0c8 (PIN_OUTPUT | MUX_MODE0)   /* dss_data14.dss_data14 */
+                        0x0ca (PIN_OUTPUT | MUX_MODE0)   /* dss_data15.dss_data15 */
+                        0x0cc (PIN_OUTPUT | MUX_MODE0)   /* dss_data16.dss_data16 */
+                        0x0ce (PIN_OUTPUT | MUX_MODE0)   /* dss_data17.dss_data17 */
+                        0x0d0 (PIN_OUTPUT | MUX_MODE0)   /* dss_data18.dss_data18 */
+                        0x0d2 (PIN_OUTPUT | MUX_MODE0)   /* dss_data19.dss_data19 */
+                        0x0d4 (PIN_OUTPUT | MUX_MODE0)   /* dss_data20.dss_data20 */
+                        0x0d6 (PIN_OUTPUT | MUX_MODE0)   /* dss_data21.dss_data21 */
+                        0x0d8 (PIN_OUTPUT | MUX_MODE0)   /* dss_data22.dss_data22 */
+                        0x0da (PIN_OUTPUT | MUX_MODE0)   /* dss_data23.dss_data23 */
+                >;
+        };
 };
 
 &leds_pins {
@@ -174,3 +215,8 @@
 &usbhsehci {
         phys = <&hsusb1_phy>;
 };
+
+&vpll2 {
+        /* Needed for DSS */
+        regulator-name = "vdds_dsi";
+};
diff --git a/arch/arm/boot/dts/omap3-igep0030.dts b/arch/arm/boot/dts/omap3-igep0030.dts
index 525e6d9b0978..02a23f8a3384 100644
--- a/arch/arm/boot/dts/omap3-igep0030.dts
+++ b/arch/arm/boot/dts/omap3-igep0030.dts
@@ -1,5 +1,5 @@
 /*
- * Device Tree Source for IGEP COM Module
+ * Device Tree Source for IGEP COM MODULE (TI OMAP AM/DM37x)
  *
  * Copyright (C) 2012 Javier Martinez Canillas <javier@collabora.co.uk>
  * Copyright (C) 2012 Enric Balletbo i Serra <eballetbo@gmail.com>
@@ -12,7 +12,7 @@
 #include "omap3-igep.dtsi"
 
 / {
-        model = "IGEP COM Module";
+        model = "IGEP COM MODULE (TI OMAP AM/DM37x)";
         compatible = "isee,omap3-igep0030", "ti,omap3";
 
         leds {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index c4f20bfe4cce..c2c306d13b87 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -125,6 +125,21 @@
                 >;
         };
 
+        mmc2_pins: pinmux_mmc2_pins {
+                pinctrl-single,pins = <
+                        0x128 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_clk */
+                        0x12a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_cmd */
+                        0x12c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat0 */
+                        0x12e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat1 */
+                        0x130 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat2 */
+                        0x132 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat3 */
+                        0x134 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat4 */
+                        0x136 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat5 */
+                        0x138 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat6 */
+                        0x13a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat7 */
+                >;
+        };
+
         display_pins: pinmux_display_pins {
                 pinctrl-single,pins = <
                         0x0d4 (PIN_OUTPUT | MUX_MODE4)          /* RX51_LCD_RESET_GPIO */
@@ -358,8 +373,14 @@
         cd-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>; /* 160 */
 };
 
+/* most boards use vaux3, only some old versions use vmmc2 instead */
 &mmc2 {
-        status = "disabled";
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc2_pins>;
+        vmmc-supply = <&vaux3>;
+        vmmc_aux-supply = <&vsim>;
+        bus-width = <8>;
+        non-removable;
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index f3a0c26ed0c2..daabf99d402a 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -82,6 +82,13 @@
                 ranges;
                 ti,hwmods = "l3_main";
 
+                aes: aes@480c5000 {
+                        compatible = "ti,omap3-aes";
+                        ti,hwmods = "aes";
+                        reg = <0x480c5000 0x50>;
+                        interrupts = <0>;
+                };
+
                 counter32k: counter@48320000 {
                         compatible = "ti,omap-counter32k";
                         reg = <0x48320000 0x20>;
@@ -260,6 +267,13 @@
                         ti,hwmods = "i2c3";
                 };
 
+                mailbox: mailbox@48094000 {
+                        compatible = "ti,omap3-mailbox";
+                        ti,hwmods = "mailbox";
+                        reg = <0x48094000 0x200>;
+                        interrupts = <26>;
+                };
+
                 mcspi1: spi@48098000 {
                         compatible = "ti,omap2-mcspi";
                         reg = <0x48098000 0x100>;
@@ -357,6 +371,13 @@
                         dma-names = "tx", "rx";
                 };
 
+                mmu_isp: mmu@480bd400 {
+                        compatible = "ti,omap3-mmu-isp";
+                        ti,hwmods = "mmu_isp";
+                        reg = <0x480bd400 0x80>;
+                        interrupts = <8>;
+                };
+
                 wdt2: wdt@48314000 {
                         compatible = "ti,omap3-wdt";
                         reg = <0x48314000 0x80>;
@@ -442,6 +463,27 @@
                         dma-names = "tx", "rx";
                 };
 
+                sham: sham@480c3000 {
+                        compatible = "ti,omap3-sham";
+                        ti,hwmods = "sham";
+                        reg = <0x480c3000 0x64>;
+                        interrupts = <49>;
+                };
+
+                smartreflex_core: smartreflex@480cb000 {
+                        compatible = "ti,omap3-smartreflex-core";
+                        ti,hwmods = "smartreflex_core";
+                        reg = <0x480cb000 0x400>;
+                        interrupts = <19>;
+                };
+
+                smartreflex_mpu_iva: smartreflex@480c9000 {
+                        compatible = "ti,omap3-smartreflex-iva";
+                        ti,hwmods = "smartreflex_mpu_iva";
+                        reg = <0x480c9000 0x400>;
+                        interrupts = <18>;
+                };
+
                 timer1: timer@48318000 {
                         compatible = "ti,omap3430-timer";
                         reg = <0x48318000 0x400>;
diff --git a/arch/arm/boot/dts/omap4-panda-common.dtsi b/arch/arm/boot/dts/omap4-panda-common.dtsi
index 298e85020e1b..88c6a05cab41 100644
--- a/arch/arm/boot/dts/omap4-panda-common.dtsi
+++ b/arch/arm/boot/dts/omap4-panda-common.dtsi
@@ -246,15 +246,6 @@
                         0xf0 (PIN_INPUT_PULLUP | MUX_MODE0)     /* i2c4_sda */
                 >;
         };
-};
-
-&omap4_pmx_wkup {
-        led_wkgpio_pins: pinmux_leds_wkpins {
-                pinctrl-single,pins = <
-                        0x1a (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk7 */
-                        0x1c (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk8 */
-                >;
-        };
 
         /*
          * wl12xx GPIO outputs for WLAN_EN, BT_EN, FM_EN, BT_WAKEUP
@@ -274,7 +265,7 @@
                 pinctrl-single,pins = <
                         0x38 (PIN_INPUT | MUX_MODE3)            /* gpmc_ncs2.gpio_52 */
                         0x3a (PIN_INPUT | MUX_MODE3)            /* gpmc_ncs3.gpio_53 */
-                        0x108 (PIN_OUTPUT | MUX_MODE0)          /* sdmmc5_clk.sdmmc5_clk */
+                        0x108 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_clk.sdmmc5_clk */
                         0x10a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_cmd.sdmmc5_cmd */
                         0x10c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat0.sdmmc5_dat0 */
                         0x10e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat1.sdmmc5_dat1 */
@@ -284,6 +275,15 @@
         };
 };
 
+&omap4_pmx_wkup {
+        led_wkgpio_pins: pinmux_leds_wkpins {
+                pinctrl-single,pins = <
+                        0x1a (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk7 */
+                        0x1c (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk8 */
+                >;
+        };
+};
+
 &i2c1 {
         pinctrl-names = "default";
         pinctrl-0 = <&i2c1_pins>;
diff --git a/arch/arm/boot/dts/omap4-sdp.dts b/arch/arm/boot/dts/omap4-sdp.dts
index 5fc3f43c5a81..dbc81fb6ef03 100644
--- a/arch/arm/boot/dts/omap4-sdp.dts
+++ b/arch/arm/boot/dts/omap4-sdp.dts
@@ -300,12 +300,12 @@
         wl12xx_pins: pinmux_wl12xx_pins {
                 pinctrl-single,pins = <
                         0x3a (PIN_INPUT | MUX_MODE3)            /* gpmc_ncs3.gpio_53 */
-                        0x108 (PIN_OUTPUT | MUX_MODE3)          /* sdmmc5_clk.sdmmc5_clk */
-                        0x10a (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_cmd.sdmmc5_cmd */
-                        0x10c (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat0.sdmmc5_dat0 */
-                        0x10e (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat1.sdmmc5_dat1 */
-                        0x110 (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat2.sdmmc5_dat2 */
-                        0x112 (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat3.sdmmc5_dat3 */
+                        0x108 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_clk.sdmmc5_clk */
+                        0x10a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_cmd.sdmmc5_cmd */
+                        0x10c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat0.sdmmc5_dat0 */
+                        0x10e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat1.sdmmc5_dat1 */
+                        0x110 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat2.sdmmc5_dat2 */
+                        0x112 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat3.sdmmc5_dat3 */
                 >;
         };
 };
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 6d09b8d42fdd..f936476c2753 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -245,14 +245,14 @@
 
                                         mpu_periph_clk: mpu_periph_clk {
                                                 #clock-cells = <0>;
-                                                compatible = "altr,socfpga-gate-clk";
+                                                compatible = "altr,socfpga-perip-clk";
                                                 clocks = <&mpuclk>;
                                                 fixed-divider = <4>;
                                         };
 
                                         mpu_l2_ram_clk: mpu_l2_ram_clk {
                                                 #clock-cells = <0>;
-                                                compatible = "altr,socfpga-gate-clk";
+                                                compatible = "altr,socfpga-perip-clk";
                                                 clocks = <&mpuclk>;
                                                 fixed-divider = <2>;
                                         };
@@ -266,8 +266,9 @@
 
                                         l3_main_clk: l3_main_clk {
                                                 #clock-cells = <0>;
-                                                compatible = "altr,socfpga-gate-clk";
+                                                compatible = "altr,socfpga-perip-clk";
                                                 clocks = <&mainclk>;
+                                                fixed-divider = <1>;
                                         };
 
                                         l3_mp_clk: l3_mp_clk {
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 4a5903e04827..c1df4e9db140 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -69,6 +69,7 @@ CONFIG_KS8851=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=y
 CONFIG_MDIO_SUN4I=y
+CONFIG_TI_CPSW=y
 CONFIG_KEYBOARD_SPEAR=y
 CONFIG_SERIO_AMBAKMI=y
 CONFIG_SERIAL_8250=y
@@ -133,12 +134,14 @@ CONFIG_USB_GPIO_VBUS=y
 CONFIG_USB_ISP1301=y
 CONFIG_USB_MXS_PHY=y
 CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=16
 CONFIG_MMC_ARMMMCI=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_ESDHC_IMX=y
 CONFIG_MMC_SDHCI_TEGRA=y
 CONFIG_MMC_SDHCI_SPEAR=y
+CONFIG_MMC_SDHCI_BCM_KONA=y
 CONFIG_MMC_OMAP=y
 CONFIG_MMC_OMAP_HS=y
 CONFIG_EDAC=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index 98a50c309b90..bfa80a11e8c7 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -173,6 +173,7 @@ CONFIG_MFD_PALMAS=y
 CONFIG_MFD_TPS65217=y
 CONFIG_MFD_TPS65910=y
 CONFIG_TWL6040_CORE=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_PALMAS=y
 CONFIG_REGULATOR_TPS65023=y
 CONFIG_REGULATOR_TPS6507X=y
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index d57a85badb5e..3e2259b60236 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -12,6 +12,9 @@ CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_INET=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
@@ -58,4 +61,8 @@ CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_COMMON_CLK_DEBUG=y
 # CONFIG_IOMMU_SUPPORT is not set
+CONFIG_TMPFS=y
+CONFIG_NFS_FS=y
+CONFIG_ROOT_NFS=y
 CONFIG_NLS=y
+CONFIG_PRINTK_TIME=y
diff --git a/arch/arm/configs/u8500_defconfig b/arch/arm/configs/u8500_defconfig
index ac632cc38f24..c6ebc184bf68 100644
--- a/arch/arm/configs/u8500_defconfig
+++ b/arch/arm/configs/u8500_defconfig
@@ -22,6 +22,7 @@ CONFIG_CMDLINE="root=/dev/ram0 console=ttyAMA2,115200n8"
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 CONFIG_CPU_IDLE=y
+CONFIG_ARM_U8500_CPUIDLE=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_PM_RUNTIME=y
@@ -109,6 +110,8 @@ CONFIG_EXT2_FS_SECURITY=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS=y
 CONFIG_VFAT_FS=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_MISC_FILESYSTEMS is not set
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index be956dbf6bae..1571d126e9dd 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -61,7 +61,7 @@ extern void __pgd_error(const char *file, int line, pgd_t);
  * mapping to be mapped at.  This is particularly important for
  * non-high vector CPUs.
  */
-#define FIRST_USER_ADDRESS      PAGE_SIZE
+#define FIRST_USER_ADDRESS      (PAGE_SIZE * 2)
 
 /*
  * Use TASK_SIZE as the ceiling argument for free_pgtables() and
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 57221e349a7c..f0d180d8b29f 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -14,11 +14,12 @@
 #include <asm/pgalloc.h>
 #include <asm/mmu_context.h>
 #include <asm/cacheflush.h>
+#include <asm/fncpy.h>
 #include <asm/mach-types.h>
 #include <asm/smp_plat.h>
 #include <asm/system_misc.h>
 
-extern const unsigned char relocate_new_kernel[];
+extern void relocate_new_kernel(void);
 extern const unsigned int relocate_new_kernel_size;
 
 extern unsigned long kexec_start_address;
@@ -142,6 +143,8 @@ void machine_kexec(struct kimage *image)
 {
         unsigned long page_list;
         unsigned long reboot_code_buffer_phys;
+        unsigned long reboot_entry = (unsigned long)relocate_new_kernel;
+        unsigned long reboot_entry_phys;
         void *reboot_code_buffer;
 
         /*
@@ -168,16 +171,16 @@ void machine_kexec(struct kimage *image)
 
 
         /* copy our kernel relocation code to the control code page */
-        memcpy(reboot_code_buffer,
-               relocate_new_kernel, relocate_new_kernel_size);
+        reboot_entry = fncpy(reboot_code_buffer,
+                             reboot_entry,
+                             relocate_new_kernel_size);
+        reboot_entry_phys = (unsigned long)reboot_entry +
+                (reboot_code_buffer_phys - (unsigned long)reboot_code_buffer);
 
-
-        flush_icache_range((unsigned long) reboot_code_buffer,
-                           (unsigned long) reboot_code_buffer + KEXEC_CONTROL_PAGE_SIZE);
         printk(KERN_INFO "Bye!\n");
 
         if (kexec_reinit)
                 kexec_reinit();
 
-        soft_restart(reboot_code_buffer_phys);
+        soft_restart(reboot_entry_phys);
 }
diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
index d0cdedf4864d..95858966d84e 100644
--- a/arch/arm/kernel/relocate_kernel.S
+++ b/arch/arm/kernel/relocate_kernel.S
@@ -2,10 +2,12 @@
  * relocate_kernel.S - put the kernel image in place to boot
  */
 
+#include <linux/linkage.h>
 #include <asm/kexec.h>
 
-        .globl relocate_new_kernel
-relocate_new_kernel:
+        .align  3       /* not needed for this code, but keeps fncpy() happy */
+
+ENTRY(relocate_new_kernel)
 
         ldr     r0,kexec_indirection_page
         ldr     r1,kexec_start_address
@@ -79,6 +81,8 @@ kexec_mach_type:
 kexec_boot_atags:
         .long   0x0
 
+ENDPROC(relocate_new_kernel)
+
 relocate_new_kernel_end:
 
         .globl relocate_new_kernel_size
diff --git a/arch/arm/kernel/sigreturn_codes.S b/arch/arm/kernel/sigreturn_codes.S
index 3c5d0f2170fd..b84d0cb13682 100644
--- a/arch/arm/kernel/sigreturn_codes.S
+++ b/arch/arm/kernel/sigreturn_codes.S
@@ -30,6 +30,27 @@
  * snippets.
  */
 
+/*
+ * In CPU_THUMBONLY case kernel arm opcodes are not allowed.
+ * Note in this case codes skips those instructions but it uses .org
+ * directive to keep correct layout of sigreturn_codes array.
+ */
+#ifndef CONFIG_CPU_THUMBONLY
+#define ARM_OK(code...) code
+#else
+#define ARM_OK(code...)
+#endif
+
+        .macro arm_slot n
+        .org    sigreturn_codes + 12 * (\n)
+ARM_OK( .arm    )
+        .endm
+
+        .macro thumb_slot n
+        .org    sigreturn_codes + 12 * (\n) + 8
+        .thumb
+        .endm
+
 #if __LINUX_ARM_ARCH__ <= 4
         /*
          * Note we manually set minimally required arch that supports
@@ -45,26 +66,27 @@
         .global sigreturn_codes
         .type   sigreturn_codes, #object
 
-        .arm
+        .align
 
 sigreturn_codes:
 
         /* ARM sigreturn syscall code snippet */
-        mov     r7, #(__NR_sigreturn - __NR_SYSCALL_BASE)
-        swi     #(__NR_sigreturn)|(__NR_OABI_SYSCALL_BASE)
+        arm_slot 0
+ARM_OK( mov     r7, #(__NR_sigreturn - __NR_SYSCALL_BASE)       )
+ARM_OK( swi     #(__NR_sigreturn)|(__NR_OABI_SYSCALL_BASE)      )
 
         /* Thumb sigreturn syscall code snippet */
-        .thumb
+        thumb_slot 0
         movs    r7, #(__NR_sigreturn - __NR_SYSCALL_BASE)
         swi     #0
 
         /* ARM sigreturn_rt syscall code snippet */
-        .arm
-        mov     r7, #(__NR_rt_sigreturn - __NR_SYSCALL_BASE)
-        swi     #(__NR_rt_sigreturn)|(__NR_OABI_SYSCALL_BASE)
+        arm_slot 1
+ARM_OK( mov     r7, #(__NR_rt_sigreturn - __NR_SYSCALL_BASE)    )
+ARM_OK( swi     #(__NR_rt_sigreturn)|(__NR_OABI_SYSCALL_BASE)   )
 
         /* Thumb sigreturn_rt syscall code snippet */
-        .thumb
+        thumb_slot 1
         movs    r7, #(__NR_rt_sigreturn - __NR_SYSCALL_BASE)
         swi     #0
 
@@ -74,7 +96,7 @@ sigreturn_codes:
          * it is thumb case or not, so we need additional
          * word after real last entry.
          */
-        .arm
+        arm_slot 2
         .space  4
 
         .size   sigreturn_codes, . - sigreturn_codes
diff --git a/arch/arm/lib/delay-loop.S b/arch/arm/lib/delay-loop.S
index 36b668d8e121..bc1033b897b4 100644
--- a/arch/arm/lib/delay-loop.S
+++ b/arch/arm/lib/delay-loop.S
@@ -40,6 +40,7 @@ ENTRY(__loop_const_udelay)			@ 0 <= r0 <= 0x7fffff06
 /*
  * loops = r0 * HZ * loops_per_jiffy / 1000000
  */
+                .align 3
 
 @ Delay routine
 ENTRY(__loop_delay)
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index f607deb40f4d..bc7b363a3083 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -174,7 +174,6 @@ clkevt32k_next_event(unsigned long delta, struct clock_event_device *dev)
 static struct clock_event_device clkevt = {
         .name           = "at91_tick",
         .features       = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
-        .shift          = 32,
         .rating         = 150,
         .set_next_event = clkevt32k_next_event,
         .set_mode       = clkevt32k_mode,
@@ -265,11 +264,9 @@ void __init at91rm9200_timer_init(void)
         at91_st_write(AT91_ST_RTMR, 1);
 
         /* Setup timer clockevent, with minimum of two ticks (important!!) */
-        clkevt.mult = div_sc(AT91_SLOW_CLOCK, NSEC_PER_SEC, clkevt.shift);
-        clkevt.max_delta_ns = clockevent_delta2ns(AT91_ST_ALMV, &clkevt);
-        clkevt.min_delta_ns = clockevent_delta2ns(2, &clkevt) + 1;
         clkevt.cpumask = cpumask_of(0);
-        clockevents_register_device(&clkevt);
+        clockevents_config_and_register(&clkevt, AT91_SLOW_CLOCK,
+                                        2, AT91_ST_ALMV);
 
         /* register clocksource */
         clocksource_register_hz(&clk32k, AT91_SLOW_CLOCK);
diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
index 3ed190ce062b..c5101dcb4fb0 100644
--- a/arch/arm/mach-at91/pm.h
+++ b/arch/arm/mach-at91/pm.h
@@ -16,7 +16,11 @@
 #include <mach/at91_ramc.h>
 #include <mach/at91rm9200_sdramc.h>
 
+#ifdef CONFIG_PM
 extern void at91_pm_set_standby(void (*at91_standby)(void));
+#else
+static inline void at91_pm_set_standby(void (*at91_standby)(void)) { }
+#endif
 
 /*
  * The AT91RM9200 goes into self-refresh mode with this command, and will
diff --git a/arch/arm/mach-at91/sama5d3.c b/arch/arm/mach-at91/sama5d3.c
index 3ea86428ee09..a28873fe3049 100644
--- a/arch/arm/mach-at91/sama5d3.c
+++ b/arch/arm/mach-at91/sama5d3.c
@@ -95,19 +95,19 @@ static struct clk twi0_clk = {
         .name           = "twi0_clk",
         .pid            = SAMA5D3_ID_TWI0,
         .type           = CLK_TYPE_PERIPHERAL,
-        .div            = AT91_PMC_PCR_DIV2,
+        .div            = AT91_PMC_PCR_DIV8,
 };
 static struct clk twi1_clk = {
         .name           = "twi1_clk",
         .pid            = SAMA5D3_ID_TWI1,
         .type           = CLK_TYPE_PERIPHERAL,
-        .div            = AT91_PMC_PCR_DIV2,
+        .div            = AT91_PMC_PCR_DIV8,
 };
 static struct clk twi2_clk = {
         .name           = "twi2_clk",
         .pid            = SAMA5D3_ID_TWI2,
         .type           = CLK_TYPE_PERIPHERAL,
-        .div            = AT91_PMC_PCR_DIV2,
+        .div            = AT91_PMC_PCR_DIV8,
 };
 static struct clk mmc0_clk = {
         .name           = "mci0_clk",
diff --git a/arch/arm/mach-footbridge/common.c b/arch/arm/mach-footbridge/common.c
index 2739ca2c1334..e0091685fd48 100644
--- a/arch/arm/mach-footbridge/common.c
+++ b/arch/arm/mach-footbridge/common.c
@@ -15,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/spinlock.h>
+#include <video/vga.h>
 
 #include <asm/pgtable.h>
 #include <asm/page.h>
@@ -196,6 +197,8 @@ void __init footbridge_map_io(void)
                 iotable_init(ebsa285_host_io_desc, ARRAY_SIZE(ebsa285_host_io_desc));
                 pci_map_io_early(__phys_to_pfn(DC21285_PCI_IO));
         }
+
+        vga_base = PCIMEM_BASE;
 }
 
 void footbridge_restart(enum reboot_mode mode, const char *cmd)
diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
index 3490a24f969e..7c2fdae9a38b 100644
--- a/arch/arm/mach-footbridge/dc21285.c
+++ b/arch/arm/mach-footbridge/dc21285.c
@@ -18,7 +18,6 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/spinlock.h>
-#include <video/vga.h>
 
 #include <asm/irq.h>
 #include <asm/mach/pci.h>
@@ -291,7 +290,6 @@ void __init dc21285_preinit(void)
         int cfn_mode;
 
         pcibios_min_mem = 0x81000000;
-        vga_base = PCIMEM_BASE;
 
         mem_size = (unsigned int)high_memory - PAGE_OFFSET;
         for (mem_mask = 0x00100000; mem_mask < 0x10000000; mem_mask <<= 1)
diff --git a/arch/arm/mach-footbridge/ebsa285.c b/arch/arm/mach-footbridge/ebsa285.c
index b08243500e2e..1a7235fb52ac 100644
--- a/arch/arm/mach-footbridge/ebsa285.c
+++ b/arch/arm/mach-footbridge/ebsa285.c
@@ -30,21 +30,24 @@ static const struct {
         const char *name;
         const char *trigger;
 } ebsa285_leds[] = {
-        { "ebsa285:amber", "heartbeat", },
-        { "ebsa285:green", "cpu0", },
+        { "ebsa285:amber", "cpu0", },
+        { "ebsa285:green", "heartbeat", },
         { "ebsa285:red",},
 };
 
+static unsigned char hw_led_state;
+
 static void ebsa285_led_set(struct led_classdev *cdev,
                 enum led_brightness b)
 {
         struct ebsa285_led *led = container_of(cdev,
                         struct ebsa285_led, cdev);
 
-        if (b != LED_OFF)
-                *XBUS_LEDS |= led->mask;
+        if (b == LED_OFF)
+                hw_led_state |= led->mask;
         else
-                *XBUS_LEDS &= ~led->mask;
+                hw_led_state &= ~led->mask;
+        *XBUS_LEDS = hw_led_state;
 }
 
 static enum led_brightness ebsa285_led_get(struct led_classdev *cdev)
@@ -52,18 +55,19 @@ static enum led_brightness ebsa285_led_get(struct led_classdev *cdev)
         struct ebsa285_led *led = container_of(cdev,
                         struct ebsa285_led, cdev);
 
-        return (*XBUS_LEDS & led->mask) ? LED_FULL : LED_OFF;
+        return hw_led_state & led->mask ? LED_OFF : LED_FULL;
 }
 
 static int __init ebsa285_leds_init(void)
 {
         int i;
 
-        if (machine_is_ebsa285())
+        if (!machine_is_ebsa285())
                 return -ENODEV;
 
-        /* 3 LEDS All ON */
-        *XBUS_LEDS |= XBUS_LED_AMBER | XBUS_LED_GREEN | XBUS_LED_RED;
+        /* 3 LEDS all off */
+        hw_led_state = XBUS_LED_AMBER | XBUS_LED_GREEN | XBUS_LED_RED;
+        *XBUS_LEDS = hw_led_state;
 
         for (i = 0; i < ARRAY_SIZE(ebsa285_leds); i++) {
                 struct ebsa285_led *led;
diff --git a/arch/arm/mach-omap2/dss-common.c b/arch/arm/mach-omap2/dss-common.c
index 365bfd3d9c68..dadccc91488c 100644
--- a/arch/arm/mach-omap2/dss-common.c
+++ b/arch/arm/mach-omap2/dss-common.c
@@ -223,7 +223,7 @@ void __init omap_4430sdp_display_init_of(void)
 static struct connector_dvi_platform_data omap3_igep2_dvi_connector_pdata = {
         .name                   = "dvi",
         .source                 = "tfp410.0",
-        .i2c_bus_num            = 3,
+        .i2c_bus_num            = 2,
 };
 
 static struct platform_device omap3_igep2_dvi_connector_device = {
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 10c71450cf63..39f020c982e8 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -139,6 +139,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 
 static struct pdata_init pdata_quirks[] __initdata = {
 #ifdef CONFIG_ARCH_OMAP3
+        { "nokia,omap3-n900", hsmmc2_internal_input_clk, },
         { "nokia,omap3-n9", hsmmc2_internal_input_clk, },
         { "nokia,omap3-n950", hsmmc2_internal_input_clk, },
         { "isee,omap3-igep0020", omap3_igep0020_legacy_init, },
diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c
index e233dfcbc186..93a2a6e4260f 100644
--- a/arch/arm/mach-omap2/powerdomain.c
+++ b/arch/arm/mach-omap2/powerdomain.c
@@ -128,7 +128,8 @@ skip_voltdm:
         for (i = 0; i < pwrdm->banks; i++)
                 pwrdm->ret_mem_off_counter[i] = 0;
 
-        arch_pwrdm->pwrdm_wait_transition(pwrdm);
+        if (arch_pwrdm && arch_pwrdm->pwrdm_wait_transition)
+                arch_pwrdm->pwrdm_wait_transition(pwrdm);
         pwrdm->state = pwrdm_read_pwrst(pwrdm);
         pwrdm->state_counter[pwrdm->state] = 1;
 
diff --git a/arch/arm/mach-socfpga/Kconfig b/arch/arm/mach-socfpga/Kconfig
index 037100a1563a..aee77f06f887 100644
--- a/arch/arm/mach-socfpga/Kconfig
+++ b/arch/arm/mach-socfpga/Kconfig
@@ -10,6 +10,7 @@ config ARCH_SOCFPGA
         select GENERIC_CLOCKEVENTS
         select GPIO_PL061 if GPIOLIB
         select HAVE_ARM_SCU
+        select HAVE_ARM_TWD if SMP
         select HAVE_SMP
         select MFD_SYSCON
         select SPARSE_IRQ
diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c
index 2e85c1e72535..12c7e5c03ea4 100644
--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
@@ -140,6 +140,10 @@ static struct of_dev_auxdata u8500_auxdata_lookup[] __initdata = {
         /* Requires call-back bindings. */
         OF_DEV_AUXDATA("arm,cortex-a9-pmu", 0, "arm-pmu", &db8500_pmu_platdata),
         /* Requires DMA bindings. */
+        OF_DEV_AUXDATA("arm,pl18x", 0x80126000, "sdi0",  &mop500_sdi0_data),
+        OF_DEV_AUXDATA("arm,pl18x", 0x80118000, "sdi1",  &mop500_sdi1_data),
+        OF_DEV_AUXDATA("arm,pl18x", 0x80005000, "sdi2",  &mop500_sdi2_data),
+        OF_DEV_AUXDATA("arm,pl18x", 0x80114000, "sdi4",  &mop500_sdi4_data),
         OF_DEV_AUXDATA("stericsson,ux500-msp-i2s", 0x80123000,
                        "ux500-msp-i2s.0", &msp0_platform_data),
         OF_DEV_AUXDATA("stericsson,ux500-msp-i2s", 0x80124000,
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 79f8b39801a8..f6b6bfa88ecf 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -9,6 +9,7 @@
  *
  *  DMA uncached mapping support.
  */
+#include <linux/bootmem.h>
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/gfp.h>
@@ -162,6 +163,8 @@ static u64 get_coherent_dma_mask(struct device *dev)
         u64 mask = (u64)DMA_BIT_MASK(32);
 
         if (dev) {
+                unsigned long max_dma_pfn;
+
                 mask = dev->coherent_dma_mask;
 
                 /*
@@ -173,6 +176,8 @@ static u64 get_coherent_dma_mask(struct device *dev)
                         return 0;
                 }
 
+                max_dma_pfn = min(max_pfn, arm_dma_pfn_limit);
+
                 /*
                  * If the mask allows for more memory than we can address,
                  * and we actually have that much memory, then fail the
@@ -180,7 +185,7 @@ static u64 get_coherent_dma_mask(struct device *dev)
                  */
                 if (sizeof(mask) != sizeof(dma_addr_t) &&
                     mask > (dma_addr_t)~0 &&
-                    dma_to_pfn(dev, ~0) > arm_dma_pfn_limit) {
+                    dma_to_pfn(dev, ~0) > max_dma_pfn) {
                         dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
                                  mask);
                         dev_warn(dev, "Driver did not use or check the return value from dma_set_coherent_mask()?\n");
@@ -192,7 +197,7 @@ static u64 get_coherent_dma_mask(struct device *dev)
                  * fits within the allowable addresses which we can
                  * allocate.
                  */
-                if (dma_to_pfn(dev, mask) < arm_dma_pfn_limit) {
+                if (dma_to_pfn(dev, mask) < max_dma_pfn) {
                         dev_warn(dev, "Coherent DMA mask %#llx (pfn %#lx-%#lx) covers a smaller range of system memory than the DMA zone pfn 0x0-%#lx\n",
                                  mask,
                                  dma_to_pfn(dev, 0), dma_to_pfn(dev, mask) + 1,
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index d27158c38eb0..5e85ed371364 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -146,7 +146,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
         info.flags = VM_UNMAPPED_AREA_TOPDOWN;
         info.length = len;
-        info.low_limit = PAGE_SIZE;
+        info.low_limit = FIRST_USER_ADDRESS;
         info.high_limit = mm->mmap_base;
         info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
         info.align_offset = pgoff << PAGE_SHIFT;
diff --git a/arch/arm/mm/pgd.c b/arch/arm/mm/pgd.c
index 0acb089d0f70..1046b373d1ae 100644
--- a/arch/arm/mm/pgd.c
+++ b/arch/arm/mm/pgd.c
@@ -87,7 +87,8 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
                 init_pud = pud_offset(init_pgd, 0);
                 init_pmd = pmd_offset(init_pud, 0);
                 init_pte = pte_offset_map(init_pmd, 0);
-                set_pte_ext(new_pte, *init_pte, 0);
+                set_pte_ext(new_pte + 0, init_pte[0], 0);
+                set_pte_ext(new_pte + 1, init_pte[1], 0);
                 pte_unmap(init_pte);
                 pte_unmap(new_pte);
         }
diff --git a/arch/arm/plat-omap/include/plat/dmtimer.h b/arch/arm/plat-omap/include/plat/dmtimer.h
index fb92abb91628..2861b155485a 100644
--- a/arch/arm/plat-omap/include/plat/dmtimer.h
+++ b/arch/arm/plat-omap/include/plat/dmtimer.h
@@ -336,8 +336,11 @@ static inline void __omap_dm_timer_enable_posted(struct omap_dm_timer *timer)
         if (timer->posted)
                 return;
 
-        if (timer->errata & OMAP_TIMER_ERRATA_I103_I767)
+        if (timer->errata & OMAP_TIMER_ERRATA_I103_I767) {
+                timer->posted = OMAP_TIMER_NONPOSTED;
+                __omap_dm_timer_write(timer, OMAP_TIMER_IF_CTRL_REG, 0, 0);
                 return;
+        }
 
         __omap_dm_timer_write(timer, OMAP_TIMER_IF_CTRL_REG,
                               OMAP_TIMER_CTRL_POSTED, 0);
diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
index 23732cdff551..b31ee1b275b0 100644
--- a/arch/arm/xen/p2m.c
+++ b/arch/arm/xen/p2m.c
@@ -25,8 +25,9 @@ struct xen_p2m_entry {
         struct rb_node rbnode_phys;
 };
 
-rwlock_t p2m_lock;
+static rwlock_t p2m_lock;
 struct rb_root phys_to_mach = RB_ROOT;
+EXPORT_SYMBOL_GPL(phys_to_mach);
 static struct rb_root mach_to_phys = RB_ROOT;
 
 static int xen_add_phys_to_mach_entry(struct xen_p2m_entry *new)
@@ -200,7 +201,7 @@ bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 }
 EXPORT_SYMBOL_GPL(__set_phys_to_machine);
 
-int p2m_init(void)
+static int p2m_init(void)
 {
         rwlock_init(&p2m_lock);
         return 0;
diff --git a/arch/arm64/boot/dts/foundation-v8.dts b/arch/arm64/boot/dts/foundation-v8.dts
index 84fcc5018284..519c4b2c0687 100644
--- a/arch/arm64/boot/dts/foundation-v8.dts
+++ b/arch/arm64/boot/dts/foundation-v8.dts
@@ -6,6 +6,8 @@
 
 /dts-v1/;
 
+/memreserve/ 0x80000000 0x00010000;
+
 / {
         model = "Foundation-v8A";
         compatible = "arm,foundation-aarch64", "arm,vexpress";
diff --git a/arch/arm64/include/asm/irqflags.h b/arch/arm64/include/asm/irqflags.h
index aa11943b8502..b2fcfbc51ecc 100644
--- a/arch/arm64/include/asm/irqflags.h
+++ b/arch/arm64/include/asm/irqflags.h
@@ -56,6 +56,9 @@ static inline void arch_local_irq_disable(void)
 #define local_fiq_enable()      asm("msr        daifclr, #1" : : : "memory")
 #define local_fiq_disable()     asm("msr        daifset, #1" : : : "memory")
 
+#define local_async_enable()    asm("msr        daifclr, #4" : : : "memory")
+#define local_async_disable()   asm("msr        daifset, #4" : : : "memory")
+
 /*
  * Save the current interrupt enable state.
  */
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 17bd3af0a117..7f2b60affbb4 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -25,10 +25,11 @@
  * Software defined PTE bits definition.
  */
 #define PTE_VALID               (_AT(pteval_t, 1) << 0)
-#define PTE_PROT_NONE           (_AT(pteval_t, 1) << 2) /* only when !PTE_VALID */
-#define PTE_FILE                (_AT(pteval_t, 1) << 3) /* only when !pte_present() */
+#define PTE_FILE                (_AT(pteval_t, 1) << 2) /* only when !pte_present() */
 #define PTE_DIRTY               (_AT(pteval_t, 1) << 55)
 #define PTE_SPECIAL             (_AT(pteval_t, 1) << 56)
+                                /* bit 57 for PMD_SECT_SPLITTING */
+#define PTE_PROT_NONE           (_AT(pteval_t, 1) << 58) /* only when !PTE_VALID */
 
 /*
  * VMALLOC and SPARSEMEM_VMEMMAP ranges.
@@ -254,7 +255,7 @@ static inline int has_transparent_hugepage(void)
 #define pgprot_noncached(prot) \
         __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE))
 #define pgprot_writecombine(prot) \
-        __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_GRE))
+        __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
 #define pgprot_dmacoherent(prot) \
         __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
 #define __HAVE_PHYS_MEM_ACCESS_PROT
@@ -357,18 +358,20 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
 
 /*
  * Encode and decode a swap entry:
- *      bits 0, 2:      present (must both be zero)
- *      bit  3:         PTE_FILE
- *      bits 4-8:       swap type
- *      bits 9-63:      swap offset
+ *      bits 0-1:       present (must be zero)
+ *      bit  2:         PTE_FILE
+ *      bits 3-8:       swap type
+ *      bits 9-57:      swap offset
  */
-#define __SWP_TYPE_SHIFT        4
+#define __SWP_TYPE_SHIFT        3
 #define __SWP_TYPE_BITS         6
+#define __SWP_OFFSET_BITS       49
 #define __SWP_TYPE_MASK         ((1 << __SWP_TYPE_BITS) - 1)
 #define __SWP_OFFSET_SHIFT      (__SWP_TYPE_BITS + __SWP_TYPE_SHIFT)
+#define __SWP_OFFSET_MASK       ((1UL << __SWP_OFFSET_BITS) - 1)
 
 #define __swp_type(x)           (((x).val >> __SWP_TYPE_SHIFT) & __SWP_TYPE_MASK)
-#define __swp_offset(x)         ((x).val >> __SWP_OFFSET_SHIFT)
+#define __swp_offset(x)         (((x).val >> __SWP_OFFSET_SHIFT) & __SWP_OFFSET_MASK)
 #define __swp_entry(type,offset) ((swp_entry_t) { ((type) << __SWP_TYPE_SHIFT) | ((offset) << __SWP_OFFSET_SHIFT) })
 
 #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
@@ -382,15 +385,15 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
 
 /*
  * Encode and decode a file entry:
- *      bits 0, 2:      present (must both be zero)
- *      bit  3:         PTE_FILE
- *      bits 4-63:      file offset / PAGE_SIZE
+ *      bits 0-1:       present (must be zero)
+ *      bit  2:         PTE_FILE
+ *      bits 3-57:      file offset / PAGE_SIZE
  */
 #define pte_file(pte)           (pte_val(pte) & PTE_FILE)
-#define pte_to_pgoff(x)         (pte_val(x) >> 4)
-#define pgoff_to_pte(x)         __pte(((x) << 4) | PTE_FILE)
+#define pte_to_pgoff(x)         (pte_val(x) >> 3)
+#define pgoff_to_pte(x)         __pte(((x) << 3) | PTE_FILE)
 
-#define PTE_FILE_MAX_BITS       60
+#define PTE_FILE_MAX_BITS       55
 
 extern int kern_addr_valid(unsigned long addr);
 
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index 6a0a9b132d7a..4ae68579031d 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -248,7 +248,8 @@ static int brk_handler(unsigned long addr, unsigned int esr,
 int aarch32_break_handler(struct pt_regs *regs)
 {
         siginfo_t info;
-        unsigned int instr;
+        u32 arm_instr;
+        u16 thumb_instr;
         bool bp = false;
         void __user *pc = (void __user *)instruction_pointer(regs);
 
@@ -257,18 +258,21 @@ int aarch32_break_handler(struct pt_regs *regs)
 
         if (compat_thumb_mode(regs)) {
                 /* get 16-bit Thumb instruction */
-                get_user(instr, (u16 __user *)pc);
-                if (instr == AARCH32_BREAK_THUMB2_LO) {
+                get_user(thumb_instr, (u16 __user *)pc);
+                thumb_instr = le16_to_cpu(thumb_instr);
+                if (thumb_instr == AARCH32_BREAK_THUMB2_LO) {
                         /* get second half of 32-bit Thumb-2 instruction */
-                        get_user(instr, (u16 __user *)(pc + 2));
-                        bp = instr == AARCH32_BREAK_THUMB2_HI;
+                        get_user(thumb_instr, (u16 __user *)(pc + 2));
+                        thumb_instr = le16_to_cpu(thumb_instr);
+                        bp = thumb_instr == AARCH32_BREAK_THUMB2_HI;
                 } else {
-                        bp = instr == AARCH32_BREAK_THUMB;
+                        bp = thumb_instr == AARCH32_BREAK_THUMB;
                 }
         } else {
                 /* 32-bit ARM instruction */
-                get_user(instr, (u32 __user *)pc);
-                bp = (instr & ~0xf0000000) == AARCH32_BREAK_ARM;
+                get_user(arm_instr, (u32 __user *)pc);
+                arm_instr = le32_to_cpu(arm_instr);
+                bp = (arm_instr & ~0xf0000000) == AARCH32_BREAK_ARM;
         }
 
         if (!bp)
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index e1166145ca29..4d2c6f3f0c41 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -309,15 +309,12 @@ el1_irq:
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
 #endif
-#ifdef CONFIG_PREEMPT
-        get_thread_info tsk
-        ldr     w24, [tsk, #TI_PREEMPT]         // get preempt count
-        add     w0, w24, #1                     // increment it
-        str     w0, [tsk, #TI_PREEMPT]
-#endif
+
         irq_handler
+
 #ifdef CONFIG_PREEMPT
-        str     w24, [tsk, #TI_PREEMPT]         // restore preempt count
+        get_thread_info tsk
+        ldr     w24, [tsk, #TI_PREEMPT]         // restore preempt count
         cbnz    w24, 1f                         // preempt count != 0
         ldr     x0, [tsk, #TI_FLAGS]            // get flags
         tbz     x0, #TIF_NEED_RESCHED, 1f       // needs rescheduling?
@@ -507,22 +504,10 @@ el0_irq_naked:
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
 #endif
-        get_thread_info tsk
-#ifdef CONFIG_PREEMPT
-        ldr     w24, [tsk, #TI_PREEMPT]         // get preempt count
-        add     w23, w24, #1                    // increment it
-        str     w23, [tsk, #TI_PREEMPT]
-#endif
+
         irq_handler
-#ifdef CONFIG_PREEMPT
-        ldr     w0, [tsk, #TI_PREEMPT]
-        str     w24, [tsk, #TI_PREEMPT]
-        cmp     w0, w23
-        b.eq    1f
-        mov     x1, #0
-        str     x1, [x1]                        // BUG
-1:
-#endif
+        get_thread_info tsk
+
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_on
 #endif
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index fecdbf7de82e..6777a2192b83 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -636,28 +636,27 @@ static int compat_gpr_get(struct task_struct *target,
 
         for (i = 0; i < num_regs; ++i) {
                 unsigned int idx = start + i;
-                void *reg;
+                compat_ulong_t reg;
 
                 switch (idx) {
                 case 15:
-                        reg = (void *)&task_pt_regs(target)->pc;
+                        reg = task_pt_regs(target)->pc;
                         break;
                 case 16:
-                        reg = (void *)&task_pt_regs(target)->pstate;
+                        reg = task_pt_regs(target)->pstate;
                         break;
                 case 17:
-                        reg = (void *)&task_pt_regs(target)->orig_x0;
+                        reg = task_pt_regs(target)->orig_x0;
                         break;
                 default:
-                        reg = (void *)&task_pt_regs(target)->regs[idx];
+                        reg = task_pt_regs(target)->regs[idx];
                 }
 
-                ret = copy_to_user(ubuf, reg, sizeof(compat_ulong_t));
-
+                ret = copy_to_user(ubuf, &reg, sizeof(reg));
                 if (ret)
                         break;
-                else
-                        ubuf += sizeof(compat_ulong_t);
+
+                ubuf += sizeof(reg);
         }
 
         return ret;
@@ -685,28 +684,28 @@ static int compat_gpr_set(struct task_struct *target,
 
         for (i = 0; i < num_regs; ++i) {
                 unsigned int idx = start + i;
-                void *reg;
+                compat_ulong_t reg;
+
+                ret = copy_from_user(&reg, ubuf, sizeof(reg));
+                if (ret)
+                        return ret;
+
+                ubuf += sizeof(reg);
 
                 switch (idx) {
                 case 15:
-                        reg = (void *)&newregs.pc;
+                        newregs.pc = reg;
                         break;
                 case 16:
-                        reg = (void *)&newregs.pstate;
+                        newregs.pstate = reg;
                         break;
                 case 17:
-                        reg = (void *)&newregs.orig_x0;
+                        newregs.orig_x0 = reg;
                         break;
                 default:
-                        reg = (void *)&newregs.regs[idx];
+                        newregs.regs[idx] = reg;
                 }
 
-                ret = copy_from_user(reg, ubuf, sizeof(compat_ulong_t));
-
-                if (ret)
-                        goto out;
-                else
-                        ubuf += sizeof(compat_ulong_t);
         }
 
         if (valid_user_regs(&newregs.user_regs))
@@ -714,7 +713,6 @@ static int compat_gpr_set(struct task_struct *target,
         else
                 ret = -EINVAL;
 
-out:
         return ret;
 }
 
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 0bc5e4cbc017..bd9bbd0e44ed 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -205,6 +205,11 @@ u64 __cpu_logical_map[NR_CPUS] = { [0 ... NR_CPUS-1] = INVALID_HWID };
 
 void __init setup_arch(char **cmdline_p)
 {
+        /*
+         * Unmask asynchronous aborts early to catch possible system errors.
+         */
+        local_async_enable();
+
         setup_processor();
 
         setup_machine_fdt(__fdt_pointer);
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index a5aeefab03c3..a0c2ca602cf8 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -160,6 +160,7 @@ asmlinkage void secondary_start_kernel(void)
 
         local_irq_enable();
         local_fiq_enable();
+        local_async_enable();
 
         /*
          * OK, it's off to the idle thread for us
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index ec1b014952b6..acacd348df89 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -50,7 +50,7 @@ CONFIG_BLK_DEV_CRYPTOLOOP=m
 CONFIG_IDE=y
 CONFIG_BLK_DEV_IDECD=y
 CONFIG_BLK_DEV_NS87415=y
-CONFIG_BLK_DEV_SIIMAGE=m
+CONFIG_PATA_SIL680=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index e1c8d2015c89..8249ac9d9cfc 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -20,7 +20,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_PA8X00=y
-CONFIG_MLONGCALLS=y
 CONFIG_64BIT=y
 CONFIG_SMP=y
 CONFIG_PREEMPT=y
@@ -81,8 +80,6 @@ CONFIG_IDE=y
 CONFIG_BLK_DEV_IDECD=y
 CONFIG_BLK_DEV_PLATFORM=y
 CONFIG_BLK_DEV_GENERIC=y
-CONFIG_BLK_DEV_SIIMAGE=y
-CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=m
 CONFIG_BLK_DEV_SR=m
@@ -94,6 +91,8 @@ CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_SAS_LIBSAS=m
 CONFIG_ISCSI_TCP=m
 CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_ATA=y
+CONFIG_PATA_SIL680=y
 CONFIG_FUSION=y
 CONFIG_FUSION_SPI=y
 CONFIG_FUSION_SAS=y
@@ -114,9 +113,8 @@ CONFIG_INPUT_FF_MEMLESS=m
 # CONFIG_KEYBOARD_ATKBD is not set
 # CONFIG_KEYBOARD_HIL_OLD is not set
 # CONFIG_KEYBOARD_HIL is not set
-CONFIG_MOUSE_PS2=m
+# CONFIG_MOUSE_PS2 is not set
 CONFIG_INPUT_MISC=y
-CONFIG_INPUT_CM109=m
 CONFIG_SERIO_SERPORT=m
 CONFIG_SERIO_PARKBD=m
 CONFIG_SERIO_GSCPS2=m
@@ -167,34 +165,6 @@ CONFIG_SND_VERBOSE_PRINTK=y
 CONFIG_SND_AD1889=m
 # CONFIG_SND_USB is not set
 # CONFIG_SND_GSC is not set
-CONFIG_HID_A4TECH=m
-CONFIG_HID_APPLE=m
-CONFIG_HID_BELKIN=m
-CONFIG_HID_CHERRY=m
-CONFIG_HID_CHICONY=m
-CONFIG_HID_CYPRESS=m
-CONFIG_HID_DRAGONRISE=m
-CONFIG_HID_EZKEY=m
-CONFIG_HID_KYE=m
-CONFIG_HID_GYRATION=m
-CONFIG_HID_TWINHAN=m
-CONFIG_HID_KENSINGTON=m
-CONFIG_HID_LOGITECH=m
-CONFIG_HID_LOGITECH_DJ=m
-CONFIG_HID_MICROSOFT=m
-CONFIG_HID_MONTEREY=m
-CONFIG_HID_NTRIG=m
-CONFIG_HID_ORTEK=m
-CONFIG_HID_PANTHERLORD=m
-CONFIG_HID_PETALYNX=m
-CONFIG_HID_SAMSUNG=m
-CONFIG_HID_SUNPLUS=m
-CONFIG_HID_GREENASIA=m
-CONFIG_HID_SMARTJOYPLUS=m
-CONFIG_HID_TOPSEED=m
-CONFIG_HID_THRUSTMASTER=m
-CONFIG_HID_ZEROPLUS=m
-CONFIG_USB_HID=m
 CONFIG_USB=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_STORAGE=y
diff --git a/arch/parisc/configs/generic-64bit_defconfig b/arch/parisc/configs/generic-64bit_defconfig
index 5874cebee077..28c1b5de044e 100644
--- a/arch/parisc/configs/generic-64bit_defconfig
+++ b/arch/parisc/configs/generic-64bit_defconfig
@@ -24,7 +24,6 @@ CONFIG_MODVERSIONS=y
 CONFIG_BLK_DEV_INTEGRITY=y
 # CONFIG_IOSCHED_DEADLINE is not set
 CONFIG_PA8X00=y
-CONFIG_MLONGCALLS=y
 CONFIG_64BIT=y
 CONFIG_SMP=y
 # CONFIG_COMPACTION is not set
@@ -68,7 +67,6 @@ CONFIG_IDE_GD=m
 CONFIG_IDE_GD_ATAPI=y
 CONFIG_BLK_DEV_IDECD=m
 CONFIG_BLK_DEV_NS87415=y
-CONFIG_BLK_DEV_SIIMAGE=y
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_DEV_SR=y
@@ -82,6 +80,7 @@ CONFIG_SCSI_ZALON=y
 CONFIG_SCSI_QLA_ISCSI=m
 CONFIG_SCSI_DH=y
 CONFIG_ATA=y
+CONFIG_PATA_SIL680=y
 CONFIG_ATA_GENERIC=y
 CONFIG_MD=y
 CONFIG_MD_LINEAR=m
@@ -162,7 +161,7 @@ CONFIG_SLIP_MODE_SLIP6=y
 CONFIG_INPUT_EVDEV=y
 # CONFIG_KEYBOARD_HIL_OLD is not set
 # CONFIG_KEYBOARD_HIL is not set
-# CONFIG_INPUT_MOUSE is not set
+# CONFIG_MOUSE_PS2 is not set
 CONFIG_INPUT_MISC=y
 CONFIG_SERIO_SERPORT=m
 # CONFIG_HP_SDC is not set
@@ -216,32 +215,7 @@ CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
-CONFIG_HID=m
 CONFIG_HIDRAW=y
-CONFIG_HID_DRAGONRISE=m
-CONFIG_DRAGONRISE_FF=y
-CONFIG_HID_KYE=m
-CONFIG_HID_GYRATION=m
-CONFIG_HID_TWINHAN=m
-CONFIG_LOGITECH_FF=y
-CONFIG_LOGIRUMBLEPAD2_FF=y
-CONFIG_HID_NTRIG=m
-CONFIG_HID_PANTHERLORD=m
-CONFIG_PANTHERLORD_FF=y
-CONFIG_HID_PETALYNX=m
-CONFIG_HID_SAMSUNG=m
-CONFIG_HID_SONY=m
-CONFIG_HID_SUNPLUS=m
-CONFIG_HID_GREENASIA=m
-CONFIG_GREENASIA_FF=y
-CONFIG_HID_SMARTJOYPLUS=m
-CONFIG_SMARTJOYPLUS_FF=y
-CONFIG_HID_TOPSEED=m
-CONFIG_HID_THRUSTMASTER=m
-CONFIG_THRUSTMASTER_FF=y
-CONFIG_HID_ZEROPLUS=m
-CONFIG_ZEROPLUS_FF=y
-CONFIG_USB_HID=m
 CONFIG_HID_PID=y
 CONFIG_USB_HIDDEV=y
 CONFIG_USB=y
@@ -251,13 +225,8 @@ CONFIG_USB_DYNAMIC_MINORS=y
 CONFIG_USB_MON=m
 CONFIG_USB_WUSB_CBAF=m
 CONFIG_USB_XHCI_HCD=m
-CONFIG_USB_EHCI_HCD=m
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_R8A66597_HCD=m
-CONFIG_USB_ACM=m
-CONFIG_USB_PRINTER=m
-CONFIG_USB_WDM=m
-CONFIG_USB_TMC=m
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_OHCI_HCD=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_TRIGGERS=y
diff --git a/arch/parisc/include/asm/serial.h b/arch/parisc/include/asm/serial.h
index d7e3cc60dbc3..77e9b67c87ee 100644
--- a/arch/parisc/include/asm/serial.h
+++ b/arch/parisc/include/asm/serial.h
@@ -6,5 +6,3 @@
  * This is used for 16550-compatible UARTs
  */
 #define BASE_BAUD ( 1843200 / 16 )
-
-#define SERIAL_PORT_DFNS
diff --git a/arch/parisc/kernel/hardware.c b/arch/parisc/kernel/hardware.c
index 06cb3992907e..608716f8496b 100644
--- a/arch/parisc/kernel/hardware.c
+++ b/arch/parisc/kernel/hardware.c
@@ -36,6 +36,9 @@
  *      HP PARISC Hardware Database
  *      Access to this database is only possible during bootup
  *      so don't reference this table after starting the init process
+ *
+ *      NOTE: Product names which are listed here and ends with a '?'
+ *      are guessed. If you know the correct name, please let us know.
  */
  
 static struct hp_hardware hp_hardware_list[] = {
@@ -222,7 +225,7 @@ static struct hp_hardware hp_hardware_list[] = {
         {HPHW_NPROC,0x5DD,0x4,0x81,"Duet W2"},
         {HPHW_NPROC,0x5DE,0x4,0x81,"Piccolo W+"},
         {HPHW_NPROC,0x5DF,0x4,0x81,"Cantata W2"},
-        {HPHW_NPROC,0x5DF,0x0,0x00,"Marcato W+? (rp5470)"},
+        {HPHW_NPROC,0x5DF,0x0,0x00,"Marcato W+ (rp5470)?"},
         {HPHW_NPROC,0x5E0,0x4,0x91,"Cantata DC- W2"},
         {HPHW_NPROC,0x5E1,0x4,0x91,"Crescendo DC- W2"},
         {HPHW_NPROC,0x5E2,0x4,0x91,"Crescendo 650 W2"},
@@ -276,9 +279,11 @@ static struct hp_hardware hp_hardware_list[] = {
         {HPHW_NPROC,0x888,0x4,0x91,"Storm Peak Fast DC-"},
         {HPHW_NPROC,0x889,0x4,0x91,"Storm Peak Fast"},
         {HPHW_NPROC,0x88A,0x4,0x91,"Crestone Peak Slow"},
+        {HPHW_NPROC,0x88B,0x4,0x91,"Crestone Peak Fast?"},
         {HPHW_NPROC,0x88C,0x4,0x91,"Orca Mako+"},
         {HPHW_NPROC,0x88D,0x4,0x91,"Rainier/Medel Mako+ Slow"},
         {HPHW_NPROC,0x88E,0x4,0x91,"Rainier/Medel Mako+ Fast"},
+        {HPHW_NPROC,0x892,0x4,0x91,"Mt. Hamilton Slow Mako+?"},
         {HPHW_NPROC,0x894,0x4,0x91,"Mt. Hamilton Fast Mako+"},
         {HPHW_NPROC,0x895,0x4,0x91,"Storm Peak Slow Mako+"},
         {HPHW_NPROC,0x896,0x4,0x91,"Storm Peak Fast Mako+"},
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index d2d58258aea6..d4dc588c0dc1 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -41,9 +41,7 @@ END(boot_args)
         .import fault_vector_11,code    /* IVA parisc 1.1 32 bit */
         .import $global$                /* forward declaration */
 #endif /*!CONFIG_64BIT*/
-        .export _stext,data             /* Kernel want it this way! */
-_stext:
-ENTRY(stext)
+ENTRY(parisc_kernel_start)
         .proc
         .callinfo
 
@@ -347,7 +345,7 @@ smp_slave_stext:
         .procend
 #endif /* CONFIG_SMP */
 
-ENDPROC(stext)
+ENDPROC(parisc_kernel_start)
 
 #ifndef CONFIG_64BIT
         .section .data..read_mostly
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 5dfd248e3f1a..0d3a9d4927b5 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -61,8 +61,15 @@ static int get_offset(struct address_space *mapping)
         return (unsigned long) mapping >> 8;
 }
 
-static unsigned long get_shared_area(struct address_space *mapping,
-                unsigned long addr, unsigned long len, unsigned long pgoff)
+static unsigned long shared_align_offset(struct file *filp, unsigned long pgoff)
+{
+        struct address_space *mapping = filp ? filp->f_mapping : NULL;
+
+        return (get_offset(mapping) + pgoff) << PAGE_SHIFT;
+}
+
+static unsigned long get_shared_area(struct file *filp, unsigned long addr,
+                unsigned long len, unsigned long pgoff)
 {
         struct vm_unmapped_area_info info;
 
@@ -71,7 +78,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
         info.low_limit = PAGE_ALIGN(addr);
         info.high_limit = TASK_SIZE;
         info.align_mask = PAGE_MASK & (SHMLBA - 1);
-        info.align_offset = (get_offset(mapping) + pgoff) << PAGE_SHIFT;
+        info.align_offset = shared_align_offset(filp, pgoff);
         return vm_unmapped_area(&info);
 }
 
@@ -82,20 +89,18 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 return -ENOMEM;
         if (flags & MAP_FIXED) {
                 if ((flags & MAP_SHARED) &&
-                    (addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1))
+                    (addr - shared_align_offset(filp, pgoff)) & (SHMLBA - 1))
                         return -EINVAL;
                 return addr;
         }
         if (!addr)
                 addr = TASK_UNMAPPED_BASE;
 
-        if (filp) {
-                addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-        } else if(flags & MAP_SHARED) {
-                addr = get_shared_area(NULL, addr, len, pgoff);
-        } else {
+        if (filp || (flags & MAP_SHARED))
+                addr = get_shared_area(filp, addr, len, pgoff);
+        else
                 addr = get_unshared_area(addr, len);
-        }
+
         return addr;
 }
 
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 76ed62ed785b..ddd988b267a9 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -168,7 +168,7 @@ void unwind_table_remove(struct unwind_table *table)
 }
 
 /* Called from setup_arch to import the kernel unwind info */
-int unwind_init(void)
+int __init unwind_init(void)
 {
         long start, stop;
         register unsigned long gp __asm__ ("r27");
@@ -233,7 +233,6 @@ static void unwind_frame_regs(struct unwind_frame_info *info)
         e = find_unwind_entry(info->ip);
         if (e == NULL) {
                 unsigned long sp;
-                extern char _stext[], _etext[];
 
                 dbg("Cannot find unwind entry for 0x%lx; forced unwinding\n", info->ip);
 
@@ -281,8 +280,7 @@ static void unwind_frame_regs(struct unwind_frame_info *info)
                                 break;
                         info->prev_ip = tmp;
                         sp = info->prev_sp;
-                } while (info->prev_ip < (unsigned long)_stext ||
-                         info->prev_ip > (unsigned long)_etext);
+                } while (!kernel_text_address(info->prev_ip));
 
                 info->rp = 0;
 
@@ -435,9 +433,8 @@ unsigned long return_address(unsigned int level)
         do {
                 if (unwind_once(&info) < 0 || info.ip == 0)
                         return 0;
-                if (!__kernel_text_address(info.ip)) {
+                if (!kernel_text_address(info.ip))
                         return 0;
-                }
         } while (info.ip && level--);
 
         return info.ip;
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 4bb095a2f6fc..0dacc5ca555a 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -6,24 +6,19 @@
  *    Copyright (C) 2000 Michael Ang <mang with subcarrier.org>
  *    Copyright (C) 2002 Randolph Chung <tausq with parisc-linux.org>
  *    Copyright (C) 2003 James Bottomley <jejb with parisc-linux.org>
- *    Copyright (C) 2006 Helge Deller <deller@gmx.de>
- *
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *    Copyright (C) 2006-2013 Helge Deller <deller@gmx.de>
+ */
+
+/*
+ * Put page table entries (swapper_pg_dir) as the first thing in .bss. This
+ * will ensure that it has .bss alignment (PAGE_SIZE).
  */
+#define BSS_FIRST_SECTIONS      *(.data..vm0.pmd) \
+                                *(.data..vm0.pgd) \
+                                *(.data..vm0.pte)
+
 #include <asm-generic/vmlinux.lds.h>
+
 /* needed for the processor specific cache alignment size */    
 #include <asm/cache.h>
 #include <asm/page.h>
@@ -39,7 +34,7 @@ OUTPUT_FORMAT("elf64-hppa-linux")
 OUTPUT_ARCH(hppa:hppa2.0w)
 #endif
 
-ENTRY(_stext)
+ENTRY(parisc_kernel_start)
 #ifndef CONFIG_64BIT
 jiffies = jiffies_64 + 4;
 #else
@@ -49,11 +44,29 @@ SECTIONS
 {
         . = KERNEL_BINARY_TEXT_START;
 
+        __init_begin = .;
+        HEAD_TEXT_SECTION
+        INIT_TEXT_SECTION(8)
+
+        . = ALIGN(PAGE_SIZE);
+        INIT_DATA_SECTION(PAGE_SIZE)
+        /* we have to discard exit text and such at runtime, not link time */
+        .exit.text :
+        {
+                EXIT_TEXT
+        }
+        .exit.data :
+        {
+                EXIT_DATA
+        }
+        PERCPU_SECTION(8)
+        . = ALIGN(PAGE_SIZE);
+        __init_end = .;
+        /* freed after init ends here */
+
         _text = .;              /* Text and read-only data */
-        .head ALIGN(16) : {
-                HEAD_TEXT
-        } = 0
-        .text ALIGN(16) : {
+        _stext = .;
+        .text ALIGN(PAGE_SIZE) : {
                 TEXT_TEXT
                 SCHED_TEXT
                 LOCK_TEXT
@@ -68,21 +81,28 @@ SECTIONS
                 *(.lock.text)           /* out-of-line lock text */
                 *(.gnu.warning)
         }
-        /* End of text section */
+        . = ALIGN(PAGE_SIZE);
         _etext = .;
+        /* End of text section */
 
         /* Start of data section */
         _sdata = .;
 
-        RODATA
+        RO_DATA_SECTION(8)
 
-        /* writeable */
-        /* Make sure this is page aligned so
-         * that we can properly leave these
-         * as writable
-         */
-        . = ALIGN(PAGE_SIZE);
-        data_start = .;
+#ifdef CONFIG_64BIT
+        . = ALIGN(16);
+        /* Linkage tables */
+        .opd : {
+                *(.opd)
+        } PROVIDE (__gp = .);
+        .plt : {
+                *(.plt)
+        }
+        .dlt : {
+                *(.dlt)
+        }
+#endif
 
         /* unwind info */
         .PARISC.unwind : {
@@ -91,7 +111,15 @@ SECTIONS
                 __stop___unwind = .;
         }
 
-        EXCEPTION_TABLE(16)
+        /* writeable */
+        /* Make sure this is page aligned so
+         * that we can properly leave these
+         * as writable
+         */
+        . = ALIGN(PAGE_SIZE);
+        data_start = .;
+
+        EXCEPTION_TABLE(8)
         NOTES
 
         /* Data */
@@ -107,54 +135,8 @@ SECTIONS
         _edata = .;
 
         /* BSS */
-        __bss_start = .;
-        /* page table entries need to be PAGE_SIZE aligned */
-        . = ALIGN(PAGE_SIZE);
-        .data..vmpages : {
-                *(.data..vm0.pmd)
-                *(.data..vm0.pgd)
-                *(.data..vm0.pte)
-        }
-        .bss : {
-                *(.bss)
-                *(COMMON)
-        }
-        __bss_stop = .;
-
-#ifdef CONFIG_64BIT
-        . = ALIGN(16);
-        /* Linkage tables */
-        .opd : {
-                *(.opd)
-        } PROVIDE (__gp = .); 
-        .plt : {
-                *(.plt)
-        } 
-        .dlt : {
-                *(.dlt)
-        }
-#endif
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 8)
 
-        /* reserve space for interrupt stack by aligning __init* to 16k */
-        . = ALIGN(16384);
-        __init_begin = .;
-        INIT_TEXT_SECTION(16384)
-        . = ALIGN(PAGE_SIZE);
-        INIT_DATA_SECTION(16)
-        /* we have to discard exit text and such at runtime, not link time */
-        .exit.text :
-        {
-                EXIT_TEXT
-        }
-        .exit.data :
-        {
-                EXIT_DATA
-        }
-
-        PERCPU_SECTION(L1_CACHE_BYTES)
-        . = ALIGN(PAGE_SIZE);
-        __init_end = .;
-        /* freed after init ends here */
         _end = . ;
 
         STABS_DEBUG
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index b0f96c0e6316..96f8168cf4ec 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -32,6 +32,7 @@
 #include <asm/sections.h>
 
 extern int  data_start;
+extern void parisc_kernel_start(void);  /* Kernel entry point in head.S */
 
 #if PT_NLEVELS == 3
 /* NOTE: This layout exactly conforms to the hybrid L2/L3 page table layout
@@ -324,8 +325,9 @@ static void __init setup_bootmem(void)
         reserve_bootmem_node(NODE_DATA(0), 0UL,
                         (unsigned long)(PAGE0->mem_free +
                                 PDC_CONSOLE_IO_IODC_SIZE), BOOTMEM_DEFAULT);
-        reserve_bootmem_node(NODE_DATA(0), __pa((unsigned long)_text),
-                        (unsigned long)(_end - _text), BOOTMEM_DEFAULT);
+        reserve_bootmem_node(NODE_DATA(0), __pa(KERNEL_BINARY_TEXT_START),
+                        (unsigned long)(_end - KERNEL_BINARY_TEXT_START),
+                        BOOTMEM_DEFAULT);
         reserve_bootmem_node(NODE_DATA(0), (bootmap_start_pfn << PAGE_SHIFT),
                         ((bootmap_pfn - bootmap_start_pfn) << PAGE_SHIFT),
                         BOOTMEM_DEFAULT);
@@ -378,6 +380,17 @@ static void __init setup_bootmem(void)
         request_resource(&sysram_resources[0], &pdcdata_resource);
 }
 
+static int __init parisc_text_address(unsigned long vaddr)
+{
+        static unsigned long head_ptr __initdata;
+
+        if (!head_ptr)
+                head_ptr = PAGE_MASK & (unsigned long)
+                        dereference_function_descriptor(&parisc_kernel_start);
+
+        return core_kernel_text(vaddr) || vaddr == head_ptr;
+}
+
 static void __init map_pages(unsigned long start_vaddr,
                              unsigned long start_paddr, unsigned long size,
                              pgprot_t pgprot, int force)
@@ -466,7 +479,7 @@ static void __init map_pages(unsigned long start_vaddr,
                                  */
                                 if (force)
                                         pte =  __mk_pte(address, pgprot);
-                                else if (core_kernel_text(vaddr) &&
+                                else if (parisc_text_address(vaddr) &&
                                          address != fv_addr)
                                         pte = __mk_pte(address, PAGE_KERNEL_EXEC);
                                 else
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 8a2463670a5b..0f4344e6fbca 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -75,8 +75,10 @@ LDEMULATION	:= lppc
 GNUTARGET       := powerpcle
 MULTIPLEWORD    := -mno-multiple
 else
+ifeq ($(call cc-option-yn,-mbig-endian),y)
 override CC     += -mbig-endian
 override AS     += -mbig-endian
+endif
 override LD     += -EB
 LDEMULATION     := ppc
 GNUTARGET       := powerpc
@@ -128,7 +130,12 @@ CFLAGS-$(CONFIG_POWER5_CPU) += $(call cc-option,-mcpu=power5)
 CFLAGS-$(CONFIG_POWER6_CPU) += $(call cc-option,-mcpu=power6)
 CFLAGS-$(CONFIG_POWER7_CPU) += $(call cc-option,-mcpu=power7)
 
+# Altivec option not allowed with e500mc64 in GCC.
+ifeq ($(CONFIG_ALTIVEC),y)
+E5500_CPU := -mcpu=powerpc64
+else
 E5500_CPU := $(call cc-option,-mcpu=e500mc64,-mcpu=powerpc64)
+endif
 CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU)
 CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU))
 
diff --git a/arch/powerpc/boot/dts/xcalibur1501.dts b/arch/powerpc/boot/dts/xcalibur1501.dts
index cc00f4ddd9a7..c409cbafb126 100644
--- a/arch/powerpc/boot/dts/xcalibur1501.dts
+++ b/arch/powerpc/boot/dts/xcalibur1501.dts
@@ -637,14 +637,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/dts/xpedite5301.dts b/arch/powerpc/boot/dts/xpedite5301.dts
index 53c1c6a9752f..04cb410da48b 100644
--- a/arch/powerpc/boot/dts/xpedite5301.dts
+++ b/arch/powerpc/boot/dts/xpedite5301.dts
@@ -547,14 +547,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/dts/xpedite5330.dts b/arch/powerpc/boot/dts/xpedite5330.dts
index 215225983150..73f8620f1ce7 100644
--- a/arch/powerpc/boot/dts/xpedite5330.dts
+++ b/arch/powerpc/boot/dts/xpedite5330.dts
@@ -583,14 +583,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/dts/xpedite5370.dts b/arch/powerpc/boot/dts/xpedite5370.dts
index 11dbda10d756..cd0ea2b99362 100644
--- a/arch/powerpc/boot/dts/xpedite5370.dts
+++ b/arch/powerpc/boot/dts/xpedite5370.dts
@@ -545,14 +545,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/util.S b/arch/powerpc/boot/util.S
index 5143228e3e5f..6636b1d7821b 100644
--- a/arch/powerpc/boot/util.S
+++ b/arch/powerpc/boot/util.S
@@ -71,18 +71,32 @@ udelay:
         add     r4,r4,r5
         addi    r4,r4,-1
         divw    r4,r4,r5        /* BUS ticks */
+#ifdef CONFIG_8xx
+1:      mftbu   r5
+        mftb    r6
+        mftbu   r7
+#else
 1:      mfspr   r5, SPRN_TBRU
         mfspr   r6, SPRN_TBRL
         mfspr   r7, SPRN_TBRU
+#endif
         cmpw    0,r5,r7
         bne     1b              /* Get [synced] base time */
         addc    r9,r6,r4        /* Compute end time */
         addze   r8,r5
+#ifdef CONFIG_8xx
+2:      mftbu   r5
+#else
 2:      mfspr   r5, SPRN_TBRU
+#endif
         cmpw    0,r5,r8
         blt     2b
         bgt     3f
+#ifdef CONFIG_8xx
+        mftb    r6
+#else
         mfspr   r6, SPRN_TBRL
+#endif
         cmpw    0,r6,r9
         blt     2b
 3:      blr
diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
index 16cb92d215d2..694012877bf7 100644
--- a/arch/powerpc/include/asm/pgalloc-64.h
+++ b/arch/powerpc/include/asm/pgalloc-64.h
@@ -16,6 +16,7 @@ struct vmemmap_backing {
         unsigned long phys;
         unsigned long virt_addr;
 };
+extern struct vmemmap_backing *vmemmap_list;
 
 /*
  * Functions that deal with pagetables that could be at any level of
diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
index 3c1acc31a092..f595b98079ee 100644
--- a/arch/powerpc/include/asm/ppc_asm.h
+++ b/arch/powerpc/include/asm/ppc_asm.h
@@ -366,6 +366,8 @@ BEGIN_FTR_SECTION_NESTED(96);		\
         cmpwi dest,0;                   \
         beq-  90b;                      \
 END_FTR_SECTION_NESTED(CPU_FTR_CELL_TB_BUG, CPU_FTR_CELL_TB_BUG, 96)
+#elif defined(CONFIG_8xx)
+#define MFTB(dest)                      mftb dest
 #else
 #define MFTB(dest)                      mfspr dest, SPRN_TBRL
 #endif
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 5c45787d551e..fa8388ed94c5 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -1174,12 +1174,19 @@
 
 #else /* __powerpc64__ */
 
+#if defined(CONFIG_8xx)
+#define mftbl()         ({unsigned long rval;   \
+                        asm volatile("mftbl %0" : "=r" (rval)); rval;})
+#define mftbu()         ({unsigned long rval;   \
+                        asm volatile("mftbu %0" : "=r" (rval)); rval;})
+#else
 #define mftbl()         ({unsigned long rval;   \
                         asm volatile("mfspr %0, %1" : "=r" (rval) : \
                                 "i" (SPRN_TBRL)); rval;})
 #define mftbu()         ({unsigned long rval;   \
                         asm volatile("mfspr %0, %1" : "=r" (rval) : \
                                 "i" (SPRN_TBRU)); rval;})
+#endif
 #endif /* !__powerpc64__ */
 
 #define mttbl(v)        asm volatile("mttbl %0":: "r"(v))
diff --git a/arch/powerpc/include/asm/timex.h b/arch/powerpc/include/asm/timex.h
index 18908caa1f3b..2cf846edb3fc 100644
--- a/arch/powerpc/include/asm/timex.h
+++ b/arch/powerpc/include/asm/timex.h
@@ -29,7 +29,11 @@ static inline cycles_t get_cycles(void)
         ret = 0;
 
         __asm__ __volatile__(
+#ifdef CONFIG_8xx
+                "97:    mftb %0\n"
+#else
                 "97:    mfspr %0, %2\n"
+#endif
                 "99:\n"
                 ".section __ftr_fixup,\"a\"\n"
                 ".align 2\n"
@@ -41,7 +45,11 @@ static inline cycles_t get_cycles(void)
                 "       .long 0\n"
                 "       .long 0\n"
                 ".previous"
+#ifdef CONFIG_8xx
+                : "=r" (ret) : "i" (CPU_FTR_601));
+#else
                 : "=r" (ret) : "i" (CPU_FTR_601), "i" (SPRN_TBRL));
+#endif
         return ret;
 #endif
 }
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index e1ec57e87b3b..88a7fb458dfd 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -18,6 +18,7 @@
 #include <linux/ftrace.h>
 
 #include <asm/machdep.h>
+#include <asm/pgalloc.h>
 #include <asm/prom.h>
 #include <asm/sections.h>
 
@@ -75,6 +76,17 @@ void arch_crash_save_vmcoreinfo(void)
 #ifndef CONFIG_NEED_MULTIPLE_NODES
         VMCOREINFO_SYMBOL(contig_page_data);
 #endif
+#if defined(CONFIG_PPC64) && defined(CONFIG_SPARSEMEM_VMEMMAP)
+        VMCOREINFO_SYMBOL(vmemmap_list);
+        VMCOREINFO_SYMBOL(mmu_vmemmap_psize);
+        VMCOREINFO_SYMBOL(mmu_psize_defs);
+        VMCOREINFO_STRUCT_SIZE(vmemmap_backing);
+        VMCOREINFO_OFFSET(vmemmap_backing, list);
+        VMCOREINFO_OFFSET(vmemmap_backing, phys);
+        VMCOREINFO_OFFSET(vmemmap_backing, virt_addr);
+        VMCOREINFO_STRUCT_SIZE(mmu_psize_def);
+        VMCOREINFO_OFFSET(mmu_psize_def, shift);
+#endif
 }
 
 /*
diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
index fd82c289ab1c..28b898e68185 100644
--- a/arch/powerpc/kernel/nvram_64.c
+++ b/arch/powerpc/kernel/nvram_64.c
@@ -210,7 +210,7 @@ static void __init nvram_print_partitions(char * label)
         printk(KERN_WARNING "--------%s---------\n", label);
         printk(KERN_WARNING "indx\t\tsig\tchks\tlen\tname\n");
         list_for_each_entry(tmp_part, &nvram_partitions, partition) {
-                printk(KERN_WARNING "%4d    \t%02x\t%02x\t%d\t%12s\n",
+                printk(KERN_WARNING "%4d    \t%02x\t%02x\t%d\t%12.12s\n",
                        tmp_part->index, tmp_part->header.signature,
                        tmp_part->header.checksum, tmp_part->header.length,
                        tmp_part->header.name);
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 1844298f5ea4..68027bfa5f8e 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -445,6 +445,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
 #endif /* CONFIG_ALTIVEC */
         if (copy_fpr_to_user(&frame->mc_fregs, current))
                 return 1;
+
+        /*
+         * Clear the MSR VSX bit to indicate there is no valid state attached
+         * to this context, except in the specific case below where we set it.
+         */
+        msr &= ~MSR_VSX;
 #ifdef CONFIG_VSX
         /*
          * Copy VSR 0-31 upper half from thread_struct to local
@@ -457,15 +463,7 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
                 if (copy_vsx_to_user(&frame->mc_vsregs, current))
                         return 1;
                 msr |= MSR_VSX;
-        } else if (!ctx_has_vsx_region)
-                /*
-                 * With a small context structure we can't hold the VSX
-                 * registers, hence clear the MSR value to indicate the state
-                 * was not saved.
-                 */
-                msr &= ~MSR_VSX;
-
-
+        }
 #endif /* CONFIG_VSX */
 #ifdef CONFIG_SPE
         /* save spe registers */
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e66f67b8b9e6..42991045349f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -122,6 +122,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
         flush_fp_to_thread(current);
         /* copy fpr regs and fpscr */
         err |= copy_fpr_to_user(&sc->fp_regs, current);
+
+        /*
+         * Clear the MSR VSX bit to indicate there is no valid state attached
+         * to this context, except in the specific case below where we set it.
+         */
+        msr &= ~MSR_VSX;
 #ifdef CONFIG_VSX
         /*
          * Copy VSX low doubleword to local buffer for formatting,
diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
index 6b1f2a6d5517..6b2b69616e77 100644
--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
@@ -232,9 +232,15 @@ __do_get_tspec:
         lwz     r6,(CFG_TB_ORIG_STAMP+4)(r9)
 
         /* Get a stable TB value */
+#ifdef CONFIG_8xx
+2:      mftbu   r3
+        mftbl   r4
+        mftbu   r0
+#else
 2:      mfspr   r3, SPRN_TBRU
         mfspr   r4, SPRN_TBRL
         mfspr   r0, SPRN_TBRU
+#endif
         cmplw   cr0,r3,r0
         bne-    2b
 
diff --git a/arch/powerpc/mm/hugetlbpage-book3e.c b/arch/powerpc/mm/hugetlbpage-book3e.c
index 3bc700655fc8..74551b5e41e5 100644
--- a/arch/powerpc/mm/hugetlbpage-book3e.c
+++ b/arch/powerpc/mm/hugetlbpage-book3e.c
@@ -117,6 +117,5 @@ void flush_hugetlb_page(struct vm_area_struct *vma, unsigned long vmaddr)
         struct hstate *hstate = hstate_file(vma->vm_file);
         unsigned long tsize = huge_page_shift(hstate) - 10;
 
-        __flush_tlb_page(vma ? vma->vm_mm : NULL, vmaddr, tsize, 0);
-
+        __flush_tlb_page(vma->vm_mm, vmaddr, tsize, 0);
 }
diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
index 41cd68dee681..358d74303138 100644
--- a/arch/powerpc/mm/tlb_nohash.c
+++ b/arch/powerpc/mm/tlb_nohash.c
@@ -305,7 +305,7 @@ void __flush_tlb_page(struct mm_struct *mm, unsigned long vmaddr,
 void flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr)
 {
 #ifdef CONFIG_HUGETLB_PAGE
-        if (is_vm_hugetlb_page(vma))
+        if (vma && is_vm_hugetlb_page(vma))
                 flush_hugetlb_page(vma, vmaddr);
 #endif
 
diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index 132f8726a257..bca2465a9c34 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype
@@ -404,13 +404,27 @@ config PPC_DOORBELL
 
 endmenu
 
-config CPU_LITTLE_ENDIAN
-        bool "Build little endian kernel"
-        default n
+choice
+        prompt "Endianness selection"
+        default CPU_BIG_ENDIAN
         help
           This option selects whether a big endian or little endian kernel will
           be built.
 
+config CPU_BIG_ENDIAN
+        bool "Build big endian kernel"
+        help
+          Build a big endian kernel.
+
+          If unsure, select this option.
+
+config CPU_LITTLE_ENDIAN
+        bool "Build little endian kernel"
+        help
+          Build a little endian kernel.
+
           Note that if cross compiling a little endian kernel,
           CROSS_COMPILE must point to a toolchain capable of targeting
           little endian powerpc.
+
+endchoice
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 314fced4fc14..5877e71901b3 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -101,7 +101,7 @@ config S390
         select GENERIC_CPU_DEVICES if !SMP
         select GENERIC_FIND_FIRST_BIT
         select GENERIC_SMP_IDLE_THREAD
-        select GENERIC_TIME_VSYSCALL_OLD
+        select GENERIC_TIME_VSYSCALL
         select HAVE_ALIGNED_STRUCT_PAGE if SLUB
         select HAVE_ARCH_JUMP_LABEL if !MARCH_G5
         select HAVE_ARCH_SECCOMP_FILTER
diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
index 4363528dc8fd..b3feabd39f31 100644
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -55,8 +55,7 @@ struct pcc_param {
 
 struct s390_xts_ctx {
         u8 key[32];
-        u8 xts_param[16];
-        struct pcc_param pcc;
+        u8 pcc_key[32];
         long enc;
         long dec;
         int key_len;
@@ -591,7 +590,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
                 xts_ctx->enc = KM_XTS_128_ENCRYPT;
                 xts_ctx->dec = KM_XTS_128_DECRYPT;
                 memcpy(xts_ctx->key + 16, in_key, 16);
-                memcpy(xts_ctx->pcc.key + 16, in_key + 16, 16);
+                memcpy(xts_ctx->pcc_key + 16, in_key + 16, 16);
                 break;
         case 48:
                 xts_ctx->enc = 0;
@@ -602,7 +601,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
                 xts_ctx->enc = KM_XTS_256_ENCRYPT;
                 xts_ctx->dec = KM_XTS_256_DECRYPT;
                 memcpy(xts_ctx->key, in_key, 32);
-                memcpy(xts_ctx->pcc.key, in_key + 32, 32);
+                memcpy(xts_ctx->pcc_key, in_key + 32, 32);
                 break;
         default:
                 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
@@ -621,29 +620,33 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func,
         unsigned int nbytes = walk->nbytes;
         unsigned int n;
         u8 *in, *out;
-        void *param;
+        struct pcc_param pcc_param;
+        struct {
+                u8 key[32];
+                u8 init[16];
+        } xts_param;
 
         if (!nbytes)
                 goto out;
 
-        memset(xts_ctx->pcc.block, 0, sizeof(xts_ctx->pcc.block));
-        memset(xts_ctx->pcc.bit, 0, sizeof(xts_ctx->pcc.bit));
-        memset(xts_ctx->pcc.xts, 0, sizeof(xts_ctx->pcc.xts));
-        memcpy(xts_ctx->pcc.tweak, walk->iv, sizeof(xts_ctx->pcc.tweak));
-        param = xts_ctx->pcc.key + offset;
-        ret = crypt_s390_pcc(func, param);
+        memset(pcc_param.block, 0, sizeof(pcc_param.block));
+        memset(pcc_param.bit, 0, sizeof(pcc_param.bit));
+        memset(pcc_param.xts, 0, sizeof(pcc_param.xts));
+        memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak));
+        memcpy(pcc_param.key, xts_ctx->pcc_key, 32);
+        ret = crypt_s390_pcc(func, &pcc_param.key[offset]);
         if (ret < 0)
                 return -EIO;
 
-        memcpy(xts_ctx->xts_param, xts_ctx->pcc.xts, 16);
-        param = xts_ctx->key + offset;
+        memcpy(xts_param.key, xts_ctx->key, 32);
+        memcpy(xts_param.init, pcc_param.xts, 16);
         do {
                 /* only use complete blocks */
                 n = nbytes & ~(AES_BLOCK_SIZE - 1);
                 out = walk->dst.virt.addr;
                 in = walk->src.virt.addr;
 
-                ret = crypt_s390_km(func, param, out, in, n);
+                ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n);
                 if (ret < 0 || ret != n)
                         return -EIO;
 
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index 316c8503a3b4..114258eeaacd 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -48,33 +48,21 @@ static inline void clear_page(void *page)
                 : "memory", "cc");
 }
 
+/*
+ * copy_page uses the mvcl instruction with 0xb0 padding byte in order to
+ * bypass caches when copying a page. Especially when copying huge pages
+ * this keeps L1 and L2 data caches alive.
+ */
 static inline void copy_page(void *to, void *from)
 {
-        if (MACHINE_HAS_MVPG) {
-                register unsigned long reg0 asm ("0") = 0;
-                asm volatile(
-                        "       mvpg    %0,%1"
-                        : : "a" (to), "a" (from), "d" (reg0)
-                        : "memory", "cc");
-        } else
-                asm volatile(
-                        "       mvc     0(256,%0),0(%1)\n"
-                        "       mvc     256(256,%0),256(%1)\n"
-                        "       mvc     512(256,%0),512(%1)\n"
-                        "       mvc     768(256,%0),768(%1)\n"
-                        "       mvc     1024(256,%0),1024(%1)\n"
-                        "       mvc     1280(256,%0),1280(%1)\n"
-                        "       mvc     1536(256,%0),1536(%1)\n"
-                        "       mvc     1792(256,%0),1792(%1)\n"
-                        "       mvc     2048(256,%0),2048(%1)\n"
-                        "       mvc     2304(256,%0),2304(%1)\n"
-                        "       mvc     2560(256,%0),2560(%1)\n"
-                        "       mvc     2816(256,%0),2816(%1)\n"
-                        "       mvc     3072(256,%0),3072(%1)\n"
-                        "       mvc     3328(256,%0),3328(%1)\n"
-                        "       mvc     3584(256,%0),3584(%1)\n"
-                        "       mvc     3840(256,%0),3840(%1)\n"
-                        : : "a" (to), "a" (from) : "memory");
+        register void *reg2 asm ("2") = to;
+        register unsigned long reg3 asm ("3") = 0x1000;
+        register void *reg4 asm ("4") = from;
+        register unsigned long reg5 asm ("5") = 0xb0001000;
+        asm volatile(
+                "       mvcl    2,4"
+                : "+d" (reg2), "+d" (reg3), "+d" (reg4), "+d" (reg5)
+                : : "memory", "cc");
 }
 
 #define clear_user_page(page, vaddr, pg)        clear_page(page)
diff --git a/arch/s390/include/asm/vdso.h b/arch/s390/include/asm/vdso.h
index a73eb2e1e918..bc9746a7d47c 100644
--- a/arch/s390/include/asm/vdso.h
+++ b/arch/s390/include/asm/vdso.h
@@ -26,8 +26,9 @@ struct vdso_data {
         __u64 wtom_clock_nsec;          /*                              0x28 */
         __u32 tz_minuteswest;           /* Minutes west of Greenwich    0x30 */
         __u32 tz_dsttime;               /* Type of dst correction       0x34 */
-        __u32 ectg_available;
-        __u32 ntp_mult;                 /* NTP adjusted multiplier      0x3C */
+        __u32 ectg_available;           /* ECTG instruction present     0x38 */
+        __u32 tk_mult;                  /* Mult. used for xtime_nsec    0x3c */
+        __u32 tk_shift;                 /* Shift used for xtime_nsec    0x40 */
 };
 
 struct vdso_per_cpu_data {
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 2416138ebd3e..496116cd65ec 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -65,7 +65,8 @@ int main(void)
         DEFINE(__VDSO_WTOM_NSEC, offsetof(struct vdso_data, wtom_clock_nsec));
         DEFINE(__VDSO_TIMEZONE, offsetof(struct vdso_data, tz_minuteswest));
         DEFINE(__VDSO_ECTG_OK, offsetof(struct vdso_data, ectg_available));
-        DEFINE(__VDSO_NTP_MULT, offsetof(struct vdso_data, ntp_mult));
+        DEFINE(__VDSO_TK_MULT, offsetof(struct vdso_data, tk_mult));
+        DEFINE(__VDSO_TK_SHIFT, offsetof(struct vdso_data, tk_shift));
         DEFINE(__VDSO_ECTG_BASE, offsetof(struct vdso_per_cpu_data, ectg_timer_base));
         DEFINE(__VDSO_ECTG_USER, offsetof(struct vdso_per_cpu_data, ectg_user_time));
         /* constants used by the vdso */
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 6e2442978409..95e7ba0fbb7e 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -194,7 +194,7 @@ static int restore_sigregs32(struct pt_regs *regs,_sigregs32 __user *sregs)
                 return -EINVAL;
 
         /* Use regs->psw.mask instead of PSW_USER_BITS to preserve PER bit. */
-        regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
+        regs->psw.mask = (regs->psw.mask & ~(PSW_MASK_USER | PSW_MASK_RI)) |
                 (__u64)(user_sregs.regs.psw.mask & PSW32_MASK_USER) << 32 |
                 (__u64)(user_sregs.regs.psw.mask & PSW32_MASK_RI) << 32 |
                 (__u64)(user_sregs.regs.psw.addr & PSW32_ADDR_AMODE);
diff --git a/arch/s390/kernel/pgm_check.S b/arch/s390/kernel/pgm_check.S
index 4a460c44e17e..813ec7260878 100644
--- a/arch/s390/kernel/pgm_check.S
+++ b/arch/s390/kernel/pgm_check.S
@@ -78,7 +78,7 @@ PGM_CHECK_DEFAULT			/* 34 */
 PGM_CHECK_DEFAULT                       /* 35 */
 PGM_CHECK_DEFAULT                       /* 36 */
 PGM_CHECK_DEFAULT                       /* 37 */
-PGM_CHECK_DEFAULT                       /* 38 */
+PGM_CHECK_64BIT(do_dat_exception)       /* 38 */
 PGM_CHECK_64BIT(do_dat_exception)       /* 39 */
 PGM_CHECK_64BIT(do_dat_exception)       /* 3a */
 PGM_CHECK_64BIT(do_dat_exception)       /* 3b */
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index fb535874a246..d8fd508ccd1e 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -94,7 +94,7 @@ static int restore_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
                 return -EINVAL;
 
         /* Use regs->psw.mask instead of PSW_USER_BITS to preserve PER bit. */
-        regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
+        regs->psw.mask = (regs->psw.mask & ~(PSW_MASK_USER | PSW_MASK_RI)) |
                 (user_sregs.regs.psw.mask & (PSW_MASK_USER | PSW_MASK_RI));
         /* Check for invalid user address space control. */
         if ((regs->psw.mask & PSW_MASK_ASC) == PSW_ASC_HOME)
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index 064c3082ab33..dd95f1631621 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -108,20 +108,10 @@ static void fixup_clock_comparator(unsigned long long delta)
         set_clock_comparator(S390_lowcore.clock_comparator);
 }
 
-static int s390_next_ktime(ktime_t expires,
+static int s390_next_event(unsigned long delta,
                            struct clock_event_device *evt)
 {
-        struct timespec ts;
-        u64 nsecs;
-
-        ts.tv_sec = ts.tv_nsec = 0;
-        monotonic_to_bootbased(&ts);
-        nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
-        do_div(nsecs, 125);
-        S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
-        /* Program the maximum value if we have an overflow (== year 2042) */
-        if (unlikely(S390_lowcore.clock_comparator < sched_clock_base_cc))
-                S390_lowcore.clock_comparator = -1ULL;
+        S390_lowcore.clock_comparator = get_tod_clock() + delta;
         set_clock_comparator(S390_lowcore.clock_comparator);
         return 0;
 }
@@ -146,15 +136,14 @@ void init_cpu_timer(void)
         cpu = smp_processor_id();
         cd = &per_cpu(comparators, cpu);
         cd->name                = "comparator";
-        cd->features            = CLOCK_EVT_FEAT_ONESHOT |
-                                  CLOCK_EVT_FEAT_KTIME;
+        cd->features            = CLOCK_EVT_FEAT_ONESHOT;
         cd->mult                = 16777;
         cd->shift               = 12;
         cd->min_delta_ns        = 1;
         cd->max_delta_ns        = LONG_MAX;
         cd->rating              = 400;
         cd->cpumask             = cpumask_of(cpu);
-        cd->set_next_ktime      = s390_next_ktime;
+        cd->set_next_event      = s390_next_event;
         cd->set_mode            = s390_set_mode;
 
         clockevents_register_device(cd);
@@ -221,21 +210,30 @@ struct clocksource * __init clocksource_default_clock(void)
         return &clocksource_tod;
 }
 
-void update_vsyscall_old(struct timespec *wall_time, struct timespec *wtm,
-                        struct clocksource *clock, u32 mult)
+void update_vsyscall(struct timekeeper *tk)
 {
-        if (clock != &clocksource_tod)
+        u64 nsecps;
+
+        if (tk->clock != &clocksource_tod)
                 return;
 
         /* Make userspace gettimeofday spin until we're done. */
         ++vdso_data->tb_update_count;
         smp_wmb();
-        vdso_data->xtime_tod_stamp = clock->cycle_last;
-        vdso_data->xtime_clock_sec = wall_time->tv_sec;
-        vdso_data->xtime_clock_nsec = wall_time->tv_nsec;
-        vdso_data->wtom_clock_sec = wtm->tv_sec;
-        vdso_data->wtom_clock_nsec = wtm->tv_nsec;
-        vdso_data->ntp_mult = mult;
+        vdso_data->xtime_tod_stamp = tk->clock->cycle_last;
+        vdso_data->xtime_clock_sec = tk->xtime_sec;
+        vdso_data->xtime_clock_nsec = tk->xtime_nsec;
+        vdso_data->wtom_clock_sec =
+                tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
+        vdso_data->wtom_clock_nsec = tk->xtime_nsec +
+                + (tk->wall_to_monotonic.tv_nsec << tk->shift);
+        nsecps = (u64) NSEC_PER_SEC << tk->shift;
+        while (vdso_data->wtom_clock_nsec >= nsecps) {
+                vdso_data->wtom_clock_nsec -= nsecps;
+                vdso_data->wtom_clock_sec++;
+        }
+        vdso_data->tk_mult = tk->mult;
+        vdso_data->tk_shift = tk->shift;
         smp_wmb();
         ++vdso_data->tb_update_count;
 }
diff --git a/arch/s390/kernel/vdso32/clock_gettime.S b/arch/s390/kernel/vdso32/clock_gettime.S
index b2224e0b974c..5be8e472f57d 100644
--- a/arch/s390/kernel/vdso32/clock_gettime.S
+++ b/arch/s390/kernel/vdso32/clock_gettime.S
@@ -38,25 +38,26 @@ __kernel_clock_gettime:
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,2f
         ahi     %r0,-1
-2:      ms      %r0,__VDSO_NTP_MULT(%r5)        /* cyc2ns(clock,cycle_delta) */
+2:      ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         lr      %r2,%r0
-        l       %r0,__VDSO_NTP_MULT(%r5)
+        l       %r0,__VDSO_TK_MULT(%r5)
         ltr     %r1,%r1
         mr      %r0,%r0
         jnm     3f
-        a       %r0,__VDSO_NTP_MULT(%r5)
+        a       %r0,__VDSO_TK_MULT(%r5)
 3:      alr     %r0,%r2
-        srdl    %r0,12
-        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
+        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
         al      %r1,__VDSO_XTIME_NSEC+4(%r5)
         brc     12,4f
         ahi     %r0,1
-4:      l       %r2,__VDSO_XTIME_SEC+4(%r5)
-        al      %r0,__VDSO_WTOM_NSEC(%r5)       /*  + wall_to_monotonic */
+4:      al      %r0,__VDSO_WTOM_NSEC(%r5)       /*  + wall_to_monotonic.nsec */
         al      %r1,__VDSO_WTOM_NSEC+4(%r5)
         brc     12,5f
         ahi     %r0,1
-5:      al      %r2,__VDSO_WTOM_SEC+4(%r5)
+5:      l       %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srdl    %r0,0(%r2)                      /*  >> tk->shift */
+        l       %r2,__VDSO_XTIME_SEC+4(%r5)
+        al      %r2,__VDSO_WTOM_SEC+4(%r5)
         cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
         jne     1b
         basr    %r5,0
@@ -86,20 +87,21 @@ __kernel_clock_gettime:
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,12f
         ahi     %r0,-1
-12:     ms      %r0,__VDSO_NTP_MULT(%r5)        /* cyc2ns(clock,cycle_delta) */
+12:     ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         lr      %r2,%r0
-        l       %r0,__VDSO_NTP_MULT(%r5)
+        l       %r0,__VDSO_TK_MULT(%r5)
         ltr     %r1,%r1
         mr      %r0,%r0
         jnm     13f
-        a       %r0,__VDSO_NTP_MULT(%r5)
+        a       %r0,__VDSO_TK_MULT(%r5)
 13:     alr     %r0,%r2
-        srdl    %r0,12
-        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
+        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
         al      %r1,__VDSO_XTIME_NSEC+4(%r5)
         brc     12,14f
         ahi     %r0,1
-14:     l       %r2,__VDSO_XTIME_SEC+4(%r5)
+14:     l       %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srdl    %r0,0(%r2)                      /*  >> tk->shift */
+        l       %r2,__VDSO_XTIME_SEC+4(%r5)
         cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
         jne     11b
         basr    %r5,0
diff --git a/arch/s390/kernel/vdso32/gettimeofday.S b/arch/s390/kernel/vdso32/gettimeofday.S
index 2d3633175e3b..fd621a950f7c 100644
--- a/arch/s390/kernel/vdso32/gettimeofday.S
+++ b/arch/s390/kernel/vdso32/gettimeofday.S
@@ -35,15 +35,14 @@ __kernel_gettimeofday:
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,3f
         ahi     %r0,-1
-3:      ms      %r0,__VDSO_NTP_MULT(%r5)        /* cyc2ns(clock,cycle_delta) */
+3:      ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         st      %r0,24(%r15)
-        l       %r0,__VDSO_NTP_MULT(%r5)
+        l       %r0,__VDSO_TK_MULT(%r5)
         ltr     %r1,%r1
         mr      %r0,%r0
         jnm     4f
-        a       %r0,__VDSO_NTP_MULT(%r5)
+        a       %r0,__VDSO_TK_MULT(%r5)
 4:      al      %r0,24(%r15)
-        srdl    %r0,12
         al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
         al      %r1,__VDSO_XTIME_NSEC+4(%r5)
         brc     12,5f
@@ -51,6 +50,8 @@ __kernel_gettimeofday:
 5:      mvc     24(4,%r15),__VDSO_XTIME_SEC+4(%r5)
         cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
         jne     1b
+        l       %r4,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srdl    %r0,0(%r4)                      /*  >> tk->shift */
         l       %r4,24(%r15)                    /* get tv_sec from stack */
         basr    %r5,0
 6:      ltr     %r0,%r0
diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
index d46c95ed5f19..0add1072ba30 100644
--- a/arch/s390/kernel/vdso64/clock_gettime.S
+++ b/arch/s390/kernel/vdso64/clock_gettime.S
@@ -34,14 +34,15 @@ __kernel_clock_gettime:
         tmll    %r4,0x0001                      /* pending update ? loop */
         jnz     0b
         stck    48(%r15)                        /* Store TOD clock */
+        lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        lg      %r0,__VDSO_XTIME_SEC(%r5)       /* tk->xtime_sec */
+        alg     %r0,__VDSO_WTOM_SEC(%r5)        /*  + wall_to_monotonic.sec */
         lg      %r1,48(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
-        msgf    %r1,__VDSO_NTP_MULT(%r5)        /*  * NTP adjustment */
-        srlg    %r1,%r1,12                      /* cyc2ns(clock,cycle_delta) */
-        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
-        lg      %r0,__VDSO_XTIME_SEC(%r5)
-        alg     %r1,__VDSO_WTOM_NSEC(%r5)       /*  + wall_to_monotonic */
-        alg     %r0,__VDSO_WTOM_SEC(%r5)
+        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
+        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
+        alg     %r1,__VDSO_WTOM_NSEC(%r5)       /*  + wall_to_monotonic.nsec */
+        srlg    %r1,%r1,0(%r2)                  /*  >> tk->shift */
         clg     %r4,__VDSO_UPD_COUNT(%r5)       /* check update counter */
         jne     0b
         larl    %r5,13f
@@ -62,12 +63,13 @@ __kernel_clock_gettime:
         tmll    %r4,0x0001                      /* pending update ? loop */
         jnz     5b
         stck    48(%r15)                        /* Store TOD clock */
+        lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
         lg      %r1,48(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
-        msgf    %r1,__VDSO_NTP_MULT(%r5)        /*  * NTP adjustment */
-        srlg    %r1,%r1,12                      /* cyc2ns(clock,cycle_delta) */
-        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
-        lg      %r0,__VDSO_XTIME_SEC(%r5)
+        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
+        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
+        srlg    %r1,%r1,0(%r2)                  /*  >> tk->shift */
+        lg      %r0,__VDSO_XTIME_SEC(%r5)       /* tk->xtime_sec */
         clg     %r4,__VDSO_UPD_COUNT(%r5)       /* check update counter */
         jne     5b
         larl    %r5,13f
diff --git a/arch/s390/kernel/vdso64/gettimeofday.S b/arch/s390/kernel/vdso64/gettimeofday.S
index 36ee674722ec..d0860d1d0ccc 100644
--- a/arch/s390/kernel/vdso64/gettimeofday.S
+++ b/arch/s390/kernel/vdso64/gettimeofday.S
@@ -31,12 +31,13 @@ __kernel_gettimeofday:
         stck    48(%r15)                        /* Store TOD clock */
         lg      %r1,48(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
-        msgf    %r1,__VDSO_NTP_MULT(%r5)        /*  * NTP adjustment */
-        srlg    %r1,%r1,12                      /* cyc2ns(clock,cycle_delta) */
-        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + xtime.tv_nsec */
-        lg      %r0,__VDSO_XTIME_SEC(%r5)       /* xtime.tv_sec */
+        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
+        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
+        lg      %r0,__VDSO_XTIME_SEC(%r5)       /* tk->xtime_sec */
         clg     %r4,__VDSO_UPD_COUNT(%r5)       /* check update counter */
         jne     0b
+        lgf     %r5,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srlg    %r1,%r1,0(%r5)                  /*  >> tk->shift */
         larl    %r5,5f
 2:      clg     %r1,0(%r5)
         jl      3f
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 97e03caf7825..dbdab3e7a1a6 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -78,11 +78,14 @@ static size_t copy_in_kernel(size_t count, void __user *to,
  * contains the (negative) exception code.
  */
 #ifdef CONFIG_64BIT
+
 static unsigned long follow_table(struct mm_struct *mm,
                                   unsigned long address, int write)
 {
         unsigned long *table = (unsigned long *)__pa(mm->pgd);
 
+        if (unlikely(address > mm->context.asce_limit - 1))
+                return -0x38UL;
         switch (mm->context.asce_bits & _ASCE_TYPE_MASK) {
         case _ASCE_TYPE_REGION1:
                 table = table + ((address >> 53) & 0x7ff);
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 48d92bbe62e9..36e658a4291c 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -33,12 +33,11 @@ MODE_INCLUDE	+= -I$(srctree)/$(ARCH_DIR)/include/shared/skas
 
 HEADER_ARCH     := $(SUBARCH)
 
-# Additional ARCH settings for x86
-ifeq ($(SUBARCH),i386)
-        HEADER_ARCH := x86
+ifneq ($(filter $(SUBARCH),x86 x86_64 i386),)
+        HEADER_ARCH := x86
 endif
-ifeq ($(SUBARCH),x86_64)
-        HEADER_ARCH := x86
+
+ifdef CONFIG_64BIT
         KBUILD_CFLAGS += -mcmodel=large
 endif
 
diff --git a/arch/um/kernel/sysrq.c b/arch/um/kernel/sysrq.c
index 4d6fdf68edf3..799d7e413bf5 100644
--- a/arch/um/kernel/sysrq.c
+++ b/arch/um/kernel/sysrq.c
@@ -19,7 +19,7 @@ struct stack_frame {
         unsigned long return_address;
 };
 
-static void print_stack_trace(unsigned long *sp, unsigned long bp)
+static void do_stack_trace(unsigned long *sp, unsigned long bp)
 {
         int reliable;
         unsigned long addr;
@@ -94,5 +94,5 @@ void show_stack(struct task_struct *task, unsigned long *stack)
         }
         printk(KERN_CONT "\n");
 
-        print_stack_trace(sp, bp);
+        do_stack_trace(sp, bp);
 }
diff --git a/arch/x86/include/asm/trace/irq_vectors.h b/arch/x86/include/asm/trace/irq_vectors.h
index 2874df24e7a4..4cab890007a7 100644
--- a/arch/x86/include/asm/trace/irq_vectors.h
+++ b/arch/x86/include/asm/trace/irq_vectors.h
@@ -72,6 +72,17 @@ DEFINE_IRQ_VECTOR_EVENT(x86_platform_ipi);
 DEFINE_IRQ_VECTOR_EVENT(irq_work);
 
 /*
+ * We must dis-allow sampling irq_work_exit() because perf event sampling
+ * itself can cause irq_work, which would lead to an infinite loop;
+ *
+ *  1) irq_work_exit happens
+ *  2) generates perf sample
+ *  3) generates irq_work
+ *  4) goto 1
+ */
+TRACE_EVENT_PERF_PERM(irq_work_exit, is_sampling_event(p_event) ? -EPERM : 0);
+
+/*
  * call_function - called when entering/exiting a call function interrupt
  * vector handler
  */
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index ef5356cd280a..850246206b12 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -114,6 +114,9 @@ static ssize_t hash_sendpage(struct socket *sock, struct page *page,
         struct hash_ctx *ctx = ask->private;
         int err;
 
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
+
         lock_sock(sk);
         sg_init_table(ctx->sgl.sg, 1);
         sg_set_page(ctx->sgl.sg, page, size, offset);
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 6a6dfc062d2a..a19c027b29bd 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -378,6 +378,9 @@ static ssize_t skcipher_sendpage(struct socket *sock, struct page *page,
         struct skcipher_sg_list *sgl;
         int err = -EINVAL;
 
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
+
         lock_sock(sk);
         if (!ctx->more && ctx->used)
                 goto unlock;
diff --git a/crypto/authenc.c b/crypto/authenc.c
index 1875e7026e8f..e1223559d5df 100644
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -380,9 +380,10 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
         if (!err) {
                 struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
                 struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
-                struct ablkcipher_request *abreq = aead_request_ctx(areq);
-                u8 *iv = (u8 *)(abreq + 1) +
-                         crypto_ablkcipher_reqsize(ctx->enc);
+                struct authenc_request_ctx *areq_ctx = aead_request_ctx(areq);
+                struct ablkcipher_request *abreq = (void *)(areq_ctx->tail
+                                                            + ctx->reqoff);
+                u8 *iv = (u8 *)abreq - crypto_ablkcipher_ivsize(ctx->enc);
 
                 err = crypto_authenc_genicv(areq, iv, 0);
         }
diff --git a/crypto/ccm.c b/crypto/ccm.c
index 3e05499d183a..1df84217f7c9 100644
--- a/crypto/ccm.c
+++ b/crypto/ccm.c
@@ -271,7 +271,8 @@ static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain,
         }
 
         /* compute plaintext into mac */
-        get_data_to_compute(cipher, pctx, plain, cryptlen);
+        if (cryptlen)
+                get_data_to_compute(cipher, pctx, plain, cryptlen);
 
 out:
         return err;
diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index 1ab8258fcf56..001f07cdb828 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -1242,6 +1242,10 @@ static int do_test(int m)
                 ret += tcrypt_test("cmac(des3_ede)");
                 break;
 
+        case 155:
+                ret += tcrypt_test("authenc(hmac(sha1),cbc(aes))");
+                break;
+
         case 200:
                 test_cipher_speed("ecb(aes)", ENCRYPT, sec, NULL, 0,
                                 speed_template_16_24_32);
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 432afc03e7c3..77955507f6f1 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -503,16 +503,16 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                 goto out;
                         }
 
-                        sg_init_one(&sg[0], input,
-                                    template[i].ilen + (enc ? authsize : 0));
-
                         if (diff_dst) {
                                 output = xoutbuf[0];
                                 output += align_offset;
+                                sg_init_one(&sg[0], input, template[i].ilen);
                                 sg_init_one(&sgout[0], output,
+                                            template[i].rlen);
+                        } else {
+                                sg_init_one(&sg[0], input,
                                             template[i].ilen +
                                                 (enc ? authsize : 0));
-                        } else {
                                 output = input;
                         }
 
@@ -612,12 +612,6 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                 memcpy(q, template[i].input + temp,
                                        template[i].tap[k]);
 
-                                n = template[i].tap[k];
-                                if (k == template[i].np - 1 && enc)
-                                        n += authsize;
-                                if (offset_in_page(q) + n < PAGE_SIZE)
-                                        q[n] = 0;
-
                                 sg_set_buf(&sg[k], q, template[i].tap[k]);
 
                                 if (diff_dst) {
@@ -625,13 +619,17 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                             offset_in_page(IDX[k]);
 
                                         memset(q, 0, template[i].tap[k]);
-                                        if (offset_in_page(q) + n < PAGE_SIZE)
-                                                q[n] = 0;
 
                                         sg_set_buf(&sgout[k], q,
                                                    template[i].tap[k]);
                                 }
 
+                                n = template[i].tap[k];
+                                if (k == template[i].np - 1 && enc)
+                                        n += authsize;
+                                if (offset_in_page(q) + n < PAGE_SIZE)
+                                        q[n] = 0;
+
                                 temp += template[i].tap[k];
                         }
 
@@ -650,10 +648,10 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                         goto out;
                                 }
 
-                                sg[k - 1].length += authsize;
-
                                 if (diff_dst)
                                         sgout[k - 1].length += authsize;
+                                else
+                                        sg[k - 1].length += authsize;
                         }
 
                         sg_init_table(asg, template[i].anp);
diff --git a/drivers/acpi/acpica/acresrc.h b/drivers/acpi/acpica/acresrc.h
index f691d0e4d9fa..ff97430455cb 100644
--- a/drivers/acpi/acpica/acresrc.h
+++ b/drivers/acpi/acpica/acresrc.h
@@ -184,7 +184,7 @@ acpi_rs_create_resource_list(union acpi_operand_object *aml_buffer,
                              struct acpi_buffer *output_buffer);
 
 acpi_status
-acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
+acpi_rs_create_aml_resources(struct acpi_buffer *resource_list,
                              struct acpi_buffer *output_buffer);
 
 acpi_status
@@ -227,8 +227,8 @@ acpi_rs_get_list_length(u8 * aml_buffer,
                         u32 aml_buffer_length, acpi_size * size_needed);
 
 acpi_status
-acpi_rs_get_aml_length(struct acpi_resource *linked_list_buffer,
-                       acpi_size * size_needed);
+acpi_rs_get_aml_length(struct acpi_resource *resource_list,
+                       acpi_size resource_list_size, acpi_size * size_needed);
 
 acpi_status
 acpi_rs_get_pci_routing_table_length(union acpi_operand_object *package_object,
diff --git a/drivers/acpi/acpica/nsalloc.c b/drivers/acpi/acpica/nsalloc.c
index 243737363fb8..fd1ff54cda19 100644
--- a/drivers/acpi/acpica/nsalloc.c
+++ b/drivers/acpi/acpica/nsalloc.c
@@ -106,6 +106,7 @@ struct acpi_namespace_node *acpi_ns_create_node(u32 name)
 void acpi_ns_delete_node(struct acpi_namespace_node *node)
 {
         union acpi_operand_object *obj_desc;
+        union acpi_operand_object *next_desc;
 
         ACPI_FUNCTION_NAME(ns_delete_node);
 
@@ -114,12 +115,13 @@ void acpi_ns_delete_node(struct acpi_namespace_node *node)
         acpi_ns_detach_object(node);
 
         /*
-         * Delete an attached data object if present (an object that was created
-         * and attached via acpi_attach_data). Note: After any normal object is
-         * detached above, the only possible remaining object is a data object.
+         * Delete an attached data object list if present (objects that were
+         * attached via acpi_attach_data). Note: After any normal object is
+         * detached above, the only possible remaining object(s) are data
+         * objects, in a linked list.
          */
         obj_desc = node->object;
-        if (obj_desc && (obj_desc->common.type == ACPI_TYPE_LOCAL_DATA)) {
+        while (obj_desc && (obj_desc->common.type == ACPI_TYPE_LOCAL_DATA)) {
 
                 /* Invoke the attached data deletion handler if present */
 
@@ -127,7 +129,15 @@ void acpi_ns_delete_node(struct acpi_namespace_node *node)
                         obj_desc->data.handler(node, obj_desc->data.pointer);
                 }
 
+                next_desc = obj_desc->common.next_object;
                 acpi_ut_remove_reference(obj_desc);
+                obj_desc = next_desc;
+        }
+
+        /* Special case for the statically allocated root node */
+
+        if (node == acpi_gbl_root_node) {
+                return;
         }
 
         /* Now we can delete the node */
diff --git a/drivers/acpi/acpica/nsutils.c b/drivers/acpi/acpica/nsutils.c
index cc2fea94c5f0..4a0665b6bcc1 100644
--- a/drivers/acpi/acpica/nsutils.c
+++ b/drivers/acpi/acpica/nsutils.c
@@ -593,24 +593,26 @@ struct acpi_namespace_node *acpi_ns_validate_handle(acpi_handle handle)
 
 void acpi_ns_terminate(void)
 {
-        union acpi_operand_object *obj_desc;
+        acpi_status status;
 
         ACPI_FUNCTION_TRACE(ns_terminate);
 
         /*
-         * 1) Free the entire namespace -- all nodes and objects
-         *
-         * Delete all object descriptors attached to namepsace nodes
+         * Free the entire namespace -- all nodes and all objects
+         * attached to the nodes
          */
         acpi_ns_delete_namespace_subtree(acpi_gbl_root_node);
 
-        /* Detach any objects attached to the root */
+        /* Delete any objects attached to the root node */
 
-        obj_desc = acpi_ns_get_attached_object(acpi_gbl_root_node);
-        if (obj_desc) {
-                acpi_ns_detach_object(acpi_gbl_root_node);
+        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+        if (ACPI_FAILURE(status)) {
+                return_VOID;
         }
 
+        acpi_ns_delete_node(acpi_gbl_root_node);
+        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Namespace freed\n"));
         return_VOID;
 }
diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c
index b62a0f4f4f9b..b60c9cf82862 100644
--- a/drivers/acpi/acpica/rscalc.c
+++ b/drivers/acpi/acpica/rscalc.c
@@ -174,6 +174,7 @@ acpi_rs_stream_option_length(u32 resource_length,
  * FUNCTION:    acpi_rs_get_aml_length
  *
  * PARAMETERS:  resource            - Pointer to the resource linked list
+ *              resource_list_size  - Size of the resource linked list
  *              size_needed         - Where the required size is returned
  *
  * RETURN:      Status
@@ -185,16 +186,20 @@ acpi_rs_stream_option_length(u32 resource_length,
  ******************************************************************************/
 
 acpi_status
-acpi_rs_get_aml_length(struct acpi_resource * resource, acpi_size * size_needed)
+acpi_rs_get_aml_length(struct acpi_resource *resource,
+                       acpi_size resource_list_size, acpi_size * size_needed)
 {
         acpi_size aml_size_needed = 0;
+        struct acpi_resource *resource_end;
         acpi_rs_length total_size;
 
         ACPI_FUNCTION_TRACE(rs_get_aml_length);
 
         /* Traverse entire list of internal resource descriptors */
 
-        while (resource) {
+        resource_end =
+            ACPI_ADD_PTR(struct acpi_resource, resource, resource_list_size);
+        while (resource < resource_end) {
 
                 /* Validate the descriptor type */
 
diff --git a/drivers/acpi/acpica/rscreate.c b/drivers/acpi/acpica/rscreate.c
index 65f3e1c5b598..3a2ace93e62c 100644
--- a/drivers/acpi/acpica/rscreate.c
+++ b/drivers/acpi/acpica/rscreate.c
@@ -418,22 +418,21 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
  *
  * FUNCTION:    acpi_rs_create_aml_resources
  *
- * PARAMETERS:  linked_list_buffer      - Pointer to the resource linked list
- *              output_buffer           - Pointer to the user's buffer
+ * PARAMETERS:  resource_list           - Pointer to the resource list buffer
+ *              output_buffer           - Where the AML buffer is returned
  *
  * RETURN:      Status  AE_OK if okay, else a valid acpi_status code.
  *              If the output_buffer is too small, the error will be
  *              AE_BUFFER_OVERFLOW and output_buffer->Length will point
  *              to the size buffer needed.
  *
- * DESCRIPTION: Takes the linked list of device resources and
- *              creates a bytestream to be used as input for the
- *              _SRS control method.
+ * DESCRIPTION: Converts a list of device resources to an AML bytestream
+ *              to be used as input for the _SRS control method.
  *
  ******************************************************************************/
 
 acpi_status
-acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
+acpi_rs_create_aml_resources(struct acpi_buffer *resource_list,
                              struct acpi_buffer *output_buffer)
 {
         acpi_status status;
@@ -441,16 +440,16 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
 
         ACPI_FUNCTION_TRACE(rs_create_aml_resources);
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "LinkedListBuffer = %p\n",
-                          linked_list_buffer));
+        /* Params already validated, no need to re-validate here */
 
-        /*
-         * Params already validated, so we don't re-validate here
-         *
-         * Pass the linked_list_buffer into a module that calculates
-         * the buffer size needed for the byte stream.
-         */
-        status = acpi_rs_get_aml_length(linked_list_buffer, &aml_size_needed);
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "ResourceList Buffer = %p\n",
+                          resource_list->pointer));
+
+        /* Get the buffer size needed for the AML byte stream */
+
+        status = acpi_rs_get_aml_length(resource_list->pointer,
+                                        resource_list->length,
+                                        &aml_size_needed);
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "AmlSizeNeeded=%X, %s\n",
                           (u32)aml_size_needed, acpi_format_exception(status)));
@@ -467,10 +466,9 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
 
         /* Do the conversion */
 
-        status =
-            acpi_rs_convert_resources_to_aml(linked_list_buffer,
-                                             aml_size_needed,
-                                             output_buffer->pointer);
+        status = acpi_rs_convert_resources_to_aml(resource_list->pointer,
+                                                  aml_size_needed,
+                                                  output_buffer->pointer);
         if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
         }
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index aef303d56d86..14a7982c9961 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -753,7 +753,7 @@ acpi_rs_set_srs_method_data(struct acpi_namespace_node *node,
          * Convert the linked list into a byte stream
          */
         buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;
-        status = acpi_rs_create_aml_resources(in_buffer->pointer, &buffer);
+        status = acpi_rs_create_aml_resources(in_buffer, &buffer);
         if (ACPI_FAILURE(status)) {
                 goto cleanup;
         }
diff --git a/drivers/acpi/acpica/utdebug.c b/drivers/acpi/acpica/utdebug.c
index 1a67b3944b3b..03ae8affe48f 100644
--- a/drivers/acpi/acpica/utdebug.c
+++ b/drivers/acpi/acpica/utdebug.c
@@ -185,6 +185,7 @@ acpi_debug_print(u32 requested_debug_level,
                 }
 
                 acpi_gbl_prev_thread_id = thread_id;
+                acpi_gbl_nesting_level = 0;
         }
 
         /*
@@ -193,13 +194,21 @@ acpi_debug_print(u32 requested_debug_level,
          */
         acpi_os_printf("%9s-%04ld ", module_name, line_number);
 
+#ifdef ACPI_EXEC_APP
+        /*
+         * For acpi_exec only, emit the thread ID and nesting level.
+         * Note: nesting level is really only useful during a single-thread
+         * execution. Otherwise, multiple threads will keep resetting the
+         * level.
+         */
         if (ACPI_LV_THREADS & acpi_dbg_level) {
                 acpi_os_printf("[%u] ", (u32)thread_id);
         }
 
-        acpi_os_printf("[%02ld] %-22.22s: ",
-                       acpi_gbl_nesting_level,
-                       acpi_ut_trim_function_name(function_name));
+        acpi_os_printf("[%02ld] ", acpi_gbl_nesting_level);
+#endif
+
+        acpi_os_printf("%-22.22s: ", acpi_ut_trim_function_name(function_name));
 
         va_start(args, format);
         acpi_os_vprintf(format, args);
@@ -420,7 +429,9 @@ acpi_ut_exit(u32 line_number,
                                  component_id, "%s\n", acpi_gbl_fn_exit_str);
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_exit)
@@ -467,7 +478,9 @@ acpi_ut_status_exit(u32 line_number,
                 }
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_status_exit)
@@ -504,7 +517,9 @@ acpi_ut_value_exit(u32 line_number,
                                  ACPI_FORMAT_UINT64(value));
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_value_exit)
@@ -540,7 +555,9 @@ acpi_ut_ptr_exit(u32 line_number,
                                  ptr);
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 #endif
diff --git a/drivers/acpi/nvs.c b/drivers/acpi/nvs.c
index 266bc58ce0ce..386a9fe497b4 100644
--- a/drivers/acpi/nvs.c
+++ b/drivers/acpi/nvs.c
@@ -13,7 +13,6 @@
 #include <linux/slab.h>
 #include <linux/acpi.h>
 #include <linux/acpi_io.h>
-#include <acpi/acpiosxf.h>
 
 /* ACPI NVS regions, APEI may use it */
 
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 0703bff5e60e..20360e480bd8 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -65,6 +65,9 @@ static struct acpi_scan_handler pci_root_handler = {
         .ids = root_device_ids,
         .attach = acpi_pci_root_add,
         .detach = acpi_pci_root_remove,
+        .hotplug = {
+                .ignore = true,
+        },
 };
 
 static DEFINE_MUTEX(osc_lock);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 15daa21fcd05..fd39459926b1 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1772,7 +1772,7 @@ static void acpi_scan_init_hotplug(acpi_handle handle, int type)
          */
         list_for_each_entry(hwid, &pnp.ids, list) {
                 handler = acpi_scan_match_handler(hwid->id, NULL);
-                if (handler) {
+                if (handler && !handler->hotplug.ignore) {
                         acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                                         acpi_hotplug_notify_cb, handler);
                         break;
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 14df30580e15..721e949e606e 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -525,7 +525,7 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
          * generate wakeup events.
          */
         if (ACPI_SUCCESS(status) && (acpi_state == ACPI_STATE_S3)) {
-                acpi_event_status pwr_btn_status;
+                acpi_event_status pwr_btn_status = ACPI_EVENT_FLAG_DISABLED;
 
                 acpi_get_event_status(ACPI_EVENT_POWER_BUTTON, &pwr_btn_status);
 
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index db5293650f62..6dbc3ca45223 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -309,7 +309,7 @@ static void acpi_table_attr_init(struct acpi_table_attr *table_attr,
                 sprintf(table_attr->name + ACPI_NAME_SIZE, "%d",
                         table_attr->instance);
 
-        table_attr->attr.size = 0;
+        table_attr->attr.size = table_header->length;
         table_attr->attr.read = acpi_table_show;
         table_attr->attr.attr.name = table_attr->name;
         table_attr->attr.attr.mode = 0400;
@@ -354,8 +354,9 @@ static int acpi_tables_sysfs_init(void)
 {
         struct acpi_table_attr *table_attr;
         struct acpi_table_header *table_header = NULL;
-        int table_index = 0;
-        int result;
+        int table_index;
+        acpi_status status;
+        int ret;
 
         tables_kobj = kobject_create_and_add("tables", acpi_kobj);
         if (!tables_kobj)
@@ -365,33 +366,34 @@ static int acpi_tables_sysfs_init(void)
         if (!dynamic_tables_kobj)
                 goto err_dynamic_tables;
 
-        do {
-                result = acpi_get_table_by_index(table_index, &table_header);
-                if (!result) {
-                        table_index++;
-                        table_attr = NULL;
-                        table_attr =
-                            kzalloc(sizeof(struct acpi_table_attr), GFP_KERNEL);
-                        if (!table_attr)
-                                return -ENOMEM;
-
-                        acpi_table_attr_init(table_attr, table_header);
-                        result =
-                            sysfs_create_bin_file(tables_kobj,
-                                                  &table_attr->attr);
-                        if (result) {
-                                kfree(table_attr);
-                                return result;
-                        } else
-                                list_add_tail(&table_attr->node,
-                                              &acpi_table_attr_list);
+        for (table_index = 0;; table_index++) {
+                status = acpi_get_table_by_index(table_index, &table_header);
+
+                if (status == AE_BAD_PARAMETER)
+                        break;
+
+                if (ACPI_FAILURE(status))
+                        continue;
+
+                table_attr = NULL;
+                table_attr = kzalloc(sizeof(*table_attr), GFP_KERNEL);
+                if (!table_attr)
+                        return -ENOMEM;
+
+                acpi_table_attr_init(table_attr, table_header);
+                ret = sysfs_create_bin_file(tables_kobj, &table_attr->attr);
+                if (ret) {
+                        kfree(table_attr);
+                        return ret;
                 }
-        } while (!result);
+                list_add_tail(&table_attr->node, &acpi_table_attr_list);
+        }
+
         kobject_uevent(tables_kobj, KOBJ_ADD);
         kobject_uevent(dynamic_tables_kobj, KOBJ_ADD);
-        result = acpi_install_table_handler(acpi_sysfs_table_handler, NULL);
+        status = acpi_install_table_handler(acpi_sysfs_table_handler, NULL);
 
-        return result == AE_OK ? 0 : -EINVAL;
+        return ACPI_FAILURE(status) ? -EINVAL : 0;
 err_dynamic_tables:
         kobject_put(tables_kobj);
 err:
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index e2903d03180e..14f1e9506338 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -435,6 +435,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 on some Gigabyte */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3),
           .driver_data = board_ahci_yes_fbs },
+        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
+          .driver_data = board_ahci_yes_fbs },
 
         /* Promise */
         { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index f9554318504f..4b231baceb09 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -329,6 +329,7 @@ static SIMPLE_DEV_PM_OPS(ahci_pm_ops, ahci_suspend, ahci_resume);
 static const struct of_device_id ahci_of_match[] = {
         { .compatible = "snps,spear-ahci", },
         { .compatible = "snps,exynos5440-ahci", },
+        { .compatible = "ibm,476gtr-ahci", },
         {},
 };
 MODULE_DEVICE_TABLE(of, ahci_of_match);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 81a94a3919db..75b93678bbcd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6304,10 +6304,9 @@ static void ata_port_detach(struct ata_port *ap)
                 for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
                         ata_tlink_delete(&ap->pmp_link[i]);
         }
-        ata_tport_delete(ap);
-
         /* remove the associated SCSI host */
         scsi_remove_host(ap->scsi_host);
+        ata_tport_delete(ap);
 }
 
 /**
diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index 68f9e3293e9c..88949c6d55dd 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -88,15 +88,13 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
 static bool odd_can_poweroff(struct ata_device *ata_dev)
 {
         acpi_handle handle;
-        acpi_status status;
         struct acpi_device *acpi_dev;
 
         handle = ata_dev_acpi_handle(ata_dev);
         if (!handle)
                 return false;
 
-        status = acpi_bus_get_device(handle, &acpi_dev);
-        if (ACPI_FAILURE(status))
+        if (acpi_bus_get_device(handle, &acpi_dev))
                 return false;
 
         return acpi_device_can_poweroff(acpi_dev);
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index e88690ebfd82..73492dd4a4bc 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -319,6 +319,7 @@ static int cf_init(struct arasan_cf_dev *acdev)
         ret = clk_set_rate(acdev->clk, 166000000);
         if (ret) {
                 dev_warn(acdev->host->dev, "clock set rate failed");
+                clk_disable_unprepare(acdev->clk);
                 return ret;
         }
 
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index bdb953e15d2a..5c07a56962db 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -87,6 +87,7 @@ config ARM_ARCH_TIMER
 config ARM_ARCH_TIMER_EVTSTREAM
         bool "Support for ARM architected timer event stream generation"
         default y if ARM_ARCH_TIMER
+        depends on ARM_ARCH_TIMER
         help
           This option enables support for event stream generation based on
           the ARM architected timer. It is used for waking up CPUs executing
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 4aac9ee0d0c0..3cf12834681e 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -313,8 +313,20 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
                 goto err1;
         }
 
-        return sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
-                                cfg->clockevent_rating);
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err2;
+
+        ret = sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
+                               cfg->clockevent_rating);
+        if (ret < 0)
+                goto err3;
+
+        return 0;
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
  err1:
         iounmap(p->mapbase);
  err0:
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 78b8dae49628..63557cda0a7d 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -472,12 +472,26 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
                 ret = PTR_ERR(p->clk);
                 goto err1;
         }
+
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err2;
+
         p->cs_enabled = false;
         p->enable_count = 0;
 
-        return sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
-                               cfg->clockevent_rating,
-                               cfg->clocksource_rating);
+        ret = sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
+                              cfg->clockevent_rating,
+                              cfg->clocksource_rating);
+        if (ret < 0)
+                goto err3;
+
+        return 0;
+
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
  err1:
         iounmap(p->mapbase);
  err0:
diff --git a/drivers/cpufreq/exynos4210-cpufreq.c b/drivers/cpufreq/exynos4210-cpufreq.c
index f2c75065ce19..dfd1643b0b2f 100644
--- a/drivers/cpufreq/exynos4210-cpufreq.c
+++ b/drivers/cpufreq/exynos4210-cpufreq.c
@@ -157,4 +157,3 @@ err_moutcore:
         pr_debug("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos4210_cpufreq_init);
diff --git a/drivers/cpufreq/exynos4x12-cpufreq.c b/drivers/cpufreq/exynos4x12-cpufreq.c
index 8683304ce62c..efad5e657f6f 100644
--- a/drivers/cpufreq/exynos4x12-cpufreq.c
+++ b/drivers/cpufreq/exynos4x12-cpufreq.c
@@ -211,4 +211,3 @@ err_moutcore:
         pr_debug("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos4x12_cpufreq_init);
diff --git a/drivers/cpufreq/exynos5250-cpufreq.c b/drivers/cpufreq/exynos5250-cpufreq.c
index 9fae466d7746..8feda86fe42c 100644
--- a/drivers/cpufreq/exynos5250-cpufreq.c
+++ b/drivers/cpufreq/exynos5250-cpufreq.c
@@ -236,4 +236,3 @@ err_moutcore:
         pr_err("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos5250_cpufreq_init);
diff --git a/drivers/cpufreq/tegra-cpufreq.c b/drivers/cpufreq/tegra-cpufreq.c
index f42df7ec03c5..b7309c37033d 100644
--- a/drivers/cpufreq/tegra-cpufreq.c
+++ b/drivers/cpufreq/tegra-cpufreq.c
@@ -142,10 +142,8 @@ static int tegra_target(struct cpufreq_policy *policy, unsigned int index)
 
         mutex_lock(&tegra_cpu_lock);
 
-        if (is_suspended) {
-                ret = -EBUSY;
+        if (is_suspended)
                 goto out;
-        }
 
         freq = freq_table[index].frequency;
 
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 4f44b71b9e24..4cf5dec826e1 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -818,7 +818,7 @@ static void aead_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
                        ivsize, 1);
         print_hex_dump(KERN_ERR, "dst    @"__stringify(__LINE__)": ",
                        DUMP_PREFIX_ADDRESS, 16, 4, sg_virt(req->dst),
-                       req->cryptlen, 1);
+                       req->cryptlen - ctx->authsize, 1);
 #endif
 
         if (err) {
@@ -972,12 +972,9 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                                  (edesc->src_nents ? : 1);
                 in_options = LDST_SGF;
         }
-        if (encrypt)
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                                  req->cryptlen - authsize, in_options);
-        else
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                                  req->cryptlen, in_options);
+
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
+                          in_options);
 
         if (likely(req->src == req->dst)) {
                 if (all_contig) {
@@ -998,7 +995,8 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                 }
         }
         if (encrypt)
-                append_seq_out_ptr(desc, dst_dma, req->cryptlen, out_options);
+                append_seq_out_ptr(desc, dst_dma, req->cryptlen + authsize,
+                                   out_options);
         else
                 append_seq_out_ptr(desc, dst_dma, req->cryptlen - authsize,
                                    out_options);
@@ -1048,8 +1046,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                 sec4_sg_index += edesc->assoc_nents + 1 + edesc->src_nents;
                 in_options = LDST_SGF;
         }
-        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                          req->cryptlen - authsize, in_options);
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
+                          in_options);
 
         if (contig & GIV_DST_CONTIG) {
                 dst_dma = edesc->iv_dma;
@@ -1066,7 +1064,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                 }
         }
 
-        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen, out_options);
+        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen + authsize,
+                           out_options);
 }
 
 /*
@@ -1130,7 +1129,8 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
  * allocate and map the aead extended descriptor
  */
 static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
-                                           int desc_bytes, bool *all_contig_ptr)
+                                           int desc_bytes, bool *all_contig_ptr,
+                                           bool encrypt)
 {
         struct crypto_aead *aead = crypto_aead_reqtfm(req);
         struct caam_ctx *ctx = crypto_aead_ctx(aead);
@@ -1145,12 +1145,22 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
         bool assoc_chained = false, src_chained = false, dst_chained = false;
         int ivsize = crypto_aead_ivsize(aead);
         int sec4_sg_index, sec4_sg_len = 0, sec4_sg_bytes;
+        unsigned int authsize = ctx->authsize;
 
         assoc_nents = sg_count(req->assoc, req->assoclen, &assoc_chained);
-        src_nents = sg_count(req->src, req->cryptlen, &src_chained);
 
-        if (unlikely(req->dst != req->src))
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+        if (unlikely(req->dst != req->src)) {
+                src_nents = sg_count(req->src, req->cryptlen, &src_chained);
+                dst_nents = sg_count(req->dst,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : (-authsize)),
+                                     &dst_chained);
+        } else {
+                src_nents = sg_count(req->src,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : 0),
+                                     &src_chained);
+        }
 
         sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                  DMA_TO_DEVICE, assoc_chained);
@@ -1234,11 +1244,9 @@ static int aead_encrypt(struct aead_request *req)
         u32 *desc;
         int ret = 0;
 
-        req->cryptlen += ctx->authsize;
-
         /* allocate extended descriptor */
         edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1275,7 +1283,7 @@ static int aead_decrypt(struct aead_request *req)
 
         /* allocate extended descriptor */
         edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1332,7 +1340,8 @@ static struct aead_edesc *aead_giv_edesc_alloc(struct aead_givcrypt_request
         src_nents = sg_count(req->src, req->cryptlen, &src_chained);
 
         if (unlikely(req->dst != req->src))
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+                dst_nents = sg_count(req->dst, req->cryptlen + ctx->authsize,
+                                     &dst_chained);
 
         sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                  DMA_TO_DEVICE, assoc_chained);
@@ -1426,8 +1435,6 @@ static int aead_givencrypt(struct aead_givcrypt_request *areq)
         u32 *desc;
         int ret = 0;
 
-        req->cryptlen += ctx->authsize;
-
         /* allocate extended descriptor */
         edesc = aead_giv_edesc_alloc(areq, DESC_JOB_IO_LEN *
                                      CAAM_CMD_SZ, &contig);
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index d23356d20e1c..1d80bd3636c5 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/of_irq.h>
+#include <linux/of_address.h>
 
 #include "compat.h"
 #include "regs.h"
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 905de4427e7c..b44f4ddc565c 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -790,7 +790,7 @@ static void ipsec_esp_unmap(struct device *dev,
 
         if (edesc->assoc_chained)
                 talitos_unmap_sg_chain(dev, areq->assoc, DMA_TO_DEVICE);
-        else
+        else if (areq->assoclen)
                 /* assoc_nents counts also for IV in non-contiguous cases */
                 dma_unmap_sg(dev, areq->assoc,
                              edesc->assoc_nents ? edesc->assoc_nents - 1 : 1,
@@ -973,7 +973,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
                 dma_sync_single_for_device(dev, edesc->dma_link_tbl,
                                            edesc->dma_len, DMA_BIDIRECTIONAL);
         } else {
-                to_talitos_ptr(&desc->ptr[1], sg_dma_address(areq->assoc));
+                if (areq->assoclen)
+                        to_talitos_ptr(&desc->ptr[1],
+                                       sg_dma_address(areq->assoc));
+                else
+                        to_talitos_ptr(&desc->ptr[1], edesc->iv_dma);
                 desc->ptr[1].j_extent = 0;
         }
 
@@ -1108,7 +1112,8 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                                                  unsigned int authsize,
                                                  unsigned int ivsize,
                                                  int icv_stashing,
-                                                 u32 cryptoflags)
+                                                 u32 cryptoflags,
+                                                 bool encrypt)
 {
         struct talitos_edesc *edesc;
         int assoc_nents = 0, src_nents, dst_nents, alloc_len, dma_len;
@@ -1122,10 +1127,10 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                 return ERR_PTR(-EINVAL);
         }
 
-        if (iv)
+        if (ivsize)
                 iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
 
-        if (assoc) {
+        if (assoclen) {
                 /*
                  * Currently it is assumed that iv is provided whenever assoc
                  * is.
@@ -1141,19 +1146,17 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                         assoc_nents = assoc_nents ? assoc_nents + 1 : 2;
         }
 
-        src_nents = sg_count(src, cryptlen + authsize, &src_chained);
-        src_nents = (src_nents == 1) ? 0 : src_nents;
-
-        if (!dst) {
-                dst_nents = 0;
-        } else {
-                if (dst == src) {
-                        dst_nents = src_nents;
-                } else {
-                        dst_nents = sg_count(dst, cryptlen + authsize,
-                                             &dst_chained);
-                        dst_nents = (dst_nents == 1) ? 0 : dst_nents;
-                }
+        if (!dst || dst == src) {
+                src_nents = sg_count(src, cryptlen + authsize, &src_chained);
+                src_nents = (src_nents == 1) ? 0 : src_nents;
+                dst_nents = dst ? src_nents : 0;
+        } else { /* dst && dst != src*/
+                src_nents = sg_count(src, cryptlen + (encrypt ? 0 : authsize),
+                                     &src_chained);
+                src_nents = (src_nents == 1) ? 0 : src_nents;
+                dst_nents = sg_count(dst, cryptlen + (encrypt ? authsize : 0),
+                                     &dst_chained);
+                dst_nents = (dst_nents == 1) ? 0 : dst_nents;
         }
 
         /*
@@ -1173,9 +1176,16 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 
         edesc = kmalloc(alloc_len, GFP_DMA | flags);
         if (!edesc) {
-                talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                if (assoc_chained)
+                        talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                else if (assoclen)
+                        dma_unmap_sg(dev, assoc,
+                                     assoc_nents ? assoc_nents - 1 : 1,
+                                     DMA_TO_DEVICE);
+
                 if (iv_dma)
                         dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
+
                 dev_err(dev, "could not allocate edescriptor\n");
                 return ERR_PTR(-ENOMEM);
         }
@@ -1197,7 +1207,7 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 }
 
 static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
-                                              int icv_stashing)
+                                              int icv_stashing, bool encrypt)
 {
         struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
         struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
@@ -1206,7 +1216,7 @@ static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
         return talitos_edesc_alloc(ctx->dev, areq->assoc, areq->src, areq->dst,
                                    iv, areq->assoclen, areq->cryptlen,
                                    ctx->authsize, ivsize, icv_stashing,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 
 static int aead_encrypt(struct aead_request *req)
@@ -1216,7 +1226,7 @@ static int aead_encrypt(struct aead_request *req)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 0);
+        edesc = aead_edesc_alloc(req, req->iv, 0, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1239,7 +1249,7 @@ static int aead_decrypt(struct aead_request *req)
         req->cryptlen -= authsize;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 1);
+        edesc = aead_edesc_alloc(req, req->iv, 1, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1285,7 +1295,7 @@ static int aead_givencrypt(struct aead_givcrypt_request *req)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(areq, req->giv, 0);
+        edesc = aead_edesc_alloc(areq, req->giv, 0, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1441,7 +1451,7 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
 }
 
 static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
-                                                    areq)
+                                                    areq, bool encrypt)
 {
         struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
         struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
@@ -1449,7 +1459,7 @@ static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
 
         return talitos_edesc_alloc(ctx->dev, NULL, areq->src, areq->dst,
                                    areq->info, 0, areq->nbytes, 0, ivsize, 0,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 
 static int ablkcipher_encrypt(struct ablkcipher_request *areq)
@@ -1459,7 +1469,7 @@ static int ablkcipher_encrypt(struct ablkcipher_request *areq)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1476,7 +1486,7 @@ static int ablkcipher_decrypt(struct ablkcipher_request *areq)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1628,7 +1638,7 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
         struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
 
         return talitos_edesc_alloc(ctx->dev, NULL, req_ctx->psrc, NULL, NULL, 0,
-                                   nbytes, 0, 0, 0, areq->base.flags);
+                                   nbytes, 0, 0, 0, areq->base.flags, false);
 }
 
 static int ahash_init(struct ahash_request *areq)
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index 72c927dc3be1..54c18c220a60 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -158,7 +158,7 @@ static int bcm_kona_gpio_get(struct gpio_chip *chip, unsigned gpio)
         spin_unlock_irqrestore(&kona_gpio->lock, flags);
 
         /* return the specified bit status */
-        return !!(val & bit);
+        return !!(val & BIT(bit));
 }
 
 static int bcm_kona_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 914e859e3eda..d7d6d72eba33 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -70,10 +70,14 @@ static int mpc8572_gpio_get(struct gpio_chip *gc, unsigned int gpio)
         u32 val;
         struct of_mm_gpio_chip *mm = to_of_mm_gpio_chip(gc);
         struct mpc8xxx_gpio_chip *mpc8xxx_gc = to_mpc8xxx_gpio_chip(mm);
+        u32 out_mask, out_shadow;
 
-        val = in_be32(mm->regs + GPIO_DAT) & ~in_be32(mm->regs + GPIO_DIR);
+        out_mask = in_be32(mm->regs + GPIO_DIR);
 
-        return (val | mpc8xxx_gc->data) & mpc8xxx_gpio2mask(gpio);
+        val = in_be32(mm->regs + GPIO_DAT) & ~out_mask;
+        out_shadow = mpc8xxx_gc->data & out_mask;
+
+        return (val | out_shadow) & mpc8xxx_gpio2mask(gpio);
 }
 
 static int mpc8xxx_gpio_get(struct gpio_chip *gc, unsigned int gpio)
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index f7a0cc4da950..7b37300973db 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -102,7 +102,7 @@ struct msm_gpio_dev {
         DECLARE_BITMAP(wake_irqs, MAX_NR_GPIO);
         DECLARE_BITMAP(dual_edge_irqs, MAX_NR_GPIO);
         struct irq_domain *domain;
-        unsigned int summary_irq;
+        int summary_irq;
         void __iomem *msm_tlmm_base;
 };
 
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 3c3321f94053..db3129043e63 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -79,7 +79,7 @@ struct mvebu_gpio_chip {
         spinlock_t         lock;
         void __iomem      *membase;
         void __iomem      *percpu_membase;
-        unsigned int       irqbase;
+        int                irqbase;
         struct irq_domain *domain;
         int                soc_variant;
 };
diff --git a/drivers/gpio/gpio-pl061.c b/drivers/gpio/gpio-pl061.c
index f22f7f3e2e53..b4d42112d02d 100644
--- a/drivers/gpio/gpio-pl061.c
+++ b/drivers/gpio/gpio-pl061.c
@@ -286,11 +286,6 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
         if (!chip->base)
                 return -ENOMEM;
 
-        chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
-                                             irq_base, &pl061_domain_ops, chip);
-        if (!chip->domain)
-                return -ENODEV;
-
         spin_lock_init(&chip->lock);
 
         chip->gc.request = pl061_gpio_request;
@@ -320,6 +315,11 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
         irq_set_chained_handler(irq, pl061_irq_handler);
         irq_set_handler_data(irq, chip);
 
+        chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
+                                             irq_base, &pl061_domain_ops, chip);
+        if (!chip->domain)
+                return -ENODEV;
+
         for (i = 0; i < PL061_GPIO_NR; i++) {
                 if (pdata) {
                         if (pdata->directions & (1 << i))
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index d3f15ae93bd3..fe088a30567a 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -381,7 +381,7 @@ static int gpio_rcar_probe(struct platform_device *pdev)
         if (!p->irq_domain) {
                 ret = -ENXIO;
                 dev_err(&pdev->dev, "cannot initialize irq domain\n");
-                goto err1;
+                goto err0;
         }
 
         if (devm_request_irq(&pdev->dev, irq->start,
diff --git a/drivers/gpio/gpio-tb10x.c b/drivers/gpio/gpio-tb10x.c
index 0502b9a041a5..da071ddbad99 100644
--- a/drivers/gpio/gpio-tb10x.c
+++ b/drivers/gpio/gpio-tb10x.c
@@ -132,6 +132,7 @@ static int tb10x_gpio_direction_out(struct gpio_chip *chip,
         int mask = BIT(offset);
         int val = TB10X_GPIO_DIR_OUT << offset;
 
+        tb10x_gpio_set(chip, offset, value);
         tb10x_set_bits(tb10x_gpio, OFFSET_TO_REG_DDR, mask, val);
 
         return 0;
diff --git a/drivers/gpio/gpio-ucb1400.c b/drivers/gpio/gpio-ucb1400.c
index 1a605f2a0f55..06fb5cf99ded 100644
--- a/drivers/gpio/gpio-ucb1400.c
+++ b/drivers/gpio/gpio-ucb1400.c
@@ -105,3 +105,4 @@ module_platform_driver(ucb1400_gpio_driver);
 
 MODULE_DESCRIPTION("Philips UCB1400 GPIO driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:ucb1400_gpio");
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 4e10b10d3ddd..85f772c0b26a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -14,6 +14,7 @@
 #include <linux/idr.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
+#include <linux/gpio/driver.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/gpio.h>
@@ -1308,6 +1309,18 @@ struct gpio_chip *gpiochip_find(void *data,
 }
 EXPORT_SYMBOL_GPL(gpiochip_find);
 
+static int gpiochip_match_name(struct gpio_chip *chip, void *data)
+{
+        const char *name = data;
+
+        return !strcmp(chip->label, name);
+}
+
+static struct gpio_chip *find_chip_by_name(const char *name)
+{
+        return gpiochip_find((void *)name, gpiochip_match_name);
+}
+
 #ifdef CONFIG_PINCTRL
 
 /**
@@ -1341,8 +1354,10 @@ int gpiochip_add_pingroup_range(struct gpio_chip *chip,
         ret = pinctrl_get_group_pins(pctldev, pin_group,
                                         &pin_range->range.pins,
                                         &pin_range->range.npins);
-        if (ret < 0)
+        if (ret < 0) {
+                kfree(pin_range);
                 return ret;
+        }
 
         pinctrl_add_gpio_range(pctldev, &pin_range->range);
 
@@ -2260,26 +2275,10 @@ void gpiod_add_table(struct gpiod_lookup *table, size_t size)
         mutex_unlock(&gpio_lookup_lock);
 }
 
-/*
- * Caller must have a acquired gpio_lookup_lock
- */
-static struct gpio_chip *find_chip_by_name(const char *name)
-{
-        struct gpio_chip *chip = NULL;
-
-        list_for_each_entry(chip, &gpio_lookup_list, list) {
-                if (chip->label == NULL)
-                        continue;
-                if (!strcmp(chip->label, name))
-                        break;
-        }
-
-        return chip;
-}
-
 #ifdef CONFIG_OF
 static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
-                                      unsigned int idx, unsigned long *flags)
+                                      unsigned int idx,
+                                      enum gpio_lookup_flags *flags)
 {
         char prop_name[32]; /* 32 is max size of property name */
         enum of_gpio_flags of_flags;
@@ -2297,20 +2296,22 @@ static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
                 return desc;
 
         if (of_flags & OF_GPIO_ACTIVE_LOW)
-                *flags |= GPIOF_ACTIVE_LOW;
+                *flags |= GPIO_ACTIVE_LOW;
 
         return desc;
 }
 #else
 static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
-                                      unsigned int idx, unsigned long *flags)
+                                      unsigned int idx,
+                                      enum gpio_lookup_flags *flags)
 {
         return ERR_PTR(-ENODEV);
 }
 #endif
 
 static struct gpio_desc *acpi_find_gpio(struct device *dev, const char *con_id,
-                                        unsigned int idx, unsigned long *flags)
+                                        unsigned int idx,
+                                        enum gpio_lookup_flags *flags)
 {
         struct acpi_gpio_info info;
         struct gpio_desc *desc;
@@ -2320,13 +2321,14 @@ static struct gpio_desc *acpi_find_gpio(struct device *dev, const char *con_id,
                 return desc;
 
         if (info.gpioint && info.active_low)
-                *flags |= GPIOF_ACTIVE_LOW;
+                *flags |= GPIO_ACTIVE_LOW;
 
         return desc;
 }
 
 static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
-                                    unsigned int idx, unsigned long *flags)
+                                    unsigned int idx,
+                                    enum gpio_lookup_flags *flags)
 {
         const char *dev_id = dev ? dev_name(dev) : NULL;
         struct gpio_desc *desc = ERR_PTR(-ENODEV);
@@ -2366,7 +2368,7 @@ static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
                                 continue;
                         }
 
-                        if (chip->ngpio >= p->chip_hwnum) {
+                        if (chip->ngpio <= p->chip_hwnum) {
                                 dev_warn(dev, "GPIO chip %s has %d GPIOs\n",
                                          chip->label, chip->ngpio);
                                 continue;
@@ -2416,9 +2418,9 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
                                                const char *con_id,
                                                unsigned int idx)
 {
-        struct gpio_desc *desc;
+        struct gpio_desc *desc = NULL;
         int status;
-        unsigned long flags = 0;
+        enum gpio_lookup_flags flags = 0;
 
         dev_dbg(dev, "GPIO lookup for consumer %s\n", con_id);
 
@@ -2429,13 +2431,23 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
         } else if (IS_ENABLED(CONFIG_ACPI) && dev && ACPI_HANDLE(dev)) {
                 dev_dbg(dev, "using ACPI for GPIO lookup\n");
                 desc = acpi_find_gpio(dev, con_id, idx, &flags);
-        } else {
+        }
+
+        /*
+         * Either we are not using DT or ACPI, or their lookup did not return
+         * a result. In that case, use platform lookup as a fallback.
+         */
+        if (!desc || IS_ERR(desc)) {
+                struct gpio_desc *pdesc;
                 dev_dbg(dev, "using lookup tables for GPIO lookup");
-                desc = gpiod_find(dev, con_id, idx, &flags);
+                pdesc = gpiod_find(dev, con_id, idx, &flags);
+                /* If used as fallback, do not replace the previous error */
+                if (!IS_ERR(pdesc) || !desc)
+                        desc = pdesc;
         }
 
         if (IS_ERR(desc)) {
-                dev_warn(dev, "lookup for GPIO %s failed\n", con_id);
+                dev_dbg(dev, "lookup for GPIO %s failed\n", con_id);
                 return desc;
         }
 
@@ -2444,8 +2456,12 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
         if (status < 0)
                 return ERR_PTR(status);
 
-        if (flags & GPIOF_ACTIVE_LOW)
+        if (flags & GPIO_ACTIVE_LOW)
                 set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+        if (flags & GPIO_OPEN_DRAIN)
+                set_bit(FLAG_OPEN_DRAIN, &desc->flags);
+        if (flags & GPIO_OPEN_SOURCE)
+                set_bit(FLAG_OPEN_SOURCE, &desc->flags);
 
         return desc;
 }
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index edcf801613e6..b3fa1ba191b7 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -59,6 +59,7 @@ nouveau-y += core/subdev/clock/nv40.o
 nouveau-y += core/subdev/clock/nv50.o
 nouveau-y += core/subdev/clock/nv84.o
 nouveau-y += core/subdev/clock/nva3.o
+nouveau-y += core/subdev/clock/nvaa.o
 nouveau-y += core/subdev/clock/nvc0.o
 nouveau-y += core/subdev/clock/nve0.o
 nouveau-y += core/subdev/clock/pllnv04.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
index db139827047c..db3fc7be856a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
@@ -283,7 +283,7 @@ nv50_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                 device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                 device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
@@ -311,7 +311,7 @@ nv50_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                 device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                 device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
index 5f555788121c..e6352bd5b4ff 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
@@ -33,6 +33,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
 
+#include "nv04.h"
 #include "nv50.h"
 
 /*******************************************************************************
@@ -460,6 +461,8 @@ nv50_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         nv_subdev(priv)->intr = nv04_fifo_intr;
         nv_engine(priv)->cclass = &nv50_fifo_cclass;
         nv_engine(priv)->sclass = nv50_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
index 0908dc834c84..fe0f41e65d9b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
@@ -35,6 +35,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
 
+#include "nv04.h"
 #include "nv50.h"
 
 /*******************************************************************************
@@ -432,6 +433,8 @@ nv84_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         nv_subdev(priv)->intr = nv04_fifo_intr;
         nv_engine(priv)->cclass = &nv84_fifo_cclass;
         nv_engine(priv)->sclass = nv84_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
index b574dd4bb828..5ce686ee729e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
@@ -176,7 +176,7 @@ nv50_software_context_ctor(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
-        chan->vblank.nr_event = pdisp->vblank->index_nr;
+        chan->vblank.nr_event = pdisp ? pdisp->vblank->index_nr : 0;
         chan->vblank.event = kzalloc(chan->vblank.nr_event *
                                      sizeof(*chan->vblank.event), GFP_KERNEL);
         if (!chan->vblank.event)
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
index e2675bc0edba..8f4ced75444a 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
@@ -14,6 +14,9 @@ enum nv_clk_src {
         nv_clk_src_hclk,
         nv_clk_src_hclkm3,
         nv_clk_src_hclkm3d2,
+        nv_clk_src_hclkm2d3, /* NVAA */
+        nv_clk_src_hclkm4, /* NVAA */
+        nv_clk_src_cclk, /* NVAA */
 
         nv_clk_src_host,
 
@@ -127,6 +130,7 @@ extern struct nouveau_oclass nv04_clock_oclass;
 extern struct nouveau_oclass nv40_clock_oclass;
 extern struct nouveau_oclass *nv50_clock_oclass;
 extern struct nouveau_oclass *nv84_clock_oclass;
+extern struct nouveau_oclass *nvaa_clock_oclass;
 extern struct nouveau_oclass nva3_clock_oclass;
 extern struct nouveau_oclass nvc0_clock_oclass;
 extern struct nouveau_oclass nve0_clock_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
index da50c1b12928..30c1f3a4158e 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
@@ -69,6 +69,11 @@ nv04_clock_pll_prog(struct nouveau_clock *clk, u32 reg1,
         return 0;
 }
 
+static struct nouveau_clocks
+nv04_domain[] = {
+        { nv_clk_src_max }
+};
+
 static int
 nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                 struct nouveau_oclass *oclass, void *data, u32 size,
@@ -77,7 +82,7 @@ nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv04_clock_priv *priv;
         int ret;
 
-        ret = nouveau_clock_create(parent, engine, oclass, NULL, &priv);
+        ret = nouveau_clock_create(parent, engine, oclass, nv04_domain, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
new file mode 100644
index 000000000000..7a723b4f564d
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
@@ -0,0 +1,445 @@
+/*
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+
+#include <engine/fifo.h>
+#include <subdev/bios.h>
+#include <subdev/bios/pll.h>
+#include <subdev/timer.h>
+#include <subdev/clock.h>
+
+#include "pll.h"
+
+struct nvaa_clock_priv {
+        struct nouveau_clock base;
+        enum nv_clk_src csrc, ssrc, vsrc;
+        u32 cctrl, sctrl;
+        u32 ccoef, scoef;
+        u32 cpost, spost;
+        u32 vdiv;
+};
+
+static u32
+read_div(struct nouveau_clock *clk)
+{
+        return nv_rd32(clk, 0x004600);
+}
+
+static u32
+read_pll(struct nouveau_clock *clk, u32 base)
+{
+        u32 ctrl = nv_rd32(clk, base + 0);
+        u32 coef = nv_rd32(clk, base + 4);
+        u32 ref = clk->read(clk, nv_clk_src_href);
+        u32 post_div = 0;
+        u32 clock = 0;
+        int N1, M1;
+
+        switch (base){
+        case 0x4020:
+                post_div = 1 << ((nv_rd32(clk, 0x4070) & 0x000f0000) >> 16);
+                break;
+        case 0x4028:
+                post_div = (nv_rd32(clk, 0x4040) & 0x000f0000) >> 16;
+                break;
+        default:
+                break;
+        }
+
+        N1 = (coef & 0x0000ff00) >> 8;
+        M1 = (coef & 0x000000ff);
+        if ((ctrl & 0x80000000) && M1) {
+                clock = ref * N1 / M1;
+                clock = clock / post_div;
+        }
+
+        return clock;
+}
+
+static int
+nvaa_clock_read(struct nouveau_clock *clk, enum nv_clk_src src)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        u32 mast = nv_rd32(clk, 0x00c054);
+        u32 P = 0;
+
+        switch (src) {
+        case nv_clk_src_crystal:
+                return nv_device(priv)->crystal;
+        case nv_clk_src_href:
+                return 100000; /* PCIE reference clock */
+        case nv_clk_src_hclkm4:
+                return clk->read(clk, nv_clk_src_href) * 4;
+        case nv_clk_src_hclkm2d3:
+                return clk->read(clk, nv_clk_src_href) * 2 / 3;
+        case nv_clk_src_host:
+                switch (mast & 0x000c0000) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_hclkm2d3);
+                case 0x00040000: break;
+                case 0x00080000: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x000c0000: return clk->read(clk, nv_clk_src_cclk);
+                }
+                break;
+        case nv_clk_src_core:
+                P = (nv_rd32(clk, 0x004028) & 0x00070000) >> 16;
+
+                switch (mast & 0x00000003) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000001: return 0;
+                case 0x00000002: return clk->read(clk, nv_clk_src_hclkm4) >> P;
+                case 0x00000003: return read_pll(clk, 0x004028) >> P;
+                }
+                break;
+        case nv_clk_src_cclk:
+                if ((mast & 0x03000000) != 0x03000000)
+                        return clk->read(clk, nv_clk_src_core);
+
+                if ((mast & 0x00000200) == 0x00000000)
+                        return clk->read(clk, nv_clk_src_core);
+
+                switch (mast & 0x00000c00) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_href);
+                case 0x00000400: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x00000800: return clk->read(clk, nv_clk_src_hclkm2d3);
+                default: return 0;
+                }
+        case nv_clk_src_shader:
+                P = (nv_rd32(clk, 0x004020) & 0x00070000) >> 16;
+                switch (mast & 0x00000030) {
+                case 0x00000000:
+                        if (mast & 0x00000040)
+                                return clk->read(clk, nv_clk_src_href) >> P;
+                        return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000010: break;
+                case 0x00000020: return read_pll(clk, 0x004028) >> P;
+                case 0x00000030: return read_pll(clk, 0x004020) >> P;
+                }
+                break;
+        case nv_clk_src_mem:
+                return 0;
+                break;
+        case nv_clk_src_vdec:
+                P = (read_div(clk) & 0x00000700) >> 8;
+
+                switch (mast & 0x00400000) {
+                case 0x00400000:
+                        return clk->read(clk, nv_clk_src_core) >> P;
+                        break;
+                default:
+                        return 500000 >> P;
+                        break;
+                }
+                break;
+        default:
+                break;
+        }
+
+        nv_debug(priv, "unknown clock source %d 0x%08x\n", src, mast);
+        return 0;
+}
+
+static u32
+calc_pll(struct nvaa_clock_priv *priv, u32 reg,
+         u32 clock, int *N, int *M, int *P)
+{
+        struct nouveau_bios *bios = nouveau_bios(priv);
+        struct nvbios_pll pll;
+        struct nouveau_clock *clk = &priv->base;
+        int ret;
+
+        ret = nvbios_pll_parse(bios, reg, &pll);
+        if (ret)
+                return 0;
+
+        pll.vco2.max_freq = 0;
+        pll.refclk = clk->read(clk, nv_clk_src_href);
+        if (!pll.refclk)
+                return 0;
+
+        return nv04_pll_calc(nv_subdev(priv), &pll, clock, N, M, NULL, NULL, P);
+}
+
+static inline u32
+calc_P(u32 src, u32 target, int *div)
+{
+        u32 clk0 = src, clk1 = src;
+        for (*div = 0; *div <= 7; (*div)++) {
+                if (clk0 <= target) {
+                        clk1 = clk0 << (*div ? 1 : 0);
+                        break;
+                }
+                clk0 >>= 1;
+        }
+
+        if (target - clk0 <= clk1 - target)
+                return clk0;
+        (*div)--;
+        return clk1;
+}
+
+static int
+nvaa_clock_calc(struct nouveau_clock *clk, struct nouveau_cstate *cstate)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        const int shader = cstate->domain[nv_clk_src_shader];
+        const int core = cstate->domain[nv_clk_src_core];
+        const int vdec = cstate->domain[nv_clk_src_vdec];
+        u32 out = 0, clock = 0;
+        int N, M, P1, P2 = 0;
+        int divs = 0;
+
+        /* cclk: find suitable source, disable PLL if we can */
+        if (core < clk->read(clk, nv_clk_src_hclkm4))
+                out = calc_P(clk->read(clk, nv_clk_src_hclkm4), core, &divs);
+
+        /* Calculate clock * 2, so shader clock can use it too */
+        clock = calc_pll(priv, 0x4028, (core << 1), &N, &M, &P1);
+
+        if (abs(core - out) <=
+            abs(core - (clock >> 1))) {
+                priv->csrc = nv_clk_src_hclkm4;
+                priv->cctrl = divs << 16;
+        } else {
+                /* NVCTRL is actually used _after_ NVPOST, and after what we
+                 * call NVPLL. To make matters worse, NVPOST is an integer
+                 * divider instead of a right-shift number. */
+                if(P1 > 2) {
+                        P2 = P1 - 2;
+                        P1 = 2;
+                }
+
+                priv->csrc = nv_clk_src_core;
+                priv->ccoef = (N << 8) | M;
+
+                priv->cctrl = (P2 + 1) << 16;
+                priv->cpost = (1 << P1) << 16;
+        }
+
+        /* sclk: nvpll + divisor, href or spll */
+        out = 0;
+        if (shader == clk->read(clk, nv_clk_src_href)) {
+                priv->ssrc = nv_clk_src_href;
+        } else {
+                clock = calc_pll(priv, 0x4020, shader, &N, &M, &P1);
+                if (priv->csrc == nv_clk_src_core) {
+                        out = calc_P((core << 1), shader, &divs);
+                }
+
+                if (abs(shader - out) <=
+                    abs(shader - clock) &&
+                   (divs + P2) <= 7) {
+                        priv->ssrc = nv_clk_src_core;
+                        priv->sctrl = (divs + P2) << 16;
+                } else {
+                        priv->ssrc = nv_clk_src_shader;
+                        priv->scoef = (N << 8) | M;
+                        priv->sctrl = P1 << 16;
+                }
+        }
+
+        /* vclk */
+        out = calc_P(core, vdec, &divs);
+        clock = calc_P(500000, vdec, &P1);
+        if(abs(vdec - out) <=
+           abs(vdec - clock)) {
+                priv->vsrc = nv_clk_src_cclk;
+                priv->vdiv = divs << 16;
+        } else {
+                priv->vsrc = nv_clk_src_vdec;
+                priv->vdiv = P1 << 16;
+        }
+
+        /* Print strategy! */
+        nv_debug(priv, "nvpll: %08x %08x %08x\n",
+                        priv->ccoef, priv->cpost, priv->cctrl);
+        nv_debug(priv, " spll: %08x %08x %08x\n",
+                        priv->scoef, priv->spost, priv->sctrl);
+        nv_debug(priv, " vdiv: %08x\n", priv->vdiv);
+        if (priv->csrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "core: hrefm4\n");
+        else
+                nv_debug(priv, "core: nvpll\n");
+
+        if (priv->ssrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "shader: hrefm4\n");
+        else if (priv->ssrc == nv_clk_src_core)
+                nv_debug(priv, "shader: nvpll\n");
+        else
+                nv_debug(priv, "shader: spll\n");
+
+        if (priv->vsrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "vdec: 500MHz\n");
+        else
+                nv_debug(priv, "vdec: core\n");
+
+        return 0;
+}
+
+static int
+nvaa_clock_prog(struct nouveau_clock *clk)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        struct nouveau_fifo *pfifo = nouveau_fifo(clk);
+        unsigned long flags;
+        u32 pllmask = 0, mast, ptherm_gate;
+        int ret = -EBUSY;
+
+        /* halt and idle execution engines */
+        ptherm_gate = nv_mask(clk, 0x020060, 0x00070000, 0x00000000);
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000001);
+        /* Wait until the interrupt handler is finished */
+        if (!nv_wait(clk, 0x000100, 0xffffffff, 0x00000000))
+                goto resume;
+
+        if (pfifo)
+                pfifo->pause(pfifo, &flags);
+
+        if (!nv_wait(clk, 0x002504, 0x00000010, 0x00000010))
+                goto resume;
+        if (!nv_wait(clk, 0x00251c, 0x0000003f, 0x0000003f))
+                goto resume;
+
+        /* First switch to safe clocks: href */
+        mast = nv_mask(clk, 0xc054, 0x03400e70, 0x03400640);
+        mast &= ~0x00400e73;
+        mast |= 0x03000000;
+
+        switch (priv->csrc) {
+        case nv_clk_src_hclkm4:
+                nv_mask(clk, 0x4028, 0x00070000, priv->cctrl);
+                mast |= 0x00000002;
+                break;
+        case nv_clk_src_core:
+                nv_wr32(clk, 0x402c, priv->ccoef);
+                nv_wr32(clk, 0x4028, 0x80000000 | priv->cctrl);
+                nv_wr32(clk, 0x4040, priv->cpost);
+                pllmask |= (0x3 << 8);
+                mast |= 0x00000003;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown core clock\n");
+                goto resume;
+        }
+
+        switch (priv->ssrc) {
+        case nv_clk_src_href:
+                nv_mask(clk, 0x4020, 0x00070000, 0x00000000);
+                /* mast |= 0x00000000; */
+                break;
+        case nv_clk_src_core:
+                nv_mask(clk, 0x4020, 0x00070000, priv->sctrl);
+                mast |= 0x00000020;
+                break;
+        case nv_clk_src_shader:
+                nv_wr32(clk, 0x4024, priv->scoef);
+                nv_wr32(clk, 0x4020, 0x80000000 | priv->sctrl);
+                nv_wr32(clk, 0x4070, priv->spost);
+                pllmask |= (0x3 << 12);
+                mast |= 0x00000030;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown sclk clock\n");
+                goto resume;
+        }
+
+        if (!nv_wait(clk, 0x004080, pllmask, pllmask)) {
+                nv_warn(priv,"Reclocking failed: unstable PLLs\n");
+                goto resume;
+        }
+
+        switch (priv->vsrc) {
+        case nv_clk_src_cclk:
+                mast |= 0x00400000;
+        default:
+                nv_wr32(clk, 0x4600, priv->vdiv);
+        }
+
+        nv_wr32(clk, 0xc054, mast);
+        ret = 0;
+
+resume:
+        if (pfifo)
+                pfifo->start(pfifo, &flags);
+
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000000);
+        nv_wr32(clk, 0x020060, ptherm_gate);
+
+        /* Disable some PLLs and dividers when unused */
+        if (priv->csrc != nv_clk_src_core) {
+                nv_wr32(clk, 0x4040, 0x00000000);
+                nv_mask(clk, 0x4028, 0x80000000, 0x00000000);
+        }
+
+        if (priv->ssrc != nv_clk_src_shader) {
+                nv_wr32(clk, 0x4070, 0x00000000);
+                nv_mask(clk, 0x4020, 0x80000000, 0x00000000);
+        }
+
+        return ret;
+}
+
+static void
+nvaa_clock_tidy(struct nouveau_clock *clk)
+{
+}
+
+static struct nouveau_clocks
+nvaa_domains[] = {
+        { nv_clk_src_crystal, 0xff },
+        { nv_clk_src_href   , 0xff },
+        { nv_clk_src_core   , 0xff, 0, "core", 1000 },
+        { nv_clk_src_shader , 0xff, 0, "shader", 1000 },
+        { nv_clk_src_vdec   , 0xff, 0, "vdec", 1000 },
+        { nv_clk_src_max }
+};
+
+static int
+nvaa_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+                struct nouveau_oclass *oclass, void *data, u32 size,
+                struct nouveau_object **pobject)
+{
+        struct nvaa_clock_priv *priv;
+        int ret;
+
+        ret = nouveau_clock_create(parent, engine, oclass, nvaa_domains, &priv);
+        *pobject = nv_object(priv);
+        if (ret)
+                return ret;
+
+        priv->base.read = nvaa_clock_read;
+        priv->base.calc = nvaa_clock_calc;
+        priv->base.prog = nvaa_clock_prog;
+        priv->base.tidy = nvaa_clock_tidy;
+        return 0;
+}
+
+struct nouveau_oclass *
+nvaa_clock_oclass = &(struct nouveau_oclass) {
+        .handle = NV_SUBDEV(CLOCK, 0xaa),
+        .ofuncs = &(struct nouveau_ofuncs) {
+                .ctor = nvaa_clock_ctor,
+                .dtor = _nouveau_clock_dtor,
+                .init = _nouveau_clock_init,
+                .fini = _nouveau_clock_fini,
+        },
+};
diff --git a/drivers/gpu/drm/nouveau/dispnv04/overlay.c b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
index 3618ac6b6316..32e7064b819b 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/overlay.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
@@ -58,8 +58,8 @@ struct nouveau_plane {
 };
 
 static uint32_t formats[] = {
-        DRM_FORMAT_NV12,
         DRM_FORMAT_UYVY,
+        DRM_FORMAT_NV12,
 };
 
 /* Sine can be approximated with
@@ -99,13 +99,28 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
         struct nouveau_bo *cur = nv_plane->cur;
         bool flip = nv_plane->flip;
-        int format = ALIGN(src_w * 4, 0x100);
         int soff = NV_PCRTC0_SIZE * nv_crtc->index;
         int soff2 = NV_PCRTC0_SIZE * !nv_crtc->index;
-        int ret;
+        int format, ret;
+
+        /* Source parameters given in 16.16 fixed point, ignore fractional. */
+        src_x >>= 16;
+        src_y >>= 16;
+        src_w >>= 16;
+        src_h >>= 16;
+
+        format = ALIGN(src_w * 4, 0x100);
 
         if (format > 0xffff)
-                return -EINVAL;
+                return -ERANGE;
+
+        if (dev->chipset >= 0x30) {
+                if (crtc_w < (src_w >> 1) || crtc_h < (src_h >> 1))
+                        return -ERANGE;
+        } else {
+                if (crtc_w < (src_w >> 3) || crtc_h < (src_h >> 3))
+                        return -ERANGE;
+        }
 
         ret = nouveau_bo_pin(nv_fb->nvbo, TTM_PL_FLAG_VRAM);
         if (ret)
@@ -113,12 +128,6 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
 
         nv_plane->cur = nv_fb->nvbo;
 
-        /* Source parameters given in 16.16 fixed point, ignore fractional. */
-        src_x = src_x >> 16;
-        src_y = src_y >> 16;
-        src_w = src_w >> 16;
-        src_h = src_h >> 16;
-
         nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff, NV_CRTC_FSEL_OVERLAY, NV_CRTC_FSEL_OVERLAY);
         nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff2, NV_CRTC_FSEL_OVERLAY, 0);
 
@@ -245,14 +254,25 @@ nv10_overlay_init(struct drm_device *device)
 {
         struct nouveau_device *dev = nouveau_dev(device);
         struct nouveau_plane *plane = kzalloc(sizeof(struct nouveau_plane), GFP_KERNEL);
+        int num_formats = ARRAY_SIZE(formats);
         int ret;
 
         if (!plane)
                 return;
 
+        switch (dev->chipset) {
+        case 0x10:
+        case 0x11:
+        case 0x15:
+        case 0x1a:
+        case 0x20:
+                num_formats = 1;
+                break;
+        }
+
         ret = drm_plane_init(device, &plane->base, 3 /* both crtc's */,
                              &nv10_plane_funcs,
-                             formats, ARRAY_SIZE(formats), false);
+                             formats, num_formats, false);
         if (ret)
                 goto err;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 7809d92183c4..29c3efdfc7dd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -608,6 +608,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
         fence = nouveau_fence_ref(new_bo->bo.sync_obj);
         spin_unlock(&new_bo->bo.bdev->fence_lock);
         ret = nouveau_fence_sync(fence, chan);
+        nouveau_fence_unref(&fence);
         if (ret)
                 return ret;
 
@@ -701,7 +702,7 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
 
         s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
         if (s->event)
-                drm_send_vblank_event(dev, -1, s->event);
+                drm_send_vblank_event(dev, s->crtc, s->event);
 
         list_del(&s->head);
         if (ps)
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1265,7 +1265,7 @@ nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b,
                     uint32_t start, uint32_t size)
 {
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
-        u32 end = max(start + size, (u32)256);
+        u32 end = min_t(u32, start + size, 256);
         u32 i;
 
         for (i = start; i < end; i++) {
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 28e178137718..07eba596d458 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -135,11 +135,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
         unsigned int num_relocs = args->num_relocs;
         unsigned int num_waitchks = args->num_waitchks;
         struct drm_tegra_cmdbuf __user *cmdbufs =
-                (void * __user)(uintptr_t)args->cmdbufs;
+                (void __user *)(uintptr_t)args->cmdbufs;
         struct drm_tegra_reloc __user *relocs =
-                (void * __user)(uintptr_t)args->relocs;
+                (void __user *)(uintptr_t)args->relocs;
         struct drm_tegra_waitchk __user *waitchks =
-                (void * __user)(uintptr_t)args->waitchks;
+                (void __user *)(uintptr_t)args->waitchks;
         struct drm_tegra_syncpt syncpt;
         struct host1x_job *job;
         int err;
@@ -163,9 +163,10 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 struct drm_tegra_cmdbuf cmdbuf;
                 struct host1x_bo *bo;
 
-                err = copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf));
-                if (err)
+                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
+                        err = -EFAULT;
                         goto fail;
+                }
 
                 bo = host1x_bo_lookup(drm, file, cmdbuf.handle);
                 if (!bo) {
@@ -178,10 +179,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 cmdbufs++;
         }
 
-        err = copy_from_user(job->relocarray, relocs,
-                             sizeof(*relocs) * num_relocs);
-        if (err)
+        if (copy_from_user(job->relocarray, relocs,
+                           sizeof(*relocs) * num_relocs)) {
+                err = -EFAULT;
                 goto fail;
+        }
 
         while (num_relocs--) {
                 struct host1x_reloc *reloc = &job->relocarray[num_relocs];
@@ -199,15 +201,17 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 }
         }
 
-        err = copy_from_user(job->waitchk, waitchks,
-                             sizeof(*waitchks) * num_waitchks);
-        if (err)
+        if (copy_from_user(job->waitchk, waitchks,
+                           sizeof(*waitchks) * num_waitchks)) {
+                err = -EFAULT;
                 goto fail;
+        }
 
-        err = copy_from_user(&syncpt, (void * __user)(uintptr_t)args->syncpts,
-                             sizeof(syncpt));
-        if (err)
+        if (copy_from_user(&syncpt, (void __user *)(uintptr_t)args->syncpts,
+                           sizeof(syncpt))) {
+                err = -EFAULT;
                 goto fail;
+        }
 
         job->is_addr_reg = context->client->ops->is_addr_reg;
         job->syncpt_incrs = syncpt.incrs;
@@ -573,7 +577,7 @@ static void tegra_debugfs_cleanup(struct drm_minor *minor)
 }
 #endif
 
-struct drm_driver tegra_drm_driver = {
+static struct drm_driver tegra_drm_driver = {
         .driver_features = DRIVER_MODESET | DRIVER_GEM,
         .load = tegra_drm_load,
         .unload = tegra_drm_unload,
diff --git a/drivers/gpu/drm/tegra/drm.h b/drivers/gpu/drm/tegra/drm.h
index fdfe259ed7f8..7da0b923131f 100644
--- a/drivers/gpu/drm/tegra/drm.h
+++ b/drivers/gpu/drm/tegra/drm.h
@@ -116,7 +116,7 @@ host1x_client_to_dc(struct host1x_client *client)
 
 static inline struct tegra_dc *to_tegra_dc(struct drm_crtc *crtc)
 {
-        return container_of(crtc, struct tegra_dc, base);
+        return crtc ? container_of(crtc, struct tegra_dc, base) : NULL;
 }
 
 static inline void tegra_dc_writel(struct tegra_dc *dc, unsigned long value,
diff --git a/drivers/gpu/drm/tegra/fb.c b/drivers/gpu/drm/tegra/fb.c
index 490f7719e317..a3835e7de184 100644
--- a/drivers/gpu/drm/tegra/fb.c
+++ b/drivers/gpu/drm/tegra/fb.c
@@ -247,7 +247,7 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
                  info->var.yoffset * fb->pitches[0];
 
         drm->mode_config.fb_base = (resource_size_t)bo->paddr;
-        info->screen_base = bo->vaddr + offset;
+        info->screen_base = (void __iomem *)bo->vaddr + offset;
         info->screen_size = size;
         info->fix.smem_start = (unsigned long)(bo->paddr + offset);
         info->fix.smem_len = size;
diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
index ba47ca4fb880..3b29018913a5 100644
--- a/drivers/gpu/drm/tegra/rgb.c
+++ b/drivers/gpu/drm/tegra/rgb.c
@@ -14,6 +14,8 @@
 
 struct tegra_rgb {
         struct tegra_output output;
+        struct tegra_dc *dc;
+
         struct clk *clk_parent;
         struct clk *clk;
 };
@@ -84,18 +86,18 @@ static void tegra_dc_write_regs(struct tegra_dc *dc,
 
 static int tegra_output_rgb_enable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
 
-        tegra_dc_write_regs(dc, rgb_enable, ARRAY_SIZE(rgb_enable));
+        tegra_dc_write_regs(rgb->dc, rgb_enable, ARRAY_SIZE(rgb_enable));
 
         return 0;
 }
 
 static int tegra_output_rgb_disable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
 
-        tegra_dc_write_regs(dc, rgb_disable, ARRAY_SIZE(rgb_disable));
+        tegra_dc_write_regs(rgb->dc, rgb_disable, ARRAY_SIZE(rgb_disable));
 
         return 0;
 }
@@ -146,6 +148,7 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
 
         rgb->output.dev = dc->dev;
         rgb->output.of_node = np;
+        rgb->dc = dc;
 
         err = tegra_output_probe(&rgb->output);
         if (err < 0)
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 24ffbe990736..8d67b943ac05 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -125,6 +125,12 @@ static int udl_gem_get_pages(struct udl_gem_object *obj, gfp_t gfpmask)
 
 static void udl_gem_put_pages(struct udl_gem_object *obj)
 {
+        if (obj->base.import_attach) {
+                drm_free_large(obj->pages);
+                obj->pages = NULL;
+                return;
+        }
+
         drm_gem_put_pages(&obj->base, obj->pages, false, false);
         obj->pages = NULL;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
index 7776e6f0aef6..0489c6152482 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
@@ -150,6 +150,8 @@ struct vmw_ttm_tt {
         bool mapped;
 };
 
+const size_t vmw_tt_size = sizeof(struct vmw_ttm_tt);
+
 /**
  * Helper functions to advance a struct vmw_piter iterator.
  *
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index db85985c7086..20890ad8408b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -615,6 +615,7 @@ extern int vmw_mmap(struct file *filp, struct vm_area_struct *vma);
  * TTM buffer object driver - vmwgfx_buffer.c
  */
 
+extern const size_t vmw_tt_size;
 extern struct ttm_placement vmw_vram_placement;
 extern struct ttm_placement vmw_vram_ne_placement;
 extern struct ttm_placement vmw_vram_sys_placement;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ecb3d867b426..03f1c2038631 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -75,6 +75,7 @@ void vmw_display_unit_cleanup(struct vmw_display_unit *du)
                 vmw_surface_unreference(&du->cursor_surface);
         if (du->cursor_dmabuf)
                 vmw_dmabuf_unreference(&du->cursor_dmabuf);
+        drm_sysfs_connector_remove(&du->connector);
         drm_crtc_cleanup(&du->crtc);
         drm_encoder_cleanup(&du->encoder);
         drm_connector_cleanup(&du->connector);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 79f7e8e60529..a055a26819c2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -260,6 +260,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
                 connector->encoder = NULL;
                 encoder->crtc = NULL;
                 crtc->fb = NULL;
+                crtc->enabled = false;
 
                 vmw_ldu_del_active(dev_priv, ldu);
 
@@ -285,6 +286,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
         crtc->x = set->x;
         crtc->y = set->y;
         crtc->mode = *mode;
+        crtc->enabled = true;
 
         vmw_ldu_add_active(dev_priv, ldu, vfb);
 
@@ -369,6 +371,8 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
         encoder->possible_crtcs = (1 << unit);
         encoder->possible_clones = 0;
 
+        (void) drm_sysfs_connector_add(connector);
+
         drm_crtc_init(dev, crtc, &vmw_legacy_crtc_funcs);
 
         drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index efe2b74c5eb1..9b5ea2ac7ddf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -352,6 +352,38 @@ int vmw_user_lookup_handle(struct vmw_private *dev_priv,
 /**
  * Buffer management.
  */
+
+/**
+ * vmw_dmabuf_acc_size - Calculate the pinned memory usage of buffers
+ *
+ * @dev_priv: Pointer to a struct vmw_private identifying the device.
+ * @size: The requested buffer size.
+ * @user: Whether this is an ordinary dma buffer or a user dma buffer.
+ */
+static size_t vmw_dmabuf_acc_size(struct vmw_private *dev_priv, size_t size,
+                                  bool user)
+{
+        static size_t struct_size, user_struct_size;
+        size_t num_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+        size_t page_array_size = ttm_round_pot(num_pages * sizeof(void *));
+
+        if (unlikely(struct_size == 0)) {
+                size_t backend_size = ttm_round_pot(vmw_tt_size);
+
+                struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_dma_buffer));
+                user_struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_user_dma_buffer));
+        }
+
+        if (dev_priv->map_mode == vmw_dma_alloc_coherent)
+                page_array_size +=
+                        ttm_round_pot(num_pages * sizeof(dma_addr_t));
+
+        return ((user) ? user_struct_size : struct_size) +
+                page_array_size;
+}
+
 void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
 {
         struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
@@ -359,6 +391,13 @@ void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
         kfree(vmw_bo);
 }
 
+static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
+{
+        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
+
+        ttm_prime_object_kfree(vmw_user_bo, prime);
+}
+
 int vmw_dmabuf_init(struct vmw_private *dev_priv,
                     struct vmw_dma_buffer *vmw_bo,
                     size_t size, struct ttm_placement *placement,
@@ -368,28 +407,23 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
         struct ttm_bo_device *bdev = &dev_priv->bdev;
         size_t acc_size;
         int ret;
+        bool user = (bo_free == &vmw_user_dmabuf_destroy);
 
-        BUG_ON(!bo_free);
+        BUG_ON(!bo_free && (!user && (bo_free != vmw_dmabuf_bo_free)));
 
-        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct vmw_dma_buffer));
+        acc_size = vmw_dmabuf_acc_size(dev_priv, size, user);
         memset(vmw_bo, 0, sizeof(*vmw_bo));
 
         INIT_LIST_HEAD(&vmw_bo->res_list);
 
         ret = ttm_bo_init(bdev, &vmw_bo->base, size,
-                          ttm_bo_type_device, placement,
+                          (user) ? ttm_bo_type_device :
+                          ttm_bo_type_kernel, placement,
                           0, interruptible,
                           NULL, acc_size, NULL, bo_free);
         return ret;
 }
 
-static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
-{
-        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
-
-        ttm_prime_object_kfree(vmw_user_bo, prime);
-}
-
 static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
 {
         struct vmw_user_dma_buffer *vmw_user_bo;
@@ -781,54 +815,55 @@ err_ref:
 }
 
 
+/**
+ * vmw_dumb_create - Create a dumb kms buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @args: Pointer to a struct drm_mode_create_dumb structure
+ *
+ * This is a driver callback for the core drm create_dumb functionality.
+ * Note that this is very similar to the vmw_dmabuf_alloc ioctl, except
+ * that the arguments have a different format.
+ */
 int vmw_dumb_create(struct drm_file *file_priv,
                     struct drm_device *dev,
                     struct drm_mode_create_dumb *args)
 {
         struct vmw_private *dev_priv = vmw_priv(dev);
         struct vmw_master *vmaster = vmw_master(file_priv->master);
-        struct vmw_user_dma_buffer *vmw_user_bo;
-        struct ttm_buffer_object *tmp;
+        struct vmw_dma_buffer *dma_buf;
         int ret;
 
         args->pitch = args->width * ((args->bpp + 7) / 8);
         args->size = args->pitch * args->height;
 
-        vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
-        if (vmw_user_bo == NULL)
-                return -ENOMEM;
-
         ret = ttm_read_lock(&vmaster->lock, true);
-        if (ret != 0) {
-                kfree(vmw_user_bo);
+        if (unlikely(ret != 0))
                 return ret;
-        }
 
-        ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
-                              &vmw_vram_sys_placement, true,
-                              &vmw_user_dmabuf_destroy);
-        if (ret != 0)
-                goto out_no_dmabuf;
-
-        tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
-        ret = ttm_prime_object_init(vmw_fpriv(file_priv)->tfile,
-                                    args->size,
-                                    &vmw_user_bo->prime,
-                                    false,
-                                    ttm_buffer_type,
-                                    &vmw_user_dmabuf_release, NULL);
+        ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
+                                    args->size, false, &args->handle,
+                                    &dma_buf);
         if (unlikely(ret != 0))
-                goto out_no_base_object;
-
-        args->handle = vmw_user_bo->prime.base.hash.key;
+                goto out_no_dmabuf;
 
-out_no_base_object:
-        ttm_bo_unref(&tmp);
+        vmw_dmabuf_unreference(&dma_buf);
 out_no_dmabuf:
         ttm_read_unlock(&vmaster->lock);
         return ret;
 }
 
+/**
+ * vmw_dumb_map_offset - Return the address space offset of a dumb buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ * @offset: The address space offset returned.
+ *
+ * This is a driver callback for the core drm dumb_map_offset functionality.
+ */
 int vmw_dumb_map_offset(struct drm_file *file_priv,
                         struct drm_device *dev, uint32_t handle,
                         uint64_t *offset)
@@ -846,6 +881,15 @@ int vmw_dumb_map_offset(struct drm_file *file_priv,
         return 0;
 }
 
+/**
+ * vmw_dumb_destroy - Destroy a dumb boffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ *
+ * This is a driver callback for the core drm dumb_destroy functionality.
+ */
 int vmw_dumb_destroy(struct drm_file *file_priv,
                      struct drm_device *dev,
                      uint32_t handle)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 26387c3d5a21..22406c8651ea 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -310,6 +310,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                 crtc->fb = NULL;
                 crtc->x = 0;
                 crtc->y = 0;
+                crtc->enabled = false;
 
                 vmw_sou_del_active(dev_priv, sou);
 
@@ -370,6 +371,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                 crtc->fb = NULL;
                 crtc->x = 0;
                 crtc->y = 0;
+                crtc->enabled = false;
 
                 return ret;
         }
@@ -382,6 +384,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
         crtc->fb = fb;
         crtc->x = set->x;
         crtc->y = set->y;
+        crtc->enabled = true;
 
         return 0;
 }
@@ -464,6 +467,8 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
         encoder->possible_crtcs = (1 << unit);
         encoder->possible_clones = 0;
 
+        (void) drm_sysfs_connector_add(connector);
+
         drm_crtc_init(dev, crtc, &vmw_screen_object_crtc_funcs);
 
         drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 509383f8be03..6a929591aa73 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -19,6 +19,7 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 
+#include "bus.h"
 #include "dev.h"
 
 static DEFINE_MUTEX(clients_lock);
@@ -257,7 +258,7 @@ static int host1x_unregister_client(struct host1x *host1x,
         return -ENODEV;
 }
 
-struct bus_type host1x_bus_type = {
+static struct bus_type host1x_bus_type = {
         .name = "host1x",
 };
 
@@ -301,7 +302,7 @@ static int host1x_device_add(struct host1x *host1x,
         device->dev.coherent_dma_mask = host1x->dev->coherent_dma_mask;
         device->dev.dma_mask = &device->dev.coherent_dma_mask;
         device->dev.release = host1x_device_release;
-        dev_set_name(&device->dev, driver->name);
+        dev_set_name(&device->dev, "%s", driver->name);
         device->dev.bus = &host1x_bus_type;
         device->dev.parent = host1x->dev;
 
diff --git a/drivers/gpu/host1x/hw/cdma_hw.c b/drivers/gpu/host1x/hw/cdma_hw.c
index 37e2a63241a9..6b09b71940c2 100644
--- a/drivers/gpu/host1x/hw/cdma_hw.c
+++ b/drivers/gpu/host1x/hw/cdma_hw.c
@@ -54,8 +54,8 @@ static void cdma_timeout_cpu_incr(struct host1x_cdma *cdma, u32 getptr,
                 u32 *p = (u32 *)((u32)pb->mapped + getptr);
                 *(p++) = HOST1X_OPCODE_NOP;
                 *(p++) = HOST1X_OPCODE_NOP;
-                dev_dbg(host1x->dev, "%s: NOP at 0x%x\n", __func__,
-                        pb->phys + getptr);
+                dev_dbg(host1x->dev, "%s: NOP at %#llx\n", __func__,
+                        (u64)pb->phys + getptr);
                 getptr = (getptr + 8) & (pb->size_bytes - 1);
         }
         wmb();
diff --git a/drivers/gpu/host1x/hw/debug_hw.c b/drivers/gpu/host1x/hw/debug_hw.c
index 640c75ca5a8b..f72c873eff81 100644
--- a/drivers/gpu/host1x/hw/debug_hw.c
+++ b/drivers/gpu/host1x/hw/debug_hw.c
@@ -163,8 +163,8 @@ static void show_channel_gathers(struct output *o, struct host1x_cdma *cdma)
                                 continue;
                         }
 
-                        host1x_debug_output(o, "    GATHER at %08x+%04x, %d words\n",
-                                            g->base, g->offset, g->words);
+                        host1x_debug_output(o, "    GATHER at %#llx+%04x, %d words\n",
+                                            (u64)g->base, g->offset, g->words);
 
                         show_gather(o, g->base + g->offset, g->words, cdma,
                                     g->base, mapped);
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 329fbb9b5976..34e2d39d4ce8 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -460,6 +460,7 @@ config HID_MULTITOUCH
           - Stantum multitouch panels
           - Touch International Panels
           - Unitec Panels
+          - Wistron optical touch panels
           - XAT optical touch panels
           - Xiroku optical touch panels
           - Zytronic touch panels
diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
index a42e6a394c5e..0e6a42d37eb6 100644
--- a/drivers/hid/hid-appleir.c
+++ b/drivers/hid/hid-appleir.c
@@ -297,6 +297,9 @@ static int appleir_probe(struct hid_device *hid, const struct hid_device_id *id)
 
         appleir->hid = hid;
 
+        /* force input as some remotes bypass the input registration */
+        hid->quirks |= HID_QUIRK_HIDINPUT_FORCE;
+
         spin_lock_init(&appleir->lock);
         setup_timer(&appleir->key_up_timer,
                     key_up_tick, (unsigned long) appleir);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8c10f2742233..253fe23ef7fe 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1723,6 +1723,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_MANTICORE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
@@ -1879,7 +1880,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
 
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
 };
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 76559629568c..f9304cb37154 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -489,6 +489,7 @@
 #define USB_VENDOR_ID_KYE               0x0458
 #define USB_DEVICE_ID_KYE_ERGO_525V     0x0087
 #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE  0x0138
+#define USB_DEVICE_ID_GENIUS_MANTICORE  0x0153
 #define USB_DEVICE_ID_GENIUS_GX_IMPERATOR       0x4018
 #define USB_DEVICE_ID_KYE_GPEN_560      0x5003
 #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
@@ -640,7 +641,6 @@
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
 
 #define USB_VENDOR_ID_NINTENDO          0x057e
-#define USB_VENDOR_ID_NINTENDO2         0x054c
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE  0x0306
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE2 0x0330
 
@@ -902,6 +902,9 @@
 #define USB_DEVICE_ID_SUPER_DUAL_BOX_PRO 0x8802
 #define USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO 0x8804
 
+#define USB_VENDOR_ID_WISTRON           0x0fb8
+#define USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH             0x1109
+
 #define USB_VENDOR_ID_X_TENSIONS               0x1ae7
 #define USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE    0x9001
 
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index 73845120295e..ecb5ca669e97 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -341,6 +341,9 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
         case USB_DEVICE_ID_GENIUS_GX_IMPERATOR:
                 rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
                                         "Genius Gx Imperator Keyboard");
+        case USB_DEVICE_ID_GENIUS_MANTICORE:
+                rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
+                                        "Genius Manticore Keyboard");
                 break;
         }
         return rdesc;
@@ -418,6 +421,14 @@ static int kye_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         goto enabling_err;
                 }
                 break;
+        case USB_DEVICE_ID_GENIUS_MANTICORE:
+                /*
+                 * The manticore keyboard needs to have all the interfaces
+                 * opened at least once to be fully functional.
+                 */
+                if (hid_hw_open(hdev))
+                        hid_hw_close(hdev);
+                break;
         }
 
         return 0;
@@ -439,6 +450,8 @@ static const struct hid_device_id kye_devices[] = {
                                 USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                 USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+                                USB_DEVICE_ID_GENIUS_MANTICORE) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, kye_devices);
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index a2cedb8ae1c0..d83b1e8b505b 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1335,6 +1335,12 @@ static const struct hid_device_id mt_devices[] = {
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_UNITEC,
                         USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19) },
+
+        /* Wistron panels */
+        { .driver_data = MT_CLS_NSMU,
+                MT_USB_DEVICE(USB_VENDOR_ID_WISTRON,
+                        USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH) },
+
         /* XAT */
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_XAT,
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index da551d113762..098af2f84b8c 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -225,6 +225,13 @@ static const unsigned int buzz_keymap[] = {
 struct sony_sc {
         unsigned long quirks;
 
+#ifdef CONFIG_SONY_FF
+        struct work_struct rumble_worker;
+        struct hid_device *hdev;
+        __u8 left;
+        __u8 right;
+#endif
+
         void *extra;
 };
 
@@ -615,9 +622,9 @@ static void buzz_remove(struct hid_device *hdev)
 }
 
 #ifdef CONFIG_SONY_FF
-static int sony_play_effect(struct input_dev *dev, void *data,
-                            struct ff_effect *effect)
+static void sony_rumble_worker(struct work_struct *work)
 {
+        struct sony_sc *sc = container_of(work, struct sony_sc, rumble_worker);
         unsigned char buf[] = {
                 0x01,
                 0x00, 0xff, 0x00, 0xff, 0x00,
@@ -628,21 +635,28 @@ static int sony_play_effect(struct input_dev *dev, void *data,
                 0xff, 0x27, 0x10, 0x00, 0x32,
                 0x00, 0x00, 0x00, 0x00, 0x00
         };
-        __u8 left;
-        __u8 right;
+
+        buf[3] = sc->right;
+        buf[5] = sc->left;
+
+        sc->hdev->hid_output_raw_report(sc->hdev, buf, sizeof(buf),
+                                        HID_OUTPUT_REPORT);
+}
+
+static int sony_play_effect(struct input_dev *dev, void *data,
+                            struct ff_effect *effect)
+{
         struct hid_device *hid = input_get_drvdata(dev);
+        struct sony_sc *sc = hid_get_drvdata(hid);
 
         if (effect->type != FF_RUMBLE)
                 return 0;
 
-        left = effect->u.rumble.strong_magnitude / 256;
-        right = effect->u.rumble.weak_magnitude ? 1 : 0;
-
-        buf[3] = right;
-        buf[5] = left;
+        sc->left = effect->u.rumble.strong_magnitude / 256;
+        sc->right = effect->u.rumble.weak_magnitude ? 1 : 0;
 
-        return hid->hid_output_raw_report(hid, buf, sizeof(buf),
-                                          HID_OUTPUT_REPORT);
+        schedule_work(&sc->rumble_worker);
+        return 0;
 }
 
 static int sony_init_ff(struct hid_device *hdev)
@@ -650,16 +664,31 @@ static int sony_init_ff(struct hid_device *hdev)
         struct hid_input *hidinput = list_entry(hdev->inputs.next,
                                                 struct hid_input, list);
         struct input_dev *input_dev = hidinput->input;
+        struct sony_sc *sc = hid_get_drvdata(hdev);
+
+        sc->hdev = hdev;
+        INIT_WORK(&sc->rumble_worker, sony_rumble_worker);
 
         input_set_capability(input_dev, EV_FF, FF_RUMBLE);
         return input_ff_create_memless(input_dev, NULL, sony_play_effect);
 }
 
+static void sony_destroy_ff(struct hid_device *hdev)
+{
+        struct sony_sc *sc = hid_get_drvdata(hdev);
+
+        cancel_work_sync(&sc->rumble_worker);
+}
+
 #else
 static int sony_init_ff(struct hid_device *hdev)
 {
         return 0;
 }
+
+static void sony_destroy_ff(struct hid_device *hdev)
+{
+}
 #endif
 
 static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
@@ -728,6 +757,8 @@ static void sony_remove(struct hid_device *hdev)
         if (sc->quirks & BUZZ_CONTROLLER)
                 buzz_remove(hdev);
 
+        sony_destroy_ff(hdev);
+
         hid_hw_stop(hdev);
 }
 
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
index 1446f526ee8b..abb20db2b443 100644
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -834,8 +834,7 @@ static void wiimote_init_set_type(struct wiimote_data *wdata,
                 goto done;
         }
 
-        if (vendor == USB_VENDOR_ID_NINTENDO ||
-            vendor == USB_VENDOR_ID_NINTENDO2) {
+        if (vendor == USB_VENDOR_ID_NINTENDO) {
                 if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
                         devtype = WIIMOTE_DEV_GEN10;
                         goto done;
@@ -1856,8 +1855,6 @@ static void wiimote_hid_remove(struct hid_device *hdev)
 static const struct hid_device_id wiimote_hid_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2,
-                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 93b00d76374c..cedc6da93c19 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -287,7 +287,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len,
                          */
                         struct uhid_create_req_compat *compat;
 
-                        compat = kmalloc(sizeof(*compat), GFP_KERNEL);
+                        compat = kzalloc(sizeof(*compat), GFP_KERNEL);
                         if (!compat)
                                 return -ENOMEM;
 
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 1d7ff46812c3..dafc63c6932d 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -18,7 +18,6 @@
 #include <linux/err.h>
 
 #include <acpi/acpi.h>
-#include <acpi/acpixf.h>
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
 
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index 036cf03aeb61..18a74a6751a9 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -20,7 +20,6 @@
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/io.h>
-#include <linux/clk.h>
 #include <linux/slab.h>
 
 /* Hardware register offsets and field defintions */
@@ -891,7 +890,7 @@ static const struct of_device_id bcm_kona_i2c_of_match[] = {
         {.compatible = "brcm,kona-i2c",},
         {},
 };
-MODULE_DEVICE_TABLE(of, kona_i2c_of_match);
+MODULE_DEVICE_TABLE(of, bcm_kona_i2c_of_match);
 
 static struct platform_driver bcm_kona_i2c_driver = {
         .driver = {
diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index d7e8600f31fb..77df97b932af 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -299,6 +299,7 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
         strlcpy(adap->name, "bcm2835 I2C adapter", sizeof(adap->name));
         adap->algo = &bcm2835_i2c_algo;
         adap->dev.parent = &pdev->dev;
+        adap->dev.of_node = pdev->dev.of_node;
 
         bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0);
 
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index ff05d9fef4a8..af0b5830303d 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -125,12 +125,12 @@ static struct davinci_i2c_platform_data davinci_i2c_platform_data_default = {
 static inline void davinci_i2c_write_reg(struct davinci_i2c_dev *i2c_dev,
                                          int reg, u16 val)
 {
-        __raw_writew(val, i2c_dev->base + reg);
+        writew_relaxed(val, i2c_dev->base + reg);
 }
 
 static inline u16 davinci_i2c_read_reg(struct davinci_i2c_dev *i2c_dev, int reg)
 {
-        return __raw_readw(i2c_dev->base + reg);
+        return readw_relaxed(i2c_dev->base + reg);
 }
 
 /* Generate a pulse on the i2c clock pin. */
diff --git a/drivers/i2c/busses/i2c-diolan-u2c.c b/drivers/i2c/busses/i2c-diolan-u2c.c
index dae3ddfe7619..721f7ebf9a3b 100644
--- a/drivers/i2c/busses/i2c-diolan-u2c.c
+++ b/drivers/i2c/busses/i2c-diolan-u2c.c
@@ -25,8 +25,6 @@
 #define USB_VENDOR_ID_DIOLAN            0x0abf
 #define USB_DEVICE_ID_DIOLAN_U2C        0x3370
 
-#define DIOLAN_OUT_EP           0x02
-#define DIOLAN_IN_EP            0x84
 
 /* commands via USB, must match command ids in the firmware */
 #define CMD_I2C_READ            0x01
@@ -84,6 +82,7 @@
 struct i2c_diolan_u2c {
         u8 obuffer[DIOLAN_OUTBUF_LEN];  /* output buffer */
         u8 ibuffer[DIOLAN_INBUF_LEN];   /* input buffer */
+        int ep_in, ep_out;              /* Endpoints    */
         struct usb_device *usb_dev;     /* the usb device for this device */
         struct usb_interface *interface;/* the interface for this device */
         struct i2c_adapter adapter;     /* i2c related things */
@@ -109,7 +108,7 @@ static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
                 return -EINVAL;
 
         ret = usb_bulk_msg(dev->usb_dev,
-                           usb_sndbulkpipe(dev->usb_dev, DIOLAN_OUT_EP),
+                           usb_sndbulkpipe(dev->usb_dev, dev->ep_out),
                            dev->obuffer, dev->olen, &actual,
                            DIOLAN_USB_TIMEOUT);
         if (!ret) {
@@ -118,7 +117,7 @@ static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
 
                         tmpret = usb_bulk_msg(dev->usb_dev,
                                               usb_rcvbulkpipe(dev->usb_dev,
-                                                              DIOLAN_IN_EP),
+                                                              dev->ep_in),
                                               dev->ibuffer,
                                               sizeof(dev->ibuffer), &actual,
                                               DIOLAN_USB_TIMEOUT);
@@ -210,7 +209,7 @@ static void diolan_flush_input(struct i2c_diolan_u2c *dev)
                 int ret;
 
                 ret = usb_bulk_msg(dev->usb_dev,
-                                   usb_rcvbulkpipe(dev->usb_dev, DIOLAN_IN_EP),
+                                   usb_rcvbulkpipe(dev->usb_dev, dev->ep_in),
                                    dev->ibuffer, sizeof(dev->ibuffer), &actual,
                                    DIOLAN_USB_TIMEOUT);
                 if (ret < 0 || actual == 0)
@@ -445,9 +444,14 @@ static void diolan_u2c_free(struct i2c_diolan_u2c *dev)
 static int diolan_u2c_probe(struct usb_interface *interface,
                             const struct usb_device_id *id)
 {
+        struct usb_host_interface *hostif = interface->cur_altsetting;
         struct i2c_diolan_u2c *dev;
         int ret;
 
+        if (hostif->desc.bInterfaceNumber != 0
+            || hostif->desc.bNumEndpoints < 2)
+                return -ENODEV;
+
         /* allocate memory for our device state and initialize it */
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL) {
@@ -455,6 +459,8 @@ static int diolan_u2c_probe(struct usb_interface *interface,
                 ret = -ENOMEM;
                 goto error;
         }
+        dev->ep_out = hostif->endpoint[0].desc.bEndpointAddress;
+        dev->ep_in = hostif->endpoint[1].desc.bEndpointAddress;
 
         dev->usb_dev = usb_get_dev(interface_to_usbdev(interface));
         dev->interface = interface;
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index d76228d81d5f..90dcc2eaac5f 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -266,13 +266,13 @@ static const u8 reg_map_ip_v2[] = {
 static inline void omap_i2c_write_reg(struct omap_i2c_dev *i2c_dev,
                                       int reg, u16 val)
 {
-        __raw_writew(val, i2c_dev->base +
+        writew_relaxed(val, i2c_dev->base +
                         (i2c_dev->regs[reg] << i2c_dev->reg_shift));
 }
 
 static inline u16 omap_i2c_read_reg(struct omap_i2c_dev *i2c_dev, int reg)
 {
-        return __raw_readw(i2c_dev->base +
+        return readw_relaxed(i2c_dev->base +
                                 (i2c_dev->regs[reg] << i2c_dev->reg_shift));
 }
 
@@ -1162,9 +1162,9 @@ omap_i2c_probe(struct platform_device *pdev)
          * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2.
          * On omap1/3/2 Offset 4 is IE Reg the bit [15:14] is 0 at reset.
          * Also since the omap_i2c_read_reg uses reg_map_ip_* a
-         * raw_readw is done.
+         * readw_relaxed is done.
          */
-        rev = __raw_readw(dev->base + 0x04);
+        rev = readw_relaxed(dev->base + 0x04);
 
         dev->scheme = OMAP_I2C_SCHEME(rev);
         switch (dev->scheme) {
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index dcda17395c4e..1cae4e920c9b 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -350,7 +350,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&accel_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -363,10 +363,11 @@ static int hid_accel_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct accel_3d_state *accel_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_ACCEL_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&accel_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index d72118d1189c..98ba761cbb9c 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -112,9 +112,10 @@ static int kxsd9_read(struct iio_dev *indio_dev, u8 address)
         mutex_lock(&st->buf_lock);
         st->tx[0] = KXSD9_READ(address);
         ret = spi_sync_transfer(st->us, xfers, ARRAY_SIZE(xfers));
-        if (ret)
-                return ret;
-        return (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
+        if (!ret)
+                ret = (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
+        mutex_unlock(&st->buf_lock);
+        return ret;
 }
 
 static IIO_CONST_ATTR(accel_scale_available,
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 17df74908db1..5b1aa027c034 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -1047,6 +1047,7 @@ static int at91_adc_probe(struct platform_device *pdev)
         } else {
                 if (!st->caps->has_tsmr) {
                         dev_err(&pdev->dev, "We don't support non-TSMR adc\n");
+                        ret = -ENODEV;
                         goto error_disable_adc_clk;
                 }
 
diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 12948325431c..c8c1baaec6c1 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -88,10 +88,10 @@ static const int mcp3422_sample_rates[4] = {
 
 /* sample rates to sign extension table */
 static const int mcp3422_sign_extend[4] = {
-        [MCP3422_SRATE_240] = 12,
-        [MCP3422_SRATE_60] = 14,
-        [MCP3422_SRATE_15] = 16,
-        [MCP3422_SRATE_3] = 18 };
+        [MCP3422_SRATE_240] = 11,
+        [MCP3422_SRATE_60] = 13,
+        [MCP3422_SRATE_15] = 15,
+        [MCP3422_SRATE_3] = 17 };
 
 /* Client data (each client gets its own) */
 struct mcp3422 {
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 728411ec7642..d4d748214e4b 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -229,12 +229,15 @@ static int tiadc_iio_buffered_hardware_setup(struct iio_dev *indio_dev,
         unsigned long flags,
         const struct iio_buffer_setup_ops *setup_ops)
 {
+        struct iio_buffer *buffer;
         int ret;
 
-        indio_dev->buffer = iio_kfifo_allocate(indio_dev);
-        if (!indio_dev->buffer)
+        buffer = iio_kfifo_allocate(indio_dev);
+        if (!buffer)
                 return -ENOMEM;
 
+        iio_device_attach_buffer(indio_dev, buffer);
+
         ret = request_threaded_irq(irq, pollfunc_th, pollfunc_bh,
                                 flags, indio_dev->name, indio_dev);
         if (ret)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index b6e77e0fc420..bbd6426c9726 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -55,11 +55,10 @@ static int hid_sensor_data_rdy_trigger_set_state(struct iio_trigger *trig,
         return 0;
 }
 
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev)
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb)
 {
-        iio_trigger_unregister(indio_dev->trig);
-        iio_trigger_free(indio_dev->trig);
-        indio_dev->trig = NULL;
+        iio_trigger_unregister(attrb->trigger);
+        iio_trigger_free(attrb->trigger);
 }
 EXPORT_SYMBOL(hid_sensor_remove_trigger);
 
@@ -90,7 +89,7 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
                 dev_err(&indio_dev->dev, "Trigger Register Failed\n");
                 goto error_free_trig;
         }
-        indio_dev->trig = trig;
+        indio_dev->trig = attrb->trigger = trig;
 
         return ret;
 
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
index 9a8731478eda..ca02f7811aa8 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
@@ -21,6 +21,6 @@
 
 int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
                                 struct hid_sensor_common *attrb);
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev);
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb);
 
 #endif
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index ea01c6bcfb56..e54f0f4959d3 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -348,7 +348,7 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&gyro_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -361,10 +361,11 @@ static int hid_gyro_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&gyro_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index f98c2b509254..b0d65df3ede2 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -81,6 +81,8 @@ config SENSORS_LM3533
 config TCS3472
         tristate "TAOS TCS3472 color light-to-digital converter"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
          If you say yes here you get support for the TAOS TCS3472
          family of color light-to-digital converters with IR filter.
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index fa6ae8cf89ea..8e8b9d722853 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -314,7 +314,7 @@ static int hid_als_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&als_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -327,10 +327,11 @@ static int hid_als_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct als_state *als_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_ALS);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&als_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index 0cf09637b35b..d86d226dcd67 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -19,6 +19,8 @@ config AK8975
 config MAG3110
         tristate "Freescale MAG3110 3-Axis Magnetometer"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say yes here to build support for the Freescale MAG3110 3-Axis
           magnetometer.
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index 2634920562fb..b26e1028a0a0 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -351,7 +351,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&magn_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -364,10 +364,11 @@ static int hid_magn_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct magn_3d_state *magn_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&magn_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
index 783c5b417356..becf54496967 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -250,7 +250,12 @@ done:
         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ) | \
                 BIT(IIO_CHAN_INFO_SCALE), \
         .scan_index = idx, \
-        .scan_type = IIO_ST('s', 16, 16, IIO_BE), \
+        .scan_type = { \
+                .sign = 's', \
+                .realbits = 16, \
+                .storagebits = 16, \
+                .endianness = IIO_BE, \
+        }, \
 }
 
 static const struct iio_chan_spec mag3110_channels[] = {
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 9031171c141b..341c6016812d 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -957,12 +957,13 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start,
         if (WARN_ON(!gic->domain))
                 return;
 
+        if (gic_nr == 0) {
 #ifdef CONFIG_SMP
-        set_smp_cross_call(gic_raise_softirq);
-        register_cpu_notifier(&gic_cpu_notifier);
+                set_smp_cross_call(gic_raise_softirq);
+                register_cpu_notifier(&gic_cpu_notifier);
 #endif
-
-        set_handle_irq(gic_handle_irq);
+                set_handle_irq(gic_handle_irq);
+        }
 
         gic_chip.flags |= gic_arch_extn.flags;
         gic_dist_init(gic);
diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index 2848171b8576..b31d8e99c419 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -82,22 +82,12 @@ static inline size_t sizeof_pwm_leds_priv(int num_leds)
                       (sizeof(struct led_pwm_data) * num_leds);
 }
 
-static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
+static int led_pwm_create_of(struct platform_device *pdev,
+                             struct led_pwm_priv *priv)
 {
         struct device_node *node = pdev->dev.of_node;
         struct device_node *child;
-        struct led_pwm_priv *priv;
-        int count, ret;
-
-        /* count LEDs in this device, so we know how much to allocate */
-        count = of_get_child_count(node);
-        if (!count)
-                return NULL;
-
-        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
-                            GFP_KERNEL);
-        if (!priv)
-                return NULL;
+        int ret;
 
         for_each_child_of_node(node, child) {
                 struct led_pwm_data *led_dat = &priv->leds[priv->num_leds];
@@ -109,6 +99,7 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                 if (IS_ERR(led_dat->pwm)) {
                         dev_err(&pdev->dev, "unable to request PWM for %s\n",
                                 led_dat->cdev.name);
+                        ret = PTR_ERR(led_dat->pwm);
                         goto err;
                 }
                 /* Get the period from PWM core when n*/
@@ -137,28 +128,36 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                 priv->num_leds++;
         }
 
-        return priv;
+        return 0;
 err:
         while (priv->num_leds--)
                 led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
 
-        return NULL;
+        return ret;
 }
 
 static int led_pwm_probe(struct platform_device *pdev)
 {
         struct led_pwm_platform_data *pdata = dev_get_platdata(&pdev->dev);
         struct led_pwm_priv *priv;
-        int i, ret = 0;
+        int count, i;
+        int ret = 0;
+
+        if (pdata)
+                count = pdata->num_leds;
+        else
+                count = of_get_child_count(pdev->dev.of_node);
+
+        if (!count)
+                return -EINVAL;
 
-        if (pdata && pdata->num_leds) {
-                priv = devm_kzalloc(&pdev->dev,
-                                    sizeof_pwm_leds_priv(pdata->num_leds),
-                                    GFP_KERNEL);
-                if (!priv)
-                        return -ENOMEM;
+        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
+                            GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
-                for (i = 0; i < pdata->num_leds; i++) {
+        if (pdata) {
+                for (i = 0; i < count; i++) {
                         struct led_pwm *cur_led = &pdata->leds[i];
                         struct led_pwm_data *led_dat = &priv->leds[i];
 
@@ -188,11 +187,11 @@ static int led_pwm_probe(struct platform_device *pdev)
                         if (ret < 0)
                                 goto err;
                 }
-                priv->num_leds = pdata->num_leds;
+                priv->num_leds = count;
         } else {
-                priv = led_pwm_create_of(pdev);
-                if (!priv)
-                        return -ENODEV;
+                ret = led_pwm_create_of(pdev, priv);
+                if (ret)
+                        return ret;
         }
 
         platform_set_drvdata(pdev, priv);
diff --git a/drivers/macintosh/Makefile b/drivers/macintosh/Makefile
index 6753b65f8ede..d2f0120bc878 100644
--- a/drivers/macintosh/Makefile
+++ b/drivers/macintosh/Makefile
@@ -40,6 +40,7 @@ obj-$(CONFIG_WINDFARM_RM31)     += windfarm_fcu_controls.o \
                                    windfarm_ad7417_sensor.o \
                                    windfarm_lm75_sensor.o \
                                    windfarm_lm87_sensor.o \
+                                   windfarm_max6690_sensor.o \
                                    windfarm_pid.o \
                                    windfarm_cpufreq_clamp.o \
                                    windfarm_rm31.o
diff --git a/drivers/md/md.c b/drivers/md/md.c
index b6b7a2866c9e..e60cebf3f519 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7777,7 +7777,7 @@ void md_check_recovery(struct mddev *mddev)
         if (mddev->ro && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
                 return;
         if ( ! (
-                (mddev->flags & ~ (1<<MD_CHANGE_PENDING)) ||
+                (mddev->flags & MD_UPDATE_SB_FLAGS & ~ (1<<MD_CHANGE_PENDING)) ||
                 test_bit(MD_RECOVERY_NEEDED, &mddev->recovery) ||
                 test_bit(MD_RECOVERY_DONE, &mddev->recovery) ||
                 (mddev->external == 0 && mddev->safemode == 1) ||
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 47da0af6322b..cc055da02e2a 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -678,26 +678,23 @@ get_active_stripe(struct r5conf *conf, sector_t sector,
                         } else
                                 init_stripe(sh, sector, previous);
                 } else {
+                        spin_lock(&conf->device_lock);
                         if (atomic_read(&sh->count)) {
                                 BUG_ON(!list_empty(&sh->lru)
                                     && !test_bit(STRIPE_EXPANDING, &sh->state)
                                     && !test_bit(STRIPE_ON_UNPLUG_LIST, &sh->state)
-                                    && !test_bit(STRIPE_ON_RELEASE_LIST, &sh->state));
+                                        );
                         } else {
-                                spin_lock(&conf->device_lock);
                                 if (!test_bit(STRIPE_HANDLE, &sh->state))
                                         atomic_inc(&conf->active_stripes);
-                                if (list_empty(&sh->lru) &&
-                                    !test_bit(STRIPE_ON_RELEASE_LIST, &sh->state) &&
-                                    !test_bit(STRIPE_EXPANDING, &sh->state))
-                                        BUG();
+                                BUG_ON(list_empty(&sh->lru));
                                 list_del_init(&sh->lru);
                                 if (sh->group) {
                                         sh->group->stripes_cnt--;
                                         sh->group = NULL;
                                 }
-                                spin_unlock(&conf->device_lock);
                         }
+                        spin_unlock(&conf->device_lock);
                 }
         } while (sh == NULL);
 
@@ -5471,7 +5468,7 @@ static int alloc_thread_groups(struct r5conf *conf, int cnt,
         for (i = 0; i < *group_cnt; i++) {
                 struct r5worker_group *group;
 
-                group = worker_groups[i];
+                group = &(*worker_groups)[i];
                 INIT_LIST_HEAD(&group->handle_list);
                 group->conf = conf;
                 group->workers = workers + i * cnt;
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 0b10a9030f4e..98b6b6ef7e5c 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
+#include <linux/of.h>
 #include <linux/omap-dma.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/card.h>
@@ -90,17 +91,6 @@
 #define OMAP_MMC_CMDTYPE_AC     2
 #define OMAP_MMC_CMDTYPE_ADTC   3
 
-#define OMAP_DMA_MMC_TX         21
-#define OMAP_DMA_MMC_RX         22
-#define OMAP_DMA_MMC2_TX        54
-#define OMAP_DMA_MMC2_RX        55
-
-#define OMAP24XX_DMA_MMC2_TX    47
-#define OMAP24XX_DMA_MMC2_RX    48
-#define OMAP24XX_DMA_MMC1_TX    61
-#define OMAP24XX_DMA_MMC1_RX    62
-
-
 #define DRIVER_NAME "mmci-omap"
 
 /* Specifies how often in millisecs to poll for card status changes
@@ -1330,7 +1320,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
         struct mmc_omap_host *host = NULL;
         struct resource *res;
         dma_cap_mask_t mask;
-        unsigned sig;
+        unsigned sig = 0;
         int i, ret = 0;
         int irq;
 
@@ -1340,7 +1330,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
         }
         if (pdata->nr_slots == 0) {
                 dev_err(&pdev->dev, "no slots\n");
-                return -ENXIO;
+                return -EPROBE_DEFER;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1407,19 +1397,20 @@ static int mmc_omap_probe(struct platform_device *pdev)
         host->dma_tx_burst = -1;
         host->dma_rx_burst = -1;
 
-        if (mmc_omap2())
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_TX : OMAP24XX_DMA_MMC2_TX;
-        else
-                sig = host->id == 0 ? OMAP_DMA_MMC_TX : OMAP_DMA_MMC2_TX;
-        host->dma_tx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
+        if (res)
+                sig = res->start;
+        host->dma_tx = dma_request_slave_channel_compat(mask,
+                                omap_dma_filter_fn, &sig, &pdev->dev, "tx");
         if (!host->dma_tx)
                 dev_warn(host->dev, "unable to obtain TX DMA engine channel %u\n",
                         sig);
-        if (mmc_omap2())
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_RX : OMAP24XX_DMA_MMC2_RX;
-        else
-                sig = host->id == 0 ? OMAP_DMA_MMC_RX : OMAP_DMA_MMC2_RX;
-        host->dma_rx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
+        if (res)
+                sig = res->start;
+        host->dma_rx = dma_request_slave_channel_compat(mask,
+                                omap_dma_filter_fn, &sig, &pdev->dev, "rx");
         if (!host->dma_rx)
                 dev_warn(host->dev, "unable to obtain RX DMA engine channel %u\n",
                         sig);
@@ -1512,12 +1503,20 @@ static int mmc_omap_remove(struct platform_device *pdev)
         return 0;
 }
 
+#if IS_BUILTIN(CONFIG_OF)
+static const struct of_device_id mmc_omap_match[] = {
+        { .compatible = "ti,omap2420-mmc", },
+        { },
+};
+#endif
+
 static struct platform_driver mmc_omap_driver = {
         .probe          = mmc_omap_probe,
         .remove         = mmc_omap_remove,
         .driver         = {
                 .name   = DRIVER_NAME,
                 .owner  = THIS_MODULE,
+                .of_match_table = of_match_ptr(mmc_omap_match),
         },
 };
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4dd5ee2a34cc..36eab0c4fb33 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4110,7 +4110,7 @@ static int bond_check_params(struct bond_params *params)
                 if (!miimon) {
                         pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure, speed and duplex which are essential for 802.3ad operation\n");
                         pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                 }
         }
 
@@ -4147,7 +4147,7 @@ static int bond_check_params(struct bond_params *params)
                 if (!miimon) {
                         pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure and link speed which are essential for TLB/ALB load balancing\n");
                         pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                 }
         }
 
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 9a5223c7b4d1..ea6f640782b7 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -45,10 +45,15 @@ int bond_option_mode_set(struct bonding *bond, int mode)
                 return -EPERM;
         }
 
-        if (BOND_MODE_IS_LB(mode) && bond->params.arp_interval) {
-                pr_err("%s: %s mode is incompatible with arp monitoring.\n",
-                       bond->dev->name, bond_mode_tbl[mode].modename);
-                return -EINVAL;
+        if (BOND_NO_USES_ARP(mode) && bond->params.arp_interval) {
+                pr_info("%s: %s mode is incompatible with arp monitoring, start mii monitoring\n",
+                        bond->dev->name, bond_mode_tbl[mode].modename);
+                /* disable arp monitoring */
+                bond->params.arp_interval = 0;
+                /* set miimon to default value */
+                bond->params.miimon = BOND_DEFAULT_MIIMON;
+                pr_info("%s: Setting MII monitoring interval to %d.\n",
+                        bond->dev->name, bond->params.miimon);
         }
 
         /* don't cache arp_validate between modes */
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 0ec2a7e8c8a9..abf5e106edc5 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -523,9 +523,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                 ret = -EINVAL;
                 goto out;
         }
-        if (bond->params.mode == BOND_MODE_ALB ||
-            bond->params.mode == BOND_MODE_TLB ||
-            bond->params.mode == BOND_MODE_8023AD) {
+        if (BOND_NO_USES_ARP(bond->params.mode)) {
                 pr_info("%s: ARP monitoring cannot be used with ALB/TLB/802.3ad. Only MII monitoring is supported on %s.\n",
                         bond->dev->name, bond->dev->name);
                 ret = -EINVAL;
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index ca31286aa028..a9f4f9f4d8ce 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -35,6 +35,8 @@
 
 #define BOND_MAX_ARP_TARGETS    16
 
+#define BOND_DEFAULT_MIIMON     100
+
 #define IS_UP(dev)                                         \
               ((((dev)->flags & IFF_UP) == IFF_UP)      && \
                netif_running(dev)                       && \
@@ -55,6 +57,11 @@
                  ((mode) == BOND_MODE_TLB)          ||  \
                  ((mode) == BOND_MODE_ALB))
 
+#define BOND_NO_USES_ARP(mode)                          \
+                (((mode) == BOND_MODE_8023AD)   ||      \
+                 ((mode) == BOND_MODE_TLB)      ||      \
+                 ((mode) == BOND_MODE_ALB))
+
 #define TX_QUEUE_OVERRIDE(mode)                         \
                         (((mode) == BOND_MODE_ACTIVEBACKUP) ||  \
                          ((mode) == BOND_MODE_ROUNDROBIN))
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index e3fc07cf2f62..77061eebb034 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -712,22 +712,31 @@ static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
         return 0;
 }
 
-static int c_can_get_berr_counter(const struct net_device *dev,
-                                        struct can_berr_counter *bec)
+static int __c_can_get_berr_counter(const struct net_device *dev,
+                                    struct can_berr_counter *bec)
 {
         unsigned int reg_err_counter;
         struct c_can_priv *priv = netdev_priv(dev);
 
-        c_can_pm_runtime_get_sync(priv);
-
         reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
         bec->rxerr = (reg_err_counter & ERR_CNT_REC_MASK) >>
                                 ERR_CNT_REC_SHIFT;
         bec->txerr = reg_err_counter & ERR_CNT_TEC_MASK;
 
+        return 0;
+}
+
+static int c_can_get_berr_counter(const struct net_device *dev,
+                                  struct can_berr_counter *bec)
+{
+        struct c_can_priv *priv = netdev_priv(dev);
+        int err;
+
+        c_can_pm_runtime_get_sync(priv);
+        err = __c_can_get_berr_counter(dev, bec);
         c_can_pm_runtime_put_sync(priv);
 
-        return 0;
+        return err;
 }
 
 /*
@@ -754,6 +763,7 @@ static void c_can_do_tx(struct net_device *dev)
                 if (!(val & (1 << (msg_obj_no - 1)))) {
                         can_get_echo_skb(dev,
                                         msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
+                        c_can_object_get(dev, 0, msg_obj_no, IF_COMM_ALL);
                         stats->tx_bytes += priv->read_reg(priv,
                                         C_CAN_IFACE(MSGCTRL_REG, 0))
                                         & IF_MCONT_DLC_MASK;
@@ -872,7 +882,7 @@ static int c_can_handle_state_change(struct net_device *dev,
         if (unlikely(!skb))
                 return 0;
 
-        c_can_get_berr_counter(dev, &bec);
+        __c_can_get_berr_counter(dev, &bec);
         reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
         rx_err_passive = (reg_err_counter & ERR_CNT_RP_MASK) >>
                                 ERR_CNT_RP_SHIFT;
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index ae08cf129ebb..aaed97bee471 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1020,13 +1020,13 @@ static int flexcan_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "no ipg clock defined\n");
                         return PTR_ERR(clk_ipg);
                 }
-                clock_freq = clk_get_rate(clk_ipg);
 
                 clk_per = devm_clk_get(&pdev->dev, "per");
                 if (IS_ERR(clk_per)) {
                         dev_err(&pdev->dev, "no per clock defined\n");
                         return PTR_ERR(clk_per);
                 }
+                clock_freq = clk_get_rate(clk_per);
         }
 
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 7164a999f50f..f17c3018b7c7 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -494,20 +494,20 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
         uint8_t isrc, status;
         int n = 0;
 
-        /* Shared interrupts and IRQ off? */
-        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
-                return IRQ_NONE;
-
         if (priv->pre_irq)
                 priv->pre_irq(priv);
 
+        /* Shared interrupts and IRQ off? */
+        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
+                goto out;
+
         while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
                (n < SJA1000_MAX_IRQ)) {
-                n++;
+
                 status = priv->read_reg(priv, SJA1000_SR);
                 /* check for absent controller due to hw unplug */
                 if (status == 0xFF && sja1000_is_absent(priv))
-                        return IRQ_NONE;
+                        goto out;
 
                 if (isrc & IRQ_WUI)
                         netdev_warn(dev, "wakeup interrupt\n");
@@ -535,7 +535,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                                 status = priv->read_reg(priv, SJA1000_SR);
                                 /* check for absent controller */
                                 if (status == 0xFF && sja1000_is_absent(priv))
-                                        return IRQ_NONE;
+                                        goto out;
                         }
                 }
                 if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
@@ -543,8 +543,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         if (sja1000_err(dev, isrc, status))
                                 break;
                 }
+                n++;
         }
-
+out:
         if (priv->post_irq)
                 priv->post_irq(priv);
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a9e068423ba0..369b736dde05 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -10629,10 +10629,8 @@ static void tg3_sd_scan_scratchpad(struct tg3 *tp, struct tg3_ocir *ocir)
 static ssize_t tg3_show_temp(struct device *dev,
                              struct device_attribute *devattr, char *buf)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct tg3 *tp = netdev_priv(netdev);
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct tg3 *tp = dev_get_drvdata(dev);
         u32 temperature;
 
         spin_lock_bh(&tp->lock);
@@ -10650,29 +10648,25 @@ static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, tg3_show_temp, NULL,
 static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO, tg3_show_temp, NULL,
                           TG3_TEMP_MAX_OFFSET);
 
-static struct attribute *tg3_attributes[] = {
+static struct attribute *tg3_attrs[] = {
         &sensor_dev_attr_temp1_input.dev_attr.attr,
         &sensor_dev_attr_temp1_crit.dev_attr.attr,
         &sensor_dev_attr_temp1_max.dev_attr.attr,
         NULL
 };
-
-static const struct attribute_group tg3_group = {
-        .attrs = tg3_attributes,
-};
+ATTRIBUTE_GROUPS(tg3);
 
 static void tg3_hwmon_close(struct tg3 *tp)
 {
         if (tp->hwmon_dev) {
                 hwmon_device_unregister(tp->hwmon_dev);
                 tp->hwmon_dev = NULL;
-                sysfs_remove_group(&tp->pdev->dev.kobj, &tg3_group);
         }
 }
 
 static void tg3_hwmon_open(struct tg3 *tp)
 {
-        int i, err;
+        int i;
         u32 size = 0;
         struct pci_dev *pdev = tp->pdev;
         struct tg3_ocir ocirs[TG3_SD_NUM_RECS];
@@ -10690,18 +10684,11 @@ static void tg3_hwmon_open(struct tg3 *tp)
         if (!size)
                 return;
 
-        /* Register hwmon sysfs hooks */
-        err = sysfs_create_group(&pdev->dev.kobj, &tg3_group);
-        if (err) {
-                dev_err(&pdev->dev, "Cannot create sysfs group, aborting\n");
-                return;
-        }
-
-        tp->hwmon_dev = hwmon_device_register(&pdev->dev);
+        tp->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev, "tg3",
+                                                          tp, tg3_groups);
         if (IS_ERR(tp->hwmon_dev)) {
                 tp->hwmon_dev = NULL;
                 dev_err(&pdev->dev, "Cannot register hwmon device, aborting\n");
-                sysfs_remove_group(&pdev->dev.kobj, &tg3_group);
         }
 }
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index f4825db5d179..5878df619b53 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -503,6 +503,7 @@ struct be_adapter {
 };
 
 #define be_physfn(adapter)              (!adapter->virtfn)
+#define be_virtfn(adapter)              (adapter->virtfn)
 #define sriov_enabled(adapter)          (adapter->num_vfs > 0)
 #define sriov_want(adapter)             (be_physfn(adapter) &&  \
                                          (num_vfs || pci_num_vf(adapter->pdev)))
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index dbcd5262c016..e0e8bc1ef14c 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1032,6 +1032,13 @@ int be_cmd_cq_create(struct be_adapter *adapter, struct be_queue_info *cq,
         } else {
                 req->hdr.version = 2;
                 req->page_size = 1; /* 1 for 4K */
+
+                /* coalesce-wm field in this cmd is not relevant to Lancer.
+                 * Lancer uses COMMON_MODIFY_CQ to set this field
+                 */
+                if (!lancer_chip(adapter))
+                        AMAP_SET_BITS(struct amap_cq_context_v2, coalescwm,
+                                      ctxt, coalesce_wm);
                 AMAP_SET_BITS(struct amap_cq_context_v2, nodelay, ctxt,
                                                                 no_delay);
                 AMAP_SET_BITS(struct amap_cq_context_v2, count, ctxt,
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index abde97471636..fee64bf10446 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2658,8 +2658,8 @@ static int be_close(struct net_device *netdev)
 
         be_roce_dev_close(adapter);
 
-        for_all_evt_queues(adapter, eqo, i) {
-                if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
+        if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
+                for_all_evt_queues(adapter, eqo, i) {
                         napi_disable(&eqo->napi);
                         be_disable_busy_poll(eqo);
                 }
@@ -3253,12 +3253,10 @@ static int be_mac_setup(struct be_adapter *adapter)
                 memcpy(mac, adapter->netdev->dev_addr, ETH_ALEN);
         }
 
-        /* On BE3 VFs this cmd may fail due to lack of privilege.
-         * Ignore the failure as in this case pmac_id is fetched
-         * in the IFACE_CREATE cmd.
-         */
-        be_cmd_pmac_add(adapter, mac, adapter->if_handle,
-                        &adapter->pmac_id[0], 0);
+        /* For BE3-R VFs, the PF programs the initial MAC address */
+        if (!(BEx_chip(adapter) && be_virtfn(adapter)))
+                be_cmd_pmac_add(adapter, mac, adapter->if_handle,
+                                &adapter->pmac_id[0], 0);
         return 0;
 }
 
@@ -4599,6 +4597,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
         if (adapter->wol)
                 be_setup_wol(adapter, true);
 
+        be_intr_set(adapter, false);
         cancel_delayed_work_sync(&adapter->func_recovery_work);
 
         netif_device_detach(netdev);
@@ -4634,6 +4633,7 @@ static int be_resume(struct pci_dev *pdev)
         if (status)
                 return status;
 
+        be_intr_set(adapter, true);
         /* tell fw we're ready to fire cmds */
         status = be_cmd_fw_init(adapter);
         if (status)
diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
index 58c147271a36..f9313b36c887 100644
--- a/drivers/net/ethernet/intel/e1000/e1000.h
+++ b/drivers/net/ethernet/intel/e1000/e1000.h
@@ -83,6 +83,11 @@ struct e1000_adapter;
 
 #define E1000_MAX_INTR                  10
 
+/*
+ * Count for polling __E1000_RESET condition every 10-20msec.
+ */
+#define E1000_CHECK_RESET_COUNT 50
+
 /* TX/RX descriptor defines */
 #define E1000_DEFAULT_TXD               256
 #define E1000_MAX_TXD                   256
@@ -312,8 +317,6 @@ struct e1000_adapter {
         struct delayed_work watchdog_task;
         struct delayed_work fifo_stall_task;
         struct delayed_work phy_info_task;
-
-        struct mutex mutex;
 };
 
 enum e1000_state_t {
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index e38622825fa7..46e6544ed1b7 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -494,13 +494,20 @@ static void e1000_down_and_stop(struct e1000_adapter *adapter)
 {
         set_bit(__E1000_DOWN, &adapter->flags);
 
-        /* Only kill reset task if adapter is not resetting */
-        if (!test_bit(__E1000_RESETTING, &adapter->flags))
-                cancel_work_sync(&adapter->reset_task);
-
         cancel_delayed_work_sync(&adapter->watchdog_task);
+
+        /*
+         * Since the watchdog task can reschedule other tasks, we should cancel
+         * it first, otherwise we can run into the situation when a work is
+         * still running after the adapter has been turned down.
+         */
+
         cancel_delayed_work_sync(&adapter->phy_info_task);
         cancel_delayed_work_sync(&adapter->fifo_stall_task);
+
+        /* Only kill reset task if adapter is not resetting */
+        if (!test_bit(__E1000_RESETTING, &adapter->flags))
+                cancel_work_sync(&adapter->reset_task);
 }
 
 void e1000_down(struct e1000_adapter *adapter)
@@ -544,21 +551,8 @@ void e1000_down(struct e1000_adapter *adapter)
         e1000_clean_all_rx_rings(adapter);
 }
 
-static void e1000_reinit_safe(struct e1000_adapter *adapter)
-{
-        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
-                msleep(1);
-        mutex_lock(&adapter->mutex);
-        e1000_down(adapter);
-        e1000_up(adapter);
-        mutex_unlock(&adapter->mutex);
-        clear_bit(__E1000_RESETTING, &adapter->flags);
-}
-
 void e1000_reinit_locked(struct e1000_adapter *adapter)
 {
-        /* if rtnl_lock is not held the call path is bogus */
-        ASSERT_RTNL();
         WARN_ON(in_interrupt());
         while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
                 msleep(1);
@@ -1316,7 +1310,6 @@ static int e1000_sw_init(struct e1000_adapter *adapter)
         e1000_irq_disable(adapter);
 
         spin_lock_init(&adapter->stats_lock);
-        mutex_init(&adapter->mutex);
 
         set_bit(__E1000_DOWN, &adapter->flags);
 
@@ -1440,6 +1433,10 @@ static int e1000_close(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
         struct e1000_hw *hw = &adapter->hw;
+        int count = E1000_CHECK_RESET_COUNT;
+
+        while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                usleep_range(10000, 20000);
 
         WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
         e1000_down(adapter);
@@ -2325,11 +2322,8 @@ static void e1000_update_phy_info_task(struct work_struct *work)
         struct e1000_adapter *adapter = container_of(work,
                                                      struct e1000_adapter,
                                                      phy_info_task.work);
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
+
         e1000_phy_get_info(&adapter->hw, &adapter->phy_info);
-        mutex_unlock(&adapter->mutex);
 }
 
 /**
@@ -2345,9 +2339,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
         struct net_device *netdev = adapter->netdev;
         u32 tctl;
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
         if (atomic_read(&adapter->tx_fifo_stall)) {
                 if ((er32(TDT) == er32(TDH)) &&
                    (er32(TDFT) == er32(TDFH)) &&
@@ -2368,7 +2359,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
                         schedule_delayed_work(&adapter->fifo_stall_task, 1);
                 }
         }
-        mutex_unlock(&adapter->mutex);
 }
 
 bool e1000_has_link(struct e1000_adapter *adapter)
@@ -2422,10 +2412,6 @@ static void e1000_watchdog(struct work_struct *work)
         struct e1000_tx_ring *txdr = adapter->tx_ring;
         u32 link, tctl;
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-
-        mutex_lock(&adapter->mutex);
         link = e1000_has_link(adapter);
         if ((netif_carrier_ok(netdev)) && link)
                 goto link_up;
@@ -2516,7 +2502,7 @@ link_up:
                         adapter->tx_timeout_count++;
                         schedule_work(&adapter->reset_task);
                         /* exit immediately since reset is imminent */
-                        goto unlock;
+                        return;
                 }
         }
 
@@ -2544,9 +2530,6 @@ link_up:
         /* Reschedule the task */
         if (!test_bit(__E1000_DOWN, &adapter->flags))
                 schedule_delayed_work(&adapter->watchdog_task, 2 * HZ);
-
-unlock:
-        mutex_unlock(&adapter->mutex);
 }
 
 enum latency_range {
@@ -3495,10 +3478,8 @@ static void e1000_reset_task(struct work_struct *work)
         struct e1000_adapter *adapter =
                 container_of(work, struct e1000_adapter, reset_task);
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
         e_err(drv, "Reset adapter\n");
-        e1000_reinit_safe(adapter);
+        e1000_reinit_locked(adapter);
 }
 
 /**
@@ -4963,6 +4944,11 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
         netif_device_detach(netdev);
 
         if (netif_running(netdev)) {
+                int count = E1000_CHECK_RESET_COUNT;
+
+                while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                        usleep_range(10000, 20000);
+
                 WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
                 e1000_down(adapter);
         }
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index b0f3666b1d7f..c3143da497c8 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2062,14 +2062,15 @@ static void igb_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
 {
         struct igb_adapter *adapter = netdev_priv(netdev);
 
-        wol->supported = WAKE_UCAST | WAKE_MCAST |
-                         WAKE_BCAST | WAKE_MAGIC |
-                         WAKE_PHY;
         wol->wolopts = 0;
 
         if (!(adapter->flags & IGB_FLAG_WOL_SUPPORTED))
                 return;
 
+        wol->supported = WAKE_UCAST | WAKE_MCAST |
+                         WAKE_BCAST | WAKE_MAGIC |
+                         WAKE_PHY;
+
         /* apply any specific unsupported masks here */
         switch (adapter->hw.device_id) {
         default:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 0c55079ebee3..cc06854296a3 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4251,8 +4251,8 @@ static void ixgbe_disable_fwd_ring(struct ixgbe_fwd_adapter *vadapter,
         rx_ring->l2_accel_priv = NULL;
 }
 
-int ixgbe_fwd_ring_down(struct net_device *vdev,
-                        struct ixgbe_fwd_adapter *accel)
+static int ixgbe_fwd_ring_down(struct net_device *vdev,
+                               struct ixgbe_fwd_adapter *accel)
 {
         struct ixgbe_adapter *adapter = accel->real_adapter;
         unsigned int rxbase = accel->rx_base_queue;
@@ -7986,10 +7986,9 @@ skip_sriov:
                            NETIF_F_TSO |
                            NETIF_F_TSO6 |
                            NETIF_F_RXHASH |
-                           NETIF_F_RXCSUM |
-                           NETIF_F_HW_L2FW_DOFFLOAD;
+                           NETIF_F_RXCSUM;
 
-        netdev->hw_features = netdev->features;
+        netdev->hw_features = netdev->features | NETIF_F_HW_L2FW_DOFFLOAD;
 
         switch (adapter->hw.mac.type) {
         case ixgbe_mac_82599EB:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index e4c676006be9..39217e5ff7dc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -46,6 +46,7 @@ static bool ixgbe_get_i2c_data(u32 *i2cctl);
 static void ixgbe_i2c_bus_clear(struct ixgbe_hw *hw);
 static enum ixgbe_phy_type ixgbe_get_phy_type_from_id(u32 phy_id);
 static s32 ixgbe_get_phy_id(struct ixgbe_hw *hw);
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 
 /**
  *  ixgbe_identify_phy_generic - Get physical layer module
@@ -1164,7 +1165,7 @@ err_read_i2c_eeprom:
  *
  * Searches for and identifies the QSFP module and assigns appropriate PHY type
  **/
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
 {
         struct ixgbe_adapter *adapter = hw->back;
         s32 status = IXGBE_ERR_PHY_ADDR_INVALID;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index aae900a256da..fffcbdd2bf0e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
@@ -145,7 +145,6 @@ s32 ixgbe_get_phy_firmware_version_generic(struct ixgbe_hw *hw,
 s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw);
 s32 ixgbe_identify_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw,
                                         u16 *list_offset,
                                         u16 *data_offset);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 40626690e8a8..c11d063473e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -140,7 +140,6 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_tx_ring *tx_ring;
         int i, carrier_ok;
 
         memset(buf, 0, sizeof(u64) * MLX4_EN_NUM_SELF_TEST);
@@ -150,16 +149,10 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                 carrier_ok = netif_carrier_ok(dev);
 
                 netif_carrier_off(dev);
-retry_tx:
                 /* Wait until all tx queues are empty.
                  * there should not be any additional incoming traffic
                  * since we turned the carrier off */
                 msleep(200);
-                for (i = 0; i < priv->tx_ring_num && carrier_ok; i++) {
-                        tx_ring = priv->tx_ring[i];
-                        if (tx_ring->prod != (tx_ring->cons + tx_ring->last_nr_txbb))
-                                goto retry_tx;
-                }
 
                 if (priv->mdev->dev->caps.flags &
                                         MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index f2a2128165dd..737c1a881f78 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -678,9 +678,6 @@ static void cp_tx (struct cp_private *cp)
                                  le32_to_cpu(txd->opts1) & 0xffff,
                                  PCI_DMA_TODEVICE);
 
-                bytes_compl += skb->len;
-                pkts_compl++;
-
                 if (status & LastFrag) {
                         if (status & (TxError | TxFIFOUnder)) {
                                 netif_dbg(cp, tx_err, cp->dev,
@@ -702,6 +699,8 @@ static void cp_tx (struct cp_private *cp)
                                 netif_dbg(cp, tx_done, cp->dev,
                                           "tx done, slot %d\n", tx_tail);
                         }
+                        bytes_compl += skb->len;
+                        pkts_compl++;
                         dev_kfree_skb_irq(skb);
                 }
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 799387570766..c737f0ea5de7 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3465,6 +3465,11 @@ static void rtl8168g_1_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x14, 0x9065);
         rtl_writephy(tp, 0x14, 0x1065);
 
+        /* Check ALDPS bit, disable it if enabled */
+        rtl_writephy(tp, 0x1f, 0x0a43);
+        if (rtl_readphy(tp, 0x10) & 0x0004)
+                rtl_w1w0_phy(tp, 0x10, 0x0000, 0x0004);
+
         rtl_writephy(tp, 0x1f, 0x0000);
 }
 
diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
index 656a3277c2b2..15816cacb548 100644
--- a/drivers/net/ethernet/sfc/mcdi.h
+++ b/drivers/net/ethernet/sfc/mcdi.h
@@ -75,6 +75,8 @@ struct efx_mcdi_mon {
         unsigned long last_update;
         struct device *device;
         struct efx_mcdi_mon_attribute *attrs;
+        struct attribute_group group;
+        const struct attribute_group *groups[2];
         unsigned int n_attrs;
 };
 
diff --git a/drivers/net/ethernet/sfc/mcdi_mon.c b/drivers/net/ethernet/sfc/mcdi_mon.c
index 4cc5d95b2a5a..d72ad4fc3617 100644
--- a/drivers/net/ethernet/sfc/mcdi_mon.c
+++ b/drivers/net/ethernet/sfc/mcdi_mon.c
@@ -139,17 +139,10 @@ static int efx_mcdi_mon_update(struct efx_nic *efx)
         return rc;
 }
 
-static ssize_t efx_mcdi_mon_show_name(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-        return sprintf(buf, "%s\n", KBUILD_MODNAME);
-}
-
 static int efx_mcdi_mon_get_entry(struct device *dev, unsigned int index,
                                   efx_dword_t *entry)
 {
-        struct efx_nic *efx = dev_get_drvdata(dev);
+        struct efx_nic *efx = dev_get_drvdata(dev->parent);
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
         int rc;
 
@@ -263,7 +256,7 @@ static ssize_t efx_mcdi_mon_show_label(struct device *dev,
                        efx_mcdi_sensor_type[mon_attr->type].label);
 }
 
-static int
+static void
 efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
                       ssize_t (*reader)(struct device *,
                                         struct device_attribute *, char *),
@@ -272,7 +265,6 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
 {
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
         struct efx_mcdi_mon_attribute *attr = &hwmon->attrs[hwmon->n_attrs];
-        int rc;
 
         strlcpy(attr->name, name, sizeof(attr->name));
         attr->index = index;
@@ -286,10 +278,7 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
         attr->dev_attr.attr.name = attr->name;
         attr->dev_attr.attr.mode = S_IRUGO;
         attr->dev_attr.show = reader;
-        rc = device_create_file(&efx->pci_dev->dev, &attr->dev_attr);
-        if (rc == 0)
-                ++hwmon->n_attrs;
-        return rc;
+        hwmon->group.attrs[hwmon->n_attrs++] = &attr->dev_attr.attr;
 }
 
 int efx_mcdi_mon_probe(struct efx_nic *efx)
@@ -338,26 +327,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
         efx_mcdi_mon_update(efx);
 
         /* Allocate space for the maximum possible number of
-         * attributes for this set of sensors: name of the driver plus
+         * attributes for this set of sensors:
          * value, min, max, crit, alarm and label for each sensor.
          */
-        n_attrs = 1 + 6 * n_sensors;
+        n_attrs = 6 * n_sensors;
         hwmon->attrs = kcalloc(n_attrs, sizeof(*hwmon->attrs), GFP_KERNEL);
         if (!hwmon->attrs) {
                 rc = -ENOMEM;
                 goto fail;
         }
-
-        hwmon->device = hwmon_device_register(&efx->pci_dev->dev);
-        if (IS_ERR(hwmon->device)) {
-                rc = PTR_ERR(hwmon->device);
+        hwmon->group.attrs = kcalloc(n_attrs + 1, sizeof(struct attribute *),
+                                     GFP_KERNEL);
+        if (!hwmon->group.attrs) {
+                rc = -ENOMEM;
                 goto fail;
         }
 
-        rc = efx_mcdi_mon_add_attr(efx, "name", efx_mcdi_mon_show_name, 0, 0, 0);
-        if (rc)
-                goto fail;
-
         for (i = 0, j = -1, type = -1; ; i++) {
                 enum efx_hwmon_type hwmon_type;
                 const char *hwmon_prefix;
@@ -372,7 +357,7 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                 page = type / 32;
                                 j = -1;
                                 if (page == n_pages)
-                                        return 0;
+                                        goto hwmon_register;
 
                                 MCDI_SET_DWORD(inbuf, SENSOR_INFO_EXT_IN_PAGE,
                                                page);
@@ -453,28 +438,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                 if (min1 != max1) {
                         snprintf(name, sizeof(name), "%s%u_input",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_value, i, type, 0);
-                        if (rc)
-                                goto fail;
 
                         if (hwmon_type != EFX_HWMON_POWER) {
                                 snprintf(name, sizeof(name), "%s%u_min",
                                          hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                         efx, name, efx_mcdi_mon_show_limit,
                                         i, type, min1);
-                                if (rc)
-                                        goto fail;
                         }
 
                         snprintf(name, sizeof(name), "%s%u_max",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_limit,
                                 i, type, max1);
-                        if (rc)
-                                goto fail;
 
                         if (min2 != max2) {
                                 /* Assume max2 is critical value.
@@ -482,32 +461,38 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                  */
                                 snprintf(name, sizeof(name), "%s%u_crit",
                                          hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                         efx, name, efx_mcdi_mon_show_limit,
                                         i, type, max2);
-                                if (rc)
-                                        goto fail;
                         }
                 }
 
                 snprintf(name, sizeof(name), "%s%u_alarm",
                          hwmon_prefix, hwmon_index);
-                rc = efx_mcdi_mon_add_attr(
+                efx_mcdi_mon_add_attr(
                         efx, name, efx_mcdi_mon_show_alarm, i, type, 0);
-                if (rc)
-                        goto fail;
 
                 if (type < ARRAY_SIZE(efx_mcdi_sensor_type) &&
                     efx_mcdi_sensor_type[type].label) {
                         snprintf(name, sizeof(name), "%s%u_label",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_label, i, type, 0);
-                        if (rc)
-                                goto fail;
                 }
         }
 
+hwmon_register:
+        hwmon->groups[0] = &hwmon->group;
+        hwmon->device = hwmon_device_register_with_groups(&efx->pci_dev->dev,
+                                                          KBUILD_MODNAME, NULL,
+                                                          hwmon->groups);
+        if (IS_ERR(hwmon->device)) {
+                rc = PTR_ERR(hwmon->device);
+                goto fail;
+        }
+
+        return 0;
+
 fail:
         efx_mcdi_mon_remove(efx);
         return rc;
@@ -516,14 +501,11 @@ fail:
 void efx_mcdi_mon_remove(struct efx_nic *efx)
 {
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
-        unsigned int i;
 
-        for (i = 0; i < hwmon->n_attrs; i++)
-                device_remove_file(&efx->pci_dev->dev,
-                                   &hwmon->attrs[i].dev_attr);
-        kfree(hwmon->attrs);
         if (hwmon->device)
                 hwmon_device_unregister(hwmon->device);
+        kfree(hwmon->attrs);
+        kfree(hwmon->group.attrs);
         efx_nic_free_buffer(efx, &hwmon->dma_buf);
 }
 
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index c9d4c872e81d..749654b976bc 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -46,7 +46,8 @@
     defined(CONFIG_MACH_LITTLETON) ||\
     defined(CONFIG_MACH_ZYLONITE2) ||\
     defined(CONFIG_ARCH_VIPER) ||\
-    defined(CONFIG_MACH_STARGATE2)
+    defined(CONFIG_MACH_STARGATE2) ||\
+    defined(CONFIG_ARCH_VERSATILE)
 
 #include <asm/mach-types.h>
 
@@ -154,6 +155,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
 #define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
+#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
 /* We actually can't write halfwords properly if not word aligned */
@@ -206,23 +209,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define RPC_LSA_DEFAULT         RPC_LED_TX_RX
 #define RPC_LSB_DEFAULT         RPC_LED_100_10
 
-#elif   defined(CONFIG_ARCH_VERSATILE)
-
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       1
-#define SMC_NOWAIT              1
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
-#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
-#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
-
 #elif defined(CONFIG_MN10300)
 
 /*
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index d022bf936572..ad61d26a44f3 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -2172,16 +2172,13 @@ static int velocity_poll(struct napi_struct *napi, int budget)
         unsigned int rx_done;
         unsigned long flags;
 
-        spin_lock_irqsave(&vptr->lock, flags);
         /*
          * Do rx and tx twice for performance (taken from the VIA
          * out-of-tree driver).
          */
-        rx_done = velocity_rx_srv(vptr, budget / 2);
-        velocity_tx_srv(vptr);
-        rx_done += velocity_rx_srv(vptr, budget - rx_done);
+        rx_done = velocity_rx_srv(vptr, budget);
+        spin_lock_irqsave(&vptr->lock, flags);
         velocity_tx_srv(vptr);
-
         /* If budget not fully consumed, exit the polling mode */
         if (rx_done < budget) {
                 napi_complete(napi);
@@ -2342,6 +2339,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
                 if (ret < 0)
                         goto out_free_tmp_vptr_1;
 
+                napi_disable(&vptr->napi);
+
                 spin_lock_irqsave(&vptr->lock, flags);
 
                 netif_stop_queue(dev);
@@ -2362,6 +2361,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
 
                 velocity_give_many_rx_descs(vptr);
 
+                napi_enable(&vptr->napi);
+
                 mac_enable_int(vptr->mac_regs);
                 netif_start_queue(dev);
 
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index dc76670c2f2a..9093004f9b63 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -744,7 +744,7 @@ err:
         rcu_read_lock();
         vlan = rcu_dereference(q->vlan);
         if (vlan)
-                vlan->dev->stats.tx_dropped++;
+                this_cpu_inc(vlan->pcpu_stats->tx_dropped);
         rcu_read_unlock();
 
         return err;
@@ -767,7 +767,6 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                                 const struct sk_buff *skb,
                                 const struct iovec *iv, int len)
 {
-        struct macvlan_dev *vlan;
         int ret;
         int vnet_hdr_len = 0;
         int vlan_offset = 0;
@@ -821,15 +820,6 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
         copied += len;
 
 done:
-        rcu_read_lock();
-        vlan = rcu_dereference(q->vlan);
-        if (vlan) {
-                preempt_disable();
-                macvlan_count_rx(vlan, copied - vnet_hdr_len, ret == 0, 0);
-                preempt_enable();
-        }
-        rcu_read_unlock();
-
         return ret ? ret : copied;
 }
 
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 508e4359338b..14372c65a7e8 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -64,6 +64,7 @@
 
 #define PHY_ID_VSC8234                  0x000fc620
 #define PHY_ID_VSC8244                  0x000fc6c0
+#define PHY_ID_VSC8514                  0x00070670
 #define PHY_ID_VSC8574                  0x000704a0
 #define PHY_ID_VSC8662                  0x00070660
 #define PHY_ID_VSC8221                  0x000fc550
@@ -131,6 +132,7 @@ static int vsc82xx_config_intr(struct phy_device *phydev)
                 err = phy_write(phydev, MII_VSC8244_IMASK,
                         (phydev->drv->phy_id == PHY_ID_VSC8234 ||
                          phydev->drv->phy_id == PHY_ID_VSC8244 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8514 ||
                          phydev->drv->phy_id == PHY_ID_VSC8574) ?
                                 MII_VSC8244_IMASK_MASK :
                                 MII_VSC8221_IMASK_MASK);
@@ -246,6 +248,18 @@ static struct phy_driver vsc82xx_driver[] = {
         .config_intr    = &vsc82xx_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_VSC8514,
+        .name           = "Vitesse VSC8514",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         .phy_id         = PHY_ID_VSC8574,
         .name           = "Vitesse VSC8574",
         .phy_id_mask    = 0x000ffff0,
@@ -315,6 +329,7 @@ module_exit(vsc82xx_exit);
 static struct mdio_device_id __maybe_unused vitesse_tbl[] = {
         { PHY_ID_VSC8234, 0x000ffff0 },
         { PHY_ID_VSC8244, 0x000fffc0 },
+        { PHY_ID_VSC8514, 0x000ffff0 },
         { PHY_ID_VSC8574, 0x000ffff0 },
         { PHY_ID_VSC8662, 0x000ffff0 },
         { PHY_ID_VSC8221, 0x000ffff0 },
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 34b0de09d881..736050d6b451 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1366,6 +1366,8 @@ static int team_user_linkup_option_get(struct team *team,
         return 0;
 }
 
+static void __team_carrier_check(struct team *team);
+
 static int team_user_linkup_option_set(struct team *team,
                                        struct team_gsetter_ctx *ctx)
 {
@@ -1373,6 +1375,7 @@ static int team_user_linkup_option_set(struct team *team,
 
         port->user.linkup = ctx->data.bool_val;
         team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
         return 0;
 }
 
@@ -1392,6 +1395,7 @@ static int team_user_linkup_en_option_set(struct team *team,
 
         port->user.linkup_enabled = ctx->data.bool_val;
         team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
         return 0;
 }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7bab4de658a9..916241d16c67 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -299,35 +299,76 @@ static struct sk_buff *page_to_skb(struct receive_queue *rq,
         return skb;
 }
 
-static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
+static struct sk_buff *receive_small(void *buf, unsigned int len)
 {
-        struct skb_vnet_hdr *hdr = skb_vnet_hdr(head_skb);
+        struct sk_buff * skb = buf;
+
+        len -= sizeof(struct virtio_net_hdr);
+        skb_trim(skb, len);
+
+        return skb;
+}
+
+static struct sk_buff *receive_big(struct net_device *dev,
+                                   struct receive_queue *rq,
+                                   void *buf,
+                                   unsigned int len)
+{
+        struct page *page = buf;
+        struct sk_buff *skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
+
+        if (unlikely(!skb))
+                goto err;
+
+        return skb;
+
+err:
+        dev->stats.rx_dropped++;
+        give_pages(rq, page);
+        return NULL;
+}
+
+static struct sk_buff *receive_mergeable(struct net_device *dev,
+                                         struct receive_queue *rq,
+                                         void *buf,
+                                         unsigned int len)
+{
+        struct skb_vnet_hdr *hdr = buf;
+        int num_buf = hdr->mhdr.num_buffers;
+        struct page *page = virt_to_head_page(buf);
+        int offset = buf - page_address(page);
+        struct sk_buff *head_skb = page_to_skb(rq, page, offset, len,
+                                               MERGE_BUFFER_LEN);
         struct sk_buff *curr_skb = head_skb;
-        char *buf;
-        struct page *page;
-        int num_buf, len, offset;
 
-        num_buf = hdr->mhdr.num_buffers;
+        if (unlikely(!curr_skb))
+                goto err_skb;
+
         while (--num_buf) {
-                int num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
+                int num_skb_frags;
+
                 buf = virtqueue_get_buf(rq->vq, &len);
                 if (unlikely(!buf)) {
-                        pr_debug("%s: rx error: %d buffers missing\n",
-                                 head_skb->dev->name, hdr->mhdr.num_buffers);
-                        head_skb->dev->stats.rx_length_errors++;
-                        return -EINVAL;
+                        pr_debug("%s: rx error: %d buffers out of %d missing\n",
+                                 dev->name, num_buf, hdr->mhdr.num_buffers);
+                        dev->stats.rx_length_errors++;
+                        goto err_buf;
                 }
                 if (unlikely(len > MERGE_BUFFER_LEN)) {
                         pr_debug("%s: rx error: merge buffer too long\n",
-                                 head_skb->dev->name);
+                                 dev->name);
                         len = MERGE_BUFFER_LEN;
                 }
+
+                page = virt_to_head_page(buf);
+                --rq->num;
+
+                num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
                 if (unlikely(num_skb_frags == MAX_SKB_FRAGS)) {
                         struct sk_buff *nskb = alloc_skb(0, GFP_ATOMIC);
-                        if (unlikely(!nskb)) {
-                                head_skb->dev->stats.rx_dropped++;
-                                return -ENOMEM;
-                        }
+
+                        if (unlikely(!nskb))
+                                goto err_skb;
                         if (curr_skb == head_skb)
                                 skb_shinfo(curr_skb)->frag_list = nskb;
                         else
@@ -341,8 +382,7 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                         head_skb->len += len;
                         head_skb->truesize += MERGE_BUFFER_LEN;
                 }
-                page = virt_to_head_page(buf);
-                offset = buf - (char *)page_address(page);
+                offset = buf - page_address(page);
                 if (skb_can_coalesce(curr_skb, num_skb_frags, page, offset)) {
                         put_page(page);
                         skb_coalesce_rx_frag(curr_skb, num_skb_frags - 1,
@@ -351,9 +391,28 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                         skb_add_rx_frag(curr_skb, num_skb_frags, page,
                                         offset, len, MERGE_BUFFER_LEN);
                 }
+        }
+
+        return head_skb;
+
+err_skb:
+        put_page(page);
+        while (--num_buf) {
+                buf = virtqueue_get_buf(rq->vq, &len);
+                if (unlikely(!buf)) {
+                        pr_debug("%s: rx error: %d buffers missing\n",
+                                 dev->name, num_buf);
+                        dev->stats.rx_length_errors++;
+                        break;
+                }
+                page = virt_to_head_page(buf);
+                put_page(page);
                 --rq->num;
         }
-        return 0;
+err_buf:
+        dev->stats.rx_dropped++;
+        dev_kfree_skb(head_skb);
+        return NULL;
 }
 
 static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
@@ -362,7 +421,6 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
         struct net_device *dev = vi->dev;
         struct virtnet_stats *stats = this_cpu_ptr(vi->stats);
         struct sk_buff *skb;
-        struct page *page;
         struct skb_vnet_hdr *hdr;
 
         if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
@@ -377,33 +435,15 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
                 return;
         }
 
-        if (!vi->mergeable_rx_bufs && !vi->big_packets) {
-                skb = buf;
-                len -= sizeof(struct virtio_net_hdr);
-                skb_trim(skb, len);
-        } else if (vi->mergeable_rx_bufs) {
-                struct page *page = virt_to_head_page(buf);
-                skb = page_to_skb(rq, page,
-                                  (char *)buf - (char *)page_address(page),
-                                  len, MERGE_BUFFER_LEN);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        put_page(page);
-                        return;
-                }
-                if (receive_mergeable(rq, skb)) {
-                        dev_kfree_skb(skb);
-                        return;
-                }
-        } else {
-                page = buf;
-                skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        give_pages(rq, page);
-                        return;
-                }
-        }
+        if (vi->mergeable_rx_bufs)
+                skb = receive_mergeable(dev, rq, buf, len);
+        else if (vi->big_packets)
+                skb = receive_big(dev, rq, buf, len);
+        else
+                skb = receive_small(buf, len);
+
+        if (unlikely(!skb))
+                return;
 
         hdr = skb_vnet_hdr(skb);
 
@@ -1084,7 +1124,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
                                   VIRTIO_NET_CTRL_MAC_TABLE_SET,
                                   sg, NULL))
-                dev_warn(&dev->dev, "Failed to set MAC fitler table.\n");
+                dev_warn(&dev->dev, "Failed to set MAC filter table.\n");
 
         kfree(buf);
 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 919b6509455c..64f0e0d18b81 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -39,6 +39,7 @@
 #include <linux/udp.h>
 
 #include <net/tcp.h>
+#include <net/ip6_checksum.h>
 
 #include <xen/xen.h>
 #include <xen/events.h>
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b3b1b9aa8863..3a02717473ad 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -9,10 +9,6 @@
  *
  *  Init/reset quirks for USB host controllers should be in the
  *  USB quirks file, where their drivers can access reuse it.
- *
- *  The bridge optimization stuff has been removed. If you really
- *  have a silly BIOS which is unable to set your host bridge right,
- *  use the PowerTweak utility (see http://powertweak.sourceforge.net).
  */
 
 #include <linux/types.h>
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index cee7e2708a1f..95e45782692f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3224,6 +3224,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp(struct dasd_device *startdev,
 
         fcx_multitrack = private->features.feature[40] & 0x20;
         data_size = blk_rq_bytes(req);
+        if (data_size % blksize)
+                return ERR_PTR(-EINVAL);
         /* tpm write request add CBC data on each track boundary */
         if (rq_data_dir(req) == WRITE)
                 data_size += (last_trk - first_trk) * 4;
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index bd6f743d87a7..892ea6161376 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -1404,11 +1404,22 @@ enum {
 };
 #define PMCRAID_AEN_CMD_MAX (__PMCRAID_AEN_CMD_MAX - 1)
 
+static struct genl_multicast_group pmcraid_mcgrps[] = {
+        { .name = "events", /* not really used - see ID discussion below */ },
+};
+
 static struct genl_family pmcraid_event_family = {
-        .id = GENL_ID_GENERATE,
+        /*
+         * Due to prior multicast group abuse (the code having assumed that
+         * the family ID can be used as a multicast group ID) we need to
+         * statically allocate a family (and thus group) ID.
+         */
+        .id = GENL_ID_PMCRAID,
         .name = "pmcraid",
         .version = 1,
-        .maxattr = PMCRAID_AEN_ATTR_MAX
+        .maxattr = PMCRAID_AEN_ATTR_MAX,
+        .mcgrps = pmcraid_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(pmcraid_mcgrps),
 };
 
 /**
@@ -1511,9 +1522,8 @@ static int pmcraid_notify_aen(
                 return result;
         }
 
-        result =
-                genlmsg_multicast(&pmcraid_event_family, skb, 0,
-                                  pmcraid_event_family.id, GFP_ATOMIC);
+        result = genlmsg_multicast(&pmcraid_event_family, skb,
+                                   0, 0, GFP_ATOMIC);
 
         /* If there are no listeners, genlmsg_multicast may return non-zero
          * value.
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 3ed666fe840a..9025edd7dc45 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -377,7 +377,7 @@ out_master_put:
 
 static int bcm2835_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+        struct spi_master *master = platform_get_drvdata(pdev);
         struct bcm2835_spi *bs = spi_master_get_devdata(master);
 
         free_irq(bs->irq, master);
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 80d56b214eb5..469ecd876358 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -435,7 +435,7 @@ out:
 
 static int bcm63xx_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+        struct spi_master *master = platform_get_drvdata(pdev);
         struct bcm63xx_spi *bs = spi_master_get_devdata(master);
 
         /* reset spi block */
diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
index 9602bbd8d7ea..87676587d783 100644
--- a/drivers/spi/spi-mpc512x-psc.c
+++ b/drivers/spi/spi-mpc512x-psc.c
@@ -557,7 +557,7 @@ free_master:
 
 static int mpc512x_psc_spi_do_remove(struct device *dev)
 {
-        struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
+        struct spi_master *master = dev_get_drvdata(dev);
         struct mpc512x_psc_spi *mps = spi_master_get_devdata(master);
 
         clk_disable_unprepare(mps->clk_mclk);
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index 73afb56c08cc..3adebfa22e3d 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -565,7 +565,7 @@ static int mxs_spi_remove(struct platform_device *pdev)
         struct mxs_spi *spi;
         struct mxs_ssp *ssp;
 
-        master = spi_master_get(platform_get_drvdata(pdev));
+        master = platform_get_drvdata(pdev);
         spi = spi_master_get_devdata(master);
         ssp = &spi->ssp;
 
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index cb0e1f1137ad..7765b1999537 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1073,6 +1073,8 @@ pxa2xx_spi_acpi_get_pdata(struct platform_device *pdev)
 static struct acpi_device_id pxa2xx_spi_acpi_match[] = {
         { "INT33C0", 0 },
         { "INT33C1", 0 },
+        { "INT3430", 0 },
+        { "INT3431", 0 },
         { "80860F0E", 0 },
         { },
 };
@@ -1291,6 +1293,9 @@ static int pxa2xx_spi_resume(struct device *dev)
         /* Enable the SSP clock */
         clk_prepare_enable(ssp->clk);
 
+        /* Restore LPSS private register bits */
+        lpss_ssp_setup(drv_data);
+
         /* Start the queue running */
         status = spi_master_resume(drv_data->master);
         if (status != 0) {
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 58449ad4ad0d..9e829cee7357 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -885,14 +885,13 @@ static void rspi_release_dma(struct rspi_data *rspi)
 
 static int rspi_remove(struct platform_device *pdev)
 {
-        struct rspi_data *rspi = spi_master_get(platform_get_drvdata(pdev));
+        struct rspi_data *rspi = platform_get_drvdata(pdev);
 
         spi_unregister_master(rspi->master);
         rspi_release_dma(rspi);
         free_irq(platform_get_irq(pdev, 0), rspi);
         clk_put(rspi->clk);
         iounmap(rspi->addr);
-        spi_master_put(rspi->master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 0b71270fbf67..4396bd448540 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -161,7 +161,7 @@ static int ti_qspi_setup(struct spi_device *spi)
                         qspi->spi_max_frequency, clk_div);
 
         ret = pm_runtime_get_sync(qspi->dev);
-        if (ret) {
+        if (ret < 0) {
                 dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
                 return ret;
         }
@@ -459,11 +459,10 @@ static int ti_qspi_probe(struct platform_device *pdev)
         if (!of_property_read_u32(np, "num-cs", &num_cs))
                 master->num_chipselect = num_cs;
 
-        platform_set_drvdata(pdev, master);
-
         qspi = spi_master_get_devdata(master);
         qspi->master = master;
         qspi->dev = &pdev->dev;
+        platform_set_drvdata(pdev, qspi);
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 
@@ -517,10 +516,26 @@ free_master:
 
 static int ti_qspi_remove(struct platform_device *pdev)
 {
-        struct  ti_qspi *qspi = platform_get_drvdata(pdev);
+        struct spi_master *master;
+        struct ti_qspi *qspi;
+        int ret;
+
+        master = platform_get_drvdata(pdev);
+        qspi = spi_master_get_devdata(master);
+
+        ret = pm_runtime_get_sync(qspi->dev);
+        if (ret < 0) {
+                dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
+                return ret;
+        }
 
         ti_qspi_write(qspi, QSPI_WC_INT_DISABLE, QSPI_INTR_ENABLE_CLEAR_REG);
 
+        pm_runtime_put(qspi->dev);
+        pm_runtime_disable(&pdev->dev);
+
+        spi_unregister_master(master);
+
         return 0;
 }
 
diff --git a/drivers/spi/spi-txx9.c b/drivers/spi/spi-txx9.c
index 637cce2b8bdd..18c9bb2b5f39 100644
--- a/drivers/spi/spi-txx9.c
+++ b/drivers/spi/spi-txx9.c
@@ -425,7 +425,7 @@ exit:
 
 static int txx9spi_remove(struct platform_device *dev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(dev));
+        struct spi_master *master = platform_get_drvdata(dev);
         struct txx9spi *c = spi_master_get_devdata(master);
 
         destroy_workqueue(c->workqueue);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 18cc625d887f..349ebba4b199 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1415,7 +1415,7 @@ int devm_spi_register_master(struct device *dev, struct spi_master *master)
                 return -ENOMEM;
 
         ret = spi_register_master(master);
-        if (ret != 0) {
+        if (!ret) {
                 *ptr = master;
                 devres_add(dev, ptr);
         } else {
diff --git a/drivers/staging/btmtk_usb/btmtk_usb.c b/drivers/staging/btmtk_usb/btmtk_usb.c
index 7a9bf3b57810..9a5ebd6cc512 100644
--- a/drivers/staging/btmtk_usb/btmtk_usb.c
+++ b/drivers/staging/btmtk_usb/btmtk_usb.c
@@ -1284,9 +1284,8 @@ done:
         kfree_skb(skb);
 }
 
-static int btmtk_usb_send_frame(struct sk_buff *skb)
+static int btmtk_usb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_dev *hdev = (struct hci_dev *)skb->dev;
         struct btmtk_usb_data *data = hci_get_drvdata(hdev);
         struct usb_ctrlrequest *dr;
         struct urb *urb;
diff --git a/drivers/staging/comedi/drivers/pcl730.c b/drivers/staging/comedi/drivers/pcl730.c
index d041b714db29..2baaf1db6fbf 100644
--- a/drivers/staging/comedi/drivers/pcl730.c
+++ b/drivers/staging/comedi/drivers/pcl730.c
@@ -173,11 +173,11 @@ static int pcl730_do_insn_bits(struct comedi_device *dev,
         if (mask) {
                 if (mask & 0x00ff)
                         outb(s->state & 0xff, dev->iobase + reg);
-                if ((mask & 0xff00) & (s->n_chan > 8))
+                if ((mask & 0xff00) && (s->n_chan > 8))
                         outb((s->state >> 8) & 0xff, dev->iobase + reg + 1);
-                if ((mask & 0xff0000) & (s->n_chan > 16))
+                if ((mask & 0xff0000) && (s->n_chan > 16))
                         outb((s->state >> 16) & 0xff, dev->iobase + reg + 2);
-                if ((mask & 0xff000000) & (s->n_chan > 24))
+                if ((mask & 0xff000000) && (s->n_chan > 24))
                         outb((s->state >> 24) & 0xff, dev->iobase + reg + 3);
         }
 
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
index 6815cfe2664e..b486099b543d 100644
--- a/drivers/staging/comedi/drivers/s626.c
+++ b/drivers/staging/comedi/drivers/s626.c
@@ -494,7 +494,7 @@ static void s626_send_dac(struct comedi_device *dev, uint32_t val)
  * Private helper function: Write setpoint to an application DAC channel.
  */
 static void s626_set_dac(struct comedi_device *dev, uint16_t chan,
-                         unsigned short dacdata)
+                         int16_t dacdata)
 {
         struct s626_private *devpriv = dev->private;
         uint16_t signmask;
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 933b01a0f03d..0adf3cffddb0 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -465,7 +465,7 @@ static int vmk80xx_do_insn_bits(struct comedi_device *dev,
         unsigned char *rx_buf = devpriv->usb_rx_buf;
         unsigned char *tx_buf = devpriv->usb_tx_buf;
         int reg, cmd;
-        int ret;
+        int ret = 0;
 
         if (devpriv->model == VMK8061_MODEL) {
                 reg = VMK8061_DO_REG;
diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_download.c b/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
index 68ded17c0f5c..12f333fa59b5 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
@@ -578,7 +578,7 @@ static int request_code_segment(struct ft1000_usb *ft1000dev, u16 **s_file,
                  u8 **c_file, const u8 *endpoint, bool boot_case)
 {
         long word_length;
-        int status;
+        int status = 0;
 
         /*DEBUG("FT1000:REQUEST_CODE_SEGMENT\n");i*/
         word_length = get_request_value(ft1000dev);
@@ -1074,4 +1074,3 @@ int scram_dnldr(struct ft1000_usb *ft1000dev, void *pFileStart,
 
         return status;
 }
-
diff --git a/drivers/staging/iio/magnetometer/Kconfig b/drivers/staging/iio/magnetometer/Kconfig
index a3ea69e9d800..34634da1f9f7 100644
--- a/drivers/staging/iio/magnetometer/Kconfig
+++ b/drivers/staging/iio/magnetometer/Kconfig
@@ -6,6 +6,8 @@ menu "Magnetometer sensors"
 config SENSORS_HMC5843
         tristate "Honeywell HMC5843/5883/5883L 3-Axis Magnetometer"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say Y here to add support for the Honeywell HMC5843, HMC5883 and
           HMC5883L 3-Axis Magnetometer (digital compass).
diff --git a/drivers/staging/imx-drm/Makefile b/drivers/staging/imx-drm/Makefile
index 2c3a9e178fb5..8742432d7b01 100644
--- a/drivers/staging/imx-drm/Makefile
+++ b/drivers/staging/imx-drm/Makefile
@@ -8,4 +8,6 @@ obj-$(CONFIG_DRM_IMX_TVE) += imx-tve.o
 obj-$(CONFIG_DRM_IMX_LDB) += imx-ldb.o
 obj-$(CONFIG_DRM_IMX_FB_HELPER) += imx-fbdev.o
 obj-$(CONFIG_DRM_IMX_IPUV3_CORE) += ipu-v3/
-obj-$(CONFIG_DRM_IMX_IPUV3)     += ipuv3-crtc.o ipuv3-plane.o
+
+imx-ipuv3-crtc-objs  := ipuv3-crtc.o ipuv3-plane.o
+obj-$(CONFIG_DRM_IMX_IPUV3)     += imx-ipuv3-crtc.o
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 51aa9772f959..6bd015ac9d68 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -72,6 +72,7 @@ int imx_drm_crtc_id(struct imx_drm_crtc *crtc)
 {
         return crtc->pipe;
 }
+EXPORT_SYMBOL_GPL(imx_drm_crtc_id);
 
 static void imx_drm_driver_lastclose(struct drm_device *drm)
 {
diff --git a/drivers/staging/lustre/lustre/ptlrpc/pinger.c b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
index 5dec771d70ee..4d340f4a2198 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/pinger.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
@@ -409,8 +409,8 @@ int ptlrpc_stop_pinger(void)
         struct l_wait_info lwi = { 0 };
         int rc = 0;
 
-        if (!thread_is_init(&pinger_thread) &&
-            !thread_is_stopped(&pinger_thread))
+        if (thread_is_init(&pinger_thread) ||
+            thread_is_stopped(&pinger_thread))
                 return -EALREADY;
 
         ptlrpc_pinger_remove_timeouts();
diff --git a/drivers/staging/media/go7007/go7007-usb.c b/drivers/staging/media/go7007/go7007-usb.c
index 58684da45e6c..b658c2316df3 100644
--- a/drivers/staging/media/go7007/go7007-usb.c
+++ b/drivers/staging/media/go7007/go7007-usb.c
@@ -15,6 +15,8 @@
  * Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -661,7 +663,7 @@ static int go7007_usb_interface_reset(struct go7007 *go)
 
         if (usb->board->flags & GO7007_USB_EZUSB) {
                 /* Reset buffer in EZ-USB */
-                dev_dbg(go->dev, "resetting EZ-USB buffers\n");
+                pr_debug("resetting EZ-USB buffers\n");
                 if (go7007_usb_vendor_request(go, 0x10, 0, 0, NULL, 0, 0) < 0 ||
                     go7007_usb_vendor_request(go, 0x10, 0, 0, NULL, 0, 0) < 0)
                         return -1;
@@ -689,7 +691,7 @@ static int go7007_usb_ezusb_write_interrupt(struct go7007 *go,
         u16 status_reg = 0;
         int timeout = 500;
 
-        dev_dbg(go->dev, "WriteInterrupt: %04x %04x\n", addr, data);
+        pr_debug("WriteInterrupt: %04x %04x\n", addr, data);
 
         for (i = 0; i < 100; ++i) {
                 r = usb_control_msg(usb->usbdev,
@@ -734,7 +736,7 @@ static int go7007_usb_onboard_write_interrupt(struct go7007 *go,
         int r;
         int timeout = 500;
 
-        dev_dbg(go->dev, "WriteInterrupt: %04x %04x\n", addr, data);
+        pr_debug("WriteInterrupt: %04x %04x\n", addr, data);
 
         go->usb_buf[0] = data & 0xff;
         go->usb_buf[1] = data >> 8;
@@ -771,7 +773,7 @@ static void go7007_usb_readinterrupt_complete(struct urb *urb)
                 go->interrupt_available = 1;
                 go->interrupt_data = __le16_to_cpu(regs[0]);
                 go->interrupt_value = __le16_to_cpu(regs[1]);
-                dev_dbg(go->dev, "ReadInterrupt: %04x %04x\n",
+                pr_debug("ReadInterrupt: %04x %04x\n",
                                 go->interrupt_value, go->interrupt_data);
         }
 
@@ -891,7 +893,7 @@ static int go7007_usb_send_firmware(struct go7007 *go, u8 *data, int len)
         int transferred, pipe;
         int timeout = 500;
 
-        dev_dbg(go->dev, "DownloadBuffer sending %d bytes\n", len);
+        pr_debug("DownloadBuffer sending %d bytes\n", len);
 
         if (usb->board->flags & GO7007_USB_EZUSB)
                 pipe = usb_sndbulkpipe(usb->usbdev, 2);
@@ -977,7 +979,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                                 !(msgs[i].flags & I2C_M_RD) &&
                                 (msgs[i + 1].flags & I2C_M_RD)) {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c write/read %d/%d bytes on %02x\n",
+                        pr_debug("i2c write/read %d/%d bytes on %02x\n",
                                 msgs[i].len, msgs[i + 1].len, msgs[i].addr);
 #endif
                         buf[0] = 0x01;
@@ -988,7 +990,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                         buf[buf_len++] = msgs[++i].len;
                 } else if (msgs[i].flags & I2C_M_RD) {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c read %d bytes on %02x\n",
+                        pr_debug("i2c read %d bytes on %02x\n",
                                         msgs[i].len, msgs[i].addr);
 #endif
                         buf[0] = 0x01;
@@ -998,7 +1000,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                         buf_len = 4;
                 } else {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c write %d bytes on %02x\n",
+                        pr_debug("i2c write %d bytes on %02x\n",
                                         msgs[i].len, msgs[i].addr);
 #endif
                         buf[0] = 0x00;
@@ -1057,7 +1059,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
         char *name;
         int video_pipe, i, v_urb_len;
 
-        dev_dbg(go->dev, "probing new GO7007 USB board\n");
+        pr_debug("probing new GO7007 USB board\n");
 
         switch (id->driver_info) {
         case GO7007_BOARDID_MATRIX_II:
@@ -1097,13 +1099,13 @@ static int go7007_usb_probe(struct usb_interface *intf,
                 board = &board_px_tv402u;
                 break;
         case GO7007_BOARDID_LIFEVIEW_LR192:
-                dev_err(go->dev, "The Lifeview TV Walker Ultra is not supported. Sorry!\n");
+                dev_err(&intf->dev, "The Lifeview TV Walker Ultra is not supported. Sorry!\n");
                 return -ENODEV;
                 name = "Lifeview TV Walker Ultra";
                 board = &board_lifeview_lr192;
                 break;
         case GO7007_BOARDID_SENSORAY_2250:
-                dev_info(go->dev, "Sensoray 2250 found\n");
+                dev_info(&intf->dev, "Sensoray 2250 found\n");
                 name = "Sensoray 2250/2251";
                 board = &board_sensoray_2250;
                 break;
@@ -1112,7 +1114,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
                 board = &board_ads_usbav_709;
                 break;
         default:
-                dev_err(go->dev, "unknown board ID %d!\n",
+                dev_err(&intf->dev, "unknown board ID %d!\n",
                                 (unsigned int)id->driver_info);
                 return -ENODEV;
         }
@@ -1247,7 +1249,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
                                         sizeof(go->name));
                         break;
                 default:
-                        dev_dbg(go->dev, "unable to detect tuner type!\n");
+                        pr_debug("unable to detect tuner type!\n");
                         break;
                 }
                 /* Configure tuner mode selection inputs connected
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 3066ee2e753b..49ea76b3435d 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -681,7 +681,8 @@ static irqreturn_t nvec_interrupt(int irq, void *dev)
                         dev_err(nvec->dev,
                                 "RX buffer overflow on %p: "
                                 "Trying to write byte %u of %u\n",
-                                nvec->rx, nvec->rx->pos, NVEC_MSG_SIZE);
+                                nvec->rx, nvec->rx ? nvec->rx->pos : 0,
+                                NVEC_MSG_SIZE);
                 break;
         default:
                 nvec->state = 0;
diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 2c678f409573..2f548ebada59 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -1115,6 +1115,9 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
                         return _FAIL;
         }
 
+        /* fix bug of flush_cam_entry at STOP AP mode */
+        psta->state |= WIFI_AP_STATE;
+        rtw_indicate_connect(padapter);
         pmlmepriv->cur_network.join_res = true;/* for check if already set beacon */
         return ret;
 }
diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig
index 165b918b8171..1b6d581c438b 100644
--- a/drivers/staging/tidspbridge/Kconfig
+++ b/drivers/staging/tidspbridge/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig TIDSPBRIDGE
         tristate "DSP Bridge driver"
-        depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM
+        depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM && BROKEN
         select MAILBOX
         select OMAP2PLUS_MBOX
         help
diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
index aab0012bba92..ab8b2ba6eedd 100644
--- a/drivers/staging/vt6655/hostap.c
+++ b/drivers/staging/vt6655/hostap.c
@@ -143,7 +143,8 @@ static int hostap_disable_hostapd(PSDevice pDevice, int rtnl_locked)
                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n",
                         pDevice->dev->name, pDevice->apdev->name);
         }
-        free_netdev(pDevice->apdev);
+        if (pDevice->apdev)
+                free_netdev(pDevice->apdev);
         pDevice->apdev = NULL;
         pDevice->bEnable8021x = false;
         pDevice->bEnableHostWEP = false;
diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
index 1e8b8412e67e..4aa5ef54b683 100644
--- a/drivers/staging/vt6656/baseband.c
+++ b/drivers/staging/vt6656/baseband.c
@@ -939,6 +939,7 @@ int BBbVT3184Init(struct vnt_private *pDevice)
     u8 *                   pbyAgc;
     u16                    wLengthAgc;
     u8                    abyArray[256];
+        u8 data;
 
     ntStatus = CONTROLnsRequestIn(pDevice,
                                   MESSAGE_TYPE_READ,
@@ -1104,6 +1105,16 @@ else {
     ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01);
 
     RFbRFTableDownload(pDevice);
+
+        /* Fix for TX USB resets from vendors driver */
+        CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4,
+                MESSAGE_REQUEST_MEM, sizeof(data), &data);
+
+        data |= 0x2;
+
+        CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4,
+                MESSAGE_REQUEST_MEM, sizeof(data), &data);
+
     return true;//ntStatus;
 }
 
diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
index ae1676d190c5..67ba48b9a8d9 100644
--- a/drivers/staging/vt6656/hostap.c
+++ b/drivers/staging/vt6656/hostap.c
@@ -133,7 +133,8 @@ static int hostap_disable_hostapd(struct vnt_private *pDevice, int rtnl_locked)
             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n",
                        pDevice->dev->name, pDevice->apdev->name);
         }
-        free_netdev(pDevice->apdev);
+        if (pDevice->apdev)
+                free_netdev(pDevice->apdev);
         pDevice->apdev = NULL;
     pDevice->bEnable8021x = false;
     pDevice->bEnableHostWEP = false;
diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h
index 5e073062017a..5cf5e732a36f 100644
--- a/drivers/staging/vt6656/rndis.h
+++ b/drivers/staging/vt6656/rndis.h
@@ -66,6 +66,8 @@
 
 #define VIAUSB20_PACKET_HEADER          0x04
 
+#define USB_REG4        0x604
+
 typedef struct _CMD_MESSAGE
 {
     u8        byData[256];
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 79ce363b2ea9..3277d9838f4e 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -652,21 +652,30 @@ static ssize_t reset_store(struct device *dev,
                 return -ENOMEM;
 
         /* Do not reset an active device! */
-        if (bdev->bd_holders)
-                return -EBUSY;
+        if (bdev->bd_holders) {
+                ret = -EBUSY;
+                goto out;
+        }
 
         ret = kstrtou16(buf, 10, &do_reset);
         if (ret)
-                return ret;
+                goto out;
 
-        if (!do_reset)
-                return -EINVAL;
+        if (!do_reset) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         /* Make sure all pending I/O is finished */
         fsync_bdev(bdev);
+        bdput(bdev);
 
         zram_reset_device(zram, true);
         return len;
+
+out:
+        bdput(bdev);
+        return ret;
 }
 
 static void __zram_make_request(struct zram *zram, struct bio *bio, int rw)
diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
index 1a67537dbc56..3b950e5a918f 100644
--- a/drivers/staging/zsmalloc/zsmalloc-main.c
+++ b/drivers/staging/zsmalloc/zsmalloc-main.c
@@ -430,7 +430,12 @@ static struct page *get_next_page(struct page *page)
         return next;
 }
 
-/* Encode <page, obj_idx> as a single handle value */
+/*
+ * Encode <page, obj_idx> as a single handle value.
+ * On hardware platforms with physical memory starting at 0x0 the pfn
+ * could be 0 so we ensure that the handle will never be 0 by adjusting the
+ * encoded obj_idx value before encoding.
+ */
 static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
 {
         unsigned long handle;
@@ -441,17 +446,21 @@ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
         }
 
         handle = page_to_pfn(page) << OBJ_INDEX_BITS;
-        handle |= (obj_idx & OBJ_INDEX_MASK);
+        handle |= ((obj_idx + 1) & OBJ_INDEX_MASK);
 
         return (void *)handle;
 }
 
-/* Decode <page, obj_idx> pair from the given object handle */
+/*
+ * Decode <page, obj_idx> pair from the given object handle. We adjust the
+ * decoded obj_idx back to its original value since it was adjusted in
+ * obj_location_to_handle().
+ */
 static void obj_handle_to_location(unsigned long handle, struct page **page,
                                 unsigned long *obj_idx)
 {
         *page = pfn_to_page(handle >> OBJ_INDEX_BITS);
-        *obj_idx = handle & OBJ_INDEX_MASK;
+        *obj_idx = (handle & OBJ_INDEX_MASK) - 1;
 }
 
 static unsigned long obj_idx_to_offset(struct page *page,
diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
index 2b86f8e0fb58..71630a2af42c 100644
--- a/drivers/tty/amiserial.c
+++ b/drivers/tty/amiserial.c
@@ -1855,6 +1855,9 @@ static struct console sercons = {
  */
 static int __init amiserial_console_init(void)
 {
+        if (!MACH_IS_AMIGA)
+                return -ENODEV;
+
         register_console(&sercons);
         return 0;
 }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 7cdd1eb9406c..0f74945af624 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -768,7 +768,7 @@ static size_t __process_echoes(struct tty_struct *tty)
          * data at the tail to prevent a subsequent overrun */
         while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
                 if (echo_buf(ldata, tail) == ECHO_OP_START) {
-                        if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
+                        if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
                                 tail += 3;
                         else
                                 tail += 2;
@@ -1998,7 +1998,10 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
                 found = 1;
 
         size = N_TTY_BUF_SIZE - tail;
-        n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
+        n = eol - tail;
+        if (n > 4096)
+                n += 4096;
+        n += found;
         c = n;
 
         if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
@@ -2243,18 +2246,19 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                 if (time)
                         timeout = time;
         }
-        mutex_unlock(&ldata->atomic_read_lock);
-        remove_wait_queue(&tty->read_wait, &wait);
+        n_tty_set_room(tty);
+        up_read(&tty->termios_rwsem);
 
+        remove_wait_queue(&tty->read_wait, &wait);
         if (!waitqueue_active(&tty->read_wait))
                 ldata->minimum_to_wake = minimum;
 
+        mutex_unlock(&ldata->atomic_read_lock);
+
         __set_current_state(TASK_RUNNING);
         if (b - buf)
                 retval = b - buf;
 
-        n_tty_set_room(tty);
-        up_read(&tty->termios_rwsem);
         return retval;
 }
 
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index f3b306efaa59..23329918f229 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -41,7 +41,7 @@ config SERIAL_8250_DEPRECATED_OPTIONS
           accept kernel parameters in both forms like 8250_core.nr_uarts=4 and
           8250.nr_uarts=4. We now renamed the module back to 8250, but if
           anybody noticed in 3.7 and changed their userspace we still have to
-          keep the 8350_core.* options around until they revert the changes
+          keep the 8250_core.* options around until they revert the changes
           they already did.
 
           If 8250 is built as a module, this adds 8250_core alias instead. 
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index 481b781b26e3..e9d420ff3931 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -2052,6 +2052,9 @@ static int __init pmz_console_init(void)
         /* Probe ports */
         pmz_probe();
 
+        if (pmz_ports_count == 0)
+                return -ENODEV;
+
         /* TODO: Autoprobe console based on OF */
         /* pmz_console.index = i; */
         register_console(&pmz_console);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 3a1a01af9a80..c74a00ad7add 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2086,6 +2086,7 @@ retry_open:
                         filp->f_op = &tty_fops;
                 goto retry_open;
         }
+        clear_bit(TTY_HUPPED, &tty->flags);
         tty_unlock(tty);
 
 
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 67beb8444930..f7beb6eb40c7 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -653,6 +653,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
                 return -EINVAL;
         mem = idev->info->mem + mi;
 
+        if (mem->addr & ~PAGE_MASK)
+                return -ENODEV;
         if (vma->vm_end - vma->vm_start > mem->size)
                 return -EINVAL;
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 62ccf5424ba8..028387192b60 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -930,9 +930,10 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                 ret = m2p_add_override(mfn, pages[i], kmap_ops ?
                                        &kmap_ops[i] : NULL);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
+ out:
         if (lazy)
                 arch_leave_lazy_mmu_mode();
 
@@ -969,9 +970,10 @@ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
                 ret = m2p_remove_override(pages[i], kmap_ops ?
                                        &kmap_ops[i] : NULL);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
+ out:
         if (lazy)
                 arch_leave_lazy_mmu_mode();
 
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index a224bc74b6b9..1eac0731c349 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -555,6 +555,11 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
                                 sg_dma_len(sgl) = 0;
                                 return 0;
                         }
+                        xen_dma_map_page(hwdev, pfn_to_page(map >> PAGE_SHIFT),
+                                                map & ~PAGE_MASK,
+                                                sg->length,
+                                                dir,
+                                                attrs);
                         sg->dma_address = xen_phys_to_bus(map);
                 } else {
                         /* we are not interested in the dma_addr returned by
diff --git a/fs/affs/Changes b/fs/affs/Changes
index a29409c1ffe0..b41c2c9792ff 100644
--- a/fs/affs/Changes
+++ b/fs/affs/Changes
@@ -91,7 +91,7 @@ more 2.4 fixes: [Roman Zippel]
 Version 3.11
 ------------
 
-- Converted to use 2.3.x page cache [Dave Jones <dave@powertweak.com>]
+- Converted to use 2.3.x page cache [Dave Jones]
 - Corruption in truncate() bugfix [Ken Tyler <kent@werple.net.au>]
 
 Version 3.10
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index d9ea7ada1378..f918a998a087 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -384,6 +384,7 @@ struct smb_version_operations {
         int (*clone_range)(const unsigned int, struct cifsFileInfo *src_file,
                         struct cifsFileInfo *target_file, u64 src_off, u64 len,
                         u64 dest_off);
+        int (*validate_negotiate)(const unsigned int, struct cifs_tcon *);
 };
 
 struct smb_version_values {
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 409b45eefe70..77492301cc2b 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -26,13 +26,15 @@
 #include <linux/mount.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
-#include <linux/btrfs.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
 #include "cifsfs.h"
 
+#define CIFS_IOCTL_MAGIC        0xCF
+#define CIFS_IOC_COPYCHUNK_FILE _IOW(CIFS_IOCTL_MAGIC, 3, int)
+
 static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
                         unsigned long srcfd, u64 off, u64 len, u64 destoff)
 {
@@ -213,7 +215,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
                                 cifs_dbg(FYI, "set compress flag rc %d\n", rc);
                         }
                         break;
-                case BTRFS_IOC_CLONE:
+                case CIFS_IOC_COPYCHUNK_FILE:
                         rc = cifs_ioctl_clone(xid, filep, arg, 0, 0, 0);
                         break;
                 default:
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 11dde4b24f8a..757da3e54d3d 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -532,7 +532,10 @@ smb2_clone_range(const unsigned int xid,
         int rc;
         unsigned int ret_data_len;
         struct copychunk_ioctl *pcchunk;
-        char *retbuf = NULL;
+        struct copychunk_ioctl_rsp *retbuf = NULL;
+        struct cifs_tcon *tcon;
+        int chunks_copied = 0;
+        bool chunk_sizes_updated = false;
 
         pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL);
 
@@ -547,27 +550,96 @@ smb2_clone_range(const unsigned int xid,
 
         /* Note: request_res_key sets res_key null only if rc !=0 */
         if (rc)
-                return rc;
+                goto cchunk_out;
 
         /* For now array only one chunk long, will make more flexible later */
         pcchunk->ChunkCount = __constant_cpu_to_le32(1);
         pcchunk->Reserved = 0;
-        pcchunk->SourceOffset = cpu_to_le64(src_off);
-        pcchunk->TargetOffset = cpu_to_le64(dest_off);
-        pcchunk->Length = cpu_to_le32(len);
         pcchunk->Reserved2 = 0;
 
-        /* Request that server copy to target from src file identified by key */
-        rc = SMB2_ioctl(xid, tlink_tcon(trgtfile->tlink),
-                        trgtfile->fid.persistent_fid,
-                        trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
-                        true /* is_fsctl */, (char *)pcchunk,
-                        sizeof(struct copychunk_ioctl), &retbuf, &ret_data_len);
+        tcon = tlink_tcon(trgtfile->tlink);
 
-        /* BB need to special case rc = EINVAL to alter chunk size */
+        while (len > 0) {
+                pcchunk->SourceOffset = cpu_to_le64(src_off);
+                pcchunk->TargetOffset = cpu_to_le64(dest_off);
+                pcchunk->Length =
+                        cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk));
 
-        cifs_dbg(FYI, "rc %d data length out %d\n", rc, ret_data_len);
+                /* Request server copy to target from src identified by key */
+                rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
+                        trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
+                        true /* is_fsctl */, (char *)pcchunk,
+                        sizeof(struct copychunk_ioctl), (char **)&retbuf,
+                        &ret_data_len);
+                if (rc == 0) {
+                        if (ret_data_len !=
+                                        sizeof(struct copychunk_ioctl_rsp)) {
+                                cifs_dbg(VFS, "invalid cchunk response size\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        if (retbuf->TotalBytesWritten == 0) {
+                                cifs_dbg(FYI, "no bytes copied\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        /*
+                         * Check if server claimed to write more than we asked
+                         */
+                        if (le32_to_cpu(retbuf->TotalBytesWritten) >
+                            le32_to_cpu(pcchunk->Length)) {
+                                cifs_dbg(VFS, "invalid copy chunk response\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        if (le32_to_cpu(retbuf->ChunksWritten) != 1) {
+                                cifs_dbg(VFS, "invalid num chunks written\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        chunks_copied++;
+
+                        src_off += le32_to_cpu(retbuf->TotalBytesWritten);
+                        dest_off += le32_to_cpu(retbuf->TotalBytesWritten);
+                        len -= le32_to_cpu(retbuf->TotalBytesWritten);
+
+                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %d\n",
+                                le32_to_cpu(retbuf->ChunksWritten),
+                                le32_to_cpu(retbuf->ChunkBytesWritten),
+                                le32_to_cpu(retbuf->TotalBytesWritten));
+                } else if (rc == -EINVAL) {
+                        if (ret_data_len != sizeof(struct copychunk_ioctl_rsp))
+                                goto cchunk_out;
+
+                        cifs_dbg(FYI, "MaxChunks %d BytesChunk %d MaxCopy %d\n",
+                                le32_to_cpu(retbuf->ChunksWritten),
+                                le32_to_cpu(retbuf->ChunkBytesWritten),
+                                le32_to_cpu(retbuf->TotalBytesWritten));
+
+                        /*
+                         * Check if this is the first request using these sizes,
+                         * (ie check if copy succeed once with original sizes
+                         * and check if the server gave us different sizes after
+                         * we already updated max sizes on previous request).
+                         * if not then why is the server returning an error now
+                         */
+                        if ((chunks_copied != 0) || chunk_sizes_updated)
+                                goto cchunk_out;
+
+                        /* Check that server is not asking us to grow size */
+                        if (le32_to_cpu(retbuf->ChunkBytesWritten) <
+                                        tcon->max_bytes_chunk)
+                                tcon->max_bytes_chunk =
+                                        le32_to_cpu(retbuf->ChunkBytesWritten);
+                        else
+                                goto cchunk_out; /* server gave us bogus size */
+
+                        /* No need to change MaxChunks since already set to 1 */
+                        chunk_sizes_updated = true;
+                }
+        }
 
+cchunk_out:
         kfree(pcchunk);
         return rc;
 }
@@ -1247,6 +1319,7 @@ struct smb_version_operations smb30_operations = {
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
         .clone_range = smb2_clone_range,
+        .validate_negotiate = smb3_validate_negotiate,
 };
 
 struct smb_version_values smb20_values = {
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index d65270c290a1..2013234b73ad 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -454,6 +454,81 @@ neg_exit:
         return rc;
 }
 
+int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
+{
+        int rc = 0;
+        struct validate_negotiate_info_req vneg_inbuf;
+        struct validate_negotiate_info_rsp *pneg_rsp;
+        u32 rsplen;
+
+        cifs_dbg(FYI, "validate negotiate\n");
+
+        /*
+         * validation ioctl must be signed, so no point sending this if we
+         * can not sign it.  We could eventually change this to selectively
+         * sign just this, the first and only signed request on a connection.
+         * This is good enough for now since a user who wants better security
+         * would also enable signing on the mount. Having validation of
+         * negotiate info for signed connections helps reduce attack vectors
+         */
+        if (tcon->ses->server->sign == false)
+                return 0; /* validation requires signing */
+
+        vneg_inbuf.Capabilities =
+                        cpu_to_le32(tcon->ses->server->vals->req_capabilities);
+        memcpy(vneg_inbuf.Guid, cifs_client_guid, SMB2_CLIENT_GUID_SIZE);
+
+        if (tcon->ses->sign)
+                vneg_inbuf.SecurityMode =
+                        cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
+        else if (global_secflags & CIFSSEC_MAY_SIGN)
+                vneg_inbuf.SecurityMode =
+                        cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
+        else
+                vneg_inbuf.SecurityMode = 0;
+
+        vneg_inbuf.DialectCount = cpu_to_le16(1);
+        vneg_inbuf.Dialects[0] =
+                cpu_to_le16(tcon->ses->server->vals->protocol_id);
+
+        rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
+                FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
+                (char *)&vneg_inbuf, sizeof(struct validate_negotiate_info_req),
+                (char **)&pneg_rsp, &rsplen);
+
+        if (rc != 0) {
+                cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);
+                return -EIO;
+        }
+
+        if (rsplen != sizeof(struct validate_negotiate_info_rsp)) {
+                cifs_dbg(VFS, "invalid size of protocol negotiate response\n");
+                return -EIO;
+        }
+
+        /* check validate negotiate info response matches what we got earlier */
+        if (pneg_rsp->Dialect !=
+                        cpu_to_le16(tcon->ses->server->vals->protocol_id))
+                goto vneg_out;
+
+        if (pneg_rsp->SecurityMode != cpu_to_le16(tcon->ses->server->sec_mode))
+                goto vneg_out;
+
+        /* do not validate server guid because not saved at negprot time yet */
+
+        if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND |
+              SMB2_LARGE_FILES) != tcon->ses->server->capabilities)
+                goto vneg_out;
+
+        /* validate negotiate successful */
+        cifs_dbg(FYI, "validate negotiate info successful\n");
+        return 0;
+
+vneg_out:
+        cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n");
+        return -EIO;
+}
+
 int
 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
                 const struct nls_table *nls_cp)
@@ -829,6 +904,8 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
             ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
                 cifs_dbg(VFS, "DFS capability contradicts DFS flag\n");
         init_copy_chunk_defaults(tcon);
+        if (tcon->ses->server->ops->validate_negotiate)
+                rc = tcon->ses->server->ops->validate_negotiate(xid, tcon);
 tcon_exit:
         free_rsp_buf(resp_buftype, rsp);
         kfree(unc_path);
@@ -1214,10 +1291,17 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
         rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base;
 
-        if (rc != 0) {
+        if ((rc != 0) && (rc != -EINVAL)) {
                 if (tcon)
                         cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
                 goto ioctl_exit;
+        } else if (rc == -EINVAL) {
+                if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
+                    (opcode != FSCTL_SRV_COPYCHUNK)) {
+                        if (tcon)
+                                cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
+                        goto ioctl_exit;
+                }
         }
 
         /* check if caller wants to look at return data or just return rc */
@@ -2154,11 +2238,9 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SendReceive2(xid, ses, iov, num, &resp_buftype, 0);
         rsp = (struct smb2_set_info_rsp *)iov[0].iov_base;
 
-        if (rc != 0) {
+        if (rc != 0)
                 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
-                goto out;
-        }
-out:
+
         free_rsp_buf(resp_buftype, rsp);
         kfree(iov);
         return rc;
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index f88320bbb477..2022c542ea3a 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -577,13 +577,19 @@ struct copychunk_ioctl_rsp {
         __le32 TotalBytesWritten;
 } __packed;
 
-/* Response and Request are the same format */
-struct validate_negotiate_info {
+struct validate_negotiate_info_req {
         __le32 Capabilities;
         __u8   Guid[SMB2_CLIENT_GUID_SIZE];
         __le16 SecurityMode;
         __le16 DialectCount;
-        __le16 Dialect[1];
+        __le16 Dialects[1]; /* dialect (someday maybe list) client asked for */
+} __packed;
+
+struct validate_negotiate_info_rsp {
+        __le32 Capabilities;
+        __u8   Guid[SMB2_CLIENT_GUID_SIZE];
+        __le16 SecurityMode;
+        __le16 Dialect; /* Dialect in use for the connection */
 } __packed;
 
 #define RSS_CAPABLE     0x00000001
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index b4eea105b08c..93adc64666f3 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -162,5 +162,6 @@ extern int smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
                       struct smb2_lock_element *buf);
 extern int SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
                             __u8 *lease_key, const __le32 lease_state);
+extern int smb3_validate_negotiate(const unsigned int, struct cifs_tcon *);
 
 #endif                  /* _SMB2PROTO_H */
diff --git a/fs/cifs/smbfsctl.h b/fs/cifs/smbfsctl.h
index a4b2391fe66e..0e538b5c9622 100644
--- a/fs/cifs/smbfsctl.h
+++ b/fs/cifs/smbfsctl.h
@@ -90,7 +90,7 @@
 #define FSCTL_LMR_REQUEST_RESILIENCY 0x001401D4 /* BB add struct */
 #define FSCTL_LMR_GET_LINK_TRACK_INF 0x001400E8 /* BB add struct */
 #define FSCTL_LMR_SET_LINK_TRACK_INF 0x001400EC /* BB add struct */
-#define FSCTL_VALIDATE_NEGOTIATE_INFO 0x00140204 /* BB add struct */
+#define FSCTL_VALIDATE_NEGOTIATE_INFO 0x00140204
 /* Perform server-side data movement */
 #define FSCTL_SRV_COPYCHUNK 0x001440F2
 #define FSCTL_SRV_COPYCHUNK_WRITE 0x001480F2
diff --git a/fs/namei.c b/fs/namei.c
index 8f77a8cea289..c53d3a9547f9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -513,8 +513,7 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
 
         if (!lockref_get_not_dead(&parent->d_lockref)) {
                 nd->path.dentry = NULL; 
-                rcu_read_unlock();
-                return -ECHILD;
+                goto out;
         }
 
         /*
diff --git a/fs/pipe.c b/fs/pipe.c
index d2c45e14e6d8..0e0752ef2715 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -726,11 +726,25 @@ pipe_poll(struct file *filp, poll_table *wait)
         return mask;
 }
 
+static void put_pipe_info(struct inode *inode, struct pipe_inode_info *pipe)
+{
+        int kill = 0;
+
+        spin_lock(&inode->i_lock);
+        if (!--pipe->files) {
+                inode->i_pipe = NULL;
+                kill = 1;
+        }
+        spin_unlock(&inode->i_lock);
+
+        if (kill)
+                free_pipe_info(pipe);
+}
+
 static int
 pipe_release(struct inode *inode, struct file *file)
 {
-        struct pipe_inode_info *pipe = inode->i_pipe;
-        int kill = 0;
+        struct pipe_inode_info *pipe = file->private_data;
 
         __pipe_lock(pipe);
         if (file->f_mode & FMODE_READ)
@@ -743,17 +757,9 @@ pipe_release(struct inode *inode, struct file *file)
                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
                 kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
-        spin_lock(&inode->i_lock);
-        if (!--pipe->files) {
-                inode->i_pipe = NULL;
-                kill = 1;
-        }
-        spin_unlock(&inode->i_lock);
         __pipe_unlock(pipe);
 
-        if (kill)
-                free_pipe_info(pipe);
-
+        put_pipe_info(inode, pipe);
         return 0;
 }
 
@@ -1014,7 +1020,6 @@ static int fifo_open(struct inode *inode, struct file *filp)
 {
         struct pipe_inode_info *pipe;
         bool is_pipe = inode->i_sb->s_magic == PIPEFS_MAGIC;
-        int kill = 0;
         int ret;
 
         filp->f_version = 0;
@@ -1130,15 +1135,9 @@ err_wr:
         goto err;
 
 err:
-        spin_lock(&inode->i_lock);
-        if (!--pipe->files) {
-                inode->i_pipe = NULL;
-                kill = 1;
-        }
-        spin_unlock(&inode->i_lock);
         __pipe_unlock(pipe);
-        if (kill)
-                free_pipe_info(pipe);
+
+        put_pipe_info(inode, pipe);
         return ret;
 }
 
diff --git a/fs/squashfs/file_direct.c b/fs/squashfs/file_direct.c
index 2943b2bfae48..62a0de6632e1 100644
--- a/fs/squashfs/file_direct.c
+++ b/fs/squashfs/file_direct.c
@@ -84,6 +84,9 @@ int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
                  */
                 res = squashfs_read_cache(target_page, block, bsize, pages,
                                                                 page);
+                if (res < 0)
+                        goto mark_errored;
+
                 goto out;
         }
 
@@ -119,7 +122,7 @@ mark_errored:
          * dealt with by the caller
          */
         for (i = 0; i < pages; i++) {
-                if (page[i] == target_page)
+                if (page[i] == NULL || page[i] == target_page)
                         continue;
                 flush_dcache_page(page[i]);
                 SetPageError(page[i]);
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 79b5da2acbe1..b94f93685093 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -609,7 +609,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
         struct sysfs_open_file *of;
-        bool has_read, has_write;
+        bool has_read, has_write, has_mmap;
         int error = -EACCES;
 
         /* need attr_sd for attr and ops, its parent for kobj */
@@ -621,6 +621,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = battr->read || battr->mmap;
                 has_write = battr->write || battr->mmap;
+                has_mmap = battr->mmap;
         } else {
                 const struct sysfs_ops *ops = sysfs_file_ops(attr_sd);
 
@@ -632,6 +633,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = ops->show;
                 has_write = ops->store;
+                has_mmap = false;
         }
 
         /* check perms and supported operations */
@@ -649,7 +651,23 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         if (!of)
                 goto err_out;
 
-        mutex_init(&of->mutex);
+        /*
+         * The following is done to give a different lockdep key to
+         * @of->mutex for files which implement mmap.  This is a rather
+         * crude way to avoid false positive lockdep warning around
+         * mm->mmap_sem - mmap nests @of->mutex under mm->mmap_sem and
+         * reading /sys/block/sda/trace/act_mask grabs sr_mutex, under
+         * which mm->mmap_sem nests, while holding @of->mutex.  As each
+         * open file has a separate mutex, it's okay as long as those don't
+         * happen on the same file.  At this point, we can't easily give
+         * each file a separate locking class.  Let's differentiate on
+         * whether the file has mmap or not for now.
+         */
+        if (has_mmap)
+                mutex_init(&of->mutex);
+        else
+                mutex_init(&of->mutex);
+
         of->sd = attr_sd;
         of->file = file;
 
diff --git a/include/acpi/acconfig.h b/include/acpi/acconfig.h
index d98c67001840..3ea214cff349 100644
--- a/include/acpi/acconfig.h
+++ b/include/acpi/acconfig.h
@@ -83,7 +83,9 @@
  * Should the subsystem abort the loading of an ACPI table if the
  * table checksum is incorrect?
  */
+#ifndef ACPI_CHECKSUM_ABORT
 #define ACPI_CHECKSUM_ABORT             FALSE
+#endif
 
 /*
  * Generate a version of ACPICA that only supports "reduced hardware"
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 7b2de026a4f3..c602c7718421 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -100,6 +100,7 @@ enum acpi_hotplug_mode {
 struct acpi_hotplug_profile {
         struct kobject kobj;
         bool enabled:1;
+        bool ignore:1;
         enum acpi_hotplug_mode mode;
 };
 
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index d8f9457755b4..4278aba96503 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -46,7 +46,7 @@
 
 /* Current ACPICA subsystem version in YYYYMMDD format */
 
-#define ACPI_CA_VERSION                 0x20130927
+#define ACPI_CA_VERSION                 0x20131115
 
 #include <acpi/acconfig.h>
 #include <acpi/actypes.h>
diff --git a/include/crypto/scatterwalk.h b/include/crypto/scatterwalk.h
index 13621cc8cf4c..64ebede184f1 100644
--- a/include/crypto/scatterwalk.h
+++ b/include/crypto/scatterwalk.h
@@ -36,6 +36,7 @@ static inline void scatterwalk_sg_chain(struct scatterlist *sg1, int num,
 {
         sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0);
         sg1[num - 1].page_link &= ~0x02;
+        sg1[num - 1].page_link |= 0x01;
 }
 
 static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 9abbe630c456..8c9b7a1c4138 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -248,6 +248,9 @@ struct ftrace_event_call {
 #ifdef CONFIG_PERF_EVENTS
         int                             perf_refcount;
         struct hlist_head __percpu      *perf_events;
+
+        int     (*perf_perm)(struct ftrace_event_call *,
+                             struct perf_event *);
 #endif
 };
 
@@ -317,6 +320,19 @@ struct ftrace_event_file {
         }                                                               \
         early_initcall(trace_init_flags_##name);
 
+#define __TRACE_EVENT_PERF_PERM(name, expr...)                          \
+        static int perf_perm_##name(struct ftrace_event_call *tp_event, \
+                                    struct perf_event *p_event)         \
+        {                                                               \
+                return ({ expr; });                                     \
+        }                                                               \
+        static int __init trace_init_perf_perm_##name(void)             \
+        {                                                               \
+                event_##name.perf_perm = &perf_perm_##name;             \
+                return 0;                                               \
+        }                                                               \
+        early_initcall(trace_init_perf_perm_##name);
+
 #define PERF_MAX_TRACE_SIZE     2048
 
 #define MAX_FILTER_STR_VAL      256     /* Should handle KSYM_SYMBOL_LEN */
diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index 656a27efb2c8..3ea2cf6b0e6c 100644
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -2,9 +2,12 @@
 #define __LINUX_GPIO_DRIVER_H
 
 #include <linux/types.h>
+#include <linux/module.h>
 
 struct device;
 struct gpio_desc;
+struct of_phandle_args;
+struct device_node;
 struct seq_file;
 
 /**
@@ -125,6 +128,13 @@ extern struct gpio_chip *gpiochip_find(void *data,
 int gpiod_lock_as_irq(struct gpio_desc *desc);
 void gpiod_unlock_as_irq(struct gpio_desc *desc);
 
+enum gpio_lookup_flags {
+        GPIO_ACTIVE_HIGH = (0 << 0),
+        GPIO_ACTIVE_LOW = (1 << 0),
+        GPIO_OPEN_DRAIN = (1 << 1),
+        GPIO_OPEN_SOURCE = (1 << 2),
+};
+
 /**
  * Lookup table for associating GPIOs to specific devices and functions using
  * platform data.
@@ -152,9 +162,9 @@ struct gpiod_lookup {
          */
         unsigned int idx;
         /*
-         * mask of GPIOF_* values
+         * mask of GPIO_* values
          */
-        unsigned long flags;
+        enum gpio_lookup_flags flags;
 };
 
 /*
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index a265af294ea4..206a2af6b62b 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -21,6 +21,8 @@
 
 #include <linux/hid.h>
 #include <linux/hid-sensor-ids.h>
+#include <linux/iio/iio.h>
+#include <linux/iio/trigger.h>
 
 /**
  * struct hid_sensor_hub_attribute_info - Attribute info
@@ -184,6 +186,7 @@ struct hid_sensor_common {
         struct platform_device *pdev;
         unsigned usage_id;
         bool data_ready;
+        struct iio_trigger *trigger;
         struct hid_sensor_hub_attribute_info poll;
         struct hid_sensor_hub_attribute_info report_state;
         struct hid_sensor_hub_attribute_info power_state;
diff --git a/include/linux/irqreturn.h b/include/linux/irqreturn.h
index 714ba08dc092..e374e369fb2f 100644
--- a/include/linux/irqreturn.h
+++ b/include/linux/irqreturn.h
@@ -14,6 +14,6 @@ enum irqreturn {
 };
 
 typedef enum irqreturn irqreturn_t;
-#define IRQ_RETVAL(x)   ((x) != IRQ_NONE)
+#define IRQ_RETVAL(x)   ((x) ? IRQ_HANDLED : IRQ_NONE)
 
 #endif
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 7e35d4b9e14a..768b037dfacb 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -831,8 +831,6 @@ struct sched_domain {
         unsigned int balance_interval;  /* initialise to 1. units in ms. */
         unsigned int nr_balance_failed; /* initialise to 0 */
 
-        u64 last_update;
-
         /* idle_balance() stats */
         u64 max_newidle_lb_cost;
         unsigned long next_decay_max_lb_cost;
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index ebeab360d851..f16dc0a40049 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -267,6 +267,8 @@ static inline void tracepoint_synchronize_unregister(void)
 
 #define TRACE_EVENT_FLAGS(event, flag)
 
+#define TRACE_EVENT_PERF_PERM(event, expr...)
+
 #endif /* DECLARE_TRACE */
 
 #ifndef TRACE_EVENT
@@ -399,4 +401,6 @@ static inline void tracepoint_synchronize_unregister(void)
 
 #define TRACE_EVENT_FLAGS(event, flag)
 
+#define TRACE_EVENT_PERF_PERM(event, expr...)
+
 #endif /* ifdef TRACE_EVENT (see note above) */
diff --git a/include/net/ip.h b/include/net/ip.h
index 217bc5bfc6c6..5a25f36fe3a7 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -473,7 +473,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
 int ip_ra_control(struct sock *sk, unsigned char on,
                   void (*destructor)(struct sock *));
 
-int ip_recv_error(struct sock *sk, struct msghdr *msg, int len);
+int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len);
 void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
                    u32 info, u8 *payload);
 void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 2a5f668cd683..eb198acaac1d 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -776,8 +776,10 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len);
 
-int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len);
-int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len);
+int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+                    int *addr_len);
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
+                     int *addr_len);
 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
                      u32 info, u8 *payload);
 void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info);
diff --git a/include/net/ping.h b/include/net/ping.h
index 3f67704f3747..90f48417b03d 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -31,7 +31,8 @@
 
 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
 struct pingv6_ops {
-        int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len);
+        int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len,
+                               int *addr_len);
         int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg,
                                      struct sk_buff *skb);
         int (*icmpv6_err_convert)(u8 type, u8 code, int *err);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 2174d8da0770..ea0ca5f6e629 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -629,6 +629,7 @@ struct sctp_chunk {
 #define SCTP_NEED_FRTX 0x1
 #define SCTP_DONT_FRTX 0x2
         __u16   rtt_in_progress:1,      /* This chunk used for RTT calc? */
+                resent:1,               /* Has this chunk ever been resent. */
                 has_tsn:1,              /* Does this chunk have a TSN yet? */
                 has_ssn:1,              /* Does this chunk have a SSN yet? */
                 singleton:1,            /* Only chunk in the packet? */
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index d17a35c6537e..5c38606613d8 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -90,6 +90,10 @@
 #define TRACE_EVENT_FLAGS(name, value)                                  \
         __TRACE_EVENT_FLAGS(name, value)
 
+#undef TRACE_EVENT_PERF_PERM
+#define TRACE_EVENT_PERF_PERM(name, expr...)                            \
+        __TRACE_EVENT_PERF_PERM(name, expr)
+
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
 
 
@@ -140,6 +144,9 @@
 #undef TRACE_EVENT_FLAGS
 #define TRACE_EVENT_FLAGS(event, flag)
 
+#undef TRACE_EVENT_PERF_PERM
+#define TRACE_EVENT_PERF_PERM(event, expr...)
+
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
 
 /*
diff --git a/include/uapi/linux/genetlink.h b/include/uapi/linux/genetlink.h
index 1af72d8228e0..c3363ba1ae05 100644
--- a/include/uapi/linux/genetlink.h
+++ b/include/uapi/linux/genetlink.h
@@ -28,6 +28,7 @@ struct genlmsghdr {
 #define GENL_ID_GENERATE        0
 #define GENL_ID_CTRL            NLMSG_MIN_TYPE
 #define GENL_ID_VFS_DQUOT       (NLMSG_MIN_TYPE + 1)
+#define GENL_ID_PMCRAID         (NLMSG_MIN_TYPE + 2)
 
 /**************************************************************************
  * Controller
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index b78566f59aba..6db460121f84 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -488,7 +488,9 @@ enum {
         IFLA_HSR_UNSPEC,
         IFLA_HSR_SLAVE1,
         IFLA_HSR_SLAVE2,
-        IFLA_HSR_MULTICAST_SPEC,
+        IFLA_HSR_MULTICAST_SPEC,        /* Last byte of supervision addr */
+        IFLA_HSR_SUPERVISION_ADDR,      /* Supervision frame multicast addr */
+        IFLA_HSR_SEQ_NR,
         __IFLA_HSR_MAX,
 };
 
diff --git a/include/uapi/linux/netlink_diag.h b/include/uapi/linux/netlink_diag.h
index 4e31db4eea41..f2159d30d1f5 100644
--- a/include/uapi/linux/netlink_diag.h
+++ b/include/uapi/linux/netlink_diag.h
@@ -33,6 +33,7 @@ struct netlink_diag_ring {
 };
 
 enum {
+        /* NETLINK_DIAG_NONE, standard nl API requires this attribute!  */
         NETLINK_DIAG_MEMINFO,
         NETLINK_DIAG_GROUPS,
         NETLINK_DIAG_RX_RING,
diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
index b2cc0cd9c4d9..d08c63f3dd6f 100644
--- a/include/uapi/linux/packet_diag.h
+++ b/include/uapi/linux/packet_diag.h
@@ -29,6 +29,7 @@ struct packet_diag_msg {
 };
 
 enum {
+        /* PACKET_DIAG_NONE, standard nl API requires this attribute!  */
         PACKET_DIAG_INFO,
         PACKET_DIAG_MCLIST,
         PACKET_DIAG_RX_RING,
diff --git a/include/uapi/linux/unix_diag.h b/include/uapi/linux/unix_diag.h
index b9e2a6a7446f..1eb0b8dd1830 100644
--- a/include/uapi/linux/unix_diag.h
+++ b/include/uapi/linux/unix_diag.h
@@ -31,6 +31,7 @@ struct unix_diag_msg {
 };
 
 enum {
+        /* UNIX_DIAG_NONE, standard nl API requires this attribute!  */
         UNIX_DIAG_NAME,
         UNIX_DIAG_VFS,
         UNIX_DIAG_PEER,
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 4c62513fe19f..8b729c278b64 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -90,6 +90,14 @@ static DEFINE_MUTEX(cgroup_mutex);
 static DEFINE_MUTEX(cgroup_root_mutex);
 
 /*
+ * cgroup destruction makes heavy use of work items and there can be a lot
+ * of concurrent destructions.  Use a separate workqueue so that cgroup
+ * destruction work items don't end up filling up max_active of system_wq
+ * which may lead to deadlock.
+ */
+static struct workqueue_struct *cgroup_destroy_wq;
+
+/*
  * Generate an array of cgroup subsystem pointers. At boot time, this is
  * populated with the built in subsystems, and modular subsystems are
  * registered after that. The mutable section of this array is protected by
@@ -191,6 +199,7 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp);
 static int cgroup_destroy_locked(struct cgroup *cgrp);
 static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
                               bool is_add);
+static int cgroup_file_release(struct inode *inode, struct file *file);
 
 /**
  * cgroup_css - obtain a cgroup's css for the specified subsystem
@@ -871,7 +880,7 @@ static void cgroup_free_rcu(struct rcu_head *head)
         struct cgroup *cgrp = container_of(head, struct cgroup, rcu_head);
 
         INIT_WORK(&cgrp->destroy_work, cgroup_free_fn);
-        schedule_work(&cgrp->destroy_work);
+        queue_work(cgroup_destroy_wq, &cgrp->destroy_work);
 }
 
 static void cgroup_diput(struct dentry *dentry, struct inode *inode)
@@ -2421,7 +2430,7 @@ static const struct file_operations cgroup_seqfile_operations = {
         .read = seq_read,
         .write = cgroup_file_write,
         .llseek = seq_lseek,
-        .release = single_release,
+        .release = cgroup_file_release,
 };
 
 static int cgroup_file_open(struct inode *inode, struct file *file)
@@ -2482,6 +2491,8 @@ static int cgroup_file_release(struct inode *inode, struct file *file)
                 ret = cft->release(inode, file);
         if (css->ss)
                 css_put(css);
+        if (file->f_op == &cgroup_seqfile_operations)
+                single_release(inode, file);
         return ret;
 }
 
@@ -4249,7 +4260,7 @@ static void css_free_rcu_fn(struct rcu_head *rcu_head)
          * css_put().  dput() requires process context which we don't have.
          */
         INIT_WORK(&css->destroy_work, css_free_work_fn);
-        schedule_work(&css->destroy_work);
+        queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
 
 static void css_release(struct percpu_ref *ref)
@@ -4539,7 +4550,7 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
                 container_of(ref, struct cgroup_subsys_state, refcnt);
 
         INIT_WORK(&css->destroy_work, css_killed_work_fn);
-        schedule_work(&css->destroy_work);
+        queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
 
 /**
@@ -5063,6 +5074,22 @@ out:
         return err;
 }
 
+static int __init cgroup_wq_init(void)
+{
+        /*
+         * There isn't much point in executing destruction path in
+         * parallel.  Good chunk is serialized with cgroup_mutex anyway.
+         * Use 1 for @max_active.
+         *
+         * We would prefer to do this in cgroup_init() above, but that
+         * is called before init_workqueues(): so leave this until after.
+         */
+        cgroup_destroy_wq = alloc_workqueue("cgroup_destroy", 0, 1);
+        BUG_ON(!cgroup_destroy_wq);
+        return 0;
+}
+core_initcall(cgroup_wq_init);
+
 /*
  * proc_cgroup_show()
  *  - Print task's cgroup paths into seq_file, one line for each hierarchy
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 6bf981e13c43..4772034b4b17 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1033,8 +1033,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
         need_loop = task_has_mempolicy(tsk) ||
                         !nodes_intersects(*newmems, tsk->mems_allowed);
 
-        if (need_loop)
+        if (need_loop) {
+                local_irq_disable();
                 write_seqcount_begin(&tsk->mems_allowed_seq);
+        }
 
         nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
         mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
@@ -1042,8 +1044,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
         mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2);
         tsk->mems_allowed = *newmems;
 
-        if (need_loop)
+        if (need_loop) {
                 write_seqcount_end(&tsk->mems_allowed_seq);
+                local_irq_enable();
+        }
 
         task_unlock(tsk);
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index d724e7757cd1..72348dc192c1 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5680,11 +5680,6 @@ static void swevent_hlist_put(struct perf_event *event)
 {
         int cpu;
 
-        if (event->cpu != -1) {
-                swevent_hlist_put_cpu(event, event->cpu);
-                return;
-        }
-
         for_each_possible_cpu(cpu)
                 swevent_hlist_put_cpu(event, cpu);
 }
@@ -5718,9 +5713,6 @@ static int swevent_hlist_get(struct perf_event *event)
         int err;
         int cpu, failed_cpu;
 
-        if (event->cpu != -1)
-                return swevent_hlist_get_cpu(event, event->cpu);
-
         get_online_cpus();
         for_each_possible_cpu(cpu) {
                 err = swevent_hlist_get_cpu(event, cpu);
diff --git a/kernel/extable.c b/kernel/extable.c
index 832cb28105bb..763faf037ec1 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -61,7 +61,7 @@ const struct exception_table_entry *search_exception_tables(unsigned long addr)
 static inline int init_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_sinittext &&
-            addr <= (unsigned long)_einittext)
+            addr < (unsigned long)_einittext)
                 return 1;
         return 0;
 }
@@ -69,7 +69,7 @@ static inline int init_kernel_text(unsigned long addr)
 int core_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_stext &&
-            addr <= (unsigned long)_etext)
+            addr < (unsigned long)_etext)
                 return 1;
 
         if (system_state == SYSTEM_BOOTING &&
diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index cb228bf21760..abcd6ca86cb7 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -50,7 +50,7 @@ static void resume_irqs(bool want_early)
                 bool is_early = desc->action &&
                         desc->action->flags & IRQF_EARLY_RESUME;
 
-                if (is_early != want_early)
+                if (!is_early && want_early)
                         continue;
 
                 raw_spin_lock_irqsave(&desc->lock, flags);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 6abb03dff5c0..08a765232432 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -1632,7 +1632,7 @@ module_param(rcu_idle_gp_delay, int, 0644);
 static int rcu_idle_lazy_gp_delay = RCU_IDLE_LAZY_GP_DELAY;
 module_param(rcu_idle_lazy_gp_delay, int, 0644);
 
-extern int tick_nohz_enabled;
+extern int tick_nohz_active;
 
 /*
  * Try to advance callbacks for all flavors of RCU on the current CPU, but
@@ -1729,7 +1729,7 @@ static void rcu_prepare_for_idle(int cpu)
         int tne;
 
         /* Handle nohz enablement switches conservatively. */
-        tne = ACCESS_ONCE(tick_nohz_enabled);
+        tne = ACCESS_ONCE(tick_nohz_active);
         if (tne != rdtp->tick_nohz_enabled_snap) {
                 if (rcu_cpu_has_callbacks(cpu, NULL))
                         invoke_rcu_core(); /* force nohz to see update. */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index c1808606ee5f..e85cda20ab2b 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2660,6 +2660,7 @@ asmlinkage void __sched notrace preempt_schedule(void)
         } while (need_resched());
 }
 EXPORT_SYMBOL(preempt_schedule);
+#endif /* CONFIG_PREEMPT */
 
 /*
  * this is the entry point to schedule() from kernel preemption
@@ -2693,8 +2694,6 @@ asmlinkage void __sched preempt_schedule_irq(void)
         exception_exit(prev_state);
 }
 
-#endif /* CONFIG_PREEMPT */
-
 int default_wake_function(wait_queue_t *curr, unsigned mode, int wake_flags,
                           void *key)
 {
@@ -4762,7 +4761,7 @@ static void rq_attach_root(struct rq *rq, struct root_domain *rd)
                 cpumask_clear_cpu(rq->cpu, old_rd->span);
 
                 /*
-                 * If we dont want to free the old_rt yet then
+                 * If we dont want to free the old_rd yet then
                  * set old_rd to NULL to skip the freeing later
                  * in this function:
                  */
@@ -4910,8 +4909,9 @@ static void update_top_cache_domain(int cpu)
         if (sd) {
                 id = cpumask_first(sched_domain_span(sd));
                 size = cpumask_weight(sched_domain_span(sd));
-                rcu_assign_pointer(per_cpu(sd_busy, cpu), sd->parent);
+                sd = sd->parent; /* sd_busy */
         }
+        rcu_assign_pointer(per_cpu(sd_busy, cpu), sd);
 
         rcu_assign_pointer(per_cpu(sd_llc, cpu), sd);
         per_cpu(sd_llc_size, cpu) = size;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index e8b652ebe027..fd773ade1a31 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5379,10 +5379,31 @@ void update_group_power(struct sched_domain *sd, int cpu)
                  */
 
                 for_each_cpu(cpu, sched_group_cpus(sdg)) {
-                        struct sched_group *sg = cpu_rq(cpu)->sd->groups;
+                        struct sched_group_power *sgp;
+                        struct rq *rq = cpu_rq(cpu);
 
-                        power_orig += sg->sgp->power_orig;
-                        power += sg->sgp->power;
+                        /*
+                         * build_sched_domains() -> init_sched_groups_power()
+                         * gets here before we've attached the domains to the
+                         * runqueues.
+                         *
+                         * Use power_of(), which is set irrespective of domains
+                         * in update_cpu_power().
+                         *
+                         * This avoids power/power_orig from being 0 and
+                         * causing divide-by-zero issues on boot.
+                         *
+                         * Runtime updates will correct power_orig.
+                         */
+                        if (unlikely(!rq->sd)) {
+                                power_orig += power_of(cpu);
+                                power += power_of(cpu);
+                                continue;
+                        }
+
+                        sgp = rq->sd->groups->sgp;
+                        power_orig += sgp->power_orig;
+                        power += sgp->power;
                 }
         } else  {
                 /*
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 64522ecdfe0e..162b03ab0ad2 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -33,6 +33,21 @@ DEFINE_PER_CPU(struct tick_device, tick_cpu_device);
  */
 ktime_t tick_next_period;
 ktime_t tick_period;
+
+/*
+ * tick_do_timer_cpu is a timer core internal variable which holds the CPU NR
+ * which is responsible for calling do_timer(), i.e. the timekeeping stuff. This
+ * variable has two functions:
+ *
+ * 1) Prevent a thundering herd issue of a gazillion of CPUs trying to grab the
+ *    timekeeping lock all at once. Only the CPU which is assigned to do the
+ *    update is handling it.
+ *
+ * 2) Hand off the duty in the NOHZ idle case by setting the value to
+ *    TICK_DO_TIMER_NONE, i.e. a non existing CPU. So the next cpu which looks
+ *    at it will take over and keep the time keeping alive.  The handover
+ *    procedure also covers cpu hotplug.
+ */
 int tick_do_timer_cpu __read_mostly = TICK_DO_TIMER_BOOT;
 
 /*
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 3612fc77f834..ea20f7d1ac2c 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -361,8 +361,8 @@ void __init tick_nohz_init(void)
 /*
  * NO HZ enabled ?
  */
-int tick_nohz_enabled __read_mostly  = 1;
-
+static int tick_nohz_enabled __read_mostly  = 1;
+int tick_nohz_active  __read_mostly;
 /*
  * Enable / Disable tickless mode
  */
@@ -465,7 +465,7 @@ u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time)
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
         ktime_t now, idle;
 
-        if (!tick_nohz_enabled)
+        if (!tick_nohz_active)
                 return -1;
 
         now = ktime_get();
@@ -506,7 +506,7 @@ u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time)
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
         ktime_t now, iowait;
 
-        if (!tick_nohz_enabled)
+        if (!tick_nohz_active)
                 return -1;
 
         now = ktime_get();
@@ -711,8 +711,10 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts)
                 return false;
         }
 
-        if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
+        if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE)) {
+                ts->sleep_length = (ktime_t) { .tv64 = NSEC_PER_SEC/HZ };
                 return false;
+        }
 
         if (need_resched())
                 return false;
@@ -799,11 +801,6 @@ void tick_nohz_idle_enter(void)
         local_irq_disable();
 
         ts = &__get_cpu_var(tick_cpu_sched);
-        /*
-         * set ts->inidle unconditionally. even if the system did not
-         * switch to nohz mode the cpu frequency governers rely on the
-         * update of the idle time accounting in tick_nohz_start_idle().
-         */
         ts->inidle = 1;
         __tick_nohz_idle_enter(ts);
 
@@ -973,7 +970,7 @@ static void tick_nohz_switch_to_nohz(void)
         struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
         ktime_t next;
 
-        if (!tick_nohz_enabled)
+        if (!tick_nohz_active)
                 return;
 
         local_irq_disable();
@@ -981,7 +978,7 @@ static void tick_nohz_switch_to_nohz(void)
                 local_irq_enable();
                 return;
         }
-
+        tick_nohz_active = 1;
         ts->nohz_mode = NOHZ_MODE_LOWRES;
 
         /*
@@ -1139,8 +1136,10 @@ void tick_setup_sched_timer(void)
         }
 
 #ifdef CONFIG_NO_HZ_COMMON
-        if (tick_nohz_enabled)
+        if (tick_nohz_enabled) {
                 ts->nohz_mode = NOHZ_MODE_HIGHRES;
+                tick_nohz_active = 1;
+        }
 #endif
 }
 #endif /* HIGH_RES_TIMERS */
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 3abf53418b67..87b4f00284c9 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1347,7 +1347,7 @@ static inline void old_vsyscall_fixup(struct timekeeper *tk)
         tk->xtime_nsec -= remainder;
         tk->xtime_nsec += 1ULL << tk->shift;
         tk->ntp_error += remainder << tk->ntp_error_shift;
-
+        tk->ntp_error -= (1ULL << tk->shift) << tk->ntp_error_shift;
 }
 #else
 #define old_vsyscall_fixup(tk)
diff --git a/kernel/timer.c b/kernel/timer.c
index 6582b82fa966..accfd241b9e5 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1518,9 +1518,8 @@ static int init_timers_cpu(int cpu)
                         /*
                          * The APs use this path later in boot
                          */
-                        base = kmalloc_node(sizeof(*base),
-                                                GFP_KERNEL | __GFP_ZERO,
-                                                cpu_to_node(cpu));
+                        base = kzalloc_node(sizeof(*base), GFP_KERNEL,
+                                            cpu_to_node(cpu));
                         if (!base)
                                 return -ENOMEM;
 
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 78e27e3b52ac..e854f420e033 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -24,6 +24,12 @@ static int	total_ref_count;
 static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
                                  struct perf_event *p_event)
 {
+        if (tp_event->perf_perm) {
+                int ret = tp_event->perf_perm(tp_event, p_event);
+                if (ret)
+                        return ret;
+        }
+
         /* The ftrace function trace is allowed only for root. */
         if (ftrace_event_is_function(tp_event) &&
             perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
@@ -173,7 +179,7 @@ static int perf_trace_event_init(struct ftrace_event_call *tp_event,
 int perf_trace_init(struct perf_event *p_event)
 {
         struct ftrace_event_call *tp_event;
-        int event_id = p_event->attr.config;
+        u64 event_id = p_event->attr.config;
         int ret = -EINVAL;
 
         mutex_lock(&event_mutex);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 987293d03ebc..c66912be990f 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -305,6 +305,9 @@ static DEFINE_HASHTABLE(unbound_pool_hash, UNBOUND_POOL_HASH_ORDER);
 /* I: attributes used when instantiating standard unbound pools on demand */
 static struct workqueue_attrs *unbound_std_wq_attrs[NR_STD_WORKER_POOLS];
 
+/* I: attributes used when instantiating ordered pools on demand */
+static struct workqueue_attrs *ordered_wq_attrs[NR_STD_WORKER_POOLS];
+
 struct workqueue_struct *system_wq __read_mostly;
 EXPORT_SYMBOL(system_wq);
 struct workqueue_struct *system_highpri_wq __read_mostly;
@@ -518,14 +521,21 @@ static inline void debug_work_activate(struct work_struct *work) { }
 static inline void debug_work_deactivate(struct work_struct *work) { }
 #endif
 
-/* allocate ID and assign it to @pool */
+/**
+ * worker_pool_assign_id - allocate ID and assing it to @pool
+ * @pool: the pool pointer of interest
+ *
+ * Returns 0 if ID in [0, WORK_OFFQ_POOL_NONE) is allocated and assigned
+ * successfully, -errno on failure.
+ */
 static int worker_pool_assign_id(struct worker_pool *pool)
 {
         int ret;
 
         lockdep_assert_held(&wq_pool_mutex);
 
-        ret = idr_alloc(&worker_pool_idr, pool, 0, 0, GFP_KERNEL);
+        ret = idr_alloc(&worker_pool_idr, pool, 0, WORK_OFFQ_POOL_NONE,
+                        GFP_KERNEL);
         if (ret >= 0) {
                 pool->id = ret;
                 return 0;
@@ -1320,7 +1330,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
 
         debug_work_activate(work);
 
-        /* if dying, only works from the same workqueue are allowed */
+        /* if draining, only works from the same workqueue are allowed */
         if (unlikely(wq->flags & __WQ_DRAINING) &&
             WARN_ON_ONCE(!is_chained_work(wq)))
                 return;
@@ -1736,16 +1746,17 @@ static struct worker *create_worker(struct worker_pool *pool)
         if (IS_ERR(worker->task))
                 goto fail;
 
+        set_user_nice(worker->task, pool->attrs->nice);
+
+        /* prevent userland from meddling with cpumask of workqueue workers */
+        worker->task->flags |= PF_NO_SETAFFINITY;
+
         /*
          * set_cpus_allowed_ptr() will fail if the cpumask doesn't have any
          * online CPUs.  It'll be re-applied when any of the CPUs come up.
          */
-        set_user_nice(worker->task, pool->attrs->nice);
         set_cpus_allowed_ptr(worker->task, pool->attrs->cpumask);
 
-        /* prevent userland from meddling with cpumask of workqueue workers */
-        worker->task->flags |= PF_NO_SETAFFINITY;
-
         /*
          * The caller is responsible for ensuring %POOL_DISASSOCIATED
          * remains stable across this function.  See the comments above the
@@ -4106,7 +4117,7 @@ out_unlock:
 static int alloc_and_link_pwqs(struct workqueue_struct *wq)
 {
         bool highpri = wq->flags & WQ_HIGHPRI;
-        int cpu;
+        int cpu, ret;
 
         if (!(wq->flags & WQ_UNBOUND)) {
                 wq->cpu_pwqs = alloc_percpu(struct pool_workqueue);
@@ -4126,6 +4137,13 @@ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
                         mutex_unlock(&wq->mutex);
                 }
                 return 0;
+        } else if (wq->flags & __WQ_ORDERED) {
+                ret = apply_workqueue_attrs(wq, ordered_wq_attrs[highpri]);
+                /* there should only be single pwq for ordering guarantee */
+                WARN(!ret && (wq->pwqs.next != &wq->dfl_pwq->pwqs_node ||
+                              wq->pwqs.prev != &wq->dfl_pwq->pwqs_node),
+                     "ordering guarantee broken for workqueue %s\n", wq->name);
+                return ret;
         } else {
                 return apply_workqueue_attrs(wq, unbound_std_wq_attrs[highpri]);
         }
@@ -5009,10 +5027,6 @@ static int __init init_workqueues(void)
         int std_nice[NR_STD_WORKER_POOLS] = { 0, HIGHPRI_NICE_LEVEL };
         int i, cpu;
 
-        /* make sure we have enough bits for OFFQ pool ID */
-        BUILD_BUG_ON((1LU << (BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT)) <
-                     WORK_CPU_END * NR_STD_WORKER_POOLS);
-
         WARN_ON(__alignof__(struct pool_workqueue) < __alignof__(long long));
 
         pwq_cache = KMEM_CACHE(pool_workqueue, SLAB_PANIC);
@@ -5051,13 +5065,23 @@ static int __init init_workqueues(void)
                 }
         }
 
-        /* create default unbound wq attrs */
+        /* create default unbound and ordered wq attrs */
         for (i = 0; i < NR_STD_WORKER_POOLS; i++) {
                 struct workqueue_attrs *attrs;
 
                 BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
                 attrs->nice = std_nice[i];
                 unbound_std_wq_attrs[i] = attrs;
+
+                /*
+                 * An ordered wq should have only one pwq as ordering is
+                 * guaranteed by max_active which is enforced by pwqs.
+                 * Turn off NUMA so that dfl_pwq is used for all nodes.
+                 */
+                BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
+                attrs->nice = std_nice[i];
+                attrs->no_numa = true;
+                ordered_wq_attrs[i] = attrs;
         }
 
         system_wq = alloc_workqueue("events", 0, 0);
diff --git a/lib/lockref.c b/lib/lockref.c
index d2b123f8456b..f07a40d33871 100644
--- a/lib/lockref.c
+++ b/lib/lockref.c
@@ -1,5 +1,6 @@
 #include <linux/export.h>
 #include <linux/lockref.h>
+#include <linux/mutex.h>
 
 #if USE_CMPXCHG_LOCKREF
 
@@ -12,14 +13,6 @@
 #endif
 
 /*
- * Allow architectures to override the default cpu_relax() within CMPXCHG_LOOP.
- * This is useful for architectures with an expensive cpu_relax().
- */
-#ifndef arch_mutex_cpu_relax
-# define arch_mutex_cpu_relax() cpu_relax()
-#endif
-
-/*
  * Note that the "cmpxchg()" reloads the "old" value for the
  * failure case.
  */
diff --git a/net/compat.c b/net/compat.c
index 618c6a8a911b..dd32e34c1e2c 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -72,7 +72,7 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
             __get_user(kmsg->msg_flags, &umsg->msg_flags))
                 return -EFAULT;
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         kmsg->msg_name = compat_ptr(tmp1);
         kmsg->msg_iov = compat_ptr(tmp2);
         kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 261357a66300..a797fff7f222 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2527,6 +2527,8 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                 if (x) {
                         int ret;
                         __u8 *eth;
+                        struct iphdr *iph;
+
                         nhead = x->props.header_len - skb_headroom(skb);
                         if (nhead > 0) {
                                 ret = pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
@@ -2548,6 +2550,11 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                         eth = (__u8 *) skb_push(skb, ETH_HLEN);
                         memcpy(eth, pkt_dev->hh, 12);
                         *(u16 *) &eth[12] = protocol;
+
+                        /* Update IPv4 header len as well as checksum value */
+                        iph = ip_hdr(skb);
+                        iph->tot_len = htons(skb->len - ETH_HLEN);
+                        ip_send_check(iph);
                 }
         }
         return 1;
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 003f5bb3acd2..4bdab1521878 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -288,7 +288,8 @@ void hsr_addr_subst_dest(struct hsr_priv *hsr_priv, struct ethhdr *ethhdr,
 static bool seq_nr_after(u16 a, u16 b)
 {
         /* Remove inconsistency where
-         * seq_nr_after(a, b) == seq_nr_before(a, b) */
+         * seq_nr_after(a, b) == seq_nr_before(a, b)
+         */
         if ((int) b - a == 32768)
                 return false;
 
diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 5325af85eea6..01a5261ac7a5 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -23,6 +23,8 @@ static const struct nla_policy hsr_policy[IFLA_HSR_MAX + 1] = {
         [IFLA_HSR_SLAVE1]               = { .type = NLA_U32 },
         [IFLA_HSR_SLAVE2]               = { .type = NLA_U32 },
         [IFLA_HSR_MULTICAST_SPEC]       = { .type = NLA_U8 },
+        [IFLA_HSR_SUPERVISION_ADDR]     = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [IFLA_HSR_SEQ_NR]               = { .type = NLA_U16 },
 };
 
 
@@ -59,6 +61,31 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,
         return hsr_dev_finalize(dev, link, multicast_spec);
 }
 
+static int hsr_fill_info(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct hsr_priv *hsr_priv;
+
+        hsr_priv = netdev_priv(dev);
+
+        if (hsr_priv->slave[0])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE1, hsr_priv->slave[0]->ifindex))
+                        goto nla_put_failure;
+
+        if (hsr_priv->slave[1])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE2, hsr_priv->slave[1]->ifindex))
+                        goto nla_put_failure;
+
+        if (nla_put(skb, IFLA_HSR_SUPERVISION_ADDR, ETH_ALEN,
+                    hsr_priv->sup_multicast_addr) ||
+            nla_put_u16(skb, IFLA_HSR_SEQ_NR, hsr_priv->sequence_nr))
+                goto nla_put_failure;
+
+        return 0;
+
+nla_put_failure:
+        return -EMSGSIZE;
+}
+
 static struct rtnl_link_ops hsr_link_ops __read_mostly = {
         .kind           = "hsr",
         .maxtype        = IFLA_HSR_MAX,
@@ -66,6 +93,7 @@ static struct rtnl_link_ops hsr_link_ops __read_mostly = {
         .priv_size      = sizeof(struct hsr_priv),
         .setup          = hsr_dev_setup,
         .newlink        = hsr_newlink,
+        .fill_info      = hsr_fill_info,
 };
 
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3f858266fa7e..ddf32a6bc415 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -386,7 +386,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
 /*
  *      Handle MSG_ERRQUEUE
  */
-int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
         struct sock_exterr_skb *serr;
         struct sk_buff *skb, *skb2;
@@ -423,6 +423,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                                    serr->addr_offset);
                 sin->sin_port = serr->port;
                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
         }
 
         memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 876c6ca2d8f9..242e7f4ed6f4 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -772,7 +772,7 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 err = PTR_ERR(rt);
                 rt = NULL;
                 if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                 goto out;
         }
 
@@ -841,10 +841,11 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         if (flags & MSG_ERRQUEUE) {
                 if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len);
+                        return ip_recv_error(sk, msg, len, addr_len);
 #if IS_ENABLED(CONFIG_IPV6)
                 } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len);
+                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
+                                                          addr_len);
 #endif
                 }
         }
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index ce848461acbb..46d6a1c923a8 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -31,10 +31,6 @@
 const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS] __read_mostly;
 const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS] __read_mostly;
 
-/*
- *      Add a protocol handler to the hash tables
- */
-
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
         if (!prot->netns_ok) {
@@ -55,10 +51,6 @@ int inet_add_offload(const struct net_offload *prot, unsigned char protocol)
 }
 EXPORT_SYMBOL(inet_add_offload);
 
-/*
- *      Remove a protocol from the hash tables.
- */
-
 int inet_del_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
         int ret;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5cb8ddb505ee..23c3e5b5bb53 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -697,7 +697,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 goto out;
 
         if (flags & MSG_ERRQUEUE) {
-                err = ip_recv_error(sk, msg, len);
+                err = ip_recv_error(sk, msg, len, addr_len);
                 goto out;
         }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 59a6f8b90cd9..067213924751 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -177,7 +177,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
                 if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
                 return err;
         }
 
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 03e9154f7e68..269a89ecd2f4 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -60,7 +60,6 @@ EXPORT_SYMBOL(tcp_destroy_cgroup);
 static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
 {
         struct cg_proto *cg_proto;
-        u64 old_lim;
         int i;
         int ret;
 
@@ -71,7 +70,6 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
         if (val > RES_COUNTER_MAX)
                 val = RES_COUNTER_MAX;
 
-        old_lim = res_counter_read_u64(&cg_proto->memory_allocated, RES_LIMIT);
         ret = res_counter_set_limit(&cg_proto->memory_allocated, val);
         if (ret)
                 return ret;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index a2b68a108eae..05606353c7e7 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -274,33 +274,32 @@ static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *
 {
         const struct iphdr *iph = skb_gro_network_header(skb);
         __wsum wsum;
-        __sum16 sum;
+
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+
+        wsum = skb->csum;
 
         switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    0);
+
+                /* fall through */
+
         case CHECKSUM_COMPLETE:
                 if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         break;
                 }
-flush:
+
                 NAPI_GRO_CB(skb)->flush = 1;
                 return NULL;
-
-        case CHECKSUM_NONE:
-                wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                          skb_gro_len(skb), IPPROTO_TCP, 0);
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
         }
 
+skip_csum:
         return tcp_gro_receive(head, skb);
 }
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5944d7d668dd..44f6a20fa29d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -999,7 +999,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         err = PTR_ERR(rt);
                         rt = NULL;
                         if (err == -ENETUNREACH)
-                                IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                                IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                         goto out;
                 }
 
@@ -1098,6 +1098,9 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
         struct udp_sock *up = udp_sk(sk);
         int ret;
 
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
+
         if (!up->pending) {
                 struct msghdr msg = {   .msg_flags = flags|MSG_MORE };
 
@@ -1236,7 +1239,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         bool slow;
 
         if (flags & MSG_ERRQUEUE)
-                return ip_recv_error(sk, msg, len);
+                return ip_recv_error(sk, msg, len, addr_len);
 
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index a454b0ff57c7..8dfe1f4d3c1a 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -318,7 +318,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
 /*
  *      Handle MSG_ERRQUEUE
  */
-int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sock_exterr_skb *serr;
@@ -369,6 +369,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                                &sin->sin6_addr);
                         sin->sin6_scope_id = 0;
                 }
+                *addr_len = sizeof(*sin);
         }
 
         memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@@ -377,6 +378,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
         if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
+                sin->sin6_port = 0;
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
@@ -423,7 +425,8 @@ EXPORT_SYMBOL_GPL(ipv6_recv_error);
 /*
  *      Handle IPV6_RECVPATHMTU
  */
-int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
+                     int *addr_len)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sk_buff *skb;
@@ -457,6 +460,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_port = 0;
                 sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
                 sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
+                *addr_len = sizeof(*sin);
         }
 
         put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 59df872e2f4d..4acdb63495db 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -116,8 +116,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
         }
         rcu_read_unlock_bh();
 
-        IP6_INC_STATS_BH(dev_net(dst->dev),
-                         ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
+        IP6_INC_STATS(dev_net(dst->dev),
+                      ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
         kfree_skb(skb);
         return -EINVAL;
 }
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 8815e31a87fe..a83243c3d656 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -57,7 +57,8 @@ static struct inet_protosw pingv6_protosw = {
 
 
 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
-static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+                                 int *addr_len)
 {
         return -EAFNOSUPPORT;
 }
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 22d1bd4670da..e048cf1bb6a2 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -36,10 +36,6 @@ int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol
 }
 EXPORT_SYMBOL(inet6_add_protocol);
 
-/*
- *      Remove a protocol from the hash tables.
- */
-
 int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
         int ret;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e24ff1df0401..7fb4e14c467f 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -466,10 +466,10 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                 return -EOPNOTSUPP;
 
         if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
 
         if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1b4a4a953675..366fbba3359a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -478,14 +478,44 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         dev_put(dev);
 }
 
+/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
+ * if sufficient data bytes are available
+ */
+static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
+{
+        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        struct rt6_info *rt;
+        struct sk_buff *skb2;
+
+        if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8))
+                return 1;
+
+        skb2 = skb_clone(skb, GFP_ATOMIC);
+
+        if (!skb2)
+                return 1;
+
+        skb_dst_drop(skb2);
+        skb_pull(skb2, iph->ihl * 4);
+        skb_reset_network_header(skb2);
+
+        rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0);
+
+        if (rt && rt->dst.dev)
+                skb2->dev = rt->dst.dev;
+
+        icmpv6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
+
+        if (rt)
+                ip6_rt_put(rt);
+
+        kfree_skb(skb2);
+
+        return 0;
+}
 
 static int ipip6_err(struct sk_buff *skb, u32 info)
 {
-
-/* All the routers (except for Linux) return only
-   8 bytes of packet payload. It means, that precise relaying of
-   ICMP in the real Internet is absolutely infeasible.
- */
         const struct iphdr *iph = (const struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
@@ -500,7 +530,6 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
         case ICMP_DEST_UNREACH:
                 switch (code) {
                 case ICMP_SR_FAILED:
-                case ICMP_PORT_UNREACH:
                         /* Impossible event. */
                         return 0;
                 default:
@@ -545,6 +574,9 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 goto out;
 
         err = 0;
+        if (!ipip6_err_gen_icmpv6_unreach(skb))
+                goto out;
+
         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
                 goto out;
 
@@ -919,7 +951,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 if (!new_skb) {
                         ip_rt_put(rt);
                         dev->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
+                        kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
                 if (skb->sk)
@@ -945,7 +977,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 tx_error_icmp:
         dst_link_failure(skb);
 tx_error:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
         dev->stats.tx_errors++;
         return NETDEV_TX_OK;
@@ -985,7 +1017,7 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
 
 tx_err:
         dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
         return NETDEV_TX_OK;
 
 }
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index c1097c798900..6d18157dc32c 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -37,34 +37,32 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 {
         const struct ipv6hdr *iph = skb_gro_network_header(skb);
         __wsum wsum;
-        __sum16 sum;
+
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+
+        wsum = skb->csum;
 
         switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    wsum);
+
+                /* fall through */
+
         case CHECKSUM_COMPLETE:
                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         break;
                 }
-flush:
+
                 NAPI_GRO_CB(skb)->flush = 1;
                 return NULL;
-
-        case CHECKSUM_NONE:
-                wsum = ~csum_unfold(csum_ipv6_magic(&iph->saddr, &iph->daddr,
-                                                    skb_gro_len(skb),
-                                                    IPPROTO_TCP, 0));
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
         }
 
+skip_csum:
         return tcp_gro_receive(head, skb);
 }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 81eb8cf8389b..bcd5699313c3 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -393,10 +393,10 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         bool slow;
 
         if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
 
         if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index cfd65304be60..d9b437e55007 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -665,7 +665,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                 *addr_len = sizeof(*lsa);
 
         if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 4518a57aa5fe..713671ae45af 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -74,9 +74,12 @@ static struct list_head family_ht[GENL_FAM_TAB_SIZE];
  * Bit 17 is marked as already used since the VFS quota code
  * also abused this API and relied on family == group ID, we
  * cater to that by giving it a static family and group ID.
+ * Bit 18 is marked as already used since the PMCRAID driver
+ * did the same thing as the VFS quota code (maybe copied?)
  */
 static unsigned long mc_group_start = 0x3 | BIT(GENL_ID_CTRL) |
-                                      BIT(GENL_ID_VFS_DQUOT);
+                                      BIT(GENL_ID_VFS_DQUOT) |
+                                      BIT(GENL_ID_PMCRAID);
 static unsigned long *mc_groups = &mc_group_start;
 static unsigned long mc_groups_longs = 1;
 
@@ -139,6 +142,7 @@ static u16 genl_generate_id(void)
 
         for (i = 0; i <= GENL_MAX_ID - GENL_MIN_ID; i++) {
                 if (id_gen_idx != GENL_ID_VFS_DQUOT &&
+                    id_gen_idx != GENL_ID_PMCRAID &&
                     !genl_family_find_byid(id_gen_idx))
                         return id_gen_idx;
                 if (++id_gen_idx > GENL_MAX_ID)
@@ -214,7 +218,7 @@ static int genl_validate_assign_mc_groups(struct genl_family *family)
 {
         int first_id;
         int n_groups = family->n_mcgrps;
-        int err, i;
+        int err = 0, i;
         bool groups_allocated = false;
 
         if (!n_groups)
@@ -236,9 +240,12 @@ static int genl_validate_assign_mc_groups(struct genl_family *family)
         } else if (strcmp(family->name, "NET_DM") == 0) {
                 first_id = 1;
                 BUG_ON(n_groups != 1);
-        } else if (strcmp(family->name, "VFS_DQUOT") == 0) {
+        } else if (family->id == GENL_ID_VFS_DQUOT) {
                 first_id = GENL_ID_VFS_DQUOT;
                 BUG_ON(n_groups != 1);
+        } else if (family->id == GENL_ID_PMCRAID) {
+                first_id = GENL_ID_PMCRAID;
+                BUG_ON(n_groups != 1);
         } else {
                 groups_allocated = true;
                 err = genl_allocate_reserve_groups(n_groups, &first_id);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ac27c86ef6d1..ba2548bd85bf 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -439,9 +439,9 @@ static void prb_shutdown_retire_blk_timer(struct packet_sock *po,
 
         pkc = tx_ring ? &po->tx_ring.prb_bdqc : &po->rx_ring.prb_bdqc;
 
-        spin_lock(&rb_queue->lock);
+        spin_lock_bh(&rb_queue->lock);
         pkc->delete_blk_timer = 1;
-        spin_unlock(&rb_queue->lock);
+        spin_unlock_bh(&rb_queue->lock);
 
         prb_del_retire_blk_timer(pkc);
 }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 75c94e59a3bd..bccd52b36e97 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -215,10 +215,10 @@ static bool loss_4state(struct netem_sched_data *q)
                 if (rnd < clg->a4) {
                         clg->state = 4;
                         return true;
-                } else if (clg->a4 < rnd && rnd < clg->a1) {
+                } else if (clg->a4 < rnd && rnd < clg->a1 + clg->a4) {
                         clg->state = 3;
                         return true;
-                } else if (clg->a1 < rnd)
+                } else if (clg->a1 + clg->a4 < rnd)
                         clg->state = 1;
 
                 break;
@@ -268,10 +268,11 @@ static bool loss_gilb_ell(struct netem_sched_data *q)
                         clg->state = 2;
                 if (net_random() < clg->a4)
                         return true;
+                break;
         case 2:
                 if (net_random() < clg->a2)
                         clg->state = 1;
-                if (clg->a3 > net_random())
+                if (net_random() > clg->a3)
                         return true;
         }
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 68f98595819c..a6090051c5db 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -21,6 +21,7 @@
 #include <net/netlink.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
+#include <net/tcp.h>
 
 
 /*      Simple Token Bucket Filter.
@@ -117,6 +118,22 @@ struct tbf_sched_data {
 };
 
 
+/*
+ * Return length of individual segments of a gso packet,
+ * including all headers (MAC, IP, TCP/UDP)
+ */
+static unsigned int skb_gso_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
+        const struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+        if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+                hdr_len += tcp_hdrlen(skb);
+        else
+                hdr_len += sizeof(struct udphdr);
+        return hdr_len + shinfo->gso_size;
+}
+
 /* GSO packet is too big, segment it so that tbf can transmit
  * each segment in time
  */
@@ -136,12 +153,8 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
         while (segs) {
                 nskb = segs->next;
                 segs->next = NULL;
-                if (likely(segs->len <= q->max_size)) {
-                        qdisc_skb_cb(segs)->pkt_len = segs->len;
-                        ret = qdisc_enqueue(segs, q->qdisc);
-                } else {
-                        ret = qdisc_reshape_fail(skb, sch);
-                }
+                qdisc_skb_cb(segs)->pkt_len = segs->len;
+                ret = qdisc_enqueue(segs, q->qdisc);
                 if (ret != NET_XMIT_SUCCESS) {
                         if (net_xmit_drop_count(ret))
                                 sch->qstats.drops++;
@@ -163,7 +176,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         int ret;
 
         if (qdisc_pkt_len(skb) > q->max_size) {
-                if (skb_is_gso(skb))
+                if (skb_is_gso(skb) && skb_gso_seglen(skb) <= q->max_size)
                         return tbf_segment(skb, sch);
                 return qdisc_reshape_fail(skb, sch);
         }
@@ -319,6 +332,11 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
         if (max_size < 0)
                 goto done;
 
+        if (max_size < psched_mtu(qdisc_dev(sch)))
+                pr_warn_ratelimited("sch_tbf: burst %u is lower than device %s mtu (%u) !\n",
+                                    max_size, qdisc_dev(sch)->name,
+                                    psched_mtu(qdisc_dev(sch)));
+
         if (q->qdisc != &noop_qdisc) {
                 err = fifo_set_limit(q->qdisc, qopt->limit);
                 if (err)
diff --git a/net/sctp/output.c b/net/sctp/output.c
index e650978daf27..0e2644d0a773 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -474,10 +474,11 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                          * for a given destination transport address.
                          */
 
-                        if (!tp->rto_pending) {
+                        if (!chunk->resent && !tp->rto_pending) {
                                 chunk->rtt_in_progress = 1;
                                 tp->rto_pending = 1;
                         }
+
                         has_data = 1;
                 }
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 94df75877869..f51ba985a36e 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -446,6 +446,8 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                                 transport->rto_pending = 0;
                         }
 
+                        chunk->resent = 1;
+
                         /* Move the chunk to the retransmit queue. The chunks
                          * on the retransmit queue are always kept in order.
                          */
@@ -1375,6 +1377,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                  * instance).
                                  */
                                 if (!tchunk->tsn_gap_acked &&
+                                    !tchunk->resent &&
                                     tchunk->rtt_in_progress) {
                                         tchunk->rtt_in_progress = 0;
                                         rtt = jiffies - tchunk->sent_at;
@@ -1391,7 +1394,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                          */
                         if (!tchunk->tsn_gap_acked) {
                                 tchunk->tsn_gap_acked = 1;
-                                *highest_new_tsn_in_sack = tsn;
+                                if (TSN_lt(*highest_new_tsn_in_sack, tsn))
+                                        *highest_new_tsn_in_sack = tsn;
                                 bytes_acked += sctp_data_size(tchunk);
                                 if (!tchunk->transport)
                                         migrate_bytes += sctp_data_size(tchunk);
diff --git a/net/socket.c b/net/socket.c
index 0b18693f2be6..e83c416708af 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1973,7 +1973,7 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
         if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
                 return -EFAULT;
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         return 0;
 }
 
diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
index 913e1927f916..635695f6a185 100644
--- a/security/integrity/ima/ima_template.c
+++ b/security/integrity/ima/ima_template.c
@@ -110,7 +110,7 @@ static int template_desc_init_fields(const char *template_fmt,
                                      struct ima_template_field ***fields,
                                      int *num_fields)
 {
-        char *c, *template_fmt_copy;
+        char *c, *template_fmt_copy, *template_fmt_ptr;
         int template_num_fields = template_fmt_size(template_fmt);
         int i, result = 0;
 
@@ -127,7 +127,9 @@ static int template_desc_init_fields(const char *template_fmt,
                 result = -ENOMEM;
                 goto out;
         }
-        for (i = 0; (c = strsep(&template_fmt_copy, "|")) != NULL &&
+
+        template_fmt_ptr = template_fmt_copy;
+        for (i = 0; (c = strsep(&template_fmt_ptr, "|")) != NULL &&
              i < template_num_fields; i++) {
                 struct ima_template_field *f = lookup_template_field(c);
 
diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
index d3226892ad6b..9048777228e2 100644
--- a/sound/firewire/amdtp.c
+++ b/sound/firewire/amdtp.c
@@ -434,17 +434,14 @@ static void queue_out_packet(struct amdtp_out_stream *s, unsigned int cycle)
                 return;
         index = s->packet_index;
 
+        /* this module generate empty packet for 'no data' */
         syt = calculate_syt(s, cycle);
-        if (!(s->flags & CIP_BLOCKING)) {
+        if (!(s->flags & CIP_BLOCKING))
                 data_blocks = calculate_data_blocks(s);
-        } else {
-                if (syt != 0xffff) {
-                        data_blocks = s->syt_interval;
-                } else {
-                        data_blocks = 0;
-                        syt = 0xffffff;
-                }
-        }
+        else if (syt != 0xffff)
+                data_blocks = s->syt_interval;
+        else
+                data_blocks = 0;
 
         buffer = s->buffer.packets[index].buffer;
         buffer[0] = cpu_to_be32(ACCESS_ONCE(s->source_node_id_field) |
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 77db69480c19..7aa9870040c1 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -698,7 +698,6 @@ struct hda_bus {
         unsigned int in_reset:1;        /* during reset operation */
         unsigned int power_keep_link_on:1; /* don't power off HDA link */
         unsigned int no_response_fallback:1; /* don't fallback at RIRB error */
-        unsigned int avoid_link_reset:1; /* don't reset link at runtime PM */
 
         int primary_dig_out_type;       /* primary digital out PCM type */
 };
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 3067ed4fe3b2..c4671d00babd 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -2506,12 +2506,8 @@ static int create_out_jack_modes(struct hda_codec *codec, int num_pins,
 
         for (i = 0; i < num_pins; i++) {
                 hda_nid_t pin = pins[i];
-                if (pin == spec->hp_mic_pin) {
-                        int ret = create_hp_mic_jack_mode(codec, pin);
-                        if (ret < 0)
-                                return ret;
+                if (pin == spec->hp_mic_pin)
                         continue;
-                }
                 if (get_out_jack_num_items(codec, pin) > 1) {
                         struct snd_kcontrol_new *knew;
                         char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
@@ -2764,7 +2760,7 @@ static int hp_mic_jack_mode_put(struct snd_kcontrol *kcontrol,
                         val &= ~(AC_PINCTL_VREFEN | PIN_HP);
                         val |= get_vref_idx(vref_caps, idx) | PIN_IN;
                 } else
-                        val = snd_hda_get_default_vref(codec, nid);
+                        val = snd_hda_get_default_vref(codec, nid) | PIN_IN;
         }
         snd_hda_set_pin_ctl_cache(codec, nid, val);
         call_hp_automute(codec, NULL);
@@ -2784,9 +2780,6 @@ static int create_hp_mic_jack_mode(struct hda_codec *codec, hda_nid_t pin)
         struct hda_gen_spec *spec = codec->spec;
         struct snd_kcontrol_new *knew;
 
-        if (get_out_jack_num_items(codec, pin) <= 1 &&
-            get_in_jack_num_items(codec, pin) <= 1)
-                return 0; /* no need */
         knew = snd_hda_gen_add_kctl(spec, "Headphone Mic Jack Mode",
                                     &hp_mic_jack_mode_enum);
         if (!knew)
@@ -2815,6 +2808,42 @@ static int add_loopback_list(struct hda_gen_spec *spec, hda_nid_t mix, int idx)
         return 0;
 }
 
+/* return true if either a volume or a mute amp is found for the given
+ * aamix path; the amp has to be either in the mixer node or its direct leaf
+ */
+static bool look_for_mix_leaf_ctls(struct hda_codec *codec, hda_nid_t mix_nid,
+                                   hda_nid_t pin, unsigned int *mix_val,
+                                   unsigned int *mute_val)
+{
+        int idx, num_conns;
+        const hda_nid_t *list;
+        hda_nid_t nid;
+
+        idx = snd_hda_get_conn_index(codec, mix_nid, pin, true);
+        if (idx < 0)
+                return false;
+
+        *mix_val = *mute_val = 0;
+        if (nid_has_volume(codec, mix_nid, HDA_INPUT))
+                *mix_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+        if (nid_has_mute(codec, mix_nid, HDA_INPUT))
+                *mute_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+        if (*mix_val && *mute_val)
+                return true;
+
+        /* check leaf node */
+        num_conns = snd_hda_get_conn_list(codec, mix_nid, &list);
+        if (num_conns < idx)
+                return false;
+        nid = list[idx];
+        if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT))
+                *mix_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+        if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT))
+                *mute_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+
+        return *mix_val || *mute_val;
+}
+
 /* create input playback/capture controls for the given pin */
 static int new_analog_input(struct hda_codec *codec, int input_idx,
                             hda_nid_t pin, const char *ctlname, int ctlidx,
@@ -2822,12 +2851,11 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
 {
         struct hda_gen_spec *spec = codec->spec;
         struct nid_path *path;
-        unsigned int val;
+        unsigned int mix_val, mute_val;
         int err, idx;
 
-        if (!nid_has_volume(codec, mix_nid, HDA_INPUT) &&
-            !nid_has_mute(codec, mix_nid, HDA_INPUT))
-                return 0; /* no need for analog loopback */
+        if (!look_for_mix_leaf_ctls(codec, mix_nid, pin, &mix_val, &mute_val))
+                return 0;
 
         path = snd_hda_add_new_path(codec, pin, mix_nid, 0);
         if (!path)
@@ -2836,20 +2864,18 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
         spec->loopback_paths[input_idx] = snd_hda_get_path_idx(codec, path);
 
         idx = path->idx[path->depth - 1];
-        if (nid_has_volume(codec, mix_nid, HDA_INPUT)) {
-                val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
-                err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, val);
+        if (mix_val) {
+                err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, mix_val);
                 if (err < 0)
                         return err;
-                path->ctls[NID_PATH_VOL_CTL] = val;
+                path->ctls[NID_PATH_VOL_CTL] = mix_val;
         }
 
-        if (nid_has_mute(codec, mix_nid, HDA_INPUT)) {
-                val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
-                err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, val);
+        if (mute_val) {
+                err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, mute_val);
                 if (err < 0)
                         return err;
-                path->ctls[NID_PATH_MUTE_CTL] = val;
+                path->ctls[NID_PATH_MUTE_CTL] = mute_val;
         }
 
         path->active = true;
@@ -4383,6 +4409,17 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
         if (err < 0)
                 return err;
 
+        /* create "Headphone Mic Jack Mode" if no input selection is
+         * available (or user specifies add_jack_modes hint)
+         */
+        if (spec->hp_mic_pin &&
+            (spec->auto_mic || spec->input_mux.num_items == 1 ||
+             spec->add_jack_modes)) {
+                err = create_hp_mic_jack_mode(codec, spec->hp_mic_pin);
+                if (err < 0)
+                        return err;
+        }
+
         if (spec->add_jack_modes) {
                 if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT) {
                         err = create_out_jack_modes(codec, cfg->line_outs,
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 7a09404579a7..c6d230193da6 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2994,8 +2994,7 @@ static int azx_runtime_suspend(struct device *dev)
                   STATESTS_INT_MASK);
 
         azx_stop_chip(chip);
-        if (!chip->bus->avoid_link_reset)
-                azx_enter_link_reset(chip);
+        azx_enter_link_reset(chip);
         azx_clear_irq_pending(chip);
         if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
                 hda_display_power(false);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index c205bb1747fd..1f2717f817a0 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3244,9 +3244,29 @@ enum {
 #if IS_ENABLED(CONFIG_THINKPAD_ACPI)
 
 #include <linux/thinkpad_acpi.h>
+#include <acpi/acpi.h>
 
 static int (*led_set_func)(int, bool);
 
+static acpi_status acpi_check_cb(acpi_handle handle, u32 lvl, void *context,
+                                 void **rv)
+{
+        bool *found = context;
+        *found = true;
+        return AE_OK;
+}
+
+static bool is_thinkpad(struct hda_codec *codec)
+{
+        bool found = false;
+        if (codec->subsystem_id >> 16 != 0x17aa)
+                return false;
+        if (ACPI_SUCCESS(acpi_get_devices("LEN0068", acpi_check_cb, &found, NULL)) && found)
+                return true;
+        found = false;
+        return ACPI_SUCCESS(acpi_get_devices("IBM0068", acpi_check_cb, &found, NULL)) && found;
+}
+
 static void update_tpacpi_mute_led(void *private_data, int enabled)
 {
         struct hda_codec *codec = private_data;
@@ -3279,6 +3299,8 @@ static void cxt_fixup_thinkpad_acpi(struct hda_codec *codec,
         bool removefunc = false;
 
         if (action == HDA_FIXUP_ACT_PROBE) {
+                if (!is_thinkpad(codec))
+                        return;
                 if (!led_set_func)
                         led_set_func = symbol_request(tpacpi_led_set);
                 if (!led_set_func) {
@@ -3494,6 +3516,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+        SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
         SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
         SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
         {}
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 5e42059f10a1..c770bdba6531 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1782,6 +1782,8 @@ enum {
         ALC889_FIXUP_IMAC91_VREF,
         ALC882_FIXUP_INV_DMIC,
         ALC882_FIXUP_NO_PRIMARY_HP,
+        ALC887_FIXUP_ASUS_BASS,
+        ALC887_FIXUP_BASS_CHMAP,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -1915,6 +1917,9 @@ static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
         }
 }
 
+static void alc_fixup_bass_chmap(struct hda_codec *codec,
+                                 const struct hda_fixup *fix, int action);
+
 static const struct hda_fixup alc882_fixups[] = {
         [ALC882_FIXUP_ABIT_AW9D_MAX] = {
                 .type = HDA_FIXUP_PINS,
@@ -2105,6 +2110,19 @@ static const struct hda_fixup alc882_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc882_fixup_no_primary_hp,
         },
+        [ALC887_FIXUP_ASUS_BASS] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        {0x16, 0x99130130}, /* bass speaker */
+                        {}
+                },
+                .chained = true,
+                .chain_id = ALC887_FIXUP_BASS_CHMAP,
+        },
+        [ALC887_FIXUP_BASS_CHMAP] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_bass_chmap,
+        },
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2138,6 +2156,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V),
         SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
         SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
+        SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
         SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
         SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
         SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
@@ -3798,6 +3817,7 @@ enum {
         ALC271_FIXUP_HP_GATE_MIC_JACK,
         ALC269_FIXUP_ACER_AC700,
         ALC269_FIXUP_LIMIT_INT_MIC_BOOST,
+        ALC269VB_FIXUP_ASUS_ZENBOOK,
         ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED,
         ALC269VB_FIXUP_ORDISSIMO_EVE2,
         ALC283_FIXUP_CHROME_BOOK,
@@ -4075,6 +4095,12 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_THINKPAD_ACPI,
         },
+        [ALC269VB_FIXUP_ASUS_ZENBOOK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_limit_int_mic_boost,
+                .chained = true,
+                .chain_id = ALC269VB_FIXUP_DMIC,
+        },
         [ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_limit_int_mic_boost,
@@ -4189,8 +4215,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
         SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-        SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC),
-        SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_DMIC),
+        SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+        SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK),
         SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
         SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
@@ -4715,7 +4741,7 @@ static const struct snd_pcm_chmap_elem asus_pcm_2_1_chmaps[] = {
 };
 
 /* override the 2.1 chmap */
-static void alc662_fixup_bass_chmap(struct hda_codec *codec,
+static void alc_fixup_bass_chmap(struct hda_codec *codec,
                                     const struct hda_fixup *fix, int action)
 {
         if (action == HDA_FIXUP_ACT_BUILD) {
@@ -4923,7 +4949,7 @@ static const struct hda_fixup alc662_fixups[] = {
         },
         [ALC662_FIXUP_BASS_CHMAP] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc662_fixup_bass_chmap,
+                .v.func = alc_fixup_bass_chmap,
                 .chained = true,
                 .chain_id = ALC662_FIXUP_ASUS_MODE4
         },
@@ -4936,7 +4962,7 @@ static const struct hda_fixup alc662_fixups[] = {
         },
         [ALC662_FIXUP_BASS_1A_CHMAP] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc662_fixup_bass_chmap,
+                .v.func = alc_fixup_bass_chmap,
                 .chained = true,
                 .chain_id = ALC662_FIXUP_BASS_1A,
         },
@@ -5118,6 +5144,7 @@ static int patch_alc662(struct hda_codec *codec)
                 case 0x10ec0272:
                 case 0x10ec0663:
                 case 0x10ec0665:
+                case 0x10ec0668:
                         set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
                         break;
                 case 0x10ec0273:
@@ -5175,6 +5202,7 @@ static int patch_alc680(struct hda_codec *codec)
  */
 static const struct hda_codec_preset snd_hda_preset_realtek[] = {
         { .id = 0x10ec0221, .name = "ALC221", .patch = patch_alc269 },
+        { .id = 0x10ec0231, .name = "ALC231", .patch = patch_alc269 },
         { .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
         { .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
         { .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index d2cc0041d9d3..088a5afbd1b9 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2094,7 +2094,8 @@ static void stac92hd83xxx_fixup_hp_mic_led(struct hda_codec *codec,
 
         if (action == HDA_FIXUP_ACT_PRE_PROBE) {
                 spec->mic_mute_led_gpio = 0x08; /* GPIO3 */
-                codec->bus->avoid_link_reset = 1;
+                /* resetting controller clears GPIO, so we need to keep on */
+                codec->bus->power_keep_link_on = 1;
         }
 }
 
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index b9ba0fcc45df..83aabea259d7 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -636,8 +636,22 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep,
         if (usb_pipein(ep->pipe) ||
                         snd_usb_endpoint_implicit_feedback_sink(ep)) {
 
+                urb_packs = packs_per_ms;
+                /*
+                 * Wireless devices can poll at a max rate of once per 4ms.
+                 * For dataintervals less than 5, increase the packet count to
+                 * allow the host controller to use bursting to fill in the
+                 * gaps.
+                 */
+                if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_WIRELESS) {
+                        int interval = ep->datainterval;
+                        while (interval < 5) {
+                                urb_packs <<= 1;
+                                ++interval;
+                        }
+                }
                 /* make capture URBs <= 1 ms and smaller than a period */
-                urb_packs = min(max_packs_per_urb, packs_per_ms);
+                urb_packs = min(max_packs_per_urb, urb_packs);
                 while (urb_packs > 1 && urb_packs * maxsize >= period_bytes)
                         urb_packs >>= 1;
                 ep->nurbs = MAX_URBS;
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index 0362d575de7d..217c82ee3665 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -1606,6 +1606,24 @@ process_arg(struct event_format *event, struct print_arg *arg, char **tok)
 static enum event_type
 process_op(struct event_format *event, struct print_arg *arg, char **tok);
 
+/*
+ * For __print_symbolic() and __print_flags, we need to completely
+ * evaluate the first argument, which defines what to print next.
+ */
+static enum event_type
+process_field_arg(struct event_format *event, struct print_arg *arg, char **tok)
+{
+        enum event_type type;
+
+        type = process_arg(event, arg, tok);
+
+        while (type == EVENT_OP) {
+                type = process_op(event, arg, tok);
+        }
+
+        return type;
+}
+
 static enum event_type
 process_cond(struct event_format *event, struct print_arg *top, char **tok)
 {
@@ -2371,7 +2389,7 @@ process_flags(struct event_format *event, struct print_arg *arg, char **tok)
                 goto out_free;
         }
 
-        type = process_arg(event, field, &token);
+        type = process_field_arg(event, field, &token);
 
         /* Handle operations in the first argument */
         while (type == EVENT_OP)
@@ -2424,7 +2442,8 @@ process_symbols(struct event_format *event, struct print_arg *arg, char **tok)
                 goto out_free;
         }
 
-        type = process_arg(event, field, &token);
+        type = process_field_arg(event, field, &token);
+
         if (test_type_token(type, token, EVENT_DELIM, ","))
                 goto out_free_field;
 
@@ -3446,7 +3465,7 @@ eval_num_arg(void *data, int size, struct event_format *event, struct print_arg
                  * is in the bottom half of the 32 bit field.
                  */
                 offset &= 0xffff;
-                val = (unsigned long long)(data + offset);
+                val = (unsigned long long)((unsigned long)data + offset);
                 break;
         default: /* not sure what to do there */
                 return 0;
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 369c03648f88..1cd035708931 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2078,8 +2078,10 @@ static int process_group_desc(struct perf_file_section *section __maybe_unused,
                 if (evsel->idx == (int) desc[i].leader_idx) {
                         evsel->leader = evsel;
                         /* {anon_group} is a dummy name */
-                        if (strcmp(desc[i].name, "{anon_group}"))
+                        if (strcmp(desc[i].name, "{anon_group}")) {
                                 evsel->group_name = desc[i].name;
+                                desc[i].name = NULL;
+                        }
                         evsel->nr_members = desc[i].nr_members;
 
                         if (i >= nr_groups || nr > 0) {
@@ -2105,7 +2107,7 @@ static int process_group_desc(struct perf_file_section *section __maybe_unused,
 
         ret = 0;
 out_free:
-        while ((int) --i >= 0)
+        for (i = 0; i < nr_groups; i++)
                 free(desc[i].name);
         free(desc);
 
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index cd8e2f592719..49eaf1d7d89d 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -70,14 +70,13 @@ int thread__set_comm(struct thread *thread, const char *str, u64 timestamp)
         /* Override latest entry if it had no specific time coverage */
         if (!curr->start) {
                 comm__override(curr, str, timestamp);
-                return 0;
+        } else {
+                new = comm__new(str, timestamp);
+                if (!new)
+                        return -ENOMEM;
+                list_add(&new->list, &thread->comm_list);
         }
 
-        new = comm__new(str, timestamp);
-        if (!new)
-                return -ENOMEM;
-
-        list_add(&new->list, &thread->comm_list);
         thread->comm_set = true;
 
         return 0;
diff --git a/tools/power/cpupower/man/cpupower-idle-info.1 b/tools/power/cpupower/man/cpupower-idle-info.1
index 4178effd9e99..7b3646adb92f 100644
--- a/tools/power/cpupower/man/cpupower-idle-info.1
+++ b/tools/power/cpupower/man/cpupower-idle-info.1
@@ -87,4 +87,5 @@ Thomas Renninger <trenn@suse.de>
 .fi
 .SH "SEE ALSO"
 .LP
-cpupower(1), cpupower\-monitor(1), cpupower\-info(1), cpupower\-set(1)
+cpupower(1), cpupower\-monitor(1), cpupower\-info(1), cpupower\-set(1),
+cpupower\-idle\-set(1)
diff --git a/tools/power/cpupower/man/cpupower-idle-set.1 b/tools/power/cpupower/man/cpupower-idle-set.1
new file mode 100644
index 000000000000..6b1607272a5b
--- /dev/null
+++ b/tools/power/cpupower/man/cpupower-idle-set.1
@@ -0,0 +1,71 @@
+.TH "CPUPOWER-IDLE-SET" "1" "0.1" "" "cpupower Manual"
+.SH "NAME"
+.LP
+cpupower idle\-set \- Utility to set cpu idle state specific kernel options
+.SH "SYNTAX"
+.LP
+cpupower [ \-c cpulist ] idle\-info [\fIoptions\fP]
+.SH "DESCRIPTION"
+.LP
+The cpupower idle\-set subcommand allows to set cpu idle, also called cpu
+sleep state, specific options offered by the kernel. One example is disabling
+sleep states. This can be handy for power vs performance tuning.
+.SH "OPTIONS"
+.LP
+.TP
+\fB\-d\fR \fB\-\-disable\fR
+Disable a specific processor sleep state.
+.TP
+\fB\-e\fR \fB\-\-enable\fR
+Enable a specific processor sleep state.
+
+.SH "REMARKS"
+.LP
+Cpuidle Governors Policy on Disabling Sleep States
+
+.RS 4
+Depending on the used  cpuidle governor, implementing the kernel policy
+how to choose sleep states, subsequent sleep states on this core, might get
+disabled as well.
+
+There are two cpuidle governors ladder and menu. While the ladder
+governor is always available, if CONFIG_CPU_IDLE is selected, the
+menu governor additionally requires CONFIG_NO_HZ.
+
+The behavior and the effect of the disable variable depends on the
+implementation of a particular governor. In the ladder governor, for
+example, it is not coherent, i.e. if one is disabling a light state,
+then all deeper states are disabled as well. Likewise, if one enables a
+deep state but a lighter state still is disabled, then this has no effect.
+.RE
+.LP
+Disabling the Lightest Sleep State may not have any Affect
+
+.RS 4
+If criteria are not met to enter deeper sleep states and the lightest sleep
+state is chosen when idle, the kernel may still enter this sleep state,
+irrespective of whether it is disabled or not. This is also reflected in
+the usage count of the disabled sleep state when using the cpupower idle-info
+command.
+.RE
+.LP
+Selecting specific CPU Cores
+
+.RS 4
+By default processor sleep states of all CPU cores are set. Please refer
+to the cpupower(1) manpage in the \-\-cpu option section how to disable
+C-states of specific cores.
+.RE
+.SH "FILES"
+.nf
+\fI/sys/devices/system/cpu/cpu*/cpuidle/state*\fP
+\fI/sys/devices/system/cpu/cpuidle/*\fP
+.fi
+.SH "AUTHORS"
+.nf
+Thomas Renninger <trenn@suse.de>
+.fi
+.SH "SEE ALSO"
+.LP
+cpupower(1), cpupower\-monitor(1), cpupower\-info(1), cpupower\-set(1),
+cpupower\-idle\-info(1)
diff --git a/tools/power/cpupower/utils/helpers/sysfs.c b/tools/power/cpupower/utils/helpers/sysfs.c
index 5cdc600e8152..851c7a16ca49 100644
--- a/tools/power/cpupower/utils/helpers/sysfs.c
+++ b/tools/power/cpupower/utils/helpers/sysfs.c
@@ -278,7 +278,7 @@ static char *sysfs_idlestate_get_one_string(unsigned int cpu,
 int sysfs_is_idlestate_disabled(unsigned int cpu,
                                 unsigned int idlestate)
 {
-        if (sysfs_get_idlestate_count(cpu) < idlestate)
+        if (sysfs_get_idlestate_count(cpu) <= idlestate)
                 return -1;
 
         if (!sysfs_idlestate_file_exists(cpu, idlestate,
@@ -303,7 +303,7 @@ int sysfs_idlestate_disable(unsigned int cpu,
         char value[SYSFS_PATH_MAX];
         int bytes_written;
 
-        if (sysfs_get_idlestate_count(cpu) < idlestate)
+        if (sysfs_get_idlestate_count(cpu) <= idlestate)
                 return -1;
 
         if (!sysfs_idlestate_file_exists(cpu, idlestate,