490 files changed, 4880 insertions, 2579 deletions

diff --git a/Documentation/CodeOfConflict b/Documentation/CodeOfConflict
new file mode 100644
index 000000000000..1684d0b4efa6
--- /dev/null
+++ b/Documentation/CodeOfConflict
@@ -0,0 +1,27 @@
+Code of Conflict
+----------------
+
+The Linux kernel development effort is a very personal process compared
+to "traditional" ways of developing software.  Your code and ideas
+behind it will be carefully reviewed, often resulting in critique and
+criticism.  The review will almost always require improvements to the
+code before it can be included in the kernel.  Know that this happens
+because everyone involved wants to see the best possible solution for
+the overall success of Linux.  This development process has been proven
+to create the most robust operating system kernel ever, and we do not
+want to do anything to cause the quality of submission and eventual
+result to ever decrease.
+
+If however, anyone feels personally abused, threatened, or otherwise
+uncomfortable due to this process, that is not acceptable.  If so,
+please contact the Linux Foundation's Technical Advisory Board at
+<tab@lists.linux-foundation.org>, or the individual members, and they
+will work to resolve the issue to the best of their ability.  For more
+information on who is on the Technical Advisory Board and what their
+role is, please see:
+        http://www.linuxfoundation.org/programs/advisory-councils/tab
+
+As a reviewer of code, please strive to keep things civil and focused on
+the technical issues involved.  We are all humans, and frustrations can
+be high on both sides of the process.  Try to keep in mind the immortal
+words of Bill and Ted, "Be excellent to each other."
diff --git a/Documentation/cgroups/unified-hierarchy.txt b/Documentation/cgroups/unified-hierarchy.txt
index 71daa35ec2d9..eb102fb72213 100644
--- a/Documentation/cgroups/unified-hierarchy.txt
+++ b/Documentation/cgroups/unified-hierarchy.txt
@@ -404,8 +404,8 @@ supported and the interface files "release_agent" and
   be understood as an underflow into the highest possible value, -2 or
   -10M etc. do not work, so it's not consistent.
 
-  memory.low, memory.high, and memory.max will use the string
-  "infinity" to indicate and set the highest possible value.
+  memory.low, memory.high, and memory.max will use the string "max" to
+  indicate and set the highest possible value.
 
 5. Planned Changes
 
diff --git a/Documentation/devicetree/bindings/i2c/i2c-imx.txt b/Documentation/devicetree/bindings/i2c/i2c-imx.txt
index 52d37fd8d3e5..ce4311d726ae 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-imx.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-imx.txt
@@ -7,6 +7,7 @@ Required properties:
   - "fsl,vf610-i2c" for I2C compatible with the one integrated on Vybrid vf610 SoC
 - reg : Should contain I2C/HS-I2C registers location and length
 - interrupts : Should contain I2C/HS-I2C interrupt
+- clocks : Should contain the I2C/HS-I2C clock specifier
 
 Optional properties:
 - clock-frequency : Constains desired I2C/HS-I2C bus clock frequency in Hz.
diff --git a/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt b/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt
index 33df3932168e..8db32384a486 100644
--- a/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt
+++ b/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt
@@ -27,6 +27,8 @@ property is used.
 - amd,serdes-cdr-rate: CDR rate speed selection
 - amd,serdes-pq-skew: PQ (data sampling) skew
 - amd,serdes-tx-amp: TX amplitude boost
+- amd,serdes-dfe-tap-config: DFE taps available to run
+- amd,serdes-dfe-tap-enable: DFE taps to enable
 
 Example:
         xgbe_phy@e1240800 {
@@ -41,4 +43,6 @@ Example:
                 amd,serdes-cdr-rate = <2>, <2>, <7>;
                 amd,serdes-pq-skew = <10>, <10>, <30>;
                 amd,serdes-tx-amp = <15>, <15>, <10>;
+                amd,serdes-dfe-tap-config = <3>, <3>, <1>;
+                amd,serdes-dfe-tap-enable = <0>, <0>, <127>;
         };
diff --git a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt
index 7f76214f728a..289c40ed7470 100644
--- a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt
+++ b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt
@@ -21,6 +21,18 @@ Optional properties:
 - reg-io-width : the size (in bytes) of the IO accesses that should be
   performed on the device.  If this property is not present then single byte
   accesses are used.
+- dcd-override : Override the DCD modem status signal. This signal will always
+  be reported as active instead of being obtained from the modem status
+  register. Define this if your serial port does not use this pin.
+- dsr-override : Override the DTS modem status signal. This signal will always
+  be reported as active instead of being obtained from the modem status
+  register. Define this if your serial port does not use this pin.
+- cts-override : Override the CTS modem status signal. This signal will always
+  be reported as active instead of being obtained from the modem status
+  register. Define this if your serial port does not use this pin.
+- ri-override : Override the RI modem status signal. This signal will always be
+  reported as inactive instead of being obtained from the modem status register.
+  Define this if your serial port does not use this pin.
 
 Example:
 
@@ -31,6 +43,10 @@ Example:
                 interrupts = <10>;
                 reg-shift = <2>;
                 reg-io-width = <4>;
+                dcd-override;
+                dsr-override;
+                cts-override;
+                ri-override;
         };
 
 Example with one clock:
diff --git a/Documentation/filesystems/dlmfs.txt b/Documentation/filesystems/dlmfs.txt
index 1b528b2ad809..fcf4d509d118 100644
--- a/Documentation/filesystems/dlmfs.txt
+++ b/Documentation/filesystems/dlmfs.txt
@@ -5,8 +5,8 @@ system.
 
 dlmfs is built with OCFS2 as it requires most of its infrastructure.
 
-Project web page:    http://oss.oracle.com/projects/ocfs2
-Tools web page:      http://oss.oracle.com/projects/ocfs2-tools
+Project web page:    http://ocfs2.wiki.kernel.org
+Tools web page:      https://github.com/markfasheh/ocfs2-tools
 OCFS2 mailing lists: http://oss.oracle.com/projects/ocfs2/mailman/
 
 All code copyright 2005 Oracle except when otherwise noted.
diff --git a/Documentation/filesystems/ocfs2.txt b/Documentation/filesystems/ocfs2.txt
index 28f8c08201e2..4c49e5410595 100644
--- a/Documentation/filesystems/ocfs2.txt
+++ b/Documentation/filesystems/ocfs2.txt
@@ -8,8 +8,8 @@ also make it attractive for non-clustered use.
 You'll want to install the ocfs2-tools package in order to at least
 get "mount.ocfs2" and "ocfs2_hb_ctl".
 
-Project web page:    http://oss.oracle.com/projects/ocfs2
-Tools web page:      http://oss.oracle.com/projects/ocfs2-tools
+Project web page:    http://ocfs2.wiki.kernel.org
+Tools git tree:      https://github.com/markfasheh/ocfs2-tools
 OCFS2 mailing lists: http://oss.oracle.com/projects/ocfs2/mailman/
 
 All code copyright 2005 Oracle except when otherwise noted.
diff --git a/Documentation/power/suspend-and-interrupts.txt b/Documentation/power/suspend-and-interrupts.txt
index 2f9c5a5fcb25..8afb29a8604a 100644
--- a/Documentation/power/suspend-and-interrupts.txt
+++ b/Documentation/power/suspend-and-interrupts.txt
@@ -40,8 +40,10 @@ but also to IPIs and to some other special-purpose interrupts.
 
 The IRQF_NO_SUSPEND flag is used to indicate that to the IRQ subsystem when
 requesting a special-purpose interrupt.  It causes suspend_device_irqs() to
-leave the corresponding IRQ enabled so as to allow the interrupt to work all
-the time as expected.
+leave the corresponding IRQ enabled so as to allow the interrupt to work as
+expected during the suspend-resume cycle, but does not guarantee that the
+interrupt will wake the system from a suspended state -- for such cases it is
+necessary to use enable_irq_wake().
 
 Note that the IRQF_NO_SUSPEND flag affects the entire IRQ and not just one
 user of it.  Thus, if the IRQ is shared, all of the interrupt handlers installed
@@ -110,8 +112,9 @@ any special interrupt handling logic for it to work.
 IRQF_NO_SUSPEND and enable_irq_wake()
 -------------------------------------
 
-There are no valid reasons to use both enable_irq_wake() and the IRQF_NO_SUSPEND
-flag on the same IRQ.
+There are very few valid reasons to use both enable_irq_wake() and the
+IRQF_NO_SUSPEND flag on the same IRQ, and it is never valid to use both for the
+same device.
 
 First of all, if the IRQ is not shared, the rules for handling IRQF_NO_SUSPEND
 interrupts (interrupt handlers are invoked after suspend_device_irqs()) are
@@ -120,4 +123,13 @@ handlers are not invoked after suspend_device_irqs()).
 
 Second, both enable_irq_wake() and IRQF_NO_SUSPEND apply to entire IRQs and not
 to individual interrupt handlers, so sharing an IRQ between a system wakeup
-interrupt source and an IRQF_NO_SUSPEND interrupt source does not make sense.
+interrupt source and an IRQF_NO_SUSPEND interrupt source does not generally
+make sense.
+
+In rare cases an IRQ can be shared between a wakeup device driver and an
+IRQF_NO_SUSPEND user. In order for this to be safe, the wakeup device driver
+must be able to discern spurious IRQs from genuine wakeup events (signalling
+the latter to the core with pm_system_wakeup()), must use enable_irq_wake() to
+ensure that the IRQ will function as a wakeup source, and must request the IRQ
+with IRQF_COND_SUSPEND to tell the core that it meets these requirements. If
+these requirements are not met, it is not valid to use IRQF_COND_SUSPEND.
diff --git a/MAINTAINERS b/MAINTAINERS
index ddc5a8cf9a8a..6239a305dff0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2065,7 +2065,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <j.vosburgh@gmail.com>
 M:      Veaceslav Falico <vfalico@gmail.com>
-M:      Andy Gospodarek <andy@greyhouse.net>
+M:      Andy Gospodarek <gospo@cumulusnetworks.com>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
@@ -7213,8 +7213,7 @@ ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
 M:      Mark Fasheh <mfasheh@suse.com>
 M:      Joel Becker <jlbec@evilplan.org>
 L:      ocfs2-devel@oss.oracle.com (moderated for non-subscribers)
-W:      http://oss.oracle.com/projects/ocfs2/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2.git
+W:      http://ocfs2.wiki.kernel.org
 S:      Supported
 F:      Documentation/filesystems/ocfs2.txt
 F:      Documentation/filesystems/dlmfs.txt
@@ -8481,6 +8480,14 @@ S:	Supported
 L:      netdev@vger.kernel.org
 F:      drivers/net/ethernet/samsung/sxgbe/
 
+SAMSUNG THERMAL DRIVER
+M:      Lukasz Majewski <l.majewski@samsung.com>
+L:      linux-pm@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org
+S:      Supported
+T:      https://github.com/lmajewski/linux-samsung-thermal.git
+F:      drivers/thermal/samsung/
+
 SAMSUNG USB2 PHY DRIVER
 M:      Kamil Debski <k.debski@samsung.com>
 L:      linux-kernel@vger.kernel.org
diff --git a/Makefile b/Makefile
index 9fab639727c7..1100ff3c77e3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Hurr durr I'ma sheep
 
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h
index 4e547296831d..52312cb5dbe2 100644
--- a/arch/arc/include/asm/processor.h
+++ b/arch/arc/include/asm/processor.h
@@ -47,9 +47,6 @@ struct thread_struct {
 /* Forward declaration, a strange C thing */
 struct task_struct;
 
-/* Return saved PC of a blocked thread  */
-unsigned long thread_saved_pc(struct task_struct *t);
-
 #define task_pt_regs(p) \
         ((struct pt_regs *)(THREAD_SIZE + (void *)task_stack_page(p)) - 1)
 
@@ -72,18 +69,21 @@ unsigned long thread_saved_pc(struct task_struct *t);
 #define release_segments(mm)        do { } while (0)
 
 #define KSTK_EIP(tsk)   (task_pt_regs(tsk)->ret)
+#define KSTK_ESP(tsk)   (task_pt_regs(tsk)->sp)
 
 /*
  * Where abouts of Task's sp, fp, blink when it was last seen in kernel mode.
  * Look in process.c for details of kernel stack layout
  */
-#define KSTK_ESP(tsk)   (tsk->thread.ksp)
+#define TSK_K_ESP(tsk)          (tsk->thread.ksp)
 
-#define KSTK_REG(tsk, off)      (*((unsigned int *)(KSTK_ESP(tsk) + \
+#define TSK_K_REG(tsk, off)     (*((unsigned int *)(TSK_K_ESP(tsk) + \
                                         sizeof(struct callee_regs) + off)))
 
-#define KSTK_BLINK(tsk) KSTK_REG(tsk, 4)
-#define KSTK_FP(tsk)    KSTK_REG(tsk, 0)
+#define TSK_K_BLINK(tsk)        TSK_K_REG(tsk, 4)
+#define TSK_K_FP(tsk)           TSK_K_REG(tsk, 0)
+
+#define thread_saved_pc(tsk)    TSK_K_BLINK(tsk)
 
 extern void start_thread(struct pt_regs * regs, unsigned long pc,
                          unsigned long usp);
diff --git a/arch/arc/include/asm/stacktrace.h b/arch/arc/include/asm/stacktrace.h
new file mode 100644
index 000000000000..b29b6064ea14
--- /dev/null
+++ b/arch/arc/include/asm/stacktrace.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2014-15 Synopsys, Inc. (www.synopsys.com)
+ * Copyright (C) 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __ASM_STACKTRACE_H
+#define __ASM_STACKTRACE_H
+
+#include <linux/sched.h>
+
+/**
+ * arc_unwind_core - Unwind the kernel mode stack for an execution context
+ * @tsk:                NULL for current task, specific task otherwise
+ * @regs:               pt_regs used to seed the unwinder {SP, FP, BLINK, PC}
+ *                      If NULL, use pt_regs of @tsk (if !NULL) otherwise
+ *                      use the current values of {SP, FP, BLINK, PC}
+ * @consumer_fn:        Callback invoked for each frame unwound
+ *                      Returns 0 to continue unwinding, -1 to stop
+ * @arg:                Arg to callback
+ *
+ * Returns the address of first function in stack
+ *
+ * Semantics:
+ *  - synchronous unwinding (e.g. dump_stack): @tsk  NULL, @regs  NULL
+ *  - Asynchronous unwinding of sleeping task: @tsk !NULL, @regs  NULL
+ *  - Asynchronous unwinding of intr/excp etc: @tsk !NULL, @regs !NULL
+ */
+notrace noinline unsigned int arc_unwind_core(
+        struct task_struct *tsk, struct pt_regs *regs,
+        int (*consumer_fn) (unsigned int, void *),
+        void *arg);
+
+#endif /* __ASM_STACKTRACE_H */
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index fdd89715d2d3..98c00a2d4dd9 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -192,29 +192,6 @@ int dump_fpu(struct pt_regs *regs, elf_fpregset_t *fpu)
         return 0;
 }
 
-/*
- * API: expected by schedular Code: If thread is sleeping where is that.
- * What is this good for? it will be always the scheduler or ret_from_fork.
- * So we hard code that anyways.
- */
-unsigned long thread_saved_pc(struct task_struct *t)
-{
-        struct pt_regs *regs = task_pt_regs(t);
-        unsigned long blink = 0;
-
-        /*
-         * If the thread being queried for in not itself calling this, then it
-         * implies it is not executing, which in turn implies it is sleeping,
-         * which in turn implies it got switched OUT by the schedular.
-         * In that case, it's kernel mode blink can reliably retrieved as per
-         * the picture above (right above pt_regs).
-         */
-        if (t != current && t->state != TASK_RUNNING)
-                blink = *((unsigned int *)regs - 1);
-
-        return blink;
-}
-
 int elf_check_arch(const struct elf32_hdr *x)
 {
         unsigned int eflags;
diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index 9ce47cfe2303..92320d6f737c 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -43,6 +43,10 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
                                    struct pt_regs *regs,
                                    struct unwind_frame_info *frame_info)
 {
+        /*
+         * synchronous unwinding (e.g. dump_stack)
+         *  - uses current values of SP and friends
+         */
         if (tsk == NULL && regs == NULL) {
                 unsigned long fp, sp, blink, ret;
                 frame_info->task = current;
@@ -61,12 +65,17 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
                 frame_info->regs.r63 = ret;
                 frame_info->call_frame = 0;
         } else if (regs == NULL) {
+                /*
+                 * Asynchronous unwinding of sleeping task
+                 *  - Gets SP etc from task's pt_regs (saved bottom of kernel
+                 *    mode stack of task)
+                 */
 
                 frame_info->task = tsk;
 
-                frame_info->regs.r27 = KSTK_FP(tsk);
-                frame_info->regs.r28 = KSTK_ESP(tsk);
-                frame_info->regs.r31 = KSTK_BLINK(tsk);
+                frame_info->regs.r27 = TSK_K_FP(tsk);
+                frame_info->regs.r28 = TSK_K_ESP(tsk);
+                frame_info->regs.r31 = TSK_K_BLINK(tsk);
                 frame_info->regs.r63 = (unsigned int)__switch_to;
 
                 /* In the prologue of __switch_to, first FP is saved on stack
@@ -83,6 +92,10 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
                 frame_info->call_frame = 0;
 
         } else {
+                /*
+                 * Asynchronous unwinding of intr/exception
+                 *  - Just uses the pt_regs passed
+                 */
                 frame_info->task = tsk;
 
                 frame_info->regs.r27 = regs->fp;
@@ -95,7 +108,7 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
 
 #endif
 
-static noinline unsigned int
+notrace noinline unsigned int
 arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
                 int (*consumer_fn) (unsigned int, void *), void *arg)
 {
diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
index 7ff5b5c183bb..74db59b6f392 100644
--- a/arch/arc/kernel/unaligned.c
+++ b/arch/arc/kernel/unaligned.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/perf_event.h>
 #include <linux/ptrace.h>
 #include <linux/uaccess.h>
 #include <asm/disasm.h>
@@ -253,6 +254,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
                 }
         }
 
+        perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, address);
         return 0;
 
 fault:
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index 563cb27e37f5..6a2e006cbcce 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -14,6 +14,7 @@
 #include <linux/ptrace.h>
 #include <linux/uaccess.h>
 #include <linux/kdebug.h>
+#include <linux/perf_event.h>
 #include <asm/pgalloc.h>
 #include <asm/mmu.h>
 
@@ -139,13 +140,20 @@ good_area:
                         return;
         }
 
+        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
+
         if (likely(!(fault & VM_FAULT_ERROR))) {
                 if (flags & FAULT_FLAG_ALLOW_RETRY) {
                         /* To avoid updating stats twice for retry case */
-                        if (fault & VM_FAULT_MAJOR)
+                        if (fault & VM_FAULT_MAJOR) {
                                 tsk->maj_flt++;
-                        else
+                                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
+                                              regs, address);
+                        } else {
                                 tsk->min_flt++;
+                                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
+                                              regs, address);
+                        }
 
                         if (fault & VM_FAULT_RETRY) {
                                 flags &= ~FAULT_FLAG_ALLOW_RETRY;
diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
index 6cc25ed912ee..2c6248d9a9ef 100644
--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
@@ -195,6 +195,7 @@
 
 &usb0 {
         status = "okay";
+        dr_mode = "peripheral";
 };
 
 &usb1 {
diff --git a/arch/arm/boot/dts/am437x-idk-evm.dts b/arch/arm/boot/dts/am437x-idk-evm.dts
index f9a17e2ca8cb..0198f5a62b96 100644
--- a/arch/arm/boot/dts/am437x-idk-evm.dts
+++ b/arch/arm/boot/dts/am437x-idk-evm.dts
@@ -133,20 +133,6 @@
                 >;
         };
 
-        i2c1_pins_default: i2c1_pins_default {
-                pinctrl-single,pins = <
-                        0x15c (PIN_INPUT | SLEWCTRL_FAST | MUX_MODE2) /* spi0_cs0.i2c1_scl */
-                        0x158 (PIN_INPUT | SLEWCTRL_FAST | MUX_MODE2) /* spi0_d1.i2c1_sda */
-                >;
-        };
-
-        i2c1_pins_sleep: i2c1_pins_sleep {
-                pinctrl-single,pins = <
-                        0x15c (PIN_INPUT_PULLDOWN | MUX_MODE7) /* spi0_cs0.i2c1_scl */
-                        0x158 (PIN_INPUT_PULLDOWN | MUX_MODE7) /* spi0_d1.i2c1_sda */
-                >;
-        };
-
         mmc1_pins_default: pinmux_mmc1_pins_default {
                 pinctrl-single,pins = <
                         0x100 (PIN_INPUT | MUX_MODE0) /* mmc0_clk.mmc0_clk */
@@ -254,7 +240,7 @@
         status = "okay";
         pinctrl-names = "default", "sleep";
         pinctrl-0 = <&i2c0_pins_default>;
-        pinctrl-1 = <&i2c0_pins_default>;
+        pinctrl-1 = <&i2c0_pins_sleep>;
         clock-frequency = <400000>;
 
         at24@50 {
@@ -262,17 +248,10 @@
                 pagesize = <64>;
                 reg = <0x50>;
         };
-};
-
-&i2c1 {
-        status = "okay";
-        pinctrl-names = "default", "sleep";
-        pinctrl-0 = <&i2c1_pins_default>;
-        pinctrl-1 = <&i2c1_pins_default>;
-        clock-frequency = <400000>;
 
         tps: tps62362@60 {
                 compatible = "ti,tps62362";
+                reg = <0x60>;
                 regulator-name = "VDD_MPU";
                 regulator-min-microvolt = <950000>;
                 regulator-max-microvolt = <1330000>;
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
index 03750af3b49a..6463f9ef2b54 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
@@ -549,14 +549,6 @@
         pinctrl-0 = <&usb1_pins>;
 };
 
-&omap_dwc3_1 {
-        extcon = <&extcon_usb1>;
-};
-
-&omap_dwc3_2 {
-        extcon = <&extcon_usb2>;
-};
-
 &usb2 {
         dr_mode = "peripheral";
 };
diff --git a/arch/arm/boot/dts/dm8168-evm.dts b/arch/arm/boot/dts/dm8168-evm.dts
index 857d0289ad4d..d3a29c1b8417 100644
--- a/arch/arm/boot/dts/dm8168-evm.dts
+++ b/arch/arm/boot/dts/dm8168-evm.dts
@@ -35,6 +35,18 @@
                         DM816X_IOPAD(0x0aac, PIN_INPUT | MUX_MODE0)     /* SPI_D1 */
                 >;
         };
+
+        usb0_pins: pinmux_usb0_pins {
+                pinctrl-single,pins = <
+                        DM816X_IOPAD(0x0d00, MUX_MODE0)                 /* USB0_DRVVBUS */
+                >;
+        };
+
+        usb1_pins: pinmux_usb0_pins {
+                pinctrl-single,pins = <
+                        DM816X_IOPAD(0x0d04, MUX_MODE0)                 /* USB1_DRVVBUS */
+                >;
+        };
 };
 
 &i2c1 {
@@ -127,3 +139,16 @@
 &mmc1 {
         vmmc-supply = <&vmmcsd_fixed>;
 };
+
+/* At least dm8168-evm rev c won't support multipoint, later may */
+&usb0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&usb0_pins>;
+        mentor,multipoint = <0>;
+};
+
+&usb1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&usb1_pins>;
+        mentor,multipoint = <0>;
+};
diff --git a/arch/arm/boot/dts/dm816x.dtsi b/arch/arm/boot/dts/dm816x.dtsi
index d98d0f7de380..3c97b5f2addc 100644
--- a/arch/arm/boot/dts/dm816x.dtsi
+++ b/arch/arm/boot/dts/dm816x.dtsi
@@ -97,10 +97,31 @@
 
                         /* Device Configuration Registers */
                         scm_conf: syscon@600 {
-                                compatible = "syscon";
+                                compatible = "syscon", "simple-bus";
                                 reg = <0x600 0x110>;
                                 #address-cells = <1>;
                                 #size-cells = <1>;
+                                ranges = <0 0x600 0x110>;
+
+                                usb_phy0: usb-phy@20 {
+                                        compatible = "ti,dm8168-usb-phy";
+                                        reg = <0x20 0x8>;
+                                        reg-names = "phy";
+                                        clocks = <&main_fapll 6>;
+                                        clock-names = "refclk";
+                                        #phy-cells = <0>;
+                                        syscon = <&scm_conf>;
+                                };
+
+                                usb_phy1: usb-phy@28 {
+                                        compatible = "ti,dm8168-usb-phy";
+                                        reg = <0x28 0x8>;
+                                        reg-names = "phy";
+                                        clocks = <&main_fapll 6>;
+                                        clock-names = "refclk";
+                                        #phy-cells = <0>;
+                                        syscon = <&scm_conf>;
+                                };
                         };
 
                         scrm_clocks: clocks {
@@ -357,7 +378,10 @@
                                 reg-names = "mc", "control";
                                 interrupts = <18>;
                                 interrupt-names = "mc";
-                                dr_mode = "otg";
+                                dr_mode = "host";
+                                interface-type = <0>;
+                                phys = <&usb_phy0>;
+                                phy-names = "usb2-phy";
                                 mentor,multipoint = <1>;
                                 mentor,num-eps = <16>;
                                 mentor,ram-bits = <12>;
@@ -366,13 +390,15 @@
 
                         usb1: usb@47401800 {
                                 compatible = "ti,musb-am33xx";
-                                status = "disabled";
                                 reg = <0x47401c00 0x400
                                        0x47401800 0x200>;
                                 reg-names = "mc", "control";
                                 interrupts = <19>;
                                 interrupt-names = "mc";
-                                dr_mode = "otg";
+                                dr_mode = "host";
+                                interface-type = <0>;
+                                phys = <&usb_phy1>;
+                                phy-names = "usb2-phy";
                                 mentor,multipoint = <1>;
                                 mentor,num-eps = <16>;
                                 mentor,ram-bits = <12>;
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 746cddb1b8f5..3290a96ba586 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -543,14 +543,6 @@
         };
 };
 
-&omap_dwc3_1 {
-        extcon = <&extcon_usb1>;
-};
-
-&omap_dwc3_2 {
-        extcon = <&extcon_usb2>;
-};
-
 &usb1 {
         dr_mode = "peripheral";
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 5827fedafd43..127608d79033 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -249,8 +249,8 @@
                                      <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <127>;
+                        dma-channels = <32>;
+                        dma-requests = <127>;
                 };
 
                 gpio1: gpio@4ae10000 {
@@ -1090,8 +1090,8 @@
                                       <0x4A096800 0x40>; /* pll_ctrl */
                                 reg-names = "phy_rx", "phy_tx", "pll_ctrl";
                                 ctrl-module = <&omap_control_sata>;
-                                clocks = <&sys_clkin1>;
-                                clock-names = "sysclk";
+                                clocks = <&sys_clkin1>, <&sata_ref_clk>;
+                                clock-names = "sysclk", "refclk";
                                 #phy-cells = <0>;
                         };
 
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index 4d8711713610..e0264d0bf7b9 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -380,14 +380,6 @@
         phy-supply = <&ldo4_reg>;
 };
 
-&omap_dwc3_1 {
-        extcon = <&extcon_usb1>;
-};
-
-&omap_dwc3_2 {
-        extcon = <&extcon_usb2>;
-};
-
 &usb1 {
         dr_mode = "peripheral";
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/omap2.dtsi b/arch/arm/boot/dts/omap2.dtsi
index 59d1c297bb30..578fa2a54dce 100644
--- a/arch/arm/boot/dts/omap2.dtsi
+++ b/arch/arm/boot/dts/omap2.dtsi
@@ -87,8 +87,8 @@
                                      <14>,
                                      <15>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <64>;
+                        dma-channels = <32>;
+                        dma-requests = <64>;
                 };
 
                 i2c1: i2c@48070000 {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 60403273f83e..db80f9d376fa 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -16,6 +16,13 @@
         model = "Nokia N900";
         compatible = "nokia,omap3-n900", "ti,omap3430", "ti,omap3";
 
+        aliases {
+                i2c0;
+                i2c1 = &i2c1;
+                i2c2 = &i2c2;
+                i2c3 = &i2c3;
+        };
+
         cpus {
                 cpu@0 {
                         cpu0-supply = <&vcc>;
@@ -704,7 +711,7 @@
                 compatible = "smsc,lan91c94";
                 interrupt-parent = <&gpio2>;
                 interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;  /* gpio54 */
-                reg = <1 0x300 0xf>;            /* 16 byte IO range at offset 0x300 */
+                reg = <1 0 0xf>;                /* 16 byte IO range */
                 bank-width = <2>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&ethernet_pins>;
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 01b71111bd55..f4f78c40b564 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -155,8 +155,8 @@
                                      <14>,
                                      <15>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <96>;
+                        dma-channels = <32>;
+                        dma-requests = <96>;
                 };
 
                 omap3_pmx_core: pinmux@48002030 {
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 074147cebae4..87401d9f4d8b 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -223,8 +223,8 @@
                                      <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <127>;
+                        dma-channels = <32>;
+                        dma-requests = <127>;
                 };
 
                 gpio1: gpio@4a310000 {
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index b321fdf42c9f..ddff674bd05e 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -238,8 +238,8 @@
                                      <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <127>;
+                        dma-channels = <32>;
+                        dma-requests = <127>;
                 };
 
                 gpio1: gpio@4ae10000 {
@@ -929,8 +929,8 @@
                                       <0x4A096800 0x40>; /* pll_ctrl */
                                 reg-names = "phy_rx", "phy_tx", "pll_ctrl";
                                 ctrl-module = <&omap_control_sata>;
-                                clocks = <&sys_clkin>;
-                                clock-names = "sysclk";
+                                clocks = <&sys_clkin>, <&sata_ref_clk>;
+                                clock-names = "sysclk", "refclk";
                                 #phy-cells = <0>;
                         };
                 };
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index e8a4c955241b..b7e6b6fba5e0 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -62,6 +62,17 @@ CONFIG_MACH_SPEAR1340=y
 CONFIG_ARCH_STI=y
 CONFIG_ARCH_EXYNOS=y
 CONFIG_EXYNOS5420_MCPM=y
+CONFIG_ARCH_SHMOBILE_MULTI=y
+CONFIG_ARCH_EMEV2=y
+CONFIG_ARCH_R7S72100=y
+CONFIG_ARCH_R8A73A4=y
+CONFIG_ARCH_R8A7740=y
+CONFIG_ARCH_R8A7779=y
+CONFIG_ARCH_R8A7790=y
+CONFIG_ARCH_R8A7791=y
+CONFIG_ARCH_R8A7794=y
+CONFIG_ARCH_SH73A0=y
+CONFIG_MACH_MARZEN=y
 CONFIG_ARCH_SUNXI=y
 CONFIG_ARCH_SIRF=y
 CONFIG_ARCH_TEGRA=y
@@ -84,6 +95,8 @@ CONFIG_PCI_KEYSTONE=y
 CONFIG_PCI_MSI=y
 CONFIG_PCI_MVEBU=y
 CONFIG_PCI_TEGRA=y
+CONFIG_PCI_RCAR_GEN2=y
+CONFIG_PCI_RCAR_GEN2_PCIE=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=8
@@ -130,6 +143,7 @@ CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=64
 CONFIG_OMAP_OCP2SCP=y
+CONFIG_SIMPLE_PM_BUS=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_BLOCK=y
@@ -157,6 +171,7 @@ CONFIG_AHCI_SUNXI=y
 CONFIG_AHCI_TEGRA=y
 CONFIG_SATA_HIGHBANK=y
 CONFIG_SATA_MV=y
+CONFIG_SATA_RCAR=y
 CONFIG_NETDEVICES=y
 CONFIG_HIX5HD2_GMAC=y
 CONFIG_SUN4I_EMAC=y
@@ -167,14 +182,17 @@ CONFIG_MV643XX_ETH=y
 CONFIG_MVNETA=y
 CONFIG_KS8851=y
 CONFIG_R8169=y
+CONFIG_SH_ETH=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=y
 CONFIG_TI_CPSW=y
 CONFIG_XILINX_EMACLITE=y
 CONFIG_AT803X_PHY=y
 CONFIG_MARVELL_PHY=y
+CONFIG_SMSC_PHY=y
 CONFIG_BROADCOM_PHY=y
 CONFIG_ICPLUS_PHY=y
+CONFIG_MICREL_PHY=y
 CONFIG_USB_PEGASUS=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC75XX=y
@@ -192,15 +210,18 @@ CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_MOUSE_PS2_ELANTECH=y
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_TOUCHSCREEN_ATMEL_MXT=y
+CONFIG_TOUCHSCREEN_ST1232=m
 CONFIG_TOUCHSCREEN_STMPE=y
 CONFIG_TOUCHSCREEN_SUN4I=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_MPU3050=y
 CONFIG_INPUT_AXP20X_PEK=y
+CONFIG_INPUT_ADXL34X=m
 CONFIG_SERIO_AMBAKMI=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_EM=y
 CONFIG_SERIAL_8250_MT6577=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
@@ -213,6 +234,9 @@ CONFIG_SERIAL_SIRFSOC_CONSOLE=y
 CONFIG_SERIAL_TEGRA=y
 CONFIG_SERIAL_IMX=y
 CONFIG_SERIAL_IMX_CONSOLE=y
+CONFIG_SERIAL_SH_SCI=y
+CONFIG_SERIAL_SH_SCI_NR_UARTS=20
+CONFIG_SERIAL_SH_SCI_CONSOLE=y
 CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SERIAL_VT8500=y
@@ -233,19 +257,26 @@ CONFIG_I2C_MUX_PCA954x=y
 CONFIG_I2C_MUX_PINCTRL=y
 CONFIG_I2C_CADENCE=y
 CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_GPIO=m
 CONFIG_I2C_EXYNOS5=y
 CONFIG_I2C_MV64XXX=y
+CONFIG_I2C_RIIC=y
 CONFIG_I2C_S3C2410=y
+CONFIG_I2C_SH_MOBILE=y
 CONFIG_I2C_SIRF=y
-CONFIG_I2C_TEGRA=y
 CONFIG_I2C_ST=y
-CONFIG_SPI=y
+CONFIG_I2C_TEGRA=y
 CONFIG_I2C_XILINX=y
-CONFIG_SPI_DAVINCI=y
+CONFIG_I2C_RCAR=y
+CONFIG_SPI=y
 CONFIG_SPI_CADENCE=y
+CONFIG_SPI_DAVINCI=y
 CONFIG_SPI_OMAP24XX=y
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
+CONFIG_SPI_RSPI=y
+CONFIG_SPI_SH_MSIOF=m
+CONFIG_SPI_SH_HSPI=y
 CONFIG_SPI_SIRF=y
 CONFIG_SPI_SUN4I=y
 CONFIG_SPI_SUN6I=y
@@ -259,12 +290,15 @@ CONFIG_PINCTRL_PALMAS=y
 CONFIG_PINCTRL_APQ8084=y
 CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_GENERIC_PLATFORM=y
-CONFIG_GPIO_DWAPB=y
 CONFIG_GPIO_DAVINCI=y
+CONFIG_GPIO_DWAPB=y
+CONFIG_GPIO_EM=y
+CONFIG_GPIO_RCAR=y
 CONFIG_GPIO_XILINX=y
 CONFIG_GPIO_ZYNQ=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_PCF857X=y
 CONFIG_GPIO_TWL4030=y
 CONFIG_GPIO_PALMAS=y
 CONFIG_GPIO_SYSCON=y
@@ -276,10 +310,12 @@ CONFIG_POWER_RESET_AS3722=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_POWER_RESET_KEYSTONE=y
 CONFIG_POWER_RESET_SUN6I=y
+CONFIG_POWER_RESET_RMOBILE=y
 CONFIG_SENSORS_LM90=y
 CONFIG_SENSORS_LM95245=y
 CONFIG_THERMAL=y
 CONFIG_CPU_THERMAL=y
+CONFIG_RCAR_THERMAL=y
 CONFIG_ARMADA_THERMAL=y
 CONFIG_DAVINCI_WATCHDOG
 CONFIG_ST_THERMAL_SYSCFG=y
@@ -290,6 +326,7 @@ CONFIG_ARM_SP805_WATCHDOG=y
 CONFIG_ORION_WATCHDOG=y
 CONFIG_SUNXI_WATCHDOG=y
 CONFIG_MESON_WATCHDOG=y
+CONFIG_MFD_AS3711=y
 CONFIG_MFD_AS3722=y
 CONFIG_MFD_BCM590XX=y
 CONFIG_MFD_AXP20X=y
@@ -304,13 +341,16 @@ CONFIG_MFD_TPS65090=y
 CONFIG_MFD_TPS6586X=y
 CONFIG_MFD_TPS65910=y
 CONFIG_REGULATOR_AB8500=y
+CONFIG_REGULATOR_AS3711=y
 CONFIG_REGULATOR_AS3722=y
 CONFIG_REGULATOR_AXP20X=y
 CONFIG_REGULATOR_BCM590XX=y
+CONFIG_REGULATOR_DA9210=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_MFD_SYSCON=y
 CONFIG_POWER_RESET_SYSCON=y
 CONFIG_REGULATOR_MAX8907=y
+CONFIG_REGULATOR_MAX8973=y
 CONFIG_REGULATOR_MAX77686=y
 CONFIG_REGULATOR_PALMAS=y
 CONFIG_REGULATOR_S2MPS11=y
@@ -324,18 +364,32 @@ CONFIG_REGULATOR_TWL4030=y
 CONFIG_REGULATOR_VEXPRESS=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
 CONFIG_MEDIA_USB_SUPPORT=y
 CONFIG_USB_VIDEO_CLASS=y
 CONFIG_USB_GSPCA=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_SOC_CAMERA=m
+CONFIG_SOC_CAMERA_PLATFORM=m
+CONFIG_VIDEO_RCAR_VIN=m
+CONFIG_V4L_MEM2MEM_DRIVERS=y
+CONFIG_VIDEO_RENESAS_VSP1=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_ADV7180=m
 CONFIG_DRM=y
+CONFIG_DRM_RCAR_DU=m
 CONFIG_DRM_TEGRA=y
 CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_FB_ARMCLCD=y
 CONFIG_FB_WM8505=y
+CONFIG_FB_SH_MOBILE_LCDC=y
 CONFIG_FB_SIMPLE=y
+CONFIG_FB_SH_MOBILE_MERAM=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_BACKLIGHT_PWM=y
+CONFIG_BACKLIGHT_AS3711=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_SOUND=y
@@ -343,6 +397,8 @@ CONFIG_SND=y
 CONFIG_SND_DYNAMIC_MINORS=y
 CONFIG_SND_USB_AUDIO=y
 CONFIG_SND_SOC=y
+CONFIG_SND_SOC_SH4_FSI=m
+CONFIG_SND_SOC_RCAR=m
 CONFIG_SND_SOC_TEGRA=y
 CONFIG_SND_SOC_TEGRA_RT5640=y
 CONFIG_SND_SOC_TEGRA_WM8753=y
@@ -350,6 +406,8 @@ CONFIG_SND_SOC_TEGRA_WM8903=y
 CONFIG_SND_SOC_TEGRA_TRIMSLICE=y
 CONFIG_SND_SOC_TEGRA_ALC5632=y
 CONFIG_SND_SOC_TEGRA_MAX98090=y
+CONFIG_SND_SOC_AK4642=m
+CONFIG_SND_SOC_WM8978=m
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MVEBU=y
@@ -362,6 +420,8 @@ CONFIG_USB_ISP1760_HCD=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_STI=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_R8A66597_HCD=m
+CONFIG_USB_RENESAS_USBHS=m
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC3=y
 CONFIG_USB_CHIPIDEA=y
@@ -374,6 +434,10 @@ CONFIG_SAMSUNG_USB3PHY=y
 CONFIG_USB_GPIO_VBUS=y
 CONFIG_USB_ISP1301=y
 CONFIG_USB_MXS_PHY=y
+CONFIG_USB_RCAR_PHY=m
+CONFIG_USB_RCAR_GEN2_PHY=m
+CONFIG_USB_GADGET=y
+CONFIG_USB_RENESAS_USBHS_UDC=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=16
 CONFIG_MMC_ARMMMCI=y
@@ -392,12 +456,14 @@ CONFIG_MMC_SDHCI_ST=y
 CONFIG_MMC_OMAP=y
 CONFIG_MMC_OMAP_HS=y
 CONFIG_MMC_MVSDIO=y
-CONFIG_MMC_SUNXI=y
+CONFIG_MMC_SDHI=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_IDMAC=y
 CONFIG_MMC_DW_PLTFM=y
 CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_MMC_SH_MMCIF=y
+CONFIG_MMC_SUNXI=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
@@ -421,10 +487,12 @@ CONFIG_RTC_DRV_AS3722=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_RTC_DRV_MAX8907=y
 CONFIG_RTC_DRV_MAX77686=y
+CONFIG_RTC_DRV_RS5C372=m
 CONFIG_RTC_DRV_PALMAS=y
 CONFIG_RTC_DRV_TWL4030=y
 CONFIG_RTC_DRV_TPS6586X=y
 CONFIG_RTC_DRV_TPS65910=y
+CONFIG_RTC_DRV_S35390A=m
 CONFIG_RTC_DRV_EM3027=y
 CONFIG_RTC_DRV_PL031=y
 CONFIG_RTC_DRV_VT8500=y
@@ -436,6 +504,9 @@ CONFIG_DMADEVICES=y
 CONFIG_DW_DMAC=y
 CONFIG_MV_XOR=y
 CONFIG_TEGRA20_APB_DMA=y
+CONFIG_SH_DMAE=y
+CONFIG_RCAR_AUDMAC_PP=m
+CONFIG_RCAR_DMAC=y
 CONFIG_STE_DMA40=y
 CONFIG_SIRF_DMA=y
 CONFIG_TI_EDMA=y
@@ -468,6 +539,7 @@ CONFIG_IIO=y
 CONFIG_XILINX_XADC=y
 CONFIG_AK8975=y
 CONFIG_PWM=y
+CONFIG_PWM_RENESAS_TPU=y
 CONFIG_PWM_TEGRA=y
 CONFIG_PWM_VT8500=y
 CONFIG_PHY_HIX5HD2_SATA=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index b7386524c356..a097cffa1231 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -114,6 +114,7 @@ CONFIG_MTD_PHYSMAP_OF=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_ECC_BCH=y
 CONFIG_MTD_NAND_OMAP2=y
+CONFIG_MTD_NAND_OMAP_BCH=y
 CONFIG_MTD_ONENAND=y
 CONFIG_MTD_ONENAND_VERIFY_WRITE=y
 CONFIG_MTD_ONENAND_OMAP2=y
@@ -248,6 +249,7 @@ CONFIG_TWL6040_CORE=y
 CONFIG_REGULATOR_PALMAS=y
 CONFIG_REGULATOR_PBIAS=y
 CONFIG_REGULATOR_TI_ABB=y
+CONFIG_REGULATOR_TPS62360=m
 CONFIG_REGULATOR_TPS65023=y
 CONFIG_REGULATOR_TPS6507X=y
 CONFIG_REGULATOR_TPS65217=y
@@ -374,7 +376,7 @@ CONFIG_PWM_TIEHRPWM=m
 CONFIG_PWM_TWL=m
 CONFIG_PWM_TWL_LED=m
 CONFIG_OMAP_USB2=m
-CONFIG_TI_PIPE3=m
+CONFIG_TI_PIPE3=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index 37ca2a4c6f09..bf0fe99e8ca9 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -207,7 +207,7 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
 
         bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached;
 
-        VM_BUG_ON(size & PAGE_MASK);
+        VM_BUG_ON(size & ~PAGE_MASK);
 
         if (!need_flush && !icache_is_pipt())
                 goto vipt_cache;
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 07e7eb1d7ab6..5560f74f9eee 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -540,7 +540,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
 
                 vcpu->mode = OUTSIDE_GUEST_MODE;
                 kvm_guest_exit();
-                trace_kvm_exit(*vcpu_pc(vcpu));
+                trace_kvm_exit(kvm_vcpu_trap_get_class(vcpu), *vcpu_pc(vcpu));
                 /*
                  * We may have taken a host interrupt in HYP mode (ie
                  * while executing the guest). This interrupt is still
diff --git a/arch/arm/kvm/trace.h b/arch/arm/kvm/trace.h
index 881874b1a036..6817664b46b8 100644
--- a/arch/arm/kvm/trace.h
+++ b/arch/arm/kvm/trace.h
@@ -25,18 +25,22 @@ TRACE_EVENT(kvm_entry,
 );
 
 TRACE_EVENT(kvm_exit,
-        TP_PROTO(unsigned long vcpu_pc),
-        TP_ARGS(vcpu_pc),
+        TP_PROTO(unsigned int exit_reason, unsigned long vcpu_pc),
+        TP_ARGS(exit_reason, vcpu_pc),
 
         TP_STRUCT__entry(
+                __field(        unsigned int,   exit_reason     )
                 __field(        unsigned long,  vcpu_pc         )
         ),
 
         TP_fast_assign(
+                __entry->exit_reason            = exit_reason;
                 __entry->vcpu_pc                = vcpu_pc;
         ),
 
-        TP_printk("PC: 0x%08lx", __entry->vcpu_pc)
+        TP_printk("HSR_EC: 0x%04x, PC: 0x%08lx",
+                  __entry->exit_reason,
+                  __entry->vcpu_pc)
 );
 
 TRACE_EVENT(kvm_guest_fault,
diff --git a/arch/arm/mach-asm9260/Kconfig b/arch/arm/mach-asm9260/Kconfig
index 8423be76080e..52241207a82a 100644
--- a/arch/arm/mach-asm9260/Kconfig
+++ b/arch/arm/mach-asm9260/Kconfig
@@ -2,5 +2,7 @@ config MACH_ASM9260
         bool "Alphascale ASM9260"
         depends on ARCH_MULTI_V5
         select CPU_ARM926T
+        select ASM9260_TIMER
+        select GENERIC_CLOCKEVENTS
         help
           Support for Alphascale ASM9260 based platform.
diff --git a/arch/arm/mach-msm/board-halibut.c b/arch/arm/mach-msm/board-halibut.c
index 61bfe584a9d7..fc832040c6e9 100644
--- a/arch/arm/mach-msm/board-halibut.c
+++ b/arch/arm/mach-msm/board-halibut.c
@@ -20,6 +20,7 @@
 #include <linux/input.h>
 #include <linux/io.h>
 #include <linux/delay.h>
+#include <linux/smc91x.h>
 
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -46,15 +47,20 @@ static struct resource smc91x_resources[] = {
         [1] = {
                 .start  = MSM_GPIO_TO_INT(49),
                 .end    = MSM_GPIO_TO_INT(49),
-                .flags  = IORESOURCE_IRQ,
+                .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
         },
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static struct platform_device *devices[] __initdata = {
diff --git a/arch/arm/mach-msm/board-qsd8x50.c b/arch/arm/mach-msm/board-qsd8x50.c
index 4c748616ef47..10016a3bc698 100644
--- a/arch/arm/mach-msm/board-qsd8x50.c
+++ b/arch/arm/mach-msm/board-qsd8x50.c
@@ -22,6 +22,7 @@
 #include <linux/usb/msm_hsusb.h>
 #include <linux/err.h>
 #include <linux/clkdev.h>
+#include <linux/smc91x.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
@@ -49,15 +50,20 @@ static struct resource smc91x_resources[] = {
                 .flags = IORESOURCE_MEM,
         },
         [1] = {
-                .flags = IORESOURCE_IRQ,
+                .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
         },
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static int __init msm_init_smc91x(void)
diff --git a/arch/arm/mach-pxa/idp.c b/arch/arm/mach-pxa/idp.c
index 343c4e3a7c5d..7d8eab857a93 100644
--- a/arch/arm/mach-pxa/idp.c
+++ b/arch/arm/mach-pxa/idp.c
@@ -81,11 +81,16 @@ static struct resource smc91x_resources[] = {
         }
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_32BIT | SMC91X_USE_DMA | SMC91X_NOWAIT,
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static void idp_backlight_power(int on)
diff --git a/arch/arm/mach-pxa/lpd270.c b/arch/arm/mach-pxa/lpd270.c
index ad777b353bd5..28da319d389f 100644
--- a/arch/arm/mach-pxa/lpd270.c
+++ b/arch/arm/mach-pxa/lpd270.c
@@ -24,6 +24,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
 #include <linux/pwm_backlight.h>
+#include <linux/smc91x.h>
 
 #include <asm/types.h>
 #include <asm/setup.h>
@@ -189,15 +190,20 @@ static struct resource smc91x_resources[] = {
         [1] = {
                 .start  = LPD270_ETHERNET_IRQ,
                 .end    = LPD270_ETHERNET_IRQ,
-                .flags  = IORESOURCE_IRQ,
+                .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE,
         },
 };
 
+struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT;
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static struct resource lpd270_flash_resources[] = {
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index 850e506926df..c309593abdb2 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -28,6 +28,7 @@
 #include <linux/platform_data/video-clcd-versatile.h>
 #include <linux/io.h>
 #include <linux/smsc911x.h>
+#include <linux/smc91x.h>
 #include <linux/ata_platform.h>
 #include <linux/amba/mmci.h>
 #include <linux/gfp.h>
@@ -94,6 +95,10 @@ static struct smsc911x_platform_config smsc911x_config = {
         .phy_interface  = PHY_INTERFACE_MODE_MII,
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+};
+
 static struct platform_device realview_eth_device = {
         .name           = "smsc911x",
         .id             = 0,
@@ -107,6 +112,8 @@ int realview_eth_register(const char *name, struct resource *res)
         realview_eth_device.resource = res;
         if (strcmp(realview_eth_device.name, "smsc911x") == 0)
                 realview_eth_device.dev.platform_data = &smsc911x_config;
+        else
+                realview_eth_device.dev.platform_data = &smc91x_platdata;
 
         return platform_device_register(&realview_eth_device);
 }
diff --git a/arch/arm/mach-realview/realview_eb.c b/arch/arm/mach-realview/realview_eb.c
index 64c88d657f9e..b3869cbbcc68 100644
--- a/arch/arm/mach-realview/realview_eb.c
+++ b/arch/arm/mach-realview/realview_eb.c
@@ -234,7 +234,7 @@ static struct resource realview_eb_eth_resources[] = {
         [1] = {
                 .start          = IRQ_EB_ETH,
                 .end            = IRQ_EB_ETH,
-                .flags          = IORESOURCE_IRQ,
+                .flags          = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE,
         },
 };
 
diff --git a/arch/arm/mach-sa1100/neponset.c b/arch/arm/mach-sa1100/neponset.c
index 169262e3040d..7b0cd3172354 100644
--- a/arch/arm/mach-sa1100/neponset.c
+++ b/arch/arm/mach-sa1100/neponset.c
@@ -12,6 +12,7 @@
 #include <linux/pm.h>
 #include <linux/serial_core.h>
 #include <linux/slab.h>
+#include <linux/smc91x.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/map.h>
@@ -258,12 +259,17 @@ static int neponset_probe(struct platform_device *dev)
                         0x02000000, "smc91x-attrib"),
                 { .flags = IORESOURCE_IRQ },
         };
+        struct smc91x_platdata smc91x_platdata = {
+                .flags = SMC91X_USE_8BIT | SMC91X_IO_SHIFT_2 | SMC91X_NOWAIT,
+        };
         struct platform_device_info smc91x_devinfo = {
                 .parent = &dev->dev,
                 .name = "smc91x",
                 .id = 0,
                 .res = smc91x_resources,
                 .num_res = ARRAY_SIZE(smc91x_resources),
+                .data = &smc91c_platdata,
+                .size_data = sizeof(smc91c_platdata),
         };
         int ret, irq;
 
diff --git a/arch/arm/mach-sa1100/pleb.c b/arch/arm/mach-sa1100/pleb.c
index 091261878eff..696fd0fe4806 100644
--- a/arch/arm/mach-sa1100/pleb.c
+++ b/arch/arm/mach-sa1100/pleb.c
@@ -11,6 +11,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/mtd/partitions.h>
+#include <linux/smc91x.h>
 
 #include <mach/hardware.h>
 #include <asm/setup.h>
@@ -43,12 +44,18 @@ static struct resource smc91x_resources[] = {
 #endif
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+};
 
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev = {
+                .platform_data  = &smc91c_platdata,
+        },
 };
 
 static struct platform_device *devices[] __initdata = {
diff --git a/arch/arm64/boot/dts/arm/foundation-v8.dts b/arch/arm64/boot/dts/arm/foundation-v8.dts
index 27f32962e55c..4eac8dcea423 100644
--- a/arch/arm64/boot/dts/arm/foundation-v8.dts
+++ b/arch/arm64/boot/dts/arm/foundation-v8.dts
@@ -34,6 +34,7 @@
                         reg = <0x0 0x0>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@1 {
                         device_type = "cpu";
@@ -41,6 +42,7 @@
                         reg = <0x0 0x1>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@2 {
                         device_type = "cpu";
@@ -48,6 +50,7 @@
                         reg = <0x0 0x2>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@3 {
                         device_type = "cpu";
@@ -55,6 +58,11 @@
                         reg = <0x0 0x3>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
+                };
+
+                L2_0: l2-cache0 {
+                        compatible = "cache";
                 };
         };
 
diff --git a/arch/arm64/boot/dts/arm/juno.dts b/arch/arm64/boot/dts/arm/juno.dts
index d429129ecb3d..133ee59de2d7 100644
--- a/arch/arm64/boot/dts/arm/juno.dts
+++ b/arch/arm64/boot/dts/arm/juno.dts
@@ -39,6 +39,7 @@
                         reg = <0x0 0x0>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A57_L2>;
                 };
 
                 A57_1: cpu@1 {
@@ -46,6 +47,7 @@
                         reg = <0x0 0x1>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A57_L2>;
                 };
 
                 A53_0: cpu@100 {
@@ -53,6 +55,7 @@
                         reg = <0x0 0x100>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
                 };
 
                 A53_1: cpu@101 {
@@ -60,6 +63,7 @@
                         reg = <0x0 0x101>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
                 };
 
                 A53_2: cpu@102 {
@@ -67,6 +71,7 @@
                         reg = <0x0 0x102>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
                 };
 
                 A53_3: cpu@103 {
@@ -74,6 +79,15 @@
                         reg = <0x0 0x103>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
+                };
+
+                A57_L2: l2-cache0 {
+                        compatible = "cache";
+                };
+
+                A53_L2: l2-cache1 {
+                        compatible = "cache";
                 };
         };
 
diff --git a/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts b/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
index efc59b3baf63..20addabbd127 100644
--- a/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
+++ b/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
@@ -37,6 +37,7 @@
                         reg = <0x0 0x0>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@1 {
                         device_type = "cpu";
@@ -44,6 +45,7 @@
                         reg = <0x0 0x1>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@2 {
                         device_type = "cpu";
@@ -51,6 +53,7 @@
                         reg = <0x0 0x2>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@3 {
                         device_type = "cpu";
@@ -58,6 +61,11 @@
                         reg = <0x0 0x3>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
+                };
+
+                L2_0: l2-cache0 {
+                        compatible = "cache";
                 };
         };
 
diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
index 5720608c50b1..abb79b3cfcfe 100644
--- a/arch/arm64/crypto/Makefile
+++ b/arch/arm64/crypto/Makefile
@@ -29,7 +29,7 @@ aes-ce-blk-y := aes-glue-ce.o aes-ce.o
 obj-$(CONFIG_CRYPTO_AES_ARM64_NEON_BLK) += aes-neon-blk.o
 aes-neon-blk-y := aes-glue-neon.o aes-neon.o
 
-AFLAGS_aes-ce.o         := -DINTERLEAVE=2 -DINTERLEAVE_INLINE
+AFLAGS_aes-ce.o         := -DINTERLEAVE=4
 AFLAGS_aes-neon.o       := -DINTERLEAVE=4
 
 CFLAGS_aes-glue-ce.o    := -DUSE_V8_CRYPTO_EXTENSIONS
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 5901480bfdca..750bac4e637e 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -20,6 +20,9 @@
 #error "Only include this from assembly code"
 #endif
 
+#ifndef __ASM_ASSEMBLER_H
+#define __ASM_ASSEMBLER_H
+
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
 
@@ -155,3 +158,5 @@ lr	.req	x30		// link register
 #endif
         orr     \rd, \lbits, \hbits, lsl #32
         .endm
+
+#endif  /* __ASM_ASSEMBLER_H */
diff --git a/arch/arm64/include/asm/cpuidle.h b/arch/arm64/include/asm/cpuidle.h
index 0710654631e7..c60643f14cda 100644
--- a/arch/arm64/include/asm/cpuidle.h
+++ b/arch/arm64/include/asm/cpuidle.h
@@ -1,6 +1,8 @@
 #ifndef __ASM_CPUIDLE_H
 #define __ASM_CPUIDLE_H
 
+#include <asm/proc-fns.h>
+
 #ifdef CONFIG_CPU_IDLE
 extern int cpu_init_idle(unsigned int cpu);
 extern int cpu_suspend(unsigned long arg);
diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h
index e2ff32a93b5c..d2f49423c5dc 100644
--- a/arch/arm64/include/asm/insn.h
+++ b/arch/arm64/include/asm/insn.h
@@ -264,8 +264,10 @@ __AARCH64_INSN_FUNCS(ands,	0x7F200000, 0x6A000000)
 __AARCH64_INSN_FUNCS(bics,      0x7F200000, 0x6A200000)
 __AARCH64_INSN_FUNCS(b,         0xFC000000, 0x14000000)
 __AARCH64_INSN_FUNCS(bl,        0xFC000000, 0x94000000)
-__AARCH64_INSN_FUNCS(cbz,       0xFE000000, 0x34000000)
-__AARCH64_INSN_FUNCS(cbnz,      0xFE000000, 0x35000000)
+__AARCH64_INSN_FUNCS(cbz,       0x7F000000, 0x34000000)
+__AARCH64_INSN_FUNCS(cbnz,      0x7F000000, 0x35000000)
+__AARCH64_INSN_FUNCS(tbz,       0x7F000000, 0x36000000)
+__AARCH64_INSN_FUNCS(tbnz,      0x7F000000, 0x37000000)
 __AARCH64_INSN_FUNCS(bcond,     0xFF000010, 0x54000000)
 __AARCH64_INSN_FUNCS(svc,       0xFFE0001F, 0xD4000001)
 __AARCH64_INSN_FUNCS(hvc,       0xFFE0001F, 0xD4000002)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 16449c535e50..800ec0e87ed9 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -460,7 +460,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long addr)
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
         const pteval_t mask = PTE_USER | PTE_PXN | PTE_UXN | PTE_RDONLY |
-                              PTE_PROT_NONE | PTE_VALID | PTE_WRITE;
+                              PTE_PROT_NONE | PTE_WRITE | PTE_TYPE_MASK;
         pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
         return pte;
 }
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index f9be30ea1cbd..20e9591a60cf 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -45,7 +45,8 @@
 #define STACK_TOP               STACK_TOP_MAX
 #endif /* CONFIG_COMPAT */
 
-#define ARCH_LOW_ADDRESS_LIMIT  PHYS_MASK
+extern phys_addr_t arm64_dma_phys_limit;
+#define ARCH_LOW_ADDRESS_LIMIT  (arm64_dma_phys_limit - 1)
 #endif /* __KERNEL__ */
 
 struct debug_info {
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index 73f0ce570fb3..4abe9b945f77 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -24,11 +24,6 @@
 #include <linux/sched.h>
 #include <asm/cputype.h>
 
-extern void __cpu_flush_user_tlb_range(unsigned long, unsigned long, struct vm_area_struct *);
-extern void __cpu_flush_kern_tlb_range(unsigned long, unsigned long);
-
-extern struct cpu_tlb_fns cpu_tlb;
-
 /*
  *      TLB Management
  *      ==============
diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index bef04afd6031..5ee07eee80c2 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -15,8 +15,9 @@ CFLAGS_REMOVE_return_address.o = -pg
 arm64-obj-y             := cputable.o debug-monitors.o entry.o irq.o fpsimd.o   \
                            entry-fpsimd.o process.o ptrace.o setup.o signal.o   \
                            sys.o stacktrace.o time.o traps.o io.o vdso.o        \
-                           hyp-stub.o psci.o cpu_ops.o insn.o return_address.o  \
-                           cpuinfo.o cpu_errata.o alternative.o cacheinfo.o
+                           hyp-stub.o psci.o psci-call.o cpu_ops.o insn.o       \
+                           return_address.o cpuinfo.o cpu_errata.o              \
+                           alternative.o cacheinfo.o
 
 arm64-obj-$(CONFIG_COMPAT)              += sys32.o kuser32.o signal32.o         \
                                            sys_compat.o entry32.o               \
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index cf8556ae09d0..c851be795080 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -156,7 +156,7 @@ static int ftrace_modify_graph_caller(bool enable)
 
         branch = aarch64_insn_gen_branch_imm(pc,
                                              (unsigned long)ftrace_graph_caller,
-                                             AARCH64_INSN_BRANCH_LINK);
+                                             AARCH64_INSN_BRANCH_NOLINK);
         nop = aarch64_insn_gen_nop();
 
         if (enable)
diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
index 27d4864577e5..c8eca88f12e6 100644
--- a/arch/arm64/kernel/insn.c
+++ b/arch/arm64/kernel/insn.c
@@ -87,8 +87,10 @@ static void __kprobes *patch_map(void *addr, int fixmap)
 
         if (module && IS_ENABLED(CONFIG_DEBUG_SET_MODULE_RONX))
                 page = vmalloc_to_page(addr);
-        else
+        else if (!module && IS_ENABLED(CONFIG_DEBUG_RODATA))
                 page = virt_to_page(addr);
+        else
+                return addr;
 
         BUG_ON(!page);
         set_fixmap(fixmap, page_to_phys(page));
diff --git a/arch/arm64/kernel/psci-call.S b/arch/arm64/kernel/psci-call.S
new file mode 100644
index 000000000000..cf83e61cd3b5
--- /dev/null
+++ b/arch/arm64/kernel/psci-call.S
@@ -0,0 +1,28 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Copyright (C) 2015 ARM Limited
+ *
+ * Author: Will Deacon <will.deacon@arm.com>
+ */
+
+#include <linux/linkage.h>
+
+/* int __invoke_psci_fn_hvc(u64 function_id, u64 arg0, u64 arg1, u64 arg2) */
+ENTRY(__invoke_psci_fn_hvc)
+        hvc     #0
+        ret
+ENDPROC(__invoke_psci_fn_hvc)
+
+/* int __invoke_psci_fn_smc(u64 function_id, u64 arg0, u64 arg1, u64 arg2) */
+ENTRY(__invoke_psci_fn_smc)
+        smc     #0
+        ret
+ENDPROC(__invoke_psci_fn_smc)
diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
index 3425f311c49e..9b8a70ae64a1 100644
--- a/arch/arm64/kernel/psci.c
+++ b/arch/arm64/kernel/psci.c
@@ -57,6 +57,9 @@ static struct psci_operations psci_ops;
 static int (*invoke_psci_fn)(u64, u64, u64, u64);
 typedef int (*psci_initcall_t)(const struct device_node *);
 
+asmlinkage int __invoke_psci_fn_hvc(u64, u64, u64, u64);
+asmlinkage int __invoke_psci_fn_smc(u64, u64, u64, u64);
+
 enum psci_function {
         PSCI_FN_CPU_SUSPEND,
         PSCI_FN_CPU_ON,
@@ -109,40 +112,6 @@ static void psci_power_state_unpack(u32 power_state,
                         PSCI_0_2_POWER_STATE_AFFL_SHIFT;
 }
 
-/*
- * The following two functions are invoked via the invoke_psci_fn pointer
- * and will not be inlined, allowing us to piggyback on the AAPCS.
- */
-static noinline int __invoke_psci_fn_hvc(u64 function_id, u64 arg0, u64 arg1,
-                                         u64 arg2)
-{
-        asm volatile(
-                        __asmeq("%0", "x0")
-                        __asmeq("%1", "x1")
-                        __asmeq("%2", "x2")
-                        __asmeq("%3", "x3")
-                        "hvc    #0\n"
-                : "+r" (function_id)
-                : "r" (arg0), "r" (arg1), "r" (arg2));
-
-        return function_id;
-}
-
-static noinline int __invoke_psci_fn_smc(u64 function_id, u64 arg0, u64 arg1,
-                                         u64 arg2)
-{
-        asm volatile(
-                        __asmeq("%0", "x0")
-                        __asmeq("%1", "x1")
-                        __asmeq("%2", "x2")
-                        __asmeq("%3", "x3")
-                        "smc    #0\n"
-                : "+r" (function_id)
-                : "r" (arg0), "r" (arg1), "r" (arg2));
-
-        return function_id;
-}
-
 static int psci_get_version(void)
 {
         int err;
diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
index c20a300e2213..d26fcd4cd6e6 100644
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -154,8 +154,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
         case __SI_TIMER:
                  err |= __put_user(from->si_tid, &to->si_tid);
                  err |= __put_user(from->si_overrun, &to->si_overrun);
-                 err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr,
-                                   &to->si_ptr);
+                 err |= __put_user(from->si_int, &to->si_int);
                 break;
         case __SI_POLL:
                 err |= __put_user(from->si_band, &to->si_band);
@@ -184,7 +183,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
         case __SI_MESGQ: /* But this is */
                 err |= __put_user(from->si_pid, &to->si_pid);
                 err |= __put_user(from->si_uid, &to->si_uid);
-                err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr, &to->si_ptr);
+                err |= __put_user(from->si_int, &to->si_int);
                 break;
         case __SI_SYS:
                 err |= __put_user((compat_uptr_t)(unsigned long)
diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
index fe652ffd34c2..efa79e8d4196 100644
--- a/arch/arm64/kernel/vdso/gettimeofday.S
+++ b/arch/arm64/kernel/vdso/gettimeofday.S
@@ -174,8 +174,6 @@ ENDPROC(__kernel_clock_gettime)
 /* int __kernel_clock_getres(clockid_t clock_id, struct timespec *res); */
 ENTRY(__kernel_clock_getres)
         .cfi_startproc
-        cbz     w1, 3f
-
         cmp     w0, #CLOCK_REALTIME
         ccmp    w0, #CLOCK_MONOTONIC, #0x4, ne
         b.ne    1f
@@ -188,6 +186,7 @@ ENTRY(__kernel_clock_getres)
         b.ne    4f
         ldr     x2, 6f
 2:
+        cbz     w1, 3f
         stp     xzr, x2, [x1]
 
 3:      /* res == NULL. */
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 0a24b9b8c698..58e0c2bdde04 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -348,8 +348,6 @@ static struct dma_map_ops swiotlb_dma_ops = {
         .mapping_error = swiotlb_dma_mapping_error,
 };
 
-extern int swiotlb_late_init_with_default_size(size_t default_size);
-
 static int __init atomic_pool_init(void)
 {
         pgprot_t prot = __pgprot(PROT_NORMAL_NC);
@@ -411,21 +409,13 @@ out:
         return -ENOMEM;
 }
 
-static int __init swiotlb_late_init(void)
+static int __init arm64_dma_init(void)
 {
-        size_t swiotlb_size = min(SZ_64M, MAX_ORDER_NR_PAGES << PAGE_SHIFT);
+        int ret;
 
         dma_ops = &swiotlb_dma_ops;
 
-        return swiotlb_late_init_with_default_size(swiotlb_size);
-}
-
-static int __init arm64_dma_init(void)
-{
-        int ret = 0;
-
-        ret |= swiotlb_late_init();
-        ret |= atomic_pool_init();
+        ret = atomic_pool_init();
 
         return ret;
 }
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 71145f952070..ae85da6307bb 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -33,6 +33,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/dma-contiguous.h>
 #include <linux/efi.h>
+#include <linux/swiotlb.h>
 
 #include <asm/fixmap.h>
 #include <asm/memory.h>
@@ -45,6 +46,7 @@
 #include "mm.h"
 
 phys_addr_t memstart_addr __read_mostly = 0;
+phys_addr_t arm64_dma_phys_limit __read_mostly;
 
 #ifdef CONFIG_BLK_DEV_INITRD
 static int __init early_initrd(char *p)
@@ -85,7 +87,7 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
 
         /* 4GB maximum for 32-bit only capable devices */
         if (IS_ENABLED(CONFIG_ZONE_DMA)) {
-                max_dma = PFN_DOWN(max_zone_dma_phys());
+                max_dma = PFN_DOWN(arm64_dma_phys_limit);
                 zone_size[ZONE_DMA] = max_dma - min;
         }
         zone_size[ZONE_NORMAL] = max - max_dma;
@@ -156,8 +158,6 @@ early_param("mem", early_mem);
 
 void __init arm64_memblock_init(void)
 {
-        phys_addr_t dma_phys_limit = 0;
-
         memblock_enforce_memory_limit(memory_limit);
 
         /*
@@ -174,8 +174,10 @@ void __init arm64_memblock_init(void)
 
         /* 4GB maximum for 32-bit only capable devices */
         if (IS_ENABLED(CONFIG_ZONE_DMA))
-                dma_phys_limit = max_zone_dma_phys();
-        dma_contiguous_reserve(dma_phys_limit);
+                arm64_dma_phys_limit = max_zone_dma_phys();
+        else
+                arm64_dma_phys_limit = PHYS_MASK + 1;
+        dma_contiguous_reserve(arm64_dma_phys_limit);
 
         memblock_allow_resize();
         memblock_dump_all();
@@ -276,6 +278,8 @@ static void __init free_unused_memmap(void)
  */
 void __init mem_init(void)
 {
+        swiotlb_init(1);
+
         set_max_mapnr(pfn_to_page(max_pfn) - mem_map);
 
 #ifndef CONFIG_SPARSEMEM_VMEMMAP
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index bb0ea94c4ba1..1d3ec3ddd84b 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -51,7 +51,10 @@ static int change_memory_common(unsigned long addr, int numpages,
                 WARN_ON_ONCE(1);
         }
 
-        if (!is_module_address(start) || !is_module_address(end - 1))
+        if (start < MODULES_VADDR || start >= MODULES_END)
+                return -EINVAL;
+
+        if (end < MODULES_VADDR || end >= MODULES_END)
                 return -EINVAL;
 
         data.set_mask = set_mask;
diff --git a/arch/frv/include/asm/pgtable.h b/arch/frv/include/asm/pgtable.h
index 93bcf2abd1a1..07d7a7ef8bd5 100644
--- a/arch/frv/include/asm/pgtable.h
+++ b/arch/frv/include/asm/pgtable.h
@@ -123,12 +123,14 @@ extern unsigned long empty_zero_page;
 #define PGDIR_MASK              (~(PGDIR_SIZE - 1))
 #define PTRS_PER_PGD            64
 
+#define __PAGETABLE_PUD_FOLDED
 #define PUD_SHIFT               26
 #define PTRS_PER_PUD            1
 #define PUD_SIZE                (1UL << PUD_SHIFT)
 #define PUD_MASK                (~(PUD_SIZE - 1))
 #define PUE_SIZE                256
 
+#define __PAGETABLE_PMD_FOLDED
 #define PMD_SHIFT               26
 #define PMD_SIZE                (1UL << PMD_SHIFT)
 #define PMD_MASK                (~(PMD_SIZE - 1))
diff --git a/arch/m32r/include/asm/pgtable-2level.h b/arch/m32r/include/asm/pgtable-2level.h
index 8fd8ee70266a..421e6ba3a173 100644
--- a/arch/m32r/include/asm/pgtable-2level.h
+++ b/arch/m32r/include/asm/pgtable-2level.h
@@ -13,6 +13,7 @@
  * the M32R is two-level, so we don't really have any
  * PMD directory physically.
  */
+#define __PAGETABLE_PMD_FOLDED
 #define PMD_SHIFT       22
 #define PTRS_PER_PMD    1
 
diff --git a/arch/m68k/include/asm/pgtable_mm.h b/arch/m68k/include/asm/pgtable_mm.h
index 28a145bfbb71..35ed4a9981ae 100644
--- a/arch/m68k/include/asm/pgtable_mm.h
+++ b/arch/m68k/include/asm/pgtable_mm.h
@@ -54,10 +54,12 @@
  */
 #ifdef CONFIG_SUN3
 #define PTRS_PER_PTE   16
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PMD   1
 #define PTRS_PER_PGD   2048
 #elif defined(CONFIG_COLDFIRE)
 #define PTRS_PER_PTE    512
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PMD    1
 #define PTRS_PER_PGD    1024
 #else
diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
index 881071c07942..13272fd5a5ba 100644
--- a/arch/metag/include/asm/processor.h
+++ b/arch/metag/include/asm/processor.h
@@ -149,8 +149,8 @@ extern void exit_thread(void);
 
 unsigned long get_wchan(struct task_struct *p);
 
-#define KSTK_EIP(tsk)   ((tsk)->thread.kernel_context->CurrPC)
-#define KSTK_ESP(tsk)   ((tsk)->thread.kernel_context->AX[0].U0)
+#define KSTK_EIP(tsk)   (task_pt_regs(tsk)->ctx.CurrPC)
+#define KSTK_ESP(tsk)   (task_pt_regs(tsk)->ctx.AX[0].U0)
 
 #define user_stack_pointer(regs)        ((regs)->ctx.AX[0].U0)
 
diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c
index bbcd82242059..b6beb0e07b1b 100644
--- a/arch/mips/kvm/tlb.c
+++ b/arch/mips/kvm/tlb.c
@@ -216,6 +216,7 @@ int kvm_mips_host_tlb_write(struct kvm_vcpu *vcpu, unsigned long entryhi,
         if (idx > current_cpu_data.tlbsize) {
                 kvm_err("%s: Invalid Index: %d\n", __func__, idx);
                 kvm_mips_dump_host_tlbs();
+                local_irq_restore(flags);
                 return -1;
         }
 
diff --git a/arch/mips/kvm/trace.h b/arch/mips/kvm/trace.h
index c1388d40663b..bd6437f67dc0 100644
--- a/arch/mips/kvm/trace.h
+++ b/arch/mips/kvm/trace.h
@@ -24,18 +24,18 @@ TRACE_EVENT(kvm_exit,
             TP_PROTO(struct kvm_vcpu *vcpu, unsigned int reason),
             TP_ARGS(vcpu, reason),
             TP_STRUCT__entry(
-                        __field(struct kvm_vcpu *, vcpu)
+                        __field(unsigned long, pc)
                         __field(unsigned int, reason)
             ),
 
             TP_fast_assign(
-                        __entry->vcpu = vcpu;
+                        __entry->pc = vcpu->arch.pc;
                         __entry->reason = reason;
             ),
 
             TP_printk("[%s]PC: 0x%08lx",
                       kvm_mips_exit_types_str[__entry->reason],
-                      __entry->vcpu->arch.pc)
+                      __entry->pc)
 );
 
 #endif /* _TRACE_KVM_H */
diff --git a/arch/mn10300/include/asm/pgtable.h b/arch/mn10300/include/asm/pgtable.h
index afab728ab65e..96d3f9deb59c 100644
--- a/arch/mn10300/include/asm/pgtable.h
+++ b/arch/mn10300/include/asm/pgtable.h
@@ -56,7 +56,9 @@ extern void paging_init(void);
 #define PGDIR_SHIFT     22
 #define PTRS_PER_PGD    1024
 #define PTRS_PER_PUD    1       /* we don't really have any PUD physically */
+#define __PAGETABLE_PUD_FOLDED
 #define PTRS_PER_PMD    1       /* we don't really have any PMD physically */
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PTE    1024
 
 #define PGD_SIZE        PAGE_SIZE
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index 8c966b2270aa..15207b9362bf 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -96,6 +96,7 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
 #if PT_NLEVELS == 3
 #define BITS_PER_PMD    (PAGE_SHIFT + PMD_ORDER - BITS_PER_PMD_ENTRY)
 #else
+#define __PAGETABLE_PMD_FOLDED
 #define BITS_PER_PMD    0
 #endif
 #define PTRS_PER_PMD    (1UL << BITS_PER_PMD)
diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
index 9cfa3706a1b8..f1ea5972f6ec 100644
--- a/arch/powerpc/include/asm/iommu.h
+++ b/arch/powerpc/include/asm/iommu.h
@@ -113,6 +113,7 @@ extern void iommu_register_group(struct iommu_table *tbl,
                                  int pci_domain_number, unsigned long pe_num);
 extern int iommu_add_device(struct device *dev);
 extern void iommu_del_device(struct device *dev);
+extern int __init tce_iommu_bus_notifier_init(void);
 #else
 static inline void iommu_register_group(struct iommu_table *tbl,
                                         int pci_domain_number,
@@ -128,6 +129,11 @@ static inline int iommu_add_device(struct device *dev)
 static inline void iommu_del_device(struct device *dev)
 {
 }
+
+static inline int __init tce_iommu_bus_notifier_init(void)
+{
+        return 0;
+}
 #endif /* !CONFIG_IOMMU_API */
 
 static inline void set_iommu_table_base_and_group(struct device *dev,
diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h
new file mode 100644
index 000000000000..744fd54de374
--- /dev/null
+++ b/arch/powerpc/include/asm/irq_work.h
@@ -0,0 +1,9 @@
+#ifndef _ASM_POWERPC_IRQ_WORK_H
+#define _ASM_POWERPC_IRQ_WORK_H
+
+static inline bool arch_irq_work_has_interrupt(void)
+{
+        return true;
+}
+
+#endif /* _ASM_POWERPC_IRQ_WORK_H */
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 5d3968c4d799..b054f33ab1fb 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -1175,4 +1175,30 @@ void iommu_del_device(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(iommu_del_device);
 
+static int tce_iommu_bus_notifier(struct notifier_block *nb,
+                unsigned long action, void *data)
+{
+        struct device *dev = data;
+
+        switch (action) {
+        case BUS_NOTIFY_ADD_DEVICE:
+                return iommu_add_device(dev);
+        case BUS_NOTIFY_DEL_DEVICE:
+                if (dev->iommu_group)
+                        iommu_del_device(dev);
+                return 0;
+        default:
+                return 0;
+        }
+}
+
+static struct notifier_block tce_iommu_bus_nb = {
+        .notifier_call = tce_iommu_bus_notifier,
+};
+
+int __init tce_iommu_bus_notifier_init(void)
+{
+        bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
+        return 0;
+}
 #endif /* CONFIG_IOMMU_API */
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 6e19afa35a15..ec9ec2058d2d 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -541,8 +541,8 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
         if (smp_ops->give_timebase)
                 smp_ops->give_timebase();
 
-        /* Wait until cpu puts itself in the online map */
-        while (!cpu_online(cpu))
+        /* Wait until cpu puts itself in the online & active maps */
+        while (!cpu_online(cpu) || !cpu_active(cpu))
                 cpu_relax();
 
         return 0;
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index e69142f4af08..54323d6b5166 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -836,30 +836,4 @@ void __init pnv_pci_init(void)
 #endif
 }
 
-static int tce_iommu_bus_notifier(struct notifier_block *nb,
-                unsigned long action, void *data)
-{
-        struct device *dev = data;
-
-        switch (action) {
-        case BUS_NOTIFY_ADD_DEVICE:
-                return iommu_add_device(dev);
-        case BUS_NOTIFY_DEL_DEVICE:
-                if (dev->iommu_group)
-                        iommu_del_device(dev);
-                return 0;
-        default:
-                return 0;
-        }
-}
-
-static struct notifier_block tce_iommu_bus_nb = {
-        .notifier_call = tce_iommu_bus_notifier,
-};
-
-static int __init tce_iommu_bus_notifier_init(void)
-{
-        bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
-        return 0;
-}
 machine_subsys_initcall_sync(powernv, tce_iommu_bus_notifier_init);
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 1d3d52dc3ff3..7803a19adb31 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -1340,3 +1340,5 @@ static int __init disable_multitce(char *str)
 }
 
 __setup("multitce=", disable_multitce);
+
+machine_subsys_initcall_sync(pseries, tce_iommu_bus_notifier_init);
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index fbb5ee3ae57c..e08ec38f8c6e 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -91,7 +91,9 @@ extern unsigned long zero_page_mask;
  */
 #define PTRS_PER_PTE    256
 #ifndef CONFIG_64BIT
+#define __PAGETABLE_PUD_FOLDED
 #define PTRS_PER_PMD    1
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PUD    1
 #else /* CONFIG_64BIT */
 #define PTRS_PER_PMD    2048
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c2fb8a87dccb..b7d31ca55187 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -499,6 +499,7 @@ config X86_INTEL_QUARK
         depends on X86_IO_APIC
         select IOSF_MBI
         select INTEL_IMR
+        select COMMON_CLK
         ---help---
           Select to include support for Quark X1000 SoC.
           Say Y here if you have a Quark based system such as the Arduino
diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
index 5fa9770035dc..c9a6d68b8d62 100644
--- a/arch/x86/include/asm/xsave.h
+++ b/arch/x86/include/asm/xsave.h
@@ -82,18 +82,15 @@ static inline int xsave_state_booting(struct xsave_struct *fx, u64 mask)
         if (boot_cpu_has(X86_FEATURE_XSAVES))
                 asm volatile("1:"XSAVES"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
         else
                 asm volatile("1:"XSAVE"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
-
-        asm volatile(xstate_fault
-                     : "0" (0)
-                     : "memory");
-
         return err;
 }
 
@@ -112,18 +109,15 @@ static inline int xrstor_state_booting(struct xsave_struct *fx, u64 mask)
         if (boot_cpu_has(X86_FEATURE_XSAVES))
                 asm volatile("1:"XRSTORS"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
         else
                 asm volatile("1:"XRSTOR"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
-
-        asm volatile(xstate_fault
-                     : "0" (0)
-                     : "memory");
-
         return err;
 }
 
@@ -149,9 +143,9 @@ static inline int xsave_state(struct xsave_struct *fx, u64 mask)
          */
         alternative_input_2(
                 "1:"XSAVE,
-                "1:"XSAVEOPT,
+                XSAVEOPT,
                 X86_FEATURE_XSAVEOPT,
-                "1:"XSAVES,
+                XSAVES,
                 X86_FEATURE_XSAVES,
                 [fx] "D" (fx), "a" (lmask), "d" (hmask) :
                 "memory");
@@ -178,7 +172,7 @@ static inline int xrstor_state(struct xsave_struct *fx, u64 mask)
          */
         alternative_input(
                 "1: " XRSTOR,
-                "1: " XRSTORS,
+                XRSTORS,
                 X86_FEATURE_XSAVES,
                 "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                 : "memory");
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index b5c8ff5e9dfc..2346c95c6ab1 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1396,6 +1396,12 @@ void cpu_init(void)
 
         wait_for_master_cpu(cpu);
 
+        /*
+         * Initialize the CR4 shadow before doing anything that could
+         * try to read it.
+         */
+        cr4_init_shadow();
+
         show_ucode_info_early();
 
         printk(KERN_INFO "Initializing CPU#%d\n", cpu);
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 94d7dcb12145..50163fa9034f 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -565,8 +565,8 @@ static const struct _tlb_table intel_tlb_table[] = {
         { 0xb2, TLB_INST_4K,            64,     " TLB_INST 4KByte pages, 4-way set associative" },
         { 0xb3, TLB_DATA_4K,            128,    " TLB_DATA 4 KByte pages, 4-way set associative" },
         { 0xb4, TLB_DATA_4K,            256,    " TLB_DATA 4 KByte pages, 4-way associative" },
-        { 0xb5, TLB_INST_4K,            64,     " TLB_INST 4 KByte pages, 8-way set ssociative" },
-        { 0xb6, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 8-way set ssociative" },
+        { 0xb5, TLB_INST_4K,            64,     " TLB_INST 4 KByte pages, 8-way set associative" },
+        { 0xb6, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 8-way set associative" },
         { 0xba, TLB_DATA_4K,            64,     " TLB_DATA 4 KByte pages, 4-way associative" },
         { 0xc0, TLB_DATA_4K_4M,         8,      " TLB_DATA 4 KByte and 4 MByte pages, 4-way associative" },
         { 0xc1, STLB_4K_2M,             1024,   " STLB 4 KByte and 2 MByte pages, 8-way associative" },
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 000d4199b03e..31e2d5bf3e38 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -982,6 +982,9 @@ ENTRY(xen_hypervisor_callback)
 ENTRY(xen_do_upcall)
 1:      mov %esp, %eax
         call xen_evtchn_do_upcall
+#ifndef CONFIG_PREEMPT
+        call xen_maybe_preempt_hcall
+#endif
         jmp  ret_from_intr
         CFI_ENDPROC
 ENDPROC(xen_hypervisor_callback)
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index db13655c3a2a..1d74d161687c 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -269,11 +269,14 @@ ENTRY(ret_from_fork)
         testl $3, CS-ARGOFFSET(%rsp)            # from kernel_thread?
         jz   1f
 
-        testl $_TIF_IA32, TI_flags(%rcx)        # 32-bit compat task needs IRET
-        jnz  int_ret_from_sys_call
-
-        RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
-        jmp ret_from_sys_call                   # go to the SYSRET fastpath
+        /*
+         * By the time we get here, we have no idea whether our pt_regs,
+         * ti flags, and ti status came from the 64-bit SYSCALL fast path,
+         * the slow path, or one of the ia32entry paths.
+         * Use int_ret_from_sys_call to return, since it can safely handle
+         * all of the above.
+         */
+        jmp  int_ret_from_sys_call
 
 1:
         subq $REST_SKIP, %rsp   # leave space for volatiles
@@ -1208,6 +1211,9 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
         popq %rsp
         CFI_DEF_CFA_REGISTER rsp
         decl PER_CPU_VAR(irq_count)
+#ifndef CONFIG_PREEMPT
+        call xen_maybe_preempt_hcall
+#endif
         jmp  error_exit
         CFI_ENDPROC
 END(xen_do_hypervisor_callback)
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 6a1146ea4d4d..4e3d5a9621fe 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -223,27 +223,48 @@ static unsigned long
 __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr)
 {
         struct kprobe *kp;
+        unsigned long faddr;
 
         kp = get_kprobe((void *)addr);
-        /* There is no probe, return original address */
-        if (!kp)
+        faddr = ftrace_location(addr);
+        /*
+         * Addresses inside the ftrace location are refused by
+         * arch_check_ftrace_location(). Something went terribly wrong
+         * if such an address is checked here.
+         */
+        if (WARN_ON(faddr && faddr != addr))
+                return 0UL;
+        /*
+         * Use the current code if it is not modified by Kprobe
+         * and it cannot be modified by ftrace.
+         */
+        if (!kp && !faddr)
                 return addr;
 
         /*
-         *  Basically, kp->ainsn.insn has an original instruction.
-         *  However, RIP-relative instruction can not do single-stepping
-         *  at different place, __copy_instruction() tweaks the displacement of
-         *  that instruction. In that case, we can't recover the instruction
-         *  from the kp->ainsn.insn.
+         * Basically, kp->ainsn.insn has an original instruction.
+         * However, RIP-relative instruction can not do single-stepping
+         * at different place, __copy_instruction() tweaks the displacement of
+         * that instruction. In that case, we can't recover the instruction
+         * from the kp->ainsn.insn.
          *
-         *  On the other hand, kp->opcode has a copy of the first byte of
-         *  the probed instruction, which is overwritten by int3. And
-         *  the instruction at kp->addr is not modified by kprobes except
-         *  for the first byte, we can recover the original instruction
-         *  from it and kp->opcode.
+         * On the other hand, in case on normal Kprobe, kp->opcode has a copy
+         * of the first byte of the probed instruction, which is overwritten
+         * by int3. And the instruction at kp->addr is not modified by kprobes
+         * except for the first byte, we can recover the original instruction
+         * from it and kp->opcode.
+         *
+         * In case of Kprobes using ftrace, we do not have a copy of
+         * the original instruction. In fact, the ftrace location might
+         * be modified at anytime and even could be in an inconsistent state.
+         * Fortunately, we know that the original code is the ideal 5-byte
+         * long NOP.
          */
-        memcpy(buf, kp->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-        buf[0] = kp->opcode;
+        memcpy(buf, (void *)addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+        if (faddr)
+                memcpy(buf, ideal_nops[NOP_ATOMIC5], 5);
+        else
+                buf[0] = kp->opcode;
         return (unsigned long)buf;
 }
 
@@ -251,6 +272,7 @@ __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr)
  * Recover the probed instruction at addr for further analysis.
  * Caller must lock kprobes by kprobe_mutex, or disable preemption
  * for preventing to release referencing kprobes.
+ * Returns zero if the instruction can not get recovered.
  */
 unsigned long recover_probed_instruction(kprobe_opcode_t *buf, unsigned long addr)
 {
@@ -285,6 +307,8 @@ static int can_probe(unsigned long paddr)
                  * normally used, we just go through if there is no kprobe.
                  */
                 __addr = recover_probed_instruction(buf, addr);
+                if (!__addr)
+                        return 0;
                 kernel_insn_init(&insn, (void *)__addr, MAX_INSN_SIZE);
                 insn_get_length(&insn);
 
@@ -333,6 +357,8 @@ int __copy_instruction(u8 *dest, u8 *src)
         unsigned long recovered_insn =
                 recover_probed_instruction(buf, (unsigned long)src);
 
+        if (!recovered_insn)
+                return 0;
         kernel_insn_init(&insn, (void *)recovered_insn, MAX_INSN_SIZE);
         insn_get_length(&insn);
         /* Another subsystem puts a breakpoint, failed to recover */
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 0dd8d089c315..7b3b9d15c47a 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -259,6 +259,8 @@ static int can_optimize(unsigned long paddr)
                          */
                         return 0;
                 recovered_insn = recover_probed_instruction(buf, addr);
+                if (!recovered_insn)
+                        return 0;
                 kernel_insn_init(&insn, (void *)recovered_insn, MAX_INSN_SIZE);
                 insn_get_length(&insn);
                 /* Another subsystem puts a breakpoint */
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index e0b794a84c35..106c01557f2b 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4950,7 +4950,8 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
                         goto done;
                 }
         }
-        ctxt->dst.orig_val = ctxt->dst.val;
+        /* Copy full 64-bit value for CMPXCHG8B.  */
+        ctxt->dst.orig_val64 = ctxt->dst.val64;
 
 special_insn:
 
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index e55b5fc344eb..bd4e34de24c7 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1572,7 +1572,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu)
                 apic_set_reg(apic, APIC_TMR + 0x10 * i, 0);
         }
         apic->irr_pending = kvm_apic_vid_enabled(vcpu->kvm);
-        apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm);
+        apic->isr_count = kvm_x86_ops->hwapic_isr_update ? 1 : 0;
         apic->highest_isr_cache = -1;
         update_divide_count(apic);
         atomic_set(&apic->lapic_timer.pending, 0);
@@ -1782,7 +1782,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu,
         update_divide_count(apic);
         start_apic_timer(apic);
         apic->irr_pending = true;
-        apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm) ?
+        apic->isr_count = kvm_x86_ops->hwapic_isr_update ?
                                 1 : count_vectors(apic->regs + APIC_ISR);
         apic->highest_isr_cache = -1;
         if (kvm_x86_ops->hwapic_irr_update)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d319e0c24758..cc618c882f90 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3649,11 +3649,6 @@ static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
         return;
 }
 
-static void svm_hwapic_isr_update(struct kvm *kvm, int isr)
-{
-        return;
-}
-
 static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu)
 {
         return;
@@ -4403,7 +4398,6 @@ static struct kvm_x86_ops svm_x86_ops = {
         .set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode,
         .vm_has_apicv = svm_vm_has_apicv,
         .load_eoi_exitmap = svm_load_eoi_exitmap,
-        .hwapic_isr_update = svm_hwapic_isr_update,
         .sync_pir_to_irr = svm_sync_pir_to_irr,
 
         .set_tss_addr = svm_set_tss_addr,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 14c1a18d206a..f7b20b417a3a 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -4367,6 +4367,18 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu)
         return 0;
 }
 
+static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu)
+{
+#ifdef CONFIG_SMP
+        if (vcpu->mode == IN_GUEST_MODE) {
+                apic->send_IPI_mask(get_cpu_mask(vcpu->cpu),
+                                POSTED_INTR_VECTOR);
+                return true;
+        }
+#endif
+        return false;
+}
+
 static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
                                                 int vector)
 {
@@ -4375,9 +4387,7 @@ static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
         if (is_guest_mode(vcpu) &&
             vector == vmx->nested.posted_intr_nv) {
                 /* the PIR and ON have been set by L1. */
-                if (vcpu->mode == IN_GUEST_MODE)
-                        apic->send_IPI_mask(get_cpu_mask(vcpu->cpu),
-                                POSTED_INTR_VECTOR);
+                kvm_vcpu_trigger_posted_interrupt(vcpu);
                 /*
                  * If a posted intr is not recognized by hardware,
                  * we will accomplish it in the next vmentry.
@@ -4409,12 +4419,7 @@ static void vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
 
         r = pi_test_and_set_on(&vmx->pi_desc);
         kvm_make_request(KVM_REQ_EVENT, vcpu);
-#ifdef CONFIG_SMP
-        if (!r && (vcpu->mode == IN_GUEST_MODE))
-                apic->send_IPI_mask(get_cpu_mask(vcpu->cpu),
-                                POSTED_INTR_VECTOR);
-        else
-#endif
+        if (r || !kvm_vcpu_trigger_posted_interrupt(vcpu))
                 kvm_vcpu_kick(vcpu);
 }
 
diff --git a/arch/x86/lguest/Kconfig b/arch/x86/lguest/Kconfig
index 4a0890f815c4..08f41caada45 100644
--- a/arch/x86/lguest/Kconfig
+++ b/arch/x86/lguest/Kconfig
@@ -1,6 +1,6 @@
 config LGUEST_GUEST
         bool "Lguest guest support"
-        depends on X86_32 && PARAVIRT
+        depends on X86_32 && PARAVIRT && PCI
         select TTY
         select VIRTUALIZATION
         select VIRTIO
@@ -8,7 +8,7 @@ config LGUEST_GUEST
         help
           Lguest is a tiny in-kernel hypervisor.  Selecting this will
           allow your kernel to boot under lguest.  This option will increase
-          your kernel size by about 6k.  If in doubt, say N.
+          your kernel size by about 10k.  If in doubt, say N.
 
           If you say Y here, make sure you say Y (or M) to the virtio block
           and net drivers which lguest needs.
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 6ac273832f28..e4695985f9de 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -331,7 +331,7 @@ static void probe_pci_root_info(struct pci_root_info *info,
                                 struct list_head *list)
 {
         int ret;
-        struct resource_entry *entry;
+        struct resource_entry *entry, *tmp;
 
         sprintf(info->name, "PCI Bus %04x:%02x", domain, busnum);
         info->bridge = device;
@@ -345,8 +345,13 @@ static void probe_pci_root_info(struct pci_root_info *info,
                 dev_dbg(&device->dev,
                         "no IO and memory resources present in _CRS\n");
         else
-                resource_list_for_each_entry(entry, list)
-                        entry->res->name = info->name;
+                resource_list_for_each_entry_safe(entry, tmp, list) {
+                        if ((entry->res->flags & IORESOURCE_WINDOW) == 0 ||
+                            (entry->res->flags & IORESOURCE_DISABLED))
+                                resource_list_destroy_entry(entry);
+                        else
+                                entry->res->name = info->name;
+                }
 }
 
 struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c
index 1bbedc4b0f88..3005f0c89f2e 100644
--- a/arch/x86/platform/intel-mid/intel-mid.c
+++ b/arch/x86/platform/intel-mid/intel-mid.c
@@ -130,7 +130,7 @@ static void intel_mid_arch_setup(void)
                 intel_mid_ops = get_intel_mid_ops[__intel_mid_cpu_chip]();
         else {
                 intel_mid_ops = get_intel_mid_ops[INTEL_MID_CPU_CHIP_PENWELL]();
-                pr_info("ARCH: Uknown SoC, assuming PENWELL!\n");
+                pr_info("ARCH: Unknown SoC, assuming PENWELL!\n");
         }
 
 out:
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index bd8b8459c3d0..5240f563076d 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1070,6 +1070,23 @@ static inline void xen_write_cr8(unsigned long val)
         BUG_ON(val);
 }
 #endif
+
+static u64 xen_read_msr_safe(unsigned int msr, int *err)
+{
+        u64 val;
+
+        val = native_read_msr_safe(msr, err);
+        switch (msr) {
+        case MSR_IA32_APICBASE:
+#ifdef CONFIG_X86_X2APIC
+                if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
+#endif
+                        val &= ~X2APIC_ENABLE;
+                break;
+        }
+        return val;
+}
+
 static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
 {
         int ret;
@@ -1240,7 +1257,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
 
         .wbinvd = native_wbinvd,
 
-        .read_msr = native_read_msr_safe,
+        .read_msr = xen_read_msr_safe,
         .write_msr = xen_write_msr_safe,
 
         .read_tsc = native_read_tsc,
@@ -1741,6 +1758,7 @@ asmlinkage __visible void __init xen_start_kernel(void)
 #ifdef CONFIG_X86_32
         i386_start_kernel();
 #else
+        cr4_init_shadow(); /* 32b kernel does this in i386_start_kernel() */
         x86_64_start_reservations((char *)__pa_symbol(&boot_params));
 #endif
 }
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index c723668e3e27..5589a6e2a023 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -42,8 +42,10 @@ static bool acpi_dev_resource_len_valid(u64 start, u64 end, u64 len, bool io)
          * CHECKME: len might be required to check versus a minimum
          * length as well. 1 for io is fine, but for memory it does
          * not make any sense at all.
+         * Note: some BIOSes report incorrect length for ACPI address space
+         * descriptor, so remove check of 'reslen == len' to avoid regression.
          */
-        if (len && reslen && reslen == len && start <= end)
+        if (len && reslen && start <= end)
                 return true;
 
         pr_debug("ACPI: invalid or unassigned resource %s [%016llx - %016llx] length [%016llx]\n",
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index debd30917010..26eb70c8f518 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -2110,7 +2110,8 @@ static int __init intel_opregion_present(void)
 
 int acpi_video_register(void)
 {
-        int result = 0;
+        int ret;
+
         if (register_count) {
                 /*
                  * if the function of acpi_video_register is already called,
@@ -2122,9 +2123,9 @@ int acpi_video_register(void)
         mutex_init(&video_list_lock);
         INIT_LIST_HEAD(&video_bus_head);
 
-        result = acpi_bus_register_driver(&acpi_video_bus);
-        if (result < 0)
-                return -ENODEV;
+        ret = acpi_bus_register_driver(&acpi_video_bus);
+        if (ret)
+                return ret;
 
         /*
          * When the acpi_video_bus is loaded successfully, increase
@@ -2176,6 +2177,17 @@ EXPORT_SYMBOL(acpi_video_unregister_backlight);
 
 static int __init acpi_video_init(void)
 {
+        /*
+         * Let the module load even if ACPI is disabled (e.g. due to
+         * a broken BIOS) so that i915.ko can still be loaded on such
+         * old systems without an AcpiOpRegion.
+         *
+         * acpi_video_register() will report -ENODEV later as well due
+         * to acpi_disabled when i915.ko tries to register itself afterwards.
+         */
+        if (acpi_disabled)
+                return 0;
+
         dmi_check_system(video_dmi_table);
 
         if (intel_opregion_present())
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 33b09b6568a4..6607f3c6ace1 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -551,7 +551,6 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
 {
         void *page_addr;
         unsigned long user_page_addr;
-        struct vm_struct tmp_area;
         struct page **page;
         struct mm_struct *mm;
 
@@ -600,10 +599,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
                                 proc->pid, page_addr);
                         goto err_alloc_page_failed;
                 }
-                tmp_area.addr = page_addr;
-                tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
-                ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
-                if (ret) {
+                ret = map_kernel_range_noflush((unsigned long)page_addr,
+                                        PAGE_SIZE, PAGE_KERNEL, page);
+                flush_cache_vmap((unsigned long)page_addr,
+                                (unsigned long)page_addr + PAGE_SIZE);
+                if (ret != 1) {
                         pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",
                                proc->pid, page_addr);
                         goto err_map_kernel_failed;
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index ba4abbe4693c..45937f88e77c 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -2242,7 +2242,7 @@ static void rtpm_status_str(struct seq_file *s, struct device *dev)
 }
 
 static int pm_genpd_summary_one(struct seq_file *s,
-                struct generic_pm_domain *gpd)
+                                struct generic_pm_domain *genpd)
 {
         static const char * const status_lookup[] = {
                 [GPD_STATE_ACTIVE] = "on",
@@ -2256,26 +2256,26 @@ static int pm_genpd_summary_one(struct seq_file *s,
         struct gpd_link *link;
         int ret;
 
-        ret = mutex_lock_interruptible(&gpd->lock);
+        ret = mutex_lock_interruptible(&genpd->lock);
         if (ret)
                 return -ERESTARTSYS;
 
-        if (WARN_ON(gpd->status >= ARRAY_SIZE(status_lookup)))
+        if (WARN_ON(genpd->status >= ARRAY_SIZE(status_lookup)))
                 goto exit;
-        seq_printf(s, "%-30s  %-15s  ", gpd->name, status_lookup[gpd->status]);
+        seq_printf(s, "%-30s  %-15s  ", genpd->name, status_lookup[genpd->status]);
 
         /*
          * Modifications on the list require holding locks on both
          * master and slave, so we are safe.
-         * Also gpd->name is immutable.
+         * Also genpd->name is immutable.
          */
-        list_for_each_entry(link, &gpd->master_links, master_node) {
+        list_for_each_entry(link, &genpd->master_links, master_node) {
                 seq_printf(s, "%s", link->slave->name);
-                if (!list_is_last(&link->master_node, &gpd->master_links))
+                if (!list_is_last(&link->master_node, &genpd->master_links))
                         seq_puts(s, ", ");
         }
 
-        list_for_each_entry(pm_data, &gpd->dev_list, list_node) {
+        list_for_each_entry(pm_data, &genpd->dev_list, list_node) {
                 kobj_path = kobject_get_path(&pm_data->dev->kobj, GFP_KERNEL);
                 if (kobj_path == NULL)
                         continue;
@@ -2287,14 +2287,14 @@ static int pm_genpd_summary_one(struct seq_file *s,
 
         seq_puts(s, "\n");
 exit:
-        mutex_unlock(&gpd->lock);
+        mutex_unlock(&genpd->lock);
 
         return 0;
 }
 
 static int pm_genpd_summary_show(struct seq_file *s, void *data)
 {
-        struct generic_pm_domain *gpd;
+        struct generic_pm_domain *genpd;
         int ret = 0;
 
         seq_puts(s, "    domain                      status         slaves\n");
@@ -2305,8 +2305,8 @@ static int pm_genpd_summary_show(struct seq_file *s, void *data)
         if (ret)
                 return -ERESTARTSYS;
 
-        list_for_each_entry(gpd, &gpd_list, gpd_list_node) {
-                ret = pm_genpd_summary_one(s, gpd);
+        list_for_each_entry(genpd, &gpd_list, gpd_list_node) {
+                ret = pm_genpd_summary_one(s, genpd);
                 if (ret)
                         break;
         }
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index c2744b30d5d9..aab7158d2afe 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -730,6 +730,7 @@ void pm_system_wakeup(void)
         pm_abort_suspend = true;
         freeze_wake();
 }
+EXPORT_SYMBOL_GPL(pm_system_wakeup);
 
 void pm_wakeup_clear(void)
 {
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index b64bccbb78c9..ceb32dd52a6c 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -482,6 +482,7 @@ static int nvme_error_status(u16 status)
         }
 }
 
+#ifdef CONFIG_BLK_DEV_INTEGRITY
 static void nvme_dif_prep(u32 p, u32 v, struct t10_pi_tuple *pi)
 {
         if (be32_to_cpu(pi->ref_tag) == v)
@@ -538,6 +539,58 @@ static void nvme_dif_remap(struct request *req,
         kunmap_atomic(pmap);
 }
 
+static int nvme_noop_verify(struct blk_integrity_iter *iter)
+{
+        return 0;
+}
+
+static int nvme_noop_generate(struct blk_integrity_iter *iter)
+{
+        return 0;
+}
+
+struct blk_integrity nvme_meta_noop = {
+        .name                   = "NVME_META_NOOP",
+        .generate_fn            = nvme_noop_generate,
+        .verify_fn              = nvme_noop_verify,
+};
+
+static void nvme_init_integrity(struct nvme_ns *ns)
+{
+        struct blk_integrity integrity;
+
+        switch (ns->pi_type) {
+        case NVME_NS_DPS_PI_TYPE3:
+                integrity = t10_pi_type3_crc;
+                break;
+        case NVME_NS_DPS_PI_TYPE1:
+        case NVME_NS_DPS_PI_TYPE2:
+                integrity = t10_pi_type1_crc;
+                break;
+        default:
+                integrity = nvme_meta_noop;
+                break;
+        }
+        integrity.tuple_size = ns->ms;
+        blk_integrity_register(ns->disk, &integrity);
+        blk_queue_max_integrity_segments(ns->queue, 1);
+}
+#else /* CONFIG_BLK_DEV_INTEGRITY */
+static void nvme_dif_remap(struct request *req,
+                        void (*dif_swap)(u32 p, u32 v, struct t10_pi_tuple *pi))
+{
+}
+static void nvme_dif_prep(u32 p, u32 v, struct t10_pi_tuple *pi)
+{
+}
+static void nvme_dif_complete(u32 p, u32 v, struct t10_pi_tuple *pi)
+{
+}
+static void nvme_init_integrity(struct nvme_ns *ns)
+{
+}
+#endif
+
 static void req_completion(struct nvme_queue *nvmeq, void *ctx,
                                                 struct nvme_completion *cqe)
 {
@@ -1959,43 +2012,6 @@ static void nvme_config_discard(struct nvme_ns *ns)
         queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, ns->queue);
 }
 
-static int nvme_noop_verify(struct blk_integrity_iter *iter)
-{
-        return 0;
-}
-
-static int nvme_noop_generate(struct blk_integrity_iter *iter)
-{
-        return 0;
-}
-
-struct blk_integrity nvme_meta_noop = {
-        .name                   = "NVME_META_NOOP",
-        .generate_fn            = nvme_noop_generate,
-        .verify_fn              = nvme_noop_verify,
-};
-
-static void nvme_init_integrity(struct nvme_ns *ns)
-{
-        struct blk_integrity integrity;
-
-        switch (ns->pi_type) {
-        case NVME_NS_DPS_PI_TYPE3:
-                integrity = t10_pi_type3_crc;
-                break;
-        case NVME_NS_DPS_PI_TYPE1:
-        case NVME_NS_DPS_PI_TYPE2:
-                integrity = t10_pi_type1_crc;
-                break;
-        default:
-                integrity = nvme_meta_noop;
-                break;
-        }
-        integrity.tuple_size = ns->ms;
-        blk_integrity_register(ns->disk, &integrity);
-        blk_queue_max_integrity_segments(ns->queue, 1);
-}
-
 static int nvme_revalidate_disk(struct gendisk *disk)
 {
         struct nvme_ns *ns = disk->private_data;
@@ -2036,7 +2052,8 @@ static int nvme_revalidate_disk(struct gendisk *disk)
         pi_type = ns->ms == sizeof(struct t10_pi_tuple) ?
                                         id->dps & NVME_NS_DPS_PI_MASK : 0;
 
-        if (disk->integrity && (ns->pi_type != pi_type || ns->ms != old_ms ||
+        if (blk_get_integrity(disk) && (ns->pi_type != pi_type ||
+                                ns->ms != old_ms ||
                                 bs != queue_logical_block_size(disk->queue) ||
                                 (ns->ms && id->flbas & NVME_NS_FLBAS_META_EXT)))
                 blk_integrity_unregister(disk);
@@ -2044,11 +2061,11 @@ static int nvme_revalidate_disk(struct gendisk *disk)
         ns->pi_type = pi_type;
         blk_queue_logical_block_size(ns->queue, bs);
 
-        if (ns->ms && !disk->integrity && (disk->flags & GENHD_FL_UP) &&
+        if (ns->ms && !blk_get_integrity(disk) && (disk->flags & GENHD_FL_UP) &&
                                 !(id->flbas & NVME_NS_FLBAS_META_EXT))
                 nvme_init_integrity(ns);
 
-        if (id->ncap == 0 || (ns->ms && !disk->integrity))
+        if (id->ncap == 0 || (ns->ms && !blk_get_integrity(disk)))
                 set_capacity(disk, 0);
         else
                 set_capacity(disk, le64_to_cpup(&id->nsze) << (ns->lba_shift - 9));
@@ -2652,7 +2669,7 @@ static void nvme_dev_remove(struct nvme_dev *dev)
 
         list_for_each_entry(ns, &dev->namespaces, list) {
                 if (ns->disk->flags & GENHD_FL_UP) {
-                        if (ns->disk->integrity)
+                        if (blk_get_integrity(ns->disk))
                                 blk_integrity_unregister(ns->disk);
                         del_gendisk(ns->disk);
                 }
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 8e233edd7a09..871bd3550cb0 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -528,7 +528,7 @@ out_cleanup:
 static inline void update_used_max(struct zram *zram,
                                         const unsigned long pages)
 {
-        int old_max, cur_max;
+        unsigned long old_max, cur_max;
 
         old_max = atomic_long_read(&zram->stats.max_used_pages);
 
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index b87688881143..8bfc4c2bba87 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -272,6 +272,7 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 
         /* Intel Bluetooth devices */
+        { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c
index f07c8152e5cc..3f27d21fb729 100644
--- a/drivers/clk/at91/pmc.c
+++ b/drivers/clk/at91/pmc.c
@@ -89,12 +89,29 @@ static int pmc_irq_set_type(struct irq_data *d, unsigned type)
         return 0;
 }
 
+static void pmc_irq_suspend(struct irq_data *d)
+{
+        struct at91_pmc *pmc = irq_data_get_irq_chip_data(d);
+
+        pmc->imr = pmc_read(pmc, AT91_PMC_IMR);
+        pmc_write(pmc, AT91_PMC_IDR, pmc->imr);
+}
+
+static void pmc_irq_resume(struct irq_data *d)
+{
+        struct at91_pmc *pmc = irq_data_get_irq_chip_data(d);
+
+        pmc_write(pmc, AT91_PMC_IER, pmc->imr);
+}
+
 static struct irq_chip pmc_irq = {
         .name = "PMC",
         .irq_disable = pmc_irq_mask,
         .irq_mask = pmc_irq_mask,
         .irq_unmask = pmc_irq_unmask,
         .irq_set_type = pmc_irq_set_type,
+        .irq_suspend = pmc_irq_suspend,
+        .irq_resume = pmc_irq_resume,
 };
 
 static struct lock_class_key pmc_lock_class;
@@ -224,7 +241,8 @@ static struct at91_pmc *__init at91_pmc_init(struct device_node *np,
                 goto out_free_pmc;
 
         pmc_write(pmc, AT91_PMC_IDR, 0xffffffff);
-        if (request_irq(pmc->virq, pmc_irq_handler, IRQF_SHARED, "pmc", pmc))
+        if (request_irq(pmc->virq, pmc_irq_handler,
+                        IRQF_SHARED | IRQF_COND_SUSPEND, "pmc", pmc))
                 goto out_remove_irqdomain;
 
         return pmc;
diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
index 52d2041fa3f6..69abb08cf146 100644
--- a/drivers/clk/at91/pmc.h
+++ b/drivers/clk/at91/pmc.h
@@ -33,6 +33,7 @@ struct at91_pmc {
         spinlock_t lock;
         const struct at91_pmc_caps *caps;
         struct irq_domain *irqdomain;
+        u32 imr;
 };
 
 static inline void pmc_lock(struct at91_pmc *pmc)
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 1c2506f68122..68161f7a07d6 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -63,6 +63,11 @@ config VT8500_TIMER
 config CADENCE_TTC_TIMER
         bool
 
+config ASM9260_TIMER
+        bool
+        select CLKSRC_MMIO
+        select CLKSRC_OF
+
 config CLKSRC_NOMADIK_MTU
         bool
         depends on (ARCH_NOMADIK || ARCH_U8500)
@@ -245,15 +250,4 @@ config CLKSRC_PXA
         help
           This enables OST0 support available on PXA and SA-11x0
           platforms.
-
-config ASM9260_TIMER
-        bool "Alphascale ASM9260 timer driver"
-        depends on GENERIC_CLOCKEVENTS
-        select CLKSRC_MMIO
-        select CLKSRC_OF
-        default y if MACH_ASM9260
-        help
-          This enables build of a clocksource and clockevent driver for
-          the 32-bit System Timer hardware available on a Alphascale ASM9260.
-
 endmenu
diff --git a/drivers/clocksource/mtk_timer.c b/drivers/clocksource/mtk_timer.c
index 32a3d25795d3..68ab42356d0e 100644
--- a/drivers/clocksource/mtk_timer.c
+++ b/drivers/clocksource/mtk_timer.c
@@ -224,6 +224,8 @@ static void __init mtk_timer_init(struct device_node *node)
         }
         rate = clk_get_rate(clk);
 
+        mtk_timer_global_reset(evt);
+
         if (request_irq(evt->dev.irq, mtk_timer_interrupt,
                         IRQF_TIMER | IRQF_IRQPOLL, "mtk_timer", evt)) {
                 pr_warn("failed to setup irq %d\n", evt->dev.irq);
@@ -232,8 +234,6 @@ static void __init mtk_timer_init(struct device_node *node)
 
         evt->ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
 
-        mtk_timer_global_reset(evt);
-
         /* Configure clock source */
         mtk_timer_setup(evt, GPT_CLK_SRC, TIMER_CTRL_OP_FREERUN);
         clocksource_mmio_init(evt->gpt_base + TIMER_CNT_REG(GPT_CLK_SRC),
@@ -241,10 +241,11 @@ static void __init mtk_timer_init(struct device_node *node)
 
         /* Configure clock event */
         mtk_timer_setup(evt, GPT_CLK_EVT, TIMER_CTRL_OP_REPEAT);
-        mtk_timer_enable_irq(evt, GPT_CLK_EVT);
-
         clockevents_config_and_register(&evt->dev, rate, 0x3,
                                         0xffffffff);
+
+        mtk_timer_enable_irq(evt, GPT_CLK_EVT);
+
         return;
 
 err_clk_disable:
diff --git a/drivers/clocksource/pxa_timer.c b/drivers/clocksource/pxa_timer.c
index 941f3f344e08..d9438af2bbd6 100644
--- a/drivers/clocksource/pxa_timer.c
+++ b/drivers/clocksource/pxa_timer.c
@@ -163,7 +163,7 @@ static struct irqaction pxa_ost0_irq = {
         .dev_id         = &ckevt_pxa_osmr0,
 };
 
-static void pxa_timer_common_init(int irq, unsigned long clock_tick_rate)
+static void __init pxa_timer_common_init(int irq, unsigned long clock_tick_rate)
 {
         timer_writel(0, OIER);
         timer_writel(OSSR_M0 | OSSR_M1 | OSSR_M2 | OSSR_M3, OSSR);
diff --git a/drivers/cpufreq/exynos-cpufreq.c b/drivers/cpufreq/exynos-cpufreq.c
index 5e98c6b1f284..82d2fbb20f7e 100644
--- a/drivers/cpufreq/exynos-cpufreq.c
+++ b/drivers/cpufreq/exynos-cpufreq.c
@@ -159,7 +159,7 @@ static struct cpufreq_driver exynos_driver = {
 
 static int exynos_cpufreq_probe(struct platform_device *pdev)
 {
-        struct device_node *cpus, *np;
+        struct device_node *cpu0;
         int ret = -EINVAL;
 
         exynos_info = kzalloc(sizeof(*exynos_info), GFP_KERNEL);
@@ -206,28 +206,19 @@ static int exynos_cpufreq_probe(struct platform_device *pdev)
         if (ret)
                 goto err_cpufreq_reg;
 
-        cpus = of_find_node_by_path("/cpus");
-        if (!cpus) {
-                pr_err("failed to find cpus node\n");
+        cpu0 = of_get_cpu_node(0, NULL);
+        if (!cpu0) {
+                pr_err("failed to find cpu0 node\n");
                 return 0;
         }
 
-        np = of_get_next_child(cpus, NULL);
-        if (!np) {
-                pr_err("failed to find cpus child node\n");
-                of_node_put(cpus);
-                return 0;
-        }
-
-        if (of_find_property(np, "#cooling-cells", NULL)) {
-                cdev = of_cpufreq_cooling_register(np,
+        if (of_find_property(cpu0, "#cooling-cells", NULL)) {
+                cdev = of_cpufreq_cooling_register(cpu0,
                                                    cpu_present_mask);
                 if (IS_ERR(cdev))
                         pr_err("running cpufreq without cooling device: %ld\n",
                                PTR_ERR(cdev));
         }
-        of_node_put(np);
-        of_node_put(cpus);
 
         return 0;
 
diff --git a/drivers/cpufreq/ppc-corenet-cpufreq.c b/drivers/cpufreq/ppc-corenet-cpufreq.c
index bee5df7794d3..7cb4b766cf94 100644
--- a/drivers/cpufreq/ppc-corenet-cpufreq.c
+++ b/drivers/cpufreq/ppc-corenet-cpufreq.c
@@ -22,6 +22,8 @@
 #include <linux/smp.h>
 #include <sysdev/fsl_soc.h>
 
+#include <asm/smp.h>    /* for get_hard_smp_processor_id() in UP configs */
+
 /**
  * struct cpu_data - per CPU data struct
  * @parent: the parent node of cpu clock
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 4d534582514e..080bd2dbde4b 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -44,6 +44,12 @@ void disable_cpuidle(void)
         off = 1;
 }
 
+bool cpuidle_not_available(struct cpuidle_driver *drv,
+                           struct cpuidle_device *dev)
+{
+        return off || !initialized || !drv || !dev || !dev->enabled;
+}
+
 /**
  * cpuidle_play_dead - cpu off-lining
  *
@@ -66,14 +72,8 @@ int cpuidle_play_dead(void)
         return -ENODEV;
 }
 
-/**
- * cpuidle_find_deepest_state - Find deepest state meeting specific conditions.
- * @drv: cpuidle driver for the given CPU.
- * @dev: cpuidle device for the given CPU.
- * @freeze: Whether or not the state should be suitable for suspend-to-idle.
- */
-static int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
-                                      struct cpuidle_device *dev, bool freeze)
+static int find_deepest_state(struct cpuidle_driver *drv,
+                              struct cpuidle_device *dev, bool freeze)
 {
         unsigned int latency_req = 0;
         int i, ret = freeze ? -1 : CPUIDLE_DRIVER_STATE_START - 1;
@@ -92,6 +92,17 @@ static int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
         return ret;
 }
 
+/**
+ * cpuidle_find_deepest_state - Find the deepest available idle state.
+ * @drv: cpuidle driver for the given CPU.
+ * @dev: cpuidle device for the given CPU.
+ */
+int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
+                               struct cpuidle_device *dev)
+{
+        return find_deepest_state(drv, dev, false);
+}
+
 static void enter_freeze_proper(struct cpuidle_driver *drv,
                                 struct cpuidle_device *dev, int index)
 {
@@ -113,15 +124,14 @@ static void enter_freeze_proper(struct cpuidle_driver *drv,
 
 /**
  * cpuidle_enter_freeze - Enter an idle state suitable for suspend-to-idle.
+ * @drv: cpuidle driver for the given CPU.
+ * @dev: cpuidle device for the given CPU.
  *
  * If there are states with the ->enter_freeze callback, find the deepest of
- * them and enter it with frozen tick.  Otherwise, find the deepest state
- * available and enter it normally.
+ * them and enter it with frozen tick.
  */
-void cpuidle_enter_freeze(void)
+int cpuidle_enter_freeze(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 {
-        struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
-        struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
         int index;
 
         /*
@@ -129,24 +139,11 @@ void cpuidle_enter_freeze(void)
          * that interrupts won't be enabled when it exits and allows the tick to
          * be frozen safely.
          */
-        index = cpuidle_find_deepest_state(drv, dev, true);
-        if (index >= 0) {
-                enter_freeze_proper(drv, dev, index);
-                return;
-        }
-
-        /*
-         * It is not safe to freeze the tick, find the deepest state available
-         * at all and try to enter it normally.
-         */
-        index = cpuidle_find_deepest_state(drv, dev, false);
+        index = find_deepest_state(drv, dev, true);
         if (index >= 0)
-                cpuidle_enter(drv, dev, index);
-        else
-                arch_cpu_idle();
+                enter_freeze_proper(drv, dev, index);
 
-        /* Interrupts are enabled again here. */
-        local_irq_disable();
+        return index;
 }
 
 /**
@@ -205,12 +202,6 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv,
  */
 int cpuidle_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 {
-        if (off || !initialized)
-                return -ENODEV;
-
-        if (!drv || !dev || !dev->enabled)
-                return -EBUSY;
-
         return cpuidle_curr_governor->select(drv, dev);
 }
 
diff --git a/drivers/dma-buf/fence.c b/drivers/dma-buf/fence.c
index e5541117b3e9..50ef8bd8708b 100644
--- a/drivers/dma-buf/fence.c
+++ b/drivers/dma-buf/fence.c
@@ -159,6 +159,9 @@ fence_wait_timeout(struct fence *fence, bool intr, signed long timeout)
         if (WARN_ON(timeout < 0))
                 return -EINVAL;
 
+        if (timeout == 0)
+                return fence_is_signaled(fence);
+
         trace_fence_wait_start(fence);
         ret = fence->ops->wait(fence, intr, timeout);
         trace_fence_wait_end(fence);
diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
index 3c97c8fa8d02..39920d77f288 100644
--- a/drivers/dma-buf/reservation.c
+++ b/drivers/dma-buf/reservation.c
@@ -327,6 +327,9 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
         unsigned seq, shared_count, i = 0;
         long ret = timeout;
 
+        if (!timeout)
+                return reservation_object_test_signaled_rcu(obj, wait_all);
+
 retry:
         fence = NULL;
         shared_count = 0;
@@ -402,8 +405,6 @@ reservation_object_test_signaled_single(struct fence *passed_fence)
         int ret = 1;
 
         if (!test_bit(FENCE_FLAG_SIGNALED_BIT, &lfence->flags)) {
-                int ret;
-
                 fence = fence_get_rcu(lfence);
                 if (!fence)
                         return -1;
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 09e2825a547a..d9891d3461f6 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -664,7 +664,6 @@ at_xdmac_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr,
         struct at_xdmac_desc    *first = NULL, *prev = NULL;
         unsigned int            periods = buf_len / period_len;
         int                     i;
-        u32                     cfg;
 
         dev_dbg(chan2dev(chan), "%s: buf_addr=%pad, buf_len=%zd, period_len=%zd, dir=%s, flags=0x%lx\n",
                 __func__, &buf_addr, buf_len, period_len,
@@ -700,17 +699,17 @@ at_xdmac_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr,
                 if (direction == DMA_DEV_TO_MEM) {
                         desc->lld.mbr_sa = atchan->per_src_addr;
                         desc->lld.mbr_da = buf_addr + i * period_len;
-                        cfg = atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG];
+                        desc->lld.mbr_cfg = atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG];
                 } else {
                         desc->lld.mbr_sa = buf_addr + i * period_len;
                         desc->lld.mbr_da = atchan->per_dst_addr;
-                        cfg = atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG];
+                        desc->lld.mbr_cfg = atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG];
                 }
                 desc->lld.mbr_ubc = AT_XDMAC_MBR_UBC_NDV1
                         | AT_XDMAC_MBR_UBC_NDEN
                         | AT_XDMAC_MBR_UBC_NSEN
                         | AT_XDMAC_MBR_UBC_NDE
-                        | period_len >> at_xdmac_get_dwidth(cfg);
+                        | period_len >> at_xdmac_get_dwidth(desc->lld.mbr_cfg);
 
                 dev_dbg(chan2dev(chan),
                          "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x\n",
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 455b7a4f1e87..a8ad05291b27 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -626,7 +626,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
         dev_vdbg(dw->dma.dev, "%s: status=0x%x\n", __func__, status);
 
         /* Check if we have any interrupt from the DMAC */
-        if (!status)
+        if (!status || !dw->in_use)
                 return IRQ_NONE;
 
         /*
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 77a6dcf25b98..194ec20c9408 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -230,6 +230,10 @@ static bool is_bwd_noraid(struct pci_dev *pdev)
         switch (pdev->device) {
         case PCI_DEVICE_ID_INTEL_IOAT_BWD2:
         case PCI_DEVICE_ID_INTEL_IOAT_BWD3:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE0:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE1:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE2:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE3:
                 return true;
         default:
                 return false;
diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index 8926f271904e..eb410044e1af 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -219,6 +219,9 @@ static irqreturn_t mmp_pdma_int_handler(int irq, void *dev_id)
 
         while (dint) {
                 i = __ffs(dint);
+                /* only handle interrupts belonging to pdma driver*/
+                if (i >= pdev->dma_channels)
+                        break;
                 dint &= (dint - 1);
                 phy = &pdev->phy[i];
                 ret = mmp_pdma_chan_handler(irq, phy);
@@ -999,6 +1002,9 @@ static int mmp_pdma_probe(struct platform_device *op)
         struct resource *iores;
         int i, ret, irq = 0;
         int dma_channels = 0, irq_num = 0;
+        const enum dma_slave_buswidth widths =
+                DMA_SLAVE_BUSWIDTH_1_BYTE   | DMA_SLAVE_BUSWIDTH_2_BYTES |
+                DMA_SLAVE_BUSWIDTH_4_BYTES;
 
         pdev = devm_kzalloc(&op->dev, sizeof(*pdev), GFP_KERNEL);
         if (!pdev)
@@ -1066,6 +1072,10 @@ static int mmp_pdma_probe(struct platform_device *op)
         pdev->device.device_config = mmp_pdma_config;
         pdev->device.device_terminate_all = mmp_pdma_terminate_all;
         pdev->device.copy_align = PDMA_ALIGNMENT;
+        pdev->device.src_addr_widths = widths;
+        pdev->device.dst_addr_widths = widths;
+        pdev->device.directions = BIT(DMA_MEM_TO_DEV) | BIT(DMA_DEV_TO_MEM);
+        pdev->device.residue_granularity = DMA_RESIDUE_GRANULARITY_DESCRIPTOR;
 
         if (pdev->dev->coherent_dma_mask)
                 dma_set_mask(pdev->dev, pdev->dev->coherent_dma_mask);
diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c
index 70c2fa9963cd..b6f4e1fc9c78 100644
--- a/drivers/dma/mmp_tdma.c
+++ b/drivers/dma/mmp_tdma.c
@@ -110,7 +110,7 @@ struct mmp_tdma_chan {
         struct tasklet_struct           tasklet;
 
         struct mmp_tdma_desc            *desc_arr;
-        phys_addr_t                     desc_arr_phys;
+        dma_addr_t                      desc_arr_phys;
         int                             desc_num;
         enum dma_transfer_direction     dir;
         dma_addr_t                      dev_addr;
@@ -166,9 +166,12 @@ static void mmp_tdma_enable_chan(struct mmp_tdma_chan *tdmac)
 static int mmp_tdma_disable_chan(struct dma_chan *chan)
 {
         struct mmp_tdma_chan *tdmac = to_mmp_tdma_chan(chan);
+        u32 tdcr;
 
-        writel(readl(tdmac->reg_base + TDCR) & ~TDCR_CHANEN,
-                                        tdmac->reg_base + TDCR);
+        tdcr = readl(tdmac->reg_base + TDCR);
+        tdcr |= TDCR_ABR;
+        tdcr &= ~TDCR_CHANEN;
+        writel(tdcr, tdmac->reg_base + TDCR);
 
         tdmac->status = DMA_COMPLETE;
 
@@ -296,12 +299,27 @@ static int mmp_tdma_clear_chan_irq(struct mmp_tdma_chan *tdmac)
         return -EAGAIN;
 }
 
+static size_t mmp_tdma_get_pos(struct mmp_tdma_chan *tdmac)
+{
+        size_t reg;
+
+        if (tdmac->idx == 0) {
+                reg = __raw_readl(tdmac->reg_base + TDSAR);
+                reg -= tdmac->desc_arr[0].src_addr;
+        } else if (tdmac->idx == 1) {
+                reg = __raw_readl(tdmac->reg_base + TDDAR);
+                reg -= tdmac->desc_arr[0].dst_addr;
+        } else
+                return -EINVAL;
+
+        return reg;
+}
+
 static irqreturn_t mmp_tdma_chan_handler(int irq, void *dev_id)
 {
         struct mmp_tdma_chan *tdmac = dev_id;
 
         if (mmp_tdma_clear_chan_irq(tdmac) == 0) {
-                tdmac->pos = (tdmac->pos + tdmac->period_len) % tdmac->buf_len;
                 tasklet_schedule(&tdmac->tasklet);
                 return IRQ_HANDLED;
         } else
@@ -343,7 +361,7 @@ static void mmp_tdma_free_descriptor(struct mmp_tdma_chan *tdmac)
         int size = tdmac->desc_num * sizeof(struct mmp_tdma_desc);
 
         gpool = tdmac->pool;
-        if (tdmac->desc_arr)
+        if (gpool && tdmac->desc_arr)
                 gen_pool_free(gpool, (unsigned long)tdmac->desc_arr,
                                 size);
         tdmac->desc_arr = NULL;
@@ -499,6 +517,7 @@ static enum dma_status mmp_tdma_tx_status(struct dma_chan *chan,
 {
         struct mmp_tdma_chan *tdmac = to_mmp_tdma_chan(chan);
 
+        tdmac->pos = mmp_tdma_get_pos(tdmac);
         dma_set_tx_state(txstate, chan->completed_cookie, chan->cookie,
                          tdmac->buf_len - tdmac->pos);
 
@@ -610,7 +629,7 @@ static int mmp_tdma_probe(struct platform_device *pdev)
         int i, ret;
         int irq = 0, irq_num = 0;
         int chan_num = TDMA_CHANNEL_NUM;
-        struct gen_pool *pool;
+        struct gen_pool *pool = NULL;
 
         of_id = of_match_device(mmp_tdma_dt_ids, &pdev->dev);
         if (of_id)
diff --git a/drivers/dma/qcom_bam_dma.c b/drivers/dma/qcom_bam_dma.c
index d7a33b3ac466..9c914d625906 100644
--- a/drivers/dma/qcom_bam_dma.c
+++ b/drivers/dma/qcom_bam_dma.c
@@ -162,9 +162,9 @@ static const struct reg_offset_data bam_v1_4_reg_info[] = {
         [BAM_P_IRQ_STTS]        = { 0x1010, 0x1000, 0x00, 0x00 },
         [BAM_P_IRQ_CLR]         = { 0x1014, 0x1000, 0x00, 0x00 },
         [BAM_P_IRQ_EN]          = { 0x1018, 0x1000, 0x00, 0x00 },
-        [BAM_P_EVNT_DEST_ADDR]  = { 0x102C, 0x00, 0x1000, 0x00 },
-        [BAM_P_EVNT_REG]        = { 0x1018, 0x00, 0x1000, 0x00 },
-        [BAM_P_SW_OFSTS]        = { 0x1000, 0x00, 0x1000, 0x00 },
+        [BAM_P_EVNT_DEST_ADDR]  = { 0x182C, 0x00, 0x1000, 0x00 },
+        [BAM_P_EVNT_REG]        = { 0x1818, 0x00, 0x1000, 0x00 },
+        [BAM_P_SW_OFSTS]        = { 0x1800, 0x00, 0x1000, 0x00 },
         [BAM_P_DATA_FIFO_ADDR]  = { 0x1824, 0x00, 0x1000, 0x00 },
         [BAM_P_DESC_FIFO_ADDR]  = { 0x181C, 0x00, 0x1000, 0x00 },
         [BAM_P_EVNT_GEN_TRSHLD] = { 0x1828, 0x00, 0x1000, 0x00 },
@@ -1143,6 +1143,10 @@ static int bam_dma_probe(struct platform_device *pdev)
         dma_cap_set(DMA_SLAVE, bdev->common.cap_mask);
 
         /* initialize dmaengine apis */
+        bdev->common.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        bdev->common.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
+        bdev->common.src_addr_widths = DMA_SLAVE_BUSWIDTH_4_BYTES;
+        bdev->common.dst_addr_widths = DMA_SLAVE_BUSWIDTH_4_BYTES;
         bdev->common.device_alloc_chan_resources = bam_alloc_chan;
         bdev->common.device_free_chan_resources = bam_free_chan;
         bdev->common.device_prep_slave_sg = bam_prep_slave_sg;
diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
index b2431aa30033..9f1d4c7dbab8 100644
--- a/drivers/dma/sh/shdmac.c
+++ b/drivers/dma/sh/shdmac.c
@@ -582,15 +582,12 @@ static void sh_dmae_chan_remove(struct sh_dmae_device *shdev)
         }
 }
 
-static void sh_dmae_shutdown(struct platform_device *pdev)
-{
-        struct sh_dmae_device *shdev = platform_get_drvdata(pdev);
-        sh_dmae_ctl_stop(shdev);
-}
-
 #ifdef CONFIG_PM
 static int sh_dmae_runtime_suspend(struct device *dev)
 {
+        struct sh_dmae_device *shdev = dev_get_drvdata(dev);
+
+        sh_dmae_ctl_stop(shdev);
         return 0;
 }
 
@@ -605,6 +602,9 @@ static int sh_dmae_runtime_resume(struct device *dev)
 #ifdef CONFIG_PM_SLEEP
 static int sh_dmae_suspend(struct device *dev)
 {
+        struct sh_dmae_device *shdev = dev_get_drvdata(dev);
+
+        sh_dmae_ctl_stop(shdev);
         return 0;
 }
 
@@ -929,13 +929,12 @@ static int sh_dmae_remove(struct platform_device *pdev)
 }
 
 static struct platform_driver sh_dmae_driver = {
-        .driver         = {
+        .driver         = {
                 .pm     = &sh_dmae_pm,
                 .name   = SH_DMAE_DRV_NAME,
                 .of_match_table = sh_dmae_of_match,
         },
         .remove         = sh_dmae_remove,
-        .shutdown       = sh_dmae_shutdown,
 };
 
 static int __init sh_dmae_init(void)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index c5f7b4e9eb6c..69fac068669f 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -78,7 +78,7 @@ static const char * __init dmi_string(const struct dmi_header *dm, u8 s)
  *      We have to be cautious here. We have seen BIOSes with DMI pointers
  *      pointing to completely the wrong place for example
  */
-static void dmi_table(u8 *buf, int len, int num,
+static void dmi_table(u8 *buf, u32 len, int num,
                       void (*decode)(const struct dmi_header *, void *),
                       void *private_data)
 {
@@ -93,12 +93,6 @@ static void dmi_table(u8 *buf, int len, int num,
                 const struct dmi_header *dm = (const struct dmi_header *)data;
 
                 /*
-                 * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0]
-                 */
-                if (dm->type == DMI_ENTRY_END_OF_TABLE)
-                        break;
-
-                /*
                  *  We want to know the total length (formatted area and
                  *  strings) before decoding to make sure we won't run off the
                  *  table in dmi_decode or dmi_string
@@ -108,13 +102,20 @@ static void dmi_table(u8 *buf, int len, int num,
                         data++;
                 if (data - buf < len - 1)
                         decode(dm, private_data);
+
+                /*
+                 * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0]
+                 */
+                if (dm->type == DMI_ENTRY_END_OF_TABLE)
+                        break;
+
                 data += 2;
                 i++;
         }
 }
 
 static phys_addr_t dmi_base;
-static u16 dmi_len;
+static u32 dmi_len;
 static u16 dmi_num;
 
 static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 2fe195002021..f07d4a67fa76 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -179,12 +179,12 @@ again:
                 start = desc->phys_addr;
                 end = start + desc->num_pages * (1UL << EFI_PAGE_SHIFT);
 
-                if ((start + size) > end || (start + size) > max)
-                        continue;
-
-                if (end - size > max)
+                if (end > max)
                         end = max;
 
+                if ((start + size) > end)
+                        continue;
+
                 if (round_down(end - size, align) < start)
                         continue;
 
diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c
index 472fb5b8779f..9cdbc0c9cb2d 100644
--- a/drivers/gpio/gpio-tps65912.c
+++ b/drivers/gpio/gpio-tps65912.c
@@ -26,9 +26,12 @@ struct tps65912_gpio_data {
         struct gpio_chip gpio_chip;
 };
 
+#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip)
+
 static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
         int val;
 
         val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset);
@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
 static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
                               int value)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
         if (value)
                 tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset,
@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
 static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
                                 int value)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
         /* Set the initial value */
         tps65912_gpio_set(gc, offset, value);
@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
 
 static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
         return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset,
                                                                 GPIO_CFG_MASK);
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 8cad8e400b44..4650bf830d6b 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -46,12 +46,13 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
 
         ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
         if (ret < 0) {
-                /* We've found the gpio chip, but the translation failed.
-                 * Return true to stop looking and return the translation
-                 * error via out_gpio
+                /* We've found a gpio chip, but the translation failed.
+                 * Store translation error in out_gpio.
+                 * Return false to keep looking, as more than one gpio chip
+                 * could be registered per of-node.
                  */
                 gg_data->out_gpio = ERR_PTR(ret);
-                return true;
+                return false;
          }
 
         gg_data->out_gpio = gpiochip_get_desc(gc, ret);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index b3589d0e39b9..910ff8ab9c9c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -62,12 +62,18 @@ enum KFD_MQD_TYPE get_mqd_type_from_queue_type(enum kfd_queue_type type)
         return KFD_MQD_TYPE_CP;
 }
 
-static inline unsigned int get_first_pipe(struct device_queue_manager *dqm)
+unsigned int get_first_pipe(struct device_queue_manager *dqm)
 {
-        BUG_ON(!dqm);
+        BUG_ON(!dqm || !dqm->dev);
         return dqm->dev->shared_resources.first_compute_pipe;
 }
 
+unsigned int get_pipes_num(struct device_queue_manager *dqm)
+{
+        BUG_ON(!dqm || !dqm->dev);
+        return dqm->dev->shared_resources.compute_pipe_count;
+}
+
 static inline unsigned int get_pipes_num_cpsch(void)
 {
         return PIPE_PER_ME_CP_SCHEDULING;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
index d64f86cda34f..488f51d19427 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
@@ -163,6 +163,8 @@ void program_sh_mem_settings(struct device_queue_manager *dqm,
                                         struct qcm_process_device *qpd);
 int init_pipelines(struct device_queue_manager *dqm,
                 unsigned int pipes_num, unsigned int first_pipe);
+unsigned int get_first_pipe(struct device_queue_manager *dqm);
+unsigned int get_pipes_num(struct device_queue_manager *dqm);
 
 extern inline unsigned int get_sh_mem_bases_32(struct kfd_process_device *pdd)
 {
@@ -175,10 +177,4 @@ get_sh_mem_bases_nybble_64(struct kfd_process_device *pdd)
         return (pdd->lds_base >> 60) & 0x0E;
 }
 
-extern inline unsigned int get_pipes_num(struct device_queue_manager *dqm)
-{
-        BUG_ON(!dqm || !dqm->dev);
-        return dqm->dev->shared_resources.compute_pipe_count;
-}
-
 #endif /* KFD_DEVICE_QUEUE_MANAGER_H_ */
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c
index 6b072466e2a6..5469efe0523e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c
@@ -131,5 +131,5 @@ static int register_process_cik(struct device_queue_manager *dqm,
 
 static int initialize_cpsch_cik(struct device_queue_manager *dqm)
 {
-        return init_pipelines(dqm, get_pipes_num(dqm), 0);
+        return init_pipelines(dqm, get_pipes_num(dqm), get_first_pipe(dqm));
 }
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index b81cea6baeea..d55c0c232e1d 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -85,7 +85,7 @@ static void atmel_hlcdc_crtc_mode_set_nofb(struct drm_crtc *c)
                      (adj->crtc_hdisplay - 1) |
                      ((adj->crtc_vdisplay - 1) << 16));
 
-        cfg = ATMEL_HLCDC_CLKPOL;
+        cfg = 0;
 
         prate = clk_get_rate(crtc->dc->hlcdc->sys_clk);
         mode_rate = adj->crtc_clock * 1000;
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
index 01afeafe17b1..c4bb1f9f95c6 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
@@ -313,8 +313,6 @@ static int atmel_hlcdc_dc_load(struct drm_device *dev)
 
         pm_runtime_enable(dev->dev);
 
-        pm_runtime_put_sync(dev->dev);
-
         ret = atmel_hlcdc_dc_modeset_init(dev);
         if (ret < 0) {
                 dev_err(dev->dev, "failed to initialize mode setting\n");
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c
index d1dca39b76dd..377e43cea9dd 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c
@@ -311,7 +311,8 @@ void atmel_hlcdc_layer_disable(struct atmel_hlcdc_layer *layer)
 
         /* Disable the layer */
         regmap_write(regmap, desc->regs_offset + ATMEL_HLCDC_LAYER_CHDR,
-                     ATMEL_HLCDC_LAYER_RST);
+                     ATMEL_HLCDC_LAYER_RST | ATMEL_HLCDC_LAYER_A2Q |
+                     ATMEL_HLCDC_LAYER_UPDATE);
 
         /* Clear all pending interrupts */
         regmap_read(regmap, desc->regs_offset + ATMEL_HLCDC_LAYER_ISR, &isr);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 29dbde5ecef7..927f3445ff38 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2138,7 +2138,6 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
         DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
 
         mutex_lock(&dev->mode_config.mutex);
-        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
 
         connector = drm_connector_find(dev, out_resp->connector_id);
         if (!connector) {
@@ -2168,6 +2167,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
         out_resp->mm_height = connector->display_info.height_mm;
         out_resp->subpixel = connector->display_info.subpixel_order;
         out_resp->connection = connector->status;
+
+        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
         encoder = drm_connector_get_encoder(connector);
         if (encoder)
                 out_resp->encoder_id = encoder->base.id;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 04a209e2b66d..7fc6f8bd4821 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -91,29 +91,29 @@
  */
 
 static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
-                                                unsigned long size,
+                                                u64 size,
                                                 unsigned alignment,
                                                 unsigned long color,
                                                 enum drm_mm_search_flags flags);
 static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_mm *mm,
-                                                unsigned long size,
+                                                u64 size,
                                                 unsigned alignment,
                                                 unsigned long color,
-                                                unsigned long start,
-                                                unsigned long end,
+                                                u64 start,
+                                                u64 end,
                                                 enum drm_mm_search_flags flags);
 
 static void drm_mm_insert_helper(struct drm_mm_node *hole_node,
                                  struct drm_mm_node *node,
-                                 unsigned long size, unsigned alignment,
+                                 u64 size, unsigned alignment,
                                  unsigned long color,
                                  enum drm_mm_allocator_flags flags)
 {
         struct drm_mm *mm = hole_node->mm;
-        unsigned long hole_start = drm_mm_hole_node_start(hole_node);
-        unsigned long hole_end = drm_mm_hole_node_end(hole_node);
-        unsigned long adj_start = hole_start;
-        unsigned long adj_end = hole_end;
+        u64 hole_start = drm_mm_hole_node_start(hole_node);
+        u64 hole_end = drm_mm_hole_node_end(hole_node);
+        u64 adj_start = hole_start;
+        u64 adj_end = hole_end;
 
         BUG_ON(node->allocated);
 
@@ -124,12 +124,15 @@ static void drm_mm_insert_helper(struct drm_mm_node *hole_node,
                 adj_start = adj_end - size;
 
         if (alignment) {
-                unsigned tmp = adj_start % alignment;
-                if (tmp) {
+                u64 tmp = adj_start;
+                unsigned rem;
+
+                rem = do_div(tmp, alignment);
+                if (rem) {
                         if (flags & DRM_MM_CREATE_TOP)
-                                adj_start -= tmp;
+                                adj_start -= rem;
                         else
-                                adj_start += alignment - tmp;
+                                adj_start += alignment - rem;
                 }
         }
 
@@ -176,9 +179,9 @@ static void drm_mm_insert_helper(struct drm_mm_node *hole_node,
 int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node)
 {
         struct drm_mm_node *hole;
-        unsigned long end = node->start + node->size;
-        unsigned long hole_start;
-        unsigned long hole_end;
+        u64 end = node->start + node->size;
+        u64 hole_start;
+        u64 hole_end;
 
         BUG_ON(node == NULL);
 
@@ -227,7 +230,7 @@ EXPORT_SYMBOL(drm_mm_reserve_node);
  * 0 on success, -ENOSPC if there's no suitable hole.
  */
 int drm_mm_insert_node_generic(struct drm_mm *mm, struct drm_mm_node *node,
-                               unsigned long size, unsigned alignment,
+                               u64 size, unsigned alignment,
                                unsigned long color,
                                enum drm_mm_search_flags sflags,
                                enum drm_mm_allocator_flags aflags)
@@ -246,16 +249,16 @@ EXPORT_SYMBOL(drm_mm_insert_node_generic);
 
 static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
                                        struct drm_mm_node *node,
-                                       unsigned long size, unsigned alignment,
+                                       u64 size, unsigned alignment,
                                        unsigned long color,
-                                       unsigned long start, unsigned long end,
+                                       u64 start, u64 end,
                                        enum drm_mm_allocator_flags flags)
 {
         struct drm_mm *mm = hole_node->mm;
-        unsigned long hole_start = drm_mm_hole_node_start(hole_node);
-        unsigned long hole_end = drm_mm_hole_node_end(hole_node);
-        unsigned long adj_start = hole_start;
-        unsigned long adj_end = hole_end;
+        u64 hole_start = drm_mm_hole_node_start(hole_node);
+        u64 hole_end = drm_mm_hole_node_end(hole_node);
+        u64 adj_start = hole_start;
+        u64 adj_end = hole_end;
 
         BUG_ON(!hole_node->hole_follows || node->allocated);
 
@@ -271,12 +274,15 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
                 mm->color_adjust(hole_node, color, &adj_start, &adj_end);
 
         if (alignment) {
-                unsigned tmp = adj_start % alignment;
-                if (tmp) {
+                u64 tmp = adj_start;
+                unsigned rem;
+
+                rem = do_div(tmp, alignment);
+                if (rem) {
                         if (flags & DRM_MM_CREATE_TOP)
-                                adj_start -= tmp;
+                                adj_start -= rem;
                         else
-                                adj_start += alignment - tmp;
+                                adj_start += alignment - rem;
                 }
         }
 
@@ -324,9 +330,9 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
  * 0 on success, -ENOSPC if there's no suitable hole.
  */
 int drm_mm_insert_node_in_range_generic(struct drm_mm *mm, struct drm_mm_node *node,
-                                        unsigned long size, unsigned alignment,
+                                        u64 size, unsigned alignment,
                                         unsigned long color,
-                                        unsigned long start, unsigned long end,
+                                        u64 start, u64 end,
                                         enum drm_mm_search_flags sflags,
                                         enum drm_mm_allocator_flags aflags)
 {
@@ -387,32 +393,34 @@ void drm_mm_remove_node(struct drm_mm_node *node)
 }
 EXPORT_SYMBOL(drm_mm_remove_node);
 
-static int check_free_hole(unsigned long start, unsigned long end,
-                           unsigned long size, unsigned alignment)
+static int check_free_hole(u64 start, u64 end, u64 size, unsigned alignment)
 {
         if (end - start < size)
                 return 0;
 
         if (alignment) {
-                unsigned tmp = start % alignment;
+                u64 tmp = start;
+                unsigned rem;
+
+                rem = do_div(tmp, alignment);
                 if (tmp)
-                        start += alignment - tmp;
+                        start += alignment - rem;
         }
 
         return end >= start + size;
 }
 
 static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
-                                                      unsigned long size,
+                                                      u64 size,
                                                       unsigned alignment,
                                                       unsigned long color,
                                                       enum drm_mm_search_flags flags)
 {
         struct drm_mm_node *entry;
         struct drm_mm_node *best;
-        unsigned long adj_start;
-        unsigned long adj_end;
-        unsigned long best_size;
+        u64 adj_start;
+        u64 adj_end;
+        u64 best_size;
 
         BUG_ON(mm->scanned_blocks);
 
@@ -421,7 +429,7 @@ static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
 
         __drm_mm_for_each_hole(entry, mm, adj_start, adj_end,
                                flags & DRM_MM_SEARCH_BELOW) {
-                unsigned long hole_size = adj_end - adj_start;
+                u64 hole_size = adj_end - adj_start;
 
                 if (mm->color_adjust) {
                         mm->color_adjust(entry, color, &adj_start, &adj_end);
@@ -445,18 +453,18 @@ static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
 }
 
 static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_mm *mm,
-                                                        unsigned long size,
+                                                        u64 size,
                                                         unsigned alignment,
                                                         unsigned long color,
-                                                        unsigned long start,
-                                                        unsigned long end,
+                                                        u64 start,
+                                                        u64 end,
                                                         enum drm_mm_search_flags flags)
 {
         struct drm_mm_node *entry;
         struct drm_mm_node *best;
-        unsigned long adj_start;
-        unsigned long adj_end;
-        unsigned long best_size;
+        u64 adj_start;
+        u64 adj_end;
+        u64 best_size;
 
         BUG_ON(mm->scanned_blocks);
 
@@ -465,7 +473,7 @@ static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_
 
         __drm_mm_for_each_hole(entry, mm, adj_start, adj_end,
                                flags & DRM_MM_SEARCH_BELOW) {
-                unsigned long hole_size = adj_end - adj_start;
+                u64 hole_size = adj_end - adj_start;
 
                 if (adj_start < start)
                         adj_start = start;
@@ -561,7 +569,7 @@ EXPORT_SYMBOL(drm_mm_replace_node);
  * adding/removing nodes to/from the scan list are allowed.
  */
 void drm_mm_init_scan(struct drm_mm *mm,
-                      unsigned long size,
+                      u64 size,
                       unsigned alignment,
                       unsigned long color)
 {
@@ -594,11 +602,11 @@ EXPORT_SYMBOL(drm_mm_init_scan);
  * adding/removing nodes to/from the scan list are allowed.
  */
 void drm_mm_init_scan_with_range(struct drm_mm *mm,
-                                 unsigned long size,
+                                 u64 size,
                                  unsigned alignment,
                                  unsigned long color,
-                                 unsigned long start,
-                                 unsigned long end)
+                                 u64 start,
+                                 u64 end)
 {
         mm->scan_color = color;
         mm->scan_alignment = alignment;
@@ -627,8 +635,8 @@ bool drm_mm_scan_add_block(struct drm_mm_node *node)
 {
         struct drm_mm *mm = node->mm;
         struct drm_mm_node *prev_node;
-        unsigned long hole_start, hole_end;
-        unsigned long adj_start, adj_end;
+        u64 hole_start, hole_end;
+        u64 adj_start, adj_end;
 
         mm->scanned_blocks++;
 
@@ -731,7 +739,7 @@ EXPORT_SYMBOL(drm_mm_clean);
  *
  * Note that @mm must be cleared to 0 before calling this function.
  */
-void drm_mm_init(struct drm_mm * mm, unsigned long start, unsigned long size)
+void drm_mm_init(struct drm_mm * mm, u64 start, u64 size)
 {
         INIT_LIST_HEAD(&mm->hole_stack);
         mm->scanned_blocks = 0;
@@ -766,18 +774,17 @@ void drm_mm_takedown(struct drm_mm * mm)
 }
 EXPORT_SYMBOL(drm_mm_takedown);
 
-static unsigned long drm_mm_debug_hole(struct drm_mm_node *entry,
-                                       const char *prefix)
+static u64 drm_mm_debug_hole(struct drm_mm_node *entry,
+                                     const char *prefix)
 {
-        unsigned long hole_start, hole_end, hole_size;
+        u64 hole_start, hole_end, hole_size;
 
         if (entry->hole_follows) {
                 hole_start = drm_mm_hole_node_start(entry);
                 hole_end = drm_mm_hole_node_end(entry);
                 hole_size = hole_end - hole_start;
-                printk(KERN_DEBUG "%s 0x%08lx-0x%08lx: %8lu: free\n",
-                        prefix, hole_start, hole_end,
-                        hole_size);
+                pr_debug("%s %#llx-%#llx: %llu: free\n", prefix, hole_start,
+                         hole_end, hole_size);
                 return hole_size;
         }
 
@@ -792,35 +799,34 @@ static unsigned long drm_mm_debug_hole(struct drm_mm_node *entry,
 void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
 {
         struct drm_mm_node *entry;
-        unsigned long total_used = 0, total_free = 0, total = 0;
+        u64 total_used = 0, total_free = 0, total = 0;
 
         total_free += drm_mm_debug_hole(&mm->head_node, prefix);
 
         drm_mm_for_each_node(entry, mm) {
-                printk(KERN_DEBUG "%s 0x%08lx-0x%08lx: %8lu: used\n",
-                        prefix, entry->start, entry->start + entry->size,
-                        entry->size);
+                pr_debug("%s %#llx-%#llx: %llu: used\n", prefix, entry->start,
+                         entry->start + entry->size, entry->size);
                 total_used += entry->size;
                 total_free += drm_mm_debug_hole(entry, prefix);
         }
         total = total_free + total_used;
 
-        printk(KERN_DEBUG "%s total: %lu, used %lu free %lu\n", prefix, total,
-                total_used, total_free);
+        pr_debug("%s total: %llu, used %llu free %llu\n", prefix, total,
+                 total_used, total_free);
 }
 EXPORT_SYMBOL(drm_mm_debug_table);
 
 #if defined(CONFIG_DEBUG_FS)
-static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
+static u64 drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
 {
-        unsigned long hole_start, hole_end, hole_size;
+        u64 hole_start, hole_end, hole_size;
 
         if (entry->hole_follows) {
                 hole_start = drm_mm_hole_node_start(entry);
                 hole_end = drm_mm_hole_node_end(entry);
                 hole_size = hole_end - hole_start;
-                seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
-                                hole_start, hole_end, hole_size);
+                seq_printf(m, "%#llx-%#llx: %llu: free\n", hole_start,
+                           hole_end, hole_size);
                 return hole_size;
         }
 
@@ -835,20 +841,20 @@ static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *en
 int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
 {
         struct drm_mm_node *entry;
-        unsigned long total_used = 0, total_free = 0, total = 0;
+        u64 total_used = 0, total_free = 0, total = 0;
 
         total_free += drm_mm_dump_hole(m, &mm->head_node);
 
         drm_mm_for_each_node(entry, mm) {
-                seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: used\n",
-                                entry->start, entry->start + entry->size,
-                                entry->size);
+                seq_printf(m, "%#016llx-%#016llx: %llu: used\n", entry->start,
+                           entry->start + entry->size, entry->size);
                 total_used += entry->size;
                 total_free += drm_mm_dump_hole(m, entry);
         }
         total = total_free + total_used;
 
-        seq_printf(m, "total: %lu, used %lu free %lu\n", total, total_used, total_free);
+        seq_printf(m, "total: %llu, used %llu free %llu\n", total,
+                   total_used, total_free);
         return 0;
 }
 EXPORT_SYMBOL(drm_mm_dump_table);
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 94b3984dbea0..e38f45374d55 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -153,12 +153,12 @@ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
                         seq_puts(m, " (pp");
                 else
                         seq_puts(m, " (g");
-                seq_printf(m, "gtt offset: %08lx, size: %08lx, type: %u)",
+                seq_printf(m, "gtt offset: %08llx, size: %08llx, type: %u)",
                            vma->node.start, vma->node.size,
                            vma->ggtt_view.type);
         }
         if (obj->stolen)
-                seq_printf(m, " (stolen: %08lx)", obj->stolen->start);
+                seq_printf(m, " (stolen: %08llx)", obj->stolen->start);
         if (obj->pin_mappable || obj->fault_mappable) {
                 char s[3], *t = s;
                 if (obj->pin_mappable)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 875b1b7964c3..0001642c38b4 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -633,7 +633,7 @@ static int i915_drm_suspend(struct drm_device *dev)
         return 0;
 }
 
-static int i915_drm_suspend_late(struct drm_device *drm_dev)
+static int i915_drm_suspend_late(struct drm_device *drm_dev, bool hibernation)
 {
         struct drm_i915_private *dev_priv = drm_dev->dev_private;
         int ret;
@@ -647,7 +647,17 @@ static int i915_drm_suspend_late(struct drm_device *drm_dev)
         }
 
         pci_disable_device(drm_dev->pdev);
-        pci_set_power_state(drm_dev->pdev, PCI_D3hot);
+        /*
+         * During hibernation on some GEN4 platforms the BIOS may try to access
+         * the device even though it's already in D3 and hang the machine. So
+         * leave the device in D0 on those platforms and hope the BIOS will
+         * power down the device properly. Platforms where this was seen:
+         * Lenovo Thinkpad X301, X61s
+         */
+        if (!(hibernation &&
+              drm_dev->pdev->subsystem_vendor == PCI_VENDOR_ID_LENOVO &&
+              INTEL_INFO(dev_priv)->gen == 4))
+                pci_set_power_state(drm_dev->pdev, PCI_D3hot);
 
         return 0;
 }
@@ -673,7 +683,7 @@ int i915_suspend_legacy(struct drm_device *dev, pm_message_t state)
         if (error)
                 return error;
 
-        return i915_drm_suspend_late(dev);
+        return i915_drm_suspend_late(dev, false);
 }
 
 static int i915_drm_resume(struct drm_device *dev)
@@ -953,7 +963,17 @@ static int i915_pm_suspend_late(struct device *dev)
         if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
                 return 0;
 
-        return i915_drm_suspend_late(drm_dev);
+        return i915_drm_suspend_late(drm_dev, false);
+}
+
+static int i915_pm_poweroff_late(struct device *dev)
+{
+        struct drm_device *drm_dev = dev_to_i915(dev)->dev;
+
+        if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+                return 0;
+
+        return i915_drm_suspend_late(drm_dev, true);
 }
 
 static int i915_pm_resume_early(struct device *dev)
@@ -1523,7 +1543,7 @@ static const struct dev_pm_ops i915_pm_ops = {
         .thaw_early = i915_pm_resume_early,
         .thaw = i915_pm_resume,
         .poweroff = i915_pm_suspend,
-        .poweroff_late = i915_pm_suspend_late,
+        .poweroff_late = i915_pm_poweroff_late,
         .restore_early = i915_pm_resume_early,
         .restore = i915_pm_resume,
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 2903090f25e5..ee5bc43dfc0b 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2004,6 +2004,9 @@ void i915_gem_track_fb(struct drm_i915_gem_object *old,
  * number comparisons on buffer last_read|write_seqno. It also allows an
  * emission time to be associated with the request for tracking how far ahead
  * of the GPU the submission is.
+ *
+ * The requests are reference counted, so upon creation they should have an
+ * initial reference taken using kref_init
  */
 struct drm_i915_gem_request {
         struct kref ref;
@@ -2027,7 +2030,16 @@ struct drm_i915_gem_request {
         /** Position in the ringbuffer of the end of the whole request */
         u32 tail;
 
-        /** Context and ring buffer related to this request */
+        /**
+         * Context and ring buffer related to this request
+         * Contexts are refcounted, so when this request is associated with a
+         * context, we must increment the context's refcount, to guarantee that
+         * it persists while any request is linked to it. Requests themselves
+         * are also refcounted, so the request will only be freed when the last
+         * reference to it is dismissed, and the code in
+         * i915_gem_request_free() will then decrement the refcount on the
+         * context.
+         */
         struct intel_context *ctx;
         struct intel_ringbuffer *ringbuf;
 
@@ -2266,6 +2278,7 @@ struct drm_i915_cmd_table {
                                  (INTEL_DEVID(dev) & 0xFF00) == 0x0C00)
 #define IS_BDW_ULT(dev)         (IS_BROADWELL(dev) && \
                                  ((INTEL_DEVID(dev) & 0xf) == 0x6 ||    \
+                                 (INTEL_DEVID(dev) & 0xf) == 0xb ||     \
                                  (INTEL_DEVID(dev) & 0xf) == 0xe))
 #define IS_BDW_GT3(dev)         (IS_BROADWELL(dev) && \
                                  (INTEL_DEVID(dev) & 0x00F0) == 0x0020)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 1b2a1eb3aafc..0107c2ae77d0 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2664,8 +2664,7 @@ static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
                 if (submit_req->ctx != ring->default_context)
                         intel_lr_context_unpin(ring, submit_req->ctx);
 
-                i915_gem_context_unreference(submit_req->ctx);
-                kfree(submit_req);
+                i915_gem_request_unreference(submit_req);
         }
 
         /*
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index bd95776c3144..74df3d1581dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1229,7 +1229,7 @@ static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
 
         ppgtt->base.clear_range(&ppgtt->base, 0, ppgtt->base.total, true);
 
-        DRM_DEBUG_DRIVER("Allocated pde space (%ldM) at GTT entry: %lx\n",
+        DRM_DEBUG_DRIVER("Allocated pde space (%lldM) at GTT entry: %llx\n",
                          ppgtt->node.size >> 20,
                          ppgtt->node.start / PAGE_SIZE);
 
@@ -1797,8 +1797,8 @@ void i915_gem_gtt_finish_object(struct drm_i915_gem_object *obj)
 
 static void i915_gtt_color_adjust(struct drm_mm_node *node,
                                   unsigned long color,
-                                  unsigned long *start,
-                                  unsigned long *end)
+                                  u64 *start,
+                                  u64 *end)
 {
         if (node->color != color)
                 *start += 4096;
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index f1de95f7432c..f8da71682c96 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -485,10 +485,8 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_device *dev,
                         stolen_offset, gtt_offset, size);
 
         /* KISS and expect everything to be page-aligned */
-        BUG_ON(stolen_offset & 4095);
-        BUG_ON(size & 4095);
-
-        if (WARN_ON(size == 0))
+        if (WARN_ON(size == 0) || WARN_ON(size & 4095) ||
+            WARN_ON(stolen_offset & 4095))
                 return NULL;
 
         stolen = kzalloc(sizeof(*stolen), GFP_KERNEL);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 7a24bd1a51f6..6377b22269ad 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -335,9 +335,10 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
 
+        mutex_lock(&dev->struct_mutex);
         if (i915_gem_obj_is_pinned(obj) || obj->framebuffer_references) {
-                drm_gem_object_unreference_unlocked(&obj->base);
-                return -EBUSY;
+                ret = -EBUSY;
+                goto err;
         }
 
         if (args->tiling_mode == I915_TILING_NONE) {
@@ -369,7 +370,6 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 }
         }
 
-        mutex_lock(&dev->struct_mutex);
         if (args->tiling_mode != obj->tiling_mode ||
             args->stride != obj->stride) {
                 /* We need to rebind the object if its current allocation
@@ -424,6 +424,7 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 obj->bit_17 = NULL;
         }
 
+err:
         drm_gem_object_unreference(&obj->base);
         mutex_unlock(&dev->struct_mutex);
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 6ebea4614204..9baecb79de8c 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1840,6 +1840,9 @@ static irqreturn_t valleyview_irq_handler(int irq, void *arg)
         u32 iir, gt_iir, pm_iir;
         irqreturn_t ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         while (true) {
                 /* Find, clear, then process each source of interrupt */
 
@@ -1884,6 +1887,9 @@ static irqreturn_t cherryview_irq_handler(int irq, void *arg)
         u32 master_ctl, iir;
         irqreturn_t ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         for (;;) {
                 master_ctl = I915_READ(GEN8_MASTER_IRQ) & ~GEN8_MASTER_IRQ_CONTROL;
                 iir = I915_READ(VLV_IIR);
@@ -2156,6 +2162,9 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
         u32 de_iir, gt_iir, de_ier, sde_ier = 0;
         irqreturn_t ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         /* We get interrupts on unclaimed registers, so check for this before we
          * do any I915_{READ,WRITE}. */
         intel_uncore_check_errors(dev);
@@ -2227,6 +2236,9 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg)
         enum pipe pipe;
         u32 aux_mask = GEN8_AUX_CHANNEL_A;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         if (IS_GEN9(dev))
                 aux_mask |=  GEN9_AUX_CHANNEL_B | GEN9_AUX_CHANNEL_C |
                         GEN9_AUX_CHANNEL_D;
@@ -3704,6 +3716,9 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
                 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
                 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         iir = I915_READ16(IIR);
         if (iir == 0)
                 return IRQ_NONE;
@@ -3884,6 +3899,9 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
                 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
         int pipe, ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         iir = I915_READ(IIR);
         do {
                 bool irq_received = (iir & ~flip_mask) != 0;
@@ -4104,6 +4122,9 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
                 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
                 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         iir = I915_READ(IIR);
 
         for (;;) {
@@ -4451,6 +4472,7 @@ void intel_runtime_pm_disable_interrupts(struct drm_i915_private *dev_priv)
 {
         dev_priv->dev->driver->irq_uninstall(dev_priv->dev);
         dev_priv->pm.irqs_enabled = false;
+        synchronize_irq(dev_priv->dev->irq);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index dbd817928d0d..31f3b11589b9 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2416,13 +2416,19 @@ intel_alloc_plane_obj(struct intel_crtc *crtc,
         struct drm_i915_gem_object *obj = NULL;
         struct drm_mode_fb_cmd2 mode_cmd = { 0 };
         struct drm_framebuffer *fb = &plane_config->fb->base;
-        u32 base = plane_config->base;
+        u32 base_aligned = round_down(plane_config->base, PAGE_SIZE);
+        u32 size_aligned = round_up(plane_config->base + plane_config->size,
+                                    PAGE_SIZE);
+
+        size_aligned -= base_aligned;
 
         if (plane_config->size == 0)
                 return false;
 
-        obj = i915_gem_object_create_stolen_for_preallocated(dev, base, base,
-                                                             plane_config->size);
+        obj = i915_gem_object_create_stolen_for_preallocated(dev,
+                                                             base_aligned,
+                                                             base_aligned,
+                                                             size_aligned);
         if (!obj)
                 return false;
 
@@ -2830,10 +2836,19 @@ static void skylake_update_primary_plane(struct drm_crtc *crtc,
         case DRM_FORMAT_XRGB8888:
                 plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
                 break;
+        case DRM_FORMAT_ARGB8888:
+                plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
+                plane_ctl |= PLANE_CTL_ALPHA_SW_PREMULTIPLY;
+                break;
         case DRM_FORMAT_XBGR8888:
                 plane_ctl |= PLANE_CTL_ORDER_RGBX;
                 plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
                 break;
+        case DRM_FORMAT_ABGR8888:
+                plane_ctl |= PLANE_CTL_ORDER_RGBX;
+                plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
+                plane_ctl |= PLANE_CTL_ALPHA_SW_PREMULTIPLY;
+                break;
         case DRM_FORMAT_XRGB2101010:
                 plane_ctl |= PLANE_CTL_FORMAT_XRGB_2101010;
                 break;
@@ -6755,7 +6770,7 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
                                                fb->pixel_format,
                                                fb->modifier[0]);
 
-        plane_config->size = PAGE_ALIGN(fb->pitches[0] * aligned_height);
+        plane_config->size = fb->pitches[0] * aligned_height;
 
         DRM_DEBUG_KMS("pipe/plane %c/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
                       pipe_name(pipe), plane, fb->width, fb->height,
@@ -7804,7 +7819,7 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
                                                fb->pixel_format,
                                                fb->modifier[0]);
 
-        plane_config->size = ALIGN(fb->pitches[0] * aligned_height, PAGE_SIZE);
+        plane_config->size = fb->pitches[0] * aligned_height;
 
         DRM_DEBUG_KMS("pipe %c with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
                       pipe_name(pipe), fb->width, fb->height,
@@ -7901,7 +7916,7 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
                                                fb->pixel_format,
                                                fb->modifier[0]);
 
-        plane_config->size = PAGE_ALIGN(fb->pitches[0] * aligned_height);
+        plane_config->size = fb->pitches[0] * aligned_height;
 
         DRM_DEBUG_KMS("pipe %c with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
                       pipe_name(pipe), fb->width, fb->height,
@@ -8844,6 +8859,7 @@ retry:
                         old->release_fb->funcs->destroy(old->release_fb);
                 goto fail;
         }
+        crtc->primary->crtc = crtc;
 
         /* let the connector get through one full cycle before testing */
         intel_wait_for_vblank(dev, intel_crtc->pipe);
@@ -12279,10 +12295,9 @@ intel_check_cursor_plane(struct drm_plane *plane,
                 return -ENOMEM;
         }
 
-        if (fb == crtc->cursor->fb)
-                return 0;
-
-        if (fb->modifier[0] != DRM_FORMAT_MOD_NONE) {
+        /* we only need to pin inside GTT if cursor is non-phy */
+        mutex_lock(&dev->struct_mutex);
+        if (!INTEL_INFO(dev)->cursor_needs_physical && obj->tiling_mode) {
                 DRM_DEBUG_KMS("cursor cannot be tiled\n");
                 ret = -EINVAL;
         }
@@ -13236,6 +13251,9 @@ static struct intel_quirk intel_quirks[] = {
 
         /* HP Chromebook 14 (Celeron 2955U) */
         { 0x0a06, 0x103c, 0x21ed, quirk_backlight_present },
+
+        /* Dell Chromebook 11 */
+        { 0x0a06, 0x1028, 0x0a35, quirk_backlight_present },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_fifo_underrun.c b/drivers/gpu/drm/i915/intel_fifo_underrun.c
index 04e248dd2259..54daa66c6970 100644
--- a/drivers/gpu/drm/i915/intel_fifo_underrun.c
+++ b/drivers/gpu/drm/i915/intel_fifo_underrun.c
@@ -282,16 +282,6 @@ bool intel_set_cpu_fifo_underrun_reporting(struct drm_i915_private *dev_priv,
         return ret;
 }
 
-static bool
-__cpu_fifo_underrun_reporting_enabled(struct drm_i915_private *dev_priv,
-                                      enum pipe pipe)
-{
-        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
-        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-
-        return !intel_crtc->cpu_fifo_underrun_disabled;
-}
-
 /**
  * intel_set_pch_fifo_underrun_reporting - set PCH fifo underrun reporting state
  * @dev_priv: i915 device instance
@@ -352,9 +342,15 @@ bool intel_set_pch_fifo_underrun_reporting(struct drm_i915_private *dev_priv,
 void intel_cpu_fifo_underrun_irq_handler(struct drm_i915_private *dev_priv,
                                          enum pipe pipe)
 {
+        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
+
+        /* We may be called too early in init, thanks BIOS! */
+        if (crtc == NULL)
+                return;
+
         /* GMCH can't disable fifo underruns, filter them. */
         if (HAS_GMCH_DISPLAY(dev_priv->dev) &&
-            !__cpu_fifo_underrun_reporting_enabled(dev_priv, pipe))
+            to_intel_crtc(crtc)->cpu_fifo_underrun_disabled)
                 return;
 
         if (intel_set_cpu_fifo_underrun_reporting(dev_priv, pipe, false))
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index a2dc9a11a248..fcb074bd55dc 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -512,18 +512,19 @@ static int execlists_context_queue(struct intel_engine_cs *ring,
                  * If there isn't a request associated with this submission,
                  * create one as a temporary holder.
                  */
-                WARN(1, "execlist context submission without request");
                 request = kzalloc(sizeof(*request), GFP_KERNEL);
                 if (request == NULL)
                         return -ENOMEM;
                 request->ring = ring;
                 request->ctx = to;
+                kref_init(&request->ref);
+                request->uniq = dev_priv->request_uniq++;
+                i915_gem_context_reference(request->ctx);
         } else {
+                i915_gem_request_reference(request);
                 WARN_ON(to != request->ctx);
         }
         request->tail = tail;
-        i915_gem_request_reference(request);
-        i915_gem_context_reference(request->ctx);
 
         intel_runtime_pm_get(dev_priv);
 
@@ -742,7 +743,6 @@ void intel_execlists_retire_requests(struct intel_engine_cs *ring)
                 if (ctx_obj && (ctx != ring->default_context))
                         intel_lr_context_unpin(ring, ctx);
                 intel_runtime_pm_put(dev_priv);
-                i915_gem_context_unreference(ctx);
                 list_del(&req->execlist_link);
                 i915_gem_request_unreference(req);
         }
diff --git a/drivers/gpu/drm/imx/dw_hdmi-imx.c b/drivers/gpu/drm/imx/dw_hdmi-imx.c
index 121d30ca2d44..87fe8ed92ebe 100644
--- a/drivers/gpu/drm/imx/dw_hdmi-imx.c
+++ b/drivers/gpu/drm/imx/dw_hdmi-imx.c
@@ -70,7 +70,9 @@ static const struct dw_hdmi_curr_ctrl imx_cur_ctr[] = {
                 118800000, { 0x091c, 0x091c, 0x06dc },
         }, {
                 216000000, { 0x06dc, 0x0b5c, 0x091c },
-        }
+        }, {
+                ~0UL, { 0x0000, 0x0000, 0x0000 },
+        },
 };
 
 static const struct dw_hdmi_sym_term imx_sym_term[] = {
@@ -136,11 +138,34 @@ static struct drm_encoder_funcs dw_hdmi_imx_encoder_funcs = {
         .destroy = drm_encoder_cleanup,
 };
 
+static enum drm_mode_status imx6q_hdmi_mode_valid(struct drm_connector *con,
+                                                  struct drm_display_mode *mode)
+{
+        if (mode->clock < 13500)
+                return MODE_CLOCK_LOW;
+        if (mode->clock > 266000)
+                return MODE_CLOCK_HIGH;
+
+        return MODE_OK;
+}
+
+static enum drm_mode_status imx6dl_hdmi_mode_valid(struct drm_connector *con,
+                                                   struct drm_display_mode *mode)
+{
+        if (mode->clock < 13500)
+                return MODE_CLOCK_LOW;
+        if (mode->clock > 270000)
+                return MODE_CLOCK_HIGH;
+
+        return MODE_OK;
+}
+
 static struct dw_hdmi_plat_data imx6q_hdmi_drv_data = {
-        .mpll_cfg = imx_mpll_cfg,
-        .cur_ctr  = imx_cur_ctr,
-        .sym_term = imx_sym_term,
-        .dev_type = IMX6Q_HDMI,
+        .mpll_cfg   = imx_mpll_cfg,
+        .cur_ctr    = imx_cur_ctr,
+        .sym_term   = imx_sym_term,
+        .dev_type   = IMX6Q_HDMI,
+        .mode_valid = imx6q_hdmi_mode_valid,
 };
 
 static struct dw_hdmi_plat_data imx6dl_hdmi_drv_data = {
@@ -148,6 +173,7 @@ static struct dw_hdmi_plat_data imx6dl_hdmi_drv_data = {
         .cur_ctr  = imx_cur_ctr,
         .sym_term = imx_sym_term,
         .dev_type = IMX6DL_HDMI,
+        .mode_valid = imx6dl_hdmi_mode_valid,
 };
 
 static const struct of_device_id dw_hdmi_imx_dt_ids[] = {
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 1b86aac0b341..2d6dc94e1e64 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -163,22 +163,7 @@ static void imx_ldb_encoder_prepare(struct drm_encoder *encoder)
 {
         struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder);
         struct imx_ldb *ldb = imx_ldb_ch->ldb;
-        struct drm_display_mode *mode = &encoder->crtc->hwmode;
         u32 pixel_fmt;
-        unsigned long serial_clk;
-        unsigned long di_clk = mode->clock * 1000;
-        int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder);
-
-        if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) {
-                /* dual channel LVDS mode */
-                serial_clk = 3500UL * mode->clock;
-                imx_ldb_set_clock(ldb, mux, 0, serial_clk, di_clk);
-                imx_ldb_set_clock(ldb, mux, 1, serial_clk, di_clk);
-        } else {
-                serial_clk = 7000UL * mode->clock;
-                imx_ldb_set_clock(ldb, mux, imx_ldb_ch->chno, serial_clk,
-                                di_clk);
-        }
 
         switch (imx_ldb_ch->chno) {
         case 0:
@@ -247,6 +232,9 @@ static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder,
         struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder);
         struct imx_ldb *ldb = imx_ldb_ch->ldb;
         int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
+        unsigned long serial_clk;
+        unsigned long di_clk = mode->clock * 1000;
+        int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder);
 
         if (mode->clock > 170000) {
                 dev_warn(ldb->dev,
@@ -257,6 +245,16 @@ static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder,
                          "%s: mode exceeds 85 MHz pixel clock\n", __func__);
         }
 
+        if (dual) {
+                serial_clk = 3500UL * mode->clock;
+                imx_ldb_set_clock(ldb, mux, 0, serial_clk, di_clk);
+                imx_ldb_set_clock(ldb, mux, 1, serial_clk, di_clk);
+        } else {
+                serial_clk = 7000UL * mode->clock;
+                imx_ldb_set_clock(ldb, mux, imx_ldb_ch->chno, serial_clk,
+                                  di_clk);
+        }
+
         /* FIXME - assumes straight connections DI0 --> CH0, DI1 --> CH1 */
         if (imx_ldb_ch == &ldb->channel[0]) {
                 if (mode->flags & DRM_MODE_FLAG_NVSYNC)
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index 5e83e007080f..900dda6a8e71 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -236,8 +236,11 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
         }
 
         panel_node = of_parse_phandle(np, "fsl,panel", 0);
-        if (panel_node)
+        if (panel_node) {
                 imxpd->panel = of_drm_find_panel(panel_node);
+                if (!imxpd->panel)
+                        return -EPROBE_DEFER;
+        }
 
         imxpd->dev = dev;
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
index 8edd531cb621..7369ee7f0c55 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
@@ -32,7 +32,10 @@ static void mdp4_irq_error_handler(struct mdp_irq *irq, uint32_t irqstatus)
 void mdp4_irq_preinstall(struct msm_kms *kms)
 {
         struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+        mdp4_enable(mdp4_kms);
         mdp4_write(mdp4_kms, REG_MDP4_INTR_CLEAR, 0xffffffff);
+        mdp4_write(mdp4_kms, REG_MDP4_INTR_ENABLE, 0x00000000);
+        mdp4_disable(mdp4_kms);
 }
 
 int mdp4_irq_postinstall(struct msm_kms *kms)
@@ -53,7 +56,9 @@ int mdp4_irq_postinstall(struct msm_kms *kms)
 void mdp4_irq_uninstall(struct msm_kms *kms)
 {
         struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+        mdp4_enable(mdp4_kms);
         mdp4_write(mdp4_kms, REG_MDP4_INTR_ENABLE, 0x00000000);
+        mdp4_disable(mdp4_kms);
 }
 
 irqreturn_t mdp4_irq(struct msm_kms *kms)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h
index 09b4a25eb553..c276624290af 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h
@@ -8,17 +8,9 @@ http://github.com/freedreno/envytools/
 git clone https://github.com/freedreno/envytools.git
 
 The rules-ng-ng source files this header was generated from are:
-- /home/robclark/src/freedreno/envytools/rnndb/msm.xml                 (    676 bytes, from 2014-12-05 15:34:49)
-- /home/robclark/src/freedreno/envytools/rnndb/freedreno_copyright.xml (   1453 bytes, from 2013-03-31 16:51:27)
-- /home/robclark/src/freedreno/envytools/rnndb/mdp/mdp4.xml            (  20908 bytes, from 2014-12-08 16:13:00)
-- /home/robclark/src/freedreno/envytools/rnndb/mdp/mdp_common.xml      (   2357 bytes, from 2014-12-08 16:13:00)
-- /home/robclark/src/freedreno/envytools/rnndb/mdp/mdp5.xml            (  27208 bytes, from 2015-01-13 23:56:11)
-- /home/robclark/src/freedreno/envytools/rnndb/dsi/dsi.xml             (  11712 bytes, from 2013-08-17 17:13:43)
-- /home/robclark/src/freedreno/envytools/rnndb/dsi/sfpb.xml            (    344 bytes, from 2013-08-11 19:26:32)
-- /home/robclark/src/freedreno/envytools/rnndb/dsi/mmss_cc.xml         (   1686 bytes, from 2014-10-31 16:48:57)
-- /home/robclark/src/freedreno/envytools/rnndb/hdmi/qfprom.xml         (    600 bytes, from 2013-07-05 19:21:12)
-- /home/robclark/src/freedreno/envytools/rnndb/hdmi/hdmi.xml           (  26848 bytes, from 2015-01-13 23:55:57)
-- /home/robclark/src/freedreno/envytools/rnndb/edp/edp.xml             (   8253 bytes, from 2014-12-08 16:13:00)
+- /local/mnt2/workspace2/sviau/envytools/rnndb/mdp/mdp5.xml            (  27229 bytes, from 2015-02-10 17:00:41)
+- /local/mnt2/workspace2/sviau/envytools/rnndb/freedreno_copyright.xml (   1453 bytes, from 2014-06-02 18:31:15)
+- /local/mnt2/workspace2/sviau/envytools/rnndb/mdp/mdp_common.xml      (   2357 bytes, from 2015-01-23 16:20:19)
 
 Copyright (C) 2013-2015 by the following authors:
 - Rob Clark <robdclark@gmail.com> (robclark)
@@ -910,6 +902,7 @@ static inline uint32_t __offset_LM(uint32_t idx)
                 case 2: return (mdp5_cfg->lm.base[2]);
                 case 3: return (mdp5_cfg->lm.base[3]);
                 case 4: return (mdp5_cfg->lm.base[4]);
+                case 5: return (mdp5_cfg->lm.base[5]);
                 default: return INVALID_IDX(idx);
         }
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 46fac545dc2b..2f2863cf8b45 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -62,8 +62,8 @@ struct mdp5_crtc {
 
                 /* current cursor being scanned out: */
                 struct drm_gem_object *scanout_bo;
-                uint32_t width;
-                uint32_t height;
+                uint32_t width, height;
+                uint32_t x, y;
         } cursor;
 };
 #define to_mdp5_crtc(x) container_of(x, struct mdp5_crtc, base)
@@ -103,8 +103,8 @@ static void crtc_flush_all(struct drm_crtc *crtc)
         struct drm_plane *plane;
         uint32_t flush_mask = 0;
 
-        /* we could have already released CTL in the disable path: */
-        if (!mdp5_crtc->ctl)
+        /* this should not happen: */
+        if (WARN_ON(!mdp5_crtc->ctl))
                 return;
 
         drm_atomic_crtc_for_each_plane(plane, crtc) {
@@ -143,6 +143,11 @@ static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
         drm_atomic_crtc_for_each_plane(plane, crtc) {
                 mdp5_plane_complete_flip(plane);
         }
+
+        if (mdp5_crtc->ctl && !crtc->state->enable) {
+                mdp5_ctl_release(mdp5_crtc->ctl);
+                mdp5_crtc->ctl = NULL;
+        }
 }
 
 static void unref_cursor_worker(struct drm_flip_work *work, void *val)
@@ -386,14 +391,17 @@ static void mdp5_crtc_atomic_flush(struct drm_crtc *crtc)
         mdp5_crtc->event = crtc->state->event;
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
+        /*
+         * If no CTL has been allocated in mdp5_crtc_atomic_check(),
+         * it means we are trying to flush a CRTC whose state is disabled:
+         * nothing else needs to be done.
+         */
+        if (unlikely(!mdp5_crtc->ctl))
+                return;
+
         blend_setup(crtc);
         crtc_flush_all(crtc);
         request_pending(crtc, PENDING_FLIP);
-
-        if (mdp5_crtc->ctl && !crtc->state->enable) {
-                mdp5_ctl_release(mdp5_crtc->ctl);
-                mdp5_crtc->ctl = NULL;
-        }
 }
 
 static int mdp5_crtc_set_property(struct drm_crtc *crtc,
@@ -403,6 +411,32 @@ static int mdp5_crtc_set_property(struct drm_crtc *crtc,
         return -EINVAL;
 }
 
+static void get_roi(struct drm_crtc *crtc, uint32_t *roi_w, uint32_t *roi_h)
+{
+        struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+        uint32_t xres = crtc->mode.hdisplay;
+        uint32_t yres = crtc->mode.vdisplay;
+
+        /*
+         * Cursor Region Of Interest (ROI) is a plane read from cursor
+         * buffer to render. The ROI region is determined by the visibility of
+         * the cursor point. In the default Cursor image the cursor point will
+         * be at the top left of the cursor image, unless it is specified
+         * otherwise using hotspot feature.
+         *
+         * If the cursor point reaches the right (xres - x < cursor.width) or
+         * bottom (yres - y < cursor.height) boundary of the screen, then ROI
+         * width and ROI height need to be evaluated to crop the cursor image
+         * accordingly.
+         * (xres-x) will be new cursor width when x > (xres - cursor.width)
+         * (yres-y) will be new cursor height when y > (yres - cursor.height)
+         */
+        *roi_w = min(mdp5_crtc->cursor.width, xres -
+                        mdp5_crtc->cursor.x);
+        *roi_h = min(mdp5_crtc->cursor.height, yres -
+                        mdp5_crtc->cursor.y);
+}
+
 static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
                 struct drm_file *file, uint32_t handle,
                 uint32_t width, uint32_t height)
@@ -416,6 +450,7 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
         unsigned int depth;
         enum mdp5_cursor_alpha cur_alpha = CURSOR_ALPHA_PER_PIXEL;
         uint32_t flush_mask = mdp_ctl_flush_mask_cursor(0);
+        uint32_t roi_w, roi_h;
         unsigned long flags;
 
         if ((width > CURSOR_WIDTH) || (height > CURSOR_HEIGHT)) {
@@ -446,6 +481,12 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
         spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
         old_bo = mdp5_crtc->cursor.scanout_bo;
 
+        mdp5_crtc->cursor.scanout_bo = cursor_bo;
+        mdp5_crtc->cursor.width = width;
+        mdp5_crtc->cursor.height = height;
+
+        get_roi(crtc, &roi_w, &roi_h);
+
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_STRIDE(lm), stride);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_FORMAT(lm),
                         MDP5_LM_CURSOR_FORMAT_FORMAT(CURSOR_FMT_ARGB8888));
@@ -453,19 +494,14 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
                         MDP5_LM_CURSOR_IMG_SIZE_SRC_H(height) |
                         MDP5_LM_CURSOR_IMG_SIZE_SRC_W(width));
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(lm),
-                        MDP5_LM_CURSOR_SIZE_ROI_H(height) |
-                        MDP5_LM_CURSOR_SIZE_ROI_W(width));
+                        MDP5_LM_CURSOR_SIZE_ROI_H(roi_h) |
+                        MDP5_LM_CURSOR_SIZE_ROI_W(roi_w));
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_BASE_ADDR(lm), cursor_addr);
 
-
         blendcfg = MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_EN;
-        blendcfg |= MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_TRANSP_EN;
         blendcfg |= MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_ALPHA_SEL(cur_alpha);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_BLEND_CONFIG(lm), blendcfg);
 
-        mdp5_crtc->cursor.scanout_bo = cursor_bo;
-        mdp5_crtc->cursor.width = width;
-        mdp5_crtc->cursor.height = height;
         spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
 
         ret = mdp5_ctl_set_cursor(mdp5_crtc->ctl, true);
@@ -489,31 +525,18 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
         struct mdp5_kms *mdp5_kms = get_kms(crtc);
         struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
         uint32_t flush_mask = mdp_ctl_flush_mask_cursor(0);
-        uint32_t xres = crtc->mode.hdisplay;
-        uint32_t yres = crtc->mode.vdisplay;
         uint32_t roi_w;
         uint32_t roi_h;
         unsigned long flags;
 
-        x = (x > 0) ? x : 0;
-        y = (y > 0) ? y : 0;
+        /* In case the CRTC is disabled, just drop the cursor update */
+        if (unlikely(!crtc->state->enable))
+                return 0;
 
-        /*
-         * Cursor Region Of Interest (ROI) is a plane read from cursor
-         * buffer to render. The ROI region is determined by the visiblity of
-         * the cursor point. In the default Cursor image the cursor point will
-         * be at the top left of the cursor image, unless it is specified
-         * otherwise using hotspot feature.
-         *
-         * If the cursor point reaches the right (xres - x < cursor.width) or
-         * bottom (yres - y < cursor.height) boundary of the screen, then ROI
-         * width and ROI height need to be evaluated to crop the cursor image
-         * accordingly.
-         * (xres-x) will be new cursor width when x > (xres - cursor.width)
-         * (yres-y) will be new cursor height when y > (yres - cursor.height)
-         */
-        roi_w = min(mdp5_crtc->cursor.width, xres - x);
-        roi_h = min(mdp5_crtc->cursor.height, yres - y);
+        mdp5_crtc->cursor.x = x = max(x, 0);
+        mdp5_crtc->cursor.y = y = max(y, 0);
+
+        get_roi(crtc, &roi_w, &roi_h);
 
         spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(mdp5_crtc->lm),
@@ -544,8 +567,8 @@ static const struct drm_crtc_funcs mdp5_crtc_funcs = {
 static const struct drm_crtc_helper_funcs mdp5_crtc_helper_funcs = {
         .mode_fixup = mdp5_crtc_mode_fixup,
         .mode_set_nofb = mdp5_crtc_mode_set_nofb,
-        .prepare = mdp5_crtc_disable,
-        .commit = mdp5_crtc_enable,
+        .disable = mdp5_crtc_disable,
+        .enable = mdp5_crtc_enable,
         .atomic_check = mdp5_crtc_atomic_check,
         .atomic_begin = mdp5_crtc_atomic_begin,
         .atomic_flush = mdp5_crtc_atomic_flush,
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
index d6a14bb99988..af0e02fa4f48 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
@@ -267,14 +267,14 @@ static void mdp5_encoder_enable(struct drm_encoder *encoder)
         mdp5_write(mdp5_kms, REG_MDP5_INTF_TIMING_ENGINE_EN(intf), 1);
         spin_unlock_irqrestore(&mdp5_encoder->intf_lock, flags);
 
-        mdp5_encoder->enabled = false;
+        mdp5_encoder->enabled = true;
 }
 
 static const struct drm_encoder_helper_funcs mdp5_encoder_helper_funcs = {
         .mode_fixup = mdp5_encoder_mode_fixup,
         .mode_set = mdp5_encoder_mode_set,
-        .prepare = mdp5_encoder_disable,
-        .commit = mdp5_encoder_enable,
+        .disable = mdp5_encoder_disable,
+        .enable = mdp5_encoder_enable,
 };
 
 /* initialize encoder */
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
index 70ac81edd40f..a9407105b9b7 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
@@ -34,7 +34,10 @@ static void mdp5_irq_error_handler(struct mdp_irq *irq, uint32_t irqstatus)
 void mdp5_irq_preinstall(struct msm_kms *kms)
 {
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        mdp5_enable(mdp5_kms);
         mdp5_write(mdp5_kms, REG_MDP5_INTR_CLEAR, 0xffffffff);
+        mdp5_write(mdp5_kms, REG_MDP5_INTR_EN, 0x00000000);
+        mdp5_disable(mdp5_kms);
 }
 
 int mdp5_irq_postinstall(struct msm_kms *kms)
@@ -57,7 +60,9 @@ int mdp5_irq_postinstall(struct msm_kms *kms)
 void mdp5_irq_uninstall(struct msm_kms *kms)
 {
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        mdp5_enable(mdp5_kms);
         mdp5_write(mdp5_kms, REG_MDP5_INTR_EN, 0x00000000);
+        mdp5_disable(mdp5_kms);
 }
 
 static void mdp5_irq_mdp(struct mdp_kms *mdp_kms)
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index 7c412292a0ff..5b192128cda2 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -219,8 +219,10 @@ int msm_atomic_commit(struct drm_device *dev,
          * mark our set of crtc's as busy:
          */
         ret = start_atomic(dev->dev_private, c->crtc_mask);
-        if (ret)
+        if (ret) {
+                kfree(c);
                 return ret;
+        }
 
         /*
          * This is the point of no return - everything below never fails except
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 79924e4b1b49..6751553abe4a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -418,7 +418,7 @@ nouveau_fbcon_create(struct drm_fb_helper *helper,
         nouveau_fbcon_zfill(dev, fbcon);
 
         /* To allow resizeing without swapping buffers */
-        NV_INFO(drm, "allocated %dx%d fb: 0x%lx, bo %p\n",
+        NV_INFO(drm, "allocated %dx%d fb: 0x%llx, bo %p\n",
                 nouveau_fb->base.width, nouveau_fb->base.height,
                 nvbo->bo.offset, nvbo);
 
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index ed644a4f6f57..86807ee91bd1 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1405,6 +1405,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                (x << 16) | y);
         viewport_w = crtc->mode.hdisplay;
         viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+        if ((rdev->family >= CHIP_BONAIRE) &&
+            (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
+                viewport_h *= 2;
         WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
                (viewport_w << 16) | viewport_h);
 
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 5bf825dfaa09..8d74de82456e 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -178,6 +178,13 @@ radeon_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
         switch (msg->request & ~DP_AUX_I2C_MOT) {
         case DP_AUX_NATIVE_WRITE:
         case DP_AUX_I2C_WRITE:
+                /* The atom implementation only supports writes with a max payload of
+                 * 12 bytes since it uses 4 bits for the total count (header + payload)
+                 * in the parameter space.  The atom interface supports 16 byte
+                 * payloads for reads. The hw itself supports up to 16 bytes of payload.
+                 */
+                if (WARN_ON_ONCE(msg->size > 12))
+                        return -E2BIG;
                 /* tx_size needs to be 4 even for bare address packets since the atom
                  * table needs the info in tx_buf[3].
                  */
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 7c9df1eac065..c39c1d0d9d4e 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -731,7 +731,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                 dig_connector = radeon_connector->con_priv;
                 if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
                     (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP)) {
-                        if (radeon_audio != 0 && ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
+                        if (radeon_audio != 0 &&
+                            drm_detect_monitor_audio(radeon_connector_edid(connector)) &&
+                            ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
                                 return ATOM_ENCODER_MODE_DP_AUDIO;
                         return ATOM_ENCODER_MODE_DP;
                 } else if (radeon_audio != 0) {
@@ -747,7 +749,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                 }
                 break;
         case DRM_MODE_CONNECTOR_eDP:
-                if (radeon_audio != 0 && ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
+                if (radeon_audio != 0 &&
+                    drm_detect_monitor_audio(radeon_connector_edid(connector)) &&
+                    ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
                         return ATOM_ENCODER_MODE_DP_AUDIO;
                 return ATOM_ENCODER_MODE_DP;
         case DRM_MODE_CONNECTOR_DVIA:
@@ -1622,7 +1626,6 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
         struct radeon_connector *radeon_connector = NULL;
         struct radeon_connector_atom_dig *radeon_dig_connector = NULL;
         bool travis_quirk = false;
-        int encoder_mode;
 
         if (connector) {
                 radeon_connector = to_radeon_connector(connector);
@@ -1718,11 +1721,6 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                 }
                 break;
         }
-
-        encoder_mode = atombios_get_encoder_mode(encoder);
-        if (radeon_audio != 0 &&
-                (encoder_mode == ATOM_ENCODER_MODE_HDMI || ENCODER_MODE_IS_DP(encoder_mode)))
-                radeon_audio_dpms(encoder, mode);
 }
 
 static void
@@ -1731,10 +1729,19 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+        int encoder_mode = atombios_get_encoder_mode(encoder);
 
         DRM_DEBUG_KMS("encoder dpms %d to mode %d, devices %08x, active_devices %08x\n",
                   radeon_encoder->encoder_id, mode, radeon_encoder->devices,
                   radeon_encoder->active_device);
+
+        if (connector && (radeon_audio != 0) &&
+            ((encoder_mode == ATOM_ENCODER_MODE_HDMI) ||
+             (ENCODER_MODE_IS_DP(encoder_mode) &&
+              drm_detect_monitor_audio(radeon_connector_edid(connector)))))
+                radeon_audio_dpms(encoder, mode);
+
         switch (radeon_encoder->encoder_id) {
         case ENCODER_OBJECT_ID_INTERNAL_TMDS1:
         case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
@@ -2136,6 +2143,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
         int encoder_mode;
 
         radeon_encoder->pixel_clock = adjusted_mode->clock;
@@ -2163,10 +2171,6 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3:
         case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
                 /* handled in dpms */
-                encoder_mode = atombios_get_encoder_mode(encoder);
-                if (radeon_audio != 0 &&
-                        (encoder_mode == ATOM_ENCODER_MODE_HDMI || ENCODER_MODE_IS_DP(encoder_mode)))
-                        radeon_audio_mode_set(encoder, adjusted_mode);
                 break;
         case ENCODER_OBJECT_ID_INTERNAL_DDI:
         case ENCODER_OBJECT_ID_INTERNAL_DVO1:
@@ -2188,6 +2192,13 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         }
 
         atombios_apply_encoder_quirks(encoder, adjusted_mode);
+
+        encoder_mode = atombios_get_encoder_mode(encoder);
+        if (connector && (radeon_audio != 0) &&
+            ((encoder_mode == ATOM_ENCODER_MODE_HDMI) ||
+             (ENCODER_MODE_IS_DP(encoder_mode) &&
+              drm_detect_monitor_audio(radeon_connector_edid(connector)))))
+                radeon_audio_mode_set(encoder, adjusted_mode);
 }
 
 static bool
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e6a4ba236c70..3e670d344a20 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3613,6 +3613,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 0x1);
+        WREG32(SRBM_INT_ACK, 0x1);
 
         WREG32(BIF_FB_EN, FB_READ_EN | FB_WRITE_EN);
 
@@ -7230,6 +7232,8 @@ static void cik_disable_interrupt_state(struct radeon_device *rdev)
         WREG32(CP_ME2_PIPE3_INT_CNTL, 0);
         /* grbm */
         WREG32(GRBM_INT_CNTL, 0);
+        /* SRBM */
+        WREG32(SRBM_INT_CNTL, 0);
         /* vline/vblank, etc. */
         WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
         WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
@@ -7551,6 +7555,9 @@ int cik_irq_set(struct radeon_device *rdev)
         WREG32(DC_HPD5_INT_CONTROL, hpd5);
         WREG32(DC_HPD6_INT_CONTROL, hpd6);
 
+        /* posting read */
+        RREG32(SRBM_STATUS);
+
         return 0;
 }
 
@@ -8046,6 +8053,10 @@ restart_ih:
                                 break;
                         }
                         break;
+                case 96:
+                        DRM_ERROR("SRBM_READ_ERROR: 0x%x\n", RREG32(SRBM_READ_ERROR));
+                        WREG32(SRBM_INT_ACK, 0x1);
+                        break;
                 case 124: /* UVD */
                         DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
                         radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index 03003f8a6de6..c648e1996dab 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -482,6 +482,10 @@
 #define         SOFT_RESET_ORB                          (1 << 23)
 #define         SOFT_RESET_VCE                          (1 << 24)
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 #define VM_L2_CNTL                                      0x1400
 #define         ENABLE_L2_CACHE                                 (1 << 0)
 #define         ENABLE_L2_FRAGMENT_PROCESSING                   (1 << 1)
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 192c80389151..3adc2afe32aa 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -26,6 +26,9 @@
 #include "radeon_audio.h"
 #include "sid.h"
 
+#define DCE8_DCCG_AUDIO_DTO1_PHASE      0x05b8
+#define DCE8_DCCG_AUDIO_DTO1_MODULE     0x05bc
+
 u32 dce6_endpoint_rreg(struct radeon_device *rdev,
                               u32 block_offset, u32 reg)
 {
@@ -252,72 +255,67 @@ void dce6_audio_enable(struct radeon_device *rdev,
 void dce6_hdmi_audio_set_dto(struct radeon_device *rdev,
         struct radeon_crtc *crtc, unsigned int clock)
 {
-    /* Two dtos; generally use dto0 for HDMI */
+        /* Two dtos; generally use dto0 for HDMI */
         u32 value = 0;
 
-    if (crtc)
+        if (crtc)
                 value |= DCCG_AUDIO_DTO0_SOURCE_SEL(crtc->crtc_id);
 
         WREG32(DCCG_AUDIO_DTO_SOURCE, value);
 
-    /* Express [24MHz / target pixel clock] as an exact rational
-     * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
-     * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
-     */
-    WREG32(DCCG_AUDIO_DTO0_PHASE, 24000);
-    WREG32(DCCG_AUDIO_DTO0_MODULE, clock);
+        /* Express [24MHz / target pixel clock] as an exact rational
+         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
+         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
+         */
+        WREG32(DCCG_AUDIO_DTO0_PHASE, 24000);
+        WREG32(DCCG_AUDIO_DTO0_MODULE, clock);
 }
 
 void dce6_dp_audio_set_dto(struct radeon_device *rdev,
         struct radeon_crtc *crtc, unsigned int clock)
 {
-    /* Two dtos; generally use dto1 for DP */
+        /* Two dtos; generally use dto1 for DP */
         u32 value = 0;
         value |= DCCG_AUDIO_DTO_SEL;
 
-    if (crtc)
+        if (crtc)
                 value |= DCCG_AUDIO_DTO0_SOURCE_SEL(crtc->crtc_id);
 
         WREG32(DCCG_AUDIO_DTO_SOURCE, value);
 
-    /* Express [24MHz / target pixel clock] as an exact rational
-     * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
-     * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
-     */
-    WREG32(DCCG_AUDIO_DTO1_PHASE, 24000);
-    WREG32(DCCG_AUDIO_DTO1_MODULE, clock);
+        /* Express [24MHz / target pixel clock] as an exact rational
+         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
+         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
+         */
+        if (ASIC_IS_DCE8(rdev)) {
+                WREG32(DCE8_DCCG_AUDIO_DTO1_PHASE, 24000);
+                WREG32(DCE8_DCCG_AUDIO_DTO1_MODULE, clock);
+        } else {
+                WREG32(DCCG_AUDIO_DTO1_PHASE, 24000);
+                WREG32(DCCG_AUDIO_DTO1_MODULE, clock);
+        }
 }
 
-void dce6_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable)
+void dce6_dp_enable(struct drm_encoder *encoder, bool enable)
 {
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        uint32_t offset;
 
         if (!dig || !dig->afmt)
                 return;
 
-        offset = dig->afmt->offset;
-
         if (enable) {
-        if (dig->afmt->enabled)
-            return;
-
-                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + offset, EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset,
-                        EVERGREEN_DP_SEC_ASP_ENABLE |           /* Audio packet transmission */
-                        EVERGREEN_DP_SEC_ATP_ENABLE |           /* Audio timestamp packet transmission */
-                        EVERGREEN_DP_SEC_AIP_ENABLE |           /* Audio infoframe packet transmission */
-                        EVERGREEN_DP_SEC_STREAM_ENABLE);        /* Master enable for secondary stream engine */
-                radeon_audio_enable(rdev, dig->afmt->pin, true);
+                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + dig->afmt->offset,
+                       EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset,
+                       EVERGREEN_DP_SEC_ASP_ENABLE |            /* Audio packet transmission */
+                       EVERGREEN_DP_SEC_ATP_ENABLE |            /* Audio timestamp packet transmission */
+                       EVERGREEN_DP_SEC_AIP_ENABLE |            /* Audio infoframe packet transmission */
+                       EVERGREEN_DP_SEC_STREAM_ENABLE); /* Master enable for secondary stream engine */
         } else {
-                if (!dig->afmt->enabled)
-                        return;
-
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset, 0);
-                radeon_audio_enable(rdev, dig->afmt->pin, false);
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset, 0);
         }
 
         dig->afmt->enabled = enable;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 78600f534c80..973df064c14f 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3253,6 +3253,8 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 0x1);
+        WREG32(SRBM_INT_ACK, 0x1);
 
         evergreen_fix_pci_max_read_req_size(rdev);
 
@@ -4324,6 +4326,7 @@ void evergreen_disable_interrupt_state(struct radeon_device *rdev)
         tmp = RREG32(DMA_CNTL) & ~TRAP_ENABLE;
         WREG32(DMA_CNTL, tmp);
         WREG32(GRBM_INT_CNTL, 0);
+        WREG32(SRBM_INT_CNTL, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
         if (rdev->num_crtc >= 4) {
@@ -4590,6 +4593,9 @@ int evergreen_irq_set(struct radeon_device *rdev)
         WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
         WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
 
+        /* posting read */
+        RREG32(SRBM_STATUS);
+
         return 0;
 }
 
@@ -5066,6 +5072,10 @@ restart_ih:
                                 DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
                                 break;
                         }
+                case 96:
+                        DRM_ERROR("SRBM_READ_ERROR: 0x%x\n", RREG32(SRBM_READ_ERROR));
+                        WREG32(SRBM_INT_ACK, 0x1);
+                        break;
                 case 124: /* UVD */
                         DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
                         radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index 1d9aebc79595..c18d4ecbd95d 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -272,7 +272,7 @@ void dce4_hdmi_audio_set_dto(struct radeon_device *rdev,
 }
 
 void dce4_dp_audio_set_dto(struct radeon_device *rdev,
-        struct radeon_crtc *crtc, unsigned int clock)
+                           struct radeon_crtc *crtc, unsigned int clock)
 {
         u32 value;
 
@@ -294,7 +294,7 @@ void dce4_dp_audio_set_dto(struct radeon_device *rdev,
          * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
          */
         WREG32(DCCG_AUDIO_DTO1_PHASE, 24000);
-        WREG32(DCCG_AUDIO_DTO1_MODULE, rdev->clock.max_pixel_clock * 10);
+        WREG32(DCCG_AUDIO_DTO1_MODULE, clock);
 }
 
 void dce4_set_vbi_packet(struct drm_encoder *encoder, u32 offset)
@@ -350,20 +350,9 @@ void dce4_set_audio_packet(struct drm_encoder *encoder, u32 offset)
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
 
-        WREG32(HDMI_INFOFRAME_CONTROL0 + offset,
-                HDMI_AUDIO_INFO_SEND | /* enable audio info frames (frames won't be set until audio is enabled) */
-                HDMI_AUDIO_INFO_CONT); /* required for audio info values to be updated */
-
         WREG32(AFMT_INFOFRAME_CONTROL0 + offset,
                 AFMT_AUDIO_INFO_UPDATE); /* required for audio info values to be updated */
 
-        WREG32(HDMI_INFOFRAME_CONTROL1 + offset,
-                HDMI_AUDIO_INFO_LINE(2)); /* anything other than 0 */
-
-        WREG32(HDMI_AUDIO_PACKET_CONTROL + offset,
-                HDMI_AUDIO_DELAY_EN(1) | /* set the default audio delay */
-                HDMI_AUDIO_PACKETS_PER_LINE(3)); /* should be suffient for all audio modes and small enough for all hblanks */
-
         WREG32(AFMT_60958_0 + offset,
                 AFMT_60958_CS_CHANNEL_NUMBER_L(1));
 
@@ -408,15 +397,19 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!dig || !dig->afmt)
                 return;
 
-        /* Silent, r600_hdmi_enable will raise WARN for us */
-        if (enable && dig->afmt->enabled)
-                return;
-        if (!enable && !dig->afmt->enabled)
-                return;
+        if (enable) {
+                WREG32(HDMI_INFOFRAME_CONTROL1 + dig->afmt->offset,
+                       HDMI_AUDIO_INFO_LINE(2)); /* anything other than 0 */
+
+                WREG32(HDMI_AUDIO_PACKET_CONTROL + dig->afmt->offset,
+                       HDMI_AUDIO_DELAY_EN(1) | /* set the default audio delay */
+                       HDMI_AUDIO_PACKETS_PER_LINE(3)); /* should be suffient for all audio modes and small enough for all hblanks */
 
-        if (!enable && dig->afmt->pin) {
-                radeon_audio_enable(rdev, dig->afmt->pin, 0);
-                dig->afmt->pin = NULL;
+                WREG32(HDMI_INFOFRAME_CONTROL0 + dig->afmt->offset,
+                       HDMI_AUDIO_INFO_SEND | /* enable audio info frames (frames won't be set until audio is enabled) */
+                       HDMI_AUDIO_INFO_CONT); /* required for audio info values to be updated */
+        } else {
+                WREG32(HDMI_INFOFRAME_CONTROL0 + dig->afmt->offset, 0);
         }
 
         dig->afmt->enabled = enable;
@@ -425,33 +418,28 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
                   enable ? "En" : "Dis", dig->afmt->offset, radeon_encoder->encoder_id);
 }
 
-void evergreen_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable)
+void evergreen_dp_enable(struct drm_encoder *encoder, bool enable)
 {
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        uint32_t offset;
 
         if (!dig || !dig->afmt)
                 return;
 
-        offset = dig->afmt->offset;
-
         if (enable) {
                 struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
                 struct radeon_connector *radeon_connector = to_radeon_connector(connector);
                 struct radeon_connector_atom_dig *dig_connector;
                 uint32_t val;
 
-                if (dig->afmt->enabled)
-                        return;
-
-                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + offset, EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
+                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + dig->afmt->offset,
+                       EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
 
                 if (radeon_connector->con_priv) {
                         dig_connector = radeon_connector->con_priv;
-                        val = RREG32(EVERGREEN_DP_SEC_AUD_N + offset);
+                        val = RREG32(EVERGREEN_DP_SEC_AUD_N + dig->afmt->offset);
                         val &= ~EVERGREEN_DP_SEC_N_BASE_MULTIPLE(0xf);
 
                         if (dig_connector->dp_clock == 162000)
@@ -459,21 +447,16 @@ void evergreen_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable)
                         else
                                 val |= EVERGREEN_DP_SEC_N_BASE_MULTIPLE(5);
 
-                        WREG32(EVERGREEN_DP_SEC_AUD_N + offset, val);
+                        WREG32(EVERGREEN_DP_SEC_AUD_N + dig->afmt->offset, val);
                 }
 
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset,
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset,
                         EVERGREEN_DP_SEC_ASP_ENABLE |           /* Audio packet transmission */
                         EVERGREEN_DP_SEC_ATP_ENABLE |           /* Audio timestamp packet transmission */
                         EVERGREEN_DP_SEC_AIP_ENABLE |           /* Audio infoframe packet transmission */
                         EVERGREEN_DP_SEC_STREAM_ENABLE);        /* Master enable for secondary stream engine */
-                radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
         } else {
-                if (!dig->afmt->enabled)
-                        return;
-
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset, 0);
-                radeon_audio_enable(rdev, dig->afmt->pin, 0);
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset, 0);
         }
 
         dig->afmt->enabled = enable;
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index ee83d2a88750..a8d1d5240fcb 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -1191,6 +1191,10 @@
 #define         SOFT_RESET_REGBB                        (1 << 22)
 #define         SOFT_RESET_ORB                          (1 << 23)
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 /* display watermarks */
 #define DC_LB_MEMORY_SPLIT                                0x6b0c
 #define PRIORITY_A_CNT                                    0x6b18
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 24242a7f0ac3..dab00812abaa 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -962,6 +962,8 @@ static void cayman_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 0x1);
+        WREG32(SRBM_INT_ACK, 0x1);
 
         evergreen_fix_pci_max_read_req_size(rdev);
 
@@ -1086,12 +1088,12 @@ static void cayman_gpu_init(struct radeon_device *rdev)
 
         if ((rdev->config.cayman.max_backends_per_se == 1) &&
             (rdev->flags & RADEON_IS_IGP)) {
-                if ((disabled_rb_mask & 3) == 1) {
-                        /* RB0 disabled, RB1 enabled */
-                        tmp = 0x11111111;
-                } else {
+                if ((disabled_rb_mask & 3) == 2) {
                         /* RB1 disabled, RB0 enabled */
                         tmp = 0x00000000;
+                } else {
+                        /* RB0 disabled, RB1 enabled */
+                        tmp = 0x11111111;
                 }
         } else {
                 tmp = gb_addr_config & NUM_PIPES_MASK;
diff --git a/drivers/gpu/drm/radeon/nid.h b/drivers/gpu/drm/radeon/nid.h
index ad7125486894..6b44580440d0 100644
--- a/drivers/gpu/drm/radeon/nid.h
+++ b/drivers/gpu/drm/radeon/nid.h
@@ -82,6 +82,10 @@
 #define         SOFT_RESET_REGBB                        (1 << 22)
 #define         SOFT_RESET_ORB                          (1 << 23)
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 #define SRBM_STATUS2                                    0x0EC4
 #define         DMA_BUSY                                (1 << 5)
 #define         DMA1_BUSY                               (1 << 6)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 279801ca5110..04f2514f7564 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -728,6 +728,10 @@ int r100_irq_set(struct radeon_device *rdev)
                 tmp |= RADEON_FP2_DETECT_MASK;
         }
         WREG32(RADEON_GEN_INT_CNTL, tmp);
+
+        /* read back to post the write */
+        RREG32(RADEON_GEN_INT_CNTL);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 07a71a2488c9..2fcad344492f 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3784,6 +3784,9 @@ int r600_irq_set(struct radeon_device *rdev)
                 WREG32(RV770_CG_THERMAL_INT, thermal_int);
         }
 
+        /* posting read */
+        RREG32(R_000E50_SRBM_STATUS);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 843b65f46ece..fa2154493cf1 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -188,7 +188,7 @@ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
                 list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                         radeon_crtc = to_radeon_crtc(crtc);
                         if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-                                vrefresh = radeon_crtc->hw_mode.vrefresh;
+                                vrefresh = drm_mode_vrefresh(&radeon_crtc->hw_mode);
                                 break;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 62c91ed669ce..dd6606b8e23c 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -476,17 +476,6 @@ void r600_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!dig || !dig->afmt)
                 return;
 
-        /* Silent, r600_hdmi_enable will raise WARN for us */
-        if (enable && dig->afmt->enabled)
-                return;
-        if (!enable && !dig->afmt->enabled)
-                return;
-
-        if (!enable && dig->afmt->pin) {
-                radeon_audio_enable(rdev, dig->afmt->pin, 0);
-                dig->afmt->pin = NULL;
-        }
-
         /* Older chipsets require setting HDMI and routing manually */
         if (!ASIC_IS_DCE3(rdev)) {
                 if (enable)
diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
index a3ceef6d9632..b21ef69a34ac 100644
--- a/drivers/gpu/drm/radeon/radeon_audio.c
+++ b/drivers/gpu/drm/radeon/radeon_audio.c
@@ -101,8 +101,8 @@ static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
         struct drm_display_mode *mode);
 void r600_hdmi_enable(struct drm_encoder *encoder, bool enable);
 void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable);
-void evergreen_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable);
-void dce6_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable);
+void evergreen_dp_enable(struct drm_encoder *encoder, bool enable);
+void dce6_dp_enable(struct drm_encoder *encoder, bool enable);
 
 static const u32 pin_offsets[7] =
 {
@@ -210,7 +210,7 @@ static struct radeon_audio_funcs dce4_dp_funcs = {
         .set_avi_packet = evergreen_set_avi_packet,
         .set_audio_packet = dce4_set_audio_packet,
         .mode_set = radeon_audio_dp_mode_set,
-        .dpms = evergreen_enable_dp_audio_packets,
+        .dpms = evergreen_dp_enable,
 };
 
 static struct radeon_audio_funcs dce6_hdmi_funcs = {
@@ -240,7 +240,7 @@ static struct radeon_audio_funcs dce6_dp_funcs = {
         .set_avi_packet = evergreen_set_avi_packet,
         .set_audio_packet = dce4_set_audio_packet,
         .mode_set = radeon_audio_dp_mode_set,
-        .dpms = dce6_enable_dp_audio_packets,
+        .dpms = dce6_dp_enable,
 };
 
 static void radeon_audio_interface_init(struct radeon_device *rdev)
@@ -452,7 +452,7 @@ void radeon_audio_enable(struct radeon_device *rdev,
 }
 
 void radeon_audio_detect(struct drm_connector *connector,
-        enum drm_connector_status status)
+                         enum drm_connector_status status)
 {
         struct radeon_device *rdev;
         struct radeon_encoder *radeon_encoder;
@@ -483,14 +483,11 @@ void radeon_audio_detect(struct drm_connector *connector,
                 else
                         radeon_encoder->audio = rdev->audio.hdmi_funcs;
 
-                radeon_audio_write_speaker_allocation(connector->encoder);
-                radeon_audio_write_sad_regs(connector->encoder);
-                if (connector->encoder->crtc)
-                        radeon_audio_write_latency_fields(connector->encoder,
-                                &connector->encoder->crtc->mode);
+                dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
                 radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
         } else {
                 radeon_audio_enable(rdev, dig->afmt->pin, 0);
+                dig->afmt->pin = NULL;
         }
 }
 
@@ -694,23 +691,22 @@ static void radeon_audio_set_mute(struct drm_encoder *encoder, bool mute)
  * update the info frames with the data from the current display mode
  */
 static void radeon_audio_hdmi_mode_set(struct drm_encoder *encoder,
-        struct drm_display_mode *mode)
+                                       struct drm_display_mode *mode)
 {
-        struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 
         if (!dig || !dig->afmt)
                 return;
 
-        /* disable audio prior to setting up hw */
-        dig->afmt->pin = radeon_audio_get_pin(encoder);
-        radeon_audio_enable(rdev, dig->afmt->pin, 0);
+        radeon_audio_set_mute(encoder, true);
 
+        radeon_audio_write_speaker_allocation(encoder);
+        radeon_audio_write_sad_regs(encoder);
+        radeon_audio_write_latency_fields(encoder, mode);
         radeon_audio_set_dto(encoder, mode->clock);
         radeon_audio_set_vbi_packet(encoder);
         radeon_hdmi_set_color_depth(encoder);
-        radeon_audio_set_mute(encoder, false);
         radeon_audio_update_acr(encoder, mode->clock);
         radeon_audio_set_audio_packet(encoder);
         radeon_audio_select_pin(encoder);
@@ -718,8 +714,7 @@ static void radeon_audio_hdmi_mode_set(struct drm_encoder *encoder,
         if (radeon_audio_set_avi_packet(encoder, mode) < 0)
                 return;
 
-        /* enable audio after to setting up hw */
-        radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
+        radeon_audio_set_mute(encoder, false);
 }
 
 static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
@@ -729,23 +724,26 @@ static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+        struct radeon_connector_atom_dig *dig_connector =
+                radeon_connector->con_priv;
 
         if (!dig || !dig->afmt)
                 return;
 
-        /* disable audio prior to setting up hw */
-        dig->afmt->pin = radeon_audio_get_pin(encoder);
-        radeon_audio_enable(rdev, dig->afmt->pin, 0);
-
-        radeon_audio_set_dto(encoder, rdev->clock.default_dispclk * 10);
+        radeon_audio_write_speaker_allocation(encoder);
+        radeon_audio_write_sad_regs(encoder);
+        radeon_audio_write_latency_fields(encoder, mode);
+        if (rdev->clock.dp_extclk || ASIC_IS_DCE5(rdev))
+                radeon_audio_set_dto(encoder, rdev->clock.default_dispclk * 10);
+        else
+                radeon_audio_set_dto(encoder, dig_connector->dp_clock);
         radeon_audio_set_audio_packet(encoder);
         radeon_audio_select_pin(encoder);
 
         if (radeon_audio_set_avi_packet(encoder, mode) < 0)
                 return;
-
-        /* enable audio after to setting up hw */
-        radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
 }
 
 void radeon_audio_mode_set(struct drm_encoder *encoder,
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index c830863bc98a..4d0f96cc3da4 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -256,11 +256,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
         u32 ring = RADEON_CS_RING_GFX;
         s32 priority = 0;
 
+        INIT_LIST_HEAD(&p->validated);
+
         if (!cs->num_chunks) {
                 return 0;
         }
+
         /* get chunks */
-        INIT_LIST_HEAD(&p->validated);
         p->idx = 0;
         p->ib.sa_bo = NULL;
         p->const_ib.sa_bo = NULL;
@@ -715,6 +717,7 @@ int radeon_cs_packet_parse(struct radeon_cs_parser *p,
         struct radeon_cs_chunk *ib_chunk = p->chunk_ib;
         struct radeon_device *rdev = p->rdev;
         uint32_t header;
+        int ret = 0, i;
 
         if (idx >= ib_chunk->length_dw) {
                 DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
@@ -743,14 +746,25 @@ int radeon_cs_packet_parse(struct radeon_cs_parser *p,
                 break;
         default:
                 DRM_ERROR("Unknown packet type %d at %d !\n", pkt->type, idx);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto dump_ib;
         }
         if ((pkt->count + 1 + pkt->idx) >= ib_chunk->length_dw) {
                 DRM_ERROR("Packet (%d:%d:%d) end after CS buffer (%d) !\n",
                           pkt->idx, pkt->type, pkt->count, ib_chunk->length_dw);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto dump_ib;
         }
         return 0;
+
+dump_ib:
+        for (i = 0; i < ib_chunk->length_dw; i++) {
+                if (i == idx)
+                        printk("\t0x%08x <---\n", radeon_get_ib_value(p, i));
+                else
+                        printk("\t0x%08x\n", radeon_get_ib_value(p, i));
+        }
+        return ret;
 }
 
 /**
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 6b670b0bc47b..3a297037cc17 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -179,9 +179,12 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder,
                     (rdev->pdev->subsystem_vendor == 0x1734) &&
                     (rdev->pdev->subsystem_device == 0x1107))
                         use_bl = false;
+/* Older PPC macs use on-GPU backlight controller */
+#ifndef CONFIG_PPC_PMAC
                 /* disable native backlight control on older asics */
                 else if (rdev->family < CHIP_R600)
                         use_bl = false;
+#endif
                 else
                         use_bl = true;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 9f758d39420d..33cf4108386d 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -852,6 +852,12 @@ static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
                         single_display = false;
         }
 
+        /* 120hz tends to be problematic even if they are under the
+         * vblank limit.
+         */
+        if (single_display && (r600_dpm_get_vrefresh(rdev) >= 120))
+                single_display = false;
+
         /* certain older asics have a separare 3D performance state,
          * so try that first if the user selected performance
          */
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index d81182ad53ec..97a904835759 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -694,6 +694,10 @@ int rs600_irq_set(struct radeon_device *rdev)
         WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
         if (ASIC_IS_DCE2(rdev))
                 WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
+
+        /* posting read */
+        RREG32(R_000040_GEN_INT_CNTL);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 73107fe9e46f..e088e5558da0 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3162,6 +3162,8 @@ static void si_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 1);
+        WREG32(SRBM_INT_ACK, 1);
 
         evergreen_fix_pci_max_read_req_size(rdev);
 
@@ -4699,12 +4701,6 @@ int si_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
                 switch (pkt.type) {
                 case RADEON_PACKET_TYPE0:
                         dev_err(rdev->dev, "Packet0 not allowed!\n");
-                        for (i = 0; i < ib->length_dw; i++) {
-                                if (i == idx)
-                                        printk("\t0x%08x <---\n", ib->ptr[i]);
-                                else
-                                        printk("\t0x%08x\n", ib->ptr[i]);
-                        }
                         ret = -EINVAL;
                         break;
                 case RADEON_PACKET_TYPE2:
@@ -4736,8 +4732,15 @@ int si_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
                         ret = -EINVAL;
                         break;
                 }
-                if (ret)
+                if (ret) {
+                        for (i = 0; i < ib->length_dw; i++) {
+                                if (i == idx)
+                                        printk("\t0x%08x <---\n", ib->ptr[i]);
+                                else
+                                        printk("\t0x%08x\n", ib->ptr[i]);
+                        }
                         break;
+                }
         } while (idx < ib->length_dw);
 
         return ret;
@@ -5910,6 +5913,7 @@ static void si_disable_interrupt_state(struct radeon_device *rdev)
         tmp = RREG32(DMA_CNTL + DMA1_REGISTER_OFFSET) & ~TRAP_ENABLE;
         WREG32(DMA_CNTL + DMA1_REGISTER_OFFSET, tmp);
         WREG32(GRBM_INT_CNTL, 0);
+        WREG32(SRBM_INT_CNTL, 0);
         if (rdev->num_crtc >= 2) {
                 WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
                 WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
@@ -6199,6 +6203,9 @@ int si_irq_set(struct radeon_device *rdev)
 
         WREG32(CG_THERMAL_INT, thermal_int);
 
+        /* posting read */
+        RREG32(SRBM_STATUS);
+
         return 0;
 }
 
@@ -6609,6 +6616,10 @@ restart_ih:
                                 break;
                         }
                         break;
+                case 96:
+                        DRM_ERROR("SRBM_READ_ERROR: 0x%x\n", RREG32(SRBM_READ_ERROR));
+                        WREG32(SRBM_INT_ACK, 0x1);
+                        break;
                 case 124: /* UVD */
                         DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
                         radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index cbd91d226f3c..99a9835c9f61 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -358,6 +358,10 @@
 #define CC_SYS_RB_BACKEND_DISABLE                       0xe80
 #define GC_USER_SYS_RB_BACKEND_DISABLE                  0xe84
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 #define SRBM_STATUS2                                    0x0EC4
 #define         DMA_BUSY                                (1 << 5)
 #define         DMA1_BUSY                               (1 << 6)
@@ -908,8 +912,8 @@
 
 #define DCCG_AUDIO_DTO0_PHASE                           0x05b0
 #define DCCG_AUDIO_DTO0_MODULE                          0x05b4
-#define DCCG_AUDIO_DTO1_PHASE                           0x05b8
-#define DCCG_AUDIO_DTO1_MODULE                          0x05bc
+#define DCCG_AUDIO_DTO1_PHASE                           0x05c0
+#define DCCG_AUDIO_DTO1_MODULE                          0x05c4
 
 #define AFMT_AUDIO_SRC_CONTROL                          0x713c
 #define         AFMT_AUDIO_SRC_SELECT(x)                (((x) & 7) << 0)
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index bc3e85186b88..b7f781573b15 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -999,8 +999,10 @@ static void tegra_crtc_reset(struct drm_crtc *crtc)
         crtc->state = NULL;
 
         state = kzalloc(sizeof(*state), GFP_KERNEL);
-        if (state)
+        if (state) {
                 crtc->state = &state->base;
+                crtc->state->crtc = crtc;
+        }
 }
 
 static struct drm_crtc_state *
@@ -1014,6 +1016,7 @@ tegra_crtc_atomic_duplicate_state(struct drm_crtc *crtc)
                 return NULL;
 
         copy->base.mode_changed = false;
+        copy->base.active_changed = false;
         copy->base.planes_changed = false;
         copy->base.event = NULL;
 
@@ -1229,9 +1232,6 @@ static void tegra_crtc_mode_set_nofb(struct drm_crtc *crtc)
         /* program display mode */
         tegra_dc_set_timings(dc, mode);
 
-        if (dc->soc->supports_border_color)
-                tegra_dc_writel(dc, 0, DC_DISP_BORDER_COLOR);
-
         /* interlacing isn't supported yet, so disable it */
         if (dc->soc->supports_interlacing) {
                 value = tegra_dc_readl(dc, DC_DISP_INTERLACE_CONTROL);
@@ -1254,42 +1254,7 @@ static void tegra_crtc_mode_set_nofb(struct drm_crtc *crtc)
 
 static void tegra_crtc_prepare(struct drm_crtc *crtc)
 {
-        struct tegra_dc *dc = to_tegra_dc(crtc);
-        unsigned int syncpt;
-        unsigned long value;
-
         drm_crtc_vblank_off(crtc);
-
-        if (dc->pipe)
-                syncpt = SYNCPT_VBLANK1;
-        else
-                syncpt = SYNCPT_VBLANK0;
-
-        /* initialize display controller */
-        tegra_dc_writel(dc, 0x00000100, DC_CMD_GENERAL_INCR_SYNCPT_CNTRL);
-        tegra_dc_writel(dc, 0x100 | syncpt, DC_CMD_CONT_SYNCPT_VSYNC);
-
-        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT | WIN_A_OF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_TYPE);
-
-        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT |
-                WIN_A_OF_INT | WIN_B_OF_INT | WIN_C_OF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_POLARITY);
-
-        /* initialize timer */
-        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(0x20) |
-                WINDOW_B_THRESHOLD(0x20) | WINDOW_C_THRESHOLD(0x20);
-        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY);
-
-        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(1) |
-                WINDOW_B_THRESHOLD(1) | WINDOW_C_THRESHOLD(1);
-        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY_TIMER);
-
-        value = VBLANK_INT | WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_ENABLE);
-
-        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_MASK);
 }
 
 static void tegra_crtc_commit(struct drm_crtc *crtc)
@@ -1666,6 +1631,8 @@ static int tegra_dc_init(struct host1x_client *client)
         struct tegra_drm *tegra = drm->dev_private;
         struct drm_plane *primary = NULL;
         struct drm_plane *cursor = NULL;
+        unsigned int syncpt;
+        u32 value;
         int err;
 
         if (tegra->domain) {
@@ -1732,6 +1699,40 @@ static int tegra_dc_init(struct host1x_client *client)
                 goto cleanup;
         }
 
+        /* initialize display controller */
+        if (dc->pipe)
+                syncpt = SYNCPT_VBLANK1;
+        else
+                syncpt = SYNCPT_VBLANK0;
+
+        tegra_dc_writel(dc, 0x00000100, DC_CMD_GENERAL_INCR_SYNCPT_CNTRL);
+        tegra_dc_writel(dc, 0x100 | syncpt, DC_CMD_CONT_SYNCPT_VSYNC);
+
+        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT | WIN_A_OF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_TYPE);
+
+        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT |
+                WIN_A_OF_INT | WIN_B_OF_INT | WIN_C_OF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_POLARITY);
+
+        /* initialize timer */
+        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(0x20) |
+                WINDOW_B_THRESHOLD(0x20) | WINDOW_C_THRESHOLD(0x20);
+        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY);
+
+        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(1) |
+                WINDOW_B_THRESHOLD(1) | WINDOW_C_THRESHOLD(1);
+        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY_TIMER);
+
+        value = VBLANK_INT | WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_ENABLE);
+
+        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_MASK);
+
+        if (dc->soc->supports_border_color)
+                tegra_dc_writel(dc, 0, DC_DISP_BORDER_COLOR);
+
         return 0;
 
 cleanup:
diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
index 7e06657ae58b..7eaaee74a039 100644
--- a/drivers/gpu/drm/tegra/hdmi.c
+++ b/drivers/gpu/drm/tegra/hdmi.c
@@ -851,6 +851,14 @@ static void tegra_hdmi_encoder_mode_set(struct drm_encoder *encoder,
         h_back_porch = mode->htotal - mode->hsync_end;
         h_front_porch = mode->hsync_start - mode->hdisplay;
 
+        err = clk_set_rate(hdmi->clk, pclk);
+        if (err < 0) {
+                dev_err(hdmi->dev, "failed to set HDMI clock frequency: %d\n",
+                        err);
+        }
+
+        DRM_DEBUG_KMS("HDMI clock rate: %lu Hz\n", clk_get_rate(hdmi->clk));
+
         /* power up sequence */
         value = tegra_hdmi_readl(hdmi, HDMI_NV_PDISP_SOR_PLL0);
         value &= ~SOR_PLL_PDBG;
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index d395b0bef73b..8d9b7de25613 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -74,7 +74,7 @@ static void ttm_mem_type_debug(struct ttm_bo_device *bdev, int mem_type)
         pr_err("    has_type: %d\n", man->has_type);
         pr_err("    use_type: %d\n", man->use_type);
         pr_err("    flags: 0x%08X\n", man->flags);
-        pr_err("    gpu_offset: 0x%08lX\n", man->gpu_offset);
+        pr_err("    gpu_offset: 0x%08llX\n", man->gpu_offset);
         pr_err("    size: %llu\n", man->size);
         pr_err("    available_caching: 0x%08X\n", man->available_caching);
         pr_err("    default_caching: 0x%08X\n", man->default_caching);
diff --git a/drivers/gpu/ipu-v3/ipu-di.c b/drivers/gpu/ipu-v3/ipu-di.c
index b61d6be97602..3ddfb3d0b64d 100644
--- a/drivers/gpu/ipu-v3/ipu-di.c
+++ b/drivers/gpu/ipu-v3/ipu-di.c
@@ -459,6 +459,8 @@ static void ipu_di_config_clock(struct ipu_di *di,
 
                 clkrate = clk_get_rate(di->clk_ipu);
                 div = DIV_ROUND_CLOSEST(clkrate, sig->mode.pixelclock);
+                if (div == 0)
+                        div = 1;
                 rate = clkrate / div;
 
                 error = rate / (sig->mode.pixelclock / 1000);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index db4fb6e1cc5b..7c669c328c4c 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1872,6 +1872,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K_JP) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE7K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
@@ -1926,6 +1927,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
 #endif
 #if IS_ENABLED(CONFIG_HID_SAITEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_OLD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 46edb4d3ed28..204312bfab2c 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -654,6 +654,7 @@
 #define USB_DEVICE_ID_MS_LK6K           0x00f9
 #define USB_DEVICE_ID_MS_PRESENTER_8K_BT        0x0701
 #define USB_DEVICE_ID_MS_PRESENTER_8K_USB       0x0713
+#define USB_DEVICE_ID_MS_NE7K           0x071d
 #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K       0x0730
 #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500     0x076c
 #define USB_DEVICE_ID_MS_SURFACE_PRO_2   0x0799
@@ -802,6 +803,7 @@
 #define USB_VENDOR_ID_SAITEK            0x06a3
 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
 #define USB_DEVICE_ID_SAITEK_PS1000     0x0621
+#define USB_DEVICE_ID_SAITEK_RAT7_OLD   0x0ccb
 #define USB_DEVICE_ID_SAITEK_RAT7       0x0cd7
 #define USB_DEVICE_ID_SAITEK_MMO7       0x0cd0
 
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index fbaea6eb882e..af935eb198c9 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -264,6 +264,8 @@ static const struct hid_device_id ms_devices[] = {
                 .driver_data = MS_ERGONOMY },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K_JP),
                 .driver_data = MS_ERGONOMY },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE7K),
+                .driver_data = MS_ERGONOMY },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K),
                 .driver_data = MS_ERGONOMY | MS_RDESC },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB),
diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
index 5632c54eadf0..a014f21275d8 100644
--- a/drivers/hid/hid-saitek.c
+++ b/drivers/hid/hid-saitek.c
@@ -177,6 +177,8 @@ static int saitek_event(struct hid_device *hdev, struct hid_field *field,
 static const struct hid_device_id saitek_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000),
                 .driver_data = SAITEK_FIX_PS1000 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_OLD),
+                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 6a58b6c723aa..e54ce1097e2c 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -135,8 +135,9 @@ static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
 {
         struct hid_sensor_hub_callbacks_list *callback;
         struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
+        unsigned long flags;
 
-        spin_lock(&pdata->dyn_callback_lock);
+        spin_lock_irqsave(&pdata->dyn_callback_lock, flags);
         list_for_each_entry(callback, &pdata->dyn_callback_list, list)
                 if (callback->usage_id == usage_id &&
                         (collection_index >=
@@ -145,10 +146,11 @@ static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
                                 callback->hsdev->end_collection_index)) {
                         *priv = callback->priv;
                         *hsdev = callback->hsdev;
-                        spin_unlock(&pdata->dyn_callback_lock);
+                        spin_unlock_irqrestore(&pdata->dyn_callback_lock,
+                                               flags);
                         return callback->usage_callback;
                 }
-        spin_unlock(&pdata->dyn_callback_lock);
+        spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
 
         return NULL;
 }
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 31e9d2561106..1896c019e302 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -804,7 +804,7 @@ union sixaxis_output_report_01 {
 #define DS4_REPORT_0x81_SIZE 7
 #define SIXAXIS_REPORT_0xF2_SIZE 18
 
-static spinlock_t sony_dev_list_lock;
+static DEFINE_SPINLOCK(sony_dev_list_lock);
 static LIST_HEAD(sony_device_list);
 static DEFINE_IDA(sony_device_id_allocator);
 
@@ -1944,6 +1944,8 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 return -ENOMEM;
         }
 
+        spin_lock_init(&sc->lock);
+
         sc->quirks = quirks;
         hid_set_drvdata(hdev, sc);
         sc->hdev = hdev;
@@ -2147,8 +2149,8 @@ static void __exit sony_exit(void)
 {
         dbg_hid("Sony:%s\n", __func__);
 
-        ida_destroy(&sony_device_id_allocator);
         hid_unregister_driver(&sony_driver);
+        ida_destroy(&sony_device_id_allocator);
 }
 module_init(sony_init);
 module_exit(sony_exit);
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index d43e967e7533..36053f33d6d9 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
 static void i2c_hid_get_input(struct i2c_hid *ihid)
 {
         int ret, ret_size;
-        int size = ihid->bufsize;
+        int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
+
+        if (size > ihid->bufsize)
+                size = ihid->bufsize;
 
         ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
         if (ret != size) {
@@ -785,7 +788,7 @@ static int i2c_hid_init_irq(struct i2c_client *client)
         dev_dbg(&client->dev, "Requesting IRQ: %d\n", client->irq);
 
         ret = request_threaded_irq(client->irq, NULL, i2c_hid_irq,
-                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                        IRQF_TRIGGER_LOW | IRQF_ONESHOT,
                         client->name, ihid);
         if (ret < 0) {
                 dev_warn(&client->dev,
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 1a6507999a65..046351cf17f3 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -778,6 +778,11 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
                         input_report_abs(input, ABS_X, be16_to_cpup((__be16 *)&data[4]));
                         input_report_abs(input, ABS_Y, be16_to_cpup((__be16 *)&data[6]));
                         input_report_abs(input, ABS_Z, be16_to_cpup((__be16 *)&data[8]));
+                        if ((data[2] & 0x07) | data[4] | data[5] | data[6] | data[7] | data[8] | data[9]) {
+                                input_report_abs(input, ABS_MISC, PAD_DEVICE_ID);
+                        } else {
+                                input_report_abs(input, ABS_MISC, 0);
+                        }
                 } else if (features->type == CINTIQ_HYBRID) {
                         /*
                          * Do not send hardware buttons under Android. They
@@ -2725,9 +2730,9 @@ static const struct wacom_features wacom_features_0xF6 =
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0xf8, .touch_max = 10,
           .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE };
 static const struct wacom_features wacom_features_0x32A =
-        { "Wacom Cintiq 27QHD", 119740, 67520, 2047,
-          63, WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
-          WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
+        { "Wacom Cintiq 27QHD", 119740, 67520, 2047, 63,
+          WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET };
 static const struct wacom_features wacom_features_0x32B =
         { "Wacom Cintiq 27QHD touch", 119740, 67520, 2047, 63,
           WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
diff --git a/drivers/hwmon/ads7828.c b/drivers/hwmon/ads7828.c
index bce4e9ff21bf..6c99ee7bafa3 100644
--- a/drivers/hwmon/ads7828.c
+++ b/drivers/hwmon/ads7828.c
@@ -147,6 +147,9 @@ static int ads7828_probe(struct i2c_client *client,
                                                     &ads2830_regmap_config);
         }
 
+        if (IS_ERR(data->regmap))
+                return PTR_ERR(data->regmap);
+
         data->cmd_byte = ext_vref ? ADS7828_CMD_PD1 : ADS7828_CMD_PD3;
         if (!diff_input)
                 data->cmd_byte |= ADS7828_CMD_SD_SE;
diff --git a/drivers/i2c/busses/i2c-designware-baytrail.c b/drivers/i2c/busses/i2c-designware-baytrail.c
index 5f1ff4cc5c34..7d7ae97476e2 100644
--- a/drivers/i2c/busses/i2c-designware-baytrail.c
+++ b/drivers/i2c/busses/i2c-designware-baytrail.c
@@ -17,27 +17,31 @@
 #include <linux/acpi.h>
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
+
 #include <asm/iosf_mbi.h>
+
 #include "i2c-designware-core.h"
 
 #define SEMAPHORE_TIMEOUT       100
 #define PUNIT_SEMAPHORE         0x7
+#define PUNIT_SEMAPHORE_BIT     BIT(0)
+#define PUNIT_SEMAPHORE_ACQUIRE BIT(1)
 
 static unsigned long acquired;
 
 static int get_sem(struct device *dev, u32 *sem)
 {
-        u32 reg_val;
+        u32 data;
         int ret;
 
         ret = iosf_mbi_read(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_READ, PUNIT_SEMAPHORE,
-                            &reg_val);
+                                &data);
         if (ret) {
                 dev_err(dev, "iosf failed to read punit semaphore\n");
                 return ret;
         }
 
-        *sem = reg_val & 0x1;
+        *sem = data & PUNIT_SEMAPHORE_BIT;
 
         return 0;
 }
@@ -52,27 +56,29 @@ static void reset_semaphore(struct device *dev)
                 return;
         }
 
-        data = data & 0xfffffffe;
+        data &= ~PUNIT_SEMAPHORE_BIT;
         if (iosf_mbi_write(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_WRITE,
-                                 PUNIT_SEMAPHORE, data))
+                                PUNIT_SEMAPHORE, data))
                 dev_err(dev, "iosf failed to reset punit semaphore during write\n");
 }
 
-int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
+static int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
 {
-        u32 sem = 0;
+        u32 sem;
         int ret;
         unsigned long start, end;
 
+        might_sleep();
+
         if (!dev || !dev->dev)
                 return -ENODEV;
 
-        if (!dev->acquire_lock)
+        if (!dev->release_lock)
                 return 0;
 
-        /* host driver writes 0x2 to side band semaphore register */
+        /* host driver writes to side band semaphore register */
         ret = iosf_mbi_write(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_WRITE,
-                                 PUNIT_SEMAPHORE, 0x2);
+                                PUNIT_SEMAPHORE, PUNIT_SEMAPHORE_ACQUIRE);
         if (ret) {
                 dev_err(dev->dev, "iosf punit semaphore request failed\n");
                 return ret;
@@ -81,7 +87,7 @@ int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
         /* host driver waits for bit 0 to be set in semaphore register */
         start = jiffies;
         end = start + msecs_to_jiffies(SEMAPHORE_TIMEOUT);
-        while (!time_after(jiffies, end)) {
+        do {
                 ret = get_sem(dev->dev, &sem);
                 if (!ret && sem) {
                         acquired = jiffies;
@@ -91,14 +97,14 @@ int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
                 }
 
                 usleep_range(1000, 2000);
-        }
+        } while (time_before(jiffies, end));
 
         dev_err(dev->dev, "punit semaphore timed out, resetting\n");
         reset_semaphore(dev->dev);
 
         ret = iosf_mbi_read(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_READ,
-                PUNIT_SEMAPHORE, &sem);
-        if (!ret)
+                                PUNIT_SEMAPHORE, &sem);
+        if (ret)
                 dev_err(dev->dev, "iosf failed to read punit semaphore\n");
         else
                 dev_err(dev->dev, "PUNIT SEM: %d\n", sem);
@@ -107,9 +113,8 @@ int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
 
         return -ETIMEDOUT;
 }
-EXPORT_SYMBOL(baytrail_i2c_acquire);
 
-void baytrail_i2c_release(struct dw_i2c_dev *dev)
+static void baytrail_i2c_release(struct dw_i2c_dev *dev)
 {
         if (!dev || !dev->dev)
                 return;
@@ -121,7 +126,6 @@ void baytrail_i2c_release(struct dw_i2c_dev *dev)
         dev_dbg(dev->dev, "punit semaphore held for %ums\n",
                 jiffies_to_msecs(jiffies - acquired));
 }
-EXPORT_SYMBOL(baytrail_i2c_release);
 
 int i2c_dw_eval_lock_support(struct dw_i2c_dev *dev)
 {
@@ -137,7 +141,6 @@ int i2c_dw_eval_lock_support(struct dw_i2c_dev *dev)
                 return 0;
 
         status = acpi_evaluate_integer(handle, "_SEM", NULL, &shared_host);
-
         if (ACPI_FAILURE(status))
                 return 0;
 
@@ -153,7 +156,6 @@ int i2c_dw_eval_lock_support(struct dw_i2c_dev *dev)
 
         return 0;
 }
-EXPORT_SYMBOL(i2c_dw_eval_lock_support);
 
 MODULE_AUTHOR("David E. Box <david.e.box@linux.intel.com>");
 MODULE_DESCRIPTION("Baytrail I2C Semaphore driver");
diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 51672256072b..b96c636470ef 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -58,20 +58,11 @@
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ), \
         }
 
-/* LSB is in nV to eliminate floating point */
-static const u32 rates_to_lsb[] = {1000000, 250000, 62500, 15625};
-
-/*
- *  scales calculated as:
- *  rates_to_lsb[sample_rate] / (1 << pga);
- *  pga is 1 for 0, 2
- */
-
 static const int mcp3422_scales[4][4] = {
-        { 1000000, 250000, 62500, 15625 },
-        { 500000 , 125000, 31250, 7812 },
-        { 250000 , 62500 , 15625, 3906 },
-        { 125000 , 31250 , 7812 , 1953 } };
+        { 1000000, 500000, 250000, 125000 },
+        { 250000 , 125000, 62500 , 31250  },
+        { 62500  , 31250 , 15625 , 7812   },
+        { 15625  , 7812  , 3906  , 1953   } };
 
 /* Constant msleep times for data acquisitions */
 static const int mcp3422_read_times[4] = {
diff --git a/drivers/iio/adc/qcom-spmi-iadc.c b/drivers/iio/adc/qcom-spmi-iadc.c
index b9666f2f5e51..fabd24edc2a1 100644
--- a/drivers/iio/adc/qcom-spmi-iadc.c
+++ b/drivers/iio/adc/qcom-spmi-iadc.c
@@ -296,7 +296,8 @@ static int iadc_do_conversion(struct iadc_chip *iadc, int chan, u16 *data)
         if (iadc->poll_eoc) {
                 ret = iadc_poll_wait_eoc(iadc, wait);
         } else {
-                ret = wait_for_completion_timeout(&iadc->complete, wait);
+                ret = wait_for_completion_timeout(&iadc->complete,
+                        usecs_to_jiffies(wait));
                 if (!ret)
                         ret = -ETIMEDOUT;
                 else
diff --git a/drivers/iio/common/ssp_sensors/ssp_dev.c b/drivers/iio/common/ssp_sensors/ssp_dev.c
index 52d70435f5a1..55a90082a29b 100644
--- a/drivers/iio/common/ssp_sensors/ssp_dev.c
+++ b/drivers/iio/common/ssp_sensors/ssp_dev.c
@@ -640,6 +640,7 @@ static int ssp_remove(struct spi_device *spi)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int ssp_suspend(struct device *dev)
 {
         int ret;
@@ -688,6 +689,7 @@ static int ssp_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP */
 
 static const struct dev_pm_ops ssp_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(ssp_suspend, ssp_resume)
diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c
index f57562aa396f..15c73e20272d 100644
--- a/drivers/iio/dac/ad5686.c
+++ b/drivers/iio/dac/ad5686.c
@@ -322,7 +322,7 @@ static int ad5686_probe(struct spi_device *spi)
         st = iio_priv(indio_dev);
         spi_set_drvdata(spi, indio_dev);
 
-        st->reg = devm_regulator_get(&spi->dev, "vcc");
+        st->reg = devm_regulator_get_optional(&spi->dev, "vcc");
         if (!IS_ERR(st->reg)) {
                 ret = regulator_enable(st->reg);
                 if (ret)
diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c
index 623c145d8a97..7d79a1ac5f5f 100644
--- a/drivers/iio/humidity/dht11.c
+++ b/drivers/iio/humidity/dht11.c
@@ -29,6 +29,7 @@
 #include <linux/wait.h>
 #include <linux/bitops.h>
 #include <linux/completion.h>
+#include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/gpio.h>
 #include <linux/of_gpio.h>
@@ -39,8 +40,12 @@
 
 #define DHT11_DATA_VALID_TIME   2000000000  /* 2s in ns */
 
-#define DHT11_EDGES_PREAMBLE 4
+#define DHT11_EDGES_PREAMBLE 2
 #define DHT11_BITS_PER_READ 40
+/*
+ * Note that when reading the sensor actually 84 edges are detected, but
+ * since the last edge is not significant, we only store 83:
+ */
 #define DHT11_EDGES_PER_READ (2*DHT11_BITS_PER_READ + DHT11_EDGES_PREAMBLE + 1)
 
 /* Data transmission timing (nano seconds) */
@@ -57,6 +62,7 @@ struct dht11 {
         int                             irq;
 
         struct completion               completion;
+        struct mutex                    lock;
 
         s64                             timestamp;
         int                             temperature;
@@ -88,7 +94,7 @@ static int dht11_decode(struct dht11 *dht11, int offset)
         unsigned char temp_int, temp_dec, hum_int, hum_dec, checksum;
 
         /* Calculate timestamp resolution */
-        for (i = 0; i < dht11->num_edges; ++i) {
+        for (i = 1; i < dht11->num_edges; ++i) {
                 t = dht11->edges[i].ts - dht11->edges[i-1].ts;
                 if (t > 0 && t < timeres)
                         timeres = t;
@@ -138,6 +144,27 @@ static int dht11_decode(struct dht11 *dht11, int offset)
         return 0;
 }
 
+/*
+ * IRQ handler called on GPIO edges
+ */
+static irqreturn_t dht11_handle_irq(int irq, void *data)
+{
+        struct iio_dev *iio = data;
+        struct dht11 *dht11 = iio_priv(iio);
+
+        /* TODO: Consider making the handler safe for IRQ sharing */
+        if (dht11->num_edges < DHT11_EDGES_PER_READ && dht11->num_edges >= 0) {
+                dht11->edges[dht11->num_edges].ts = iio_get_time_ns();
+                dht11->edges[dht11->num_edges++].value =
+                                                gpio_get_value(dht11->gpio);
+
+                if (dht11->num_edges >= DHT11_EDGES_PER_READ)
+                        complete(&dht11->completion);
+        }
+
+        return IRQ_HANDLED;
+}
+
 static int dht11_read_raw(struct iio_dev *iio_dev,
                         const struct iio_chan_spec *chan,
                         int *val, int *val2, long m)
@@ -145,6 +172,7 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
         struct dht11 *dht11 = iio_priv(iio_dev);
         int ret;
 
+        mutex_lock(&dht11->lock);
         if (dht11->timestamp + DHT11_DATA_VALID_TIME < iio_get_time_ns()) {
                 reinit_completion(&dht11->completion);
 
@@ -157,8 +185,17 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
                 if (ret)
                         goto err;
 
+                ret = request_irq(dht11->irq, dht11_handle_irq,
+                                  IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+                                  iio_dev->name, iio_dev);
+                if (ret)
+                        goto err;
+
                 ret = wait_for_completion_killable_timeout(&dht11->completion,
                                                                  HZ);
+
+                free_irq(dht11->irq, iio_dev);
+
                 if (ret == 0 && dht11->num_edges < DHT11_EDGES_PER_READ - 1) {
                         dev_err(&iio_dev->dev,
                                         "Only %d signal edges detected\n",
@@ -185,6 +222,7 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
                 ret = -EINVAL;
 err:
         dht11->num_edges = -1;
+        mutex_unlock(&dht11->lock);
         return ret;
 }
 
@@ -193,27 +231,6 @@ static const struct iio_info dht11_iio_info = {
         .read_raw               = dht11_read_raw,
 };
 
-/*
- * IRQ handler called on GPIO edges
-*/
-static irqreturn_t dht11_handle_irq(int irq, void *data)
-{
-        struct iio_dev *iio = data;
-        struct dht11 *dht11 = iio_priv(iio);
-
-        /* TODO: Consider making the handler safe for IRQ sharing */
-        if (dht11->num_edges < DHT11_EDGES_PER_READ && dht11->num_edges >= 0) {
-                dht11->edges[dht11->num_edges].ts = iio_get_time_ns();
-                dht11->edges[dht11->num_edges++].value =
-                                                gpio_get_value(dht11->gpio);
-
-                if (dht11->num_edges >= DHT11_EDGES_PER_READ)
-                        complete(&dht11->completion);
-        }
-
-        return IRQ_HANDLED;
-}
-
 static const struct iio_chan_spec dht11_chan_spec[] = {
         { .type = IIO_TEMP,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED), },
@@ -256,11 +273,6 @@ static int dht11_probe(struct platform_device *pdev)
                 dev_err(dev, "GPIO %d has no interrupt\n", dht11->gpio);
                 return -EINVAL;
         }
-        ret = devm_request_irq(dev, dht11->irq, dht11_handle_irq,
-                                IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                                pdev->name, iio);
-        if (ret)
-                return ret;
 
         dht11->timestamp = iio_get_time_ns() - DHT11_DATA_VALID_TIME - 1;
         dht11->num_edges = -1;
@@ -268,6 +280,7 @@ static int dht11_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, iio);
 
         init_completion(&dht11->completion);
+        mutex_init(&dht11->lock);
         iio->name = pdev->name;
         iio->dev.parent = &pdev->dev;
         iio->info = &dht11_iio_info;
diff --git a/drivers/iio/humidity/si7020.c b/drivers/iio/humidity/si7020.c
index b54164677b89..fa3b809aff5e 100644
--- a/drivers/iio/humidity/si7020.c
+++ b/drivers/iio/humidity/si7020.c
@@ -45,12 +45,12 @@ static int si7020_read_raw(struct iio_dev *indio_dev,
                            struct iio_chan_spec const *chan, int *val,
                            int *val2, long mask)
 {
-        struct i2c_client *client = iio_priv(indio_dev);
+        struct i2c_client **client = iio_priv(indio_dev);
         int ret;
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                ret = i2c_smbus_read_word_data(client,
+                ret = i2c_smbus_read_word_data(*client,
                                                chan->type == IIO_TEMP ?
                                                SI7020CMD_TEMP_HOLD :
                                                SI7020CMD_RH_HOLD);
@@ -126,7 +126,7 @@ static int si7020_probe(struct i2c_client *client,
         /* Wait the maximum power-up time after software reset. */
         msleep(15);
 
-        indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*client));
+        indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data));
         if (!indio_dev)
                 return -ENOMEM;
 
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index b70873de04ea..fa795dcd5f75 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -26,6 +26,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/debugfs.h>
+#include <linux/bitops.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
@@ -414,7 +415,7 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
                 mutex_unlock(&indio_dev->mlock);
                 if (ret)
                         return ret;
-                val16 = ((val16 & 0xFFF) << 4) >> 4;
+                val16 = sign_extend32(val16, 11);
                 *val = val16;
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_OFFSET:
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index f73e60b7a796..d8d5bed65e07 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -780,7 +780,11 @@ static int inv_mpu_probe(struct i2c_client *client,
 
         i2c_set_clientdata(client, indio_dev);
         indio_dev->dev.parent = &client->dev;
-        indio_dev->name = id->name;
+        /* id will be NULL when enumerated via ACPI */
+        if (id)
+                indio_dev->name = (char *)id->name;
+        else
+                indio_dev->name = (char *)dev_name(&client->dev);
         indio_dev->channels = inv_mpu_channels;
         indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels);
 
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index ae68c64bdad3..a224afd6380c 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -73,6 +73,7 @@ config CM36651
 config GP2AP020A00F
         tristate "Sharp GP2AP020A00F Proximity/ALS sensor"
         depends on I2C
+        select REGMAP_I2C
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select IRQ_WORK
@@ -126,6 +127,7 @@ config HID_SENSOR_PROX
 config JSA1212
         tristate "JSA1212 ALS and proximity sensor driver"
         depends on I2C
+        select REGMAP_I2C
         help
          Say Y here if you want to build a IIO driver for JSA1212
          proximity & ALS sensor device.
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index 4c7a4c52dd06..a5d6de72c523 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -18,6 +18,8 @@ config AK8975
 
 config AK09911
         tristate "Asahi Kasei AK09911 3-axis Compass"
+        depends on I2C
+        depends on GPIOLIB
         select AK8975
         help
           Deprecated: AK09911 is now supported by AK8975 driver.
diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index 3c92780bda09..ff48da61c94c 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -1755,7 +1755,7 @@ init_card(struct hfc_pci *hc)
                 enable_hwirq(hc);
                 spin_unlock_irqrestore(&hc->lock, flags);
                 /* Timeout 80ms */
-                current->state = TASK_UNINTERRUPTIBLE;
+                set_current_state(TASK_UNINTERRUPTIBLE);
                 schedule_timeout((80 * HZ) / 1000);
                 printk(KERN_INFO "HFC PCI: IRQ %d count %d\n",
                        hc->irq, hc->irqcnt);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c8d2bac4e28b..cadf9cc02b25 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2555,7 +2555,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
         return err ? err : len;
 }
 static struct rdev_sysfs_entry rdev_state =
-__ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
+__ATTR_PREALLOC(state, S_IRUGO|S_IWUSR, state_show, state_store);
 
 static ssize_t
 errors_show(struct md_rdev *rdev, char *page)
@@ -3638,7 +3638,8 @@ resync_start_store(struct mddev *mddev, const char *buf, size_t len)
         return err ?: len;
 }
 static struct md_sysfs_entry md_resync_start =
-__ATTR(resync_start, S_IRUGO|S_IWUSR, resync_start_show, resync_start_store);
+__ATTR_PREALLOC(resync_start, S_IRUGO|S_IWUSR,
+                resync_start_show, resync_start_store);
 
 /*
  * The array state can be:
@@ -3851,7 +3852,7 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len)
         return err ?: len;
 }
 static struct md_sysfs_entry md_array_state =
-__ATTR(array_state, S_IRUGO|S_IWUSR, array_state_show, array_state_store);
+__ATTR_PREALLOC(array_state, S_IRUGO|S_IWUSR, array_state_show, array_state_store);
 
 static ssize_t
 max_corrected_read_errors_show(struct mddev *mddev, char *page) {
@@ -4101,7 +4102,7 @@ out_unlock:
 }
 
 static struct md_sysfs_entry md_metadata =
-__ATTR(metadata_version, S_IRUGO|S_IWUSR, metadata_show, metadata_store);
+__ATTR_PREALLOC(metadata_version, S_IRUGO|S_IWUSR, metadata_show, metadata_store);
 
 static ssize_t
 action_show(struct mddev *mddev, char *page)
@@ -4189,7 +4190,7 @@ action_store(struct mddev *mddev, const char *page, size_t len)
 }
 
 static struct md_sysfs_entry md_scan_mode =
-__ATTR(sync_action, S_IRUGO|S_IWUSR, action_show, action_store);
+__ATTR_PREALLOC(sync_action, S_IRUGO|S_IWUSR, action_show, action_store);
 
 static ssize_t
 last_sync_action_show(struct mddev *mddev, char *page)
@@ -4335,7 +4336,8 @@ sync_completed_show(struct mddev *mddev, char *page)
         return sprintf(page, "%llu / %llu\n", resync, max_sectors);
 }
 
-static struct md_sysfs_entry md_sync_completed = __ATTR_RO(sync_completed);
+static struct md_sysfs_entry md_sync_completed =
+        __ATTR_PREALLOC(sync_completed, S_IRUGO, sync_completed_show, NULL);
 
 static ssize_t
 min_sync_show(struct mddev *mddev, char *page)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 4153da5d4011..d34e238afa54 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -560,7 +560,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                 if (test_bit(WriteMostly, &rdev->flags)) {
                         /* Don't balance among write-mostly, just
                          * use the first as a last resort */
-                        if (best_disk < 0) {
+                        if (best_dist_disk < 0) {
                                 if (is_badblock(rdev, this_sector, sectors,
                                                 &first_bad, &bad_sectors)) {
                                         if (first_bad < this_sector)
@@ -569,7 +569,8 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                                         best_good_sectors = first_bad - this_sector;
                                 } else
                                         best_good_sectors = sectors;
-                                best_disk = disk;
+                                best_dist_disk = disk;
+                                best_pending_disk = disk;
                         }
                         continue;
                 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e75d48c0421a..cd2f96b2c572 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5121,12 +5121,17 @@ static inline sector_t sync_request(struct mddev *mddev, sector_t sector_nr, int
                 schedule_timeout_uninterruptible(1);
         }
         /* Need to check if array will still be degraded after recovery/resync
-         * We don't need to check the 'failed' flag as when that gets set,
-         * recovery aborts.
+         * Note in case of > 1 drive failures it's possible we're rebuilding
+         * one drive while leaving another faulty drive in array.
          */
-        for (i = 0; i < conf->raid_disks; i++)
-                if (conf->disks[i].rdev == NULL)
+        rcu_read_lock();
+        for (i = 0; i < conf->raid_disks; i++) {
+                struct md_rdev *rdev = ACCESS_ONCE(conf->disks[i].rdev);
+
+                if (rdev == NULL || test_bit(Faulty, &rdev->flags))
                         still_degraded = 1;
+        }
+        rcu_read_unlock();
 
         bitmap_start_sync(mddev->bitmap, sector_nr, &sync_blocks, still_degraded);
 
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 9306219d5675..6ad049a08e4d 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -341,6 +341,8 @@ void mei_stop(struct mei_device *dev)
 
         dev->dev_state = MEI_DEV_POWER_DOWN;
         mei_reset(dev);
+        /* move device to disabled state unconditionally */
+        dev->dev_state = MEI_DEV_DISABLED;
 
         mutex_unlock(&dev->device_lock);
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 84673ebcf428..df51d6025a90 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -157,7 +157,7 @@ config IPVLAN
       making it transparent to the connected L2 switch.
 
       Ipvlan devices can be added using the "ip" command from the
-      iproute2 package starting with the iproute2-X.Y.ZZ release:
+      iproute2 package starting with the iproute2-3.19 release:
 
       "ip link add link <main-dev> [ NAME ] type ipvlan"
 
diff --git a/drivers/net/appletalk/Kconfig b/drivers/net/appletalk/Kconfig
index 4ce6ca5f3d36..dc6b78e5342f 100644
--- a/drivers/net/appletalk/Kconfig
+++ b/drivers/net/appletalk/Kconfig
@@ -40,7 +40,7 @@ config DEV_APPLETALK
 
 config LTPC
         tristate "Apple/Farallon LocalTalk PC support"
-        depends on DEV_APPLETALK && (ISA || EISA) && ISA_DMA_API
+        depends on DEV_APPLETALK && (ISA || EISA) && ISA_DMA_API && VIRT_TO_BUS
         help
           This allows you to use the AppleTalk PC card to connect to LocalTalk
           networks. The card is also known as the Farallon PhoneNet PC card.
diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
index ee9f650d5026..7b7053d3c5fa 100644
--- a/drivers/net/dsa/bcm_sf2.h
+++ b/drivers/net/dsa/bcm_sf2.h
@@ -105,8 +105,8 @@ static inline u64 name##_readq(struct bcm_sf2_priv *priv, u32 off)	\
 {                                                                       \
         u32 indir, dir;                                                 \
         spin_lock(&priv->indir_lock);                                   \
-        indir = reg_readl(priv, REG_DIR_DATA_READ);                     \
         dir = __raw_readl(priv->name + off);                            \
+        indir = reg_readl(priv, REG_DIR_DATA_READ);                     \
         spin_unlock(&priv->indir_lock);                                 \
         return (u64)indir << 32 | dir;                                  \
 }                                                                       \
diff --git a/drivers/net/ethernet/8390/axnet_cs.c b/drivers/net/ethernet/8390/axnet_cs.c
index 7769c05543f1..ec6eac1f8c95 100644
--- a/drivers/net/ethernet/8390/axnet_cs.c
+++ b/drivers/net/ethernet/8390/axnet_cs.c
@@ -484,11 +484,8 @@ static int axnet_open(struct net_device *dev)
     link->open++;
 
     info->link_status = 0x00;
-    init_timer(&info->watchdog);
-    info->watchdog.function = ei_watchdog;
-    info->watchdog.data = (u_long)dev;
-    info->watchdog.expires = jiffies + HZ;
-    add_timer(&info->watchdog);
+    setup_timer(&info->watchdog, ei_watchdog, (u_long)dev);
+    mod_timer(&info->watchdog, jiffies + HZ);
 
     return ax_open(dev);
 } /* axnet_open */
diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c
index 9fb7b9d4fd6c..2777289a26c0 100644
--- a/drivers/net/ethernet/8390/pcnet_cs.c
+++ b/drivers/net/ethernet/8390/pcnet_cs.c
@@ -918,11 +918,8 @@ static int pcnet_open(struct net_device *dev)
 
     info->phy_id = info->eth_phy;
     info->link_status = 0x00;
-    init_timer(&info->watchdog);
-    info->watchdog.function = ei_watchdog;
-    info->watchdog.data = (u_long)dev;
-    info->watchdog.expires = jiffies + HZ;
-    add_timer(&info->watchdog);
+    setup_timer(&info->watchdog, ei_watchdog, (u_long)dev);
+    mod_timer(&info->watchdog, jiffies + HZ);
 
     return ei_open(dev);
 } /* pcnet_open */
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 760c72c6e2ac..6725dc00750b 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -376,7 +376,8 @@ static int tse_rx(struct altera_tse_private *priv, int limit)
         u16 pktlength;
         u16 pktstatus;
 
-        while ((rxstatus = priv->dmaops->get_rx_status(priv)) != 0) {
+        while (((rxstatus = priv->dmaops->get_rx_status(priv)) != 0) &&
+               (count < limit))  {
                 pktstatus = rxstatus >> 16;
                 pktlength = rxstatus & 0xffff;
 
@@ -491,28 +492,27 @@ static int tse_poll(struct napi_struct *napi, int budget)
         struct altera_tse_private *priv =
                         container_of(napi, struct altera_tse_private, napi);
         int rxcomplete = 0;
-        int txcomplete = 0;
         unsigned long int flags;
 
-        txcomplete = tse_tx_complete(priv);
+        tse_tx_complete(priv);
 
         rxcomplete = tse_rx(priv, budget);
 
-        if (rxcomplete >= budget || txcomplete > 0)
-                return rxcomplete;
+        if (rxcomplete < budget) {
 
-        napi_gro_flush(napi, false);
-        __napi_complete(napi);
+                napi_gro_flush(napi, false);
+                __napi_complete(napi);
 
-        netdev_dbg(priv->dev,
-                   "NAPI Complete, did %d packets with budget %d\n",
-                   txcomplete+rxcomplete, budget);
+                netdev_dbg(priv->dev,
+                           "NAPI Complete, did %d packets with budget %d\n",
+                           rxcomplete, budget);
 
-        spin_lock_irqsave(&priv->rxdma_irq_lock, flags);
-        priv->dmaops->enable_rxirq(priv);
-        priv->dmaops->enable_txirq(priv);
-        spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
-        return rxcomplete + txcomplete;
+                spin_lock_irqsave(&priv->rxdma_irq_lock, flags);
+                priv->dmaops->enable_rxirq(priv);
+                priv->dmaops->enable_txirq(priv);
+                spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
+        }
+        return rxcomplete;
 }
 
 /* DMA TX & RX FIFO interrupt routing
@@ -521,7 +521,6 @@ static irqreturn_t altera_isr(int irq, void *dev_id)
 {
         struct net_device *dev = dev_id;
         struct altera_tse_private *priv;
-        unsigned long int flags;
 
         if (unlikely(!dev)) {
                 pr_err("%s: invalid dev pointer\n", __func__);
@@ -529,20 +528,20 @@ static irqreturn_t altera_isr(int irq, void *dev_id)
         }
         priv = netdev_priv(dev);
 
-        /* turn off desc irqs and enable napi rx */
-        spin_lock_irqsave(&priv->rxdma_irq_lock, flags);
+        spin_lock(&priv->rxdma_irq_lock);
+        /* reset IRQs */
+        priv->dmaops->clear_rxirq(priv);
+        priv->dmaops->clear_txirq(priv);
+        spin_unlock(&priv->rxdma_irq_lock);
 
         if (likely(napi_schedule_prep(&priv->napi))) {
+                spin_lock(&priv->rxdma_irq_lock);
                 priv->dmaops->disable_rxirq(priv);
                 priv->dmaops->disable_txirq(priv);
+                spin_unlock(&priv->rxdma_irq_lock);
                 __napi_schedule(&priv->napi);
         }
 
-        /* reset IRQs */
-        priv->dmaops->clear_rxirq(priv);
-        priv->dmaops->clear_txirq(priv);
-
-        spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
 
         return IRQ_HANDLED;
 }
@@ -1399,7 +1398,7 @@ static int altera_tse_probe(struct platform_device *pdev)
         }
 
         if (of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth",
-                                 &priv->rx_fifo_depth)) {
+                                 &priv->tx_fifo_depth)) {
                 dev_err(&pdev->dev, "cannot obtain tx-fifo-depth\n");
                 ret = -ENXIO;
                 goto err_free_netdev;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index b93d4404d975..885b02b5be07 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -609,6 +609,68 @@ static void xgbe_napi_disable(struct xgbe_prv_data *pdata, unsigned int del)
         }
 }
 
+static int xgbe_request_irqs(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_channel *channel;
+        struct net_device *netdev = pdata->netdev;
+        unsigned int i;
+        int ret;
+
+        ret = devm_request_irq(pdata->dev, pdata->dev_irq, xgbe_isr, 0,
+                               netdev->name, pdata);
+        if (ret) {
+                netdev_alert(netdev, "error requesting irq %d\n",
+                             pdata->dev_irq);
+                return ret;
+        }
+
+        if (!pdata->per_channel_irq)
+                return 0;
+
+        channel = pdata->channel;
+        for (i = 0; i < pdata->channel_count; i++, channel++) {
+                snprintf(channel->dma_irq_name,
+                         sizeof(channel->dma_irq_name) - 1,
+                         "%s-TxRx-%u", netdev_name(netdev),
+                         channel->queue_index);
+
+                ret = devm_request_irq(pdata->dev, channel->dma_irq,
+                                       xgbe_dma_isr, 0,
+                                       channel->dma_irq_name, channel);
+                if (ret) {
+                        netdev_alert(netdev, "error requesting irq %d\n",
+                                     channel->dma_irq);
+                        goto err_irq;
+                }
+        }
+
+        return 0;
+
+err_irq:
+        /* Using an unsigned int, 'i' will go to UINT_MAX and exit */
+        for (i--, channel--; i < pdata->channel_count; i--, channel--)
+                devm_free_irq(pdata->dev, channel->dma_irq, channel);
+
+        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
+
+        return ret;
+}
+
+static void xgbe_free_irqs(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_channel *channel;
+        unsigned int i;
+
+        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
+
+        if (!pdata->per_channel_irq)
+                return;
+
+        channel = pdata->channel;
+        for (i = 0; i < pdata->channel_count; i++, channel++)
+                devm_free_irq(pdata->dev, channel->dma_irq, channel);
+}
+
 void xgbe_init_tx_coalesce(struct xgbe_prv_data *pdata)
 {
         struct xgbe_hw_if *hw_if = &pdata->hw_if;
@@ -810,20 +872,20 @@ int xgbe_powerdown(struct net_device *netdev, unsigned int caller)
                 return -EINVAL;
         }
 
-        phy_stop(pdata->phydev);
-
         spin_lock_irqsave(&pdata->lock, flags);
 
         if (caller == XGMAC_DRIVER_CONTEXT)
                 netif_device_detach(netdev);
 
         netif_tx_stop_all_queues(netdev);
-        xgbe_napi_disable(pdata, 0);
 
-        /* Powerdown Tx/Rx */
         hw_if->powerdown_tx(pdata);
         hw_if->powerdown_rx(pdata);
 
+        xgbe_napi_disable(pdata, 0);
+
+        phy_stop(pdata->phydev);
+
         pdata->power_down = 1;
 
         spin_unlock_irqrestore(&pdata->lock, flags);
@@ -854,14 +916,14 @@ int xgbe_powerup(struct net_device *netdev, unsigned int caller)
 
         phy_start(pdata->phydev);
 
-        /* Enable Tx/Rx */
+        xgbe_napi_enable(pdata, 0);
+
         hw_if->powerup_tx(pdata);
         hw_if->powerup_rx(pdata);
 
         if (caller == XGMAC_DRIVER_CONTEXT)
                 netif_device_attach(netdev);
 
-        xgbe_napi_enable(pdata, 0);
         netif_tx_start_all_queues(netdev);
 
         spin_unlock_irqrestore(&pdata->lock, flags);
@@ -875,6 +937,7 @@ static int xgbe_start(struct xgbe_prv_data *pdata)
 {
         struct xgbe_hw_if *hw_if = &pdata->hw_if;
         struct net_device *netdev = pdata->netdev;
+        int ret;
 
         DBGPR("-->xgbe_start\n");
 
@@ -884,17 +947,31 @@ static int xgbe_start(struct xgbe_prv_data *pdata)
 
         phy_start(pdata->phydev);
 
+        xgbe_napi_enable(pdata, 1);
+
+        ret = xgbe_request_irqs(pdata);
+        if (ret)
+                goto err_napi;
+
         hw_if->enable_tx(pdata);
         hw_if->enable_rx(pdata);
 
         xgbe_init_tx_timers(pdata);
 
-        xgbe_napi_enable(pdata, 1);
         netif_tx_start_all_queues(netdev);
 
         DBGPR("<--xgbe_start\n");
 
         return 0;
+
+err_napi:
+        xgbe_napi_disable(pdata, 1);
+
+        phy_stop(pdata->phydev);
+
+        hw_if->exit(pdata);
+
+        return ret;
 }
 
 static void xgbe_stop(struct xgbe_prv_data *pdata)
@@ -907,16 +984,21 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
 
         DBGPR("-->xgbe_stop\n");
 
-        phy_stop(pdata->phydev);
-
         netif_tx_stop_all_queues(netdev);
-        xgbe_napi_disable(pdata, 1);
 
         xgbe_stop_tx_timers(pdata);
 
         hw_if->disable_tx(pdata);
         hw_if->disable_rx(pdata);
 
+        xgbe_free_irqs(pdata);
+
+        xgbe_napi_disable(pdata, 1);
+
+        phy_stop(pdata->phydev);
+
+        hw_if->exit(pdata);
+
         channel = pdata->channel;
         for (i = 0; i < pdata->channel_count; i++, channel++) {
                 if (!channel->tx_ring)
@@ -931,10 +1013,6 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
 
 static void xgbe_restart_dev(struct xgbe_prv_data *pdata)
 {
-        struct xgbe_channel *channel;
-        struct xgbe_hw_if *hw_if = &pdata->hw_if;
-        unsigned int i;
-
         DBGPR("-->xgbe_restart_dev\n");
 
         /* If not running, "restart" will happen on open */
@@ -942,19 +1020,10 @@ static void xgbe_restart_dev(struct xgbe_prv_data *pdata)
                 return;
 
         xgbe_stop(pdata);
-        synchronize_irq(pdata->dev_irq);
-        if (pdata->per_channel_irq) {
-                channel = pdata->channel;
-                for (i = 0; i < pdata->channel_count; i++, channel++)
-                        synchronize_irq(channel->dma_irq);
-        }
 
         xgbe_free_tx_data(pdata);
         xgbe_free_rx_data(pdata);
 
-        /* Issue software reset to device */
-        hw_if->exit(pdata);
-
         xgbe_start(pdata);
 
         DBGPR("<--xgbe_restart_dev\n");
@@ -1283,10 +1352,7 @@ static void xgbe_packet_info(struct xgbe_prv_data *pdata,
 static int xgbe_open(struct net_device *netdev)
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
-        struct xgbe_hw_if *hw_if = &pdata->hw_if;
         struct xgbe_desc_if *desc_if = &pdata->desc_if;
-        struct xgbe_channel *channel = NULL;
-        unsigned int i = 0;
         int ret;
 
         DBGPR("-->xgbe_open\n");
@@ -1329,55 +1395,14 @@ static int xgbe_open(struct net_device *netdev)
         INIT_WORK(&pdata->restart_work, xgbe_restart);
         INIT_WORK(&pdata->tx_tstamp_work, xgbe_tx_tstamp);
 
-        /* Request interrupts */
-        ret = devm_request_irq(pdata->dev, pdata->dev_irq, xgbe_isr, 0,
-                               netdev->name, pdata);
-        if (ret) {
-                netdev_alert(netdev, "error requesting irq %d\n",
-                             pdata->dev_irq);
-                goto err_rings;
-        }
-
-        if (pdata->per_channel_irq) {
-                channel = pdata->channel;
-                for (i = 0; i < pdata->channel_count; i++, channel++) {
-                        snprintf(channel->dma_irq_name,
-                                 sizeof(channel->dma_irq_name) - 1,
-                                 "%s-TxRx-%u", netdev_name(netdev),
-                                 channel->queue_index);
-
-                        ret = devm_request_irq(pdata->dev, channel->dma_irq,
-                                               xgbe_dma_isr, 0,
-                                               channel->dma_irq_name, channel);
-                        if (ret) {
-                                netdev_alert(netdev,
-                                             "error requesting irq %d\n",
-                                             channel->dma_irq);
-                                goto err_irq;
-                        }
-                }
-        }
-
         ret = xgbe_start(pdata);
         if (ret)
-                goto err_start;
+                goto err_rings;
 
         DBGPR("<--xgbe_open\n");
 
         return 0;
 
-err_start:
-        hw_if->exit(pdata);
-
-err_irq:
-        if (pdata->per_channel_irq) {
-                /* Using an unsigned int, 'i' will go to UINT_MAX and exit */
-                for (i--, channel--; i < pdata->channel_count; i--, channel--)
-                        devm_free_irq(pdata->dev, channel->dma_irq, channel);
-        }
-
-        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
-
 err_rings:
         desc_if->free_ring_resources(pdata);
 
@@ -1399,30 +1424,16 @@ err_phy_init:
 static int xgbe_close(struct net_device *netdev)
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
-        struct xgbe_hw_if *hw_if = &pdata->hw_if;
         struct xgbe_desc_if *desc_if = &pdata->desc_if;
-        struct xgbe_channel *channel;
-        unsigned int i;
 
         DBGPR("-->xgbe_close\n");
 
         /* Stop the device */
         xgbe_stop(pdata);
 
-        /* Issue software reset to device */
-        hw_if->exit(pdata);
-
         /* Free the ring descriptors and buffers */
         desc_if->free_ring_resources(pdata);
 
-        /* Release the interrupts */
-        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
-        if (pdata->per_channel_irq) {
-                channel = pdata->channel;
-                for (i = 0; i < pdata->channel_count; i++, channel++)
-                        devm_free_irq(pdata->dev, channel->dma_irq, channel);
-        }
-
         /* Free the channel and ring structures */
         xgbe_free_channels(pdata);
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 5b308a4a4d0e..783543ad1fcf 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -274,9 +274,9 @@ static const struct bcm_sysport_stats bcm_sysport_gstrings_stats[] = {
         /* RBUF misc statistics */
         STAT_RBUF("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt, RBUF_OVFL_DISC_CNTR),
         STAT_RBUF("rbuf_err_cnt", mib.rbuf_err_cnt, RBUF_ERR_PKT_CNTR),
-        STAT_MIB_RX("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
-        STAT_MIB_RX("rx_dma_failed", mib.rx_dma_failed),
-        STAT_MIB_TX("tx_dma_failed", mib.tx_dma_failed),
+        STAT_MIB_SOFT("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
+        STAT_MIB_SOFT("rx_dma_failed", mib.rx_dma_failed),
+        STAT_MIB_SOFT("tx_dma_failed", mib.tx_dma_failed),
 };
 
 #define BCM_SYSPORT_STATS_LEN   ARRAY_SIZE(bcm_sysport_gstrings_stats)
@@ -345,6 +345,7 @@ static void bcm_sysport_update_mib_counters(struct bcm_sysport_priv *priv)
                 s = &bcm_sysport_gstrings_stats[i];
                 switch (s->type) {
                 case BCM_SYSPORT_STAT_NETDEV:
+                case BCM_SYSPORT_STAT_SOFT:
                         continue;
                 case BCM_SYSPORT_STAT_MIB_RX:
                 case BCM_SYSPORT_STAT_MIB_TX:
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index fc19417d82a5..7e3d87a88c76 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -570,6 +570,7 @@ enum bcm_sysport_stat_type {
         BCM_SYSPORT_STAT_RUNT,
         BCM_SYSPORT_STAT_RXCHK,
         BCM_SYSPORT_STAT_RBUF,
+        BCM_SYSPORT_STAT_SOFT,
 };
 
 /* Macros to help define ethtool statistics */
@@ -590,6 +591,7 @@ enum bcm_sysport_stat_type {
 #define STAT_MIB_RX(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_MIB_RX)
 #define STAT_MIB_TX(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_MIB_TX)
 #define STAT_RUNT(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_RUNT)
+#define STAT_MIB_SOFT(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_SOFT)
 
 #define STAT_RXCHK(str, m, ofs) { \
         .stat_string = str, \
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index ff83c46bc389..6befde61c203 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -487,6 +487,7 @@ enum bcmgenet_stat_type {
         BCMGENET_STAT_MIB_TX,
         BCMGENET_STAT_RUNT,
         BCMGENET_STAT_MISC,
+        BCMGENET_STAT_SOFT,
 };
 
 struct bcmgenet_stats {
@@ -515,6 +516,7 @@ struct bcmgenet_stats {
 #define STAT_GENET_MIB_RX(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_MIB_RX)
 #define STAT_GENET_MIB_TX(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_MIB_TX)
 #define STAT_GENET_RUNT(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_RUNT)
+#define STAT_GENET_SOFT_MIB(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_SOFT)
 
 #define STAT_GENET_MISC(str, m, offset) { \
         .stat_string = str, \
@@ -614,9 +616,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = {
                         UMAC_RBUF_OVFL_CNT),
         STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT),
         STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT),
-        STAT_GENET_MIB_RX("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
-        STAT_GENET_MIB_RX("rx_dma_failed", mib.rx_dma_failed),
-        STAT_GENET_MIB_TX("tx_dma_failed", mib.tx_dma_failed),
+        STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
+        STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed),
+        STAT_GENET_SOFT_MIB("tx_dma_failed", mib.tx_dma_failed),
 };
 
 #define BCMGENET_STATS_LEN      ARRAY_SIZE(bcmgenet_gstrings_stats)
@@ -668,6 +670,7 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
                 s = &bcmgenet_gstrings_stats[i];
                 switch (s->type) {
                 case BCMGENET_STAT_NETDEV:
+                case BCMGENET_STAT_SOFT:
                         continue;
                 case BCMGENET_STAT_MIB_RX:
                 case BCMGENET_STAT_MIB_TX:
@@ -971,13 +974,14 @@ static inline void bcmgenet_tx_ring_int_disable(struct bcmgenet_priv *priv,
 }
 
 /* Unlocked version of the reclaim routine */
-static void __bcmgenet_tx_reclaim(struct net_device *dev,
-                                  struct bcmgenet_tx_ring *ring)
+static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
+                                          struct bcmgenet_tx_ring *ring)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         int last_tx_cn, last_c_index, num_tx_bds;
         struct enet_cb *tx_cb_ptr;
         struct netdev_queue *txq;
+        unsigned int pkts_compl = 0;
         unsigned int bds_compl;
         unsigned int c_index;
 
@@ -1005,6 +1009,7 @@ static void __bcmgenet_tx_reclaim(struct net_device *dev,
                 tx_cb_ptr = ring->cbs + last_c_index;
                 bds_compl = 0;
                 if (tx_cb_ptr->skb) {
+                        pkts_compl++;
                         bds_compl = skb_shinfo(tx_cb_ptr->skb)->nr_frags + 1;
                         dev->stats.tx_bytes += tx_cb_ptr->skb->len;
                         dma_unmap_single(&dev->dev,
@@ -1028,23 +1033,45 @@ static void __bcmgenet_tx_reclaim(struct net_device *dev,
                 last_c_index &= (num_tx_bds - 1);
         }
 
-        if (ring->free_bds > (MAX_SKB_FRAGS + 1))
-                ring->int_disable(priv, ring);
-
-        if (netif_tx_queue_stopped(txq))
-                netif_tx_wake_queue(txq);
+        if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
+                if (netif_tx_queue_stopped(txq))
+                        netif_tx_wake_queue(txq);
+        }
 
         ring->c_index = c_index;
+
+        return pkts_compl;
 }
 
-static void bcmgenet_tx_reclaim(struct net_device *dev,
+static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
                                 struct bcmgenet_tx_ring *ring)
 {
+        unsigned int released;
         unsigned long flags;
 
         spin_lock_irqsave(&ring->lock, flags);
-        __bcmgenet_tx_reclaim(dev, ring);
+        released = __bcmgenet_tx_reclaim(dev, ring);
         spin_unlock_irqrestore(&ring->lock, flags);
+
+        return released;
+}
+
+static int bcmgenet_tx_poll(struct napi_struct *napi, int budget)
+{
+        struct bcmgenet_tx_ring *ring =
+                container_of(napi, struct bcmgenet_tx_ring, napi);
+        unsigned int work_done = 0;
+
+        work_done = bcmgenet_tx_reclaim(ring->priv->dev, ring);
+
+        if (work_done == 0) {
+                napi_complete(napi);
+                ring->int_enable(ring->priv, ring);
+
+                return 0;
+        }
+
+        return budget;
 }
 
 static void bcmgenet_tx_reclaim_all(struct net_device *dev)
@@ -1302,10 +1329,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
         bcmgenet_tdma_ring_writel(priv, ring->index,
                                   ring->prod_index, TDMA_PROD_INDEX);
 
-        if (ring->free_bds <= (MAX_SKB_FRAGS + 1)) {
+        if (ring->free_bds <= (MAX_SKB_FRAGS + 1))
                 netif_tx_stop_queue(txq);
-                ring->int_enable(priv, ring);
-        }
 
 out:
         spin_unlock_irqrestore(&ring->lock, flags);
@@ -1621,6 +1646,7 @@ static int init_umac(struct bcmgenet_priv *priv)
         struct device *kdev = &priv->pdev->dev;
         int ret;
         u32 reg, cpu_mask_clear;
+        int index;
 
         dev_dbg(&priv->pdev->dev, "bcmgenet: init_umac\n");
 
@@ -1647,7 +1673,7 @@ static int init_umac(struct bcmgenet_priv *priv)
 
         bcmgenet_intr_disable(priv);
 
-        cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE;
+        cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE | UMAC_IRQ_TXDMA_BDONE;
 
         dev_dbg(kdev, "%s:Enabling RXDMA_BDONE interrupt\n", __func__);
 
@@ -1674,6 +1700,10 @@ static int init_umac(struct bcmgenet_priv *priv)
 
         bcmgenet_intrl2_0_writel(priv, cpu_mask_clear, INTRL2_CPU_MASK_CLEAR);
 
+        for (index = 0; index < priv->hw_params->tx_queues; index++)
+                bcmgenet_intrl2_1_writel(priv, (1 << index),
+                                         INTRL2_CPU_MASK_CLEAR);
+
         /* Enable rx/tx engine.*/
         dev_dbg(kdev, "done init umac\n");
 
@@ -1693,6 +1723,8 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
         unsigned int first_bd;
 
         spin_lock_init(&ring->lock);
+        ring->priv = priv;
+        netif_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll, 64);
         ring->index = index;
         if (index == DESC_INDEX) {
                 ring->queue = 0;
@@ -1738,6 +1770,17 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
                                   TDMA_WRITE_PTR);
         bcmgenet_tdma_ring_writel(priv, index, end_ptr * words_per_bd - 1,
                                   DMA_END_ADDR);
+
+        napi_enable(&ring->napi);
+}
+
+static void bcmgenet_fini_tx_ring(struct bcmgenet_priv *priv,
+                                  unsigned int index)
+{
+        struct bcmgenet_tx_ring *ring = &priv->tx_rings[index];
+
+        napi_disable(&ring->napi);
+        netif_napi_del(&ring->napi);
 }
 
 /* Initialize a RDMA ring */
@@ -1907,7 +1950,7 @@ static int bcmgenet_dma_teardown(struct bcmgenet_priv *priv)
         return ret;
 }
 
-static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+static void __bcmgenet_fini_dma(struct bcmgenet_priv *priv)
 {
         int i;
 
@@ -1926,6 +1969,18 @@ static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
         kfree(priv->tx_cbs);
 }
 
+static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+{
+        int i;
+
+        bcmgenet_fini_tx_ring(priv, DESC_INDEX);
+
+        for (i = 0; i < priv->hw_params->tx_queues; i++)
+                bcmgenet_fini_tx_ring(priv, i);
+
+        __bcmgenet_fini_dma(priv);
+}
+
 /* init_edma: Initialize DMA control register */
 static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
 {
@@ -1952,7 +2007,7 @@ static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
         priv->tx_cbs = kcalloc(priv->num_tx_bds, sizeof(struct enet_cb),
                                GFP_KERNEL);
         if (!priv->tx_cbs) {
-                bcmgenet_fini_dma(priv);
+                __bcmgenet_fini_dma(priv);
                 return -ENOMEM;
         }
 
@@ -1975,9 +2030,6 @@ static int bcmgenet_poll(struct napi_struct *napi, int budget)
                         struct bcmgenet_priv, napi);
         unsigned int work_done;
 
-        /* tx reclaim */
-        bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
-
         work_done = bcmgenet_desc_rx(priv, budget);
 
         /* Advancing our consumer index*/
@@ -2022,28 +2074,34 @@ static void bcmgenet_irq_task(struct work_struct *work)
 static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
 {
         struct bcmgenet_priv *priv = dev_id;
+        struct bcmgenet_tx_ring *ring;
         unsigned int index;
 
         /* Save irq status for bottom-half processing. */
         priv->irq1_stat =
                 bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
-                ~priv->int1_mask;
+                ~bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_MASK_STATUS);
         /* clear interrupts */
         bcmgenet_intrl2_1_writel(priv, priv->irq1_stat, INTRL2_CPU_CLEAR);
 
         netif_dbg(priv, intr, priv->dev,
                   "%s: IRQ=0x%x\n", __func__, priv->irq1_stat);
+
         /* Check the MBDONE interrupts.
          * packet is done, reclaim descriptors
          */
-        if (priv->irq1_stat & 0x0000ffff) {
-                index = 0;
-                for (index = 0; index < 16; index++) {
-                        if (priv->irq1_stat & (1 << index))
-                                bcmgenet_tx_reclaim(priv->dev,
-                                                    &priv->tx_rings[index]);
+        for (index = 0; index < priv->hw_params->tx_queues; index++) {
+                if (!(priv->irq1_stat & BIT(index)))
+                        continue;
+
+                ring = &priv->tx_rings[index];
+
+                if (likely(napi_schedule_prep(&ring->napi))) {
+                        ring->int_disable(priv, ring);
+                        __napi_schedule(&ring->napi);
                 }
         }
+
         return IRQ_HANDLED;
 }
 
@@ -2075,8 +2133,12 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
         }
         if (priv->irq0_stat &
                         (UMAC_IRQ_TXDMA_BDONE | UMAC_IRQ_TXDMA_PDONE)) {
-                /* Tx reclaim */
-                bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
+                struct bcmgenet_tx_ring *ring = &priv->tx_rings[DESC_INDEX];
+
+                if (likely(napi_schedule_prep(&ring->napi))) {
+                        ring->int_disable(priv, ring);
+                        __napi_schedule(&ring->napi);
+                }
         }
         if (priv->irq0_stat & (UMAC_IRQ_PHY_DET_R |
                                 UMAC_IRQ_PHY_DET_F |
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index b36ddec0cc0a..0d370d168aee 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -520,6 +520,7 @@ struct bcmgenet_hw_params {
 
 struct bcmgenet_tx_ring {
         spinlock_t      lock;           /* ring lock */
+        struct napi_struct napi;        /* NAPI per tx queue */
         unsigned int    index;          /* ring index */
         unsigned int    queue;          /* queue index */
         struct enet_cb  *cbs;           /* tx ring buffer control block*/
@@ -534,6 +535,7 @@ struct bcmgenet_tx_ring {
                            struct bcmgenet_tx_ring *);
         void (*int_disable)(struct bcmgenet_priv *priv,
                             struct bcmgenet_tx_ring *);
+        struct bcmgenet_priv *priv;
 };
 
 /* device context */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
index 9062a8434246..c308429dd9c7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
@@ -35,10 +35,10 @@ static inline unsigned int ipv6_clip_hash(struct clip_tbl *d, const u32 *key)
 }
 
 static unsigned int clip_addr_hash(struct clip_tbl *ctbl, const u32 *addr,
-                                   int addr_len)
+                                   u8 v6)
 {
-        return addr_len == 4 ? ipv4_clip_hash(ctbl, addr) :
-                                ipv6_clip_hash(ctbl, addr);
+        return v6 ? ipv6_clip_hash(ctbl, addr) :
+                        ipv4_clip_hash(ctbl, addr);
 }
 
 static int clip6_get_mbox(const struct net_device *dev,
@@ -78,23 +78,22 @@ int cxgb4_clip_get(const struct net_device *dev, const u32 *lip, u8 v6)
         struct clip_entry *ce, *cte;
         u32 *addr = (u32 *)lip;
         int hash;
-        int addr_len;
-        int ret = 0;
+        int ret = -1;
 
         if (!ctbl)
                 return 0;
 
-        if (v6)
-                addr_len = 16;
-        else
-                addr_len = 4;
-
-        hash = clip_addr_hash(ctbl, addr, addr_len);
+        hash = clip_addr_hash(ctbl, addr, v6);
 
         read_lock_bh(&ctbl->lock);
         list_for_each_entry(cte, &ctbl->hash_list[hash], list) {
-                if (addr_len == cte->addr_len &&
-                    memcmp(lip, cte->addr, cte->addr_len) == 0) {
+                if (cte->addr6.sin6_family == AF_INET6 && v6)
+                        ret = memcmp(lip, cte->addr6.sin6_addr.s6_addr,
+                                     sizeof(struct in6_addr));
+                else if (cte->addr.sin_family == AF_INET && !v6)
+                        ret = memcmp(lip, (char *)(&cte->addr.sin_addr),
+                                     sizeof(struct in_addr));
+                if (!ret) {
                         ce = cte;
                         read_unlock_bh(&ctbl->lock);
                         goto found;
@@ -111,15 +110,20 @@ int cxgb4_clip_get(const struct net_device *dev, const u32 *lip, u8 v6)
                 spin_lock_init(&ce->lock);
                 atomic_set(&ce->refcnt, 0);
                 atomic_dec(&ctbl->nfree);
-                ce->addr_len = addr_len;
-                memcpy(ce->addr, lip, addr_len);
                 list_add_tail(&ce->list, &ctbl->hash_list[hash]);
                 if (v6) {
+                        ce->addr6.sin6_family = AF_INET6;
+                        memcpy(ce->addr6.sin6_addr.s6_addr,
+                               lip, sizeof(struct in6_addr));
                         ret = clip6_get_mbox(dev, (const struct in6_addr *)lip);
                         if (ret) {
                                 write_unlock_bh(&ctbl->lock);
                                 return ret;
                         }
+                } else {
+                        ce->addr.sin_family = AF_INET;
+                        memcpy((char *)(&ce->addr.sin_addr), lip,
+                               sizeof(struct in_addr));
                 }
         } else {
                 write_unlock_bh(&ctbl->lock);
@@ -140,19 +144,19 @@ void cxgb4_clip_release(const struct net_device *dev, const u32 *lip, u8 v6)
         struct clip_entry *ce, *cte;
         u32 *addr = (u32 *)lip;
         int hash;
-        int addr_len;
-
-        if (v6)
-                addr_len = 16;
-        else
-                addr_len = 4;
+        int ret = -1;
 
-        hash = clip_addr_hash(ctbl, addr, addr_len);
+        hash = clip_addr_hash(ctbl, addr, v6);
 
         read_lock_bh(&ctbl->lock);
         list_for_each_entry(cte, &ctbl->hash_list[hash], list) {
-                if (addr_len == cte->addr_len &&
-                    memcmp(lip, cte->addr, cte->addr_len) == 0) {
+                if (cte->addr6.sin6_family == AF_INET6 && v6)
+                        ret = memcmp(lip, cte->addr6.sin6_addr.s6_addr,
+                                     sizeof(struct in6_addr));
+                else if (cte->addr.sin_family == AF_INET && !v6)
+                        ret = memcmp(lip, (char *)(&cte->addr.sin_addr),
+                                     sizeof(struct in_addr));
+                if (!ret) {
                         ce = cte;
                         read_unlock_bh(&ctbl->lock);
                         goto found;
@@ -249,10 +253,7 @@ int clip_tbl_show(struct seq_file *seq, void *v)
         for (i = 0 ; i < ctbl->clipt_size;  ++i) {
                 list_for_each_entry(ce, &ctbl->hash_list[i], list) {
                         ip[0] = '\0';
-                        if (ce->addr_len == 16)
-                                sprintf(ip, "%pI6c", ce->addr);
-                        else
-                                sprintf(ip, "%pI4c", ce->addr);
+                        sprintf(ip, "%pISc", &ce->addr);
                         seq_printf(seq, "%-25s   %u\n", ip,
                                    atomic_read(&ce->refcnt));
                 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h
index 2eaba0161cf8..35eb43c6bcbb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h
@@ -14,8 +14,10 @@ struct clip_entry {
         spinlock_t lock;        /* Hold while modifying clip reference */
         atomic_t refcnt;
         struct list_head list;
-        u32 addr[4];
-        int addr_len;
+        union {
+                struct sockaddr_in addr;
+                struct sockaddr_in6 addr6;
+        };
 };
 
 struct clip_tbl {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index d6cda17efe6e..97842d03675b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -1103,7 +1103,7 @@ int t4_restart_aneg(struct adapter *adap, unsigned int mbox, unsigned int port);
 #define T4_MEMORY_WRITE 0
 #define T4_MEMORY_READ  1
 int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr, u32 len,
-                 __be32 *buf, int dir);
+                 void *buf, int dir);
 static inline int t4_memory_write(struct adapter *adap, int mtype, u32 addr,
                                   u32 len, __be32 *buf)
 {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4d643b65265e..853c38997c82 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -449,7 +449,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
  *      @mtype: memory type: MEM_EDC0, MEM_EDC1 or MEM_MC
  *      @addr: address within indicated memory type
  *      @len: amount of memory to transfer
- *      @buf: host memory buffer
+ *      @hbuf: host memory buffer
  *      @dir: direction of transfer T4_MEMORY_READ (1) or T4_MEMORY_WRITE (0)
  *
  *      Reads/writes an [almost] arbitrary memory region in the firmware: the
@@ -460,15 +460,17 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
  *      caller's responsibility to perform appropriate byte order conversions.
  */
 int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
-                 u32 len, __be32 *buf, int dir)
+                 u32 len, void *hbuf, int dir)
 {
         u32 pos, offset, resid, memoffset;
         u32 edc_size, mc_size, win_pf, mem_reg, mem_aperture, mem_base;
+        u32 *buf;
 
         /* Argument sanity checks ...
          */
-        if (addr & 0x3)
+        if (addr & 0x3 || (uintptr_t)hbuf & 0x3)
                 return -EINVAL;
+        buf = (u32 *)hbuf;
 
         /* It's convenient to be able to handle lengths which aren't a
          * multiple of 32-bits because we often end up transferring files to
@@ -532,14 +534,45 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
 
         /* Transfer data to/from the adapter as long as there's an integral
          * number of 32-bit transfers to complete.
+         *
+         * A note on Endianness issues:
+         *
+         * The "register" reads and writes below from/to the PCI-E Memory
+         * Window invoke the standard adapter Big-Endian to PCI-E Link
+         * Little-Endian "swizzel."  As a result, if we have the following
+         * data in adapter memory:
+         *
+         *     Memory:  ... | b0 | b1 | b2 | b3 | ...
+         *     Address:      i+0  i+1  i+2  i+3
+         *
+         * Then a read of the adapter memory via the PCI-E Memory Window
+         * will yield:
+         *
+         *     x = readl(i)
+         *         31                  0
+         *         [ b3 | b2 | b1 | b0 ]
+         *
+         * If this value is stored into local memory on a Little-Endian system
+         * it will show up correctly in local memory as:
+         *
+         *     ( ..., b0, b1, b2, b3, ... )
+         *
+         * But on a Big-Endian system, the store will show up in memory
+         * incorrectly swizzled as:
+         *
+         *     ( ..., b3, b2, b1, b0, ... )
+         *
+         * So we need to account for this in the reads and writes to the
+         * PCI-E Memory Window below by undoing the register read/write
+         * swizzels.
          */
         while (len > 0) {
                 if (dir == T4_MEMORY_READ)
-                        *buf++ = (__force __be32) t4_read_reg(adap,
-                                                        mem_base + offset);
+                        *buf++ = le32_to_cpu((__force __le32)t4_read_reg(adap,
+                                                mem_base + offset));
                 else
                         t4_write_reg(adap, mem_base + offset,
-                                     (__force u32) *buf++);
+                                     (__force u32)cpu_to_le32(*buf++));
                 offset += sizeof(__be32);
                 len -= sizeof(__be32);
 
@@ -568,15 +601,16 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
          */
         if (resid) {
                 union {
-                        __be32 word;
+                        u32 word;
                         char byte[4];
                 } last;
                 unsigned char *bp;
                 int i;
 
                 if (dir == T4_MEMORY_READ) {
-                        last.word = (__force __be32) t4_read_reg(adap,
-                                                        mem_base + offset);
+                        last.word = le32_to_cpu(
+                                        (__force __le32)t4_read_reg(adap,
+                                                mem_base + offset));
                         for (bp = (unsigned char *)buf, i = resid; i < 4; i++)
                                 bp[i] = last.byte[i];
                 } else {
@@ -584,7 +618,7 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
                         for (i = resid; i < 4; i++)
                                 last.byte[i] = 0;
                         t4_write_reg(adap, mem_base + offset,
-                                     (__force u32) last.word);
+                                     (__force u32)cpu_to_le32(last.word));
                 }
         }
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 9cbe038a388e..a5179bfcdc2c 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -272,8 +272,8 @@ static irqreturn_t enic_isr_legacy(int irq, void *data)
         }
 
         if (ENIC_TEST_INTR(pba, notify_intr)) {
-                vnic_intr_return_all_credits(&enic->intr[notify_intr]);
                 enic_notify_check(enic);
+                vnic_intr_return_all_credits(&enic->intr[notify_intr]);
         }
 
         if (ENIC_TEST_INTR(pba, err_intr)) {
@@ -346,8 +346,8 @@ static irqreturn_t enic_isr_msix_notify(int irq, void *data)
         struct enic *enic = data;
         unsigned int intr = enic_msix_notify_intr(enic);
 
-        vnic_intr_return_all_credits(&enic->intr[intr]);
         enic_notify_check(enic);
+        vnic_intr_return_all_credits(&enic->intr[intr]);
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 43df78882e48..178e54028d10 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -3162,8 +3162,8 @@ static void adjust_link(struct net_device *dev)
         struct phy_device *phydev = priv->phydev;
 
         if (unlikely(phydev->link != priv->oldlink ||
-                     phydev->duplex != priv->oldduplex ||
-                     phydev->speed != priv->oldspeed))
+                     (phydev->link && (phydev->duplex != priv->oldduplex ||
+                                       phydev->speed != priv->oldspeed))))
                 gfar_update_link_state(priv);
 }
 
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index e8a1adb7a962..c05e50759621 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -3262,6 +3262,139 @@ static void ehea_remove_device_sysfs(struct platform_device *dev)
         device_remove_file(&dev->dev, &dev_attr_remove_port);
 }
 
+static int ehea_reboot_notifier(struct notifier_block *nb,
+                                unsigned long action, void *unused)
+{
+        if (action == SYS_RESTART) {
+                pr_info("Reboot: freeing all eHEA resources\n");
+                ibmebus_unregister_driver(&ehea_driver);
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block ehea_reboot_nb = {
+        .notifier_call = ehea_reboot_notifier,
+};
+
+static int ehea_mem_notifier(struct notifier_block *nb,
+                             unsigned long action, void *data)
+{
+        int ret = NOTIFY_BAD;
+        struct memory_notify *arg = data;
+
+        mutex_lock(&dlpar_mem_lock);
+
+        switch (action) {
+        case MEM_CANCEL_OFFLINE:
+                pr_info("memory offlining canceled");
+                /* Fall through: re-add canceled memory block */
+
+        case MEM_ONLINE:
+                pr_info("memory is going online");
+                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
+                if (ehea_add_sect_bmap(arg->start_pfn, arg->nr_pages))
+                        goto out_unlock;
+                ehea_rereg_mrs();
+                break;
+
+        case MEM_GOING_OFFLINE:
+                pr_info("memory is going offline");
+                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
+                if (ehea_rem_sect_bmap(arg->start_pfn, arg->nr_pages))
+                        goto out_unlock;
+                ehea_rereg_mrs();
+                break;
+
+        default:
+                break;
+        }
+
+        ehea_update_firmware_handles();
+        ret = NOTIFY_OK;
+
+out_unlock:
+        mutex_unlock(&dlpar_mem_lock);
+        return ret;
+}
+
+static struct notifier_block ehea_mem_nb = {
+        .notifier_call = ehea_mem_notifier,
+};
+
+static void ehea_crash_handler(void)
+{
+        int i;
+
+        if (ehea_fw_handles.arr)
+                for (i = 0; i < ehea_fw_handles.num_entries; i++)
+                        ehea_h_free_resource(ehea_fw_handles.arr[i].adh,
+                                             ehea_fw_handles.arr[i].fwh,
+                                             FORCE_FREE);
+
+        if (ehea_bcmc_regs.arr)
+                for (i = 0; i < ehea_bcmc_regs.num_entries; i++)
+                        ehea_h_reg_dereg_bcmc(ehea_bcmc_regs.arr[i].adh,
+                                              ehea_bcmc_regs.arr[i].port_id,
+                                              ehea_bcmc_regs.arr[i].reg_type,
+                                              ehea_bcmc_regs.arr[i].macaddr,
+                                              0, H_DEREG_BCMC);
+}
+
+static atomic_t ehea_memory_hooks_registered;
+
+/* Register memory hooks on probe of first adapter */
+static int ehea_register_memory_hooks(void)
+{
+        int ret = 0;
+
+        if (atomic_inc_and_test(&ehea_memory_hooks_registered))
+                return 0;
+
+        ret = ehea_create_busmap();
+        if (ret) {
+                pr_info("ehea_create_busmap failed\n");
+                goto out;
+        }
+
+        ret = register_reboot_notifier(&ehea_reboot_nb);
+        if (ret) {
+                pr_info("register_reboot_notifier failed\n");
+                goto out;
+        }
+
+        ret = register_memory_notifier(&ehea_mem_nb);
+        if (ret) {
+                pr_info("register_memory_notifier failed\n");
+                goto out2;
+        }
+
+        ret = crash_shutdown_register(ehea_crash_handler);
+        if (ret) {
+                pr_info("crash_shutdown_register failed\n");
+                goto out3;
+        }
+
+        return 0;
+
+out3:
+        unregister_memory_notifier(&ehea_mem_nb);
+out2:
+        unregister_reboot_notifier(&ehea_reboot_nb);
+out:
+        return ret;
+}
+
+static void ehea_unregister_memory_hooks(void)
+{
+        if (atomic_read(&ehea_memory_hooks_registered))
+                return;
+
+        unregister_reboot_notifier(&ehea_reboot_nb);
+        if (crash_shutdown_unregister(ehea_crash_handler))
+                pr_info("failed unregistering crash handler\n");
+        unregister_memory_notifier(&ehea_mem_nb);
+}
+
 static int ehea_probe_adapter(struct platform_device *dev)
 {
         struct ehea_adapter *adapter;
@@ -3269,6 +3402,10 @@ static int ehea_probe_adapter(struct platform_device *dev)
         int ret;
         int i;
 
+        ret = ehea_register_memory_hooks();
+        if (ret)
+                return ret;
+
         if (!dev || !dev->dev.of_node) {
                 pr_err("Invalid ibmebus device probed\n");
                 return -EINVAL;
@@ -3392,81 +3529,6 @@ static int ehea_remove(struct platform_device *dev)
         return 0;
 }
 
-static void ehea_crash_handler(void)
-{
-        int i;
-
-        if (ehea_fw_handles.arr)
-                for (i = 0; i < ehea_fw_handles.num_entries; i++)
-                        ehea_h_free_resource(ehea_fw_handles.arr[i].adh,
-                                             ehea_fw_handles.arr[i].fwh,
-                                             FORCE_FREE);
-
-        if (ehea_bcmc_regs.arr)
-                for (i = 0; i < ehea_bcmc_regs.num_entries; i++)
-                        ehea_h_reg_dereg_bcmc(ehea_bcmc_regs.arr[i].adh,
-                                              ehea_bcmc_regs.arr[i].port_id,
-                                              ehea_bcmc_regs.arr[i].reg_type,
-                                              ehea_bcmc_regs.arr[i].macaddr,
-                                              0, H_DEREG_BCMC);
-}
-
-static int ehea_mem_notifier(struct notifier_block *nb,
-                             unsigned long action, void *data)
-{
-        int ret = NOTIFY_BAD;
-        struct memory_notify *arg = data;
-
-        mutex_lock(&dlpar_mem_lock);
-
-        switch (action) {
-        case MEM_CANCEL_OFFLINE:
-                pr_info("memory offlining canceled");
-                /* Readd canceled memory block */
-        case MEM_ONLINE:
-                pr_info("memory is going online");
-                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
-                if (ehea_add_sect_bmap(arg->start_pfn, arg->nr_pages))
-                        goto out_unlock;
-                ehea_rereg_mrs();
-                break;
-        case MEM_GOING_OFFLINE:
-                pr_info("memory is going offline");
-                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
-                if (ehea_rem_sect_bmap(arg->start_pfn, arg->nr_pages))
-                        goto out_unlock;
-                ehea_rereg_mrs();
-                break;
-        default:
-                break;
-        }
-
-        ehea_update_firmware_handles();
-        ret = NOTIFY_OK;
-
-out_unlock:
-        mutex_unlock(&dlpar_mem_lock);
-        return ret;
-}
-
-static struct notifier_block ehea_mem_nb = {
-        .notifier_call = ehea_mem_notifier,
-};
-
-static int ehea_reboot_notifier(struct notifier_block *nb,
-                                unsigned long action, void *unused)
-{
-        if (action == SYS_RESTART) {
-                pr_info("Reboot: freeing all eHEA resources\n");
-                ibmebus_unregister_driver(&ehea_driver);
-        }
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block ehea_reboot_nb = {
-        .notifier_call = ehea_reboot_notifier,
-};
-
 static int check_module_parm(void)
 {
         int ret = 0;
@@ -3520,26 +3582,10 @@ static int __init ehea_module_init(void)
         if (ret)
                 goto out;
 
-        ret = ehea_create_busmap();
-        if (ret)
-                goto out;
-
-        ret = register_reboot_notifier(&ehea_reboot_nb);
-        if (ret)
-                pr_info("failed registering reboot notifier\n");
-
-        ret = register_memory_notifier(&ehea_mem_nb);
-        if (ret)
-                pr_info("failed registering memory remove notifier\n");
-
-        ret = crash_shutdown_register(ehea_crash_handler);
-        if (ret)
-                pr_info("failed registering crash handler\n");
-
         ret = ibmebus_register_driver(&ehea_driver);
         if (ret) {
                 pr_err("failed registering eHEA device driver on ebus\n");
-                goto out2;
+                goto out;
         }
 
         ret = driver_create_file(&ehea_driver.driver,
@@ -3547,32 +3593,22 @@ static int __init ehea_module_init(void)
         if (ret) {
                 pr_err("failed to register capabilities attribute, ret=%d\n",
                        ret);
-                goto out3;
+                goto out2;
         }
 
         return ret;
 
-out3:
-        ibmebus_unregister_driver(&ehea_driver);
 out2:
-        unregister_memory_notifier(&ehea_mem_nb);
-        unregister_reboot_notifier(&ehea_reboot_nb);
-        crash_shutdown_unregister(ehea_crash_handler);
+        ibmebus_unregister_driver(&ehea_driver);
 out:
         return ret;
 }
 
 static void __exit ehea_module_exit(void)
 {
-        int ret;
-
         driver_remove_file(&ehea_driver.driver, &driver_attr_capabilities);
         ibmebus_unregister_driver(&ehea_driver);
-        unregister_reboot_notifier(&ehea_reboot_nb);
-        ret = crash_shutdown_unregister(ehea_crash_handler);
-        if (ret)
-                pr_info("failed unregistering crash handler\n");
-        unregister_memory_notifier(&ehea_mem_nb);
+        ehea_unregister_memory_hooks();
         kfree(ehea_fw_handles.arr);
         kfree(ehea_bcmc_regs.arr);
         ehea_destroy_busmap();
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 21978cc019e7..072426a72745 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1327,6 +1327,28 @@ static unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev)
         return ret;
 }
 
+static int ibmveth_set_mac_addr(struct net_device *dev, void *p)
+{
+        struct ibmveth_adapter *adapter = netdev_priv(dev);
+        struct sockaddr *addr = p;
+        u64 mac_address;
+        int rc;
+
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        mac_address = ibmveth_encode_mac_addr(addr->sa_data);
+        rc = h_change_logical_lan_mac(adapter->vdev->unit_address, mac_address);
+        if (rc) {
+                netdev_err(adapter->netdev, "h_change_logical_lan_mac failed with rc=%d\n", rc);
+                return rc;
+        }
+
+        ether_addr_copy(dev->dev_addr, addr->sa_data);
+
+        return 0;
+}
+
 static const struct net_device_ops ibmveth_netdev_ops = {
         .ndo_open               = ibmveth_open,
         .ndo_stop               = ibmveth_close,
@@ -1337,7 +1359,7 @@ static const struct net_device_ops ibmveth_netdev_ops = {
         .ndo_fix_features       = ibmveth_fix_features,
         .ndo_set_features       = ibmveth_set_features,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = ibmveth_set_mac_addr,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ibmveth_poll_controller,
 #endif
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index 11a9ffebf8d8..6aea65dae5ed 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -868,8 +868,9 @@ i40e_status i40e_pf_reset(struct i40e_hw *hw)
          * The grst delay value is in 100ms units, and we'll wait a
          * couple counts longer to be sure we don't just miss the end.
          */
-        grst_del = rd32(hw, I40E_GLGEN_RSTCTL) & I40E_GLGEN_RSTCTL_GRSTDEL_MASK
-                        >> I40E_GLGEN_RSTCTL_GRSTDEL_SHIFT;
+        grst_del = (rd32(hw, I40E_GLGEN_RSTCTL) &
+                    I40E_GLGEN_RSTCTL_GRSTDEL_MASK) >>
+                    I40E_GLGEN_RSTCTL_GRSTDEL_SHIFT;
         for (cnt = 0; cnt < grst_del + 2; cnt++) {
                 reg = rd32(hw, I40E_GLGEN_RSTAT);
                 if (!(reg & I40E_GLGEN_RSTAT_DEVSTATE_MASK))
@@ -2846,7 +2847,7 @@ i40e_status i40e_aq_add_udp_tunnel(struct i40e_hw *hw,
 
         status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details);
 
-        if (!status)
+        if (!status && filter_index)
                 *filter_index = resp->index;
 
         return status;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c b/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
index 183dcb63ce98..a11c70ca5a28 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
@@ -40,7 +40,7 @@ static void i40e_get_pfc_delay(struct i40e_hw *hw, u16 *delay)
         u32 val;
 
         val = rd32(hw, I40E_PRTDCB_GENC);
-        *delay = (u16)(val & I40E_PRTDCB_GENC_PFCLDA_MASK >>
+        *delay = (u16)((val & I40E_PRTDCB_GENC_PFCLDA_MASK) >>
                        I40E_PRTDCB_GENC_PFCLDA_SHIFT);
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 61236f983971..c17ee77100d3 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -989,8 +989,10 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
         if (!cmd_buf)
                 return count;
         bytes_not_copied = copy_from_user(cmd_buf, buffer, count);
-        if (bytes_not_copied < 0)
+        if (bytes_not_copied < 0) {
+                kfree(cmd_buf);
                 return bytes_not_copied;
+        }
         if (bytes_not_copied > 0)
                 count -= bytes_not_copied;
         cmd_buf[count] = '\0';
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index cbe281be1c9f..dadda3c5d658 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1512,7 +1512,12 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
         vsi->tc_config.numtc = numtc;
         vsi->tc_config.enabled_tc = enabled_tc ? enabled_tc : 1;
         /* Number of queues per enabled TC */
-        num_tc_qps = vsi->alloc_queue_pairs/numtc;
+        /* In MFP case we can have a much lower count of MSIx
+         * vectors available and so we need to lower the used
+         * q count.
+         */
+        qcount = min_t(int, vsi->alloc_queue_pairs, pf->num_lan_msix);
+        num_tc_qps = qcount / numtc;
         num_tc_qps = min_t(int, num_tc_qps, I40E_MAX_QUEUES_PER_TC);
 
         /* Setup queue offset/count for all TCs for given VSI */
@@ -2684,8 +2689,15 @@ static void i40e_vsi_config_dcb_rings(struct i40e_vsi *vsi)
         u16 qoffset, qcount;
         int i, n;
 
-        if (!(vsi->back->flags & I40E_FLAG_DCB_ENABLED))
-                return;
+        if (!(vsi->back->flags & I40E_FLAG_DCB_ENABLED)) {
+                /* Reset the TC information */
+                for (i = 0; i < vsi->num_queue_pairs; i++) {
+                        rx_ring = vsi->rx_rings[i];
+                        tx_ring = vsi->tx_rings[i];
+                        rx_ring->dcb_tc = 0;
+                        tx_ring->dcb_tc = 0;
+                }
+        }
 
         for (n = 0; n < I40E_MAX_TRAFFIC_CLASS; n++) {
                 if (!(vsi->tc_config.enabled_tc & (1 << n)))
@@ -3830,6 +3842,12 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf)
 {
         int i;
 
+        i40e_stop_misc_vector(pf);
+        if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
+                synchronize_irq(pf->msix_entries[0].vector);
+                free_irq(pf->msix_entries[0].vector, pf);
+        }
+
         i40e_put_lump(pf->irq_pile, 0, I40E_PILE_VALID_BIT-1);
         for (i = 0; i < pf->num_alloc_vsi; i++)
                 if (pf->vsi[i])
@@ -5254,8 +5272,14 @@ static int i40e_handle_lldp_event(struct i40e_pf *pf,
 
         /* Wait for the PF's Tx queues to be disabled */
         ret = i40e_pf_wait_txq_disabled(pf);
-        if (!ret)
+        if (ret) {
+                /* Schedule PF reset to recover */
+                set_bit(__I40E_PF_RESET_REQUESTED, &pf->state);
+                i40e_service_event_schedule(pf);
+        } else {
                 i40e_pf_unquiesce_all_vsi(pf);
+        }
+
 exit:
         return ret;
 }
@@ -5587,7 +5611,8 @@ static void i40e_check_hang_subtask(struct i40e_pf *pf)
         int i, v;
 
         /* If we're down or resetting, just bail */
-        if (test_bit(__I40E_CONFIG_BUSY, &pf->state))
+        if (test_bit(__I40E_DOWN, &pf->state) ||
+            test_bit(__I40E_CONFIG_BUSY, &pf->state))
                 return;
 
         /* for each VSI/netdev
@@ -9533,6 +9558,7 @@ static void i40e_remove(struct pci_dev *pdev)
         set_bit(__I40E_DOWN, &pf->state);
         del_timer_sync(&pf->service_timer);
         cancel_work_sync(&pf->service_task);
+        i40e_fdir_teardown(pf);
 
         if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
                 i40e_free_vfs(pf);
@@ -9559,12 +9585,6 @@ static void i40e_remove(struct pci_dev *pdev)
         if (pf->vsi[pf->lan_vsi])
                 i40e_vsi_release(pf->vsi[pf->lan_vsi]);
 
-        i40e_stop_misc_vector(pf);
-        if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
-                synchronize_irq(pf->msix_entries[0].vector);
-                free_irq(pf->msix_entries[0].vector, pf);
-        }
-
         /* shutdown and destroy the HMC */
         if (pf->hw.hmc.hmc_obj) {
                 ret_code = i40e_shutdown_lan_hmc(&pf->hw);
@@ -9718,6 +9738,8 @@ static void i40e_shutdown(struct pci_dev *pdev)
         wr32(hw, I40E_PFPM_APM, (pf->wol_en ? I40E_PFPM_APM_APME_MASK : 0));
         wr32(hw, I40E_PFPM_WUFC, (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0));
 
+        i40e_clear_interrupt_scheme(pf);
+
         if (system_state == SYSTEM_POWER_OFF) {
                 pci_wake_from_d3(pdev, pf->wol_en);
                 pci_set_power_state(pdev, PCI_D3hot);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index 3e70f2e45a47..5defe0d63514 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -679,9 +679,11 @@ static i40e_status i40e_nvmupd_state_writing(struct i40e_hw *hw,
 {
         i40e_status status;
         enum i40e_nvmupd_cmd upd_cmd;
+        bool retry_attempt = false;
 
         upd_cmd = i40e_nvmupd_validate_command(hw, cmd, errno);
 
+retry:
         switch (upd_cmd) {
         case I40E_NVMUPD_WRITE_CON:
                 status = i40e_nvmupd_nvm_write(hw, cmd, bytes, errno);
@@ -725,6 +727,39 @@ static i40e_status i40e_nvmupd_state_writing(struct i40e_hw *hw,
                 *errno = -ESRCH;
                 break;
         }
+
+        /* In some circumstances, a multi-write transaction takes longer
+         * than the default 3 minute timeout on the write semaphore.  If
+         * the write failed with an EBUSY status, this is likely the problem,
+         * so here we try to reacquire the semaphore then retry the write.
+         * We only do one retry, then give up.
+         */
+        if (status && (hw->aq.asq_last_status == I40E_AQ_RC_EBUSY) &&
+            !retry_attempt) {
+                i40e_status old_status = status;
+                u32 old_asq_status = hw->aq.asq_last_status;
+                u32 gtime;
+
+                gtime = rd32(hw, I40E_GLVFGEN_TIMER);
+                if (gtime >= hw->nvm.hw_semaphore_timeout) {
+                        i40e_debug(hw, I40E_DEBUG_ALL,
+                                   "NVMUPD: write semaphore expired (%d >= %lld), retrying\n",
+                                   gtime, hw->nvm.hw_semaphore_timeout);
+                        i40e_release_nvm(hw);
+                        status = i40e_acquire_nvm(hw, I40E_RESOURCE_WRITE);
+                        if (status) {
+                                i40e_debug(hw, I40E_DEBUG_ALL,
+                                           "NVMUPD: write semaphore reacquire failed aq_err = %d\n",
+                                           hw->aq.asq_last_status);
+                                status = old_status;
+                                hw->aq.asq_last_status = old_asq_status;
+                        } else {
+                                retry_attempt = true;
+                                goto retry;
+                        }
+                }
+        }
+
         return status;
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 2206d2d36f0f..bbf1b1247ac4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -586,6 +586,20 @@ void i40e_free_tx_resources(struct i40e_ring *tx_ring)
 }
 
 /**
+ * i40e_get_head - Retrieve head from head writeback
+ * @tx_ring:  tx ring to fetch head of
+ *
+ * Returns value of Tx ring head based on value stored
+ * in head write-back location
+ **/
+static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
+{
+        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
+
+        return le32_to_cpu(*(volatile __le32 *)head);
+}
+
+/**
  * i40e_get_tx_pending - how many tx descriptors not processed
  * @tx_ring: the ring of descriptors
  *
@@ -594,10 +608,16 @@ void i40e_free_tx_resources(struct i40e_ring *tx_ring)
  **/
 static u32 i40e_get_tx_pending(struct i40e_ring *ring)
 {
-        u32 ntu = ((ring->next_to_clean <= ring->next_to_use)
-                        ? ring->next_to_use
-                        : ring->next_to_use + ring->count);
-        return ntu - ring->next_to_clean;
+        u32 head, tail;
+
+        head = i40e_get_head(ring);
+        tail = readl(ring->tail);
+
+        if (head != tail)
+                return (head < tail) ?
+                        tail - head : (tail + ring->count - head);
+
+        return 0;
 }
 
 /**
@@ -606,6 +626,8 @@ static u32 i40e_get_tx_pending(struct i40e_ring *ring)
  **/
 static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
 {
+        u32 tx_done = tx_ring->stats.packets;
+        u32 tx_done_old = tx_ring->tx_stats.tx_done_old;
         u32 tx_pending = i40e_get_tx_pending(tx_ring);
         struct i40e_pf *pf = tx_ring->vsi->back;
         bool ret = false;
@@ -623,41 +645,25 @@ static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
          * run the check_tx_hang logic with a transmit completion
          * pending but without time to complete it yet.
          */
-        if ((tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) &&
-            (tx_pending >= I40E_MIN_DESC_PENDING)) {
+        if ((tx_done_old == tx_done) && tx_pending) {
                 /* make sure it is true for two checks in a row */
                 ret = test_and_set_bit(__I40E_HANG_CHECK_ARMED,
                                        &tx_ring->state);
-        } else if ((tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) &&
-                   (tx_pending < I40E_MIN_DESC_PENDING) &&
-                   (tx_pending > 0)) {
+        } else if (tx_done_old == tx_done &&
+                   (tx_pending < I40E_MIN_DESC_PENDING) && (tx_pending > 0)) {
                 if (I40E_DEBUG_FLOW & pf->hw.debug_mask)
                         dev_info(tx_ring->dev, "HW needs some more descs to do a cacheline flush. tx_pending %d, queue %d",
                                  tx_pending, tx_ring->queue_index);
                 pf->tx_sluggish_count++;
         } else {
                 /* update completed stats and disarm the hang check */
-                tx_ring->tx_stats.tx_done_old = tx_ring->stats.packets;
+                tx_ring->tx_stats.tx_done_old = tx_done;
                 clear_bit(__I40E_HANG_CHECK_ARMED, &tx_ring->state);
         }
 
         return ret;
 }
 
-/**
- * i40e_get_head - Retrieve head from head writeback
- * @tx_ring:  tx ring to fetch head of
- *
- * Returns value of Tx ring head based on value stored
- * in head write-back location
- **/
-static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
-{
-        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
-
-        return le32_to_cpu(*(volatile __le32 *)head);
-}
-
 #define WB_STRIDE 0x3
 
 /**
@@ -2140,6 +2146,67 @@ static int i40e_maybe_stop_tx(struct i40e_ring *tx_ring, int size)
 }
 
 /**
+ * i40e_chk_linearize - Check if there are more than 8 fragments per packet
+ * @skb:      send buffer
+ * @tx_flags: collected send information
+ * @hdr_len:  size of the packet header
+ *
+ * Note: Our HW can't scatter-gather more than 8 fragments to build
+ * a packet on the wire and so we need to figure out the cases where we
+ * need to linearize the skb.
+ **/
+static bool i40e_chk_linearize(struct sk_buff *skb, u32 tx_flags,
+                               const u8 hdr_len)
+{
+        struct skb_frag_struct *frag;
+        bool linearize = false;
+        unsigned int size = 0;
+        u16 num_frags;
+        u16 gso_segs;
+
+        num_frags = skb_shinfo(skb)->nr_frags;
+        gso_segs = skb_shinfo(skb)->gso_segs;
+
+        if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO)) {
+                u16 j = 1;
+
+                if (num_frags < (I40E_MAX_BUFFER_TXD))
+                        goto linearize_chk_done;
+                /* try the simple math, if we have too many frags per segment */
+                if (DIV_ROUND_UP((num_frags + gso_segs), gso_segs) >
+                    I40E_MAX_BUFFER_TXD) {
+                        linearize = true;
+                        goto linearize_chk_done;
+                }
+                frag = &skb_shinfo(skb)->frags[0];
+                size = hdr_len;
+                /* we might still have more fragments per segment */
+                do {
+                        size += skb_frag_size(frag);
+                        frag++; j++;
+                        if (j == I40E_MAX_BUFFER_TXD) {
+                                if (size < skb_shinfo(skb)->gso_size) {
+                                        linearize = true;
+                                        break;
+                                }
+                                j = 1;
+                                size -= skb_shinfo(skb)->gso_size;
+                                if (size)
+                                        j++;
+                                size += hdr_len;
+                        }
+                        num_frags--;
+                } while (num_frags);
+        } else {
+                if (num_frags >= I40E_MAX_BUFFER_TXD)
+                        linearize = true;
+        }
+
+linearize_chk_done:
+        return linearize;
+}
+
+/**
  * i40e_tx_map - Build the Tx descriptor
  * @tx_ring:  ring to send buffer on
  * @skb:      send buffer
@@ -2396,6 +2463,10 @@ static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
         if (tsyn)
                 tx_flags |= I40E_TX_FLAGS_TSYN;
 
+        if (i40e_chk_linearize(skb, tx_flags, hdr_len))
+                if (skb_linearize(skb))
+                        goto out_drop;
+
         skb_tx_timestamp(skb);
 
         /* always enable CRC insertion offload */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
index 18b00231d2f1..dff0baeb1ecc 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
@@ -112,6 +112,7 @@ enum i40e_dyn_idx_t {
 
 #define i40e_rx_desc i40e_32byte_rx_desc
 
+#define I40E_MAX_BUFFER_TXD     8
 #define I40E_MIN_TX_LEN         17
 #define I40E_MAX_DATA_PER_TXD   8192
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index 29004382f462..708891571dae 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -126,6 +126,20 @@ void i40evf_free_tx_resources(struct i40e_ring *tx_ring)
 }
 
 /**
+ * i40e_get_head - Retrieve head from head writeback
+ * @tx_ring:  tx ring to fetch head of
+ *
+ * Returns value of Tx ring head based on value stored
+ * in head write-back location
+ **/
+static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
+{
+        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
+
+        return le32_to_cpu(*(volatile __le32 *)head);
+}
+
+/**
  * i40e_get_tx_pending - how many tx descriptors not processed
  * @tx_ring: the ring of descriptors
  *
@@ -134,10 +148,16 @@ void i40evf_free_tx_resources(struct i40e_ring *tx_ring)
  **/
 static u32 i40e_get_tx_pending(struct i40e_ring *ring)
 {
-        u32 ntu = ((ring->next_to_clean <= ring->next_to_use)
-                        ? ring->next_to_use
-                        : ring->next_to_use + ring->count);
-        return ntu - ring->next_to_clean;
+        u32 head, tail;
+
+        head = i40e_get_head(ring);
+        tail = readl(ring->tail);
+
+        if (head != tail)
+                return (head < tail) ?
+                        tail - head : (tail + ring->count - head);
+
+        return 0;
 }
 
 /**
@@ -146,6 +166,8 @@ static u32 i40e_get_tx_pending(struct i40e_ring *ring)
  **/
 static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
 {
+        u32 tx_done = tx_ring->stats.packets;
+        u32 tx_done_old = tx_ring->tx_stats.tx_done_old;
         u32 tx_pending = i40e_get_tx_pending(tx_ring);
         bool ret = false;
 
@@ -162,36 +184,20 @@ static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
          * run the check_tx_hang logic with a transmit completion
          * pending but without time to complete it yet.
          */
-        if ((tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) &&
-            (tx_pending >= I40E_MIN_DESC_PENDING)) {
+        if ((tx_done_old == tx_done) && tx_pending) {
                 /* make sure it is true for two checks in a row */
                 ret = test_and_set_bit(__I40E_HANG_CHECK_ARMED,
                                        &tx_ring->state);
-        } else if (!(tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) ||
-                   !(tx_pending < I40E_MIN_DESC_PENDING) ||
-                   !(tx_pending > 0)) {
+        } else if (tx_done_old == tx_done &&
+                   (tx_pending < I40E_MIN_DESC_PENDING) && (tx_pending > 0)) {
                 /* update completed stats and disarm the hang check */
-                tx_ring->tx_stats.tx_done_old = tx_ring->stats.packets;
+                tx_ring->tx_stats.tx_done_old = tx_done;
                 clear_bit(__I40E_HANG_CHECK_ARMED, &tx_ring->state);
         }
 
         return ret;
 }
 
-/**
- * i40e_get_head - Retrieve head from head writeback
- * @tx_ring:  tx ring to fetch head of
- *
- * Returns value of Tx ring head based on value stored
- * in head write-back location
- **/
-static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
-{
-        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
-
-        return le32_to_cpu(*(volatile __le32 *)head);
-}
-
 #define WB_STRIDE 0x3
 
 /**
@@ -1206,17 +1212,16 @@ static int i40e_tso(struct i40e_ring *tx_ring, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        if (protocol == htons(ETH_P_IP)) {
-                iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
+        iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
+        ipv6h = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
+
+        if (iph->version == 4) {
                 tcph = skb->encapsulation ? inner_tcp_hdr(skb) : tcp_hdr(skb);
                 iph->tot_len = 0;
                 iph->check = 0;
                 tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
                                                  0, IPPROTO_TCP, 0);
-        } else if (skb_is_gso_v6(skb)) {
-
-                ipv6h = skb->encapsulation ? inner_ipv6_hdr(skb)
-                                           : ipv6_hdr(skb);
+        } else if (ipv6h->version == 6) {
                 tcph = skb->encapsulation ? inner_tcp_hdr(skb) : tcp_hdr(skb);
                 ipv6h->payload_len = 0;
                 tcph->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
@@ -1274,13 +1279,9 @@ static void i40e_tx_enable_csum(struct sk_buff *skb, u32 tx_flags,
                                          I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
                         }
                 } else if (tx_flags & I40E_TX_FLAGS_IPV6) {
-                        if (tx_flags & I40E_TX_FLAGS_TSO) {
-                                *cd_tunneling |= I40E_TX_CTX_EXT_IP_IPV6;
+                        *cd_tunneling |= I40E_TX_CTX_EXT_IP_IPV6;
+                        if (tx_flags & I40E_TX_FLAGS_TSO)
                                 ip_hdr(skb)->check = 0;
-                        } else {
-                                *cd_tunneling |=
-                                         I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
-                        }
                 }
 
                 /* Now set the ctx descriptor fields */
@@ -1290,6 +1291,11 @@ static void i40e_tx_enable_csum(struct sk_buff *skb, u32 tx_flags,
                                    ((skb_inner_network_offset(skb) -
                                         skb_transport_offset(skb)) >> 1) <<
                                    I40E_TXD_CTX_QW0_NATLEN_SHIFT;
+                if (this_ip_hdr->version == 6) {
+                        tx_flags &= ~I40E_TX_FLAGS_IPV4;
+                        tx_flags |= I40E_TX_FLAGS_IPV6;
+                }
+
 
         } else {
                 network_hdr_len = skb_network_header_len(skb);
@@ -1380,6 +1386,67 @@ static void i40e_create_tx_ctx(struct i40e_ring *tx_ring,
         context_desc->type_cmd_tso_mss = cpu_to_le64(cd_type_cmd_tso_mss);
 }
 
+ /**
+ * i40e_chk_linearize - Check if there are more than 8 fragments per packet
+ * @skb:      send buffer
+ * @tx_flags: collected send information
+ * @hdr_len:  size of the packet header
+ *
+ * Note: Our HW can't scatter-gather more than 8 fragments to build
+ * a packet on the wire and so we need to figure out the cases where we
+ * need to linearize the skb.
+ **/
+static bool i40e_chk_linearize(struct sk_buff *skb, u32 tx_flags,
+                               const u8 hdr_len)
+{
+        struct skb_frag_struct *frag;
+        bool linearize = false;
+        unsigned int size = 0;
+        u16 num_frags;
+        u16 gso_segs;
+
+        num_frags = skb_shinfo(skb)->nr_frags;
+        gso_segs = skb_shinfo(skb)->gso_segs;
+
+        if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO)) {
+                u16 j = 1;
+
+                if (num_frags < (I40E_MAX_BUFFER_TXD))
+                        goto linearize_chk_done;
+                /* try the simple math, if we have too many frags per segment */
+                if (DIV_ROUND_UP((num_frags + gso_segs), gso_segs) >
+                    I40E_MAX_BUFFER_TXD) {
+                        linearize = true;
+                        goto linearize_chk_done;
+                }
+                frag = &skb_shinfo(skb)->frags[0];
+                size = hdr_len;
+                /* we might still have more fragments per segment */
+                do {
+                        size += skb_frag_size(frag);
+                        frag++; j++;
+                        if (j == I40E_MAX_BUFFER_TXD) {
+                                if (size < skb_shinfo(skb)->gso_size) {
+                                        linearize = true;
+                                        break;
+                                }
+                                j = 1;
+                                size -= skb_shinfo(skb)->gso_size;
+                                if (size)
+                                        j++;
+                                size += hdr_len;
+                        }
+                        num_frags--;
+                } while (num_frags);
+        } else {
+                if (num_frags >= I40E_MAX_BUFFER_TXD)
+                        linearize = true;
+        }
+
+linearize_chk_done:
+        return linearize;
+}
+
 /**
  * i40e_tx_map - Build the Tx descriptor
  * @tx_ring:  ring to send buffer on
@@ -1654,6 +1721,10 @@ static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
         else if (tso)
                 tx_flags |= I40E_TX_FLAGS_TSO;
 
+        if (i40e_chk_linearize(skb, tx_flags, hdr_len))
+                if (skb_linearize(skb))
+                        goto out_drop;
+
         skb_tx_timestamp(skb);
 
         /* always enable CRC insertion offload */
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
index 4e15903b2b6d..c950a038237c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
@@ -112,6 +112,7 @@ enum i40e_dyn_idx_t {
 
 #define i40e_rx_desc i40e_32byte_rx_desc
 
+#define I40E_MAX_BUFFER_TXD     8
 #define I40E_MIN_TX_LEN         17
 #define I40E_MAX_DATA_PER_TXD   8192
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 2d8ee66138e8..a61009f4b2df 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -81,12 +81,14 @@ static int mlx4_en_test_loopback(struct mlx4_en_priv *priv)
 {
         u32 loopback_ok = 0;
         int i;
-
+        bool gro_enabled;
 
         priv->loopback_ok = 0;
         priv->validate_loopback = 1;
+        gro_enabled = priv->dev->features & NETIF_F_GRO;
 
         mlx4_en_update_loopback_state(priv->dev, priv->dev->features);
+        priv->dev->features &= ~NETIF_F_GRO;
 
         /* xmit */
         if (mlx4_en_test_loopback_xmit(priv)) {
@@ -108,6 +110,10 @@ static int mlx4_en_test_loopback(struct mlx4_en_priv *priv)
 mlx4_en_test_loopback_exit:
 
         priv->validate_loopback = 0;
+
+        if (gro_enabled)
+                priv->dev->features |= NETIF_F_GRO;
+
         mlx4_en_update_loopback_state(priv->dev, priv->dev->features);
         return !loopback_ok;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 2bb8553bd905..eda29dbbfcd2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -412,7 +412,6 @@ err_icm:
 
 EXPORT_SYMBOL_GPL(mlx4_qp_alloc);
 
-#define MLX4_UPDATE_QP_SUPPORTED_ATTRS MLX4_UPDATE_QP_SMAC
 int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
                    enum mlx4_update_qp_attr attr,
                    struct mlx4_update_qp_params *params)
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 486e3d26cd4a..d97ca88c55b5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -713,7 +713,7 @@ static int update_vport_qp_param(struct mlx4_dev *dev,
         struct mlx4_vport_oper_state *vp_oper;
         struct mlx4_priv *priv;
         u32 qp_type;
-        int port;
+        int port, err = 0;
 
         port = (qpc->pri_path.sched_queue & 0x40) ? 2 : 1;
         priv = mlx4_priv(dev);
@@ -738,7 +738,9 @@ static int update_vport_qp_param(struct mlx4_dev *dev,
                         } else {
                                 struct mlx4_update_qp_params params = {.flags = 0};
 
-                                mlx4_update_qp(dev, qpn, MLX4_UPDATE_QP_VSD, &params);
+                                err = mlx4_update_qp(dev, qpn, MLX4_UPDATE_QP_VSD, &params);
+                                if (err)
+                                        goto out;
                         }
                 }
 
@@ -773,7 +775,8 @@ static int update_vport_qp_param(struct mlx4_dev *dev,
                 qpc->pri_path.feup |= MLX4_FSM_FORCE_ETH_SRC_MAC;
                 qpc->pri_path.grh_mylmc = (0x80 & qpc->pri_path.grh_mylmc) + vp_oper->mac_idx;
         }
-        return 0;
+out:
+        return err;
 }
 
 static int mpt_mask(struct mlx4_dev *dev)
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 44e8d7d25547..57a6e6cd74fc 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1239,11 +1239,9 @@ static int pasemi_mac_open(struct net_device *dev)
         if (mac->phydev)
                 phy_start(mac->phydev);
 
-        init_timer(&mac->tx->clean_timer);
-        mac->tx->clean_timer.function = pasemi_mac_tx_timer;
-        mac->tx->clean_timer.data = (unsigned long)mac->tx;
-        mac->tx->clean_timer.expires = jiffies+HZ;
-        add_timer(&mac->tx->clean_timer);
+        setup_timer(&mac->tx->clean_timer, pasemi_mac_tx_timer,
+                    (unsigned long)mac->tx);
+        mod_timer(&mac->tx->clean_timer, jiffies + HZ);
 
         return 0;
 
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
index 6e426ae94692..0a5e204a0179 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
@@ -354,7 +354,7 @@ struct cmd_desc_type0 {
 
 } __attribute__ ((aligned(64)));
 
-/* Note: sizeof(rcv_desc) should always be a mutliple of 2 */
+/* Note: sizeof(rcv_desc) should always be a multiple of 2 */
 struct rcv_desc {
         __le16 reference_handle;
         __le16 reserved;
@@ -499,7 +499,7 @@ struct uni_data_desc{
 #define NETXEN_IMAGE_START      0x43000 /* compressed image */
 #define NETXEN_SECONDARY_START  0x200000        /* backup images */
 #define NETXEN_PXE_START        0x3E0000        /* PXE boot rom */
-#define NETXEN_USER_START       0x3E8000        /* Firmare info */
+#define NETXEN_USER_START       0x3E8000        /* Firmware info */
 #define NETXEN_FIXED_START      0x3F0000        /* backup of crbinit */
 #define NETXEN_USER_START_OLD   NETXEN_PXE_START /* very old flash */
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index fa4317611fd6..f221126a5c4e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -314,7 +314,7 @@ struct qlcnic_fdt {
 #define QLCNIC_BRDCFG_START     0x4000          /* board config */
 #define QLCNIC_BOOTLD_START     0x10000         /* bootld */
 #define QLCNIC_IMAGE_START      0x43000         /* compressed image */
-#define QLCNIC_USER_START       0x3E8000        /* Firmare info */
+#define QLCNIC_USER_START       0x3E8000        /* Firmware info */
 
 #define QLCNIC_FW_VERSION_OFFSET        (QLCNIC_USER_START+0x408)
 #define QLCNIC_FW_SIZE_OFFSET           (QLCNIC_USER_START+0x40c)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index ad0020af2193..c70ab40d8698 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -2561,7 +2561,7 @@ static int rtl_check_firmware(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
         int rc = -EINVAL;
 
         if (!rtl_fw_format_ok(tp, rtl_fw)) {
-                netif_err(tp, ifup, dev, "invalid firwmare\n");
+                netif_err(tp, ifup, dev, "invalid firmware\n");
                 goto out;
         }
 
@@ -5067,8 +5067,6 @@ static void rtl_hw_reset(struct rtl8169_private *tp)
         RTL_W8(ChipCmd, CmdReset);
 
         rtl_udelay_loop_wait_low(tp, &rtl_chipcmd_cond, 100, 100);
-
-        netdev_reset_queue(tp->dev);
 }
 
 static void rtl_request_uncached_firmware(struct rtl8169_private *tp)
@@ -7049,7 +7047,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
         u32 status, len;
         u32 opts[2];
         int frags;
-        bool stop_queue;
 
         if (unlikely(!TX_FRAGS_READY_FOR(tp, skb_shinfo(skb)->nr_frags))) {
                 netif_err(tp, drv, dev, "BUG! Tx Ring full when queue awake!\n");
@@ -7090,8 +7087,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         txd->opts2 = cpu_to_le32(opts[1]);
 
-        netdev_sent_queue(dev, skb->len);
-
         skb_tx_timestamp(skb);
 
         /* Force memory writes to complete before releasing descriptor */
@@ -7106,16 +7101,11 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         tp->cur_tx += frags + 1;
 
-        stop_queue = !TX_FRAGS_READY_FOR(tp, MAX_SKB_FRAGS);
+        RTL_W8(TxPoll, NPQ);
 
-        if (!skb->xmit_more || stop_queue ||
-            netif_xmit_stopped(netdev_get_tx_queue(dev, 0))) {
-                RTL_W8(TxPoll, NPQ);
-
-                mmiowb();
-        }
+        mmiowb();
 
-        if (stop_queue) {
+        if (!TX_FRAGS_READY_FOR(tp, MAX_SKB_FRAGS)) {
                 /* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
                  * not miss a ring update when it notices a stopped queue.
                  */
@@ -7198,7 +7188,6 @@ static void rtl8169_pcierr_interrupt(struct net_device *dev)
 static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
 {
         unsigned int dirty_tx, tx_left;
-        unsigned int bytes_compl = 0, pkts_compl = 0;
 
         dirty_tx = tp->dirty_tx;
         smp_rmb();
@@ -7222,8 +7211,10 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
                 rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
                                      tp->TxDescArray + entry);
                 if (status & LastFrag) {
-                        pkts_compl++;
-                        bytes_compl += tx_skb->skb->len;
+                        u64_stats_update_begin(&tp->tx_stats.syncp);
+                        tp->tx_stats.packets++;
+                        tp->tx_stats.bytes += tx_skb->skb->len;
+                        u64_stats_update_end(&tp->tx_stats.syncp);
                         dev_kfree_skb_any(tx_skb->skb);
                         tx_skb->skb = NULL;
                 }
@@ -7232,13 +7223,6 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
         }
 
         if (tp->dirty_tx != dirty_tx) {
-                netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
-
-                u64_stats_update_begin(&tp->tx_stats.syncp);
-                tp->tx_stats.packets += pkts_compl;
-                tp->tx_stats.bytes += bytes_compl;
-                u64_stats_update_end(&tp->tx_stats.syncp);
-
                 tp->dirty_tx = dirty_tx;
                 /* Sync with rtl8169_start_xmit:
                  * - publish dirty_tx ring index (write barrier)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 4da8bd263997..736d5d1624a1 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -508,7 +508,6 @@ static struct sh_eth_cpu_data r8a779x_data = {
         .tpauser        = 1,
         .hw_swap        = 1,
         .rmiimode       = 1,
-        .shift_rd0      = 1,
 };
 
 static void sh_eth_set_rate_sh7724(struct net_device *ndev)
@@ -1392,6 +1391,9 @@ static void sh_eth_dev_exit(struct net_device *ndev)
         msleep(2); /* max frame time at 10 Mbps < 1250 us */
         sh_eth_get_stats(ndev);
         sh_eth_reset(ndev);
+
+        /* Set MAC address again */
+        update_mac_address(ndev);
 }
 
 /* free Tx skb function */
@@ -1407,6 +1409,8 @@ static int sh_eth_txfree(struct net_device *ndev)
                 txdesc = &mdp->tx_ring[entry];
                 if (txdesc->status & cpu_to_edmac(mdp, TD_TACT))
                         break;
+                /* TACT bit must be checked before all the following reads */
+                rmb();
                 /* Free the original skb. */
                 if (mdp->tx_skbuff[entry]) {
                         dma_unmap_single(&ndev->dev, txdesc->addr,
@@ -1444,6 +1448,8 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         limit = boguscnt;
         rxdesc = &mdp->rx_ring[entry];
         while (!(rxdesc->status & cpu_to_edmac(mdp, RD_RACT))) {
+                /* RACT bit must be checked before all the following reads */
+                rmb();
                 desc_status = edmac_to_cpu(mdp, rxdesc->status);
                 pkt_len = rxdesc->frame_length;
 
@@ -1455,8 +1461,8 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 
                 /* In case of almost all GETHER/ETHERs, the Receive Frame State
                  * (RFS) bits in the Receive Descriptor 0 are from bit 9 to
-                 * bit 0. However, in case of the R8A7740, R8A779x, and
-                 * R7S72100 the RFS bits are from bit 25 to bit 16. So, the
+                 * bit 0. However, in case of the R8A7740 and R7S72100
+                 * the RFS bits are from bit 25 to bit 16. So, the
                  * driver needs right shifting by 16.
                  */
                 if (mdp->cd->shift_rd0)
@@ -1523,6 +1529,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         skb_checksum_none_assert(skb);
                         rxdesc->addr = dma_addr;
                 }
+                wmb(); /* RACT bit must be set after all the above writes */
                 if (entry >= mdp->num_rx_ring - 1)
                         rxdesc->status |=
                                 cpu_to_edmac(mdp, RD_RACT | RD_RFP | RD_RDEL);
@@ -1535,7 +1542,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         /* If we don't need to check status, don't. -KDU */
         if (!(sh_eth_read(ndev, EDRRR) & EDRRR_R)) {
                 /* fix the values for the next receiving if RDE is set */
-                if (intr_status & EESR_RDE) {
+                if (intr_status & EESR_RDE && mdp->reg_offset[RDFAR] != 0) {
                         u32 count = (sh_eth_read(ndev, RDFAR) -
                                      sh_eth_read(ndev, RDLAR)) >> 4;
 
@@ -2174,7 +2181,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         }
         spin_unlock_irqrestore(&mdp->lock, flags);
 
-        if (skb_padto(skb, ETH_ZLEN))
+        if (skb_put_padto(skb, ETH_ZLEN))
                 return NETDEV_TX_OK;
 
         entry = mdp->cur_tx % mdp->num_tx_ring;
@@ -2192,6 +2199,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         }
         txdesc->buffer_length = skb->len;
 
+        wmb(); /* TACT bit must be set after all the above writes */
         if (entry >= mdp->num_tx_ring - 1)
                 txdesc->status |= cpu_to_edmac(mdp, TD_TACT | TD_TDLE);
         else
diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
index 34389b6aa67c..9fb6948e14c6 100644
--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -1257,9 +1257,9 @@ static void rocker_port_set_enable(struct rocker_port *rocker_port, bool enable)
         u64 val = rocker_read64(rocker_port->rocker, PORT_PHYS_ENABLE);
 
         if (enable)
-                val |= 1 << rocker_port->lport;
+                val |= 1ULL << rocker_port->lport;
         else
-                val &= ~(1 << rocker_port->lport);
+                val &= ~(1ULL << rocker_port->lport);
         rocker_write64(rocker_port->rocker, PORT_PHYS_ENABLE, val);
 }
 
@@ -4201,6 +4201,8 @@ static int rocker_probe_ports(struct rocker *rocker)
 
         alloc_size = sizeof(struct rocker_port *) * rocker->port_count;
         rocker->ports = kmalloc(alloc_size, GFP_KERNEL);
+        if (!rocker->ports)
+                return -ENOMEM;
         for (i = 0; i < rocker->port_count; i++) {
                 err = rocker_probe_port(rocker, i);
                 if (err)
diff --git a/drivers/net/ethernet/smsc/smc91c92_cs.c b/drivers/net/ethernet/smsc/smc91c92_cs.c
index 6b33127ab352..3449893aea8d 100644
--- a/drivers/net/ethernet/smsc/smc91c92_cs.c
+++ b/drivers/net/ethernet/smsc/smc91c92_cs.c
@@ -1070,11 +1070,8 @@ static int smc_open(struct net_device *dev)
     smc->packets_waiting = 0;
 
     smc_reset(dev);
-    init_timer(&smc->media);
-    smc->media.function = media_check;
-    smc->media.data = (u_long) dev;
-    smc->media.expires = jiffies + HZ;
-    add_timer(&smc->media);
+    setup_timer(&smc->media, media_check, (u_long)dev);
+    mod_timer(&smc->media, jiffies + HZ);
 
     return 0;
 } /* smc_open */
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 88a55f95fe09..209ee1b27f8d 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -91,6 +91,10 @@ static const char version[] =
 
 #include "smc91x.h"
 
+#if defined(CONFIG_ASSABET_NEPONSET)
+#include <mach/neponset.h>
+#endif
+
 #ifndef SMC_NOWAIT
 # define SMC_NOWAIT             0
 #endif
@@ -2355,8 +2359,9 @@ static int smc_drv_probe(struct platform_device *pdev)
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
                 goto out_release_io;
-#if defined(CONFIG_SA1100_ASSABET)
-        neponset_ncr_set(NCR_ENET_OSC_EN);
+#if defined(CONFIG_ASSABET_NEPONSET)
+        if (machine_is_assabet() && machine_has_neponset())
+                neponset_ncr_set(NCR_ENET_OSC_EN);
 #endif
         platform_set_drvdata(pdev, ndev);
         ret = smc_enable_device(pdev);
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index be67baf5f677..3a18501d1068 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -39,14 +39,7 @@
  * Define your architecture specific bus configuration parameters here.
  */
 
-#if defined(CONFIG_ARCH_LUBBOCK) ||\
-    defined(CONFIG_MACH_MAINSTONE) ||\
-    defined(CONFIG_MACH_ZYLONITE) ||\
-    defined(CONFIG_MACH_LITTLETON) ||\
-    defined(CONFIG_MACH_ZYLONITE2) ||\
-    defined(CONFIG_ARCH_VIPER) ||\
-    defined(CONFIG_MACH_STARGATE2) ||\
-    defined(CONFIG_ARCH_VERSATILE)
+#if defined(CONFIG_ARM)
 
 #include <asm/mach-types.h>
 
@@ -74,95 +67,8 @@
 /* We actually can't write halfwords properly if not word aligned */
 static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 {
-        if ((machine_is_mainstone() || machine_is_stargate2()) && reg & 2) {
-                unsigned int v = val << 16;
-                v |= readl(ioaddr + (reg & ~2)) & 0xffff;
-                writel(v, ioaddr + (reg & ~2));
-        } else {
-                writew(val, ioaddr + reg);
-        }
-}
-
-#elif defined(CONFIG_SA1100_PLEB)
-/* We can only do 16-bit reads and writes in the static memory space. */
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       0
-#define SMC_IO_SHIFT            0
-#define SMC_NOWAIT              1
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, (l))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-
-#define SMC_IRQ_FLAGS           (-1)
-
-#elif defined(CONFIG_SA1100_ASSABET)
-
-#include <mach/neponset.h>
-
-/* We can only do 8-bit reads and writes in the static memory space. */
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       0
-#define SMC_CAN_USE_32BIT       0
-#define SMC_NOWAIT              1
-
-/* The first two address lines aren't connected... */
-#define SMC_IO_SHIFT            2
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, (l))
-#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
-
-#elif   defined(CONFIG_MACH_LOGICPD_PXA270) ||  \
-        defined(CONFIG_MACH_NOMADIK_8815NHK)
-
-#define SMC_CAN_USE_8BIT        0
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       0
-#define SMC_IO_SHIFT            0
-#define SMC_NOWAIT              1
-
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-
-#elif   defined(CONFIG_ARCH_INNOKOM) || \
-        defined(CONFIG_ARCH_PXA_IDP) || \
-        defined(CONFIG_ARCH_RAMSES) || \
-        defined(CONFIG_ARCH_PCM027)
-
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       1
-#define SMC_IO_SHIFT            0
-#define SMC_NOWAIT              1
-#define SMC_USE_PXA_DMA         1
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
-#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
-#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
-
-/* We actually can't write halfwords properly if not word aligned */
-static inline void
-SMC_outw(u16 val, void __iomem *ioaddr, int reg)
-{
-        if (reg & 2) {
+        if ((machine_is_mainstone() || machine_is_stargate2() ||
+             machine_is_pxa_idp()) && reg & 2) {
                 unsigned int v = val << 16;
                 v |= readl(ioaddr + (reg & ~2)) & 0xffff;
                 writel(v, ioaddr + (reg & ~2));
@@ -237,20 +143,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define RPC_LSA_DEFAULT         RPC_LED_100_10
 #define RPC_LSB_DEFAULT         RPC_LED_TX_RX
 
-#elif defined(CONFIG_ARCH_MSM)
-
-#define SMC_CAN_USE_8BIT        0
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       0
-#define SMC_NOWAIT              1
-
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-
-#define SMC_IRQ_FLAGS           IRQF_TRIGGER_HIGH
-
 #elif defined(CONFIG_COLDFIRE)
 
 #define SMC_CAN_USE_8BIT        0
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 55e89b3838f1..a0ea84fe6519 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -310,11 +310,11 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                 spin_lock_irqsave(&priv->lock, flags);
                 if (!priv->eee_active) {
                         priv->eee_active = 1;
-                        init_timer(&priv->eee_ctrl_timer);
-                        priv->eee_ctrl_timer.function = stmmac_eee_ctrl_timer;
-                        priv->eee_ctrl_timer.data = (unsigned long)priv;
-                        priv->eee_ctrl_timer.expires = STMMAC_LPI_T(eee_timer);
-                        add_timer(&priv->eee_ctrl_timer);
+                        setup_timer(&priv->eee_ctrl_timer,
+                                    stmmac_eee_ctrl_timer,
+                                    (unsigned long)priv);
+                        mod_timer(&priv->eee_ctrl_timer,
+                                  STMMAC_LPI_T(eee_timer));
 
                         priv->hw->mac->set_eee_timer(priv->hw,
                                                      STMMAC_DEFAULT_LIT_LS,
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 4b51f903fb73..0c5842aeb807 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -6989,10 +6989,10 @@ static int niu_class_to_ethflow(u64 class, int *flow_type)
                 *flow_type = IP_USER_FLOW;
                 break;
         default:
-                return 0;
+                return -EINVAL;
         }
 
-        return 1;
+        return 0;
 }
 
 static int niu_ethflow_to_class(int flow_type, u64 *class)
@@ -7198,11 +7198,9 @@ static int niu_get_ethtool_tcam_entry(struct niu *np,
         class = (tp->key[0] & TCAM_V4KEY0_CLASS_CODE) >>
                 TCAM_V4KEY0_CLASS_CODE_SHIFT;
         ret = niu_class_to_ethflow(class, &fsp->flow_type);
-
         if (ret < 0) {
                 netdev_info(np->dev, "niu%d: niu_class_to_ethflow failed\n",
                             parent->index);
-                ret = -EINVAL;
                 goto out;
         }
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7d8dd0d2182e..a1bbaf6352ba 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1103,7 +1103,7 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
         cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast,
                            port_mask, ALE_VLAN, slave->port_vlan, 0);
         cpsw_ale_add_ucast(priv->ale, priv->mac_addr,
-                priv->host_port, ALE_VLAN, slave->port_vlan);
+                priv->host_port, ALE_VLAN | ALE_SECURE, slave->port_vlan);
 }
 
 static void soft_reset_slave(struct cpsw_slave *slave)
@@ -2466,6 +2466,7 @@ static int cpsw_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int cpsw_suspend(struct device *dev)
 {
         struct platform_device  *pdev = to_platform_device(dev);
@@ -2518,11 +2519,9 @@ static int cpsw_resume(struct device *dev)
         }
         return 0;
 }
+#endif
 
-static const struct dev_pm_ops cpsw_pm_ops = {
-        .suspend        = cpsw_suspend,
-        .resume         = cpsw_resume,
-};
+static SIMPLE_DEV_PM_OPS(cpsw_pm_ops, cpsw_suspend, cpsw_resume);
 
 static const struct of_device_id cpsw_of_mtable[] = {
         { .compatible = "ti,cpsw", },
diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
index 98655b44b97e..c00084d689f3 100644
--- a/drivers/net/ethernet/ti/davinci_mdio.c
+++ b/drivers/net/ethernet/ti/davinci_mdio.c
@@ -423,6 +423,7 @@ static int davinci_mdio_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int davinci_mdio_suspend(struct device *dev)
 {
         struct davinci_mdio_data *data = dev_get_drvdata(dev);
@@ -464,10 +465,10 @@ static int davinci_mdio_resume(struct device *dev)
 
         return 0;
 }
+#endif
 
 static const struct dev_pm_ops davinci_mdio_pm_ops = {
-        .suspend_late   = davinci_mdio_suspend,
-        .resume_early   = davinci_mdio_resume,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(davinci_mdio_suspend, davinci_mdio_resume)
 };
 
 #if IS_ENABLED(CONFIG_OF)
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index f7e0f0f7c2e2..9e16a2819d48 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -938,7 +938,7 @@ static void eth_set_mcast_list(struct net_device *dev)
         int i;
         static const u8 allmulti[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
-        if (dev->flags & IFF_ALLMULTI) {
+        if ((dev->flags & IFF_ALLMULTI) && !(dev->flags & IFF_PROMISC)) {
                 for (i = 0; i < ETH_ALEN; i++) {
                         __raw_writel(allmulti[i], &port->regs->mcast_addr[i]);
                         __raw_writel(allmulti[i], &port->regs->mcast_mask[i]);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index e40fdfccc9c1..27ecc5c4fa26 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -654,11 +654,14 @@ static void macvtap_skb_to_vnet_hdr(struct macvtap_queue *q,
         } /* else everything is zero */
 }
 
+/* Neighbour code has some assumptions on HH_DATA_MOD alignment */
+#define MACVTAP_RESERVE HH_DATA_OFF(ETH_HLEN)
+
 /* Get packet from user space buffer */
 static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                                 struct iov_iter *from, int noblock)
 {
-        int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
+        int good_linear = SKB_MAX_HEAD(MACVTAP_RESERVE);
         struct sk_buff *skb;
         struct macvlan_dev *vlan;
         unsigned long total_len = iov_iter_count(from);
@@ -722,7 +725,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                         linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len);
         }
 
-        skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
+        skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
                                 linear, noblock, &err);
         if (!skb)
                 goto err;
diff --git a/drivers/net/phy/amd-xgbe-phy.c b/drivers/net/phy/amd-xgbe-phy.c
index 9e3af54c9010..32efbd48f326 100644
--- a/drivers/net/phy/amd-xgbe-phy.c
+++ b/drivers/net/phy/amd-xgbe-phy.c
@@ -92,6 +92,8 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define XGBE_PHY_CDR_RATE_PROPERTY      "amd,serdes-cdr-rate"
 #define XGBE_PHY_PQ_SKEW_PROPERTY       "amd,serdes-pq-skew"
 #define XGBE_PHY_TX_AMP_PROPERTY        "amd,serdes-tx-amp"
+#define XGBE_PHY_DFE_CFG_PROPERTY       "amd,serdes-dfe-tap-config"
+#define XGBE_PHY_DFE_ENA_PROPERTY       "amd,serdes-dfe-tap-enable"
 
 #define XGBE_PHY_SPEEDS                 3
 #define XGBE_PHY_SPEED_1000             0
@@ -177,10 +179,12 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define SPEED_10000_BLWC                0
 #define SPEED_10000_CDR                 0x7
 #define SPEED_10000_PLL                 0x1
-#define SPEED_10000_PQ                  0x1e
+#define SPEED_10000_PQ                  0x12
 #define SPEED_10000_RATE                0x0
 #define SPEED_10000_TXAMP               0xa
 #define SPEED_10000_WORD                0x7
+#define SPEED_10000_DFE_TAP_CONFIG      0x1
+#define SPEED_10000_DFE_TAP_ENABLE      0x7f
 
 #define SPEED_2500_BLWC                 1
 #define SPEED_2500_CDR                  0x2
@@ -189,6 +193,8 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define SPEED_2500_RATE                 0x1
 #define SPEED_2500_TXAMP                0xf
 #define SPEED_2500_WORD                 0x1
+#define SPEED_2500_DFE_TAP_CONFIG       0x3
+#define SPEED_2500_DFE_TAP_ENABLE       0x0
 
 #define SPEED_1000_BLWC                 1
 #define SPEED_1000_CDR                  0x2
@@ -197,16 +203,25 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define SPEED_1000_RATE                 0x3
 #define SPEED_1000_TXAMP                0xf
 #define SPEED_1000_WORD                 0x1
+#define SPEED_1000_DFE_TAP_CONFIG       0x3
+#define SPEED_1000_DFE_TAP_ENABLE       0x0
 
 /* SerDes RxTx register offsets */
+#define RXTX_REG6                       0x0018
 #define RXTX_REG20                      0x0050
+#define RXTX_REG22                      0x0058
 #define RXTX_REG114                     0x01c8
+#define RXTX_REG129                     0x0204
 
 /* SerDes RxTx register entry bit positions and sizes */
+#define RXTX_REG6_RESETB_RXD_INDEX      8
+#define RXTX_REG6_RESETB_RXD_WIDTH      1
 #define RXTX_REG20_BLWC_ENA_INDEX       2
 #define RXTX_REG20_BLWC_ENA_WIDTH       1
 #define RXTX_REG114_PQ_REG_INDEX        9
 #define RXTX_REG114_PQ_REG_WIDTH        7
+#define RXTX_REG129_RXDFE_CONFIG_INDEX  14
+#define RXTX_REG129_RXDFE_CONFIG_WIDTH  2
 
 /* Bit setting and getting macros
  *  The get macro will extract the current bit field value from within
@@ -333,6 +348,18 @@ static const u32 amd_xgbe_phy_serdes_tx_amp[] = {
         SPEED_10000_TXAMP,
 };
 
+static const u32 amd_xgbe_phy_serdes_dfe_tap_cfg[] = {
+        SPEED_1000_DFE_TAP_CONFIG,
+        SPEED_2500_DFE_TAP_CONFIG,
+        SPEED_10000_DFE_TAP_CONFIG,
+};
+
+static const u32 amd_xgbe_phy_serdes_dfe_tap_ena[] = {
+        SPEED_1000_DFE_TAP_ENABLE,
+        SPEED_2500_DFE_TAP_ENABLE,
+        SPEED_10000_DFE_TAP_ENABLE,
+};
+
 enum amd_xgbe_phy_an {
         AMD_XGBE_AN_READY = 0,
         AMD_XGBE_AN_PAGE_RECEIVED,
@@ -393,6 +420,8 @@ struct amd_xgbe_phy_priv {
         u32 serdes_cdr_rate[XGBE_PHY_SPEEDS];
         u32 serdes_pq_skew[XGBE_PHY_SPEEDS];
         u32 serdes_tx_amp[XGBE_PHY_SPEEDS];
+        u32 serdes_dfe_tap_cfg[XGBE_PHY_SPEEDS];
+        u32 serdes_dfe_tap_ena[XGBE_PHY_SPEEDS];
 
         /* Auto-negotiation state machine support */
         struct mutex an_mutex;
@@ -481,11 +510,16 @@ static void amd_xgbe_phy_serdes_complete_ratechange(struct phy_device *phydev)
                 status = XSIR0_IOREAD(priv, SIR0_STATUS);
                 if (XSIR_GET_BITS(status, SIR0_STATUS, RX_READY) &&
                     XSIR_GET_BITS(status, SIR0_STATUS, TX_READY))
-                        return;
+                        goto rx_reset;
         }
 
         netdev_dbg(phydev->attached_dev, "SerDes rx/tx not ready (%#hx)\n",
                    status);
+
+rx_reset:
+        /* Perform Rx reset for the DFE changes */
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG6, RESETB_RXD, 0);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG6, RESETB_RXD, 1);
 }
 
 static int amd_xgbe_phy_xgmii_mode(struct phy_device *phydev)
@@ -534,6 +568,10 @@ static int amd_xgbe_phy_xgmii_mode(struct phy_device *phydev)
                            priv->serdes_blwc[XGBE_PHY_SPEED_10000]);
         XRXTX_IOWRITE_BITS(priv, RXTX_REG114, PQ_REG,
                            priv->serdes_pq_skew[XGBE_PHY_SPEED_10000]);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG129, RXDFE_CONFIG,
+                           priv->serdes_dfe_tap_cfg[XGBE_PHY_SPEED_10000]);
+        XRXTX_IOWRITE(priv, RXTX_REG22,
+                      priv->serdes_dfe_tap_ena[XGBE_PHY_SPEED_10000]);
 
         amd_xgbe_phy_serdes_complete_ratechange(phydev);
 
@@ -586,6 +624,10 @@ static int amd_xgbe_phy_gmii_2500_mode(struct phy_device *phydev)
                            priv->serdes_blwc[XGBE_PHY_SPEED_2500]);
         XRXTX_IOWRITE_BITS(priv, RXTX_REG114, PQ_REG,
                            priv->serdes_pq_skew[XGBE_PHY_SPEED_2500]);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG129, RXDFE_CONFIG,
+                           priv->serdes_dfe_tap_cfg[XGBE_PHY_SPEED_2500]);
+        XRXTX_IOWRITE(priv, RXTX_REG22,
+                      priv->serdes_dfe_tap_ena[XGBE_PHY_SPEED_2500]);
 
         amd_xgbe_phy_serdes_complete_ratechange(phydev);
 
@@ -638,6 +680,10 @@ static int amd_xgbe_phy_gmii_mode(struct phy_device *phydev)
                            priv->serdes_blwc[XGBE_PHY_SPEED_1000]);
         XRXTX_IOWRITE_BITS(priv, RXTX_REG114, PQ_REG,
                            priv->serdes_pq_skew[XGBE_PHY_SPEED_1000]);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG129, RXDFE_CONFIG,
+                           priv->serdes_dfe_tap_cfg[XGBE_PHY_SPEED_1000]);
+        XRXTX_IOWRITE(priv, RXTX_REG22,
+                      priv->serdes_dfe_tap_ena[XGBE_PHY_SPEED_1000]);
 
         amd_xgbe_phy_serdes_complete_ratechange(phydev);
 
@@ -1668,6 +1714,38 @@ static int amd_xgbe_phy_probe(struct phy_device *phydev)
                        sizeof(priv->serdes_tx_amp));
         }
 
+        if (device_property_present(phy_dev, XGBE_PHY_DFE_CFG_PROPERTY)) {
+                ret = device_property_read_u32_array(phy_dev,
+                                                     XGBE_PHY_DFE_CFG_PROPERTY,
+                                                     priv->serdes_dfe_tap_cfg,
+                                                     XGBE_PHY_SPEEDS);
+                if (ret) {
+                        dev_err(dev, "invalid %s property\n",
+                                XGBE_PHY_DFE_CFG_PROPERTY);
+                        goto err_sir1;
+                }
+        } else {
+                memcpy(priv->serdes_dfe_tap_cfg,
+                       amd_xgbe_phy_serdes_dfe_tap_cfg,
+                       sizeof(priv->serdes_dfe_tap_cfg));
+        }
+
+        if (device_property_present(phy_dev, XGBE_PHY_DFE_ENA_PROPERTY)) {
+                ret = device_property_read_u32_array(phy_dev,
+                                                     XGBE_PHY_DFE_ENA_PROPERTY,
+                                                     priv->serdes_dfe_tap_ena,
+                                                     XGBE_PHY_SPEEDS);
+                if (ret) {
+                        dev_err(dev, "invalid %s property\n",
+                                XGBE_PHY_DFE_ENA_PROPERTY);
+                        goto err_sir1;
+                }
+        } else {
+                memcpy(priv->serdes_dfe_tap_ena,
+                       amd_xgbe_phy_serdes_dfe_tap_ena,
+                       sizeof(priv->serdes_dfe_tap_ena));
+        }
+
         phydev->priv = priv;
 
         if (!priv->adev || acpi_disabled)
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index cdcac6aa4260..52cd8db2c57d 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -236,6 +236,25 @@ static inline unsigned int phy_find_valid(unsigned int idx, u32 features)
 }
 
 /**
+ * phy_check_valid - check if there is a valid PHY setting which matches
+ *                   speed, duplex, and feature mask
+ * @speed: speed to match
+ * @duplex: duplex to match
+ * @features: A mask of the valid settings
+ *
+ * Description: Returns true if there is a valid setting, false otherwise.
+ */
+static inline bool phy_check_valid(int speed, int duplex, u32 features)
+{
+        unsigned int idx;
+
+        idx = phy_find_valid(phy_find_setting(speed, duplex), features);
+
+        return settings[idx].speed == speed && settings[idx].duplex == duplex &&
+                (settings[idx].setting & features);
+}
+
+/**
  * phy_sanitize_settings - make sure the PHY is set to supported speed and duplex
  * @phydev: the target phy_device struct
  *
@@ -1045,7 +1064,6 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
                 int eee_lp, eee_cap, eee_adv;
                 u32 lp, cap, adv;
                 int status;
-                unsigned int idx;
 
                 /* Read phy status to properly get the right settings */
                 status = phy_read_status(phydev);
@@ -1077,8 +1095,7 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
 
                 adv = mmd_eee_adv_to_ethtool_adv_t(eee_adv);
                 lp = mmd_eee_adv_to_ethtool_adv_t(eee_lp);
-                idx = phy_find_setting(phydev->speed, phydev->duplex);
-                if (!(lp & adv & settings[idx].setting))
+                if (!phy_check_valid(phydev->speed, phydev->duplex, lp & adv))
                         goto eee_exit_err;
 
                 if (clk_stop_enable) {
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 0e62274e884a..f1ee71e22241 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -43,9 +43,7 @@
 
 static struct team_port *team_port_get_rcu(const struct net_device *dev)
 {
-        struct team_port *port = rcu_dereference(dev->rx_handler_data);
-
-        return team_port_exists(dev) ? port : NULL;
+        return rcu_dereference(dev->rx_handler_data);
 }
 
 static struct team_port *team_port_get_rtnl(const struct net_device *dev)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 3bd9678315ad..7ba8d0885f12 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -161,6 +161,7 @@ config USB_NET_AX8817X
             * Linksys USB200M
             * Netgear FA120
             * Sitecom LN-029
+            * Sitecom LN-028
             * Intellinet USB 2.0 Ethernet
             * ST Lab USB 2.0 Ethernet
             * TrendNet TU2-ET100
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index bf49792062a2..1173a24feda3 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -979,6 +979,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x0df6, 0x0056),
         .driver_info =  (unsigned long) &ax88178_info,
 }, {
+        // Sitecom LN-028 "USB 2.0 10/100/1000 Ethernet adapter"
+        USB_DEVICE (0x0df6, 0x061c),
+        .driver_info =  (unsigned long) &ax88178_info,
+}, {
         // corega FEther USB2-TX
         USB_DEVICE (0x07aa, 0x0017),
         .driver_info =  (unsigned long) &ax8817x_info,
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 9cdfb3fe9c15..778e91531fac 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1594,7 +1594,7 @@ hso_wait_modem_status(struct hso_serial *serial, unsigned long arg)
                 }
                 cprev = cnow;
         }
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(&tiocmget->waitq, &wait);
 
         return ret;
diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
index 3d18bb0eee85..1bfe0fcaccf5 100644
--- a/drivers/net/usb/plusb.c
+++ b/drivers/net/usb/plusb.c
@@ -134,6 +134,11 @@ static const struct usb_device_id	products [] = {
 }, {
         USB_DEVICE(0x050d, 0x258a),     /* Belkin F5U258/F5U279 (PL-25A1) */
         .driver_info =  (unsigned long) &prolific_info,
+}, {
+        USB_DEVICE(0x3923, 0x7825),     /* National Instruments USB
+                                         * Host-to-Host Cable
+                                         */
+        .driver_info =  (unsigned long) &prolific_info,
 },
 
         { },            // END
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index 83c39e2858bf..88d121d43c08 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -806,21 +806,21 @@ static ssize_t cosa_read(struct file *file,
         spin_lock_irqsave(&cosa->lock, flags);
         add_wait_queue(&chan->rxwaitq, &wait);
         while (!chan->rx_status) {
-                current->state = TASK_INTERRUPTIBLE;
+                set_current_state(TASK_INTERRUPTIBLE);
                 spin_unlock_irqrestore(&cosa->lock, flags);
                 schedule();
                 spin_lock_irqsave(&cosa->lock, flags);
                 if (signal_pending(current) && chan->rx_status == 0) {
                         chan->rx_status = 1;
                         remove_wait_queue(&chan->rxwaitq, &wait);
-                        current->state = TASK_RUNNING;
+                        __set_current_state(TASK_RUNNING);
                         spin_unlock_irqrestore(&cosa->lock, flags);
                         mutex_unlock(&chan->rlock);
                         return -ERESTARTSYS;
                 }
         }
         remove_wait_queue(&chan->rxwaitq, &wait);
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
         kbuf = chan->rxdata;
         count = chan->rxsize;
         spin_unlock_irqrestore(&cosa->lock, flags);
@@ -890,14 +890,14 @@ static ssize_t cosa_write(struct file *file,
         spin_lock_irqsave(&cosa->lock, flags);
         add_wait_queue(&chan->txwaitq, &wait);
         while (!chan->tx_status) {
-                current->state = TASK_INTERRUPTIBLE;
+                set_current_state(TASK_INTERRUPTIBLE);
                 spin_unlock_irqrestore(&cosa->lock, flags);
                 schedule();
                 spin_lock_irqsave(&cosa->lock, flags);
                 if (signal_pending(current) && chan->tx_status == 0) {
                         chan->tx_status = 1;
                         remove_wait_queue(&chan->txwaitq, &wait);
-                        current->state = TASK_RUNNING;
+                        __set_current_state(TASK_RUNNING);
                         chan->tx_status = 1;
                         spin_unlock_irqrestore(&cosa->lock, flags);
                         up(&chan->wsem);
@@ -905,7 +905,7 @@ static ssize_t cosa_write(struct file *file,
                 }
         }
         remove_wait_queue(&chan->txwaitq, &wait);
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
         up(&chan->wsem);
         spin_unlock_irqrestore(&cosa->lock, flags);
         kfree(kbuf);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 4a4c6586a8d2..8908be6dbc48 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -946,7 +946,8 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
                 goto nla_put_failure;
 
         genlmsg_end(skb, msg_head);
-        genlmsg_unicast(&init_net, skb, dst_portid);
+        if (genlmsg_unicast(&init_net, skb, dst_portid))
+                goto err_free_txskb;
 
         /* Enqueue the packet */
         skb_queue_tail(&data->pending, my_skb);
@@ -955,6 +956,8 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         return;
 
 nla_put_failure:
+        nlmsg_free(skb);
+err_free_txskb:
         printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
         ieee80211_free_txskb(hw, my_skb);
         data->tx_failed++;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f7a31d2cb3f1..c4d68d768408 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -655,9 +655,15 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
         unsigned long flags;
 
         do {
+                int notify;
+
                 spin_lock_irqsave(&queue->response_lock, flags);
                 make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
+                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
                 spin_unlock_irqrestore(&queue->response_lock, flags);
+                if (notify)
+                        notify_remote_via_irq(queue->tx_irq);
+
                 if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1649,17 +1655,28 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
         struct pending_tx_info *pending_tx_info;
         pending_ring_idx_t index;
+        int notify;
         unsigned long flags;
 
         pending_tx_info = &queue->pending_tx_info[pending_idx];
+
         spin_lock_irqsave(&queue->response_lock, flags);
+
         make_tx_response(queue, &pending_tx_info->req, status);
-        index = pending_index(queue->pending_prod);
+
+        /* Release the pending index before pusing the Tx response so
+         * its available before a new Tx request is pushed by the
+         * frontend.
+         */
+        index = pending_index(queue->pending_prod++);
         queue->pending_ring[index] = pending_idx;
-        /* TX shouldn't use the index before we give it back here */
-        mb();
-        queue->pending_prod++;
+
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+
         spin_unlock_irqrestore(&queue->response_lock, flags);
+
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
 }
 
 
@@ -1669,7 +1686,6 @@ static void make_tx_response(struct xenvif_queue *queue,
 {
         RING_IDX i = queue->tx.rsp_prod_pvt;
         struct xen_netif_tx_response *resp;
-        int notify;
 
         resp = RING_GET_RESPONSE(&queue->tx, i);
         resp->id     = txp->id;
@@ -1679,9 +1695,6 @@ static void make_tx_response(struct xenvif_queue *queue,
                 RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;
 
         queue->tx.rsp_prod_pvt = ++i;
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
 
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c
index 1ec694a52379..464bf492ee2a 100644
--- a/drivers/pci/host/pci-versatile.c
+++ b/drivers/pci/host/pci-versatile.c
@@ -80,7 +80,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
         if (err)
                 return err;
 
-        resource_list_for_each_entry(win, res, list) {
+        resource_list_for_each_entry(win, res) {
                 struct resource *parent, *res = win->res;
 
                 switch (resource_type(res)) {
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 70a5d94cc766..b4f7744f6751 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -31,6 +31,7 @@
 #include <linux/io.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/suspend.h>
 #include <linux/uaccess.h>
 
 #include "rtc-at91rm9200.h"
@@ -54,6 +55,10 @@ static void __iomem *at91_rtc_regs;
 static int irq;
 static DEFINE_SPINLOCK(at91_rtc_lock);
 static u32 at91_rtc_shadow_imr;
+static bool suspended;
+static DEFINE_SPINLOCK(suspended_lock);
+static unsigned long cached_events;
+static u32 at91_rtc_imr;
 
 static void at91_rtc_write_ier(u32 mask)
 {
@@ -290,7 +295,9 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
         struct rtc_device *rtc = platform_get_drvdata(pdev);
         unsigned int rtsr;
         unsigned long events = 0;
+        int ret = IRQ_NONE;
 
+        spin_lock(&suspended_lock);
         rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read_imr();
         if (rtsr) {             /* this interrupt is shared!  Is it ours? */
                 if (rtsr & AT91_RTC_ALARM)
@@ -304,14 +311,22 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
 
                 at91_rtc_write(AT91_RTC_SCCR, rtsr);    /* clear status reg */
 
-                rtc_update_irq(rtc, 1, events);
+                if (!suspended) {
+                        rtc_update_irq(rtc, 1, events);
 
-                dev_dbg(&pdev->dev, "%s(): num=%ld, events=0x%02lx\n", __func__,
-                        events >> 8, events & 0x000000FF);
+                        dev_dbg(&pdev->dev, "%s(): num=%ld, events=0x%02lx\n",
+                                __func__, events >> 8, events & 0x000000FF);
+                } else {
+                        cached_events |= events;
+                        at91_rtc_write_idr(at91_rtc_imr);
+                        pm_system_wakeup();
+                }
 
-                return IRQ_HANDLED;
+                ret = IRQ_HANDLED;
         }
-        return IRQ_NONE;                /* not handled */
+        spin_lock(&suspended_lock);
+
+        return ret;
 }
 
 static const struct at91_rtc_config at91rm9200_config = {
@@ -401,8 +416,8 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
                                         AT91_RTC_CALEV);
 
         ret = devm_request_irq(&pdev->dev, irq, at91_rtc_interrupt,
-                                IRQF_SHARED,
-                                "at91_rtc", pdev);
+                               IRQF_SHARED | IRQF_COND_SUSPEND,
+                               "at91_rtc", pdev);
         if (ret) {
                 dev_err(&pdev->dev, "IRQ %d already in use.\n", irq);
                 return ret;
@@ -454,8 +469,6 @@ static void at91_rtc_shutdown(struct platform_device *pdev)
 
 /* AT91RM9200 RTC Power management control */
 
-static u32 at91_rtc_imr;
-
 static int at91_rtc_suspend(struct device *dev)
 {
         /* this IRQ is shared with DBGU and other hardware which isn't
@@ -464,21 +477,42 @@ static int at91_rtc_suspend(struct device *dev)
         at91_rtc_imr = at91_rtc_read_imr()
                         & (AT91_RTC_ALARM|AT91_RTC_SECEV);
         if (at91_rtc_imr) {
-                if (device_may_wakeup(dev))
+                if (device_may_wakeup(dev)) {
+                        unsigned long flags;
+
                         enable_irq_wake(irq);
-                else
+
+                        spin_lock_irqsave(&suspended_lock, flags);
+                        suspended = true;
+                        spin_unlock_irqrestore(&suspended_lock, flags);
+                } else {
                         at91_rtc_write_idr(at91_rtc_imr);
+                }
         }
         return 0;
 }
 
 static int at91_rtc_resume(struct device *dev)
 {
+        struct rtc_device *rtc = dev_get_drvdata(dev);
+
         if (at91_rtc_imr) {
-                if (device_may_wakeup(dev))
+                if (device_may_wakeup(dev)) {
+                        unsigned long flags;
+
+                        spin_lock_irqsave(&suspended_lock, flags);
+
+                        if (cached_events) {
+                                rtc_update_irq(rtc, 1, cached_events);
+                                cached_events = 0;
+                        }
+
+                        suspended = false;
+                        spin_unlock_irqrestore(&suspended_lock, flags);
+
                         disable_irq_wake(irq);
-                else
-                        at91_rtc_write_ier(at91_rtc_imr);
+                }
+                at91_rtc_write_ier(at91_rtc_imr);
         }
         return 0;
 }
diff --git a/drivers/rtc/rtc-at91sam9.c b/drivers/rtc/rtc-at91sam9.c
index 2183fd2750ab..5ccaee32df72 100644
--- a/drivers/rtc/rtc-at91sam9.c
+++ b/drivers/rtc/rtc-at91sam9.c
@@ -23,6 +23,7 @@
 #include <linux/io.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
+#include <linux/suspend.h>
 #include <linux/clk.h>
 
 /*
@@ -77,6 +78,9 @@ struct sam9_rtc {
         unsigned int            gpbr_offset;
         int                     irq;
         struct clk              *sclk;
+        bool                    suspended;
+        unsigned long           events;
+        spinlock_t              lock;
 };
 
 #define rtt_readl(rtc, field) \
@@ -271,14 +275,9 @@ static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
         return 0;
 }
 
-/*
- * IRQ handler for the RTC
- */
-static irqreturn_t at91_rtc_interrupt(int irq, void *_rtc)
+static irqreturn_t at91_rtc_cache_events(struct sam9_rtc *rtc)
 {
-        struct sam9_rtc *rtc = _rtc;
         u32 sr, mr;
-        unsigned long events = 0;
 
         /* Shared interrupt may be for another device.  Note: reading
          * SR clears it, so we must only read it in this irq handler!
@@ -290,18 +289,54 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *_rtc)
 
         /* alarm status */
         if (sr & AT91_RTT_ALMS)
-                events |= (RTC_AF | RTC_IRQF);
+                rtc->events |= (RTC_AF | RTC_IRQF);
 
         /* timer update/increment */
         if (sr & AT91_RTT_RTTINC)
-                events |= (RTC_UF | RTC_IRQF);
+                rtc->events |= (RTC_UF | RTC_IRQF);
+
+        return IRQ_HANDLED;
+}
+
+static void at91_rtc_flush_events(struct sam9_rtc *rtc)
+{
+        if (!rtc->events)
+                return;
 
-        rtc_update_irq(rtc->rtcdev, 1, events);
+        rtc_update_irq(rtc->rtcdev, 1, rtc->events);
+        rtc->events = 0;
 
         pr_debug("%s: num=%ld, events=0x%02lx\n", __func__,
-                events >> 8, events & 0x000000FF);
+                rtc->events >> 8, rtc->events & 0x000000FF);
+}
 
-        return IRQ_HANDLED;
+/*
+ * IRQ handler for the RTC
+ */
+static irqreturn_t at91_rtc_interrupt(int irq, void *_rtc)
+{
+        struct sam9_rtc *rtc = _rtc;
+        int ret;
+
+        spin_lock(&rtc->lock);
+
+        ret = at91_rtc_cache_events(rtc);
+
+        /* We're called in suspended state */
+        if (rtc->suspended) {
+                /* Mask irqs coming from this peripheral */
+                rtt_writel(rtc, MR,
+                           rtt_readl(rtc, MR) &
+                           ~(AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN));
+                /* Trigger a system wakeup */
+                pm_system_wakeup();
+        } else {
+                at91_rtc_flush_events(rtc);
+        }
+
+        spin_unlock(&rtc->lock);
+
+        return ret;
 }
 
 static const struct rtc_class_ops at91_rtc_ops = {
@@ -421,7 +456,8 @@ static int at91_rtc_probe(struct platform_device *pdev)
 
         /* register irq handler after we know what name we'll use */
         ret = devm_request_irq(&pdev->dev, rtc->irq, at91_rtc_interrupt,
-                                IRQF_SHARED, dev_name(&rtc->rtcdev->dev), rtc);
+                               IRQF_SHARED | IRQF_COND_SUSPEND,
+                               dev_name(&rtc->rtcdev->dev), rtc);
         if (ret) {
                 dev_dbg(&pdev->dev, "can't share IRQ %d?\n", rtc->irq);
                 return ret;
@@ -482,7 +518,12 @@ static int at91_rtc_suspend(struct device *dev)
         rtc->imr = mr & (AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN);
         if (rtc->imr) {
                 if (device_may_wakeup(dev) && (mr & AT91_RTT_ALMIEN)) {
+                        unsigned long flags;
+
                         enable_irq_wake(rtc->irq);
+                        spin_lock_irqsave(&rtc->lock, flags);
+                        rtc->suspended = true;
+                        spin_unlock_irqrestore(&rtc->lock, flags);
                         /* don't let RTTINC cause wakeups */
                         if (mr & AT91_RTT_RTTINCIEN)
                                 rtt_writel(rtc, MR, mr & ~AT91_RTT_RTTINCIEN);
@@ -499,10 +540,18 @@ static int at91_rtc_resume(struct device *dev)
         u32             mr;
 
         if (rtc->imr) {
+                unsigned long flags;
+
                 if (device_may_wakeup(dev))
                         disable_irq_wake(rtc->irq);
                 mr = rtt_readl(rtc, MR);
                 rtt_writel(rtc, MR, mr | rtc->imr);
+
+                spin_lock_irqsave(&rtc->lock, flags);
+                rtc->suspended = false;
+                at91_rtc_cache_events(rtc);
+                at91_rtc_flush_events(rtc);
+                spin_unlock_irqrestore(&rtc->lock, flags);
         }
 
         return 0;
diff --git a/drivers/rtc/rtc-ds1685.c b/drivers/rtc/rtc-ds1685.c
index 8c3bfcb115b7..803869c7d7c2 100644
--- a/drivers/rtc/rtc-ds1685.c
+++ b/drivers/rtc/rtc-ds1685.c
@@ -399,21 +399,21 @@ ds1685_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
          * of this RTC chip.  We check for it anyways in case support is
          * added in the future.
          */
-        if (unlikely((seconds >= 0xc0) && (seconds <= 0xff)))
+        if (unlikely(seconds >= 0xc0))
                 alrm->time.tm_sec = -1;
         else
                 alrm->time.tm_sec = ds1685_rtc_bcd2bin(rtc, seconds,
                                                        RTC_SECS_BCD_MASK,
                                                        RTC_SECS_BIN_MASK);
 
-        if (unlikely((minutes >= 0xc0) && (minutes <= 0xff)))
+        if (unlikely(minutes >= 0xc0))
                 alrm->time.tm_min = -1;
         else
                 alrm->time.tm_min = ds1685_rtc_bcd2bin(rtc, minutes,
                                                        RTC_MINS_BCD_MASK,
                                                        RTC_MINS_BIN_MASK);
 
-        if (unlikely((hours >= 0xc0) && (hours <= 0xff)))
+        if (unlikely(hours >= 0xc0))
                 alrm->time.tm_hour = -1;
         else
                 alrm->time.tm_hour = ds1685_rtc_bcd2bin(rtc, hours,
@@ -472,13 +472,13 @@ ds1685_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
          * field, and we only support four fields.  We put the support
          * here anyways for the future.
          */
-        if (unlikely((seconds >= 0xc0) && (seconds <= 0xff)))
+        if (unlikely(seconds >= 0xc0))
                 seconds = 0xff;
 
-        if (unlikely((minutes >= 0xc0) && (minutes <= 0xff)))
+        if (unlikely(minutes >= 0xc0))
                 minutes = 0xff;
 
-        if (unlikely((hours >= 0xc0) && (hours <= 0xff)))
+        if (unlikely(hours >= 0xc0))
                 hours = 0xff;
 
         alrm->time.tm_mon       = -1;
@@ -528,7 +528,6 @@ ds1685_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 /* ----------------------------------------------------------------------- */
 /* /dev/rtcX Interface functions */
 
-#ifdef CONFIG_RTC_INTF_DEV
 /**
  * ds1685_rtc_alarm_irq_enable - replaces ioctl() RTC_AIE on/off.
  * @dev: pointer to device structure.
@@ -557,7 +556,6 @@ ds1685_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 
         return 0;
 }
-#endif
 /* ----------------------------------------------------------------------- */
 
 
@@ -1612,7 +1610,7 @@ ds1685_rtc_sysfs_time_regs_show(struct device *dev,
                 ds1685_rtc_sysfs_time_regs_lookup(attr->attr.name, false);
 
         /* Make sure we actually matched something. */
-        if (!bcd_reg_info && !bin_reg_info)
+        if (!bcd_reg_info || !bin_reg_info)
                 return -EINVAL;
 
         /* bcd_reg_info->reg == bin_reg_info->reg. */
@@ -1650,7 +1648,7 @@ ds1685_rtc_sysfs_time_regs_store(struct device *dev,
                 return -EINVAL;
 
         /* Make sure we actually matched something. */
-        if (!bcd_reg_info && !bin_reg_info)
+        if (!bcd_reg_info || !bin_reg_info)
                 return -EINVAL;
 
         /* Check for a valid range. */
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index f3ee439d6f0e..cd4c293f0dd0 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -81,7 +81,9 @@ static int __init sh_pm_runtime_init(void)
                 if (!of_machine_is_compatible("renesas,emev2") &&
                     !of_machine_is_compatible("renesas,r7s72100") &&
                     !of_machine_is_compatible("renesas,r8a73a4") &&
+#ifndef CONFIG_PM_GENERIC_DOMAINS_OF
                     !of_machine_is_compatible("renesas,r8a7740") &&
+#endif
                     !of_machine_is_compatible("renesas,r8a7778") &&
                     !of_machine_is_compatible("renesas,r8a7779") &&
                     !of_machine_is_compatible("renesas,r8a7790") &&
diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index 9800c01e6fb9..3f72451d2de0 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -426,7 +426,6 @@ static int pci171x_ai_insn_read(struct comedi_device *dev,
                                 unsigned int *data)
 {
         struct pci1710_private *devpriv = dev->private;
-        unsigned int chan = CR_CHAN(insn->chanspec);
         int ret = 0;
         int i;
 
@@ -447,7 +446,7 @@ static int pci171x_ai_insn_read(struct comedi_device *dev,
                 if (ret)
                         break;
 
-                ret = pci171x_ai_read_sample(dev, s, chan, &val);
+                ret = pci171x_ai_read_sample(dev, s, 0, &val);
                 if (ret)
                         break;
 
diff --git a/drivers/staging/comedi/drivers/comedi_isadma.c b/drivers/staging/comedi/drivers/comedi_isadma.c
index dbdea71d6b95..e856f01ca077 100644
--- a/drivers/staging/comedi/drivers/comedi_isadma.c
+++ b/drivers/staging/comedi/drivers/comedi_isadma.c
@@ -91,9 +91,10 @@ unsigned int comedi_isadma_disable_on_sample(unsigned int dma_chan,
                         stalled++;
                         if (stalled > 10)
                                 break;
+                } else {
+                        residue = new_residue;
+                        stalled = 0;
                 }
-                residue = new_residue;
-                stalled = 0;
         }
         return residue;
 }
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index e37118321a27..a0906685e27f 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -103,11 +103,6 @@ enum vmk80xx_model {
         VMK8061_MODEL
 };
 
-struct firmware_version {
-        unsigned char ic3_vers[32];     /* USB-Controller */
-        unsigned char ic6_vers[32];     /* CPU */
-};
-
 static const struct comedi_lrange vmk8061_range = {
         2, {
                 UNI_RANGE(5),
@@ -156,68 +151,12 @@ static const struct vmk80xx_board vmk80xx_boardinfo[] = {
 struct vmk80xx_private {
         struct usb_endpoint_descriptor *ep_rx;
         struct usb_endpoint_descriptor *ep_tx;
-        struct firmware_version fw;
         struct semaphore limit_sem;
         unsigned char *usb_rx_buf;
         unsigned char *usb_tx_buf;
         enum vmk80xx_model model;
 };
 
-static int vmk80xx_check_data_link(struct comedi_device *dev)
-{
-        struct vmk80xx_private *devpriv = dev->private;
-        struct usb_device *usb = comedi_to_usb_dev(dev);
-        unsigned int tx_pipe;
-        unsigned int rx_pipe;
-        unsigned char tx[1];
-        unsigned char rx[2];
-
-        tx_pipe = usb_sndbulkpipe(usb, 0x01);
-        rx_pipe = usb_rcvbulkpipe(usb, 0x81);
-
-        tx[0] = VMK8061_CMD_RD_PWR_STAT;
-
-        /*
-         * Check that IC6 (PIC16F871) is powered and
-         * running and the data link between IC3 and
-         * IC6 is working properly
-         */
-        usb_bulk_msg(usb, tx_pipe, tx, 1, NULL, devpriv->ep_tx->bInterval);
-        usb_bulk_msg(usb, rx_pipe, rx, 2, NULL, HZ * 10);
-
-        return (int)rx[1];
-}
-
-static void vmk80xx_read_eeprom(struct comedi_device *dev, int flag)
-{
-        struct vmk80xx_private *devpriv = dev->private;
-        struct usb_device *usb = comedi_to_usb_dev(dev);
-        unsigned int tx_pipe;
-        unsigned int rx_pipe;
-        unsigned char tx[1];
-        unsigned char rx[64];
-        int cnt;
-
-        tx_pipe = usb_sndbulkpipe(usb, 0x01);
-        rx_pipe = usb_rcvbulkpipe(usb, 0x81);
-
-        tx[0] = VMK8061_CMD_RD_VERSION;
-
-        /*
-         * Read the firmware version info of IC3 and
-         * IC6 from the internal EEPROM of the IC
-         */
-        usb_bulk_msg(usb, tx_pipe, tx, 1, NULL, devpriv->ep_tx->bInterval);
-        usb_bulk_msg(usb, rx_pipe, rx, 64, &cnt, HZ * 10);
-
-        rx[cnt] = '\0';
-
-        if (flag & IC3_VERSION)
-                strncpy(devpriv->fw.ic3_vers, rx + 1, 24);
-        else                    /* IC6_VERSION */
-                strncpy(devpriv->fw.ic6_vers, rx + 25, 24);
-}
-
 static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
 {
         struct vmk80xx_private *devpriv = dev->private;
@@ -878,16 +817,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
 
         usb_set_intfdata(intf, devpriv);
 
-        if (devpriv->model == VMK8061_MODEL) {
-                vmk80xx_read_eeprom(dev, IC3_VERSION);
-                dev_info(&intf->dev, "%s\n", devpriv->fw.ic3_vers);
-
-                if (vmk80xx_check_data_link(dev)) {
-                        vmk80xx_read_eeprom(dev, IC6_VERSION);
-                        dev_info(&intf->dev, "%s\n", devpriv->fw.ic6_vers);
-                }
-        }
-
         if (devpriv->model == VMK8055_MODEL)
                 vmk80xx_reset_device(dev);
 
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index d9d6fad7cb00..816174388f13 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -214,11 +214,17 @@ struct mxs_lradc {
         unsigned long           is_divided;
 
         /*
-         * Touchscreen LRADC channels receives a private slot in the CTRL4
-         * register, the slot #7. Therefore only 7 slots instead of 8 in the
-         * CTRL4 register can be mapped to LRADC channels when using the
-         * touchscreen.
-         *
+         * When the touchscreen is enabled, we give it two private virtual
+         * channels: #6 and #7. This means that only 6 virtual channels (instead
+         * of 8) will be available for buffered capture.
+         */
+#define TOUCHSCREEN_VCHANNEL1           7
+#define TOUCHSCREEN_VCHANNEL2           6
+#define BUFFER_VCHANS_LIMITED           0x3f
+#define BUFFER_VCHANS_ALL               0xff
+        u8                      buffer_vchans;
+
+        /*
          * Furthermore, certain LRADC channels are shared between touchscreen
          * and/or touch-buttons and generic LRADC block. Therefore when using
          * either of these, these channels are not available for the regular
@@ -342,6 +348,9 @@ struct mxs_lradc {
 #define LRADC_CTRL4                             0x140
 #define LRADC_CTRL4_LRADCSELECT_MASK(n)         (0xf << ((n) * 4))
 #define LRADC_CTRL4_LRADCSELECT_OFFSET(n)       ((n) * 4)
+#define LRADC_CTRL4_LRADCSELECT(n, x) \
+                                (((x) << LRADC_CTRL4_LRADCSELECT_OFFSET(n)) & \
+                                LRADC_CTRL4_LRADCSELECT_MASK(n))
 
 #define LRADC_RESOLUTION                        12
 #define LRADC_SINGLE_SAMPLE_MASK                ((1 << LRADC_RESOLUTION) - 1)
@@ -416,6 +425,14 @@ static bool mxs_lradc_check_touch_event(struct mxs_lradc *lradc)
                                         LRADC_STATUS_TOUCH_DETECT_RAW);
 }
 
+static void mxs_lradc_map_channel(struct mxs_lradc *lradc, unsigned vch,
+                                  unsigned ch)
+{
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(vch),
+                                LRADC_CTRL4);
+        mxs_lradc_reg_set(lradc, LRADC_CTRL4_LRADCSELECT(vch, ch), LRADC_CTRL4);
+}
+
 static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch)
 {
         /*
@@ -450,12 +467,8 @@ static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch)
                 LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
                         LRADC_DELAY(3));
 
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
-                        LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
-                        LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch), LRADC_CTRL1);
 
-        /* wake us again, when the complete conversion is done */
-        mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch), LRADC_CTRL1);
         /*
          * after changing the touchscreen plates setting
          * the signals need some initial time to settle. Start the
@@ -509,12 +522,8 @@ static void mxs_lradc_setup_ts_pressure(struct mxs_lradc *lradc, unsigned ch1,
                 LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
                                         LRADC_DELAY(3));
 
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
-                        LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
-                        LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch2), LRADC_CTRL1);
 
-        /* wake us again, when the conversions are done */
-        mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch2), LRADC_CTRL1);
         /*
          * after changing the touchscreen plates setting
          * the signals need some initial time to settle. Start the
@@ -580,36 +589,6 @@ static unsigned mxs_lradc_read_ts_pressure(struct mxs_lradc *lradc,
 #define TS_CH_XM 4
 #define TS_CH_YM 5
 
-static int mxs_lradc_read_ts_channel(struct mxs_lradc *lradc)
-{
-        u32 reg;
-        int val;
-
-        reg = readl(lradc->base + LRADC_CTRL1);
-
-        /* only channels 3 to 5 are of interest here */
-        if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YP)) {
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YP) |
-                        LRADC_CTRL1_LRADC_IRQ(TS_CH_YP), LRADC_CTRL1);
-                val = mxs_lradc_read_raw_channel(lradc, TS_CH_YP);
-        } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_XM)) {
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_XM) |
-                        LRADC_CTRL1_LRADC_IRQ(TS_CH_XM), LRADC_CTRL1);
-                val = mxs_lradc_read_raw_channel(lradc, TS_CH_XM);
-        } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YM)) {
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YM) |
-                        LRADC_CTRL1_LRADC_IRQ(TS_CH_YM), LRADC_CTRL1);
-                val = mxs_lradc_read_raw_channel(lradc, TS_CH_YM);
-        } else {
-                return -EIO;
-        }
-
-        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
-        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
-
-        return val;
-}
-
 /*
  * YP(open)--+-------------+
  *           |             |--+
@@ -653,7 +632,8 @@ static void mxs_lradc_prepare_x_pos(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, mxs_lradc_drive_x_plate(lradc), LRADC_CTRL0);
 
         lradc->cur_plate = LRADC_SAMPLE_X;
-        mxs_lradc_setup_ts_channel(lradc, TS_CH_YP);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YP);
+        mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
 }
 
 /*
@@ -674,7 +654,8 @@ static void mxs_lradc_prepare_y_pos(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, mxs_lradc_drive_y_plate(lradc), LRADC_CTRL0);
 
         lradc->cur_plate = LRADC_SAMPLE_Y;
-        mxs_lradc_setup_ts_channel(lradc, TS_CH_XM);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_XM);
+        mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
 }
 
 /*
@@ -695,7 +676,10 @@ static void mxs_lradc_prepare_pressure(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, mxs_lradc_drive_pressure(lradc), LRADC_CTRL0);
 
         lradc->cur_plate = LRADC_SAMPLE_PRESSURE;
-        mxs_lradc_setup_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YM);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL2, TS_CH_XP);
+        mxs_lradc_setup_ts_pressure(lradc, TOUCHSCREEN_VCHANNEL2,
+                                                TOUCHSCREEN_VCHANNEL1);
 }
 
 static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc)
@@ -708,6 +692,19 @@ static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
 
+static void mxs_lradc_start_touch_event(struct mxs_lradc *lradc)
+{
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
+                                LRADC_CTRL1);
+        mxs_lradc_reg_set(lradc,
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
+        /*
+         * start with the Y-pos, because it uses nearly the same plate
+         * settings like the touch detection
+         */
+        mxs_lradc_prepare_y_pos(lradc);
+}
+
 static void mxs_lradc_report_ts_event(struct mxs_lradc *lradc)
 {
         input_report_abs(lradc->ts_input, ABS_X, lradc->ts_x_pos);
@@ -725,10 +722,12 @@ static void mxs_lradc_complete_touch_event(struct mxs_lradc *lradc)
          * start a dummy conversion to burn time to settle the signals
          * note: we are not interested in the conversion's value
          */
-        mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(5));
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
-        mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(5), LRADC_CTRL1);
-        mxs_lradc_reg_wrt(lradc, LRADC_DELAY_TRIGGER(1 << 5) |
+        mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(TOUCHSCREEN_VCHANNEL1));
+        mxs_lradc_reg_clear(lradc,
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
+        mxs_lradc_reg_wrt(lradc,
+                LRADC_DELAY_TRIGGER(1 << TOUCHSCREEN_VCHANNEL1) |
                 LRADC_DELAY_KICK | LRADC_DELAY_DELAY(10), /* waste 5 ms */
                         LRADC_DELAY(2));
 }
@@ -760,59 +759,45 @@ static void mxs_lradc_finish_touch_event(struct mxs_lradc *lradc, bool valid)
 
         /* if it is released, wait for the next touch via IRQ */
         lradc->cur_plate = LRADC_TOUCH;
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, LRADC_CTRL1);
+        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
+        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ |
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
         mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
 
 /* touchscreen's state machine */
 static void mxs_lradc_handle_touch(struct mxs_lradc *lradc)
 {
-        int val;
-
         switch (lradc->cur_plate) {
         case LRADC_TOUCH:
-                /*
-                 * start with the Y-pos, because it uses nearly the same plate
-                 * settings like the touch detection
-                 */
-                if (mxs_lradc_check_touch_event(lradc)) {
-                        mxs_lradc_reg_clear(lradc,
-                                        LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
-                                        LRADC_CTRL1);
-                        mxs_lradc_prepare_y_pos(lradc);
-                }
+                if (mxs_lradc_check_touch_event(lradc))
+                        mxs_lradc_start_touch_event(lradc);
                 mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ,
                                         LRADC_CTRL1);
                 return;
 
         case LRADC_SAMPLE_Y:
-                val = mxs_lradc_read_ts_channel(lradc);
-                if (val < 0) {
-                        mxs_lradc_enable_touch_detection(lradc); /* re-start */
-                        return;
-                }
-                lradc->ts_y_pos = val;
+                lradc->ts_y_pos = mxs_lradc_read_raw_channel(lradc,
+                                                        TOUCHSCREEN_VCHANNEL1);
                 mxs_lradc_prepare_x_pos(lradc);
                 return;
 
         case LRADC_SAMPLE_X:
-                val = mxs_lradc_read_ts_channel(lradc);
-                if (val < 0) {
-                        mxs_lradc_enable_touch_detection(lradc); /* re-start */
-                        return;
-                }
-                lradc->ts_x_pos = val;
+                lradc->ts_x_pos = mxs_lradc_read_raw_channel(lradc,
+                                                        TOUCHSCREEN_VCHANNEL1);
                 mxs_lradc_prepare_pressure(lradc);
                 return;
 
         case LRADC_SAMPLE_PRESSURE:
-                lradc->ts_pressure =
-                        mxs_lradc_read_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
+                lradc->ts_pressure = mxs_lradc_read_ts_pressure(lradc,
+                                                        TOUCHSCREEN_VCHANNEL2,
+                                                        TOUCHSCREEN_VCHANNEL1);
                 mxs_lradc_complete_touch_event(lradc);
                 return;
 
         case LRADC_SAMPLE_VALID:
-                val = mxs_lradc_read_ts_channel(lradc); /* ignore the value */
                 mxs_lradc_finish_touch_event(lradc, 1);
                 break;
         }
@@ -844,9 +829,9 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val)
          * used if doing raw sampling.
          */
         if (lradc->soc == IMX28_LRADC)
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
+                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(0),
                         LRADC_CTRL1);
-        mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+        mxs_lradc_reg_clear(lradc, 0x1, LRADC_CTRL0);
 
         /* Enable / disable the divider per requirement */
         if (test_bit(chan, &lradc->is_divided))
@@ -1090,9 +1075,8 @@ static void mxs_lradc_disable_ts(struct mxs_lradc *lradc)
 {
         /* stop all interrupts from firing */
         mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN |
-                LRADC_CTRL1_LRADC_IRQ_EN(2) | LRADC_CTRL1_LRADC_IRQ_EN(3) |
-                LRADC_CTRL1_LRADC_IRQ_EN(4) | LRADC_CTRL1_LRADC_IRQ_EN(5),
-                LRADC_CTRL1);
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
 
         /* Power-down touchscreen touch-detect circuitry. */
         mxs_lradc_reg_clear(lradc, mxs_lradc_plate_mask(lradc), LRADC_CTRL0);
@@ -1158,26 +1142,31 @@ static irqreturn_t mxs_lradc_handle_irq(int irq, void *data)
         struct iio_dev *iio = data;
         struct mxs_lradc *lradc = iio_priv(iio);
         unsigned long reg = readl(lradc->base + LRADC_CTRL1);
+        uint32_t clr_irq = mxs_lradc_irq_mask(lradc);
         const uint32_t ts_irq_mask =
                 LRADC_CTRL1_TOUCH_DETECT_IRQ |
-                LRADC_CTRL1_LRADC_IRQ(2) |
-                LRADC_CTRL1_LRADC_IRQ(3) |
-                LRADC_CTRL1_LRADC_IRQ(4) |
-                LRADC_CTRL1_LRADC_IRQ(5);
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2);
 
         if (!(reg & mxs_lradc_irq_mask(lradc)))
                 return IRQ_NONE;
 
-        if (lradc->use_touchscreen && (reg & ts_irq_mask))
+        if (lradc->use_touchscreen && (reg & ts_irq_mask)) {
                 mxs_lradc_handle_touch(lradc);
 
-        if (iio_buffer_enabled(iio))
-                iio_trigger_poll(iio->trig);
-        else if (reg & LRADC_CTRL1_LRADC_IRQ(0))
+                /* Make sure we don't clear the next conversion's interrupt. */
+                clr_irq &= ~(LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+                                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2));
+        }
+
+        if (iio_buffer_enabled(iio)) {
+                if (reg & lradc->buffer_vchans)
+                        iio_trigger_poll(iio->trig);
+        } else if (reg & LRADC_CTRL1_LRADC_IRQ(0)) {
                 complete(&lradc->completion);
+        }
 
-        mxs_lradc_reg_clear(lradc, reg & mxs_lradc_irq_mask(lradc),
-                        LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, reg & clr_irq, LRADC_CTRL1);
 
         return IRQ_HANDLED;
 }
@@ -1289,9 +1278,10 @@ static int mxs_lradc_buffer_preenable(struct iio_dev *iio)
         }
 
         if (lradc->soc == IMX28_LRADC)
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
-                                                        LRADC_CTRL1);
-        mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+                mxs_lradc_reg_clear(lradc,
+                        lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
+                        LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
 
         for_each_set_bit(chan, iio->active_scan_mask, LRADC_MAX_TOTAL_CHANS) {
                 ctrl4_set |= chan << LRADC_CTRL4_LRADCSELECT_OFFSET(ofs);
@@ -1324,10 +1314,11 @@ static int mxs_lradc_buffer_postdisable(struct iio_dev *iio)
         mxs_lradc_reg_clear(lradc, LRADC_DELAY_TRIGGER_LRADCS_MASK |
                                         LRADC_DELAY_KICK, LRADC_DELAY(0));
 
-        mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+        mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
         if (lradc->soc == IMX28_LRADC)
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
-                                        LRADC_CTRL1);
+                mxs_lradc_reg_clear(lradc,
+                        lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
+                        LRADC_CTRL1);
 
         kfree(lradc->buffer);
         mutex_unlock(&lradc->lock);
@@ -1353,7 +1344,7 @@ static bool mxs_lradc_validate_scan_mask(struct iio_dev *iio,
         if (lradc->use_touchbutton)
                 rsvd_chans++;
         if (lradc->use_touchscreen)
-                rsvd_chans++;
+                rsvd_chans += 2;
 
         /* Test for attempts to map channels with special mode of operation. */
         if (bitmap_intersects(mask, &rsvd_mask, LRADC_MAX_TOTAL_CHANS))
@@ -1413,6 +1404,13 @@ static const struct iio_chan_spec mxs_lradc_chan_spec[] = {
                 .channel = 8,
                 .scan_type = {.sign = 'u', .realbits = 18, .storagebits = 32,},
         },
+        /* Hidden channel to keep indexes */
+        {
+                .type = IIO_TEMP,
+                .indexed = 1,
+                .scan_index = -1,
+                .channel = 9,
+        },
         MXS_ADC_CHAN(10, IIO_VOLTAGE),  /* VDDIO */
         MXS_ADC_CHAN(11, IIO_VOLTAGE),  /* VTH */
         MXS_ADC_CHAN(12, IIO_VOLTAGE),  /* VDDA */
@@ -1583,6 +1581,11 @@ static int mxs_lradc_probe(struct platform_device *pdev)
 
         touch_ret = mxs_lradc_probe_touchscreen(lradc, node);
 
+        if (touch_ret == 0)
+                lradc->buffer_vchans = BUFFER_VCHANS_LIMITED;
+        else
+                lradc->buffer_vchans = BUFFER_VCHANS_ALL;
+
         /* Grab all IRQ sources */
         for (i = 0; i < of_cfg->irq_count; i++) {
                 lradc->irq[i] = platform_get_irq(pdev, i);
diff --git a/drivers/staging/iio/resolver/ad2s1200.c b/drivers/staging/iio/resolver/ad2s1200.c
index 017d2f8379b7..c17893b4918c 100644
--- a/drivers/staging/iio/resolver/ad2s1200.c
+++ b/drivers/staging/iio/resolver/ad2s1200.c
@@ -18,6 +18,7 @@
 #include <linux/delay.h>
 #include <linux/gpio.h>
 #include <linux/module.h>
+#include <linux/bitops.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
@@ -68,7 +69,7 @@ static int ad2s1200_read_raw(struct iio_dev *indio_dev,
                 break;
         case IIO_ANGL_VEL:
                 vel = (((s16)(st->rx[0])) << 4) | ((st->rx[1] & 0xF0) >> 4);
-                vel = (vel << 4) >> 4;
+                vel = sign_extend32(vel, 11);
                 *val = vel;
                 break;
         default:
diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
index 25d244cbbe8f..031018e7a65b 100644
--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
@@ -262,13 +262,12 @@ static int int3400_thermal_probe(struct platform_device *pdev)
         result = acpi_parse_art(priv->adev->handle, &priv->art_count,
                                 &priv->arts, true);
         if (result)
-                goto free_priv;
-
+                dev_dbg(&pdev->dev, "_ART table parsing error\n");
 
         result = acpi_parse_trt(priv->adev->handle, &priv->trt_count,
                                 &priv->trts, true);
         if (result)
-                goto free_art;
+                dev_dbg(&pdev->dev, "_TRT table parsing error\n");
 
         platform_set_drvdata(pdev, priv);
 
@@ -281,7 +280,7 @@ static int int3400_thermal_probe(struct platform_device *pdev)
                                                 &int3400_thermal_params, 0, 0);
         if (IS_ERR(priv->thermal)) {
                 result = PTR_ERR(priv->thermal);
-                goto free_trt;
+                goto free_art_trt;
         }
 
         priv->rel_misc_dev_res = acpi_thermal_rel_misc_device_add(
@@ -295,9 +294,8 @@ static int int3400_thermal_probe(struct platform_device *pdev)
 
 free_zone:
         thermal_zone_device_unregister(priv->thermal);
-free_trt:
+free_art_trt:
         kfree(priv->trts);
-free_art:
         kfree(priv->arts);
 free_priv:
         kfree(priv);
diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
index f88b08877025..1e25133d35e2 100644
--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
+++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
@@ -208,7 +208,7 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,
                                 trip_cnt, GFP_KERNEL);
                 if (!int34x_thermal_zone->aux_trips) {
                         ret = -ENOMEM;
-                        goto free_mem;
+                        goto err_trip_alloc;
                 }
                 trip_mask = BIT(trip_cnt) - 1;
                 int34x_thermal_zone->aux_trip_nr = trip_cnt;
@@ -248,14 +248,15 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,
                                                 0, 0);
         if (IS_ERR(int34x_thermal_zone->zone)) {
                 ret = PTR_ERR(int34x_thermal_zone->zone);
-                goto free_lpat;
+                goto err_thermal_zone;
         }
 
         return int34x_thermal_zone;
 
-free_lpat:
+err_thermal_zone:
         acpi_lpat_free_conversion_table(int34x_thermal_zone->lpat_table);
-free_mem:
+        kfree(int34x_thermal_zone->aux_trips);
+err_trip_alloc:
         kfree(int34x_thermal_zone);
         return ERR_PTR(ret);
 }
@@ -266,6 +267,7 @@ void int340x_thermal_zone_remove(struct int34x_thermal_zone
 {
         thermal_zone_device_unregister(int34x_thermal_zone->zone);
         acpi_lpat_free_conversion_table(int34x_thermal_zone->lpat_table);
+        kfree(int34x_thermal_zone->aux_trips);
         kfree(int34x_thermal_zone);
 }
 EXPORT_SYMBOL_GPL(int340x_thermal_zone_remove);
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index 6ceebd659dd4..12623bc02f46 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -688,6 +688,7 @@ static const struct x86_cpu_id intel_powerclamp_ids[] = {
         { X86_VENDOR_INTEL, 6, 0x45},
         { X86_VENDOR_INTEL, 6, 0x46},
         { X86_VENDOR_INTEL, 6, 0x4c},
+        { X86_VENDOR_INTEL, 6, 0x4d},
         { X86_VENDOR_INTEL, 6, 0x56},
         {}
 };
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 2580a4872f90..fe4e767018c4 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -387,21 +387,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 
         irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         if (irq) {
-                int ret;
-
                 /*
                  * platform has IRQ support.
                  * Then, driver uses common registers
-                 */
-
-                ret = devm_request_irq(dev, irq->start, rcar_thermal_irq, 0,
-                                       dev_name(dev), common);
-                if (ret) {
-                        dev_err(dev, "irq request failed\n ");
-                        return ret;
-                }
-
-                /*
                  * rcar_has_irq_support() will be enabled
                  */
                 res = platform_get_resource(pdev, IORESOURCE_MEM, mres++);
@@ -456,8 +444,16 @@ static int rcar_thermal_probe(struct platform_device *pdev)
         }
 
         /* enable temperature comparation */
-        if (irq)
+        if (irq) {
+                ret = devm_request_irq(dev, irq->start, rcar_thermal_irq, 0,
+                                       dev_name(dev), common);
+                if (ret) {
+                        dev_err(dev, "irq request failed\n ");
+                        goto error_unregister;
+                }
+
                 rcar_thermal_common_write(common, ENR, enr_bits);
+        }
 
         platform_set_drvdata(pdev, common);
 
@@ -467,9 +463,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 
 error_unregister:
         rcar_thermal_for_each_priv(priv, common) {
-                thermal_zone_device_unregister(priv->zone);
                 if (rcar_has_irq_support(priv))
                         rcar_thermal_irq_disable(priv);
+                thermal_zone_device_unregister(priv->zone);
         }
 
         pm_runtime_put(dev);
@@ -485,9 +481,9 @@ static int rcar_thermal_remove(struct platform_device *pdev)
         struct rcar_thermal_priv *priv;
 
         rcar_thermal_for_each_priv(priv, common) {
-                thermal_zone_device_unregister(priv->zone);
                 if (rcar_has_irq_support(priv))
                         rcar_thermal_irq_disable(priv);
+                thermal_zone_device_unregister(priv->zone);
         }
 
         pm_runtime_put(dev);
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index 933cd80a6bc5..1d30b0975651 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -682,6 +682,7 @@ static void exynos7_tmu_control(struct platform_device *pdev, bool on)
 
         if (on) {
                 con |= (1 << EXYNOS_TMU_CORE_EN_SHIFT);
+                con |= (1 << EXYNOS7_PD_DET_EN_SHIFT);
                 interrupt_en =
                         (of_thermal_is_trip_valid(tz, 7)
                         << EXYNOS7_TMU_INTEN_RISE7_SHIFT) |
@@ -704,9 +705,9 @@ static void exynos7_tmu_control(struct platform_device *pdev, bool on)
                         interrupt_en << EXYNOS_TMU_INTEN_FALL0_SHIFT;
         } else {
                 con &= ~(1 << EXYNOS_TMU_CORE_EN_SHIFT);
+                con &= ~(1 << EXYNOS7_PD_DET_EN_SHIFT);
                 interrupt_en = 0; /* Disable all interrupts */
         }
-        con |= 1 << EXYNOS7_PD_DET_EN_SHIFT;
 
         writel(interrupt_en, data->base + EXYNOS7_TMU_REG_INTEN);
         writel(con, data->base + EXYNOS_TMU_REG_CONTROL);
@@ -918,34 +919,16 @@ static irqreturn_t exynos_tmu_irq(int irq, void *id)
 }
 
 static const struct of_device_id exynos_tmu_match[] = {
-        {
-                .compatible = "samsung,exynos3250-tmu",
-        },
-        {
-                .compatible = "samsung,exynos4210-tmu",
-        },
-        {
-                .compatible = "samsung,exynos4412-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5250-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5260-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5420-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5420-tmu-ext-triminfo",
-        },
-        {
-                .compatible = "samsung,exynos5440-tmu",
-        },
-        {
-                .compatible = "samsung,exynos7-tmu",
-        },
-        {},
+        { .compatible = "samsung,exynos3250-tmu", },
+        { .compatible = "samsung,exynos4210-tmu", },
+        { .compatible = "samsung,exynos4412-tmu", },
+        { .compatible = "samsung,exynos5250-tmu", },
+        { .compatible = "samsung,exynos5260-tmu", },
+        { .compatible = "samsung,exynos5420-tmu", },
+        { .compatible = "samsung,exynos5420-tmu-ext-triminfo", },
+        { .compatible = "samsung,exynos5440-tmu", },
+        { .compatible = "samsung,exynos7-tmu", },
+        { /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, exynos_tmu_match);
 
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 48491d1a81d6..174d3bcf8bd7 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -899,6 +899,22 @@ thermal_cooling_device_trip_point_show(struct device *dev,
                 return sprintf(buf, "%d\n", instance->trip);
 }
 
+static struct attribute *cooling_device_attrs[] = {
+        &dev_attr_cdev_type.attr,
+        &dev_attr_max_state.attr,
+        &dev_attr_cur_state.attr,
+        NULL,
+};
+
+static const struct attribute_group cooling_device_attr_group = {
+        .attrs = cooling_device_attrs,
+};
+
+static const struct attribute_group *cooling_device_attr_groups[] = {
+        &cooling_device_attr_group,
+        NULL,
+};
+
 /* Device management */
 
 /**
@@ -1130,6 +1146,7 @@ __thermal_cooling_device_register(struct device_node *np,
         cdev->ops = ops;
         cdev->updated = false;
         cdev->device.class = &thermal_class;
+        cdev->device.groups = cooling_device_attr_groups;
         cdev->devdata = devdata;
         dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
         result = device_register(&cdev->device);
@@ -1139,21 +1156,6 @@ __thermal_cooling_device_register(struct device_node *np,
                 return ERR_PTR(result);
         }
 
-        /* sys I/F */
-        if (type) {
-                result = device_create_file(&cdev->device, &dev_attr_cdev_type);
-                if (result)
-                        goto unregister;
-        }
-
-        result = device_create_file(&cdev->device, &dev_attr_max_state);
-        if (result)
-                goto unregister;
-
-        result = device_create_file(&cdev->device, &dev_attr_cur_state);
-        if (result)
-                goto unregister;
-
         /* Add 'this' new cdev to the global cdev list */
         mutex_lock(&thermal_list_lock);
         list_add(&cdev->node, &thermal_cdev_list);
@@ -1163,11 +1165,6 @@ __thermal_cooling_device_register(struct device_node *np,
         bind_cdev(cdev);
 
         return cdev;
-
-unregister:
-        release_idr(&thermal_cdev_idr, &thermal_idr_lock, cdev->id);
-        device_unregister(&cdev->device);
-        return ERR_PTR(result);
 }
 
 /**
diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index 634b6ce0e63a..62a5d449c388 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1402,7 +1402,7 @@ int ti_bandgap_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int ti_bandgap_save_ctxt(struct ti_bandgap *bgp)
 {
         int i;
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index 3fb054a10f6a..a38c1756442a 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -429,7 +429,7 @@ int ti_thermal_unregister_cpu_cooling(struct ti_bandgap *bgp, int id)
 
         data = ti_bandgap_get_sensor_data(bgp, id);
 
-        if (data && data->cool_dev)
+        if (data)
                 cpufreq_cooling_unregister(data->cool_dev);
 
         return 0;
diff --git a/drivers/tty/bfin_jtag_comm.c b/drivers/tty/bfin_jtag_comm.c
index d7b198c400c7..ce24182f8514 100644
--- a/drivers/tty/bfin_jtag_comm.c
+++ b/drivers/tty/bfin_jtag_comm.c
@@ -210,18 +210,6 @@ bfin_jc_chars_in_buffer(struct tty_struct *tty)
         return circ_cnt(&bfin_jc_write_buf);
 }
 
-static void
-bfin_jc_wait_until_sent(struct tty_struct *tty, int timeout)
-{
-        unsigned long expire = jiffies + timeout;
-        while (!circ_empty(&bfin_jc_write_buf)) {
-                if (signal_pending(current))
-                        break;
-                if (time_after(jiffies, expire))
-                        break;
-        }
-}
-
 static const struct tty_operations bfin_jc_ops = {
         .open            = bfin_jc_open,
         .close           = bfin_jc_close,
@@ -230,7 +218,6 @@ static const struct tty_operations bfin_jc_ops = {
         .flush_chars     = bfin_jc_flush_chars,
         .write_room      = bfin_jc_write_room,
         .chars_in_buffer = bfin_jc_chars_in_buffer,
-        .wait_until_sent = bfin_jc_wait_until_sent,
 };
 
 static int __init bfin_jc_init(void)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index e3b9570a1eff..deae122c9c4b 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -2138,8 +2138,8 @@ int serial8250_do_startup(struct uart_port *port)
         /*
          * Clear the interrupt registers.
          */
-        if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-                serial_port_in(port, UART_RX);
+        serial_port_in(port, UART_LSR);
+        serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
 
@@ -2300,8 +2300,8 @@ dont_test_tx_en:
          * saved flags to avoid getting false values from polling
          * routines or the previous session.
          */
-        if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-                serial_port_in(port, UART_RX);
+        serial_port_in(port, UART_LSR);
+        serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
         up->lsr_saved_flags = 0;
@@ -2394,8 +2394,7 @@ void serial8250_do_shutdown(struct uart_port *port)
          * Read data port to reset things, and then unlink from
          * the IRQ chain.
          */
-        if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-                serial_port_in(port, UART_RX);
+        serial_port_in(port, UART_RX);
         serial8250_rpm_put(up);
 
         del_timer_sync(&up->timer);
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index e60116235836..2ab229ddee38 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -59,6 +59,8 @@ struct dw8250_data {
         u8                      usr_reg;
         int                     last_mcr;
         int                     line;
+        int                     msr_mask_on;
+        int                     msr_mask_off;
         struct clk              *clk;
         struct clk              *pclk;
         struct reset_control    *rst;
@@ -81,6 +83,12 @@ static inline int dw8250_modify_msr(struct uart_port *p, int offset, int value)
                 value &= ~UART_MSR_DCTS;
         }
 
+        /* Override any modem control signals if needed */
+        if (offset == UART_MSR) {
+                value |= d->msr_mask_on;
+                value &= ~d->msr_mask_off;
+        }
+
         return value;
 }
 
@@ -334,6 +342,30 @@ static int dw8250_probe_of(struct uart_port *p,
         if (id >= 0)
                 p->line = id;
 
+        if (of_property_read_bool(np, "dcd-override")) {
+                /* Always report DCD as active */
+                data->msr_mask_on |= UART_MSR_DCD;
+                data->msr_mask_off |= UART_MSR_DDCD;
+        }
+
+        if (of_property_read_bool(np, "dsr-override")) {
+                /* Always report DSR as active */
+                data->msr_mask_on |= UART_MSR_DSR;
+                data->msr_mask_off |= UART_MSR_DDSR;
+        }
+
+        if (of_property_read_bool(np, "cts-override")) {
+                /* Always report DSR as active */
+                data->msr_mask_on |= UART_MSR_DSR;
+                data->msr_mask_off |= UART_MSR_DDSR;
+        }
+
+        if (of_property_read_bool(np, "ri-override")) {
+                /* Always report Ring indicator as inactive */
+                data->msr_mask_off |= UART_MSR_RI;
+                data->msr_mask_off |= UART_MSR_TERI;
+        }
+
         /* clock got configured through clk api, all done */
         if (p->uartclk)
                 return 0;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index daf2c82984e9..892eb32cdef4 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -69,7 +69,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
                "Please send the output of lspci -vv, this\n"
                "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
                "manufacturer and name of serial board or\n"
-               "modem board to rmk+serial@arm.linux.org.uk.\n",
+               "modem board to <linux-serial@vger.kernel.org>.\n",
                pci_name(dev), str, dev->vendor, dev->device,
                dev->subsystem_vendor, dev->subsystem_device);
 }
@@ -1989,13 +1989,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
         },
         {
                 .vendor         = PCI_VENDOR_ID_INTEL,
-                .device         = PCI_DEVICE_ID_INTEL_QRK_UART,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_INTEL,
                 .device         = PCI_DEVICE_ID_INTEL_BSW_UART1,
                 .subvendor      = PCI_ANY_ID,
                 .subdevice      = PCI_ANY_ID,
@@ -2201,13 +2194,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
          */
         {
                 .vendor         = PCI_VENDOR_ID_PLX,
-                .device         = PCI_DEVICE_ID_PLX_9030,
-                .subvendor      = PCI_SUBVENDOR_ID_PERLE,
-                .subdevice      = PCI_ANY_ID,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_PLX,
                 .device         = PCI_DEVICE_ID_PLX_9050,
                 .subvendor      = PCI_SUBVENDOR_ID_EXSYS,
                 .subdevice      = PCI_SUBDEVICE_ID_EXSYS_4055,
@@ -5415,10 +5401,6 @@ static struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_b0_bt_2_115200 },
 
-        {       PCI_VENDOR_ID_WCH, PCI_DEVICE_ID_WCH_CH352_2S,
-                PCI_ANY_ID, PCI_ANY_ID,
-                0, 0, pbn_b0_bt_2_115200 },
-
         {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_wch384_4 },
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 846552bff67d..4e959c43f680 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -47,6 +47,7 @@
 #include <linux/gpio/consumer.h>
 #include <linux/err.h>
 #include <linux/irq.h>
+#include <linux/suspend.h>
 
 #include <asm/io.h>
 #include <asm/ioctls.h>
@@ -173,6 +174,12 @@ struct atmel_uart_port {
         bool                    ms_irq_enabled;
         bool                    is_usart;       /* usart or uart */
         struct timer_list       uart_timer;     /* uart timer */
+
+        bool                    suspended;
+        unsigned int            pending;
+        unsigned int            pending_status;
+        spinlock_t              lock_suspended;
+
         int (*prepare_rx)(struct uart_port *port);
         int (*prepare_tx)(struct uart_port *port);
         void (*schedule_rx)(struct uart_port *port);
@@ -1179,12 +1186,15 @@ static irqreturn_t atmel_interrupt(int irq, void *dev_id)
 {
         struct uart_port *port = dev_id;
         struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
-        unsigned int status, pending, pass_counter = 0;
+        unsigned int status, pending, mask, pass_counter = 0;
         bool gpio_handled = false;
 
+        spin_lock(&atmel_port->lock_suspended);
+
         do {
                 status = atmel_get_lines_status(port);
-                pending = status & UART_GET_IMR(port);
+                mask = UART_GET_IMR(port);
+                pending = status & mask;
                 if (!gpio_handled) {
                         /*
                          * Dealing with GPIO interrupt
@@ -1206,11 +1216,21 @@ static irqreturn_t atmel_interrupt(int irq, void *dev_id)
                 if (!pending)
                         break;
 
+                if (atmel_port->suspended) {
+                        atmel_port->pending |= pending;
+                        atmel_port->pending_status = status;
+                        UART_PUT_IDR(port, mask);
+                        pm_system_wakeup();
+                        break;
+                }
+
                 atmel_handle_receive(port, pending);
                 atmel_handle_status(port, pending, status);
                 atmel_handle_transmit(port, pending);
         } while (pass_counter++ < ATMEL_ISR_PASS_LIMIT);
 
+        spin_unlock(&atmel_port->lock_suspended);
+
         return pass_counter ? IRQ_HANDLED : IRQ_NONE;
 }
 
@@ -1742,7 +1762,8 @@ static int atmel_startup(struct uart_port *port)
         /*
          * Allocate the IRQ
          */
-        retval = request_irq(port->irq, atmel_interrupt, IRQF_SHARED,
+        retval = request_irq(port->irq, atmel_interrupt,
+                        IRQF_SHARED | IRQF_COND_SUSPEND,
                         tty ? tty->name : "atmel_serial", port);
         if (retval) {
                 dev_err(port->dev, "atmel_startup - Can't get irq\n");
@@ -2513,8 +2534,14 @@ static int atmel_serial_suspend(struct platform_device *pdev,
 
         /* we can not wake up if we're running on slow clock */
         atmel_port->may_wakeup = device_may_wakeup(&pdev->dev);
-        if (atmel_serial_clk_will_stop())
+        if (atmel_serial_clk_will_stop()) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&atmel_port->lock_suspended, flags);
+                atmel_port->suspended = true;
+                spin_unlock_irqrestore(&atmel_port->lock_suspended, flags);
                 device_set_wakeup_enable(&pdev->dev, 0);
+        }
 
         uart_suspend_port(&atmel_uart, port);
 
@@ -2525,6 +2552,18 @@ static int atmel_serial_resume(struct platform_device *pdev)
 {
         struct uart_port *port = platform_get_drvdata(pdev);
         struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+        unsigned long flags;
+
+        spin_lock_irqsave(&atmel_port->lock_suspended, flags);
+        if (atmel_port->pending) {
+                atmel_handle_receive(port, atmel_port->pending);
+                atmel_handle_status(port, atmel_port->pending,
+                                    atmel_port->pending_status);
+                atmel_handle_transmit(port, atmel_port->pending);
+                atmel_port->pending = 0;
+        }
+        atmel_port->suspended = false;
+        spin_unlock_irqrestore(&atmel_port->lock_suspended, flags);
 
         uart_resume_port(&atmel_uart, port);
         device_set_wakeup_enable(&pdev->dev, atmel_port->may_wakeup);
@@ -2593,6 +2632,8 @@ static int atmel_serial_probe(struct platform_device *pdev)
         port->backup_imr = 0;
         port->uart.line = ret;
 
+        spin_lock_init(&port->lock_suspended);
+
         ret = atmel_init_gpios(port, &pdev->dev);
         if (ret < 0)
                 dev_err(&pdev->dev, "%s",
diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 7ff61e24a195..33fb94f78967 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -133,10 +133,6 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
         if (of_find_property(np, "no-loopback-test", NULL))
                 port->flags |= UPF_SKIP_TEST;
 
-        ret = of_alias_get_id(np, "serial");
-        if (ret >= 0)
-                port->line = ret;
-
         port->dev = &ofdev->dev;
 
         switch (type) {
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index 594b63331ef4..bca975f5093b 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -293,8 +293,10 @@ static irqreturn_t sprd_handle_irq(int irq, void *dev_id)
 
         ims = serial_in(port, SPRD_IMSR);
 
-        if (!ims)
+        if (!ims) {
+                spin_unlock(&port->lock);
                 return IRQ_NONE;
+        }
 
         serial_out(port, SPRD_ICLR, ~0);
 
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 51f066aa375e..2bb4dfc02873 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1028,8 +1028,8 @@ EXPORT_SYMBOL(start_tty);
 /* We limit tty time update visibility to every 8 seconds or so. */
 static void tty_update_time(struct timespec *time)
 {
-        unsigned long sec = get_seconds() & ~7;
-        if ((long)(sec - time->tv_sec) > 0)
+        unsigned long sec = get_seconds();
+        if (abs(sec - time->tv_sec) & ~7)
                 time->tv_sec = sec;
 }
 
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index a5cf253b2544..632fc8152061 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -217,11 +217,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
 #endif
         if (!timeout)
                 timeout = MAX_SCHEDULE_TIMEOUT;
-        if (wait_event_interruptible_timeout(tty->write_wait,
-                        !tty_chars_in_buffer(tty), timeout) >= 0) {
-                if (tty->ops->wait_until_sent)
-                        tty->ops->wait_until_sent(tty, timeout);
-        }
+
+        timeout = wait_event_interruptible_timeout(tty->write_wait,
+                        !tty_chars_in_buffer(tty), timeout);
+        if (timeout <= 0)
+                return;
+
+        if (timeout == MAX_SCHEDULE_TIMEOUT)
+                timeout = 0;
+
+        if (tty->ops->wait_until_sent)
+                tty->ops->wait_until_sent(tty, timeout);
 }
 EXPORT_SYMBOL(tty_wait_until_sent);
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e78720b59d67..683617714e7c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1650,6 +1650,8 @@ static int acm_reset_resume(struct usb_interface *intf)
 
 static const struct usb_device_id acm_ids[] = {
         /* quirky and broken devices */
+        { USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */
+        .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
         { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
         .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
         { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 66abdbcfbfa5..11635537c052 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -501,6 +501,7 @@ static void async_completed(struct urb *urb)
         as->status = urb->status;
         signr = as->signr;
         if (signr) {
+                memset(&sinfo, 0, sizeof(sinfo));
                 sinfo.si_signo = as->signr;
                 sinfo.si_errno = as->status;
                 sinfo.si_code = SI_ASYNCIO;
@@ -2382,6 +2383,7 @@ static void usbdev_remove(struct usb_device *udev)
                 wake_up_all(&ps->wait);
                 list_del_init(&ps->list);
                 if (ps->discsignr) {
+                        memset(&sinfo, 0, sizeof(sinfo));
                         sinfo.si_signo = ps->discsignr;
                         sinfo.si_errno = EPIPE;
                         sinfo.si_code = SI_ASYNCIO;
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 172d64e585b6..52e0c4e5e48e 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -205,6 +205,18 @@ static void dwc3_omap_write_irq0_set(struct dwc3_omap *omap, u32 value)
                                                 omap->irq0_offset, value);
 }
 
+static void dwc3_omap_write_irqmisc_clr(struct dwc3_omap *omap, u32 value)
+{
+        dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_MISC +
+                                                omap->irqmisc_offset, value);
+}
+
+static void dwc3_omap_write_irq0_clr(struct dwc3_omap *omap, u32 value)
+{
+        dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_0 -
+                                                omap->irq0_offset, value);
+}
+
 static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
         enum omap_dwc3_vbus_id_status status)
 {
@@ -345,9 +357,23 @@ static void dwc3_omap_enable_irqs(struct dwc3_omap *omap)
 
 static void dwc3_omap_disable_irqs(struct dwc3_omap *omap)
 {
+        u32                     reg;
+
         /* disable all IRQs */
-        dwc3_omap_write_irqmisc_set(omap, 0x00);
-        dwc3_omap_write_irq0_set(omap, 0x00);
+        reg = USBOTGSS_IRQO_COREIRQ_ST;
+        dwc3_omap_write_irq0_clr(omap, reg);
+
+        reg = (USBOTGSS_IRQMISC_OEVT |
+                        USBOTGSS_IRQMISC_DRVVBUS_RISE |
+                        USBOTGSS_IRQMISC_CHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_IDPULLUP_RISE |
+                        USBOTGSS_IRQMISC_DRVVBUS_FALL |
+                        USBOTGSS_IRQMISC_CHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_IDPULLUP_FALL);
+
+        dwc3_omap_write_irqmisc_clr(omap, reg);
 }
 
 static u64 dwc3_omap_dma_mask = DMA_BIT_MASK(32);
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 75648145dc1b..c42765b3a060 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1161,7 +1161,6 @@ static ssize_t interf_grp_compatible_id_store(struct usb_os_desc *desc,
         if (desc->opts_mutex)
                 mutex_lock(desc->opts_mutex);
         memcpy(desc->ext_compat_id, page, l);
-        desc->ext_compat_id[l] = '\0';
 
         if (desc->opts_mutex)
                 mutex_unlock(desc->opts_mutex);
@@ -1192,7 +1191,6 @@ static ssize_t interf_grp_sub_compatible_id_store(struct usb_os_desc *desc,
         if (desc->opts_mutex)
                 mutex_lock(desc->opts_mutex);
         memcpy(desc->ext_compat_id + 8, page, l);
-        desc->ext_compat_id[l + 8] = '\0';
 
         if (desc->opts_mutex)
                 mutex_unlock(desc->opts_mutex);
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 426d69a9c018..a2612fb79eff 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -569,7 +569,7 @@ fail:
         return status;
 }
 
-const struct file_operations f_hidg_fops = {
+static const struct file_operations f_hidg_fops = {
         .owner          = THIS_MODULE,
         .open           = f_hidg_open,
         .release        = f_hidg_release,
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index c89e96cfa3e4..c0c3ef272714 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -417,7 +417,10 @@ static int pn_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                         return -EINVAL;
 
                 spin_lock(&port->lock);
-                __pn_reset(f);
+
+                if (fp->in_ep->driver_data)
+                        __pn_reset(f);
+
                 if (alt == 1) {
                         int i;
 
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index e07c50ced64d..e3dae47baef3 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -344,7 +344,7 @@ static struct usb_endpoint_descriptor ss_int_source_desc = {
         .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
 };
 
-struct usb_ss_ep_comp_descriptor ss_int_source_comp_desc = {
+static struct usb_ss_ep_comp_descriptor ss_int_source_comp_desc = {
         .bLength =              USB_DT_SS_EP_COMP_SIZE,
         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
 
@@ -362,7 +362,7 @@ static struct usb_endpoint_descriptor ss_int_sink_desc = {
         .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
 };
 
-struct usb_ss_ep_comp_descriptor ss_int_sink_comp_desc = {
+static struct usb_ss_ep_comp_descriptor ss_int_sink_comp_desc = {
         .bLength =              USB_DT_SS_EP_COMP_SIZE,
         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
 
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 33e16658e5cf..6d3eb8b00a48 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -54,7 +54,7 @@
 #define UNFLW_CTRL      8
 #define OVFLW_CTRL      10
 
-const char *uac2_name = "snd_uac2";
+static const char *uac2_name = "snd_uac2";
 
 struct uac2_req {
         struct uac2_rtd_params *pp; /* parent param */
@@ -634,7 +634,7 @@ static struct usb_interface_descriptor std_ac_if_desc = {
 };
 
 /* Clock source for IN traffic */
-struct uac_clock_source_descriptor in_clk_src_desc = {
+static struct uac_clock_source_descriptor in_clk_src_desc = {
         .bLength = sizeof in_clk_src_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -646,7 +646,7 @@ struct uac_clock_source_descriptor in_clk_src_desc = {
 };
 
 /* Clock source for OUT traffic */
-struct uac_clock_source_descriptor out_clk_src_desc = {
+static struct uac_clock_source_descriptor out_clk_src_desc = {
         .bLength = sizeof out_clk_src_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -658,7 +658,7 @@ struct uac_clock_source_descriptor out_clk_src_desc = {
 };
 
 /* Input Terminal for USB_OUT */
-struct uac2_input_terminal_descriptor usb_out_it_desc = {
+static struct uac2_input_terminal_descriptor usb_out_it_desc = {
         .bLength = sizeof usb_out_it_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -672,7 +672,7 @@ struct uac2_input_terminal_descriptor usb_out_it_desc = {
 };
 
 /* Input Terminal for I/O-In */
-struct uac2_input_terminal_descriptor io_in_it_desc = {
+static struct uac2_input_terminal_descriptor io_in_it_desc = {
         .bLength = sizeof io_in_it_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -686,7 +686,7 @@ struct uac2_input_terminal_descriptor io_in_it_desc = {
 };
 
 /* Ouput Terminal for USB_IN */
-struct uac2_output_terminal_descriptor usb_in_ot_desc = {
+static struct uac2_output_terminal_descriptor usb_in_ot_desc = {
         .bLength = sizeof usb_in_ot_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -700,7 +700,7 @@ struct uac2_output_terminal_descriptor usb_in_ot_desc = {
 };
 
 /* Ouput Terminal for I/O-Out */
-struct uac2_output_terminal_descriptor io_out_ot_desc = {
+static struct uac2_output_terminal_descriptor io_out_ot_desc = {
         .bLength = sizeof io_out_ot_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -713,7 +713,7 @@ struct uac2_output_terminal_descriptor io_out_ot_desc = {
         .bmControls = (CONTROL_RDWR << COPY_CTRL),
 };
 
-struct uac2_ac_header_descriptor ac_hdr_desc = {
+static struct uac2_ac_header_descriptor ac_hdr_desc = {
         .bLength = sizeof ac_hdr_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -751,7 +751,7 @@ static struct usb_interface_descriptor std_as_out_if1_desc = {
 };
 
 /* Audio Stream OUT Intface Desc */
-struct uac2_as_header_descriptor as_out_hdr_desc = {
+static struct uac2_as_header_descriptor as_out_hdr_desc = {
         .bLength = sizeof as_out_hdr_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -764,7 +764,7 @@ struct uac2_as_header_descriptor as_out_hdr_desc = {
 };
 
 /* Audio USB_OUT Format */
-struct uac2_format_type_i_descriptor as_out_fmt1_desc = {
+static struct uac2_format_type_i_descriptor as_out_fmt1_desc = {
         .bLength = sizeof as_out_fmt1_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
         .bDescriptorSubtype = UAC_FORMAT_TYPE,
@@ -772,7 +772,7 @@ struct uac2_format_type_i_descriptor as_out_fmt1_desc = {
 };
 
 /* STD AS ISO OUT Endpoint */
-struct usb_endpoint_descriptor fs_epout_desc = {
+static struct usb_endpoint_descriptor fs_epout_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -782,7 +782,7 @@ struct usb_endpoint_descriptor fs_epout_desc = {
         .bInterval = 1,
 };
 
-struct usb_endpoint_descriptor hs_epout_desc = {
+static struct usb_endpoint_descriptor hs_epout_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -828,7 +828,7 @@ static struct usb_interface_descriptor std_as_in_if1_desc = {
 };
 
 /* Audio Stream IN Intface Desc */
-struct uac2_as_header_descriptor as_in_hdr_desc = {
+static struct uac2_as_header_descriptor as_in_hdr_desc = {
         .bLength = sizeof as_in_hdr_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -841,7 +841,7 @@ struct uac2_as_header_descriptor as_in_hdr_desc = {
 };
 
 /* Audio USB_IN Format */
-struct uac2_format_type_i_descriptor as_in_fmt1_desc = {
+static struct uac2_format_type_i_descriptor as_in_fmt1_desc = {
         .bLength = sizeof as_in_fmt1_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
         .bDescriptorSubtype = UAC_FORMAT_TYPE,
@@ -849,7 +849,7 @@ struct uac2_format_type_i_descriptor as_in_fmt1_desc = {
 };
 
 /* STD AS ISO IN Endpoint */
-struct usb_endpoint_descriptor fs_epin_desc = {
+static struct usb_endpoint_descriptor fs_epin_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -859,7 +859,7 @@ struct usb_endpoint_descriptor fs_epin_desc = {
         .bInterval = 1,
 };
 
-struct usb_endpoint_descriptor hs_epin_desc = {
+static struct usb_endpoint_descriptor hs_epin_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -1563,7 +1563,7 @@ static void afunc_unbind(struct usb_configuration *c, struct usb_function *f)
                 agdev->out_ep->driver_data = NULL;
 }
 
-struct usb_function *afunc_alloc(struct usb_function_instance *fi)
+static struct usb_function *afunc_alloc(struct usb_function_instance *fi)
 {
         struct audio_dev *agdev;
         struct f_uac2_opts *opts;
diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c
index 5aad7fededa5..8b818fd027b3 100644
--- a/drivers/usb/gadget/function/uvc_v4l2.c
+++ b/drivers/usb/gadget/function/uvc_v4l2.c
@@ -27,6 +27,7 @@
 #include "uvc.h"
 #include "uvc_queue.h"
 #include "uvc_video.h"
+#include "uvc_v4l2.h"
 
 /* --------------------------------------------------------------------------
  * Requests handling
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 9cb86bc1a9a5..50a5e637ca35 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -21,6 +21,7 @@
 
 #include "uvc.h"
 #include "uvc_queue.h"
+#include "uvc_video.h"
 
 /* --------------------------------------------------------------------------
  * Video codecs
diff --git a/drivers/usb/gadget/legacy/g_ffs.c b/drivers/usb/gadget/legacy/g_ffs.c
index 06acfa55864a..b01b88e1b716 100644
--- a/drivers/usb/gadget/legacy/g_ffs.c
+++ b/drivers/usb/gadget/legacy/g_ffs.c
@@ -133,7 +133,9 @@ struct gfs_configuration {
         struct usb_configuration c;
         int (*eth)(struct usb_configuration *c);
         int num;
-} gfs_configurations[] = {
+};
+
+static struct gfs_configuration gfs_configurations[] = {
 #ifdef CONFIG_USB_FUNCTIONFS_RNDIS
         {
                 .eth            = bind_rndis_config,
@@ -278,7 +280,7 @@ static void *functionfs_acquire_dev(struct ffs_dev *dev)
         if (!try_module_get(THIS_MODULE))
                 return ERR_PTR(-ENOENT);
         
-        return 0;
+        return NULL;
 }
 
 static void functionfs_release_dev(struct ffs_dev *dev)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7f76c8a12f89..fd53c9ebd662 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -37,6 +37,9 @@
 
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI      0x8c31
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
+#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI             0x22b5
+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI         0xa12f
+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI        0x9d2f
 
 static const char hcd_name[] = "xhci_hcd";
 
@@ -133,6 +136,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
                 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
         }
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+                (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
+                xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+        }
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                         pdev->device == PCI_DEVICE_ID_EJ168) {
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
@@ -159,6 +168,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                                 "QUIRK: Resetting on resume");
 }
 
+/*
+ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
+ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
+ */
+static void xhci_pme_quirk(struct xhci_hcd *xhci)
+{
+        u32 val;
+        void __iomem *reg;
+
+        reg = (void __iomem *) xhci->cap_regs + 0x80a4;
+        val = readl(reg);
+        writel(val | BIT(28), reg);
+        readl(reg);
+}
+
 /* called during probe() after chip reset completes */
 static int xhci_pci_setup(struct usb_hcd *hcd)
 {
@@ -283,6 +307,9 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
         if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
                 pdev->no_d3cold = true;
 
+        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+                xhci_pme_quirk(xhci);
+
         return xhci_suspend(xhci, do_wakeup);
 }
 
@@ -313,6 +340,9 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
         if (pdev->vendor == PCI_VENDOR_ID_INTEL)
                 usb_enable_intel_xhci_ports(pdev);
 
+        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+                xhci_pme_quirk(xhci);
+
         retval = xhci_resume(xhci, hibernated);
         return retval;
 }
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 08d402b15482..0e11d61408ff 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -83,16 +83,6 @@ static int xhci_plat_probe(struct platform_device *pdev)
         if (irq < 0)
                 return -ENODEV;
 
-
-        if (of_device_is_compatible(pdev->dev.of_node,
-                                    "marvell,armada-375-xhci") ||
-            of_device_is_compatible(pdev->dev.of_node,
-                                    "marvell,armada-380-xhci")) {
-                ret = xhci_mvebu_mbus_init_quirk(pdev);
-                if (ret)
-                        return ret;
-        }
-
         /* Initialize dma_mask and coherent_dma_mask to 32-bits */
         ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
         if (ret)
@@ -127,6 +117,15 @@ static int xhci_plat_probe(struct platform_device *pdev)
                         goto put_hcd;
         }
 
+        if (of_device_is_compatible(pdev->dev.of_node,
+                                    "marvell,armada-375-xhci") ||
+            of_device_is_compatible(pdev->dev.of_node,
+                                    "marvell,armada-380-xhci")) {
+                ret = xhci_mvebu_mbus_init_quirk(pdev);
+                if (ret)
+                        goto disable_clk;
+        }
+
         ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (ret)
                 goto disable_clk;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 88da8d629820..5fb66db89e05 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1729,7 +1729,7 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
         if (!command)
                 return;
 
-        ep->ep_state |= EP_HALTED;
+        ep->ep_state |= EP_HALTED | EP_RECENTLY_HALTED;
         ep->stopped_stream = stream_id;
 
         xhci_queue_reset_ep(xhci, command, slot_id, ep_index);
@@ -1946,7 +1946,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
         if (event_trb != ep_ring->dequeue) {
                 /* The event was for the status stage */
                 if (event_trb == td->last_trb) {
-                        if (td->urb->actual_length != 0) {
+                        if (td->urb_length_set) {
                                 /* Don't overwrite a previously set error code
                                  */
                                 if ((*status == -EINPROGRESS || *status == 0) &&
@@ -1960,7 +1960,13 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                         td->urb->transfer_buffer_length;
                         }
                 } else {
-                /* Maybe the event was for the data stage? */
+                        /*
+                         * Maybe the event was for the data stage? If so, update
+                         * already the actual_length of the URB and flag it as
+                         * set, so that it is not overwritten in the event for
+                         * the last TRB.
+                         */
+                        td->urb_length_set = true;
                         td->urb->actual_length =
                                 td->urb->transfer_buffer_length -
                                 EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index ec8ac1674854..b06d1a53652d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1338,6 +1338,12 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                 goto exit;
         }
 
+        /* Reject urb if endpoint is in soft reset, queue must stay empty */
+        if (xhci->devs[slot_id]->eps[ep_index].ep_state & EP_CONFIG_PENDING) {
+                xhci_warn(xhci, "Can't enqueue URB while ep is in soft reset\n");
+                ret = -EINVAL;
+        }
+
         if (usb_endpoint_xfer_isoc(&urb->ep->desc))
                 size = urb->number_of_packets;
         else
@@ -2948,23 +2954,36 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
         }
 }
 
-/* Called when clearing halted device. The core should have sent the control
+/* Called after clearing a halted device. USB core should have sent the control
  * message to clear the device halt condition. The host side of the halt should
- * already be cleared with a reset endpoint command issued when the STALL tx
- * event was received.
- *
- * Context: in_interrupt
+ * already be cleared with a reset endpoint command issued immediately when the
+ * STALL tx event was received.
  */
 
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                 struct usb_host_endpoint *ep)
 {
         struct xhci_hcd *xhci;
+        struct usb_device *udev;
+        struct xhci_virt_device *virt_dev;
+        struct xhci_virt_ep *virt_ep;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        struct xhci_command *command;
+        unsigned int ep_index, ep_state;
+        unsigned long flags;
+        u32 ep_flag;
 
         xhci = hcd_to_xhci(hcd);
+        udev = (struct usb_device *) ep->hcpriv;
+        if (!ep->hcpriv)
+                return;
+        virt_dev = xhci->devs[udev->slot_id];
+        ep_index = xhci_get_endpoint_index(&ep->desc);
+        virt_ep = &virt_dev->eps[ep_index];
+        ep_state = virt_ep->ep_state;
 
         /*
-         * We might need to implement the config ep cmd in xhci 4.8.1 note:
+         * Implement the config ep command in xhci 4.6.8 additional note:
          * The Reset Endpoint Command may only be issued to endpoints in the
          * Halted state. If software wishes reset the Data Toggle or Sequence
          * Number of an endpoint that isn't in the Halted state, then software
@@ -2972,9 +2991,72 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
          * for the target endpoint. that is in the Stopped state.
          */
 
-        /* For now just print debug to follow the situation */
-        xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
-                 ep->desc.bEndpointAddress);
+        if (ep_state & SET_DEQ_PENDING || ep_state & EP_RECENTLY_HALTED) {
+                virt_ep->ep_state &= ~EP_RECENTLY_HALTED;
+                xhci_dbg(xhci, "ep recently halted, no toggle reset needed\n");
+                return;
+        }
+
+        /* Only interrupt and bulk ep's use Data toggle, USB2 spec 5.5.4-> */
+        if (usb_endpoint_xfer_control(&ep->desc) ||
+            usb_endpoint_xfer_isoc(&ep->desc))
+                return;
+
+        ep_flag = xhci_get_endpoint_flag(&ep->desc);
+
+        if (ep_flag == SLOT_FLAG || ep_flag == EP0_FLAG)
+                return;
+
+        command = xhci_alloc_command(xhci, true, true, GFP_NOWAIT);
+        if (!command) {
+                xhci_err(xhci, "Could not allocate xHCI command structure.\n");
+                return;
+        }
+
+        spin_lock_irqsave(&xhci->lock, flags);
+
+        /* block ringing ep doorbell */
+        virt_ep->ep_state |= EP_CONFIG_PENDING;
+
+        /*
+         * Make sure endpoint ring is empty before resetting the toggle/seq.
+         * Driver is required to synchronously cancel all transfer request.
+         *
+         * xhci 4.6.6 says we can issue a configure endpoint command on a
+         * running endpoint ring as long as it's idle (queue empty)
+         */
+
+        if (!list_empty(&virt_ep->ring->td_list)) {
+                dev_err(&udev->dev, "EP not empty, refuse reset\n");
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                goto cleanup;
+        }
+
+        xhci_dbg(xhci, "Reset toggle/seq for slot %d, ep_index: %d\n",
+                 udev->slot_id, ep_index);
+
+        ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
+        if (!ctrl_ctx) {
+                xhci_err(xhci, "Could not get input context, bad type. virt_dev: %p, in_ctx %p\n",
+                         virt_dev, virt_dev->in_ctx);
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                goto cleanup;
+        }
+        xhci_setup_input_ctx_for_config_ep(xhci, command->in_ctx,
+                                           virt_dev->out_ctx, ctrl_ctx,
+                                           ep_flag, ep_flag);
+        xhci_endpoint_copy(xhci, command->in_ctx, virt_dev->out_ctx, ep_index);
+
+        xhci_queue_configure_endpoint(xhci, command, command->in_ctx->dma,
+                                     udev->slot_id, false);
+        xhci_ring_cmd_db(xhci);
+        spin_unlock_irqrestore(&xhci->lock, flags);
+
+        wait_for_completion(command->completion);
+
+cleanup:
+        virt_ep->ep_state &= ~EP_CONFIG_PENDING;
+        xhci_free_command(xhci, command);
 }
 
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 974514762a14..265ab1771d24 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1,3 +1,4 @@
+
 /*
  * xHCI host controller driver
  *
@@ -88,9 +89,10 @@ struct xhci_cap_regs {
 #define HCS_IST(p)              (((p) >> 0) & 0xf)
 /* bits 4:7, max number of Event Ring segments */
 #define HCS_ERST_MAX(p)         (((p) >> 4) & 0xf)
+/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
 /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
-#define HCS_MAX_SCRATCHPAD(p)   (((p) >> 27) & 0x1f)
+/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
+#define HCS_MAX_SCRATCHPAD(p)   ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
 
 /* HCSPARAMS3 - hcs_params3 - bitmasks */
 /* bits 0:7, Max U1 to U0 latency for the roothub ports */
@@ -863,6 +865,8 @@ struct xhci_virt_ep {
 #define EP_HAS_STREAMS          (1 << 4)
 /* Transitioning the endpoint to not using streams, don't enqueue URBs */
 #define EP_GETTING_NO_STREAMS   (1 << 5)
+#define EP_RECENTLY_HALTED      (1 << 6)
+#define EP_CONFIG_PENDING       (1 << 7)
         /* ----  Related to URB cancellation ---- */
         struct list_head        cancelled_td_list;
         struct xhci_td          *stopped_td;
@@ -1288,6 +1292,8 @@ struct xhci_td {
         struct xhci_segment     *start_seg;
         union xhci_trb          *first_trb;
         union xhci_trb          *last_trb;
+        /* actual_length of the URB has already been set */
+        bool                    urb_length_set;
 };
 
 /* xHCI command default timeout value */
@@ -1560,6 +1566,7 @@ struct xhci_hcd {
 #define XHCI_SPURIOUS_WAKEUP    (1 << 18)
 /* For controllers with a broken beyond repair streams implementation */
 #define XHCI_BROKEN_STREAMS     (1 << 19)
+#define XHCI_PME_STUCK_QUIRK    (1 << 20)
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
         /* There are two roothubs to keep track of bus suspend info for */
diff --git a/drivers/usb/isp1760/isp1760-hcd.c b/drivers/usb/isp1760/isp1760-hcd.c
index eba9b82e2d70..3cb98b1d5d29 100644
--- a/drivers/usb/isp1760/isp1760-hcd.c
+++ b/drivers/usb/isp1760/isp1760-hcd.c
@@ -1274,7 +1274,7 @@ static void errata2_function(unsigned long data)
         for (slot = 0; slot < 32; slot++)
                 if (priv->atl_slots[slot].qh && time_after(jiffies,
                                         priv->atl_slots[slot].timestamp +
-                                        SLOT_TIMEOUT * HZ / 1000)) {
+                                        msecs_to_jiffies(SLOT_TIMEOUT))) {
                         ptd_read(hcd->regs, ATL_PTD_OFFSET, slot, &ptd);
                         if (!FROM_DW0_VALID(ptd.dw0) &&
                                         !FROM_DW3_ACTIVE(ptd.dw3))
@@ -1286,7 +1286,7 @@ static void errata2_function(unsigned long data)
 
         spin_unlock_irqrestore(&priv->lock, spinflags);
 
-        errata2_timer.expires = jiffies + SLOT_CHECK_PERIOD * HZ / 1000;
+        errata2_timer.expires = jiffies + msecs_to_jiffies(SLOT_CHECK_PERIOD);
         add_timer(&errata2_timer);
 }
 
@@ -1336,7 +1336,7 @@ static int isp1760_run(struct usb_hcd *hcd)
                 return retval;
 
         setup_timer(&errata2_timer, errata2_function, (unsigned long)hcd);
-        errata2_timer.expires = jiffies + SLOT_CHECK_PERIOD * HZ / 1000;
+        errata2_timer.expires = jiffies + msecs_to_jiffies(SLOT_CHECK_PERIOD);
         add_timer(&errata2_timer);
 
         chipid = reg_read32(hcd->regs, HC_CHIP_ID_REG);
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index e6f4cbfeed97..067920f2d570 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1969,10 +1969,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
                 goto fail0;
         }
 
-        pm_runtime_use_autosuspend(musb->controller);
-        pm_runtime_set_autosuspend_delay(musb->controller, 200);
-        pm_runtime_enable(musb->controller);
-
         spin_lock_init(&musb->lock);
         musb->board_set_power = plat->set_power;
         musb->min_power = plat->min_power;
@@ -1991,6 +1987,12 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         musb_readl = musb_default_readl;
         musb_writel = musb_default_writel;
 
+        /* We need musb_read/write functions initialized for PM */
+        pm_runtime_use_autosuspend(musb->controller);
+        pm_runtime_set_autosuspend_delay(musb->controller, 200);
+        pm_runtime_irq_safe(musb->controller);
+        pm_runtime_enable(musb->controller);
+
         /* The musb_platform_init() call:
          *   - adjusts musb->mregs
          *   - sets the musb->isr
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 53bd0e71d19f..a900c9877195 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -457,12 +457,27 @@ static int dsps_musb_init(struct musb *musb)
         if (IS_ERR(musb->xceiv))
                 return PTR_ERR(musb->xceiv);
 
+        musb->phy = devm_phy_get(dev->parent, "usb2-phy");
+
         /* Returns zero if e.g. not clocked */
         rev = dsps_readl(reg_base, wrp->revision);
         if (!rev)
                 return -ENODEV;
 
         usb_phy_init(musb->xceiv);
+        if (IS_ERR(musb->phy))  {
+                musb->phy = NULL;
+        } else {
+                ret = phy_init(musb->phy);
+                if (ret < 0)
+                        return ret;
+                ret = phy_power_on(musb->phy);
+                if (ret) {
+                        phy_exit(musb->phy);
+                        return ret;
+                }
+        }
+
         setup_timer(&glue->timer, otg_timer, (unsigned long) musb);
 
         /* Reset the musb */
@@ -502,6 +517,8 @@ static int dsps_musb_exit(struct musb *musb)
 
         del_timer_sync(&glue->timer);
         usb_phy_shutdown(musb->xceiv);
+        phy_power_off(musb->phy);
+        phy_exit(musb->phy);
         debugfs_remove_recursive(glue->dbgfs_root);
 
         return 0;
@@ -610,7 +627,7 @@ static int dsps_musb_reset(struct musb *musb)
         struct device *dev = musb->controller;
         struct dsps_glue *glue = dev_get_drvdata(dev->parent);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
-        int session_restart = 0;
+        int session_restart = 0, error;
 
         if (glue->sw_babble_enabled)
                 session_restart = sw_babble_control(musb);
@@ -624,8 +641,14 @@ static int dsps_musb_reset(struct musb *musb)
                 dsps_writel(musb->ctrl_base, wrp->control, (1 << wrp->reset));
                 usleep_range(100, 200);
                 usb_phy_shutdown(musb->xceiv);
+                error = phy_power_off(musb->phy);
+                if (error)
+                        dev_err(dev, "phy shutdown failed: %i\n", error);
                 usleep_range(100, 200);
                 usb_phy_init(musb->xceiv);
+                error = phy_power_on(musb->phy);
+                if (error)
+                        dev_err(dev, "phy powerup failed: %i\n", error);
                 session_restart = 1;
         }
 
@@ -687,7 +710,7 @@ static int dsps_create_musb_pdev(struct dsps_glue *glue,
         struct musb_hdrc_config *config;
         struct platform_device *musb;
         struct device_node *dn = parent->dev.of_node;
-        int ret;
+        int ret, val;
 
         memset(resources, 0, sizeof(resources));
         res = platform_get_resource_byname(parent, IORESOURCE_MEM, "mc");
@@ -739,7 +762,10 @@ static int dsps_create_musb_pdev(struct dsps_glue *glue,
         pdata.mode = get_musb_port_mode(dev);
         /* DT keeps this entry in mA, musb expects it as per USB spec */
         pdata.power = get_int_prop(dn, "mentor,power") / 2;
-        config->multipoint = of_property_read_bool(dn, "mentor,multipoint");
+
+        ret = of_property_read_u32(dn, "mentor,multipoint", &val);
+        if (!ret && val)
+                config->multipoint = true;
 
         ret = platform_device_add_data(musb, &pdata, sizeof(pdata));
         if (ret) {
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 883a9adfdfff..c3d5fc9dfb5b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2613,7 +2613,7 @@ static const struct hc_driver musb_hc_driver = {
         .description            = "musb-hcd",
         .product_desc           = "MUSB HDRC host driver",
         .hcd_priv_size          = sizeof(struct musb *),
-        .flags                  = HCD_USB2 | HCD_MEMORY,
+        .flags                  = HCD_USB2 | HCD_MEMORY | HCD_BH,
 
         /* not using irq handler or reset hooks from usbcore, since
          * those must be shared with peripheral code for OTG configs
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 763649eb4987..cc752d8c7773 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -516,7 +516,7 @@ static int omap2430_probe(struct platform_device *pdev)
         struct omap2430_glue            *glue;
         struct device_node              *np = pdev->dev.of_node;
         struct musb_hdrc_config         *config;
-        int                             ret = -ENOMEM;
+        int                             ret = -ENOMEM, val;
 
         glue = devm_kzalloc(&pdev->dev, sizeof(*glue), GFP_KERNEL);
         if (!glue)
@@ -559,7 +559,10 @@ static int omap2430_probe(struct platform_device *pdev)
                 of_property_read_u32(np, "num-eps", (u32 *)&config->num_eps);
                 of_property_read_u32(np, "ram-bits", (u32 *)&config->ram_bits);
                 of_property_read_u32(np, "power", (u32 *)&pdata->power);
-                config->multipoint = of_property_read_bool(np, "multipoint");
+
+                ret = of_property_read_u32(np, "multipoint", &val);
+                if (!ret && val)
+                        config->multipoint = true;
 
                 pdata->board_data       = data;
                 pdata->config           = config;
diff --git a/drivers/usb/renesas_usbhs/Kconfig b/drivers/usb/renesas_usbhs/Kconfig
index de83b9d0cd5c..ebc99ee076ce 100644
--- a/drivers/usb/renesas_usbhs/Kconfig
+++ b/drivers/usb/renesas_usbhs/Kconfig
@@ -6,6 +6,7 @@ config USB_RENESAS_USBHS
         tristate 'Renesas USBHS controller'
         depends on USB_GADGET
         depends on ARCH_SHMOBILE || SUPERH || COMPILE_TEST
+        depends on EXTCON || !EXTCON # if EXTCON=m, USBHS cannot be built-in
         default n
         help
           Renesas USBHS is a discrete USB host and peripheral controller chip
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index 9374bd2aba20..8936a83c96cd 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -38,56 +38,51 @@ static int usb_serial_device_match(struct device *dev,
         return 0;
 }
 
-static ssize_t port_number_show(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        struct usb_serial_port *port = to_usb_serial_port(dev);
-
-        return sprintf(buf, "%d\n", port->port_number);
-}
-static DEVICE_ATTR_RO(port_number);
-
 static int usb_serial_device_probe(struct device *dev)
 {
         struct usb_serial_driver *driver;
         struct usb_serial_port *port;
+        struct device *tty_dev;
         int retval = 0;
         int minor;
 
         port = to_usb_serial_port(dev);
-        if (!port) {
-                retval = -ENODEV;
-                goto exit;
-        }
+        if (!port)
+                return -ENODEV;
 
         /* make sure suspend/resume doesn't race against port_probe */
         retval = usb_autopm_get_interface(port->serial->interface);
         if (retval)
-                goto exit;
+                return retval;
 
         driver = port->serial->type;
         if (driver->port_probe) {
                 retval = driver->port_probe(port);
                 if (retval)
-                        goto exit_with_autopm;
+                        goto err_autopm_put;
         }
 
-        retval = device_create_file(dev, &dev_attr_port_number);
-        if (retval) {
-                if (driver->port_remove)
-                        retval = driver->port_remove(port);
-                goto exit_with_autopm;
+        minor = port->minor;
+        tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev);
+        if (IS_ERR(tty_dev)) {
+                retval = PTR_ERR(tty_dev);
+                goto err_port_remove;
         }
 
-        minor = port->minor;
-        tty_register_device(usb_serial_tty_driver, minor, dev);
+        usb_autopm_put_interface(port->serial->interface);
+
         dev_info(&port->serial->dev->dev,
                  "%s converter now attached to ttyUSB%d\n",
                  driver->description, minor);
 
-exit_with_autopm:
+        return 0;
+
+err_port_remove:
+        if (driver->port_remove)
+                driver->port_remove(port);
+err_autopm_put:
         usb_autopm_put_interface(port->serial->interface);
-exit:
+
         return retval;
 }
 
@@ -114,8 +109,6 @@ static int usb_serial_device_remove(struct device *dev)
         minor = port->minor;
         tty_unregister_device(usb_serial_tty_driver, minor);
 
-        device_remove_file(&port->dev, &dev_attr_port_number);
-
         driver = port->serial->type;
         if (driver->port_remove)
                 retval = driver->port_remove(port);
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 2d72aa3564a3..ede4f5fcfadd 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -84,6 +84,10 @@ struct ch341_private {
         u8 line_status; /* active status of modem control inputs */
 };
 
+static void ch341_set_termios(struct tty_struct *tty,
+                              struct usb_serial_port *port,
+                              struct ktermios *old_termios);
+
 static int ch341_control_out(struct usb_device *dev, u8 request,
                              u16 value, u16 index)
 {
@@ -309,19 +313,12 @@ static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port)
         struct ch341_private *priv = usb_get_serial_port_data(port);
         int r;
 
-        priv->baud_rate = DEFAULT_BAUD_RATE;
-
         r = ch341_configure(serial->dev, priv);
         if (r)
                 goto out;
 
-        r = ch341_set_handshake(serial->dev, priv->line_control);
-        if (r)
-                goto out;
-
-        r = ch341_set_baudrate(serial->dev, priv);
-        if (r)
-                goto out;
+        if (tty)
+                ch341_set_termios(tty, port, NULL);
 
         dev_dbg(&port->dev, "%s - submitting interrupt urb\n", __func__);
         r = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 29fa1c3d0089..3806e7014199 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -14,6 +14,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/console.h>
@@ -144,6 +145,7 @@ static int usb_console_setup(struct console *co, char *options)
                         init_ldsem(&tty->ldisc_sem);
                         INIT_LIST_HEAD(&tty->tty_files);
                         kref_get(&tty->driver->kref);
+                        __module_get(tty->driver->owner);
                         tty->ops = &usb_console_fake_tty_ops;
                         if (tty_init_termios(tty)) {
                                 retval = -ENOMEM;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f40c856ff758..84ce2d74894c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -147,6 +147,8 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
         { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
         { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
+        { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */
+        { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */
         { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
         { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
         { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1ebb351b9e9a..3086dec0ef53 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -799,6 +799,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
+        { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
@@ -978,6 +980,23 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
         /* GE Healthcare devices */
         { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
+        /* Active Research (Actisense) devices */
+        { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index e52409c9be99..56b1b55c4751 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -38,6 +38,9 @@
 
 #define FTDI_LUMEL_PD12_PID     0x6002
 
+/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
+#define CYBER_CORTEX_AV_PID     0x8698
+
 /*
  * Marvell OpenRD Base, Client
  * http://www.open-rd.org
@@ -1438,3 +1441,23 @@
  */
 #define GE_HEALTHCARE_VID               0x1901
 #define GE_HEALTHCARE_NEMO_TRACKER_PID  0x0015
+
+/*
+ * Active Research (Actisense) devices
+ */
+#define ACTISENSE_NDC_PID               0xD9A8 /* NDC USB Serial Adapter */
+#define ACTISENSE_USG_PID               0xD9A9 /* USG USB Serial Adapter */
+#define ACTISENSE_NGT_PID               0xD9AA /* NGT NMEA2000 Interface */
+#define ACTISENSE_NGW_PID               0xD9AB /* NGW NMEA2000 Gateway */
+#define ACTISENSE_D9AC_PID              0xD9AC /* Actisense Reserved */
+#define ACTISENSE_D9AD_PID              0xD9AD /* Actisense Reserved */
+#define ACTISENSE_D9AE_PID              0xD9AE /* Actisense Reserved */
+#define ACTISENSE_D9AF_PID              0xD9AF /* Actisense Reserved */
+#define CHETCO_SEAGAUGE_PID             0xA548 /* SeaGauge USB Adapter */
+#define CHETCO_SEASWITCH_PID            0xA549 /* SeaSwitch USB Adapter */
+#define CHETCO_SEASMART_NMEA2000_PID    0xA54A /* SeaSmart NMEA2000 Gateway */
+#define CHETCO_SEASMART_ETHERNET_PID    0xA54B /* SeaSmart Ethernet Gateway */
+#define CHETCO_SEASMART_WIFI_PID        0xA5AC /* SeaSmart Wifi Gateway */
+#define CHETCO_SEASMART_DISPLAY_PID     0xA5AD /* SeaSmart NMEA2000 Display */
+#define CHETCO_SEASMART_LITE_PID        0xA5AE /* SeaSmart Lite USB Adapter */
+#define CHETCO_SEASMART_ANALOG_PID      0xA5AF /* SeaSmart Analog Adapter */
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index ccf1df7c4b80..54e170dd3dad 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -258,7 +258,8 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout)
          * character or at least one jiffy.
          */
         period = max_t(unsigned long, (10 * HZ / bps), 1);
-        period = min_t(unsigned long, period, timeout);
+        if (timeout)
+                period = min_t(unsigned long, period, timeout);
 
         dev_dbg(&port->dev, "%s - timeout = %u ms, period = %u ms\n",
                                         __func__, jiffies_to_msecs(timeout),
@@ -268,7 +269,7 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout)
                 schedule_timeout_interruptible(period);
                 if (signal_pending(current))
                         break;
-                if (time_after(jiffies, expire))
+                if (timeout && time_after(jiffies, expire))
                         break;
         }
 }
diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c
index ab1d690274ae..460a40669967 100644
--- a/drivers/usb/serial/mxuport.c
+++ b/drivers/usb/serial/mxuport.c
@@ -1284,7 +1284,8 @@ static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port)
         }
 
         /* Initial port termios */
-        mxuport_set_termios(tty, port, NULL);
+        if (tty)
+                mxuport_set_termios(tty, port, NULL);
 
         /*
          * TODO: use RQ_VENDOR_GET_MSR, once we know what it
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 0f872e6b2c87..829604d11f3f 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -132,6 +132,7 @@ MODULE_DEVICE_TABLE(usb, id_table);
 #define UART_OVERRUN_ERROR              0x40
 #define UART_CTS                        0x80
 
+static void pl2303_set_break(struct usb_serial_port *port, bool enable);
 
 enum pl2303_type {
         TYPE_01,        /* Type 0 and 1 (difference unknown) */
@@ -615,6 +616,7 @@ static void pl2303_close(struct usb_serial_port *port)
 {
         usb_serial_generic_close(port);
         usb_kill_urb(port->interrupt_in_urb);
+        pl2303_set_break(port, false);
 }
 
 static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port)
@@ -741,17 +743,16 @@ static int pl2303_ioctl(struct tty_struct *tty,
         return -ENOIOCTLCMD;
 }
 
-static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
+static void pl2303_set_break(struct usb_serial_port *port, bool enable)
 {
-        struct usb_serial_port *port = tty->driver_data;
         struct usb_serial *serial = port->serial;
         u16 state;
         int result;
 
-        if (break_state == 0)
-                state = BREAK_OFF;
-        else
+        if (enable)
                 state = BREAK_ON;
+        else
+                state = BREAK_OFF;
 
         dev_dbg(&port->dev, "%s - turning break %s\n", __func__,
                         state == BREAK_OFF ? "off" : "on");
@@ -763,6 +764,13 @@ static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
                 dev_err(&port->dev, "error sending break = %d\n", result);
 }
 
+static void pl2303_break_ctl(struct tty_struct *tty, int state)
+{
+        struct usb_serial_port *port = tty->driver_data;
+
+        pl2303_set_break(port, state);
+}
+
 static void pl2303_update_line_status(struct usb_serial_port *port,
                                       unsigned char *data,
                                       unsigned int actual_length)
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 475723c006f9..529066bbc7e8 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -687,6 +687,21 @@ static void serial_port_dtr_rts(struct tty_port *port, int on)
                 drv->dtr_rts(p, on);
 }
 
+static ssize_t port_number_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct usb_serial_port *port = to_usb_serial_port(dev);
+
+        return sprintf(buf, "%u\n", port->port_number);
+}
+static DEVICE_ATTR_RO(port_number);
+
+static struct attribute *usb_serial_port_attrs[] = {
+        &dev_attr_port_number.attr,
+        NULL
+};
+ATTRIBUTE_GROUPS(usb_serial_port);
+
 static const struct tty_port_operations serial_port_ops = {
         .carrier_raised         = serial_port_carrier_raised,
         .dtr_rts                = serial_port_dtr_rts,
@@ -902,6 +917,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                 port->dev.driver = NULL;
                 port->dev.bus = &usb_serial_bus_type;
                 port->dev.release = &usb_serial_port_release;
+                port->dev.groups = usb_serial_port_groups;
                 device_initialize(&port->dev);
         }
 
@@ -940,8 +956,9 @@ static int usb_serial_probe(struct usb_interface *interface,
                 port = serial->port[i];
                 if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL))
                         goto probe_error;
-                buffer_size = max_t(int, serial->type->bulk_out_size,
-                                                usb_endpoint_maxp(endpoint));
+                buffer_size = serial->type->bulk_out_size;
+                if (!buffer_size)
+                        buffer_size = usb_endpoint_maxp(endpoint);
                 port->bulk_out_size = buffer_size;
                 port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
 
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index dbc00e56c7f5..82570425fdfe 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
+                "JMicron",
+                "JMS539",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_REPORT_OPCODES),
+
 /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 "JMicron",
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index d468d02179f4..5600c33fcadb 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -889,6 +889,12 @@ static void usb_stor_scan_dwork(struct work_struct *work)
             !(us->fflags & US_FL_SCM_MULT_TARG)) {
                 mutex_lock(&us->dev_mutex);
                 us->max_lun = usb_stor_Bulk_max_lun(us);
+                /*
+                 * Allow proper scanning of devices that present more than 8 LUNs
+                 * While not affecting other devices that may need the previous behavior
+                 */
+                if (us->max_lun >= 8)
+                        us_to_host(us)->max_lun = us->max_lun+1;
                 mutex_unlock(&us->dev_mutex);
         }
         scsi_scan_host(us_to_host(us));
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index afa06d28725d..2bbfc25e582c 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -591,11 +591,6 @@ static void handle_rx(struct vhost_net *net)
                          * TODO: support TSO.
                          */
                         iov_iter_advance(&msg.msg_iter, vhost_hlen);
-                } else {
-                        /* It'll come from socket; we'll need to patch
-                         * ->num_buffers over if VIRTIO_NET_F_MRG_RXBUF
-                         */
-                        iov_iter_advance(&fixup, sizeof(hdr));
                 }
                 err = sock->ops->recvmsg(NULL, sock, &msg,
                                          sock_len, MSG_DONTWAIT | MSG_TRUNC);
@@ -609,17 +604,25 @@ static void handle_rx(struct vhost_net *net)
                         continue;
                 }
                 /* Supply virtio_net_hdr if VHOST_NET_F_VIRTIO_NET_HDR */
-                if (unlikely(vhost_hlen) &&
-                    copy_to_iter(&hdr, sizeof(hdr), &fixup) != sizeof(hdr)) {
-                        vq_err(vq, "Unable to write vnet_hdr at addr %p\n",
-                               vq->iov->iov_base);
-                        break;
+                if (unlikely(vhost_hlen)) {
+                        if (copy_to_iter(&hdr, sizeof(hdr),
+                                         &fixup) != sizeof(hdr)) {
+                                vq_err(vq, "Unable to write vnet_hdr "
+                                       "at addr %p\n", vq->iov->iov_base);
+                                break;
+                        }
+                } else {
+                        /* Header came from socket; we'll need to patch
+                         * ->num_buffers over if VIRTIO_NET_F_MRG_RXBUF
+                         */
+                        iov_iter_advance(&fixup, sizeof(hdr));
                 }
                 /* TODO: Should check and handle checksum. */
 
                 num_buffers = cpu_to_vhost16(vq, headcount);
                 if (likely(mergeable) &&
-                    copy_to_iter(&num_buffers, 2, &fixup) != 2) {
+                    copy_to_iter(&num_buffers, sizeof num_buffers,
+                                 &fixup) != sizeof num_buffers) {
                         vq_err(vq, "Failed num_buffers write");
                         vhost_discard_vq_desc(vq, headcount);
                         break;
diff --git a/drivers/watchdog/at91sam9_wdt.c b/drivers/watchdog/at91sam9_wdt.c
index 6df940528fd2..1443b3c391de 100644
--- a/drivers/watchdog/at91sam9_wdt.c
+++ b/drivers/watchdog/at91sam9_wdt.c
@@ -208,7 +208,8 @@ static int at91_wdt_init(struct platform_device *pdev, struct at91wdt *wdt)
 
         if ((tmp & AT91_WDT_WDFIEN) && wdt->irq) {
                 err = request_irq(wdt->irq, wdt_interrupt,
-                                  IRQF_SHARED | IRQF_IRQPOLL,
+                                  IRQF_SHARED | IRQF_IRQPOLL |
+                                  IRQF_NO_SUSPEND,
                                   pdev->name, wdt);
                 if (err)
                         return err;
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 2140398a2a8c..2ccd3592d41f 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -2,7 +2,7 @@ ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
 obj-$(CONFIG_X86)                       += fallback.o
-obj-y   += grant-table.o features.o balloon.o manage.o
+obj-y   += grant-table.o features.o balloon.o manage.o preempt.o
 obj-y   += events/
 obj-y   += xenbus/
 
diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
new file mode 100644
index 000000000000..a1800c150839
--- /dev/null
+++ b/drivers/xen/preempt.c
@@ -0,0 +1,44 @@
+/*
+ * Preemptible hypercalls
+ *
+ * Copyright (C) 2014 Citrix Systems R&D ltd.
+ *
+ * This source code is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ */
+
+#include <linux/sched.h>
+#include <xen/xen-ops.h>
+
+#ifndef CONFIG_PREEMPT
+
+/*
+ * Some hypercalls issued by the toolstack can take many 10s of
+ * seconds. Allow tasks running hypercalls via the privcmd driver to
+ * be voluntarily preempted even if full kernel preemption is
+ * disabled.
+ *
+ * Such preemptible hypercalls are bracketed by
+ * xen_preemptible_hcall_begin() and xen_preemptible_hcall_end()
+ * calls.
+ */
+
+DEFINE_PER_CPU(bool, xen_in_preemptible_hcall);
+EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall);
+
+asmlinkage __visible void xen_maybe_preempt_hcall(void)
+{
+        if (unlikely(__this_cpu_read(xen_in_preemptible_hcall)
+                     && should_resched())) {
+                /*
+                 * Clear flag as we may be rescheduled on a different
+                 * cpu.
+                 */
+                __this_cpu_write(xen_in_preemptible_hcall, false);
+                _cond_resched();
+                __this_cpu_write(xen_in_preemptible_hcall, true);
+        }
+}
+#endif /* CONFIG_PREEMPT */
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 569a13b9e856..59ac71c4a043 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -56,10 +56,12 @@ static long privcmd_ioctl_hypercall(void __user *udata)
         if (copy_from_user(&hypercall, udata, sizeof(hypercall)))
                 return -EFAULT;
 
+        xen_preemptible_hcall_begin();
         ret = privcmd_call(hypercall.op,
                            hypercall.arg[0], hypercall.arg[1],
                            hypercall.arg[2], hypercall.arg[3],
                            hypercall.arg[4]);
+        xen_preemptible_hcall_end();
 
         return ret;
 }
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 61653a03a8f5..9faca6a60bb0 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -709,12 +709,11 @@ static int prepare_pending_reqs(struct vscsibk_info *info,
 static int scsiback_do_cmd_fn(struct vscsibk_info *info)
 {
         struct vscsiif_back_ring *ring = &info->ring;
-        struct vscsiif_request *ring_req;
+        struct vscsiif_request ring_req;
         struct vscsibk_pend *pending_req;
         RING_IDX rc, rp;
         int err, more_to_do;
         uint32_t result;
-        uint8_t act;
 
         rc = ring->req_cons;
         rp = ring->sring->req_prod;
@@ -735,11 +734,10 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                 if (!pending_req)
                         return 1;
 
-                ring_req = RING_GET_REQUEST(ring, rc);
+                ring_req = *RING_GET_REQUEST(ring, rc);
                 ring->req_cons = ++rc;
 
-                act = ring_req->act;
-                err = prepare_pending_reqs(info, ring_req, pending_req);
+                err = prepare_pending_reqs(info, &ring_req, pending_req);
                 if (err) {
                         switch (err) {
                         case -ENODEV:
@@ -755,9 +753,9 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                         return 1;
                 }
 
-                switch (act) {
+                switch (ring_req.act) {
                 case VSCSIIF_ACT_SCSI_CDB:
-                        if (scsiback_gnttab_data_map(ring_req, pending_req)) {
+                        if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
                                 scsiback_fast_flush_area(pending_req);
                                 scsiback_do_resp_with_sense(NULL,
                                         DRIVER_ERROR << 24, 0, pending_req);
@@ -768,7 +766,7 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                         break;
                 case VSCSIIF_ACT_SCSI_ABORT:
                         scsiback_device_action(pending_req, TMR_ABORT_TASK,
-                                ring_req->ref_rqid);
+                                ring_req.ref_rqid);
                         break;
                 case VSCSIIF_ACT_SCSI_RESET:
                         scsiback_device_action(pending_req, TMR_LUN_RESET, 0);
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 993642199326..6d67f32e648d 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1645,14 +1645,14 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
 
         parent_nritems = btrfs_header_nritems(parent);
         blocksize = root->nodesize;
-        end_slot = parent_nritems;
+        end_slot = parent_nritems - 1;
 
-        if (parent_nritems == 1)
+        if (parent_nritems <= 1)
                 return 0;
 
         btrfs_set_lock_blocking(parent);
 
-        for (i = start_slot; i < end_slot; i++) {
+        for (i = start_slot; i <= end_slot; i++) {
                 int close = 1;
 
                 btrfs_node_key(parent, &disk_key, i);
@@ -1669,7 +1669,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
                         other = btrfs_node_blockptr(parent, i - 1);
                         close = close_blocks(blocknr, other, blocksize);
                 }
-                if (!close && i < end_slot - 2) {
+                if (!close && i < end_slot) {
                         other = btrfs_node_blockptr(parent, i + 1);
                         close = close_blocks(blocknr, other, blocksize);
                 }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 571f402d3fc4..6f080451fcb1 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3208,6 +3208,8 @@ static int cache_save_setup(struct btrfs_block_group_cache *block_group,
                 return 0;
         }
 
+        if (trans->aborted)
+                return 0;
 again:
         inode = lookup_free_space_inode(root, block_group, path);
         if (IS_ERR(inode) && PTR_ERR(inode) != -ENOENT) {
@@ -3243,6 +3245,20 @@ again:
          */
         BTRFS_I(inode)->generation = 0;
         ret = btrfs_update_inode(trans, root, inode);
+        if (ret) {
+                /*
+                 * So theoretically we could recover from this, simply set the
+                 * super cache generation to 0 so we know to invalidate the
+                 * cache, but then we'd have to keep track of the block groups
+                 * that fail this way so we know we _have_ to reset this cache
+                 * before the next commit or risk reading stale cache.  So to
+                 * limit our exposure to horrible edge cases lets just abort the
+                 * transaction, this only happens in really bad situations
+                 * anyway.
+                 */
+                btrfs_abort_transaction(trans, root, ret);
+                goto out_put;
+        }
         WARN_ON(ret);
 
         if (i_size_read(inode) > 0) {
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index b78bbbac900d..30982bbd31c3 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1811,22 +1811,10 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
         mutex_unlock(&inode->i_mutex);
 
         /*
-         * we want to make sure fsync finds this change
-         * but we haven't joined a transaction running right now.
-         *
-         * Later on, someone is sure to update the inode and get the
-         * real transid recorded.
-         *
-         * We set last_trans now to the fs_info generation + 1,
-         * this will either be one more than the running transaction
-         * or the generation used for the next transaction if there isn't
-         * one running right now.
-         *
          * We also have to set last_sub_trans to the current log transid,
          * otherwise subsequent syncs to a file that's been synced in this
          * transaction will appear to have already occured.
          */
-        BTRFS_I(inode)->last_trans = root->fs_info->generation + 1;
         BTRFS_I(inode)->last_sub_trans = root->log_transid;
         if (num_written > 0) {
                 err = generic_write_sync(file, pos, num_written);
@@ -1959,25 +1947,37 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         atomic_inc(&root->log_batch);
 
         /*
-         * check the transaction that last modified this inode
-         * and see if its already been committed
-         */
-        if (!BTRFS_I(inode)->last_trans) {
-                mutex_unlock(&inode->i_mutex);
-                goto out;
-        }
-
-        /*
-         * if the last transaction that changed this file was before
-         * the current transaction, we can bail out now without any
-         * syncing
+         * If the last transaction that changed this file was before the current
+         * transaction and we have the full sync flag set in our inode, we can
+         * bail out now without any syncing.
+         *
+         * Note that we can't bail out if the full sync flag isn't set. This is
+         * because when the full sync flag is set we start all ordered extents
+         * and wait for them to fully complete - when they complete they update
+         * the inode's last_trans field through:
+         *
+         *     btrfs_finish_ordered_io() ->
+         *         btrfs_update_inode_fallback() ->
+         *             btrfs_update_inode() ->
+         *                 btrfs_set_inode_last_trans()
+         *
+         * So we are sure that last_trans is up to date and can do this check to
+         * bail out safely. For the fast path, when the full sync flag is not
+         * set in our inode, we can not do it because we start only our ordered
+         * extents and don't wait for them to complete (that is when
+         * btrfs_finish_ordered_io runs), so here at this point their last_trans
+         * value might be less than or equals to fs_info->last_trans_committed,
+         * and setting a speculative last_trans for an inode when a buffered
+         * write is made (such as fs_info->generation + 1 for example) would not
+         * be reliable since after setting the value and before fsync is called
+         * any number of transactions can start and commit (transaction kthread
+         * commits the current transaction periodically), and a transaction
+         * commit does not start nor waits for ordered extents to complete.
          */
         smp_mb();
         if (btrfs_inode_in_log(inode, root->fs_info->generation) ||
-            BTRFS_I(inode)->last_trans <=
-            root->fs_info->last_trans_committed) {
-                BTRFS_I(inode)->last_trans = 0;
-
+            (full_sync && BTRFS_I(inode)->last_trans <=
+             root->fs_info->last_trans_committed)) {
                 /*
                  * We'v had everything committed since the last time we were
                  * modified so clear this flag in case it was set for whatever
@@ -2275,6 +2275,8 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
         bool same_page;
         bool no_holes = btrfs_fs_incompat(root->fs_info, NO_HOLES);
         u64 ino_size;
+        bool truncated_page = false;
+        bool updated_inode = false;
 
         ret = btrfs_wait_ordered_range(inode, offset, len);
         if (ret)
@@ -2306,13 +2308,18 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
          * entire page.
          */
         if (same_page && len < PAGE_CACHE_SIZE) {
-                if (offset < ino_size)
+                if (offset < ino_size) {
+                        truncated_page = true;
                         ret = btrfs_truncate_page(inode, offset, len, 0);
+                } else {
+                        ret = 0;
+                }
                 goto out_only_mutex;
         }
 
         /* zero back part of the first page */
         if (offset < ino_size) {
+                truncated_page = true;
                 ret = btrfs_truncate_page(inode, offset, 0, 0);
                 if (ret) {
                         mutex_unlock(&inode->i_mutex);
@@ -2348,6 +2355,7 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
                 if (!ret) {
                         /* zero the front end of the last page */
                         if (tail_start + tail_len < ino_size) {
+                                truncated_page = true;
                                 ret = btrfs_truncate_page(inode,
                                                 tail_start + tail_len, 0, 1);
                                 if (ret)
@@ -2357,8 +2365,8 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
         }
 
         if (lockend < lockstart) {
-                mutex_unlock(&inode->i_mutex);
-                return 0;
+                ret = 0;
+                goto out_only_mutex;
         }
 
         while (1) {
@@ -2506,6 +2514,7 @@ out_trans:
 
         trans->block_rsv = &root->fs_info->trans_block_rsv;
         ret = btrfs_update_inode(trans, root, inode);
+        updated_inode = true;
         btrfs_end_transaction(trans, root);
         btrfs_btree_balance_dirty(root);
 out_free:
@@ -2515,6 +2524,22 @@ out:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, lockend,
                              &cached_state, GFP_NOFS);
 out_only_mutex:
+        if (!updated_inode && truncated_page && !ret && !err) {
+                /*
+                 * If we only end up zeroing part of a page, we still need to
+                 * update the inode item, so that all the time fields are
+                 * updated as well as the necessary btrfs inode in memory fields
+                 * for detecting, at fsync time, if the inode isn't yet in the
+                 * log tree or it's there but not up to date.
+                 */
+                trans = btrfs_start_transaction(root, 1);
+                if (IS_ERR(trans)) {
+                        err = PTR_ERR(trans);
+                } else {
+                        err = btrfs_update_inode(trans, root, inode);
+                        ret = btrfs_end_transaction(trans, root);
+                }
+        }
         mutex_unlock(&inode->i_mutex);
         if (ret && !err)
                 err = ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index a85c23dfcddb..da828cf5e8f8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7285,7 +7285,6 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
             ((BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW) &&
              em->block_start != EXTENT_MAP_HOLE)) {
                 int type;
-                int ret;
                 u64 block_start, orig_start, orig_block_len, ram_bytes;
 
                 if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 534544e08f76..157cc54fc634 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -452,9 +452,7 @@ void btrfs_get_logged_extents(struct inode *inode,
                         continue;
                 if (entry_end(ordered) <= start)
                         break;
-                if (!list_empty(&ordered->log_list))
-                        continue;
-                if (test_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
+                if (test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
                         continue;
                 list_add(&ordered->log_list, logged_list);
                 atomic_inc(&ordered->refs);
@@ -511,8 +509,7 @@ void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
                 wait_event(ordered->wait, test_bit(BTRFS_ORDERED_IO_DONE,
                                                    &ordered->flags));
 
-                if (!test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
-                        list_add_tail(&ordered->trans_list, &trans->ordered);
+                list_add_tail(&ordered->trans_list, &trans->ordered);
                 spin_lock_irq(&log->log_extents_lock[index]);
         }
         spin_unlock_irq(&log->log_extents_lock[index]);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index fe5857223515..d6033f540cc7 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -230,6 +230,7 @@ struct pending_dir_move {
         u64 parent_ino;
         u64 ino;
         u64 gen;
+        bool is_orphan;
         struct list_head update_refs;
 };
 
@@ -2984,7 +2985,8 @@ static int add_pending_dir_move(struct send_ctx *sctx,
                                 u64 ino_gen,
                                 u64 parent_ino,
                                 struct list_head *new_refs,
-                                struct list_head *deleted_refs)
+                                struct list_head *deleted_refs,
+                                const bool is_orphan)
 {
         struct rb_node **p = &sctx->pending_dir_moves.rb_node;
         struct rb_node *parent = NULL;
@@ -2999,6 +3001,7 @@ static int add_pending_dir_move(struct send_ctx *sctx,
         pm->parent_ino = parent_ino;
         pm->ino = ino;
         pm->gen = ino_gen;
+        pm->is_orphan = is_orphan;
         INIT_LIST_HEAD(&pm->list);
         INIT_LIST_HEAD(&pm->update_refs);
         RB_CLEAR_NODE(&pm->node);
@@ -3131,16 +3134,20 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
         rmdir_ino = dm->rmdir_ino;
         free_waiting_dir_move(sctx, dm);
 
-        ret = get_first_ref(sctx->parent_root, pm->ino,
-                            &parent_ino, &parent_gen, name);
-        if (ret < 0)
-                goto out;
-
-        ret = get_cur_path(sctx, parent_ino, parent_gen,
-                           from_path);
-        if (ret < 0)
-                goto out;
-        ret = fs_path_add_path(from_path, name);
+        if (pm->is_orphan) {
+                ret = gen_unique_name(sctx, pm->ino,
+                                      pm->gen, from_path);
+        } else {
+                ret = get_first_ref(sctx->parent_root, pm->ino,
+                                    &parent_ino, &parent_gen, name);
+                if (ret < 0)
+                        goto out;
+                ret = get_cur_path(sctx, parent_ino, parent_gen,
+                                   from_path);
+                if (ret < 0)
+                        goto out;
+                ret = fs_path_add_path(from_path, name);
+        }
         if (ret < 0)
                 goto out;
 
@@ -3150,7 +3157,8 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
                 LIST_HEAD(deleted_refs);
                 ASSERT(ancestor > BTRFS_FIRST_FREE_OBJECTID);
                 ret = add_pending_dir_move(sctx, pm->ino, pm->gen, ancestor,
-                                           &pm->update_refs, &deleted_refs);
+                                           &pm->update_refs, &deleted_refs,
+                                           pm->is_orphan);
                 if (ret < 0)
                         goto out;
                 if (rmdir_ino) {
@@ -3283,6 +3291,127 @@ out:
         return ret;
 }
 
+/*
+ * We might need to delay a directory rename even when no ancestor directory
+ * (in the send root) with a higher inode number than ours (sctx->cur_ino) was
+ * renamed. This happens when we rename a directory to the old name (the name
+ * in the parent root) of some other unrelated directory that got its rename
+ * delayed due to some ancestor with higher number that got renamed.
+ *
+ * Example:
+ *
+ * Parent snapshot:
+ * .                                       (ino 256)
+ * |---- a/                                (ino 257)
+ * |     |---- file                        (ino 260)
+ * |
+ * |---- b/                                (ino 258)
+ * |---- c/                                (ino 259)
+ *
+ * Send snapshot:
+ * .                                       (ino 256)
+ * |---- a/                                (ino 258)
+ * |---- x/                                (ino 259)
+ *       |---- y/                          (ino 257)
+ *             |----- file                 (ino 260)
+ *
+ * Here we can not rename 258 from 'b' to 'a' without the rename of inode 257
+ * from 'a' to 'x/y' happening first, which in turn depends on the rename of
+ * inode 259 from 'c' to 'x'. So the order of rename commands the send stream
+ * must issue is:
+ *
+ * 1 - rename 259 from 'c' to 'x'
+ * 2 - rename 257 from 'a' to 'x/y'
+ * 3 - rename 258 from 'b' to 'a'
+ *
+ * Returns 1 if the rename of sctx->cur_ino needs to be delayed, 0 if it can
+ * be done right away and < 0 on error.
+ */
+static int wait_for_dest_dir_move(struct send_ctx *sctx,
+                                  struct recorded_ref *parent_ref,
+                                  const bool is_orphan)
+{
+        struct btrfs_path *path;
+        struct btrfs_key key;
+        struct btrfs_key di_key;
+        struct btrfs_dir_item *di;
+        u64 left_gen;
+        u64 right_gen;
+        int ret = 0;
+
+        if (RB_EMPTY_ROOT(&sctx->waiting_dir_moves))
+                return 0;
+
+        path = alloc_path_for_send();
+        if (!path)
+                return -ENOMEM;
+
+        key.objectid = parent_ref->dir;
+        key.type = BTRFS_DIR_ITEM_KEY;
+        key.offset = btrfs_name_hash(parent_ref->name, parent_ref->name_len);
+
+        ret = btrfs_search_slot(NULL, sctx->parent_root, &key, path, 0, 0);
+        if (ret < 0) {
+                goto out;
+        } else if (ret > 0) {
+                ret = 0;
+                goto out;
+        }
+
+        di = btrfs_match_dir_item_name(sctx->parent_root, path,
+                                       parent_ref->name, parent_ref->name_len);
+        if (!di) {
+                ret = 0;
+                goto out;
+        }
+        /*
+         * di_key.objectid has the number of the inode that has a dentry in the
+         * parent directory with the same name that sctx->cur_ino is being
+         * renamed to. We need to check if that inode is in the send root as
+         * well and if it is currently marked as an inode with a pending rename,
+         * if it is, we need to delay the rename of sctx->cur_ino as well, so
+         * that it happens after that other inode is renamed.
+         */
+        btrfs_dir_item_key_to_cpu(path->nodes[0], di, &di_key);
+        if (di_key.type != BTRFS_INODE_ITEM_KEY) {
+                ret = 0;
+                goto out;
+        }
+
+        ret = get_inode_info(sctx->parent_root, di_key.objectid, NULL,
+                             &left_gen, NULL, NULL, NULL, NULL);
+        if (ret < 0)
+                goto out;
+        ret = get_inode_info(sctx->send_root, di_key.objectid, NULL,
+                             &right_gen, NULL, NULL, NULL, NULL);
+        if (ret < 0) {
+                if (ret == -ENOENT)
+                        ret = 0;
+                goto out;
+        }
+
+        /* Different inode, no need to delay the rename of sctx->cur_ino */
+        if (right_gen != left_gen) {
+                ret = 0;
+                goto out;
+        }
+
+        if (is_waiting_for_move(sctx, di_key.objectid)) {
+                ret = add_pending_dir_move(sctx,
+                                           sctx->cur_ino,
+                                           sctx->cur_inode_gen,
+                                           di_key.objectid,
+                                           &sctx->new_refs,
+                                           &sctx->deleted_refs,
+                                           is_orphan);
+                if (!ret)
+                        ret = 1;
+        }
+out:
+        btrfs_free_path(path);
+        return ret;
+}
+
 static int wait_for_parent_move(struct send_ctx *sctx,
                                 struct recorded_ref *parent_ref)
 {
@@ -3349,7 +3478,8 @@ out:
                                            sctx->cur_inode_gen,
                                            ino,
                                            &sctx->new_refs,
-                                           &sctx->deleted_refs);
+                                           &sctx->deleted_refs,
+                                           false);
                 if (!ret)
                         ret = 1;
         }
@@ -3372,6 +3502,7 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move)
         int did_overwrite = 0;
         int is_orphan = 0;
         u64 last_dir_ino_rm = 0;
+        bool can_rename = true;
 
 verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
 
@@ -3490,12 +3621,22 @@ verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
                         }
                 }
 
+                if (S_ISDIR(sctx->cur_inode_mode) && sctx->parent_root) {
+                        ret = wait_for_dest_dir_move(sctx, cur, is_orphan);
+                        if (ret < 0)
+                                goto out;
+                        if (ret == 1) {
+                                can_rename = false;
+                                *pending_move = 1;
+                        }
+                }
+
                 /*
                  * link/move the ref to the new place. If we have an orphan
                  * inode, move it and update valid_path. If not, link or move
                  * it depending on the inode mode.
                  */
-                if (is_orphan) {
+                if (is_orphan && can_rename) {
                         ret = send_rename(sctx, valid_path, cur->full_path);
                         if (ret < 0)
                                 goto out;
@@ -3503,7 +3644,7 @@ verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
                         ret = fs_path_copy(valid_path, cur->full_path);
                         if (ret < 0)
                                 goto out;
-                } else {
+                } else if (can_rename) {
                         if (S_ISDIR(sctx->cur_inode_mode)) {
                                 /*
                                  * Dirs can't be linked, so move it. For moved
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 7e80f32550a6..88e51aded6bd 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1052,9 +1052,6 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
                 ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
                 if (ret)
                         return ret;
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-                if (ret)
-                        return ret;
         }
 
         return 0;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 9a37f8b39bae..c5b8ba37f88e 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1012,7 +1012,7 @@ again:
                 base = btrfs_item_ptr_offset(leaf, path->slots[0]);
 
                 while (cur_offset < item_size) {
-                        extref = (struct btrfs_inode_extref *)base + cur_offset;
+                        extref = (struct btrfs_inode_extref *)(base + cur_offset);
 
                         victim_name_len = btrfs_inode_extref_name_len(leaf, extref);
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index cd4d1315aaa9..8222f6f74147 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4903,10 +4903,17 @@ static void sort_parity_stripes(struct btrfs_bio *bbio, int num_stripes)
 static struct btrfs_bio *alloc_btrfs_bio(int total_stripes, int real_stripes)
 {
         struct btrfs_bio *bbio = kzalloc(
+                 /* the size of the btrfs_bio */
                 sizeof(struct btrfs_bio) +
+                /* plus the variable array for the stripes */
                 sizeof(struct btrfs_bio_stripe) * (total_stripes) +
+                /* plus the variable array for the tgt dev */
                 sizeof(int) * (real_stripes) +
-                sizeof(u64) * (real_stripes),
+                /*
+                 * plus the raid_map, which includes both the tgt dev
+                 * and the stripes
+                 */
+                sizeof(u64) * (total_stripes),
                 GFP_NOFS);
         if (!bbio)
                 return NULL;
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index 47b19465f0dc..883b93623bc5 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -111,6 +111,8 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
                                         name, name_len, -1);
                 if (!di && (flags & XATTR_REPLACE))
                         ret = -ENODATA;
+                else if (IS_ERR(di))
+                        ret = PTR_ERR(di);
                 else if (di)
                         ret = btrfs_delete_one_dir_name(trans, root, path, di);
                 goto out;
@@ -127,10 +129,12 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
                 ASSERT(mutex_is_locked(&inode->i_mutex));
                 di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode),
                                         name, name_len, 0);
-                if (!di) {
+                if (!di)
                         ret = -ENODATA;
+                else if (IS_ERR(di))
+                        ret = PTR_ERR(di);
+                if (ret)
                         goto out;
-                }
                 btrfs_release_path(path);
                 di = NULL;
         }
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 90d1882b306f..5ba029e627cc 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -124,7 +124,7 @@ ecryptfs_get_key_payload_data(struct key *key)
 }
 
 #define ECRYPTFS_MAX_KEYSET_SIZE 1024
-#define ECRYPTFS_MAX_CIPHER_NAME_SIZE 32
+#define ECRYPTFS_MAX_CIPHER_NAME_SIZE 31
 #define ECRYPTFS_MAX_NUM_ENC_KEYS 64
 #define ECRYPTFS_MAX_IV_BYTES 16        /* 128 bits */
 #define ECRYPTFS_SALT_BYTES 2
@@ -237,7 +237,7 @@ struct ecryptfs_crypt_stat {
         struct crypto_ablkcipher *tfm;
         struct crypto_hash *hash_tfm; /* Crypto context for generating
                                        * the initialization vectors */
-        unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE];
+        unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1];
         unsigned char key[ECRYPTFS_MAX_KEY_BYTES];
         unsigned char root_iv[ECRYPTFS_MAX_IV_BYTES];
         struct list_head keysig_list;
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index b07731e68c0b..fd39bad6f1bd 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -303,9 +303,22 @@ ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         struct file *lower_file = ecryptfs_file_to_lower(file);
         long rc = -ENOTTY;
 
-        if (lower_file->f_op->unlocked_ioctl)
+        if (!lower_file->f_op->unlocked_ioctl)
+                return rc;
+
+        switch (cmd) {
+        case FITRIM:
+        case FS_IOC_GETFLAGS:
+        case FS_IOC_SETFLAGS:
+        case FS_IOC_GETVERSION:
+        case FS_IOC_SETVERSION:
                 rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
-        return rc;
+                fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
+
+                return rc;
+        default:
+                return rc;
+        }
 }
 
 #ifdef CONFIG_COMPAT
@@ -315,9 +328,22 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         struct file *lower_file = ecryptfs_file_to_lower(file);
         long rc = -ENOIOCTLCMD;
 
-        if (lower_file->f_op->compat_ioctl)
+        if (!lower_file->f_op->compat_ioctl)
+                return rc;
+
+        switch (cmd) {
+        case FITRIM:
+        case FS_IOC32_GETFLAGS:
+        case FS_IOC32_SETFLAGS:
+        case FS_IOC32_GETVERSION:
+        case FS_IOC32_SETVERSION:
                 rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
-        return rc;
+                fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
+
+                return rc;
+        default:
+                return rc;
+        }
 }
 #endif
 
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 917bd5c9776a..6bd67e2011f0 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -891,7 +891,7 @@ struct ecryptfs_parse_tag_70_packet_silly_stack {
         struct blkcipher_desc desc;
         char fnek_sig_hex[ECRYPTFS_SIG_SIZE_HEX + 1];
         char iv[ECRYPTFS_MAX_IV_BYTES];
-        char cipher_string[ECRYPTFS_MAX_CIPHER_NAME_SIZE];
+        char cipher_string[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1];
 };
 
 /**
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 1895d60f4122..c095d3264259 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -407,7 +407,7 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
         if (!cipher_name_set) {
                 int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER);
 
-                BUG_ON(cipher_name_len >= ECRYPTFS_MAX_CIPHER_NAME_SIZE);
+                BUG_ON(cipher_name_len > ECRYPTFS_MAX_CIPHER_NAME_SIZE);
                 strcpy(mount_crypt_stat->global_default_cipher_name,
                        ECRYPTFS_DEFAULT_CIPHER);
         }
diff --git a/fs/locks.c b/fs/locks.c
index 365c82e1b3a9..f1bad681fc1c 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1665,7 +1665,8 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
         }
 
         if (my_fl != NULL) {
-                error = lease->fl_lmops->lm_change(my_fl, arg, &dispose);
+                lease = my_fl;
+                error = lease->fl_lmops->lm_change(lease, arg, &dispose);
                 if (error)
                         goto out;
                 goto out_setup;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index f9f4845db989..19874151e95c 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -433,7 +433,7 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
 
 static bool nfs_client_init_is_complete(const struct nfs_client *clp)
 {
-        return clp->cl_cons_state != NFS_CS_INITING;
+        return clp->cl_cons_state <= NFS_CS_READY;
 }
 
 int nfs_wait_client_init_complete(const struct nfs_client *clp)
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index a1f0685b42ff..a6ad68865880 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -181,8 +181,8 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred,
                         clear_bit(NFS_DELEGATION_NEED_RECLAIM,
                                   &delegation->flags);
                         spin_unlock(&delegation->lock);
-                        put_rpccred(oldcred);
                         rcu_read_unlock();
+                        put_rpccred(oldcred);
                         trace_nfs4_reclaim_delegation(inode, res->delegation_type);
                 } else {
                         /* We appear to have raced with a delegation return. */
@@ -370,7 +370,10 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
                         delegation = NULL;
                         goto out;
                 }
-                freeme = nfs_detach_delegation_locked(nfsi, 
+                if (test_and_set_bit(NFS_DELEGATION_RETURNING,
+                                        &old_delegation->flags))
+                        goto out;
+                freeme = nfs_detach_delegation_locked(nfsi,
                                 old_delegation, clp);
                 if (freeme == NULL)
                         goto out;
@@ -433,6 +436,8 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation)
 {
         bool ret = false;
 
+        if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
+                goto out;
         if (test_and_clear_bit(NFS_DELEGATION_RETURN, &delegation->flags))
                 ret = true;
         if (test_and_clear_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags) && !ret) {
@@ -444,6 +449,7 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation)
                         ret = true;
                 spin_unlock(&delegation->lock);
         }
+out:
         return ret;
 }
 
@@ -471,14 +477,20 @@ restart:
                                                                 super_list) {
                         if (!nfs_delegation_need_return(delegation))
                                 continue;
-                        inode = nfs_delegation_grab_inode(delegation);
-                        if (inode == NULL)
+                        if (!nfs_sb_active(server->super))
                                 continue;
+                        inode = nfs_delegation_grab_inode(delegation);
+                        if (inode == NULL) {
+                                rcu_read_unlock();
+                                nfs_sb_deactive(server->super);
+                                goto restart;
+                        }
                         delegation = nfs_start_delegation_return_locked(NFS_I(inode));
                         rcu_read_unlock();
 
                         err = nfs_end_delegation_return(inode, delegation, 0);
                         iput(inode);
+                        nfs_sb_deactive(server->super);
                         if (!err)
                                 goto restart;
                         set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);
@@ -809,19 +821,30 @@ restart:
         list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
                 list_for_each_entry_rcu(delegation, &server->delegations,
                                                                 super_list) {
+                        if (test_bit(NFS_DELEGATION_RETURNING,
+                                                &delegation->flags))
+                                continue;
                         if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
                                                 &delegation->flags) == 0)
                                 continue;
-                        inode = nfs_delegation_grab_inode(delegation);
-                        if (inode == NULL)
+                        if (!nfs_sb_active(server->super))
                                 continue;
-                        delegation = nfs_detach_delegation(NFS_I(inode),
-                                        delegation, server);
+                        inode = nfs_delegation_grab_inode(delegation);
+                        if (inode == NULL) {
+                                rcu_read_unlock();
+                                nfs_sb_deactive(server->super);
+                                goto restart;
+                        }
+                        delegation = nfs_start_delegation_return_locked(NFS_I(inode));
                         rcu_read_unlock();
-
-                        if (delegation != NULL)
-                                nfs_free_delegation(delegation);
+                        if (delegation != NULL) {
+                                delegation = nfs_detach_delegation(NFS_I(inode),
+                                        delegation, server);
+                                if (delegation != NULL)
+                                        nfs_free_delegation(delegation);
+                        }
                         iput(inode);
+                        nfs_sb_deactive(server->super);
                         goto restart;
                 }
         }
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 9b0c55cb2a2e..c19e16f0b2d0 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -408,14 +408,22 @@ static int xdr_decode(nfs_readdir_descriptor_t *desc,
         return 0;
 }
 
+/* Match file and dirent using either filehandle or fileid
+ * Note: caller is responsible for checking the fsid
+ */
 static
 int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
 {
+        struct nfs_inode *nfsi;
+
         if (dentry->d_inode == NULL)
                 goto different;
-        if (nfs_compare_fh(entry->fh, NFS_FH(dentry->d_inode)) != 0)
-                goto different;
-        return 1;
+
+        nfsi = NFS_I(dentry->d_inode);
+        if (entry->fattr->fileid == nfsi->fileid)
+                return 1;
+        if (nfs_compare_fh(entry->fh, &nfsi->fh) == 0)
+                return 1;
 different:
         return 0;
 }
@@ -469,6 +477,10 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
         struct inode *inode;
         int status;
 
+        if (!(entry->fattr->valid & NFS_ATTR_FATTR_FILEID))
+                return;
+        if (!(entry->fattr->valid & NFS_ATTR_FATTR_FSID))
+                return;
         if (filename.name[0] == '.') {
                 if (filename.len == 1)
                         return;
@@ -479,6 +491,10 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
 
         dentry = d_lookup(parent, &filename);
         if (dentry != NULL) {
+                /* Is there a mountpoint here? If so, just exit */
+                if (!nfs_fsid_equal(&NFS_SB(dentry->d_sb)->fsid,
+                                        &entry->fattr->fsid))
+                        goto out;
                 if (nfs_same_file(dentry, entry)) {
                         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                         status = nfs_refresh_inode(dentry->d_inode, entry->fattr);
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 94712fc781fa..e679d24c39d3 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -178,7 +178,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to)
                 iocb->ki_filp,
                 iov_iter_count(to), (unsigned long) iocb->ki_pos);
 
-        result = nfs_revalidate_mapping(inode, iocb->ki_filp->f_mapping);
+        result = nfs_revalidate_mapping_protected(inode, iocb->ki_filp->f_mapping);
         if (!result) {
                 result = generic_file_read_iter(iocb, to);
                 if (result > 0)
@@ -199,7 +199,7 @@ nfs_file_splice_read(struct file *filp, loff_t *ppos,
         dprintk("NFS: splice_read(%pD2, %lu@%Lu)\n",
                 filp, (unsigned long) count, (unsigned long long) *ppos);
 
-        res = nfs_revalidate_mapping(inode, filp->f_mapping);
+        res = nfs_revalidate_mapping_protected(inode, filp->f_mapping);
         if (!res) {
                 res = generic_file_splice_read(filp, ppos, pipe, count, flags);
                 if (res > 0)
@@ -372,6 +372,10 @@ start:
                                  nfs_wait_bit_killable, TASK_KILLABLE);
         if (ret)
                 return ret;
+        /*
+         * Wait for O_DIRECT to complete
+         */
+        nfs_inode_dio_wait(mapping->host);
 
         page = grab_cache_page_write_begin(mapping, index, flags);
         if (!page)
@@ -619,6 +623,9 @@ static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         /* make sure the cache has finished storing the page */
         nfs_fscache_wait_on_page_write(NFS_I(inode), page);
 
+        wait_on_bit_action(&NFS_I(inode)->flags, NFS_INO_INVALIDATING,
+                        nfs_wait_bit_killable, TASK_KILLABLE);
+
         lock_page(page);
         mapping = page_file_mapping(page);
         if (mapping != inode->i_mapping)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 83107be3dd01..d42dff6d5e98 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -556,6 +556,7 @@ EXPORT_SYMBOL_GPL(nfs_setattr);
  * This is a copy of the common vmtruncate, but with the locking
  * corrected to take into account the fact that NFS requires
  * inode->i_size to be updated under the inode->i_lock.
+ * Note: must be called with inode->i_lock held!
  */
 static int nfs_vmtruncate(struct inode * inode, loff_t offset)
 {
@@ -565,14 +566,14 @@ static int nfs_vmtruncate(struct inode * inode, loff_t offset)
         if (err)
                 goto out;
 
-        spin_lock(&inode->i_lock);
         i_size_write(inode, offset);
         /* Optimisation */
         if (offset == 0)
                 NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_DATA;
-        spin_unlock(&inode->i_lock);
 
+        spin_unlock(&inode->i_lock);
         truncate_pagecache(inode, offset);
+        spin_lock(&inode->i_lock);
 out:
         return err;
 }
@@ -585,10 +586,15 @@ out:
  * Note: we do this in the *proc.c in order to ensure that
  *       it works for things like exclusive creates too.
  */
-void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
+void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr,
+                struct nfs_fattr *fattr)
 {
+        /* Barrier: bump the attribute generation count. */
+        nfs_fattr_set_barrier(fattr);
+
+        spin_lock(&inode->i_lock);
+        NFS_I(inode)->attr_gencount = fattr->gencount;
         if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0) {
-                spin_lock(&inode->i_lock);
                 if ((attr->ia_valid & ATTR_MODE) != 0) {
                         int mode = attr->ia_mode & S_IALLUGO;
                         mode |= inode->i_mode & ~S_IALLUGO;
@@ -600,12 +606,13 @@ void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
                         inode->i_gid = attr->ia_gid;
                 nfs_set_cache_invalid(inode, NFS_INO_INVALID_ACCESS
                                 | NFS_INO_INVALID_ACL);
-                spin_unlock(&inode->i_lock);
         }
         if ((attr->ia_valid & ATTR_SIZE) != 0) {
                 nfs_inc_stats(inode, NFSIOS_SETATTRTRUNC);
                 nfs_vmtruncate(inode, attr->ia_size);
         }
+        nfs_update_inode(inode, fattr);
+        spin_unlock(&inode->i_lock);
 }
 EXPORT_SYMBOL_GPL(nfs_setattr_update_inode);
 
@@ -1028,6 +1035,7 @@ static int nfs_invalidate_mapping(struct inode *inode, struct address_space *map
 
         if (mapping->nrpages != 0) {
                 if (S_ISREG(inode->i_mode)) {
+                        unmap_mapping_range(mapping, 0, 0, 0);
                         ret = nfs_sync_mapping(mapping);
                         if (ret < 0)
                                 return ret;
@@ -1060,11 +1068,14 @@ static bool nfs_mapping_need_revalidate_inode(struct inode *inode)
 }
 
 /**
- * nfs_revalidate_mapping - Revalidate the pagecache
+ * __nfs_revalidate_mapping - Revalidate the pagecache
  * @inode - pointer to host inode
  * @mapping - pointer to mapping
+ * @may_lock - take inode->i_mutex?
  */
-int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
+static int __nfs_revalidate_mapping(struct inode *inode,
+                struct address_space *mapping,
+                bool may_lock)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         unsigned long *bitlock = &nfsi->flags;
@@ -1113,7 +1124,12 @@ int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
         nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
         spin_unlock(&inode->i_lock);
         trace_nfs_invalidate_mapping_enter(inode);
-        ret = nfs_invalidate_mapping(inode, mapping);
+        if (may_lock) {
+                mutex_lock(&inode->i_mutex);
+                ret = nfs_invalidate_mapping(inode, mapping);
+                mutex_unlock(&inode->i_mutex);
+        } else
+                ret = nfs_invalidate_mapping(inode, mapping);
         trace_nfs_invalidate_mapping_exit(inode, ret);
 
         clear_bit_unlock(NFS_INO_INVALIDATING, bitlock);
@@ -1123,6 +1139,29 @@ out:
         return ret;
 }
 
+/**
+ * nfs_revalidate_mapping - Revalidate the pagecache
+ * @inode - pointer to host inode
+ * @mapping - pointer to mapping
+ */
+int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
+{
+        return __nfs_revalidate_mapping(inode, mapping, false);
+}
+
+/**
+ * nfs_revalidate_mapping_protected - Revalidate the pagecache
+ * @inode - pointer to host inode
+ * @mapping - pointer to mapping
+ *
+ * Differs from nfs_revalidate_mapping() in that it grabs the inode->i_mutex
+ * while invalidating the mapping.
+ */
+int nfs_revalidate_mapping_protected(struct inode *inode, struct address_space *mapping)
+{
+        return __nfs_revalidate_mapping(inode, mapping, true);
+}
+
 static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
@@ -1231,13 +1270,6 @@ static int nfs_ctime_need_update(const struct inode *inode, const struct nfs_fat
         return timespec_compare(&fattr->ctime, &inode->i_ctime) > 0;
 }
 
-static int nfs_size_need_update(const struct inode *inode, const struct nfs_fattr *fattr)
-{
-        if (!(fattr->valid & NFS_ATTR_FATTR_SIZE))
-                return 0;
-        return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
-}
-
 static atomic_long_t nfs_attr_generation_counter;
 
 static unsigned long nfs_read_attr_generation_counter(void)
@@ -1249,6 +1281,7 @@ unsigned long nfs_inc_attr_generation_counter(void)
 {
         return atomic_long_inc_return(&nfs_attr_generation_counter);
 }
+EXPORT_SYMBOL_GPL(nfs_inc_attr_generation_counter);
 
 void nfs_fattr_init(struct nfs_fattr *fattr)
 {
@@ -1260,6 +1293,22 @@ void nfs_fattr_init(struct nfs_fattr *fattr)
 }
 EXPORT_SYMBOL_GPL(nfs_fattr_init);
 
+/**
+ * nfs_fattr_set_barrier
+ * @fattr: attributes
+ *
+ * Used to set a barrier after an attribute was updated. This
+ * barrier ensures that older attributes from RPC calls that may
+ * have raced with our update cannot clobber these new values.
+ * Note that you are still responsible for ensuring that other
+ * operations which change the attribute on the server do not
+ * collide.
+ */
+void nfs_fattr_set_barrier(struct nfs_fattr *fattr)
+{
+        fattr->gencount = nfs_inc_attr_generation_counter();
+}
+
 struct nfs_fattr *nfs_alloc_fattr(void)
 {
         struct nfs_fattr *fattr;
@@ -1370,7 +1419,6 @@ static int nfs_inode_attrs_need_update(const struct inode *inode, const struct n
 
         return ((long)fattr->gencount - (long)nfsi->attr_gencount) > 0 ||
                 nfs_ctime_need_update(inode, fattr) ||
-                nfs_size_need_update(inode, fattr) ||
                 ((long)nfsi->attr_gencount - (long)nfs_read_attr_generation_counter() > 0);
 }
 
@@ -1460,6 +1508,7 @@ int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr)
         int status;
 
         spin_lock(&inode->i_lock);
+        nfs_fattr_set_barrier(fattr);
         status = nfs_post_op_update_inode_locked(inode, fattr);
         spin_unlock(&inode->i_lock);
 
@@ -1468,7 +1517,7 @@ int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 EXPORT_SYMBOL_GPL(nfs_post_op_update_inode);
 
 /**
- * nfs_post_op_update_inode_force_wcc - try to update the inode attribute cache
+ * nfs_post_op_update_inode_force_wcc_locked - update the inode attribute cache
  * @inode - pointer to inode
  * @fattr - updated attributes
  *
@@ -1478,11 +1527,10 @@ EXPORT_SYMBOL_GPL(nfs_post_op_update_inode);
  *
  * This function is mainly designed to be used by the ->write_done() functions.
  */
-int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr)
+int nfs_post_op_update_inode_force_wcc_locked(struct inode *inode, struct nfs_fattr *fattr)
 {
         int status;
 
-        spin_lock(&inode->i_lock);
         /* Don't do a WCC update if these attributes are already stale */
         if ((fattr->valid & NFS_ATTR_FATTR) == 0 ||
                         !nfs_inode_attrs_need_update(inode, fattr)) {
@@ -1514,6 +1562,27 @@ int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fa
         }
 out_noforce:
         status = nfs_post_op_update_inode_locked(inode, fattr);
+        return status;
+}
+
+/**
+ * nfs_post_op_update_inode_force_wcc - try to update the inode attribute cache
+ * @inode - pointer to inode
+ * @fattr - updated attributes
+ *
+ * After an operation that has changed the inode metadata, mark the
+ * attribute cache as being invalid, then try to update it. Fake up
+ * weak cache consistency data, if none exist.
+ *
+ * This function is mainly designed to be used by the ->write_done() functions.
+ */
+int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr)
+{
+        int status;
+
+        spin_lock(&inode->i_lock);
+        nfs_fattr_set_barrier(fattr);
+        status = nfs_post_op_update_inode_force_wcc_locked(inode, fattr);
         spin_unlock(&inode->i_lock);
         return status;
 }
@@ -1715,6 +1784,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 nfs_inc_stats(inode, NFSIOS_ATTRINVALIDATE);
                 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
                 nfsi->attrtimeo_timestamp = now;
+                /* Set barrier to be more recent than all outstanding updates */
                 nfsi->attr_gencount = nfs_inc_attr_generation_counter();
         } else {
                 if (!time_in_range_open(now, nfsi->attrtimeo_timestamp, nfsi->attrtimeo_timestamp + nfsi->attrtimeo)) {
@@ -1722,6 +1792,9 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                                 nfsi->attrtimeo = NFS_MAXATTRTIMEO(inode);
                         nfsi->attrtimeo_timestamp = now;
                 }
+                /* Set the barrier to be more recent than this fattr */
+                if ((long)fattr->gencount - (long)nfsi->attr_gencount > 0)
+                        nfsi->attr_gencount = fattr->gencount;
         }
         invalid &= ~NFS_INO_INVALID_ATTR;
         /* Don't invalidate the data if we were to blame */
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index b802fb3a2d99..9e6475bc5ba2 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -459,6 +459,7 @@ void nfs_mark_request_commit(struct nfs_page *req,
                              struct nfs_commit_info *cinfo,
                              u32 ds_commit_idx);
 int nfs_write_need_commit(struct nfs_pgio_header *);
+void nfs_writeback_update_inode(struct nfs_pgio_header *hdr);
 int nfs_generic_commit_list(struct inode *inode, struct list_head *head,
                             int how, struct nfs_commit_info *cinfo);
 void nfs_retry_commit(struct list_head *page_list,
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 78e557c3ab87..1f11d2533ee4 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -138,7 +138,7 @@ nfs3_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
         if (status == 0)
-                nfs_setattr_update_inode(inode, sattr);
+                nfs_setattr_update_inode(inode, sattr, fattr);
         dprintk("NFS reply setattr: %d\n", status);
         return status;
 }
@@ -834,7 +834,7 @@ static int nfs3_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
         if (nfs3_async_handle_jukebox(task, inode))
                 return -EAGAIN;
         if (task->tk_status >= 0)
-                nfs_post_op_update_inode_force_wcc(inode, hdr->res.fattr);
+                nfs_writeback_update_inode(hdr);
         return 0;
 }
 
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 2a932fdc57cb..53852a4bd88b 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1987,6 +1987,11 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
                 if (entry->fattr->valid & NFS_ATTR_FATTR_V3)
                         entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
 
+                if (entry->fattr->fileid != entry->ino) {
+                        entry->fattr->mounted_on_fileid = entry->ino;
+                        entry->fattr->valid |= NFS_ATTR_FATTR_MOUNTED_ON_FILEID;
+                }
+
                 /* In fact, a post_op_fh3: */
                 p = xdr_inline_decode(xdr, 4);
                 if (unlikely(p == NULL))
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 8646af9b11d2..86d6214ea022 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -621,6 +621,9 @@ int nfs41_walk_client_list(struct nfs_client *new,
         spin_lock(&nn->nfs_client_lock);
         list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
 
+                if (pos == new)
+                        goto found;
+
                 if (pos->rpc_ops != new->rpc_ops)
                         continue;
 
@@ -639,10 +642,6 @@ int nfs41_walk_client_list(struct nfs_client *new,
                         prev = pos;
 
                         status = nfs_wait_client_init_complete(pos);
-                        if (pos->cl_cons_state == NFS_CS_SESSION_INITING) {
-                                nfs4_schedule_lease_recovery(pos);
-                                status = nfs4_wait_clnt_recover(pos);
-                        }
                         spin_lock(&nn->nfs_client_lock);
                         if (status < 0)
                                 break;
@@ -668,7 +667,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
                  */
                 if (!nfs4_match_client_owner_id(pos, new))
                         continue;
-
+found:
                 atomic_inc(&pos->cl_count);
                 *result = pos;
                 status = 0;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 88180ac5ea0e..627f37c44456 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -901,6 +901,7 @@ static void update_changeattr(struct inode *dir, struct nfs4_change_info *cinfo)
         if (!cinfo->atomic || cinfo->before != dir->i_version)
                 nfs_force_lookup_revalidate(dir);
         dir->i_version = cinfo->after;
+        nfsi->attr_gencount = nfs_inc_attr_generation_counter();
         nfs_fscache_invalidate(dir);
         spin_unlock(&dir->i_lock);
 }
@@ -1552,6 +1553,9 @@ static int nfs4_open_recover_helper(struct nfs4_opendata *opendata, fmode_t fmod
 
         opendata->o_arg.open_flags = 0;
         opendata->o_arg.fmode = fmode;
+        opendata->o_arg.share_access = nfs4_map_atomic_open_share(
+                        NFS_SB(opendata->dentry->d_sb),
+                        fmode, 0);
         memset(&opendata->o_res, 0, sizeof(opendata->o_res));
         memset(&opendata->c_res, 0, sizeof(opendata->c_res));
         nfs4_init_opendata_res(opendata);
@@ -2413,8 +2417,8 @@ static int _nfs4_do_open(struct inode *dir,
                                 opendata->o_res.f_attr, sattr,
                                 state, label, olabel);
                 if (status == 0) {
-                        nfs_setattr_update_inode(state->inode, sattr);
-                        nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
+                        nfs_setattr_update_inode(state->inode, sattr,
+                                        opendata->o_res.f_attr);
                         nfs_setsecurity(state->inode, opendata->o_res.f_attr, olabel);
                 }
         }
@@ -2651,7 +2655,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                 case -NFS4ERR_BAD_STATEID:
                 case -NFS4ERR_EXPIRED:
                         if (!nfs4_stateid_match(&calldata->arg.stateid,
-                                                &state->stateid)) {
+                                                &state->open_stateid)) {
                                 rpc_restart_call_prepare(task);
                                 goto out_release;
                         }
@@ -2687,7 +2691,7 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
         is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
         is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
         is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
-        nfs4_stateid_copy(&calldata->arg.stateid, &state->stateid);
+        nfs4_stateid_copy(&calldata->arg.stateid, &state->open_stateid);
         /* Calculate the change in open mode */
         calldata->arg.fmode = 0;
         if (state->n_rdwr == 0) {
@@ -3288,7 +3292,7 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
 
         status = nfs4_do_setattr(inode, cred, fattr, sattr, state, NULL, label);
         if (status == 0) {
-                nfs_setattr_update_inode(inode, sattr);
+                nfs_setattr_update_inode(inode, sattr, fattr);
                 nfs_setsecurity(inode, fattr, label);
         }
         nfs4_label_free(label);
@@ -4234,7 +4238,7 @@ static int nfs4_write_done_cb(struct rpc_task *task,
         }
         if (task->tk_status >= 0) {
                 renew_lease(NFS_SERVER(inode), hdr->timestamp);
-                nfs_post_op_update_inode_force_wcc(inode, &hdr->fattr);
+                nfs_writeback_update_inode(hdr);
         }
         return 0;
 }
@@ -6893,9 +6897,13 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
 
         if (status == 0) {
                 clp->cl_clientid = res.clientid;
-                clp->cl_exchange_flags = (res.flags & ~EXCHGID4_FLAG_CONFIRMED_R);
-                if (!(res.flags & EXCHGID4_FLAG_CONFIRMED_R))
+                clp->cl_exchange_flags = res.flags;
+                /* Client ID is not confirmed */
+                if (!(res.flags & EXCHGID4_FLAG_CONFIRMED_R)) {
+                        clear_bit(NFS4_SESSION_ESTABLISHED,
+                                        &clp->cl_session->session_state);
                         clp->cl_seqid = res.seqid;
+                }
 
                 kfree(clp->cl_serverowner);
                 clp->cl_serverowner = res.server_owner;
@@ -7227,6 +7235,9 @@ static void nfs4_update_session(struct nfs4_session *session,
                 struct nfs41_create_session_res *res)
 {
         nfs4_copy_sessionid(&session->sess_id, &res->sessionid);
+        /* Mark client id and session as being confirmed */
+        session->clp->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
+        set_bit(NFS4_SESSION_ESTABLISHED, &session->session_state);
         session->flags = res->flags;
         memcpy(&session->fc_attrs, &res->fc_attrs, sizeof(session->fc_attrs));
         if (res->flags & SESSION4_BACK_CHAN)
@@ -7322,8 +7333,8 @@ int nfs4_proc_destroy_session(struct nfs4_session *session,
         dprintk("--> nfs4_proc_destroy_session\n");
 
         /* session is still being setup */
-        if (session->clp->cl_cons_state != NFS_CS_READY)
-                return status;
+        if (!test_and_clear_bit(NFS4_SESSION_ESTABLISHED, &session->session_state))
+                return 0;
 
         status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         trace_nfs4_destroy_session(session->clp, status);
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index fc46c7455898..e3ea2c5324d6 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -70,6 +70,7 @@ struct nfs4_session {
 
 enum nfs4_session_state {
         NFS4_SESSION_INITING,
+        NFS4_SESSION_ESTABLISHED,
 };
 
 extern int nfs4_setup_slot_table(struct nfs4_slot_table *tbl,
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 5ad908e9ce9c..f95e3b58bbc3 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -346,9 +346,23 @@ int nfs41_discover_server_trunking(struct nfs_client *clp,
         status = nfs4_proc_exchange_id(clp, cred);
         if (status != NFS4_OK)
                 return status;
-        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
 
-        return nfs41_walk_client_list(clp, result, cred);
+        status = nfs41_walk_client_list(clp, result, cred);
+        if (status < 0)
+                return status;
+        if (clp != *result)
+                return 0;
+
+        /* Purge state if the client id was established in a prior instance */
+        if (clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R)
+                set_bit(NFS4CLNT_PURGE_STATE, &clp->cl_state);
+        else
+                set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+        nfs4_schedule_state_manager(clp);
+        status = nfs_wait_client_init_complete(clp);
+        if (status < 0)
+                nfs_put_client(clp);
+        return status;
 }
 
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index b09cc23d6f43..c63189acd052 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -139,7 +139,7 @@ nfs_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
         if (status == 0)
-                nfs_setattr_update_inode(inode, sattr);
+                nfs_setattr_update_inode(inode, sattr, fattr);
         dprintk("NFS reply setattr: %d\n", status);
         return status;
 }
@@ -609,10 +609,8 @@ static int nfs_proc_pgio_rpc_prepare(struct rpc_task *task,
 
 static int nfs_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
 {
-        struct inode *inode = hdr->inode;
-
         if (task->tk_status >= 0)
-                nfs_post_op_update_inode_force_wcc(inode, hdr->res.fattr);
+                nfs_writeback_update_inode(hdr);
         return 0;
 }
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 595d81e354d1..849ed784d6ac 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1377,6 +1377,36 @@ static int nfs_should_remove_suid(const struct inode *inode)
         return 0;
 }
 
+static void nfs_writeback_check_extend(struct nfs_pgio_header *hdr,
+                struct nfs_fattr *fattr)
+{
+        struct nfs_pgio_args *argp = &hdr->args;
+        struct nfs_pgio_res *resp = &hdr->res;
+
+        if (!(fattr->valid & NFS_ATTR_FATTR_SIZE))
+                return;
+        if (argp->offset + resp->count != fattr->size)
+                return;
+        if (nfs_size_to_loff_t(fattr->size) < i_size_read(hdr->inode))
+                return;
+        /* Set attribute barrier */
+        nfs_fattr_set_barrier(fattr);
+}
+
+void nfs_writeback_update_inode(struct nfs_pgio_header *hdr)
+{
+        struct nfs_fattr *fattr = hdr->res.fattr;
+        struct inode *inode = hdr->inode;
+
+        if (fattr == NULL)
+                return;
+        spin_lock(&inode->i_lock);
+        nfs_writeback_check_extend(hdr, fattr);
+        nfs_post_op_update_inode_force_wcc_locked(inode, fattr);
+        spin_unlock(&inode->i_lock);
+}
+EXPORT_SYMBOL_GPL(nfs_writeback_update_inode);
+
 /*
  * This function is called when the WRITE call is complete.
  */
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index f6b2a09f793f..d2f2c37dc2db 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1638,7 +1638,7 @@ __destroy_client(struct nfs4_client *clp)
                 nfs4_put_stid(&dp->dl_stid);
         }
         while (!list_empty(&clp->cl_revoked)) {
-                dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
+                dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
                 list_del_init(&dp->dl_recall_lru);
                 nfs4_put_stid(&dp->dl_stid);
         }
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index b2e3ff347620..ecdbae19a766 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -31,6 +31,8 @@
 #include "alloc.h"
 #include "dat.h"
 
+static void __nilfs_btree_init(struct nilfs_bmap *bmap);
+
 static struct nilfs_btree_path *nilfs_btree_alloc_path(void)
 {
         struct nilfs_btree_path *path;
@@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,
         return ret;
 }
 
+/**
+ * nilfs_btree_root_broken - verify consistency of btree root node
+ * @node: btree root node to be examined
+ * @ino: inode number
+ *
+ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned.
+ */
+static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+                                   unsigned long ino)
+{
+        int level, flags, nchildren;
+        int ret = 0;
+
+        level = nilfs_btree_node_get_level(node);
+        flags = nilfs_btree_node_get_flags(node);
+        nchildren = nilfs_btree_node_get_nchildren(node);
+
+        if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+                     level > NILFS_BTREE_LEVEL_MAX ||
+                     nchildren < 0 ||
+                     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+                pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+                        ino, level, flags, nchildren);
+                ret = 1;
+        }
+        return ret;
+}
+
 int nilfs_btree_broken_node_block(struct buffer_head *bh)
 {
         int ret;
@@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(struct nilfs_bmap *btree,
 
         /* convert and insert */
         dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
-        nilfs_btree_init(btree);
+        __nilfs_btree_init(btree);
         if (nreq != NULL) {
                 nilfs_bmap_commit_alloc_ptr(btree, dreq, dat);
                 nilfs_bmap_commit_alloc_ptr(btree, nreq, dat);
@@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operations nilfs_btree_ops_gc = {
         .bop_gather_data        =       NULL,
 };
 
-int nilfs_btree_init(struct nilfs_bmap *bmap)
+static void __nilfs_btree_init(struct nilfs_bmap *bmap)
 {
         bmap->b_ops = &nilfs_btree_ops;
         bmap->b_nchildren_per_block =
                 NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap));
-        return 0;
+}
+
+int nilfs_btree_init(struct nilfs_bmap *bmap)
+{
+        int ret = 0;
+
+        __nilfs_btree_init(bmap);
+
+        if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap),
+                                    bmap->b_inode->i_ino))
+                ret = -EIO;
+        return ret;
 }
 
 void nilfs_btree_init_gc(struct nilfs_bmap *bmap)
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index ce615d12fb44..a2e1cb8a568b 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -397,7 +397,8 @@ STATIC int				/* error (positive) */
 xfs_zero_last_block(
         struct xfs_inode        *ip,
         xfs_fsize_t             offset,
-        xfs_fsize_t             isize)
+        xfs_fsize_t             isize,
+        bool                    *did_zeroing)
 {
         struct xfs_mount        *mp = ip->i_mount;
         xfs_fileoff_t           last_fsb = XFS_B_TO_FSBT(mp, isize);
@@ -425,6 +426,7 @@ xfs_zero_last_block(
         zero_len = mp->m_sb.sb_blocksize - zero_offset;
         if (isize + zero_len > offset)
                 zero_len = offset - isize;
+        *did_zeroing = true;
         return xfs_iozero(ip, isize, zero_len);
 }
 
@@ -443,7 +445,8 @@ int					/* error (positive) */
 xfs_zero_eof(
         struct xfs_inode        *ip,
         xfs_off_t               offset,         /* starting I/O offset */
-        xfs_fsize_t             isize)          /* current inode size */
+        xfs_fsize_t             isize,          /* current inode size */
+        bool                    *did_zeroing)
 {
         struct xfs_mount        *mp = ip->i_mount;
         xfs_fileoff_t           start_zero_fsb;
@@ -465,7 +468,7 @@ xfs_zero_eof(
          * We only zero a part of that block so it is handled specially.
          */
         if (XFS_B_FSB_OFFSET(mp, isize) != 0) {
-                error = xfs_zero_last_block(ip, offset, isize);
+                error = xfs_zero_last_block(ip, offset, isize, did_zeroing);
                 if (error)
                         return error;
         }
@@ -525,6 +528,7 @@ xfs_zero_eof(
                 if (error)
                         return error;
 
+                *did_zeroing = true;
                 start_zero_fsb = imap.br_startoff + imap.br_blockcount;
                 ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
         }
@@ -567,13 +571,15 @@ restart:
          * having to redo all checks before.
          */
         if (*pos > i_size_read(inode)) {
+                bool    zero = false;
+
                 if (*iolock == XFS_IOLOCK_SHARED) {
                         xfs_rw_iunlock(ip, *iolock);
                         *iolock = XFS_IOLOCK_EXCL;
                         xfs_rw_ilock(ip, *iolock);
                         goto restart;
                 }
-                error = xfs_zero_eof(ip, *pos, i_size_read(inode));
+                error = xfs_zero_eof(ip, *pos, i_size_read(inode), &zero);
                 if (error)
                         return error;
         }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index daafa1f6d260..6163767aa856 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2867,6 +2867,10 @@ xfs_rename(
          * Handle RENAME_EXCHANGE flags
          */
         if (flags & RENAME_EXCHANGE) {
+                if (target_ip == NULL) {
+                        error = -EINVAL;
+                        goto error_return;
+                }
                 error = xfs_cross_rename(tp, src_dp, src_name, src_ip,
                                          target_dp, target_name, target_ip,
                                          &free_list, &first_block, spaceres);
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 86cd6b39bed7..a1cd55f3f351 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -384,10 +384,11 @@ enum xfs_prealloc_flags {
         XFS_PREALLOC_INVISIBLE  = (1 << 4),
 };
 
-int             xfs_update_prealloc_flags(struct xfs_inode *,
-                        enum xfs_prealloc_flags);
-int             xfs_zero_eof(struct xfs_inode *, xfs_off_t, xfs_fsize_t);
-int             xfs_iozero(struct xfs_inode *, loff_t, size_t);
+int     xfs_update_prealloc_flags(struct xfs_inode *ip,
+                                  enum xfs_prealloc_flags flags);
+int     xfs_zero_eof(struct xfs_inode *ip, xfs_off_t offset,
+                     xfs_fsize_t isize, bool *did_zeroing);
+int     xfs_iozero(struct xfs_inode *ip, loff_t pos, size_t count);
 
 
 #define IHOLD(ip) \
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index d919ad7b16bf..e53a90331422 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -751,6 +751,7 @@ xfs_setattr_size(
         int                     error;
         uint                    lock_flags = 0;
         uint                    commit_flags = 0;
+        bool                    did_zeroing = false;
 
         trace_xfs_setattr(ip);
 
@@ -794,20 +795,16 @@ xfs_setattr_size(
                 return error;
 
         /*
-         * Now we can make the changes.  Before we join the inode to the
-         * transaction, take care of the part of the truncation that must be
-         * done without the inode lock.  This needs to be done before joining
-         * the inode to the transaction, because the inode cannot be unlocked
-         * once it is a part of the transaction.
+         * File data changes must be complete before we start the transaction to
+         * modify the inode.  This needs to be done before joining the inode to
+         * the transaction because the inode cannot be unlocked once it is a
+         * part of the transaction.
+         *
+         * Start with zeroing any data block beyond EOF that we may expose on
+         * file extension.
          */
         if (newsize > oldsize) {
-                /*
-                 * Do the first part of growing a file: zero any data in the
-                 * last block that is beyond the old EOF.  We need to do this
-                 * before the inode is joined to the transaction to modify
-                 * i_size.
-                 */
-                error = xfs_zero_eof(ip, newsize, oldsize);
+                error = xfs_zero_eof(ip, newsize, oldsize, &did_zeroing);
                 if (error)
                         return error;
         }
@@ -817,23 +814,18 @@ xfs_setattr_size(
          * any previous writes that are beyond the on disk EOF and the new
          * EOF that have not been written out need to be written here.  If we
          * do not write the data out, we expose ourselves to the null files
-         * problem.
-         *
-         * Only flush from the on disk size to the smaller of the in memory
-         * file size or the new size as that's the range we really care about
-         * here and prevents waiting for other data not within the range we
-         * care about here.
+         * problem. Note that this includes any block zeroing we did above;
+         * otherwise those blocks may not be zeroed after a crash.
          */
-        if (oldsize != ip->i_d.di_size && newsize > ip->i_d.di_size) {
+        if (newsize > ip->i_d.di_size &&
+            (oldsize != ip->i_d.di_size || did_zeroing)) {
                 error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
                                                       ip->i_d.di_size, newsize);
                 if (error)
                         return error;
         }
 
-        /*
-         * Wait for all direct I/O to complete.
-         */
+        /* Now wait for all direct I/O to complete. */
         inode_dio_wait(inode);
 
         /*
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index 4b33ef112400..365dd57ea760 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -300,8 +300,10 @@ xfs_fs_commit_blocks(
 
         tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
         error = xfs_trans_reserve(tp, &M_RES(mp)->tr_ichange, 0, 0);
-        if (error)
+        if (error) {
+                xfs_trans_cancel(tp, 0);
                 goto out_drop_iolock;
+        }
 
         xfs_ilock(ip, XFS_ILOCK_EXCL);
         xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 53cc2aaf8d2b..fbbb9e62e274 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -836,6 +836,11 @@ xfs_qm_reset_dqcounts(
                  */
                 xfs_dqcheck(mp, ddq, id+j, type, XFS_QMOPT_DQREPAIR,
                             "xfs_quotacheck");
+                /*
+                 * Reset type in case we are reusing group quota file for
+                 * project quotas or vice versa
+                 */
+                ddq->d_flags = type;
                 ddq->d_bcount = 0;
                 ddq->d_icount = 0;
                 ddq->d_rtbcount = 0;
diff --git a/include/drm/drm_mm.h b/include/drm/drm_mm.h
index a24addfdfcec..0de6290df4da 100644
--- a/include/drm/drm_mm.h
+++ b/include/drm/drm_mm.h
@@ -68,8 +68,8 @@ struct drm_mm_node {
         unsigned scanned_preceeds_hole : 1;
         unsigned allocated : 1;
         unsigned long color;
-        unsigned long start;
-        unsigned long size;
+        u64 start;
+        u64 size;
         struct drm_mm *mm;
 };
 
@@ -82,16 +82,16 @@ struct drm_mm {
         unsigned int scan_check_range : 1;
         unsigned scan_alignment;
         unsigned long scan_color;
-        unsigned long scan_size;
-        unsigned long scan_hit_start;
-        unsigned long scan_hit_end;
+        u64 scan_size;
+        u64 scan_hit_start;
+        u64 scan_hit_end;
         unsigned scanned_blocks;
-        unsigned long scan_start;
-        unsigned long scan_end;
+        u64 scan_start;
+        u64 scan_end;
         struct drm_mm_node *prev_scanned_node;
 
         void (*color_adjust)(struct drm_mm_node *node, unsigned long color,
-                             unsigned long *start, unsigned long *end);
+                             u64 *start, u64 *end);
 };
 
 /**
@@ -124,7 +124,7 @@ static inline bool drm_mm_initialized(struct drm_mm *mm)
         return mm->hole_stack.next;
 }
 
-static inline unsigned long __drm_mm_hole_node_start(struct drm_mm_node *hole_node)
+static inline u64 __drm_mm_hole_node_start(struct drm_mm_node *hole_node)
 {
         return hole_node->start + hole_node->size;
 }
@@ -140,13 +140,13 @@ static inline unsigned long __drm_mm_hole_node_start(struct drm_mm_node *hole_no
  * Returns:
  * Start of the subsequent hole.
  */
-static inline unsigned long drm_mm_hole_node_start(struct drm_mm_node *hole_node)
+static inline u64 drm_mm_hole_node_start(struct drm_mm_node *hole_node)
 {
         BUG_ON(!hole_node->hole_follows);
         return __drm_mm_hole_node_start(hole_node);
 }
 
-static inline unsigned long __drm_mm_hole_node_end(struct drm_mm_node *hole_node)
+static inline u64 __drm_mm_hole_node_end(struct drm_mm_node *hole_node)
 {
         return list_entry(hole_node->node_list.next,
                           struct drm_mm_node, node_list)->start;
@@ -163,7 +163,7 @@ static inline unsigned long __drm_mm_hole_node_end(struct drm_mm_node *hole_node
  * Returns:
  * End of the subsequent hole.
  */
-static inline unsigned long drm_mm_hole_node_end(struct drm_mm_node *hole_node)
+static inline u64 drm_mm_hole_node_end(struct drm_mm_node *hole_node)
 {
         return __drm_mm_hole_node_end(hole_node);
 }
@@ -222,7 +222,7 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node);
 
 int drm_mm_insert_node_generic(struct drm_mm *mm,
                                struct drm_mm_node *node,
-                               unsigned long size,
+                               u64 size,
                                unsigned alignment,
                                unsigned long color,
                                enum drm_mm_search_flags sflags,
@@ -245,7 +245,7 @@ int drm_mm_insert_node_generic(struct drm_mm *mm,
  */
 static inline int drm_mm_insert_node(struct drm_mm *mm,
                                      struct drm_mm_node *node,
-                                     unsigned long size,
+                                     u64 size,
                                      unsigned alignment,
                                      enum drm_mm_search_flags flags)
 {
@@ -255,11 +255,11 @@ static inline int drm_mm_insert_node(struct drm_mm *mm,
 
 int drm_mm_insert_node_in_range_generic(struct drm_mm *mm,
                                         struct drm_mm_node *node,
-                                        unsigned long size,
+                                        u64 size,
                                         unsigned alignment,
                                         unsigned long color,
-                                        unsigned long start,
-                                        unsigned long end,
+                                        u64 start,
+                                        u64 end,
                                         enum drm_mm_search_flags sflags,
                                         enum drm_mm_allocator_flags aflags);
 /**
@@ -282,10 +282,10 @@ int drm_mm_insert_node_in_range_generic(struct drm_mm *mm,
  */
 static inline int drm_mm_insert_node_in_range(struct drm_mm *mm,
                                               struct drm_mm_node *node,
-                                              unsigned long size,
+                                              u64 size,
                                               unsigned alignment,
-                                              unsigned long start,
-                                              unsigned long end,
+                                              u64 start,
+                                              u64 end,
                                               enum drm_mm_search_flags flags)
 {
         return drm_mm_insert_node_in_range_generic(mm, node, size, alignment,
@@ -296,21 +296,21 @@ static inline int drm_mm_insert_node_in_range(struct drm_mm *mm,
 void drm_mm_remove_node(struct drm_mm_node *node);
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new);
 void drm_mm_init(struct drm_mm *mm,
-                 unsigned long start,
-                 unsigned long size);
+                 u64 start,
+                 u64 size);
 void drm_mm_takedown(struct drm_mm *mm);
 bool drm_mm_clean(struct drm_mm *mm);
 
 void drm_mm_init_scan(struct drm_mm *mm,
-                      unsigned long size,
+                      u64 size,
                       unsigned alignment,
                       unsigned long color);
 void drm_mm_init_scan_with_range(struct drm_mm *mm,
-                                 unsigned long size,
+                                 u64 size,
                                  unsigned alignment,
                                  unsigned long color,
-                                 unsigned long start,
-                                 unsigned long end);
+                                 u64 start,
+                                 u64 end);
 bool drm_mm_scan_add_block(struct drm_mm_node *node);
 bool drm_mm_scan_remove_block(struct drm_mm_node *node);
 
diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index 38a7c8049e47..f2e47fd56751 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -214,9 +214,9 @@
         INTEL_VGA_DEVICE((((gt) - 1) << 4) | (id), info)
 
 #define _INTEL_BDW_M_IDS(gt, info) \
-        _INTEL_BDW_M(gt, 0x1602, info), /* ULT */ \
+        _INTEL_BDW_M(gt, 0x1602, info), /* Halo */ \
         _INTEL_BDW_M(gt, 0x1606, info), /* ULT */ \
-        _INTEL_BDW_M(gt, 0x160B, info), /* Iris */ \
+        _INTEL_BDW_M(gt, 0x160B, info), /* ULT */ \
         _INTEL_BDW_M(gt, 0x160E, info) /* ULX */
 
 #define _INTEL_BDW_D_IDS(gt, info) \
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 0ccf7f267ff9..c768ddfbe53c 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -249,7 +249,7 @@ struct ttm_buffer_object {
          * either of these locks held.
          */
 
-        unsigned long offset;
+        uint64_t offset; /* GPU address space is independent of CPU word size */
         uint32_t cur_placement;
 
         struct sg_table *sg;
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 142d752fc450..813042cede57 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -277,7 +277,7 @@ struct ttm_mem_type_manager {
         bool has_type;
         bool use_type;
         uint32_t flags;
-        unsigned long gpu_offset;
+        uint64_t gpu_offset; /* GPU address space is independent of CPU word size */
         uint64_t size;
         uint32_t available_caching;
         uint32_t default_caching;
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index f551a9299ac9..306178d7309f 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -126,6 +126,8 @@ struct cpuidle_driver {
 
 #ifdef CONFIG_CPU_IDLE
 extern void disable_cpuidle(void);
+extern bool cpuidle_not_available(struct cpuidle_driver *drv,
+                                  struct cpuidle_device *dev);
 
 extern int cpuidle_select(struct cpuidle_driver *drv,
                           struct cpuidle_device *dev);
@@ -150,11 +152,17 @@ extern void cpuidle_resume(void);
 extern int cpuidle_enable_device(struct cpuidle_device *dev);
 extern void cpuidle_disable_device(struct cpuidle_device *dev);
 extern int cpuidle_play_dead(void);
-extern void cpuidle_enter_freeze(void);
+extern int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
+                                      struct cpuidle_device *dev);
+extern int cpuidle_enter_freeze(struct cpuidle_driver *drv,
+                                struct cpuidle_device *dev);
 
 extern struct cpuidle_driver *cpuidle_get_cpu_driver(struct cpuidle_device *dev);
 #else
 static inline void disable_cpuidle(void) { }
+static inline bool cpuidle_not_available(struct cpuidle_driver *drv,
+                                         struct cpuidle_device *dev)
+{return true; }
 static inline int cpuidle_select(struct cpuidle_driver *drv,
                                  struct cpuidle_device *dev)
 {return -ENODEV; }
@@ -183,7 +191,12 @@ static inline int cpuidle_enable_device(struct cpuidle_device *dev)
 {return -ENODEV; }
 static inline void cpuidle_disable_device(struct cpuidle_device *dev) { }
 static inline int cpuidle_play_dead(void) {return -ENODEV; }
-static inline void cpuidle_enter_freeze(void) { }
+static inline int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
+                                             struct cpuidle_device *dev)
+{return -ENODEV; }
+static inline int cpuidle_enter_freeze(struct cpuidle_driver *drv,
+                                       struct cpuidle_device *dev)
+{return -ENODEV; }
 static inline struct cpuidle_driver *cpuidle_get_cpu_driver(
         struct cpuidle_device *dev) {return NULL; }
 #endif
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index 51f7ccadf923..4173a8fdad9e 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -33,6 +33,8 @@
  * @units:              Measurment unit for this attribute.
  * @unit_expo:          Exponent used in the data.
  * @size:               Size in bytes for data size.
+ * @logical_minimum:    Logical minimum value for this attribute.
+ * @logical_maximum:    Logical maximum value for this attribute.
  */
 struct hid_sensor_hub_attribute_info {
         u32 usage_id;
@@ -146,6 +148,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
 
 /**
 * sensor_hub_input_attr_get_raw_value() - Synchronous read request
+* @hsdev:       Hub device instance.
 * @usage_id:    Attribute usage id of parent physical device as per spec
 * @attr_usage_id:       Attribute usage id as per spec
 * @report_id:   Report id to look for
@@ -160,6 +163,7 @@ int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                         u32 attr_usage_id, u32 report_id);
 /**
 * sensor_hub_set_feature() - Feature set request
+* @hsdev:       Hub device instance.
 * @report_id:   Report id to look for
 * @field_index: Field index inside a report
 * @value:       Value to set
@@ -172,6 +176,7 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 
 /**
 * sensor_hub_get_feature() - Feature get request
+* @hsdev:       Hub device instance.
 * @report_id:   Report id to look for
 * @field_index: Field index inside a report
 * @value:       Place holder for return value
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index d9b05b5bf8c7..2e88580194f0 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -52,11 +52,17 @@
  * IRQF_ONESHOT - Interrupt is not reenabled after the hardirq handler finished.
  *                Used by threaded interrupts which need to keep the
  *                irq line disabled until the threaded handler has been run.
- * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend
+ * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend.  Does not guarantee
+ *                   that this interrupt will wake the system from a suspended
+ *                   state.  See Documentation/power/suspend-and-interrupts.txt
  * IRQF_FORCE_RESUME - Force enable it on resume even if IRQF_NO_SUSPEND is set
  * IRQF_NO_THREAD - Interrupt cannot be threaded
  * IRQF_EARLY_RESUME - Resume IRQ early during syscore instead of at device
  *                resume time.
+ * IRQF_COND_SUSPEND - If the IRQ is shared with a NO_SUSPEND user, execute this
+ *                interrupt handler after suspending interrupts. For system
+ *                wakeup devices users need to implement wakeup detection in
+ *                their interrupt handlers.
  */
 #define IRQF_DISABLED           0x00000020
 #define IRQF_SHARED             0x00000080
@@ -70,6 +76,7 @@
 #define IRQF_FORCE_RESUME       0x00008000
 #define IRQF_NO_THREAD          0x00010000
 #define IRQF_EARLY_RESUME       0x00020000
+#define IRQF_COND_SUSPEND       0x00040000
 
 #define IRQF_TIMER              (__IRQF_TIMER | IRQF_NO_SUSPEND | IRQF_NO_THREAD)
 
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index faf433af425e..dd1109fb241e 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -78,6 +78,7 @@ struct irq_desc {
 #ifdef CONFIG_PM_SLEEP
         unsigned int            nr_actions;
         unsigned int            no_suspend_depth;
+        unsigned int            cond_suspend_depth;
         unsigned int            force_resume_depth;
 #endif
 #ifdef CONFIG_PROC_FS
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index 2bbc62aa818a..551f85456c11 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -427,7 +427,7 @@ struct mlx4_wqe_inline_seg {
 
 enum mlx4_update_qp_attr {
         MLX4_UPDATE_QP_SMAC             = 1 << 0,
-        MLX4_UPDATE_QP_VSD              = 1 << 2,
+        MLX4_UPDATE_QP_VSD              = 1 << 1,
         MLX4_UPDATE_QP_SUPPORTED_ATTRS  = (1 << 2) - 1
 };
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5897b4ea5a3f..429d1790a27e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2342,6 +2342,7 @@ struct gro_remcsum {
 
 static inline void skb_gro_remcsum_init(struct gro_remcsum *grc)
 {
+        grc->offset = 0;
         grc->delta = 0;
 }
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 2f77e0c651c8..b01ccf371fdc 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -343,6 +343,7 @@ extern struct inode *nfs_fhget(struct super_block *, struct nfs_fh *,
 extern int nfs_refresh_inode(struct inode *, struct nfs_fattr *);
 extern int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr);
 extern int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr);
+extern int nfs_post_op_update_inode_force_wcc_locked(struct inode *inode, struct nfs_fattr *fattr);
 extern int nfs_getattr(struct vfsmount *, struct dentry *, struct kstat *);
 extern void nfs_access_add_cache(struct inode *, struct nfs_access_entry *);
 extern void nfs_access_set_mask(struct nfs_access_entry *, u32);
@@ -355,8 +356,9 @@ extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int nfs_revalidate_inode_rcu(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
+extern int nfs_revalidate_mapping_protected(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
-extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
+extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr, struct nfs_fattr *);
 extern void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                 struct nfs4_label *label);
 extern struct nfs_open_context *get_nfs_open_context(struct nfs_open_context *ctx);
@@ -369,6 +371,7 @@ extern struct nfs_lock_context *nfs_get_lock_context(struct nfs_open_context *ct
 extern void nfs_put_lock_context(struct nfs_lock_context *l_ctx);
 extern u64 nfs_compat_user_ino64(u64 fileid);
 extern void nfs_fattr_init(struct nfs_fattr *fattr);
+extern void nfs_fattr_set_barrier(struct nfs_fattr *fattr);
 extern unsigned long nfs_inc_attr_generation_counter(void);
 
 extern struct nfs_fattr *nfs_alloc_fattr(void);
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index 58851275fed9..d438eeb08bff 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -54,10 +54,11 @@ struct rhash_head {
  * @buckets: size * hash buckets
  */
 struct bucket_table {
-        size_t                          size;
-        unsigned int                    locks_mask;
-        spinlock_t                      *locks;
-        struct rhash_head __rcu         *buckets[];
+        size_t                  size;
+        unsigned int            locks_mask;
+        spinlock_t              *locks;
+
+        struct rhash_head __rcu *buckets[] ____cacheline_aligned_in_smp;
 };
 
 typedef u32 (*rht_hashfn_t)(const void *data, u32 len, u32 seed);
@@ -78,12 +79,6 @@ struct rhashtable;
  * @locks_mul: Number of bucket locks to allocate per cpu (default: 128)
  * @hashfn: Function to hash key
  * @obj_hashfn: Function to hash object
- * @grow_decision: If defined, may return true if table should expand
- * @shrink_decision: If defined, may return true if table should shrink
- *
- * Note: when implementing the grow and shrink decision function, min/max
- * shift must be enforced, otherwise, resizing watermarks they set may be
- * useless.
  */
 struct rhashtable_params {
         size_t                  nelem_hint;
@@ -97,10 +92,6 @@ struct rhashtable_params {
         size_t                  locks_mul;
         rht_hashfn_t            hashfn;
         rht_obj_hashfn_t        obj_hashfn;
-        bool                    (*grow_decision)(const struct rhashtable *ht,
-                                                 size_t new_size);
-        bool                    (*shrink_decision)(const struct rhashtable *ht,
-                                                   size_t new_size);
 };
 
 /**
@@ -192,9 +183,6 @@ int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params);
 void rhashtable_insert(struct rhashtable *ht, struct rhash_head *node);
 bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *node);
 
-bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size);
-bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
-
 int rhashtable_expand(struct rhashtable *ht);
 int rhashtable_shrink(struct rhashtable *ht);
 
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index baf3e1d08416..d10965f0d8a4 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -143,13 +143,13 @@ struct uart_port {
         unsigned char           iotype;                 /* io access style */
         unsigned char           unused1;
 
-#define UPIO_PORT               (0)                     /* 8b I/O port access */
-#define UPIO_HUB6               (1)                     /* Hub6 ISA card */
-#define UPIO_MEM                (2)                     /* 8b MMIO access */
-#define UPIO_MEM32              (3)                     /* 32b little endian */
-#define UPIO_MEM32BE            (4)                     /* 32b big endian */
-#define UPIO_AU                 (5)                     /* Au1x00 and RT288x type IO */
-#define UPIO_TSI                (6)                     /* Tsi108/109 type IO */
+#define UPIO_PORT               (SERIAL_IO_PORT)        /* 8b I/O port access */
+#define UPIO_HUB6               (SERIAL_IO_HUB6)        /* Hub6 ISA card */
+#define UPIO_MEM                (SERIAL_IO_MEM)         /* 8b MMIO access */
+#define UPIO_MEM32              (SERIAL_IO_MEM32)       /* 32b little endian */
+#define UPIO_AU                 (SERIAL_IO_AU)          /* Au1x00 and RT288x type IO */
+#define UPIO_TSI                (SERIAL_IO_TSI)         /* Tsi108/109 type IO */
+#define UPIO_MEM32BE            (SERIAL_IO_MEM32BE)     /* 32b big endian */
 
         unsigned int            read_status_mask;       /* driver specific */
         unsigned int            ignore_status_mask;     /* driver specific */
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index fc52e307efab..5eac316490ea 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -314,6 +314,8 @@ void thermal_zone_of_sensor_unregister(struct device *dev,
 }
 
 #endif
+
+#if IS_ENABLED(CONFIG_THERMAL)
 struct thermal_zone_device *thermal_zone_device_register(const char *, int, int,
                 void *, struct thermal_zone_device_ops *,
                 const struct thermal_zone_params *, int, int);
@@ -340,8 +342,58 @@ struct thermal_instance *get_thermal_instance(struct thermal_zone_device *,
                 struct thermal_cooling_device *, int);
 void thermal_cdev_update(struct thermal_cooling_device *);
 void thermal_notify_framework(struct thermal_zone_device *, int);
-
-#ifdef CONFIG_NET
+#else
+static inline struct thermal_zone_device *thermal_zone_device_register(
+        const char *type, int trips, int mask, void *devdata,
+        struct thermal_zone_device_ops *ops,
+        const struct thermal_zone_params *tzp,
+        int passive_delay, int polling_delay)
+{ return ERR_PTR(-ENODEV); }
+static inline void thermal_zone_device_unregister(
+        struct thermal_zone_device *tz)
+{ }
+static inline int thermal_zone_bind_cooling_device(
+        struct thermal_zone_device *tz, int trip,
+        struct thermal_cooling_device *cdev,
+        unsigned long upper, unsigned long lower)
+{ return -ENODEV; }
+static inline int thermal_zone_unbind_cooling_device(
+        struct thermal_zone_device *tz, int trip,
+        struct thermal_cooling_device *cdev)
+{ return -ENODEV; }
+static inline void thermal_zone_device_update(struct thermal_zone_device *tz)
+{ }
+static inline struct thermal_cooling_device *
+thermal_cooling_device_register(char *type, void *devdata,
+        const struct thermal_cooling_device_ops *ops)
+{ return ERR_PTR(-ENODEV); }
+static inline struct thermal_cooling_device *
+thermal_of_cooling_device_register(struct device_node *np,
+        char *type, void *devdata, const struct thermal_cooling_device_ops *ops)
+{ return ERR_PTR(-ENODEV); }
+static inline void thermal_cooling_device_unregister(
+        struct thermal_cooling_device *cdev)
+{ }
+static inline struct thermal_zone_device *thermal_zone_get_zone_by_name(
+                const char *name)
+{ return ERR_PTR(-ENODEV); }
+static inline int thermal_zone_get_temp(
+                struct thermal_zone_device *tz, unsigned long *temp)
+{ return -ENODEV; }
+static inline int get_tz_trend(struct thermal_zone_device *tz, int trip)
+{ return -ENODEV; }
+static inline struct thermal_instance *
+get_thermal_instance(struct thermal_zone_device *tz,
+        struct thermal_cooling_device *cdev, int trip)
+{ return ERR_PTR(-ENODEV); }
+static inline void thermal_cdev_update(struct thermal_cooling_device *cdev)
+{ }
+static inline void thermal_notify_framework(struct thermal_zone_device *tz,
+        int trip)
+{ }
+#endif /* CONFIG_THERMAL */
+
+#if defined(CONFIG_NET) && IS_ENABLED(CONFIG_THERMAL)
 extern int thermal_generate_netlink_event(struct thermal_zone_device *tz,
                                                 enum events event);
 #else
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 9bb547c7bce7..704a1ab8240c 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -190,8 +190,7 @@ static inline void usb_set_serial_data(struct usb_serial *serial, void *data)
  * @num_ports: the number of different ports this device will have.
  * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer
  *      (0 = end-point size)
- * @bulk_out_size: minimum number of bytes to allocate for bulk-out buffer
- *      (0 = end-point size)
+ * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size)
  * @calc_num_ports: pointer to a function to determine how many ports this
  *      device has dynamically.  It will be called after the probe()
  *      callback is called, but before attach()
diff --git a/include/net/caif/cfpkt.h b/include/net/caif/cfpkt.h
index 1c1ad46250d5..fe328c52c46b 100644
--- a/include/net/caif/cfpkt.h
+++ b/include/net/caif/cfpkt.h
@@ -171,7 +171,7 @@ struct cfpkt *cfpkt_split(struct cfpkt *pkt, u16 pos);
  * @return    Checksum of buffer.
  */
 
-u16 cfpkt_iterate(struct cfpkt *pkt,
+int cfpkt_iterate(struct cfpkt *pkt,
                 u16 (*iter_func)(u16 chks, void *buf, u16 len),
                 u16 data);
 
diff --git a/include/uapi/linux/serial.h b/include/uapi/linux/serial.h
index 5e0d0ed61cf3..25331f9faa76 100644
--- a/include/uapi/linux/serial.h
+++ b/include/uapi/linux/serial.h
@@ -65,6 +65,10 @@ struct serial_struct {
 #define SERIAL_IO_PORT  0
 #define SERIAL_IO_HUB6  1
 #define SERIAL_IO_MEM   2
+#define SERIAL_IO_MEM32   3
+#define SERIAL_IO_AU      4
+#define SERIAL_IO_TSI     5
+#define SERIAL_IO_MEM32BE 6
 
 #define UART_CLEAR_FIFO         0x01
 #define UART_USE_FIFO           0x02
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index 19d5219b0b99..242cf0c6e33d 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -9,3 +9,4 @@ header-y += tc_pedit.h
 header-y += tc_skbedit.h
 header-y += tc_vlan.h
 header-y += tc_bpf.h
+header-y += tc_connmark.h
diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
index 7491ee5d8164..83338210ee04 100644
--- a/include/xen/xen-ops.h
+++ b/include/xen/xen-ops.h
@@ -46,4 +46,30 @@ static inline efi_system_table_t __init *xen_efi_probe(void)
 }
 #endif
 
+#ifdef CONFIG_PREEMPT
+
+static inline void xen_preemptible_hcall_begin(void)
+{
+}
+
+static inline void xen_preemptible_hcall_end(void)
+{
+}
+
+#else
+
+DECLARE_PER_CPU(bool, xen_in_preemptible_hcall);
+
+static inline void xen_preemptible_hcall_begin(void)
+{
+        __this_cpu_write(xen_in_preemptible_hcall, true);
+}
+
+static inline void xen_preemptible_hcall_end(void)
+{
+        __this_cpu_write(xen_in_preemptible_hcall, false);
+}
+
+#endif /* CONFIG_PREEMPT */
+
 #endif /* INCLUDE_XEN_OPS_H */
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 196a06fbc122..886d09e691d5 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1474,8 +1474,13 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
          * otherwise we'll have trouble later trying to figure out
          * which interrupt is which (messes up the interrupt freeing
          * logic etc).
+         *
+         * Also IRQF_COND_SUSPEND only makes sense for shared interrupts and
+         * it cannot be set along with IRQF_NO_SUSPEND.
          */
-        if ((irqflags & IRQF_SHARED) && !dev_id)
+        if (((irqflags & IRQF_SHARED) && !dev_id) ||
+            (!(irqflags & IRQF_SHARED) && (irqflags & IRQF_COND_SUSPEND)) ||
+            ((irqflags & IRQF_NO_SUSPEND) && (irqflags & IRQF_COND_SUSPEND)))
                 return -EINVAL;
 
         desc = irq_to_desc(irq);
diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index 3ca532592704..5204a6d1b985 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -43,9 +43,12 @@ void irq_pm_install_action(struct irq_desc *desc, struct irqaction *action)
 
         if (action->flags & IRQF_NO_SUSPEND)
                 desc->no_suspend_depth++;
+        else if (action->flags & IRQF_COND_SUSPEND)
+                desc->cond_suspend_depth++;
 
         WARN_ON_ONCE(desc->no_suspend_depth &&
-                     desc->no_suspend_depth != desc->nr_actions);
+                     (desc->no_suspend_depth +
+                        desc->cond_suspend_depth) != desc->nr_actions);
 }
 
 /*
@@ -61,6 +64,8 @@ void irq_pm_remove_action(struct irq_desc *desc, struct irqaction *action)
 
         if (action->flags & IRQF_NO_SUSPEND)
                 desc->no_suspend_depth--;
+        else if (action->flags & IRQF_COND_SUSPEND)
+                desc->cond_suspend_depth--;
 }
 
 static bool suspend_device_irq(struct irq_desc *desc, int irq)
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index ff7f47d026ac..01ca08804f51 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -248,11 +248,12 @@ static int klp_find_external_symbol(struct module *pmod, const char *name,
         /* first, check if it's an exported symbol */
         preempt_disable();
         sym = find_symbol(name, NULL, NULL, true, true);
-        preempt_enable();
         if (sym) {
                 *addr = sym->value;
+                preempt_enable();
                 return 0;
         }
+        preempt_enable();
 
         /* otherwise check if it's in another .o within the patch module */
         return klp_find_object_symbol(pmod->name, name, addr);
@@ -314,12 +315,12 @@ static void notrace klp_ftrace_handler(unsigned long ip,
         rcu_read_lock();
         func = list_first_or_null_rcu(&ops->func_stack, struct klp_func,
                                       stack_node);
-        rcu_read_unlock();
-
         if (WARN_ON_ONCE(!func))
-                return;
+                goto unlock;
 
         klp_arch_set_pc(regs, (unsigned long)func->new_func);
+unlock:
+        rcu_read_unlock();
 }
 
 static int klp_disable_func(struct klp_func *func)
@@ -731,7 +732,7 @@ static int klp_init_func(struct klp_object *obj, struct klp_func *func)
         func->state = KLP_DISABLED;
 
         return kobject_init_and_add(&func->kobj, &klp_ktype_func,
-                                    obj->kobj, func->old_name);
+                                    obj->kobj, "%s", func->old_name);
 }
 
 /* parts of the initialization that is done only when the object is loaded */
@@ -807,7 +808,7 @@ static int klp_init_patch(struct klp_patch *patch)
         patch->state = KLP_DISABLED;
 
         ret = kobject_init_and_add(&patch->kobj, &klp_ktype_patch,
-                                   klp_root_kobj, patch->mod->name);
+                                   klp_root_kobj, "%s", patch->mod->name);
         if (ret)
                 goto unlock;
 
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index e16e5542bf13..6357265a31ad 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1193,6 +1193,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
                 ret = __rt_mutex_slowlock(lock, state, timeout, &waiter);
 
         if (unlikely(ret)) {
+                __set_current_state(TASK_RUNNING);
                 if (rt_mutex_has_waiters(lock))
                         remove_waiter(lock, &waiter);
                 rt_mutex_handle_deadlock(ret, chwalk, &waiter);
diff --git a/kernel/module.c b/kernel/module.c
index b34813f725e9..cc93cf68653c 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2313,11 +2313,13 @@ static void layout_symtab(struct module *mod, struct load_info *info)
         info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
         info->stroffs = mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
         mod->core_size += strtab_size;
+        mod->core_size = debug_align(mod->core_size);
 
         /* Put string table section at end of init part of module. */
         strsect->sh_flags |= SHF_ALLOC;
         strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
                                          info->index.str) | INIT_OFFSET_MASK;
+        mod->init_size = debug_align(mod->init_size);
         pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
 }
 
diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
index cbd69d842341..2ca4a8b5fe57 100644
--- a/kernel/printk/console_cmdline.h
+++ b/kernel/printk/console_cmdline.h
@@ -3,7 +3,7 @@
 
 struct console_cmdline
 {
-        char    name[8];                        /* Name of the driver       */
+        char    name[16];                       /* Name of the driver       */
         int     index;                          /* Minor dev. to use        */
         char    *options;                       /* Options for the driver   */
 #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 01cfd69c54c6..bb0635bd74f2 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2464,6 +2464,7 @@ void register_console(struct console *newcon)
         for (i = 0, c = console_cmdline;
              i < MAX_CMDLINECONSOLES && c->name[0];
              i++, c++) {
+                BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
                 if (strcmp(c->name, newcon->name) != 0)
                         continue;
                 if (newcon->index >= 0 &&
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 94b2d7b88a27..80014a178342 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -82,6 +82,7 @@ static void cpuidle_idle_call(void)
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
         int next_state, entered_state;
         unsigned int broadcast;
+        bool reflect;
 
         /*
          * Check if the idle task must be rescheduled. If it is the
@@ -105,6 +106,9 @@ static void cpuidle_idle_call(void)
          */
         rcu_idle_enter();
 
+        if (cpuidle_not_available(drv, dev))
+                goto use_default;
+
         /*
          * Suspend-to-idle ("freeze") is a system state in which all user space
          * has been frozen, all I/O devices have been suspended and the only
@@ -115,30 +119,24 @@ static void cpuidle_idle_call(void)
          * until a proper wakeup interrupt happens.
          */
         if (idle_should_freeze()) {
-                cpuidle_enter_freeze();
-                local_irq_enable();
-                goto exit_idle;
-        }
+                entered_state = cpuidle_enter_freeze(drv, dev);
+                if (entered_state >= 0) {
+                        local_irq_enable();
+                        goto exit_idle;
+                }
 
-        /*
-         * Ask the cpuidle framework to choose a convenient idle state.
-         * Fall back to the default arch idle method on errors.
-         */
-        next_state = cpuidle_select(drv, dev);
-        if (next_state < 0) {
-use_default:
+                reflect = false;
+                next_state = cpuidle_find_deepest_state(drv, dev);
+        } else {
+                reflect = true;
                 /*
-                 * We can't use the cpuidle framework, let's use the default
-                 * idle routine.
+                 * Ask the cpuidle framework to choose a convenient idle state.
                  */
-                if (current_clr_polling_and_test())
-                        local_irq_enable();
-                else
-                        arch_cpu_idle();
-
-                goto exit_idle;
+                next_state = cpuidle_select(drv, dev);
         }
-
+        /* Fall back to the default arch idle method on errors. */
+        if (next_state < 0)
+                goto use_default;
 
         /*
          * The idle task must be scheduled, it is pointless to
@@ -183,7 +181,8 @@ use_default:
         /*
          * Give the governor an opportunity to reflect on the outcome
          */
-        cpuidle_reflect(dev, entered_state);
+        if (reflect)
+                cpuidle_reflect(dev, entered_state);
 
 exit_idle:
         __current_set_polling();
@@ -196,6 +195,19 @@ exit_idle:
 
         rcu_idle_exit();
         start_critical_timings();
+        return;
+
+use_default:
+        /*
+         * We can't use the cpuidle framework, let's use the default
+         * idle routine.
+         */
+        if (current_clr_polling_and_test())
+                local_irq_enable();
+        else
+                arch_cpu_idle();
+
+        goto exit_idle;
 }
 
 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index 667b2e62fad2..a03d9cd23ed7 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1108,6 +1108,7 @@ DECLARE_RWSEM(uts_sem);
 /*
  * Work around broken programs that cannot handle "Linux 3.0".
  * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
+ * And we map 4.x to 2.6.60+x, so 4.0 would be 2.6.60.
  */
 static int override_release(char __user *release, size_t len)
 {
@@ -1127,7 +1128,7 @@ static int override_release(char __user *release, size_t len)
                                 break;
                         rest++;
                 }
-                v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
+                v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 60;
                 copy = clamp_t(size_t, len, 1, sizeof(buf));
                 copy = scnprintf(buf, copy, "2.6.%u%s", v, rest);
                 ret = copy_to_user(release, buf, copy + 1);
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 9cc4c4a90d00..b5344ef4c684 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -17,6 +17,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/log2.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
@@ -217,15 +218,15 @@ static void bucket_table_free(const struct bucket_table *tbl)
 static struct bucket_table *bucket_table_alloc(struct rhashtable *ht,
                                                size_t nbuckets)
 {
-        struct bucket_table *tbl;
+        struct bucket_table *tbl = NULL;
         size_t size;
         int i;
 
         size = sizeof(*tbl) + nbuckets * sizeof(tbl->buckets[0]);
-        tbl = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER))
+                tbl = kzalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
         if (tbl == NULL)
                 tbl = vzalloc(size);
-
         if (tbl == NULL)
                 return NULL;
 
@@ -247,26 +248,24 @@ static struct bucket_table *bucket_table_alloc(struct rhashtable *ht,
  * @ht:         hash table
  * @new_size:   new table size
  */
-bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size)
+static bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size)
 {
         /* Expand table when exceeding 75% load */
         return atomic_read(&ht->nelems) > (new_size / 4 * 3) &&
-               (ht->p.max_shift && atomic_read(&ht->shift) < ht->p.max_shift);
+               (!ht->p.max_shift || atomic_read(&ht->shift) < ht->p.max_shift);
 }
-EXPORT_SYMBOL_GPL(rht_grow_above_75);
 
 /**
  * rht_shrink_below_30 - returns true if nelems < 0.3 * table-size
  * @ht:         hash table
  * @new_size:   new table size
  */
-bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size)
+static bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size)
 {
         /* Shrink table beneath 30% load */
         return atomic_read(&ht->nelems) < (new_size * 3 / 10) &&
                (atomic_read(&ht->shift) > ht->p.min_shift);
 }
-EXPORT_SYMBOL_GPL(rht_shrink_below_30);
 
 static void lock_buckets(struct bucket_table *new_tbl,
                          struct bucket_table *old_tbl, unsigned int hash)
@@ -414,6 +413,7 @@ int rhashtable_expand(struct rhashtable *ht)
                         }
                 }
                 unlock_buckets(new_tbl, old_tbl, new_hash);
+                cond_resched();
         }
 
         /* Unzip interleaved hash chains */
@@ -437,6 +437,7 @@ int rhashtable_expand(struct rhashtable *ht)
                                 complete = false;
 
                         unlock_buckets(new_tbl, old_tbl, old_hash);
+                        cond_resched();
                 }
         }
 
@@ -495,6 +496,7 @@ int rhashtable_shrink(struct rhashtable *ht)
                                    tbl->buckets[new_hash + new_tbl->size]);
 
                 unlock_buckets(new_tbl, tbl, new_hash);
+                cond_resched();
         }
 
         /* Publish the new, valid hash table */
@@ -528,31 +530,19 @@ static void rht_deferred_worker(struct work_struct *work)
         list_for_each_entry(walker, &ht->walkers, list)
                 walker->resize = true;
 
-        if (ht->p.grow_decision && ht->p.grow_decision(ht, tbl->size))
+        if (rht_grow_above_75(ht, tbl->size))
                 rhashtable_expand(ht);
-        else if (ht->p.shrink_decision && ht->p.shrink_decision(ht, tbl->size))
+        else if (rht_shrink_below_30(ht, tbl->size))
                 rhashtable_shrink(ht);
-
 unlock:
         mutex_unlock(&ht->mutex);
 }
 
-static void rhashtable_wakeup_worker(struct rhashtable *ht)
-{
-        struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht);
-        struct bucket_table *new_tbl = rht_dereference_rcu(ht->future_tbl, ht);
-        size_t size = tbl->size;
-
-        /* Only adjust the table if no resizing is currently in progress. */
-        if (tbl == new_tbl &&
-            ((ht->p.grow_decision && ht->p.grow_decision(ht, size)) ||
-             (ht->p.shrink_decision && ht->p.shrink_decision(ht, size))))
-                schedule_work(&ht->run_work);
-}
-
 static void __rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
-                                struct bucket_table *tbl, u32 hash)
+                                struct bucket_table *tbl,
+                                const struct bucket_table *old_tbl, u32 hash)
 {
+        bool no_resize_running = tbl == old_tbl;
         struct rhash_head *head;
 
         hash = rht_bucket_index(tbl, hash);
@@ -568,8 +558,8 @@ static void __rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
         rcu_assign_pointer(tbl->buckets[hash], obj);
 
         atomic_inc(&ht->nelems);
-
-        rhashtable_wakeup_worker(ht);
+        if (no_resize_running && rht_grow_above_75(ht, tbl->size))
+                schedule_work(&ht->run_work);
 }
 
 /**
@@ -599,7 +589,7 @@ void rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj)
         hash = obj_raw_hashfn(ht, rht_obj(ht, obj));
 
         lock_buckets(tbl, old_tbl, hash);
-        __rhashtable_insert(ht, obj, tbl, hash);
+        __rhashtable_insert(ht, obj, tbl, old_tbl, hash);
         unlock_buckets(tbl, old_tbl, hash);
 
         rcu_read_unlock();
@@ -681,8 +671,11 @@ found:
         unlock_buckets(new_tbl, old_tbl, new_hash);
 
         if (ret) {
+                bool no_resize_running = new_tbl == old_tbl;
+
                 atomic_dec(&ht->nelems);
-                rhashtable_wakeup_worker(ht);
+                if (no_resize_running && rht_shrink_below_30(ht, new_tbl->size))
+                        schedule_work(&ht->run_work);
         }
 
         rcu_read_unlock();
@@ -852,7 +845,7 @@ bool rhashtable_lookup_compare_insert(struct rhashtable *ht,
                 goto exit;
         }
 
-        __rhashtable_insert(ht, obj, new_tbl, new_hash);
+        __rhashtable_insert(ht, obj, new_tbl, old_tbl, new_hash);
 
 exit:
         unlock_buckets(new_tbl, old_tbl, new_hash);
@@ -894,6 +887,9 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
         if (!iter->walker)
                 return -ENOMEM;
 
+        INIT_LIST_HEAD(&iter->walker->list);
+        iter->walker->resize = false;
+
         mutex_lock(&ht->mutex);
         list_add(&iter->walker->list, &ht->walkers);
         mutex_unlock(&ht->mutex);
@@ -1111,8 +1107,7 @@ int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params)
         if (!ht->p.hash_rnd)
                 get_random_bytes(&ht->p.hash_rnd, sizeof(ht->p.hash_rnd));
 
-        if (ht->p.grow_decision || ht->p.shrink_decision)
-                INIT_WORK(&ht->run_work, rht_deferred_worker);
+        INIT_WORK(&ht->run_work, rht_deferred_worker);
 
         return 0;
 }
@@ -1130,8 +1125,7 @@ void rhashtable_destroy(struct rhashtable *ht)
 {
         ht->being_destroyed = true;
 
-        if (ht->p.grow_decision || ht->p.shrink_decision)
-                cancel_work_sync(&ht->run_work);
+        cancel_work_sync(&ht->run_work);
 
         mutex_lock(&ht->mutex);
         bucket_table_free(rht_dereference(ht->tbl, ht));
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 1dfeba73fc74..67c7593d1dd6 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -191,18 +191,18 @@ error:
         return err;
 }
 
+static struct rhashtable ht;
+
 static int __init test_rht_init(void)
 {
-        struct rhashtable ht;
         struct rhashtable_params params = {
                 .nelem_hint = TEST_HT_SIZE,
                 .head_offset = offsetof(struct test_obj, node),
                 .key_offset = offsetof(struct test_obj, value),
                 .key_len = sizeof(int),
                 .hashfn = jhash,
+                .max_shift = 1, /* we expand/shrink manually here */
                 .nulls_base = (3U << RHT_BASE_SHIFT),
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
         int err;
 
@@ -222,6 +222,11 @@ static int __init test_rht_init(void)
         return err;
 }
 
+static void __exit test_rht_exit(void)
+{
+}
+
 module_init(test_rht_init);
+module_exit(test_rht_exit);
 
 MODULE_LICENSE("GPL v2");
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d18d3a6e7337..9fe07692eaad 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5247,7 +5247,7 @@ static int memory_low_show(struct seq_file *m, void *v)
         unsigned long low = ACCESS_ONCE(memcg->low);
 
         if (low == PAGE_COUNTER_MAX)
-                seq_puts(m, "infinity\n");
+                seq_puts(m, "max\n");
         else
                 seq_printf(m, "%llu\n", (u64)low * PAGE_SIZE);
 
@@ -5262,7 +5262,7 @@ static ssize_t memory_low_write(struct kernfs_open_file *of,
         int err;
 
         buf = strstrip(buf);
-        err = page_counter_memparse(buf, "infinity", &low);
+        err = page_counter_memparse(buf, "max", &low);
         if (err)
                 return err;
 
@@ -5277,7 +5277,7 @@ static int memory_high_show(struct seq_file *m, void *v)
         unsigned long high = ACCESS_ONCE(memcg->high);
 
         if (high == PAGE_COUNTER_MAX)
-                seq_puts(m, "infinity\n");
+                seq_puts(m, "max\n");
         else
                 seq_printf(m, "%llu\n", (u64)high * PAGE_SIZE);
 
@@ -5292,7 +5292,7 @@ static ssize_t memory_high_write(struct kernfs_open_file *of,
         int err;
 
         buf = strstrip(buf);
-        err = page_counter_memparse(buf, "infinity", &high);
+        err = page_counter_memparse(buf, "max", &high);
         if (err)
                 return err;
 
@@ -5307,7 +5307,7 @@ static int memory_max_show(struct seq_file *m, void *v)
         unsigned long max = ACCESS_ONCE(memcg->memory.limit);
 
         if (max == PAGE_COUNTER_MAX)
-                seq_puts(m, "infinity\n");
+                seq_puts(m, "max\n");
         else
                 seq_printf(m, "%llu\n", (u64)max * PAGE_SIZE);
 
@@ -5322,7 +5322,7 @@ static ssize_t memory_max_write(struct kernfs_open_file *of,
         int err;
 
         buf = strstrip(buf);
-        err = page_counter_memparse(buf, "infinity", &max);
+        err = page_counter_memparse(buf, "max", &max);
         if (err)
                 return err;
 
@@ -5426,7 +5426,7 @@ bool mem_cgroup_low(struct mem_cgroup *root, struct mem_cgroup *memcg)
         if (memcg == root_mem_cgroup)
                 return false;
 
-        if (page_counter_read(&memcg->memory) > memcg->low)
+        if (page_counter_read(&memcg->memory) >= memcg->low)
                 return false;
 
         while (memcg != root) {
@@ -5435,7 +5435,7 @@ bool mem_cgroup_low(struct mem_cgroup *root, struct mem_cgroup *memcg)
                 if (memcg == root_mem_cgroup)
                         break;
 
-                if (page_counter_read(&memcg->memory) > memcg->low)
+                if (page_counter_read(&memcg->memory) >= memcg->low)
                         return false;
         }
         return true;
diff --git a/mm/nommu.c b/mm/nommu.c
index 7296360fc057..3e67e7538ecf 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1213,11 +1213,9 @@ static int do_mmap_private(struct vm_area_struct *vma,
         if (sysctl_nr_trim_pages && total - point >= sysctl_nr_trim_pages) {
                 total = point;
                 kdebug("try to alloc exact %lu pages", total);
-                base = alloc_pages_exact(len, GFP_KERNEL);
-        } else {
-                base = (void *)__get_free_pages(GFP_KERNEL, order);
         }
 
+        base = alloc_pages_exact(total << PAGE_SHIFT, GFP_KERNEL);
         if (!base)
                 goto enomem;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a47f0b229a1a..7abfa70cdc1a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2353,8 +2353,15 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                 if (ac->high_zoneidx < ZONE_NORMAL)
                         goto out;
                 /* The OOM killer does not compensate for light reclaim */
-                if (!(gfp_mask & __GFP_FS))
+                if (!(gfp_mask & __GFP_FS)) {
+                        /*
+                         * XXX: Page reclaim didn't yield anything,
+                         * and the OOM killer can't be invoked, but
+                         * keep looping as per should_alloc_retry().
+                         */
+                        *did_some_progress = 1;
                         goto out;
+                }
                 /*
                  * GFP_THISNODE contains __GFP_NORETRY and we never hit this.
                  * Sanity check for bare calls of __GFP_THISNODE, not real OOM.
diff --git a/mm/shmem.c b/mm/shmem.c
index 2f17cb5f00a4..cf2d0ca010bc 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1455,6 +1455,9 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode
 
 bool shmem_mapping(struct address_space *mapping)
 {
+        if (!mapping->host)
+                return false;
+
         return mapping->host->i_sb->s_op == &shmem_ops;
 }
 
diff --git a/net/bridge/br.c b/net/bridge/br.c
index fb57ab6b24f9..02c24cf63c34 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -190,6 +190,8 @@ static int __init br_init(void)
 {
         int err;
 
+        BUILD_BUG_ON(sizeof(struct br_input_skb_cb) > FIELD_SIZEOF(struct sk_buff, cb));
+
         err = stp_proto_register(&br_stp_proto);
         if (err < 0) {
                 pr_err("bridge: can't register sap for STP\n");
diff --git a/net/caif/cffrml.c b/net/caif/cffrml.c
index 8bc7caa28e64..434ba8557826 100644
--- a/net/caif/cffrml.c
+++ b/net/caif/cffrml.c
@@ -84,7 +84,7 @@ static int cffrml_receive(struct cflayer *layr, struct cfpkt *pkt)
         u16 tmp;
         u16 len;
         u16 hdrchks;
-        u16 pktchks;
+        int pktchks;
         struct cffrml *this;
         this = container_obj(layr);
 
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 1be0b521ac49..f6c3b2137eea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -255,9 +255,9 @@ inline u16 cfpkt_getlen(struct cfpkt *pkt)
         return skb->len;
 }
 
-inline u16 cfpkt_iterate(struct cfpkt *pkt,
-                         u16 (*iter_func)(u16, void *, u16),
-                         u16 data)
+int cfpkt_iterate(struct cfpkt *pkt,
+                  u16 (*iter_func)(u16, void *, u16),
+                  u16 data)
 {
         /*
          * Don't care about the performance hit of linearizing,
diff --git a/net/compat.c b/net/compat.c
index 3236b4167a32..94d3d5e97883 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -711,24 +711,18 @@ static unsigned char nas[21] = {
 
 COMPAT_SYSCALL_DEFINE3(sendmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_sendmsg(fd, (struct user_msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE4(sendmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
                        unsigned int, vlen, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                               flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE3(recvmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_recvmsg(fd, (struct user_msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
@@ -751,9 +745,6 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
         int datagrams;
         struct timespec ktspec;
 
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
-
         if (timeout == NULL)
                 return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                       flags | MSG_CMSG_COMPAT, NULL);
diff --git a/net/core/dev.c b/net/core/dev.c
index 8f9710c62e20..962ee9d71964 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -946,7 +946,7 @@ bool dev_valid_name(const char *name)
                 return false;
 
         while (*name) {
-                if (*name == '/' || isspace(*name))
+                if (*name == '/' || *name == ':' || isspace(*name))
                         return false;
                 name++;
         }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 91f74f3eb204..aa378ecef186 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -98,6 +98,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_RXALL_BIT] =            "rx-all",
         [NETIF_F_HW_L2FW_DOFFLOAD_BIT] = "l2-fwd-offload",
         [NETIF_F_BUSY_POLL_BIT] =        "busy-poll",
+        [NETIF_F_HW_SWITCH_OFFLOAD_BIT] = "hw-switch-offload",
 };
 
 static const char
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 0c08062d1796..1e2f46a69d50 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -32,6 +32,9 @@ gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size)
         return 0;
 
 nla_put_failure:
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return -1;
 }
@@ -305,7 +308,9 @@ int
 gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
 {
         if (d->compat_xstats) {
-                d->xstats = st;
+                d->xstats = kmemdup(st, len, GFP_ATOMIC);
+                if (!d->xstats)
+                        goto err_out;
                 d->xstats_len = len;
         }
 
@@ -313,6 +318,11 @@ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
                 return gnet_stats_copy(d, TCA_STATS_APP, st, len);
 
         return 0;
+
+err_out:
+        d->xstats_len = 0;
+        spin_unlock_bh(d->lock);
+        return -1;
 }
 EXPORT_SYMBOL(gnet_stats_copy_app);
 
@@ -345,6 +355,9 @@ gnet_stats_finish_copy(struct gnet_dump *d)
                         return -1;
         }
 
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return 0;
 }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b4899f5b7388..508155b283dd 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1134,6 +1134,9 @@ static ssize_t pktgen_if_write(struct file *file,
                         return len;
 
                 i += len;
+                if ((value > 1) &&
+                    (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
+                        return -ENOTSUPP;
                 pkt_dev->burst = value < 1 ? 1 : value;
                 sprintf(pg_result, "OK: burst=%d", pkt_dev->burst);
                 return count;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ab293a3066b3..25b4b5d23485 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1300,7 +1300,6 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         s_h = cb->args[0];
         s_idx = cb->args[1];
 
-        rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
         /* A hack to preserve kernel<->userspace interface.
@@ -1322,7 +1321,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, head, index_hlist) {
+                hlist_for_each_entry(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
@@ -1344,7 +1343,6 @@ cont:
                 }
         }
 out:
-        rcu_read_unlock();
         cb->args[1] = idx;
         cb->args[0] = h;
 
@@ -2012,8 +2010,8 @@ replay:
         }
 
         if (1) {
-                struct nlattr *attr[ops ? ops->maxtype + 1 : 0];
-                struct nlattr *slave_attr[m_ops ? m_ops->slave_maxtype + 1 : 0];
+                struct nlattr *attr[ops ? ops->maxtype + 1 : 1];
+                struct nlattr *slave_attr[m_ops ? m_ops->slave_maxtype + 1 : 1];
                 struct nlattr **data = NULL;
                 struct nlattr **slave_data = NULL;
                 struct net *dest_net, *link_net = NULL;
@@ -2122,6 +2120,10 @@ replay:
                 if (IS_ERR(dest_net))
                         return PTR_ERR(dest_net);
 
+                err = -EPERM;
+                if (!netlink_ns_capable(skb, dest_net->user_ns, CAP_NET_ADMIN))
+                        goto out;
+
                 if (tb[IFLA_LINK_NETNSID]) {
                         int id = nla_get_s32(tb[IFLA_LINK_NETNSID]);
 
@@ -2130,6 +2132,9 @@ replay:
                                 err =  -EINVAL;
                                 goto out;
                         }
+                        err = -EPERM;
+                        if (!netlink_ns_capable(skb, link_net->user_ns, CAP_NET_ADMIN))
+                                goto out;
                 }
 
                 dev = rtnl_create_link(link_net ? : dest_net, ifname,
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 88c613eab142..f80507823531 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3621,13 +3621,14 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
 {
         struct sk_buff_head *q = &sk->sk_error_queue;
         struct sk_buff *skb, *skb_next;
+        unsigned long flags;
         int err = 0;
 
-        spin_lock_bh(&q->lock);
+        spin_lock_irqsave(&q->lock, flags);
         skb = __skb_dequeue(q);
         if (skb && (skb_next = skb_peek(q)))
                 err = SKB_EXT_ERR(skb_next)->ee.ee_errno;
-        spin_unlock_bh(&q->lock);
+        spin_unlock_irqrestore(&q->lock, flags);
 
         sk->sk_err = err;
         if (err)
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1d7c1256e845..3b81092771f8 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1062,7 +1062,7 @@ source_ok:
         if (decnet_debug_level & 16)
                 printk(KERN_DEBUG
                        "dn_route_output_slow: initial checks complete."
-                       " dst=%o4x src=%04x oif=%d try_hard=%d\n",
+                       " dst=%04x src=%04x oif=%d try_hard=%d\n",
                        le16_to_cpu(fld.daddr), le16_to_cpu(fld.saddr),
                        fld.flowidn_oif, try_hard);
 
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index a138d75751df..44d27469ae55 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -359,8 +359,11 @@ static void hsr_dev_destroy(struct net_device *hsr_dev)
         struct hsr_port *port;
 
         hsr = netdev_priv(hsr_dev);
+
+        rtnl_lock();
         hsr_for_each_port(hsr, port)
                 hsr_del_port(port);
+        rtnl_unlock();
 
         del_timer_sync(&hsr->prune_timer);
         del_timer_sync(&hsr->announce_timer);
diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c
index 779d28b65417..cd37d0011b42 100644
--- a/net/hsr/hsr_main.c
+++ b/net/hsr/hsr_main.c
@@ -36,6 +36,10 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
                         return NOTIFY_DONE;     /* Not an HSR device */
                 hsr = netdev_priv(dev);
                 port = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
+                if (port == NULL) {
+                        /* Resend of notification concerning removed device? */
+                        return NOTIFY_DONE;
+                }
         } else {
                 hsr = port->hsr;
         }
diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
index a348dcbcd683..7d37366cc695 100644
--- a/net/hsr/hsr_slave.c
+++ b/net/hsr/hsr_slave.c
@@ -181,8 +181,10 @@ void hsr_del_port(struct hsr_port *port)
         list_del_rcu(&port->port_list);
 
         if (port != master) {
-                netdev_update_features(master->dev);
-                dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
+                if (master != NULL) {
+                        netdev_update_features(master->dev);
+                        dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
+                }
                 netdev_rx_handler_unregister(port->dev);
                 dev_set_promiscuity(port->dev, -1);
         }
@@ -192,5 +194,7 @@ void hsr_del_port(struct hsr_port *port)
          */
 
         synchronize_rcu();
-        dev_put(port->dev);
+
+        if (port != master)
+                dev_put(port->dev);
 }
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index e5b6d0ddcb58..2c8d98e728c0 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -664,7 +664,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
         if (skb->protocol != htons(ETH_P_IP))
                 return skb;
 
-        if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
+        if (skb_copy_bits(skb, 0, &iph, sizeof(iph)) < 0)
                 return skb;
 
         if (iph.ihl < 5 || iph.version != 4)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d68199d9b2b0..a7aea2048a0d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -888,7 +888,8 @@ static int __ip_append_data(struct sock *sk,
         cork->length += length;
         if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
+            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (sk->sk_type == SOCK_DGRAM)) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
                                          maxfraglen, flags);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 8fdd27b17306..fb4cf8b8e121 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4770,7 +4770,7 @@ static bool tcp_should_expand_sndbuf(const struct sock *sk)
                 return false;
 
         /* If we filled the congestion window, do not expand.  */
-        if (tp->packets_out >= tp->snd_cwnd)
+        if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)
                 return false;
 
         return true;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 98e4a63d72bb..b6030025f411 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4903,6 +4903,21 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
         return ret;
 }
 
+static
+int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
+                        void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        struct inet6_dev *idev = ctl->extra1;
+        int min_mtu = IPV6_MIN_MTU;
+        struct ctl_table lctl;
+
+        lctl = *ctl;
+        lctl.extra1 = &min_mtu;
+        lctl.extra2 = idev ? &idev->dev->mtu : NULL;
+
+        return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
+}
+
 static void dev_disable_change(struct inet6_dev *idev)
 {
         struct netdev_notifier_info info;
@@ -5054,7 +5069,7 @@ static struct addrconf_sysctl_table
                         .data           = &ipv6_devconf.mtu6,
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .proc_handler   = addrconf_sysctl_mtu,
                 },
                 {
                         .procname       = "accept_ra",
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7deebf102cba..0a04a37305d5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1298,7 +1298,8 @@ emsgsize:
         if (((length > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO)) {
+            (rt->dst.dev->features & NETIF_F_UFO) &&
+            (sk->sk_type == SOCK_DGRAM)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen,
                                           transhdrlen, mtu, flags, rt);
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 40695b9751c1..683346d2d633 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -798,7 +798,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
         orig_jiffies = jiffies;
 
         /* Set poll time to 200 ms */
-        poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
+        poll_time = msecs_to_jiffies(200);
+        if (timeout)
+                poll_time = min_t(unsigned long, timeout, poll_time);
 
         spin_lock_irqsave(&self->spinlock, flags);
         while (self->tx_skb && self->tx_skb->len) {
@@ -811,7 +813,7 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
                         break;
         }
         spin_unlock_irqrestore(&self->spinlock, flags);
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
 }
 
 /*
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 3c83a1e5ab03..1215693fdd22 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -305,7 +305,7 @@ irnet_ctrl_read(irnet_socket *	ap,
 
   /* Put ourselves on the wait queue to be woken up */
   add_wait_queue(&irnet_events.rwait, &wait);
-  current->state = TASK_INTERRUPTIBLE;
+  set_current_state(TASK_INTERRUPTIBLE);
   for(;;)
     {
       /* If there is unread events */
@@ -321,7 +321,7 @@ irnet_ctrl_read(irnet_socket *	ap,
       /* Yield and wait to be woken up */
       schedule();
     }
-  current->state = TASK_RUNNING;
+  __set_current_state(TASK_RUNNING);
   remove_wait_queue(&irnet_events.rwait, &wait);
 
   /* Did we got it ? */
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index ff0d2db09df9..5bcd4e5589d3 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -1508,6 +1508,8 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
         if (ieee80211_chanctx_refcount(local, ctx) == 0)
                 ieee80211_free_chanctx(local, ctx);
 
+        sdata->radar_required = false;
+
         /* Unreserving may ready an in-place reservation. */
         if (use_reserved_switch)
                 ieee80211_vif_use_reserved_switch(local);
@@ -1566,6 +1568,9 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
  out:
+        if (ret)
+                sdata->radar_required = false;
+
         mutex_unlock(&local->chanctx_mtx);
         return ret;
 }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 7c86a002df95..ef6e8a6c4253 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -373,7 +373,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                 rate++;
                 mi->sample_deferred++;
         } else {
-                if (!msr->sample_limit != 0)
+                if (!msr->sample_limit)
                         return;
 
                 mi->sample_packets++;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 88a18ffe2975..07bd8db00af8 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -566,6 +566,7 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
                 if (tx->sdata->control_port_no_encrypt)
                         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
                 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
+                info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
         }
 
         return TX_CONTINUE;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e55759056361..ed99448671c3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3402,7 +3402,7 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
                 if (udest.af == 0)
                         udest.af = svc->af;
 
-                if (udest.af != svc->af) {
+                if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
                         /* The synchronization protocol is incompatible
                          * with mixed family services
                          */
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index c598f74063a1..1279cd85663e 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -625,8 +625,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
                 struct xt_match *match = nft_match->ops.data;
 
                 if (strcmp(match->name, mt_name) == 0 &&
-                    match->revision == rev && match->family == family)
+                    match->revision == rev && match->family == family) {
+                        if (!try_module_get(match->me))
+                                return ERR_PTR(-ENOENT);
+
                         return &nft_match->ops;
+                }
         }
 
         match = xt_request_find_match(family, mt_name, rev);
@@ -695,8 +699,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
                 struct xt_target *target = nft_target->ops.data;
 
                 if (strcmp(target->name, tg_name) == 0 &&
-                    target->revision == rev && target->family == family)
+                    target->revision == rev && target->family == family) {
+                        if (!try_module_get(target->me))
+                                return ERR_PTR(-ENOENT);
+
                         return &nft_target->ops;
+                }
         }
 
         target = xt_request_find_target(family, tg_name, rev);
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 61e6c407476a..c82df0a48fcd 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -192,8 +192,6 @@ static int nft_hash_init(const struct nft_set *set,
                 .key_offset = offsetof(struct nft_hash_elem, key),
                 .key_len = set->klen,
                 .hashfn = jhash,
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         return rhashtable_init(priv, &params);
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 30dbe34915ae..45e1b30e4fb2 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -378,12 +378,11 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         mutex_lock(&recent_mutex);
         t = recent_table_lookup(recent_net, info->name);
         if (t != NULL) {
-                if (info->hit_count > t->nstamps_max_mask) {
-                        pr_info("hitcount (%u) is larger than packets to be remembered (%u) for table %s\n",
-                                info->hit_count, t->nstamps_max_mask + 1,
-                                info->name);
-                        ret = -EINVAL;
-                        goto out;
+                if (nstamp_mask > t->nstamps_max_mask) {
+                        spin_lock_bh(&recent_lock);
+                        recent_table_flush(t);
+                        t->nstamps_max_mask = nstamp_mask;
+                        spin_unlock_bh(&recent_lock);
                 }
 
                 t->refcnt++;
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 1ba67931eb1b..13332dbf291d 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -243,12 +243,13 @@ static int
 extract_icmp6_fields(const struct sk_buff *skb,
                      unsigned int outside_hdrlen,
                      int *protocol,
-                     struct in6_addr **raddr,
-                     struct in6_addr **laddr,
+                     const struct in6_addr **raddr,
+                     const struct in6_addr **laddr,
                      __be16 *rport,
-                     __be16 *lport)
+                     __be16 *lport,
+                     struct ipv6hdr *ipv6_var)
 {
-        struct ipv6hdr *inside_iph, _inside_iph;
+        const struct ipv6hdr *inside_iph;
         struct icmp6hdr *icmph, _icmph;
         __be16 *ports, _ports[2];
         u8 inside_nexthdr;
@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
         if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
                 return 1;
 
-        inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
+        inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
+                                        sizeof(*ipv6_var), ipv6_var);
         if (inside_iph == NULL)
                 return 1;
         inside_nexthdr = inside_iph->nexthdr;
 
-        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
+        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
+                                              sizeof(*ipv6_var),
                                          &inside_nexthdr, &inside_fragoff);
         if (inside_hdrlen < 0)
                 return 1; /* hjm: Packet has no/incomplete transport layer headers. */
@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,
 static bool
 socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
         struct sock *sk = skb->sk;
-        struct in6_addr *daddr = NULL, *saddr = NULL;
+        const struct in6_addr *daddr = NULL, *saddr = NULL;
         __be16 uninitialized_var(dport), uninitialized_var(sport);
         int thoff = 0, uninitialized_var(tproto);
         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 
         } else if (tproto == IPPROTO_ICMPV6) {
                 if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
-                                         &sport, &dport))
+                                         &sport, &dport, &ipv6_var))
                         return false;
         } else {
                 return false;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2702673f0f23..05919bf3f670 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -3126,8 +3126,6 @@ static int __init netlink_proto_init(void)
                 .key_len = sizeof(u32), /* portid */
                 .hashfn = jhash,
                 .max_shift = 16, /* 64K */
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         if (err != 0)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index ae5e77cdc0ca..5bae7243c577 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -2194,14 +2194,55 @@ static int __net_init ovs_init_net(struct net *net)
         return 0;
 }
 
-static void __net_exit ovs_exit_net(struct net *net)
+static void __net_exit list_vports_from_net(struct net *net, struct net *dnet,
+                                            struct list_head *head)
 {
-        struct datapath *dp, *dp_next;
         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+        struct datapath *dp;
+
+        list_for_each_entry(dp, &ovs_net->dps, list_node) {
+                int i;
+
+                for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
+                        struct vport *vport;
+
+                        hlist_for_each_entry(vport, &dp->ports[i], dp_hash_node) {
+                                struct netdev_vport *netdev_vport;
+
+                                if (vport->ops->type != OVS_VPORT_TYPE_INTERNAL)
+                                        continue;
+
+                                netdev_vport = netdev_vport_priv(vport);
+                                if (dev_net(netdev_vport->dev) == dnet)
+                                        list_add(&vport->detach_list, head);
+                        }
+                }
+        }
+}
+
+static void __net_exit ovs_exit_net(struct net *dnet)
+{
+        struct datapath *dp, *dp_next;
+        struct ovs_net *ovs_net = net_generic(dnet, ovs_net_id);
+        struct vport *vport, *vport_next;
+        struct net *net;
+        LIST_HEAD(head);
 
         ovs_lock();
         list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
                 __dp_destroy(dp);
+
+        rtnl_lock();
+        for_each_net(net)
+                list_vports_from_net(net, dnet, &head);
+        rtnl_unlock();
+
+        /* Detach all vports from given namespace. */
+        list_for_each_entry_safe(vport, vport_next, &head, detach_list) {
+                list_del(&vport->detach_list);
+                ovs_dp_detach_port(vport);
+        }
+
         ovs_unlock();
 
         cancel_work_sync(&ovs_net->dp_notify_work);
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 216f20b90aa5..22b18c145c92 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2253,14 +2253,20 @@ static int masked_set_action_to_set_action_attr(const struct nlattr *a,
                                                 struct sk_buff *skb)
 {
         const struct nlattr *ovs_key = nla_data(a);
+        struct nlattr *nla;
         size_t key_len = nla_len(ovs_key) / 2;
 
         /* Revert the conversion we did from a non-masked set action to
          * masked set action.
          */
-        if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a) - key_len, ovs_key))
+        nla = nla_nest_start(skb, OVS_ACTION_ATTR_SET);
+        if (!nla)
                 return -EMSGSIZE;
 
+        if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key)))
+                return -EMSGSIZE;
+
+        nla_nest_end(skb, nla);
         return 0;
 }
 
diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h
index f8ae295fb001..bc85331a6c60 100644
--- a/net/openvswitch/vport.h
+++ b/net/openvswitch/vport.h
@@ -103,6 +103,7 @@ struct vport_portids {
  * @ops: Class structure.
  * @percpu_stats: Points to per-CPU statistics used and maintained by vport
  * @err_stats: Points to error statistics used and maintained by vport
+ * @detach_list: list used for detaching vport in net-exit call.
  */
 struct vport {
         struct rcu_head rcu;
@@ -117,6 +118,7 @@ struct vport {
         struct pcpu_sw_netstats __percpu *percpu_stats;
 
         struct vport_err_stats err_stats;
+        struct list_head detach_list;
 };
 
 /**
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9c28cec1a083..5bf1e968a728 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -698,6 +698,10 @@ static void prb_retire_rx_blk_timer_expired(unsigned long data)
 
         if (pkc->last_kactive_blk_num == pkc->kactive_blk_num) {
                 if (!frozen) {
+                        if (!BLOCK_NUM_PKTS(pbd)) {
+                                /* An empty block. Just refresh the timer. */
+                                goto refresh_timer;
+                        }
                         prb_retire_current_block(pkc, po, TP_STATUS_BLK_TMO);
                         if (!prb_dispatch_next_block(pkc, po))
                                 goto refresh_timer;
@@ -798,7 +802,11 @@ static void prb_close_block(struct tpacket_kbdq_core *pkc1,
                 h1->ts_last_pkt.ts_sec = last_pkt->tp_sec;
                 h1->ts_last_pkt.ts_nsec = last_pkt->tp_nsec;
         } else {
-                /* Ok, we tmo'd - so get the current time */
+                /* Ok, we tmo'd - so get the current time.
+                 *
+                 * It shouldn't really happen as we don't close empty
+                 * blocks. See prb_retire_rx_blk_timer_expired().
+                 */
                 struct timespec ts;
                 getnstimeofday(&ts);
                 h1->ts_last_pkt.ts_sec = ts.tv_sec;
@@ -1349,14 +1357,14 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
                 return 0;
         }
 
+        if (fanout_has_flag(f, PACKET_FANOUT_FLAG_DEFRAG)) {
+                skb = ip_check_defrag(skb, IP_DEFRAG_AF_PACKET);
+                if (!skb)
+                        return 0;
+        }
         switch (f->type) {
         case PACKET_FANOUT_HASH:
         default:
-                if (fanout_has_flag(f, PACKET_FANOUT_FLAG_DEFRAG)) {
-                        skb = ip_check_defrag(skb, IP_DEFRAG_AF_PACKET);
-                        if (!skb)
-                                return 0;
-                }
                 idx = fanout_demux_hash(f, skb, num);
                 break;
         case PACKET_FANOUT_LB:
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index c6be17a959a6..e0547f521f20 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -218,7 +218,8 @@ static void rxrpc_resend(struct rxrpc_call *call)
         struct rxrpc_header *hdr;
         struct sk_buff *txb;
         unsigned long *p_txb, resend_at;
-        int loop, stop;
+        bool stop;
+        int loop;
         u8 resend;
 
         _enter("{%d,%d,%d,%d},",
@@ -226,7 +227,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
                atomic_read(&call->sequence),
                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 
-        stop = 0;
+        stop = false;
         resend = 0;
         resend_at = 0;
 
@@ -255,11 +256,11 @@ static void rxrpc_resend(struct rxrpc_call *call)
                         _proto("Tx DATA %%%u { #%d }",
                                ntohl(sp->hdr.serial), ntohl(sp->hdr.seq));
                         if (rxrpc_send_packet(call->conn->trans, txb) < 0) {
-                                stop = 0;
+                                stop = true;
                                 sp->resend_at = jiffies + 3;
                         } else {
                                 sp->resend_at =
-                                        jiffies + rxrpc_resend_timeout * HZ;
+                                        jiffies + rxrpc_resend_timeout;
                         }
                 }
 
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 6742200b1307..fbb7ebfc58c6 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -228,6 +228,7 @@ static int tcf_em_validate(struct tcf_proto *tp,
                                  * to replay the request.
                                  */
                                 module_put(em->ops->owner);
+                                em->ops = NULL;
                                 err = -EAGAIN;
                         }
 #endif
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index abbb7dcd1689..59eeed43eda2 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -217,6 +217,8 @@ static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg)
 
         for (i = 0; i < arg->npages && arg->pages[i]; i++)
                 __free_page(arg->pages[i]);
+
+        kfree(arg->pages);
 }
 
 static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg)
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 224a82f24d3c..1095be9c80ab 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -463,6 +463,8 @@ static int rsc_parse(struct cache_detail *cd,
                 /* number of additional gid's */
                 if (get_int(&mesg, &N))
                         goto out;
+                if (N < 0 || N > NGROUPS_MAX)
+                        goto out;
                 status = -ENOMEM;
                 rsci.cred.cr_group_info = groups_alloc(N);
                 if (rsci.cred.cr_group_info == NULL)
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 33fb105d4352..5199bb1a017e 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -921,7 +921,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait,
         poll_wait(filp, &queue_wait, wait);
 
         /* alway allow write */
-        mask = POLL_OUT | POLLWRNORM;
+        mask = POLLOUT | POLLWRNORM;
 
         if (!rp)
                 return mask;
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 7e9acd9361c5..91ffde82fa0c 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -738,8 +738,9 @@ rpcrdma_reply_handler(struct rpcrdma_rep *rep)
         struct rpc_xprt *xprt = rep->rr_xprt;
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
         __be32 *iptr;
-        int credits, rdmalen, status;
+        int rdmalen, status;
         unsigned long cwnd;
+        u32 credits;
 
         /* Check status. If bad, signal disconnect and return rep to pool */
         if (rep->rr_len == ~0U) {
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index d1b70397c60f..0a16fb6f0885 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -285,7 +285,7 @@ rpcr_to_rdmar(struct rpc_rqst *rqst)
  */
 struct rpcrdma_buffer {
         spinlock_t      rb_lock;        /* protects indexes */
-        int             rb_max_requests;/* client max requests */
+        u32             rb_max_requests;/* client max requests */
         struct list_head rb_mws;        /* optional memory windows/fmrs/frmrs */
         struct list_head rb_all;
         int             rb_send_index;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index f73e975af80b..b4d4467d0bb0 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2364,8 +2364,6 @@ int tipc_sk_rht_init(struct net *net)
                 .hashfn = jhash,
                 .max_shift = 20, /* 1M */
                 .min_shift = 8,  /* 256 */
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         return rhashtable_init(&tn->sk_rht, &rht_params);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 3af0ecf1cc16..2a0bbd22854b 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1199,6 +1199,7 @@ out_fail_wq:
         regulatory_exit();
 out_fail_reg:
         debugfs_remove(ieee80211_debugfs_dir);
+        nl80211_exit();
 out_fail_nl80211:
         unregister_netdevice_notifier(&cfg80211_netdev_notifier);
 out_fail_notifier:
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d78fd8b54515..be2501538011 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2654,10 +2654,6 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                         return err;
         }
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg)
-                return -ENOMEM;
-
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
@@ -2666,6 +2662,10 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
         wdev = rdev_add_virtual_intf(rdev,
                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                                 type, err ? NULL : &flags, &params);
@@ -12528,9 +12528,7 @@ static int cfg80211_net_detect_results(struct sk_buff *msg,
                         }
 
                         for (j = 0; j < match->n_channels; j++) {
-                                if (nla_put_u32(msg,
-                                                NL80211_ATTR_WIPHY_FREQ,
-                                                match->channels[j])) {
+                                if (nla_put_u32(msg, j, match->channels[j])) {
                                         nla_nest_cancel(msg, nl_freqs);
                                         nla_nest_cancel(msg, nl_match);
                                         goto out;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index b586d0dcb09e..48dfc7b4e981 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -228,7 +228,7 @@ static DECLARE_DELAYED_WORK(reg_timeout, reg_timeout_work);
 
 /* We keep a static world regulatory domain in case of the absence of CRDA */
 static const struct ieee80211_regdomain world_regdom = {
-        .n_reg_rules = 6,
+        .n_reg_rules = 8,
         .alpha2 =  "00",
         .reg_rules = {
                 /* IEEE 802.11b/g, channels 1..11 */
diff --git a/scripts/gdb/linux/__init__.py b/scripts/gdb/linux/__init__.py
new file mode 100644
index 000000000000..4680fb176337
--- /dev/null
+++ b/scripts/gdb/linux/__init__.py
@@ -0,0 +1 @@
+# nothing to do for the initialization of this package
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index b03a638b420c..279e24f61305 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1552,6 +1552,8 @@ static int snd_pcm_do_drain_init(struct snd_pcm_substream *substream, int state)
                         if (! snd_pcm_playback_empty(substream)) {
                                 snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING);
                                 snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING);
+                        } else {
+                                runtime->status->state = SNDRV_PCM_STATE_SETUP;
                         }
                         break;
                 case SNDRV_PCM_STATE_RUNNING:
diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
index f62780ed64ad..7821b07415a7 100644
--- a/sound/drivers/opl3/opl3_midi.c
+++ b/sound/drivers/opl3/opl3_midi.c
@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,
                 int pitchbend = chan->midi_pitchbend;
                 int segment;
 
+                if (pitchbend < -0x2000)
+                        pitchbend = -0x2000;
                 if (pitchbend > 0x1FFF)
                         pitchbend = 0x1FFF;
 
diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
index 0d580186ef1a..5cc356db5351 100644
--- a/sound/firewire/amdtp.c
+++ b/sound/firewire/amdtp.c
@@ -33,7 +33,7 @@
  */
 #define MAX_MIDI_RX_BLOCKS      8
 
-#define TRANSFER_DELAY_TICKS    0x2e00 /* 479.17 µs */
+#define TRANSFER_DELAY_TICKS    0x2e00 /* 479.17 microseconds */
 
 /* isochronous header parameters */
 #define ISO_DATA_LENGTH_SHIFT   16
@@ -78,7 +78,7 @@ static void pcm_period_tasklet(unsigned long data);
 int amdtp_stream_init(struct amdtp_stream *s, struct fw_unit *unit,
                       enum amdtp_stream_direction dir, enum cip_flags flags)
 {
-        s->unit = fw_unit_get(unit);
+        s->unit = unit;
         s->direction = dir;
         s->flags = flags;
         s->context = ERR_PTR(-1);
@@ -102,7 +102,6 @@ void amdtp_stream_destroy(struct amdtp_stream *s)
 {
         WARN_ON(amdtp_stream_running(s));
         mutex_destroy(&s->mutex);
-        fw_unit_put(s->unit);
 }
 EXPORT_SYMBOL(amdtp_stream_destroy);
 
diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
index fc19c99654aa..611b7dae7ee5 100644
--- a/sound/firewire/bebob/bebob.c
+++ b/sound/firewire/bebob/bebob.c
@@ -116,11 +116,22 @@ end:
         return err;
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void
 bebob_card_free(struct snd_card *card)
 {
         struct snd_bebob *bebob = card->private_data;
 
+        snd_bebob_stream_destroy_duplex(bebob);
+        fw_unit_put(bebob->unit);
+
+        kfree(bebob->maudio_special_quirk);
+
         if (bebob->card_index >= 0) {
                 mutex_lock(&devices_mutex);
                 clear_bit(bebob->card_index, devices_used);
@@ -205,7 +216,7 @@ bebob_probe(struct fw_unit *unit,
         card->private_free = bebob_card_free;
 
         bebob->card = card;
-        bebob->unit = unit;
+        bebob->unit = fw_unit_get(unit);
         bebob->spec = spec;
         mutex_init(&bebob->mutex);
         spin_lock_init(&bebob->lock);
@@ -306,10 +317,11 @@ static void bebob_remove(struct fw_unit *unit)
         if (bebob == NULL)
                 return;
 
-        kfree(bebob->maudio_special_quirk);
+        /* Awake bus-reset waiters. */
+        if (!completion_done(&bebob->bus_reset))
+                complete_all(&bebob->bus_reset);
 
-        snd_bebob_stream_destroy_duplex(bebob);
-        snd_card_disconnect(bebob->card);
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(bebob->card);
 }
 
diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
index 0ebcabfdc7ce..98e4fc8121a1 100644
--- a/sound/firewire/bebob/bebob_stream.c
+++ b/sound/firewire/bebob/bebob_stream.c
@@ -410,8 +410,6 @@ break_both_connections(struct snd_bebob *bebob)
 static void
 destroy_both_connections(struct snd_bebob *bebob)
 {
-        break_both_connections(bebob);
-
         cmp_connection_destroy(&bebob->in_conn);
         cmp_connection_destroy(&bebob->out_conn);
 }
@@ -712,22 +710,16 @@ void snd_bebob_stream_update_duplex(struct snd_bebob *bebob)
         mutex_unlock(&bebob->mutex);
 }
 
+/*
+ * This function should be called before starting streams or after stopping
+ * streams.
+ */
 void snd_bebob_stream_destroy_duplex(struct snd_bebob *bebob)
 {
-        mutex_lock(&bebob->mutex);
-
-        amdtp_stream_pcm_abort(&bebob->rx_stream);
-        amdtp_stream_pcm_abort(&bebob->tx_stream);
-
-        amdtp_stream_stop(&bebob->rx_stream);
-        amdtp_stream_stop(&bebob->tx_stream);
-
         amdtp_stream_destroy(&bebob->rx_stream);
         amdtp_stream_destroy(&bebob->tx_stream);
 
         destroy_both_connections(bebob);
-
-        mutex_unlock(&bebob->mutex);
 }
 
 /*
diff --git a/sound/firewire/dice/dice-interface.h b/sound/firewire/dice/dice-interface.h
index 27b044f84c81..de7602bd69b5 100644
--- a/sound/firewire/dice/dice-interface.h
+++ b/sound/firewire/dice/dice-interface.h
@@ -299,23 +299,23 @@
 #define RX_ISOCHRONOUS                  0x008
 
 /*
- * Index of first quadlet to be interpreted; read/write.  If > 0, that many
- * quadlets at the beginning of each data block will be ignored, and all the
- * audio and MIDI quadlets will follow.
- */
-#define RX_SEQ_START                    0x00c
-
-/*
  * The number of audio channels; read-only.  There will be one quadlet per
  * channel.
  */
-#define RX_NUMBER_AUDIO                 0x010
+#define RX_NUMBER_AUDIO                 0x00c
 
 /*
  * The number of MIDI ports, 0-8; read-only.  If > 0, there will be one
  * additional quadlet in each data block, following the audio quadlets.
  */
-#define RX_NUMBER_MIDI                  0x014
+#define RX_NUMBER_MIDI                  0x010
+
+/*
+ * Index of first quadlet to be interpreted; read/write.  If > 0, that many
+ * quadlets at the beginning of each data block will be ignored, and all the
+ * audio and MIDI quadlets will follow.
+ */
+#define RX_SEQ_START                    0x014
 
 /*
  * Names of all audio channels; read-only.  Quadlets are byte-swapped.  Names
diff --git a/sound/firewire/dice/dice-proc.c b/sound/firewire/dice/dice-proc.c
index f5c1d1bced59..ecfe20fd4de5 100644
--- a/sound/firewire/dice/dice-proc.c
+++ b/sound/firewire/dice/dice-proc.c
@@ -99,9 +99,9 @@ static void dice_proc_read(struct snd_info_entry *entry,
                 } tx;
                 struct {
                         u32 iso;
-                        u32 seq_start;
                         u32 number_audio;
                         u32 number_midi;
+                        u32 seq_start;
                         char names[RX_NAMES_SIZE];
                         u32 ac3_caps;
                         u32 ac3_enable;
@@ -204,10 +204,10 @@ static void dice_proc_read(struct snd_info_entry *entry,
                         break;
                 snd_iprintf(buffer, "rx %u:\n", stream);
                 snd_iprintf(buffer, "  iso channel: %d\n", (int)buf.rx.iso);
-                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 snd_iprintf(buffer, "  audio channels: %u\n",
                             buf.rx.number_audio);
                 snd_iprintf(buffer, "  midi ports: %u\n", buf.rx.number_midi);
+                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 if (quadlets >= 68) {
                         dice_proc_fixup_string(buf.rx.names, RX_NAMES_SIZE);
                         snd_iprintf(buffer, "  names: %s\n", buf.rx.names);
diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c
index fa9cf761b610..07dbd01d7a6b 100644
--- a/sound/firewire/dice/dice-stream.c
+++ b/sound/firewire/dice/dice-stream.c
@@ -311,14 +311,21 @@ end:
         return err;
 }
 
+/*
+ * This function should be called before starting streams or after stopping
+ * streams.
+ */
 static void destroy_stream(struct snd_dice *dice, struct amdtp_stream *stream)
 {
-        amdtp_stream_destroy(stream);
+        struct fw_iso_resources *resources;
 
         if (stream == &dice->tx_stream)
-                fw_iso_resources_destroy(&dice->tx_resources);
+                resources = &dice->tx_resources;
         else
-                fw_iso_resources_destroy(&dice->rx_resources);
+                resources = &dice->rx_resources;
+
+        amdtp_stream_destroy(stream);
+        fw_iso_resources_destroy(resources);
 }
 
 int snd_dice_stream_init_duplex(struct snd_dice *dice)
@@ -332,6 +339,8 @@ int snd_dice_stream_init_duplex(struct snd_dice *dice)
                 goto end;
 
         err = init_stream(dice, &dice->rx_stream);
+        if (err < 0)
+                destroy_stream(dice, &dice->tx_stream);
 end:
         return err;
 }
@@ -340,10 +349,7 @@ void snd_dice_stream_destroy_duplex(struct snd_dice *dice)
 {
         snd_dice_transaction_clear_enable(dice);
 
-        stop_stream(dice, &dice->tx_stream);
         destroy_stream(dice, &dice->tx_stream);
-
-        stop_stream(dice, &dice->rx_stream);
         destroy_stream(dice, &dice->rx_stream);
 
         dice->substreams_counter = 0;
diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c
index 90d8f40ff727..70a111d7f428 100644
--- a/sound/firewire/dice/dice.c
+++ b/sound/firewire/dice/dice.c
@@ -226,11 +226,20 @@ static void dice_card_strings(struct snd_dice *dice)
         strcpy(card->mixername, "DICE");
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void dice_card_free(struct snd_card *card)
 {
         struct snd_dice *dice = card->private_data;
 
+        snd_dice_stream_destroy_duplex(dice);
         snd_dice_transaction_destroy(dice);
+        fw_unit_put(dice->unit);
+
         mutex_destroy(&dice->mutex);
 }
 
@@ -251,7 +260,7 @@ static int dice_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
 
         dice = card->private_data;
         dice->card = card;
-        dice->unit = unit;
+        dice->unit = fw_unit_get(unit);
         card->private_free = dice_card_free;
 
         spin_lock_init(&dice->lock);
@@ -305,10 +314,7 @@ static void dice_remove(struct fw_unit *unit)
 {
         struct snd_dice *dice = dev_get_drvdata(&unit->device);
 
-        snd_card_disconnect(dice->card);
-
-        snd_dice_stream_destroy_duplex(dice);
-
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(dice->card);
 }
 
diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
index 3e2ed8e82cbc..2682e7e3e5c9 100644
--- a/sound/firewire/fireworks/fireworks.c
+++ b/sound/firewire/fireworks/fireworks.c
@@ -173,11 +173,23 @@ end:
         return err;
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void
 efw_card_free(struct snd_card *card)
 {
         struct snd_efw *efw = card->private_data;
 
+        snd_efw_stream_destroy_duplex(efw);
+        snd_efw_transaction_remove_instance(efw);
+        fw_unit_put(efw->unit);
+
+        kfree(efw->resp_buf);
+
         if (efw->card_index >= 0) {
                 mutex_lock(&devices_mutex);
                 clear_bit(efw->card_index, devices_used);
@@ -185,7 +197,6 @@ efw_card_free(struct snd_card *card)
         }
 
         mutex_destroy(&efw->mutex);
-        kfree(efw->resp_buf);
 }
 
 static int
@@ -218,7 +229,7 @@ efw_probe(struct fw_unit *unit,
         card->private_free = efw_card_free;
 
         efw->card = card;
-        efw->unit = unit;
+        efw->unit = fw_unit_get(unit);
         mutex_init(&efw->mutex);
         spin_lock_init(&efw->lock);
         init_waitqueue_head(&efw->hwdep_wait);
@@ -289,10 +300,7 @@ static void efw_remove(struct fw_unit *unit)
 {
         struct snd_efw *efw = dev_get_drvdata(&unit->device);
 
-        snd_efw_stream_destroy_duplex(efw);
-        snd_efw_transaction_remove_instance(efw);
-
-        snd_card_disconnect(efw->card);
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(efw->card);
 }
 
diff --git a/sound/firewire/fireworks/fireworks_stream.c b/sound/firewire/fireworks/fireworks_stream.c
index 4f440e163667..c55db1bddc80 100644
--- a/sound/firewire/fireworks/fireworks_stream.c
+++ b/sound/firewire/fireworks/fireworks_stream.c
@@ -100,17 +100,22 @@ end:
         return err;
 }
 
+/*
+ * This function should be called before starting the stream or after stopping
+ * the streams.
+ */
 static void
 destroy_stream(struct snd_efw *efw, struct amdtp_stream *stream)
 {
-        stop_stream(efw, stream);
-
-        amdtp_stream_destroy(stream);
+        struct cmp_connection *conn;
 
         if (stream == &efw->tx_stream)
-                cmp_connection_destroy(&efw->out_conn);
+                conn = &efw->out_conn;
         else
-                cmp_connection_destroy(&efw->in_conn);
+                conn = &efw->in_conn;
+
+        amdtp_stream_destroy(stream);
+        cmp_connection_destroy(&efw->out_conn);
 }
 
 static int
@@ -319,12 +324,8 @@ void snd_efw_stream_update_duplex(struct snd_efw *efw)
 
 void snd_efw_stream_destroy_duplex(struct snd_efw *efw)
 {
-        mutex_lock(&efw->mutex);
-
         destroy_stream(efw, &efw->rx_stream);
         destroy_stream(efw, &efw->tx_stream);
-
-        mutex_unlock(&efw->mutex);
 }
 
 void snd_efw_stream_lock_changed(struct snd_efw *efw)
diff --git a/sound/firewire/oxfw/oxfw-stream.c b/sound/firewire/oxfw/oxfw-stream.c
index bda845afb470..e6757cd85724 100644
--- a/sound/firewire/oxfw/oxfw-stream.c
+++ b/sound/firewire/oxfw/oxfw-stream.c
@@ -171,9 +171,10 @@ static int start_stream(struct snd_oxfw *oxfw, struct amdtp_stream *stream,
         }
 
         /* Wait first packet */
-        err = amdtp_stream_wait_callback(stream, CALLBACK_TIMEOUT);
-        if (err < 0)
+        if (!amdtp_stream_wait_callback(stream, CALLBACK_TIMEOUT)) {
                 stop_stream(oxfw, stream);
+                err = -ETIMEDOUT;
+        }
 end:
         return err;
 }
@@ -337,6 +338,10 @@ void snd_oxfw_stream_stop_simplex(struct snd_oxfw *oxfw,
         stop_stream(oxfw, stream);
 }
 
+/*
+ * This function should be called before starting the stream or after stopping
+ * the streams.
+ */
 void snd_oxfw_stream_destroy_simplex(struct snd_oxfw *oxfw,
                                      struct amdtp_stream *stream)
 {
@@ -347,8 +352,6 @@ void snd_oxfw_stream_destroy_simplex(struct snd_oxfw *oxfw,
         else
                 conn = &oxfw->in_conn;
 
-        stop_stream(oxfw, stream);
-
         amdtp_stream_destroy(stream);
         cmp_connection_destroy(conn);
 }
diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
index 60e5cad0531a..8c6ce019f437 100644
--- a/sound/firewire/oxfw/oxfw.c
+++ b/sound/firewire/oxfw/oxfw.c
@@ -104,11 +104,23 @@ end:
         return err;
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void oxfw_card_free(struct snd_card *card)
 {
         struct snd_oxfw *oxfw = card->private_data;
         unsigned int i;
 
+        snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream);
+        if (oxfw->has_output)
+                snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream);
+
+        fw_unit_put(oxfw->unit);
+
         for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; i++) {
                 kfree(oxfw->tx_stream_formats[i]);
                 kfree(oxfw->rx_stream_formats[i]);
@@ -136,7 +148,7 @@ static int oxfw_probe(struct fw_unit *unit,
         oxfw = card->private_data;
         oxfw->card = card;
         mutex_init(&oxfw->mutex);
-        oxfw->unit = unit;
+        oxfw->unit = fw_unit_get(unit);
         oxfw->device_info = (const struct device_info *)id->driver_data;
         spin_lock_init(&oxfw->lock);
         init_waitqueue_head(&oxfw->hwdep_wait);
@@ -212,12 +224,7 @@ static void oxfw_remove(struct fw_unit *unit)
 {
         struct snd_oxfw *oxfw = dev_get_drvdata(&unit->device);
 
-        snd_card_disconnect(oxfw->card);
-
-        snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream);
-        if (oxfw->has_output)
-                snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream);
-
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(oxfw->card);
 }
 
diff --git a/sound/isa/msnd/msnd_pinnacle_mixer.c b/sound/isa/msnd/msnd_pinnacle_mixer.c
index 17e49a071af4..b408540798c1 100644
--- a/sound/isa/msnd/msnd_pinnacle_mixer.c
+++ b/sound/isa/msnd/msnd_pinnacle_mixer.c
@@ -306,11 +306,12 @@ int snd_msndmix_new(struct snd_card *card)
         spin_lock_init(&chip->mixer_lock);
         strcpy(card->mixername, "MSND Pinnacle Mixer");
 
-        for (idx = 0; idx < ARRAY_SIZE(snd_msnd_controls); idx++)
+        for (idx = 0; idx < ARRAY_SIZE(snd_msnd_controls); idx++) {
                 err = snd_ctl_add(card,
                                   snd_ctl_new1(snd_msnd_controls + idx, chip));
                 if (err < 0)
                         return err;
+        }
 
         return 0;
 }
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index dfcb5e929f9f..a2ce773bdc62 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -961,7 +961,6 @@ static int azx_alloc_cmd_io(struct azx *chip)
                 dev_err(chip->card->dev, "cannot allocate CORB/RIRB\n");
         return err;
 }
-EXPORT_SYMBOL_GPL(azx_alloc_cmd_io);
 
 static void azx_init_cmd_io(struct azx *chip)
 {
@@ -1026,7 +1025,6 @@ static void azx_init_cmd_io(struct azx *chip)
         azx_writeb(chip, RIRBCTL, AZX_RBCTL_DMA_EN | AZX_RBCTL_IRQ_EN);
         spin_unlock_irq(&chip->reg_lock);
 }
-EXPORT_SYMBOL_GPL(azx_init_cmd_io);
 
 static void azx_free_cmd_io(struct azx *chip)
 {
@@ -1036,7 +1034,6 @@ static void azx_free_cmd_io(struct azx *chip)
         azx_writeb(chip, CORBCTL, 0);
         spin_unlock_irq(&chip->reg_lock);
 }
-EXPORT_SYMBOL_GPL(azx_free_cmd_io);
 
 static unsigned int azx_command_addr(u32 cmd)
 {
@@ -1316,7 +1313,6 @@ static int azx_send_cmd(struct hda_bus *bus, unsigned int val)
         else
                 return azx_corb_send_cmd(bus, val);
 }
-EXPORT_SYMBOL_GPL(azx_send_cmd);
 
 /* get a response */
 static unsigned int azx_get_response(struct hda_bus *bus,
@@ -1330,7 +1326,6 @@ static unsigned int azx_get_response(struct hda_bus *bus,
         else
                 return azx_rirb_get_response(bus, addr);
 }
-EXPORT_SYMBOL_GPL(azx_get_response);
 
 #ifdef CONFIG_SND_HDA_DSP_LOADER
 /*
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 36d2f20db7a4..4ca3d5d02436 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1966,7 +1966,7 @@ static const struct pci_device_id azx_ids[] = {
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* Panther Point */
         { PCI_DEVICE(0x8086, 0x1e20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* Lynx Point */
         { PCI_DEVICE(0x8086, 0x8c20),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b2b24a8b3dac..526398a4a442 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5209,6 +5209,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x17, 0x40000000},
                 {0x1d, 0x40700001},
                 {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC255_STANDARD_PINS,
+                {0x12, 0x90a60170},
+                {0x14, 0x90170140},
+                {0x17, 0x40000000},
+                {0x1d, 0x40700001},
+                {0x21, 0x02211050}),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
                 {0x12, 0x90a60130},
                 {0x13, 0x40000000},
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6d36c5b78805..87eff3173ce9 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -79,6 +79,7 @@ enum {
         STAC_ALIENWARE_M17X,
         STAC_92HD89XX_HP_FRONT_JACK,
         STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK,
+        STAC_92HD73XX_ASUS_MOBO,
         STAC_92HD73XX_MODELS
 };
 
@@ -1911,7 +1912,18 @@ static const struct hda_fixup stac92hd73xx_fixups[] = {
         [STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = stac92hd89xx_hp_z1_g2_right_mic_jack_pin_configs,
-        }
+        },
+        [STAC_92HD73XX_ASUS_MOBO] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        /* enable 5.1 and SPDIF out */
+                        { 0x0c, 0x01014411 },
+                        { 0x0d, 0x01014410 },
+                        { 0x0e, 0x01014412 },
+                        { 0x22, 0x014b1180 },
+                        { }
+                }
+        },
 };
 
 static const struct hda_model_fixup stac92hd73xx_models[] = {
@@ -1923,6 +1935,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = {
         { .id = STAC_DELL_M6_BOTH, .name = "dell-m6" },
         { .id = STAC_DELL_EQ, .name = "dell-eq" },
         { .id = STAC_ALIENWARE_M17X, .name = "alienware" },
+        { .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" },
         {}
 };
 
@@ -1975,6 +1988,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
                                 "HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
                                 "unknown HP", STAC_92HD89XX_HP_FRONT_JACK),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_ASUSTEK, 0x83f8, "ASUS AT4NM10",
+                      STAC_92HD73XX_ASUS_MOBO),
         {} /* terminator */
 };
 
diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c
index f5ad214663f9..8de836165cf2 100644
--- a/sound/soc/atmel/sam9g20_wm8731.c
+++ b/sound/soc/atmel/sam9g20_wm8731.c
@@ -46,8 +46,6 @@
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
 
-#include <asm/mach-types.h>
-
 #include "../codecs/wm8731.h"
 #include "atmel-pcm.h"
 #include "atmel_ssc_dai.h"
@@ -171,9 +169,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
         int ret;
 
         if (!np) {
-                if (!(machine_is_at91sam9g20ek() ||
-                        machine_is_at91sam9g20ek_2mmc()))
-                        return -ENODEV;
+                return -ENODEV;
         }
 
         ret = atmel_ssc_set_audio(0);
@@ -210,39 +206,37 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
         card->dev = &pdev->dev;
 
         /* Parse device node info */
-        if (np) {
-                ret = snd_soc_of_parse_card_name(card, "atmel,model");
-                if (ret)
-                        goto err;
-
-                ret = snd_soc_of_parse_audio_routing(card,
-                        "atmel,audio-routing");
-                if (ret)
-                        goto err;
-
-                /* Parse codec info */
-                at91sam9g20ek_dai.codec_name = NULL;
-                codec_np = of_parse_phandle(np, "atmel,audio-codec", 0);
-                if (!codec_np) {
-                        dev_err(&pdev->dev, "codec info missing\n");
-                        return -EINVAL;
-                }
-                at91sam9g20ek_dai.codec_of_node = codec_np;
-
-                /* Parse dai and platform info */
-                at91sam9g20ek_dai.cpu_dai_name = NULL;
-                at91sam9g20ek_dai.platform_name = NULL;
-                cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0);
-                if (!cpu_np) {
-                        dev_err(&pdev->dev, "dai and pcm info missing\n");
-                        return -EINVAL;
-                }
-                at91sam9g20ek_dai.cpu_of_node = cpu_np;
-                at91sam9g20ek_dai.platform_of_node = cpu_np;
-
-                of_node_put(codec_np);
-                of_node_put(cpu_np);
+        ret = snd_soc_of_parse_card_name(card, "atmel,model");
+        if (ret)
+                goto err;
+
+        ret = snd_soc_of_parse_audio_routing(card,
+                "atmel,audio-routing");
+        if (ret)
+                goto err;
+
+        /* Parse codec info */
+        at91sam9g20ek_dai.codec_name = NULL;
+        codec_np = of_parse_phandle(np, "atmel,audio-codec", 0);
+        if (!codec_np) {
+                dev_err(&pdev->dev, "codec info missing\n");
+                return -EINVAL;
+        }
+        at91sam9g20ek_dai.codec_of_node = codec_np;
+
+        /* Parse dai and platform info */
+        at91sam9g20ek_dai.cpu_dai_name = NULL;
+        at91sam9g20ek_dai.platform_name = NULL;
+        cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0);
+        if (!cpu_np) {
+                dev_err(&pdev->dev, "dai and pcm info missing\n");
+                return -EINVAL;
         }
+        at91sam9g20ek_dai.cpu_of_node = cpu_np;
+        at91sam9g20ek_dai.platform_of_node = cpu_np;
+
+        of_node_put(codec_np);
+        of_node_put(cpu_np);
 
         ret = snd_soc_register_card(card);
         if (ret) {
diff --git a/sound/soc/cirrus/Kconfig b/sound/soc/cirrus/Kconfig
index 7b7fbcd49e5e..c7cd60f009e9 100644
--- a/sound/soc/cirrus/Kconfig
+++ b/sound/soc/cirrus/Kconfig
@@ -16,7 +16,7 @@ config SND_EP93XX_SOC_AC97
 
 config SND_EP93XX_SOC_SNAPPERCL15
         tristate "SoC Audio support for Bluewater Systems Snapper CL15 module"
-        depends on SND_EP93XX_SOC && MACH_SNAPPER_CL15
+        depends on SND_EP93XX_SOC && MACH_SNAPPER_CL15 && I2C
         select SND_EP93XX_SOC_I2S
         select SND_SOC_TLV320AIC23_I2C
         help
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 064e6c18e109..ea9f0e31f9d4 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -69,7 +69,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_MAX98088 if I2C
         select SND_SOC_MAX98090 if I2C
         select SND_SOC_MAX98095 if I2C
-        select SND_SOC_MAX98357A
+        select SND_SOC_MAX98357A if GPIOLIB
         select SND_SOC_MAX9850 if I2C
         select SND_SOC_MAX9768 if I2C
         select SND_SOC_MAX9877 if I2C
diff --git a/sound/soc/codecs/max98357a.c b/sound/soc/codecs/max98357a.c
index 1806333ea29e..e9e6efbc21dd 100644
--- a/sound/soc/codecs/max98357a.c
+++ b/sound/soc/codecs/max98357a.c
@@ -12,9 +12,19 @@
  * max98357a.c -- MAX98357A ALSA SoC Codec driver
  */
 
-#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/err.h>
 #include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <sound/pcm.h>
 #include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/soc-dapm.h>
 
 #define DRV_NAME "max98357a"
 
diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
index e1a4a45c57e2..fd102613d20d 100644
--- a/sound/soc/codecs/rt5670.c
+++ b/sound/soc/codecs/rt5670.c
@@ -225,7 +225,6 @@ static bool rt5670_volatile_register(struct device *dev, unsigned int reg)
         case RT5670_ADC_EQ_CTRL1:
         case RT5670_EQ_CTRL1:
         case RT5670_ALC_CTRL_1:
-        case RT5670_IRQ_CTRL1:
         case RT5670_IRQ_CTRL2:
         case RT5670_INT_IRQ_ST:
         case RT5670_IL_CMD:
@@ -2703,6 +2702,12 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
 
         regmap_write(rt5670->regmap, RT5670_RESET, 0);
 
+        regmap_read(rt5670->regmap, RT5670_VENDOR_ID, &val);
+        if (val >= 4)
+                regmap_write(rt5670->regmap, RT5670_GPIO_CTRL3, 0x0980);
+        else
+                regmap_write(rt5670->regmap, RT5670_GPIO_CTRL3, 0x0d00);
+
         ret = regmap_register_patch(rt5670->regmap, init_list,
                                     ARRAY_SIZE(init_list));
         if (ret != 0)
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index 5d0bb8748dd1..fb9c20eace3f 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -3284,8 +3284,8 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "IB45 Bypass Mux", "Bypass", "IB45 Mux" },
         { "IB45 Bypass Mux", "Pass SRC", "IB45 Mux" },
 
-        { "IB6 Mux", "IF1 DAC 6", "IF1 DAC6" },
-        { "IB6 Mux", "IF2 DAC 6", "IF2 DAC6" },
+        { "IB6 Mux", "IF1 DAC 6", "IF1 DAC6 Mux" },
+        { "IB6 Mux", "IF2 DAC 6", "IF2 DAC6 Mux" },
         { "IB6 Mux", "SLB DAC 6", "SLB DAC6" },
         { "IB6 Mux", "STO4 ADC MIX L", "Stereo4 ADC MIXL" },
         { "IB6 Mux", "IF4 DAC L", "IF4 DAC L" },
@@ -3293,8 +3293,8 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "IB6 Mux", "STO2 ADC MIX L", "Stereo2 ADC MIXL" },
         { "IB6 Mux", "STO3 ADC MIX L", "Stereo3 ADC MIXL" },
 
-        { "IB7 Mux", "IF1 DAC 7", "IF1 DAC7" },
-        { "IB7 Mux", "IF2 DAC 7", "IF2 DAC7" },
+        { "IB7 Mux", "IF1 DAC 7", "IF1 DAC7 Mux" },
+        { "IB7 Mux", "IF2 DAC 7", "IF2 DAC7 Mux" },
         { "IB7 Mux", "SLB DAC 7", "SLB DAC7" },
         { "IB7 Mux", "STO4 ADC MIX R", "Stereo4 ADC MIXR" },
         { "IB7 Mux", "IF4 DAC R", "IF4 DAC R" },
@@ -3635,15 +3635,15 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "DAC1 FS", NULL, "DAC1 MIXL" },
         { "DAC1 FS", NULL, "DAC1 MIXR" },
 
-        { "DAC2 L Mux", "IF1 DAC 2", "IF1 DAC2" },
-        { "DAC2 L Mux", "IF2 DAC 2", "IF2 DAC2" },
+        { "DAC2 L Mux", "IF1 DAC 2", "IF1 DAC2 Mux" },
+        { "DAC2 L Mux", "IF2 DAC 2", "IF2 DAC2 Mux" },
         { "DAC2 L Mux", "IF3 DAC L", "IF3 DAC L" },
         { "DAC2 L Mux", "IF4 DAC L", "IF4 DAC L" },
         { "DAC2 L Mux", "SLB DAC 2", "SLB DAC2" },
         { "DAC2 L Mux", "OB 2", "OutBound2" },
 
-        { "DAC2 R Mux", "IF1 DAC 3", "IF1 DAC3" },
-        { "DAC2 R Mux", "IF2 DAC 3", "IF2 DAC3" },
+        { "DAC2 R Mux", "IF1 DAC 3", "IF1 DAC3 Mux" },
+        { "DAC2 R Mux", "IF2 DAC 3", "IF2 DAC3 Mux" },
         { "DAC2 R Mux", "IF3 DAC R", "IF3 DAC R" },
         { "DAC2 R Mux", "IF4 DAC R", "IF4 DAC R" },
         { "DAC2 R Mux", "SLB DAC 3", "SLB DAC3" },
@@ -3651,29 +3651,29 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "DAC2 R Mux", "Haptic Generator", "Haptic Generator" },
         { "DAC2 R Mux", "VAD ADC", "VAD ADC Mux" },
 
-        { "DAC3 L Mux", "IF1 DAC 4", "IF1 DAC4" },
-        { "DAC3 L Mux", "IF2 DAC 4", "IF2 DAC4" },
+        { "DAC3 L Mux", "IF1 DAC 4", "IF1 DAC4 Mux" },
+        { "DAC3 L Mux", "IF2 DAC 4", "IF2 DAC4 Mux" },
         { "DAC3 L Mux", "IF3 DAC L", "IF3 DAC L" },
         { "DAC3 L Mux", "IF4 DAC L", "IF4 DAC L" },
         { "DAC3 L Mux", "SLB DAC 4", "SLB DAC4" },
         { "DAC3 L Mux", "OB 4", "OutBound4" },
 
-        { "DAC3 R Mux", "IF1 DAC 5", "IF1 DAC4" },
-        { "DAC3 R Mux", "IF2 DAC 5", "IF2 DAC4" },
+        { "DAC3 R Mux", "IF1 DAC 5", "IF1 DAC5 Mux" },
+        { "DAC3 R Mux", "IF2 DAC 5", "IF2 DAC5 Mux" },
         { "DAC3 R Mux", "IF3 DAC R", "IF3 DAC R" },
         { "DAC3 R Mux", "IF4 DAC R", "IF4 DAC R" },
         { "DAC3 R Mux", "SLB DAC 5", "SLB DAC5" },
         { "DAC3 R Mux", "OB 5", "OutBound5" },
 
-        { "DAC4 L Mux", "IF1 DAC 6", "IF1 DAC6" },
-        { "DAC4 L Mux", "IF2 DAC 6", "IF2 DAC6" },
+        { "DAC4 L Mux", "IF1 DAC 6", "IF1 DAC6 Mux" },
+        { "DAC4 L Mux", "IF2 DAC 6", "IF2 DAC6 Mux" },
         { "DAC4 L Mux", "IF3 DAC L", "IF3 DAC L" },
         { "DAC4 L Mux", "IF4 DAC L", "IF4 DAC L" },
         { "DAC4 L Mux", "SLB DAC 6", "SLB DAC6" },
         { "DAC4 L Mux", "OB 6", "OutBound6" },
 
-        { "DAC4 R Mux", "IF1 DAC 7", "IF1 DAC7" },
-        { "DAC4 R Mux", "IF2 DAC 7", "IF2 DAC7" },
+        { "DAC4 R Mux", "IF1 DAC 7", "IF1 DAC7 Mux" },
+        { "DAC4 R Mux", "IF2 DAC 7", "IF2 DAC7 Mux" },
         { "DAC4 R Mux", "IF3 DAC R", "IF3 DAC R" },
         { "DAC4 R Mux", "IF4 DAC R", "IF4 DAC R" },
         { "DAC4 R Mux", "SLB DAC 7", "SLB DAC7" },
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index 3a1343fa109b..007a0e3bc273 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -106,13 +106,11 @@ static const struct reg_default sta32x_regs[] = {
 };
 
 static const struct regmap_range sta32x_write_regs_range[] = {
-        regmap_reg_range(STA32X_CONFA,  STA32X_AUTO2),
-        regmap_reg_range(STA32X_C1CFG,  STA32X_FDRC2),
+        regmap_reg_range(STA32X_CONFA,  STA32X_FDRC2),
 };
 
 static const struct regmap_range sta32x_read_regs_range[] = {
-        regmap_reg_range(STA32X_CONFA,  STA32X_AUTO2),
-        regmap_reg_range(STA32X_C1CFG,  STA32X_FDRC2),
+        regmap_reg_range(STA32X_CONFA,  STA32X_FDRC2),
 };
 
 static const struct regmap_range sta32x_volatile_regs_range[] = {
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 2595611e8a6d..b9fabbf69db6 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -603,10 +603,6 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
         factor = (div2 + 1) * (7 * psr + 1) * 2;
 
         for (i = 0; i < 255; i++) {
-                /* The bclk rate must be smaller than 1/5 sysclk rate */
-                if (factor * (i + 1) < 5)
-                        continue;
-
                 tmprate = freq * factor * (i + 2);
 
                 if (baudclk_is_used)
@@ -614,6 +610,13 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
                 else
                         clkrate = clk_round_rate(ssi_private->baudclk, tmprate);
 
+                /*
+                 * Hardware limitation: The bclk rate must be
+                 * never greater than 1/5 IPG clock rate
+                 */
+                if (clkrate * 5 > clk_get_rate(ssi_private->clk))
+                        continue;
+
                 clkrate /= factor;
                 afreq = clkrate / (i + 1);
 
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index f7c6734bd5da..fb550b5869d2 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -372,6 +372,11 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
                             strlen(dai_link->cpu_dai_name)   +
                             strlen(dai_link->codec_dai_name) + 2,
                             GFP_KERNEL);
+        if (!name) {
+                ret = -ENOMEM;
+                goto dai_link_of_err;
+        }
+
         sprintf(name, "%s-%s", dai_link->cpu_dai_name,
                                 dai_link->codec_dai_name);
         dai_link->name = dai_link->stream_name = name;
diff --git a/sound/soc/intel/sst-atom-controls.h b/sound/soc/intel/sst-atom-controls.h
index dfebfdd5eb2a..daecc58f28af 100644
--- a/sound/soc/intel/sst-atom-controls.h
+++ b/sound/soc/intel/sst-atom-controls.h
@@ -150,7 +150,7 @@ enum sst_cmd_type {
 
 enum sst_task {
         SST_TASK_SBA = 1,
-        SST_TASK_MMX,
+        SST_TASK_MMX = 3,
 };
 
 enum sst_type {
diff --git a/sound/soc/intel/sst/sst.c b/sound/soc/intel/sst/sst.c
index 8a8d56a146e7..11c578651c1c 100644
--- a/sound/soc/intel/sst/sst.c
+++ b/sound/soc/intel/sst/sst.c
@@ -350,7 +350,9 @@ static inline void sst_save_shim64(struct intel_sst_drv *ctx,
 
         spin_lock_irqsave(&ctx->ipc_spin_lock, irq_flags);
 
-        shim_regs->imrx = sst_shim_read64(shim, SST_IMRX),
+        shim_regs->imrx = sst_shim_read64(shim, SST_IMRX);
+        shim_regs->csr = sst_shim_read64(shim, SST_CSR);
+
 
         spin_unlock_irqrestore(&ctx->ipc_spin_lock, irq_flags);
 }
@@ -367,6 +369,7 @@ static inline void sst_restore_shim64(struct intel_sst_drv *ctx,
          */
         spin_lock_irqsave(&ctx->ipc_spin_lock, irq_flags);
         sst_shim_write64(shim, SST_IMRX, shim_regs->imrx),
+        sst_shim_write64(shim, SST_CSR, shim_regs->csr),
         spin_unlock_irqrestore(&ctx->ipc_spin_lock, irq_flags);
 }
 
@@ -379,6 +382,10 @@ void sst_configure_runtime_pm(struct intel_sst_drv *ctx)
          * initially active. So change the state to active before
          * enabling the pm
          */
+
+        if (!acpi_disabled)
+                pm_runtime_set_active(ctx->dev);
+
         pm_runtime_enable(ctx->dev);
 
         if (acpi_disabled)
@@ -409,6 +416,7 @@ static int intel_sst_runtime_suspend(struct device *dev)
         synchronize_irq(ctx->irq_num);
         flush_workqueue(ctx->post_msg_wq);
 
+        ctx->ops->reset(ctx);
         /* save the shim registers because PMC doesn't save state */
         sst_save_shim64(ctx, ctx->shim, ctx->shim_regs64);
 
diff --git a/sound/soc/omap/omap-hdmi-audio.c b/sound/soc/omap/omap-hdmi-audio.c
index ccfb41c22e53..f7eb42aa3f38 100644
--- a/sound/soc/omap/omap-hdmi-audio.c
+++ b/sound/soc/omap/omap-hdmi-audio.c
@@ -352,6 +352,9 @@ static int omap_hdmi_audio_probe(struct platform_device *pdev)
                 return ret;
 
         card = devm_kzalloc(dev, sizeof(*card), GFP_KERNEL);
+        if (!card)
+                return -ENOMEM;
+
         card->name = devm_kasprintf(dev, GFP_KERNEL,
                                     "HDMI %s", dev_name(ad->dssdev));
         card->owner = THIS_MODULE;
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index c7eb9dd67f60..fd99d89de6a8 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -530,8 +530,19 @@ static int omap_mcbsp_dai_set_dai_sysclk(struct snd_soc_dai *cpu_dai,
 
         case OMAP_MCBSP_SYSCLK_CLKX_EXT:
                 regs->srgr2     |= CLKSM;
+                regs->pcr0      |= SCLKME;
+                /*
+                 * If McBSP is master but yet the CLKX/CLKR pin drives the SRG,
+                 * disable output on those pins. This enables to inject the
+                 * reference clock through CLKX/CLKR. For this to work
+                 * set_dai_sysclk() _needs_ to be called after set_dai_fmt().
+                 */
+                regs->pcr0      &= ~CLKXM;
+                break;
         case OMAP_MCBSP_SYSCLK_CLKR_EXT:
                 regs->pcr0      |= SCLKME;
+                /* Disable ouput on CLKR pin in master mode */
+                regs->pcr0      &= ~CLKRM;
                 break;
         default:
                 err = -ENODEV;
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index f4b05bc23e4b..1343ecbf0bd5 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -201,7 +201,7 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd)
         struct snd_pcm *pcm = rtd->pcm;
         int ret;
 
-        ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(64));
+        ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(32));
         if (ret)
                 return ret;
 
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index 3cebf6ca03df..0632a36852c8 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -174,7 +174,7 @@ config SND_SOC_SMDK_WM8994_PCM
 
 config SND_SOC_SPEYSIDE
         tristate "Audio support for Wolfson Speyside"
-        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410
+        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && I2C && SPI_MASTER
         select SND_SAMSUNG_I2S
         select SND_SOC_WM8996
         select SND_SOC_WM9081
@@ -189,7 +189,7 @@ config SND_SOC_TOBERMORY
 
 config SND_SOC_BELLS
         tristate "Audio support for Wolfson Bells"
-        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && MFD_ARIZONA
+        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && MFD_ARIZONA && I2C && SPI_MASTER
         select SND_SAMSUNG_I2S
         select SND_SOC_WM5102
         select SND_SOC_WM5110
@@ -206,7 +206,7 @@ config SND_SOC_LOWLAND
 
 config SND_SOC_LITTLEMILL
         tristate "Audio support for Wolfson Littlemill"
-        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410
+        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && I2C
         select SND_SAMSUNG_I2S
         select MFD_WM8994
         select SND_SOC_WM8994
@@ -223,7 +223,7 @@ config SND_SOC_SNOW
 
 config SND_SOC_ODROIDX2
         tristate "Audio support for Odroid-X2 and Odroid-U3"
-        depends on SND_SOC_SAMSUNG
+        depends on SND_SOC_SAMSUNG && I2C
         select SND_SOC_MAX98090
         select SND_SAMSUNG_I2S
         help
@@ -231,6 +231,6 @@ config SND_SOC_ODROIDX2
 
 config SND_SOC_ARNDALE_RT5631_ALC5631
         tristate "Audio support for RT5631(ALC5631) on Arndale Board"
-        depends on SND_SOC_SAMSUNG
+        depends on SND_SOC_SAMSUNG && I2C
         select SND_SAMSUNG_I2S
         select SND_SOC_RT5631
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 1b53605f7154..110577c52317 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1252,6 +1252,8 @@ static int rsnd_probe(struct platform_device *pdev)
                         goto exit_snd_probe;
         }
 
+        dev_set_drvdata(dev, priv);
+
         /*
          *      asoc register
          */
@@ -1268,8 +1270,6 @@ static int rsnd_probe(struct platform_device *pdev)
                 goto exit_snd_soc;
         }
 
-        dev_set_drvdata(dev, priv);
-
         pm_runtime_enable(dev);
 
         dev_info(dev, "probed\n");
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index 05dee690f487..97ed593f6010 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -39,7 +39,7 @@ static void change_volume(struct urb *urb_out, int volume[],
                 for (; p < buf_end; ++p) {
                         short pv = le16_to_cpu(*p);
                         int val = (pv * volume[chn & 1]) >> 8;
-                        pv = clamp(val, 0x7fff, -0x8000);
+                        pv = clamp(val, -0x8000, 0x7fff);
                         *p = cpu_to_le16(pv);
                         ++chn;
                 }
@@ -54,7 +54,7 @@ static void change_volume(struct urb *urb_out, int volume[],
 
                         val = p[0] + (p[1] << 8) + ((signed char)p[2] << 16);
                         val = (val * volume[chn & 1]) >> 8;
-                        val = clamp(val, 0x7fffff, -0x800000);
+                        val = clamp(val, -0x800000, 0x7fffff);
                         p[0] = val;
                         p[1] = val >> 8;
                         p[2] = val >> 16;
@@ -126,7 +126,7 @@ static void add_monitor_signal(struct urb *urb_out, unsigned char *signal,
                         short pov = le16_to_cpu(*po);
                         short piv = le16_to_cpu(*pi);
                         int val = pov + ((piv * volume) >> 8);
-                        pov = clamp(val, 0x7fff, -0x8000);
+                        pov = clamp(val, -0x8000, 0x7fff);
                         *po = cpu_to_le16(pov);
                 }
         }
diff --git a/tools/perf/bench/mem-memcpy.c b/tools/perf/bench/mem-memcpy.c
index 6c14afe8c1b1..db1d3a29d97f 100644
--- a/tools/perf/bench/mem-memcpy.c
+++ b/tools/perf/bench/mem-memcpy.c
@@ -289,7 +289,7 @@ static u64 do_memcpy_cycle(const struct routine *r, size_t len, bool prefault)
         memcpy_t fn = r->fn.memcpy;
         int i;
 
-        memcpy_alloc_mem(&src, &dst, len);
+        memcpy_alloc_mem(&dst, &src, len);
 
         if (prefault)
                 fn(dst, src, len);
@@ -312,7 +312,7 @@ static double do_memcpy_gettimeofday(const struct routine *r, size_t len,
         void *src = NULL, *dst = NULL;
         int i;
 
-        memcpy_alloc_mem(&src, &dst, len);
+        memcpy_alloc_mem(&dst, &src, len);
 
         if (prefault)
                 fn(dst, src, len);
diff --git a/tools/perf/config/Makefile.arch b/tools/perf/config/Makefile.arch
index ff95a68741d1..ac8721ffa6c8 100644
--- a/tools/perf/config/Makefile.arch
+++ b/tools/perf/config/Makefile.arch
@@ -21,6 +21,10 @@ ifeq ($(RAW_ARCH),x86_64)
   endif
 endif
 
+ifeq ($(RAW_ARCH),sparc64)
+  ARCH ?= sparc
+endif
+
 ARCH ?= $(RAW_ARCH)
 
 LP64 := $(shell echo __LP64__ | ${CC} ${CFLAGS} -E -x c - | tail -n 1)
diff --git a/tools/perf/config/feature-checks/Makefile b/tools/perf/config/feature-checks/Makefile
index 42ac05aaf8ac..b32ff3372514 100644
--- a/tools/perf/config/feature-checks/Makefile
+++ b/tools/perf/config/feature-checks/Makefile
@@ -49,7 +49,7 @@ test-hello.bin:
         $(BUILD)
 
 test-pthread-attr-setaffinity-np.bin:
-        $(BUILD) -Werror -lpthread
+        $(BUILD) -D_GNU_SOURCE -Werror -lpthread
 
 test-stackprotector-all.bin:
         $(BUILD) -Werror -fstack-protector-all
diff --git a/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c b/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
index 0a0d3ecb4e8a..2b81b72eca23 100644
--- a/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
+++ b/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
@@ -5,10 +5,11 @@ int main(void)
 {
         int ret = 0;
         pthread_attr_t thread_attr;
+        cpu_set_t cs;
 
         pthread_attr_init(&thread_attr);
         /* don't care abt exact args, just the API itself in libpthread */
-        ret = pthread_attr_setaffinity_np(&thread_attr, 0, NULL);
+        ret = pthread_attr_setaffinity_np(&thread_attr, sizeof(cs), &cs);
 
         return ret;
 }
diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c
index 47b78b3f0325..6da965bdbc2c 100644
--- a/tools/perf/util/cloexec.c
+++ b/tools/perf/util/cloexec.c
@@ -25,6 +25,10 @@ static int perf_flag_probe(void)
         if (cpu < 0)
                 cpu = 0;
 
+        /*
+         * Using -1 for the pid is a workaround to avoid gratuitous jump label
+         * changes.
+         */
         while (1) {
                 /* check cloexec flag */
                 fd = sys_perf_event_open(&attr, pid, cpu, -1,
@@ -47,16 +51,24 @@ static int perf_flag_probe(void)
                   err, strerror_r(err, sbuf, sizeof(sbuf)));
 
         /* not supported, confirm error related to PERF_FLAG_FD_CLOEXEC */
-        fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
+        while (1) {
+                fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
+                if (fd < 0 && pid == -1 && errno == EACCES) {
+                        pid = 0;
+                        continue;
+                }
+                break;
+        }
         err = errno;
 
+        if (fd >= 0)
+                close(fd);
+
         if (WARN_ONCE(fd < 0 && err != EBUSY,
                       "perf_event_open(..., 0) failed unexpectedly with error %d (%s)\n",
                       err, strerror_r(err, sbuf, sizeof(sbuf))))
                 return -1;
 
-        close(fd);
-
         return 0;
 }
 
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index c94a9e03ecf1..e99a67632831 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -28,7 +28,7 @@ struct perf_mmap {
         int              mask;
         int              refcnt;
         unsigned int     prev;
-        char             event_copy[PERF_SAMPLE_MAX_SIZE];
+        char             event_copy[PERF_SAMPLE_MAX_SIZE] __attribute__((aligned(8)));
 };
 
 struct perf_evlist {
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index b24f9d8727a8..33b7a2aef713 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -11,6 +11,11 @@
 #include <symbol/kallsyms.h>
 #include "debug.h"
 
+#ifndef EM_AARCH64
+#define EM_AARCH64      183  /* ARM 64 bit */
+#endif
+
+
 #ifdef HAVE_CPLUS_DEMANGLE_SUPPORT
 extern char *cplus_demangle(const char *, int);
 
diff --git a/tools/thermal/tmon/.gitignore b/tools/thermal/tmon/.gitignore
new file mode 100644
index 000000000000..06e96be65276
--- /dev/null
+++ b/tools/thermal/tmon/.gitignore
@@ -0,0 +1 @@
+/tmon
diff --git a/tools/thermal/tmon/Makefile b/tools/thermal/tmon/Makefile
index e775adcbd29f..0788621c8d76 100644
--- a/tools/thermal/tmon/Makefile
+++ b/tools/thermal/tmon/Makefile
@@ -2,8 +2,8 @@ VERSION = 1.0
 
 BINDIR=usr/bin
 WARNFLAGS=-Wall -Wshadow -W -Wformat -Wimplicit-function-declaration -Wimplicit-int
-CFLAGS= -O1 ${WARNFLAGS} -fstack-protector
-CC=gcc
+CFLAGS+= -O1 ${WARNFLAGS} -fstack-protector
+CC=$(CROSS_COMPILE)gcc
 
 CFLAGS+=-D VERSION=\"$(VERSION)\"
 LDFLAGS+=
@@ -16,12 +16,21 @@ INSTALL_CONFIGFILE=install -m 644 -p
 CONFIG_FILE=
 CONFIG_PATH=
 
+# Static builds might require -ltinfo, for instance
+ifneq ($(findstring -static, $(LDFLAGS)),)
+STATIC := --static
+endif
+
+TMON_LIBS=-lm -lpthread
+TMON_LIBS += $(shell pkg-config --libs $(STATIC) panelw ncursesw 2> /dev/null || \
+                     pkg-config --libs $(STATIC) panel ncurses 2> /dev/null || \
+                     echo -lpanel -lncurses)
 
 OBJS = tmon.o tui.o sysfs.o pid.o
 OBJS +=
 
 tmon: $(OBJS) Makefile tmon.h
-        $(CC) ${CFLAGS} $(LDFLAGS) $(OBJS)  -o $(TARGET) -lm -lpanel -lncursesw -ltinfo -lpthread
+        $(CC) $(CFLAGS) $(LDFLAGS) $(OBJS)  -o $(TARGET) $(TMON_LIBS)
 
 valgrind: tmon
          sudo valgrind -v --track-origins=yes --tool=memcheck --leak-check=yes --show-reachable=yes --num-callers=20 --track-fds=yes ./$(TARGET)  1> /dev/null
diff --git a/tools/thermal/tmon/tmon.8 b/tools/thermal/tmon/tmon.8
index 0be727cb9892..02d5179803aa 100644
--- a/tools/thermal/tmon/tmon.8
+++ b/tools/thermal/tmon/tmon.8
@@ -55,6 +55,8 @@ The \fB-l --log\fP option write data to /var/tmp/tmon.log
 .PP
 The \fB-t --time-interval\fP option sets the polling interval in seconds
 .PP
+The \fB-T --target-temp\fP option sets the initial target temperature
+.PP
 The \fB-v --version\fP option shows the version of \fBtmon \fP
 .PP
 The \fB-z --zone\fP option sets the target therma zone instance to be controlled
diff --git a/tools/thermal/tmon/tmon.c b/tools/thermal/tmon/tmon.c
index 09b7c3218334..9aa19652e8e8 100644
--- a/tools/thermal/tmon/tmon.c
+++ b/tools/thermal/tmon/tmon.c
@@ -64,6 +64,7 @@ void usage()
         printf("  -h, --help            show this help message\n");
         printf("  -l, --log             log data to /var/tmp/tmon.log\n");
         printf("  -t, --time-interval   sampling time interval, > 1 sec.\n");
+        printf("  -T, --target-temp     initial target temperature\n");
         printf("  -v, --version         show version\n");
         printf("  -z, --zone            target thermal zone id\n");
 
@@ -219,6 +220,7 @@ static struct option opts[] = {
         { "control", 1, NULL, 'c' },
         { "daemon", 0, NULL, 'd' },
         { "time-interval", 1, NULL, 't' },
+        { "target-temp", 1, NULL, 'T' },
         { "log", 0, NULL, 'l' },
         { "help", 0, NULL, 'h' },
         { "version", 0, NULL, 'v' },
@@ -231,7 +233,7 @@ int main(int argc, char **argv)
 {
         int err = 0;
         int id2 = 0, c;
-        double yk = 0.0; /* controller output */
+        double yk = 0.0, temp; /* controller output */
         int target_tz_index;
 
         if (geteuid() != 0) {
@@ -239,7 +241,7 @@ int main(int argc, char **argv)
                 exit(EXIT_FAILURE);
         }
 
-        while ((c = getopt_long(argc, argv, "c:dlht:vgz:", opts, &id2)) != -1) {
+        while ((c = getopt_long(argc, argv, "c:dlht:T:vgz:", opts, &id2)) != -1) {
                 switch (c) {
                 case 'c':
                         no_control = 0;
@@ -254,6 +256,14 @@ int main(int argc, char **argv)
                         if (ticktime < 1)
                                 ticktime = 1;
                         break;
+                case 'T':
+                        temp = strtod(optarg, NULL);
+                        if (temp < 0) {
+                                fprintf(stderr, "error: temperature must be positive\n");
+                                return 1;
+                        }
+                        target_temp_user = temp;
+                        break;
                 case 'l':
                         printf("Logging data to /var/tmp/tmon.log\n");
                         logging = 1;
diff --git a/tools/thermal/tmon/tui.c b/tools/thermal/tmon/tui.c
index 89f8ef0e15c8..b5d1c6b22dd3 100644
--- a/tools/thermal/tmon/tui.c
+++ b/tools/thermal/tmon/tui.c
@@ -30,6 +30,18 @@
 
 #include "tmon.h"
 
+#define min(x, y) ({                            \
+        typeof(x) _min1 = (x);                  \
+        typeof(y) _min2 = (y);                  \
+        (void) (&_min1 == &_min2);              \
+        _min1 < _min2 ? _min1 : _min2; })
+
+#define max(x, y) ({                            \
+        typeof(x) _max1 = (x);                  \
+        typeof(y) _max2 = (y);                  \
+        (void) (&_max1 == &_max2);              \
+        _max1 > _max2 ? _max1 : _max2; })
+
 static PANEL *data_panel;
 static PANEL *dialogue_panel;
 static PANEL *top;
@@ -98,6 +110,18 @@ void write_status_bar(int x, char *line)
         wrefresh(status_bar_window);
 }
 
+/* wrap at 5 */
+#define DIAG_DEV_ROWS  5
+/*
+ * list cooling devices + "set temp" entry; wraps after 5 rows, if they fit
+ */
+static int diag_dev_rows(void)
+{
+        int entries = ptdata.nr_cooling_dev + 1;
+        int rows = max(DIAG_DEV_ROWS, (entries + 1) / 2);
+        return min(rows, entries);
+}
+
 void setup_windows(void)
 {
         int y_begin = 1;
@@ -122,7 +146,7 @@ void setup_windows(void)
          * dialogue window is a pop-up, when needed it lays on top of cdev win
          */
 
-        dialogue_window = subwin(stdscr, ptdata.nr_cooling_dev+5, maxx-50,
+        dialogue_window = subwin(stdscr, diag_dev_rows() + 5, maxx-50,
                                 DIAG_Y, DIAG_X);
 
         thermal_data_window = subwin(stdscr, ptdata.nr_tz_sensor *
@@ -258,21 +282,26 @@ void show_cooling_device(void)
 }
 
 const char DIAG_TITLE[] = "[ TUNABLES ]";
-#define DIAG_DEV_ROWS  5
 void show_dialogue(void)
 {
         int j, x = 0, y = 0;
+        int rows, cols;
         WINDOW *w = dialogue_window;
 
         if (tui_disabled || !w)
                 return;
 
+        getmaxyx(w, rows, cols);
+
+        /* Silence compiler 'unused' warnings */
+        (void)cols;
+
         werase(w);
         box(w, 0, 0);
         mvwprintw(w, 0, maxx/4, DIAG_TITLE);
         /* list all the available tunables */
         for (j = 0; j <= ptdata.nr_cooling_dev; j++) {
-                y = j % DIAG_DEV_ROWS;
+                y = j % diag_dev_rows();
                 if (y == 0 && j != 0)
                         x += 20;
                 if (j == ptdata.nr_cooling_dev)
@@ -283,12 +312,10 @@ void show_dialogue(void)
                                 ptdata.cdi[j].type, ptdata.cdi[j].instance);
         }
         wattron(w, A_BOLD);
-        mvwprintw(w, DIAG_DEV_ROWS+1, 1, "Enter Choice [A-Z]?");
+        mvwprintw(w, diag_dev_rows()+1, 1, "Enter Choice [A-Z]?");
         wattroff(w, A_BOLD);
-        /* y size of dialogue win is nr cdev + 5, so print legend
-         * at the bottom line
-         */
-        mvwprintw(w, ptdata.nr_cooling_dev+3, 1,
+        /* print legend at the bottom line */
+        mvwprintw(w, rows - 2, 1,
                 "Legend: A=Active, P=Passive, C=Critical");
 
         wrefresh(dialogue_window);
@@ -437,7 +464,7 @@ static void handle_input_choice(int ch)
                         snprintf(buf, sizeof(buf), "New Value for %.10s-%2d: ",
                                 ptdata.cdi[cdev_id].type,
                                 ptdata.cdi[cdev_id].instance);
-                write_dialogue_win(buf, DIAG_DEV_ROWS+2, 2);
+                write_dialogue_win(buf, diag_dev_rows() + 2, 2);
                 handle_input_val(cdev_id);
         } else {
                 snprintf(buf, sizeof(buf), "Invalid selection %d", ch);