181 files changed, 1656 insertions, 925 deletions
diff --git a/Documentation/DocBook/drm.tmpl b/Documentation/DocBook/drm.tmpl
index 677a02553ec0..ba60d93c1855 100644
--- a/Documentation/DocBook/drm.tmpl
+++ b/Documentation/DocBook/drm.tmpl
@@ -79,7 +79,7 @@
  <partintro>
    <para>
      This first part of the DRM Developer's Guide documents core DRM code,
-      helper libraries for writting drivers and generic userspace interfaces
+      helper libraries for writing drivers and generic userspace interfaces
      exposed by DRM drivers.
    </para>
  </partintro>
@@ -459,7 +459,7 @@ char *date;</synopsis>
      providing a solution to every graphics memory-related problems, GEM
      identified common code between drivers and created a support library to
      share it. GEM has simpler initialization and execution requirements than
-      TTM, but has no video RAM management capabitilies and is thus limited to
+      TTM, but has no video RAM management capabilities and is thus limited to
      UMA devices.
    </para>
    <sect2>
@@ -889,7 +889,7 @@ int (*prime_fd_to_handle)(struct drm_device *dev,
            vice versa. Drivers must use the kernel dma-buf buffer sharing framework
            to manage the PRIME file descriptors. Similar to the mode setting
            API PRIME is agnostic to the underlying buffer object manager, as
-            long as handles are 32bit unsinged integers.
+            long as handles are 32bit unsigned integers.
          </para>
          <para>
            While non-GEM drivers must implement the operations themselves, GEM
@@ -2356,7 +2356,7 @@ void intel_crt_init(struct drm_device *dev)
      first create properties and then create and associate individual instances
      of those properties to objects. A property can be instantiated multiple
      times and associated with different objects. Values are stored in property
-      instances, and all other property information are stored in the propery
+      instances, and all other property information are stored in the property
      and shared between all instances of the property.
    </para>
    <para>
@@ -2697,10 +2697,10 @@ int num_ioctls;</synopsis>
  <sect1>
    <title>Legacy Support Code</title>
    <para>
-      The section very brievely covers some of the old legacy support code which
+      The section very briefly covers some of the old legacy support code which
      is only used by old DRM drivers which have done a so-called shadow-attach
      to the underlying device instead of registering as a real driver. This
-      also includes some of the old generic buffer mangement and command
+      also includes some of the old generic buffer management and command
      submission code. Do not use any of this in new and modern drivers.
    </para>
diff --git a/Documentation/debugging-via-ohci1394.txt b/Documentation/debugging-via-ohci1394.txt
index fa0151a712f9..5c9a567b3fac 100644
--- a/Documentation/debugging-via-ohci1394.txt
+++ b/Documentation/debugging-via-ohci1394.txt
@@ -25,9 +25,11 @@ using data transfer rates in the order of 10MB/s or more.
 With most FireWire controllers, memory access is limited to the low 4 GB
 of physical address space.  This can be a problem on IA64 machines where
 memory is located mostly above that limit, but it is rarely a problem on
-more common hardware such as x86, x86-64 and PowerPC.  However, at least
+more common hardware such as x86, x86-64 and PowerPC.
-Agere/LSI FW643e and FW643e2 controllers are known to support access to
-physical addresses above 4 GB.
+At least LSI FW643e and FW643e2 controllers are known to support access to
+physical addresses above 4 GB, but this feature is currently not enabled by
+Linux.
 Together with a early initialization of the OHCI-1394 controller for debugging,
 this facility proved most useful for examining long debugs logs in the printk
@@ -101,8 +103,9 @@ Step-by-step instructions for using firescope with early OHCI initialization:
   compliant, they are based on TI PCILynx chips and require drivers for Win-
   dows operating systems.
-   The mentioned kernel log message contains ">4 GB phys DMA" in case of
+   The mentioned kernel log message contains the string "physUB" if the
-   OHCI-1394 controllers which support accesses above this limit.
+   controller implements a writable Physical Upper Bound register.  This is
+   required for physical DMA above 4 GB (but not utilized by Linux yet).
 2) Establish a working FireWire cable connection:
diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
index 05a27e9442bd..2f5173500bd9 100644
--- a/Documentation/device-mapper/thin-provisioning.txt
+++ b/Documentation/device-mapper/thin-provisioning.txt
@@ -309,7 +309,10 @@ ii) Status
    error_if_no_space|queue_if_no_space
        If the pool runs out of data or metadata space, the pool will
        either queue or error the IO destined to the data device.  The
-        default is to queue the IO until more space is added.
+        default is to queue the IO until more space is added or the
+        'no_space_timeout' expires.  The 'no_space_timeout' dm-thin-pool
+        module parameter can be used to change this timeout -- it
+        defaults to 60 seconds but may be disabled using a value of 0.
 iii) Messages
diff --git a/Documentation/email-clients.txt b/Documentation/email-clients.txt
index e9f5daccbd02..4e30ebaa9e5b 100644
--- a/Documentation/email-clients.txt
+++ b/Documentation/email-clients.txt
@@ -201,20 +201,15 @@ To beat some sense out of the internal editor, do this:
 - Edit your Thunderbird config settings so that it won't use format=flowed.
  Go to "edit->preferences->advanced->config editor" to bring up the
-  thunderbird's registry editor, and set "mailnews.send_plaintext_flowed" to
+  thunderbird's registry editor.
-  "false".
- Disable HTML Format: Set "mail.identity.id1.compose_html" to "false".
+- Set "mailnews.send_plaintext_flowed" to "false"
- Enable "preformat" mode: Set "editor.quotesPreformatted" to "true".
+- Set "mailnews.wraplength" from "72" to "0"
- Enable UTF8: Set "prefs.converted-to-utf8" to "true".
+- "View" > "Message Body As" > "Plain Text"
- Install the "toggle wordwrap" extension.  Download the file from:
+- "View" > "Character Encoding" > "Unicode (UTF-8)"
-    https://addons.mozilla.org/thunderbird/addon/2351/
-  Then go to "tools->add ons", select "install" at the bottom of the screen,
-  and browse to where you saved the .xul file.  This adds an "Enable
-  Wordwrap" entry under the Options menu of the message composer.
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 TkRat (GUI)
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 8b9cd8eb3f91..264bcde0c51c 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1245,8 +1245,9 @@ second).  The meanings of the columns are as follows, from left to right:
 The "intr" line gives counts of interrupts  serviced since boot time, for each
 of the  possible system interrupts.   The first  column  is the  total of  all
-interrupts serviced; each  subsequent column is the  total for that particular
+interrupts serviced  including  unnumbered  architecture specific  interrupts;
-interrupt.
+each  subsequent column is the  total for that particular numbered interrupt.
+Unnumbered interrupts are not shown, only summed into the total.
 The "ctxt" line gives the total number of context switches across all CPUs.
diff --git a/Documentation/hwmon/sysfs-interface b/Documentation/hwmon/sysfs-interface
index 79f8257dd790..2cc95ad46604 100644
--- a/Documentation/hwmon/sysfs-interface
+++ b/Documentation/hwmon/sysfs-interface
@@ -327,6 +327,13 @@ temp[1-*]_max_hyst
                from the max value.
                RW
+temp[1-*]_min_hyst
+                Temperature hysteresis value for min limit.
+                Unit: millidegree Celsius
+                Must be reported as an absolute temperature, NOT a delta
+                from the min value.
+                RW
 temp[1-*]_input Temperature input value.
                Unit: millidegree Celsius
                RO
@@ -362,6 +369,13 @@ temp[1-*]_lcrit	Temperature critical min value, typically lower than
                Unit: millidegree Celsius
                RW
+temp[1-*]_lcrit_hyst
+                Temperature hysteresis value for critical min limit.
+                Unit: millidegree Celsius
+                Must be reported as an absolute temperature, NOT a delta
+                from the critical min value.
+                RW
 temp[1-*]_offset
                Temperature offset which is added to the temperature reading
                by the chip.
diff --git a/Documentation/java.txt b/Documentation/java.txt
index e6a723281547..418020584ccc 100644
--- a/Documentation/java.txt
+++ b/Documentation/java.txt
@@ -188,6 +188,9 @@ shift
 #define CP_METHODREF 10
 #define CP_INTERFACEMETHODREF 11
 #define CP_NAMEANDTYPE 12
+#define CP_METHODHANDLE 15
+#define CP_METHODTYPE 16
+#define CP_INVOKEDYNAMIC 18
 /* Define some commonly used error messages */
@@ -242,14 +245,19 @@ void skip_constant(FILE *classfile, u_int16_t *cur)
                break;
        case CP_CLASS:
        case CP_STRING:
+        case CP_METHODTYPE:
                seekerr = fseek(classfile, 2, SEEK_CUR);
                break;
+        case CP_METHODHANDLE:
+                seekerr = fseek(classfile, 3, SEEK_CUR);
+                break;
        case CP_INTEGER:
        case CP_FLOAT:
        case CP_FIELDREF:
        case CP_METHODREF:
        case CP_INTERFACEMETHODREF:
        case CP_NAMEANDTYPE:
+        case CP_INVOKEDYNAMIC:
                seekerr = fseek(classfile, 4, SEEK_CUR);
                break;
        case CP_LONG:
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index a9380ba54c8e..b4f53653c106 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -2126,7 +2126,7 @@ into the hash PTE second double word).
 4.75 KVM_IRQFD
 Capability: KVM_CAP_IRQFD
-Architectures: x86
+Architectures: x86 s390
 Type: vm ioctl
 Parameters: struct kvm_irqfd (in)
 Returns: 0 on success, -1 on error
diff --git a/MAINTAINERS b/MAINTAINERS
index dd33abf44766..a3287090f12c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3158,10 +3158,9 @@ S:	Maintained
 F:      drivers/scsi/eata_pio.*
 EBTABLES
-M:      Bart De Schuymer <bart.de.schuymer@pandora.be>
 L:      netfilter-devel@vger.kernel.org
 W:      http://ebtables.sourceforge.net/
-S:      Maintained
+S:      Orphan
 F:      include/linux/netfilter_bridge/ebt_*.h
 F:      include/uapi/linux/netfilter_bridge/ebt_*.h
 F:      net/bridge/netfilter/ebt*.c
@@ -7410,6 +7409,14 @@ F:	drivers/rpmsg/
 F:      Documentation/rpmsg.txt
 F:      include/linux/rpmsg.h
+RESET CONTROLLER FRAMEWORK
+M:      Philipp Zabel <p.zabel@pengutronix.de>
+S:      Maintained
+F:      drivers/reset/
+F:      Documentation/devicetree/bindings/reset/
+F:      include/linux/reset.h
+F:      include/linux/reset-controller.h
 RFKILL
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
diff --git a/Makefile b/Makefile
index 9d993787afe0..cdaa5b6a1c4d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 15
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc8
 NAME = Shuffling Zombie Juror
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/armada-380.dtsi b/arch/arm/boot/dts/armada-380.dtsi
index 068031f0f263..6d0f03c98ee9 100644
--- a/arch/arm/boot/dts/armada-380.dtsi
+++ b/arch/arm/boot/dts/armada-380.dtsi
@@ -99,7 +99,7 @@
                        pcie@3,0 {
                                device_type = "pci";
                                assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
-                                reg = <0x1000 0 0 0 0>;
+                                reg = <0x1800 0 0 0 0>;
                                #address-cells = <3>;
                                #size-cells = <2>;
                                #interrupt-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-385.dtsi b/arch/arm/boot/dts/armada-385.dtsi
index e2919f02e1d4..da801964a257 100644
--- a/arch/arm/boot/dts/armada-385.dtsi
+++ b/arch/arm/boot/dts/armada-385.dtsi
@@ -110,7 +110,7 @@
                        pcie@3,0 {
                                device_type = "pci";
                                assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
-                                reg = <0x1000 0 0 0 0>;
+                                reg = <0x1800 0 0 0 0>;
                                #address-cells = <3>;
                                #size-cells = <2>;
                                #interrupt-cells = <1>;
@@ -131,7 +131,7 @@
                        pcie@4,0 {
                                device_type = "pci";
                                assigned-addresses = <0x82000800 0 0x48000 0 0x2000>;
-                                reg = <0x1000 0 0 0 0>;
+                                reg = <0x2000 0 0 0 0>;
                                #address-cells = <3>;
                                #size-cells = <2>;
                                #interrupt-cells = <1>;
diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
index 366fc2cbcd64..c0e0eae16a27 100644
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -641,7 +641,7 @@
                                trigger@3 {
                                        reg = <3>;
                                        trigger-name = "external";
-                                        trigger-value = <0x13>;
+                                        trigger-value = <0xd>;
                                        trigger-external;
                                };
                        };
diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts
index 9583563dd0ef..8a558b7ac999 100644
--- a/arch/arm/boot/dts/exynos4412-trats2.dts
+++ b/arch/arm/boot/dts/exynos4412-trats2.dts
@@ -503,7 +503,7 @@
                status = "okay";
                ak8975@0c {
-                        compatible = "ak,ak8975";
+                        compatible = "asahi-kasei,ak8975";
                        reg = <0x0c>;
                        gpios = <&gpj0 7 0>;
                };
diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
index 090f9830b129..cde19c818667 100644
--- a/arch/arm/boot/dts/exynos5250-arndale.dts
+++ b/arch/arm/boot/dts/exynos5250-arndale.dts
@@ -107,6 +107,7 @@
                                        regulator-name = "VDD_IOPERI_1.8V";
                                        regulator-min-microvolt = <1800000>;
                                        regulator-max-microvolt = <1800000>;
+                                        regulator-always-on;
                                        op_mode = <1>;
                                };
diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
index 80a3bf4c5986..896a2a6619e0 100644
--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
@@ -364,16 +364,4 @@
                        gpio-key,wakeup;
                };
        };
-        amba {
-                mdma1: mdma@11C10000 {
-                        /*
-                         * MDMA1 can support both secure and non-secure
-                         * AXI transactions. When this is enabled in the kernel
-                         * for boards that run in secure mode, we are getting
-                         * imprecise external aborts causing the kernel to oops.
-                         */
-                        status = "disabled";
-                };
-        };
 };
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
index c3a9a66c5767..b69fbcb7dcb8 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -219,16 +219,6 @@
                reg = <0x100440C0 0x20>;
        };
-        mau_pd: power-domain@100440E0 {
-                compatible = "samsung,exynos4210-pd";
-                reg = <0x100440E0 0x20>;
-        };
-        g2d_pd: power-domain@10044100 {
-                compatible = "samsung,exynos4210-pd";
-                reg = <0x10044100 0x20>;
-        };
        msc_pd: power-domain@10044120 {
                compatible = "samsung,exynos4210-pd";
                reg = <0x10044120 0x20>;
@@ -336,6 +326,13 @@
                        #dma-cells = <1>;
                        #dma-channels = <8>;
                        #dma-requests = <1>;
+                        /*
+                         * MDMA1 can support both secure and non-secure
+                         * AXI transactions. When this is enabled in the kernel
+                         * for boards that run in secure mode, we are getting
+                         * imprecise external aborts causing the kernel to oops.
+                         */
+                        status = "disabled";
                };
        };
@@ -385,7 +382,7 @@
        spi_0: spi@12d20000 {
                compatible = "samsung,exynos4210-spi";
                reg = <0x12d20000 0x100>;
-                interrupts = <0 66 0>;
+                interrupts = <0 68 0>;
                dmas = <&pdma0 5
                        &pdma0 4>;
                dma-names = "tx", "rx";
@@ -401,7 +398,7 @@
        spi_1: spi@12d30000 {
                compatible = "samsung,exynos4210-spi";
                reg = <0x12d30000 0x100>;
-                interrupts = <0 67 0>;
+                interrupts = <0 69 0>;
                dmas = <&pdma1 5
                        &pdma1 4>;
                dma-names = "tx", "rx";
@@ -417,7 +414,7 @@
        spi_2: spi@12d40000 {
                compatible = "samsung,exynos4210-spi";
                reg = <0x12d40000 0x100>;
-                interrupts = <0 68 0>;
+                interrupts = <0 70 0>;
                dmas = <&pdma0 7
                        &pdma0 6>;
                dma-names = "tx", "rx";
@@ -730,6 +727,5 @@
                interrupts = <0 112 0>;
                clocks = <&clock 471>;
                clock-names = "secss";
-                samsung,power-domain = <&g2d_pd>;
        };
 };
diff --git a/arch/arm/common/bL_switcher.c b/arch/arm/common/bL_switcher.c
index f01c0ee0c87e..490f3dced749 100644
--- a/arch/arm/common/bL_switcher.c
+++ b/arch/arm/common/bL_switcher.c
@@ -433,8 +433,12 @@ static void bL_switcher_restore_cpus(void)
 {
        int i;
-        for_each_cpu(i, &bL_switcher_removed_logical_cpus)
+        for_each_cpu(i, &bL_switcher_removed_logical_cpus) {
-                cpu_up(i);
+                struct device *cpu_dev = get_cpu_device(i);
+                int ret = device_online(cpu_dev);
+                if (ret)
+                        dev_err(cpu_dev, "switcher: unable to restore CPU\n");
+        }
 }
 static int bL_switcher_halve_cpus(void)
@@ -521,7 +525,7 @@ static int bL_switcher_halve_cpus(void)
                        continue;
                }
-                ret = cpu_down(i);
+                ret = device_offline(get_cpu_device(i));
                if (ret) {
                        bL_switcher_restore_cpus();
                        return ret;
diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig
index 4ce7b70ea901..e07a227ec0db 100644
--- a/arch/arm/configs/exynos_defconfig
+++ b/arch/arm/configs/exynos_defconfig
@@ -65,6 +65,7 @@ CONFIG_TCG_TIS_I2C_INFINEON=y
 CONFIG_I2C=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_ARB_GPIO_CHALLENGE=y
+CONFIG_I2C_EXYNOS5=y
 CONFIG_I2C_S3C2410=y
 CONFIG_DEBUG_GPIO=y
 # CONFIG_HWMON is not set
diff --git a/arch/arm/include/asm/trusted_foundations.h b/arch/arm/include/asm/trusted_foundations.h
index b5f7705abcb0..624e1d436c6c 100644
--- a/arch/arm/include/asm/trusted_foundations.h
+++ b/arch/arm/include/asm/trusted_foundations.h
@@ -54,7 +54,9 @@ static inline void register_trusted_foundations(
         */
        pr_err("No support for Trusted Foundations, continuing in degraded mode.\n");
        pr_err("Secondary processors as well as CPU PM will be disabled.\n");
+#if IS_ENABLED(CONFIG_SMP)
        setup_max_cpus = 0;
+#endif
        cpu_idle_poll_ctrl(true);
 }
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 12c3a5decc60..75d95799b6e6 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -171,8 +171,9 @@ extern int __put_user_8(void *, unsigned long long);
 #define __put_user_check(x,p)                                                   \
        ({                                                              \
                unsigned long __limit = current_thread_info()->addr_limit - 1; \
+                const typeof(*(p)) __user *__tmp_p = (p);               \
                register const typeof(*(p)) __r2 asm("r2") = (x);       \
-                register const typeof(*(p)) __user *__p asm("r0") = (p);\
+                register const typeof(*(p)) __user *__p asm("r0") = __tmp_p; \
                register unsigned long __l asm("r1") = __limit;         \
                register int __e asm("r0");                             \
                switch (sizeof(*(__p))) {                               \
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 1420725142ca..efb208de75ec 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -132,6 +132,10 @@
        orrne   r5, V7M_xPSR_FRAMEPTRALIGN
        biceq   r5, V7M_xPSR_FRAMEPTRALIGN
+        @ ensure bit 0 is cleared in the PC, otherwise behaviour is
+        @ unpredictable
+        bic     r4, #1
        @ write basic exception frame
        stmdb   r2!, {r1, r3-r5}
        ldmia   sp, {r1, r3-r5}
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index 3c217694ebec..cb791ac6a003 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -285,7 +285,7 @@ static int unwind_exec_pop_r4_to_rN(struct unwind_ctrl_block *ctrl,
                if (unwind_pop_register(ctrl, &vsp, reg))
                                return -URC_FAILURE;
-        if (insn & 0x80)
+        if (insn & 0x8)
                if (unwind_pop_register(ctrl, &vsp, 14))
                                return -URC_FAILURE;
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index a0282928e9c1..7cd6f19945ed 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -1308,19 +1308,19 @@ static struct platform_device at91_adc_device = {
 static struct at91_adc_trigger at91_adc_triggers[] = {
        [0] = {
                .name = "timer-counter-0",
-                .value = AT91_ADC_TRGSEL_TC0 | AT91_ADC_TRGEN,
+                .value = 0x1,
        },
        [1] = {
                .name = "timer-counter-1",
-                .value = AT91_ADC_TRGSEL_TC1 | AT91_ADC_TRGEN,
+                .value = 0x3,
        },
        [2] = {
                .name = "timer-counter-2",
-                .value = AT91_ADC_TRGSEL_TC2 | AT91_ADC_TRGEN,
+                .value = 0x5,
        },
        [3] = {
                .name = "external",
-                .value = AT91_ADC_TRGSEL_EXTERNAL | AT91_ADC_TRGEN,
+                .value = 0xd,
                .is_external = true,
        },
 };
diff --git a/arch/arm/mach-exynos/firmware.c b/arch/arm/mach-exynos/firmware.c
index 932129ef26c6..aa01c4222b40 100644
--- a/arch/arm/mach-exynos/firmware.c
+++ b/arch/arm/mach-exynos/firmware.c
@@ -18,6 +18,8 @@
 #include <mach/map.h>
+#include <plat/cpu.h>
 #include "smc.h"
 static int exynos_do_idle(void)
@@ -28,13 +30,24 @@ static int exynos_do_idle(void)
 static int exynos_cpu_boot(int cpu)
 {
+        /*
+         * The second parameter of SMC_CMD_CPU1BOOT command means CPU id.
+         * But, Exynos4212 has only one secondary CPU so second parameter
+         * isn't used for informing secure firmware about CPU id.
+         */
+        if (soc_is_exynos4212())
+                cpu = 0;
        exynos_smc(SMC_CMD_CPU1BOOT, cpu, 0, 0);
        return 0;
 }
 static int exynos_set_cpu_boot_addr(int cpu, unsigned long boot_addr)
 {
-        void __iomem *boot_reg = S5P_VA_SYSRAM_NS + 0x1c + 4*cpu;
+        void __iomem *boot_reg = S5P_VA_SYSRAM_NS + 0x1c;
+        if (!soc_is_exynos4212())
+                boot_reg += 4*cpu;
        __raw_writel(boot_addr, boot_reg);
        return 0;
diff --git a/arch/arm/mach-imx/devices/platform-ipu-core.c b/arch/arm/mach-imx/devices/platform-ipu-core.c
index fc4dd7cedc11..6bd7c3f37ac0 100644
--- a/arch/arm/mach-imx/devices/platform-ipu-core.c
+++ b/arch/arm/mach-imx/devices/platform-ipu-core.c
@@ -77,7 +77,7 @@ struct platform_device *__init imx_alloc_mx3_camera(
        pdev = platform_device_alloc("mx3-camera", 0);
        if (!pdev)
-                goto err;
+                return ERR_PTR(-ENOMEM);
        pdev->dev.dma_mask = kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
        if (!pdev->dev.dma_mask)
diff --git a/arch/arm/mach-mvebu/mvebu-soc-id.c b/arch/arm/mach-mvebu/mvebu-soc-id.c
index f3d4cf53f746..09520e19b78e 100644
--- a/arch/arm/mach-mvebu/mvebu-soc-id.c
+++ b/arch/arm/mach-mvebu/mvebu-soc-id.c
@@ -108,7 +108,18 @@ static int __init mvebu_soc_id_init(void)
        iounmap(pci_base);
 res_ioremap:
-        clk_disable_unprepare(clk);
+        /*
+         * If the PCIe unit is actually enabled and we have PCI
+         * support in the kernel, we intentionally do not release the
+         * reference to the clock. We want to keep it running since
+         * the bootloader does some PCIe link configuration that the
+         * kernel is for now unable to do, and gating the clock would
+         * make us loose this precious configuration.
+         */
+        if (!of_device_is_available(child) || !IS_ENABLED(CONFIG_PCI_MVEBU)) {
+                clk_disable_unprepare(clk);
+                clk_put(clk);
+        }
 clk_err:
        of_node_put(child);
diff --git a/arch/arm/mach-omap2/board-flash.c b/arch/arm/mach-omap2/board-flash.c
index ac82512b9c8c..b6885e42c0a0 100644
--- a/arch/arm/mach-omap2/board-flash.c
+++ b/arch/arm/mach-omap2/board-flash.c
@@ -142,7 +142,7 @@ __init board_nand_init(struct mtd_partition *nand_parts, u8 nr_parts, u8 cs,
        board_nand_data.nr_parts        = nr_parts;
        board_nand_data.devsize         = nand_type;
-        board_nand_data.ecc_opt = OMAP_ECC_BCH8_CODE_HW;
+        board_nand_data.ecc_opt = OMAP_ECC_HAM1_CODE_HW;
        gpmc_nand_init(&board_nand_data, gpmc_t);
 }
 #endif /* CONFIG_MTD_NAND_OMAP2 || CONFIG_MTD_NAND_OMAP2_MODULE */
diff --git a/arch/arm/mach-omap2/cclock3xxx_data.c b/arch/arm/mach-omap2/cclock3xxx_data.c
index 8f5121b89688..eb8c75ec3b1a 100644
--- a/arch/arm/mach-omap2/cclock3xxx_data.c
+++ b/arch/arm/mach-omap2/cclock3xxx_data.c
@@ -456,7 +456,8 @@ static struct clk_hw_omap dpll4_m5x2_ck_hw = {
        .clkdm_name     = "dpll4_clkdm",
 };
-DEFINE_STRUCT_CLK(dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names, dpll4_m5x2_ck_ops);
+DEFINE_STRUCT_CLK_FLAGS(dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names,
+                        dpll4_m5x2_ck_ops, CLK_SET_RATE_PARENT);
 static struct clk dpll4_m5x2_ck_3630 = {
        .name           = "dpll4_m5x2_ck",
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index 01fc710c8181..2498ab025fa2 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -14,6 +14,7 @@
 #include <linux/cpuidle.h>
 #include <linux/cpu_pm.h>
 #include <linux/export.h>
+#include <linux/clockchips.h>
 #include <asm/cpuidle.h>
 #include <asm/proc-fns.h>
@@ -83,6 +84,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
 {
        struct idle_statedata *cx = state_ptr + index;
        u32 mpuss_can_lose_context = 0;
+        int cpu_id = smp_processor_id();
        /*
         * CPU0 has to wait and stay ON until CPU1 is OFF state.
@@ -110,6 +112,8 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
        mpuss_can_lose_context = (cx->mpu_state == PWRDM_POWER_RET) &&
                                 (cx->mpu_logic_state == PWRDM_POWER_OFF);
+        clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu_id);
        /*
         * Call idle CPU PM enter notifier chain so that
         * VFP and per CPU interrupt context is saved.
@@ -165,6 +169,8 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
        if (dev->cpu == 0 && mpuss_can_lose_context)
                cpu_cluster_pm_exit();
+        clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu_id);
 fail:
        cpuidle_coupled_parallel_barrier(dev, &abort_barrier);
        cpu_done[dev->cpu] = false;
@@ -172,6 +178,16 @@ fail:
        return index;
 }
+/*
+ * For each cpu, setup the broadcast timer because local timers
+ * stops for the states above C1.
+ */
+static void omap_setup_broadcast_timer(void *arg)
+{
+        int cpu = smp_processor_id();
+        clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ON, &cpu);
+}
 static struct cpuidle_driver omap4_idle_driver = {
        .name                           = "omap4_idle",
        .owner                          = THIS_MODULE,
@@ -189,8 +205,7 @@ static struct cpuidle_driver omap4_idle_driver = {
                        /* C2 - CPU0 OFF + CPU1 OFF + MPU CSWR */
                        .exit_latency = 328 + 440,
                        .target_residency = 960,
-                        .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED |
+                        .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED,
-                                 CPUIDLE_FLAG_TIMER_STOP,
                        .enter = omap_enter_idle_coupled,
                        .name = "C2",
                        .desc = "CPUx OFF, MPUSS CSWR",
@@ -199,8 +214,7 @@ static struct cpuidle_driver omap4_idle_driver = {
                        /* C3 - CPU0 OFF + CPU1 OFF + MPU OSWR */
                        .exit_latency = 460 + 518,
                        .target_residency = 1100,
-                        .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED |
+                        .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED,
-                                 CPUIDLE_FLAG_TIMER_STOP,
                        .enter = omap_enter_idle_coupled,
                        .name = "C3",
                        .desc = "CPUx OFF, MPUSS OSWR",
@@ -231,5 +245,8 @@ int __init omap4_idle_init(void)
        if (!cpu_clkdm[0] || !cpu_clkdm[1])
                return -ENODEV;
+        /* Configure the broadcast timer on each cpu */
+        on_each_cpu(omap_setup_broadcast_timer, NULL, 1);
        return cpuidle_register(&omap4_idle_driver, cpu_online_mask);
 }
diff --git a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
index 892317294fdc..e829664e6a6c 100644
--- a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
@@ -895,7 +895,7 @@ static struct omap_hwmod omap54xx_mcpdm_hwmod = {
         * current exception.
         */
-        .flags          = HWMOD_EXT_OPT_MAIN_CLK,
+        .flags          = HWMOD_EXT_OPT_MAIN_CLK | HWMOD_SWSUP_SIDLE,
        .main_clk       = "pad_clks_ck",
        .prcm = {
                .omap4 = {
diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
index 0c93588fcb91..1ca37c72f12f 100644
--- a/arch/arm/mm/proc-v7m.S
+++ b/arch/arm/mm/proc-v7m.S
@@ -123,6 +123,11 @@ __v7m_setup:
        mov     pc, lr
 ENDPROC(__v7m_setup)
+        .align 2
+__v7m_setup_stack:
+        .space  4 * 8                           @ 8 registers
+__v7m_setup_stack_top:
        define_processor_functions v7m, dabort=nommu_early_abort, pabort=legacy_pabort, nommu=1
        .section ".rodata"
@@ -152,6 +157,3 @@ __v7m_proc_info:
        .long   nop_cache_fns           @ proc_info_list.cache
        .size   __v7m_proc_info, . - __v7m_proc_info
-__v7m_setup_stack:
-        .space  4 * 8                           @ 8 registers
-__v7m_setup_stack_top:
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index 5f5b975887fc..b5608b1f9fbd 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -70,6 +70,7 @@ static u32 errata;
 static struct omap_dma_global_context_registers {
        u32 dma_irqenable_l0;
+        u32 dma_irqenable_l1;
        u32 dma_ocp_sysconfig;
        u32 dma_gcr;
 } omap_dma_global_context;
@@ -1973,10 +1974,17 @@ static struct irqaction omap24xx_dma_irq;
 /*----------------------------------------------------------------------------*/
+/*
+ * Note that we are currently using only IRQENABLE_L0 and L1.
+ * As the DSP may be using IRQENABLE_L2 and L3, let's not
+ * touch those for now.
+ */
 void omap_dma_global_context_save(void)
 {
        omap_dma_global_context.dma_irqenable_l0 =
                p->dma_read(IRQENABLE_L0, 0);
+        omap_dma_global_context.dma_irqenable_l1 =
+                p->dma_read(IRQENABLE_L1, 0);
        omap_dma_global_context.dma_ocp_sysconfig =
                p->dma_read(OCP_SYSCONFIG, 0);
        omap_dma_global_context.dma_gcr = p->dma_read(GCR, 0);
@@ -1991,6 +1999,8 @@ void omap_dma_global_context_restore(void)
                OCP_SYSCONFIG, 0);
        p->dma_write(omap_dma_global_context.dma_irqenable_l0,
                IRQENABLE_L0, 0);
+        p->dma_write(omap_dma_global_context.dma_irqenable_l1,
+                IRQENABLE_L1, 0);
        if (IS_DMA_ERRATA(DMA_ROMCODE_BUG))
                p->dma_write(0x3 , IRQSTATUS_L0, 0);
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 90c811f05a2e..7b1c67a0b485 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -266,7 +266,7 @@ static inline pmd_t pte_pmd(pte_t pte)
 #define pmd_page(pmd)           pfn_to_page(__phys_to_pfn(pmd_val(pmd) & PHYS_MASK))
-#define set_pmd_at(mm, addr, pmdp, pmd) set_pmd(pmdp, pmd)
+#define set_pmd_at(mm, addr, pmdp, pmd) set_pte_at(mm, addr, (pte_t *)pmdp, pmd_pte(pmd))
 static inline int has_transparent_hugepage(void)
 {
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 1a5b4032cb66..60a359cfa328 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -151,7 +151,7 @@ cflags-$(CONFIG_CPU_NEVADA)	+= $(call cc-option,-march=rm5200,-march=r5000) \
                        -Wa,--trap
 cflags-$(CONFIG_CPU_RM7000)     += $(call cc-option,-march=rm7000,-march=r5000) \
                        -Wa,--trap
-cflags-$(CONFIG_CPU_SB1)        += $(call cc-option,-march=sb1,-march=r5000) \
+cflags-$(CONFIG_CPU_SB1)        += $(call cc-option,-march=sb1 -mno-mdmx -mno-mips3d,-march=r5000) \
                        -Wa,--trap
 cflags-$(CONFIG_CPU_R8000)      += -march=r8000 -Wa,--trap
 cflags-$(CONFIG_CPU_R10000)     += $(call cc-option,-march=r10000,-march=r8000) \
diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
index dc2135be2a3a..ff2707ab3295 100644
--- a/arch/mips/include/asm/cpu-info.h
+++ b/arch/mips/include/asm/cpu-info.h
@@ -39,14 +39,14 @@ struct cache_desc {
 #define MIPS_CACHE_PINDEX       0x00000020      /* Physically indexed cache */
 struct cpuinfo_mips {
-        unsigned int            udelay_val;
+        unsigned long           asid_cache;
-        unsigned int            asid_cache;
        /*
         * Capability and feature descriptor structure for MIPS CPU
         */
        unsigned long           options;
        unsigned long           ases;
+        unsigned int            udelay_val;
        unsigned int            processor_id;
        unsigned int            fpu_id;
        unsigned int            msa_id;
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index 2692abb28e36..5805414777e0 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -381,7 +381,7 @@
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         350
+#define __NR_O32_Linux_syscalls         351
 #if _MIPS_SIM == _MIPS_SIM_ABI64
@@ -710,7 +710,7 @@
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          310
+#define __NR_64_Linux_syscalls          311
 #if _MIPS_SIM == _MIPS_SIM_NABI32
@@ -1043,6 +1043,6 @@
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         314
+#define __NR_N32_Linux_syscalls         315
 #endif /* _UAPI_ASM_UNISTD_H */
diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index 4d78bf445a9c..76122ff5cb5e 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -317,7 +317,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                if (regs->regs[insn.i_format.rs] ==
                    regs->regs[insn.i_format.rt]) {
                        epc = epc + 4 + (insn.i_format.simmediate << 2);
-                        if (insn.i_format.rt == beql_op)
+                        if (insn.i_format.opcode == beql_op)
                                ret = BRANCH_LIKELY_TAKEN;
                } else
                        epc += 8;
@@ -329,7 +329,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                if (regs->regs[insn.i_format.rs] !=
                    regs->regs[insn.i_format.rt]) {
                        epc = epc + 4 + (insn.i_format.simmediate << 2);
-                        if (insn.i_format.rt == bnel_op)
+                        if (insn.i_format.opcode == bnel_op)
                                ret = BRANCH_LIKELY_TAKEN;
                } else
                        epc += 8;
@@ -341,7 +341,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                /* rt field assumed to be zero */
                if ((long)regs->regs[insn.i_format.rs] <= 0) {
                        epc = epc + 4 + (insn.i_format.simmediate << 2);
-                        if (insn.i_format.rt == bnel_op)
+                        if (insn.i_format.opcode == blezl_op)
                                ret = BRANCH_LIKELY_TAKEN;
                } else
                        epc += 8;
@@ -353,7 +353,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                /* rt field assumed to be zero */
                if ((long)regs->regs[insn.i_format.rs] > 0) {
                        epc = epc + 4 + (insn.i_format.simmediate << 2);
-                        if (insn.i_format.rt == bnel_op)
+                        if (insn.i_format.opcode == bgtzl_op)
                                ret = BRANCH_LIKELY_TAKEN;
                } else
                        epc += 8;
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 71f85f427034..f639ccd5060c 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -163,7 +163,7 @@ int ptrace_get_watch_regs(struct task_struct *child,
        enum pt_watch_style style;
        int i;
-        if (!cpu_has_watch || current_cpu_data.watch_reg_use_cnt == 0)
+        if (!cpu_has_watch || boot_cpu_data.watch_reg_use_cnt == 0)
                return -EIO;
        if (!access_ok(VERIFY_WRITE, addr, sizeof(struct pt_watch_regs)))
                return -EIO;
@@ -177,14 +177,14 @@ int ptrace_get_watch_regs(struct task_struct *child,
 #endif
        __put_user(style, &addr->style);
-        __put_user(current_cpu_data.watch_reg_use_cnt,
+        __put_user(boot_cpu_data.watch_reg_use_cnt,
                   &addr->WATCH_STYLE.num_valid);
-        for (i = 0; i < current_cpu_data.watch_reg_use_cnt; i++) {
+        for (i = 0; i < boot_cpu_data.watch_reg_use_cnt; i++) {
                __put_user(child->thread.watch.mips3264.watchlo[i],
                           &addr->WATCH_STYLE.watchlo[i]);
                __put_user(child->thread.watch.mips3264.watchhi[i] & 0xfff,
                           &addr->WATCH_STYLE.watchhi[i]);
-                __put_user(current_cpu_data.watch_reg_masks[i],
+                __put_user(boot_cpu_data.watch_reg_masks[i],
                           &addr->WATCH_STYLE.watch_masks[i]);
        }
        for (; i < 8; i++) {
@@ -204,12 +204,12 @@ int ptrace_set_watch_regs(struct task_struct *child,
        unsigned long lt[NUM_WATCH_REGS];
        u16 ht[NUM_WATCH_REGS];
-        if (!cpu_has_watch || current_cpu_data.watch_reg_use_cnt == 0)
+        if (!cpu_has_watch || boot_cpu_data.watch_reg_use_cnt == 0)
                return -EIO;
        if (!access_ok(VERIFY_READ, addr, sizeof(struct pt_watch_regs)))
                return -EIO;
        /* Check the values. */
-        for (i = 0; i < current_cpu_data.watch_reg_use_cnt; i++) {
+        for (i = 0; i < boot_cpu_data.watch_reg_use_cnt; i++) {
                __get_user(lt[i], &addr->WATCH_STYLE.watchlo[i]);
 #ifdef CONFIG_32BIT
                if (lt[i] & __UA_LIMIT)
@@ -228,7 +228,7 @@ int ptrace_set_watch_regs(struct task_struct *child,
                        return -EINVAL;
        }
        /* Install them. */
-        for (i = 0; i < current_cpu_data.watch_reg_use_cnt; i++) {
+        for (i = 0; i < boot_cpu_data.watch_reg_use_cnt; i++) {
                if (lt[i] & 7)
                        watch_active = 1;
                child->thread.watch.mips3264.watchlo[i] = lt[i];
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 074e857ced28..8119ac2fdfc9 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1545,7 +1545,7 @@ asmlinkage void cache_parity_error(void)
               reg_val & (1<<30) ? "secondary" : "primary",
               reg_val & (1<<31) ? "data" : "insn");
        if (cpu_has_mips_r2 &&
-            ((current_cpu_data.processor_id && 0xff0000) == PRID_COMP_MIPS)) {
+            ((current_cpu_data.processor_id & 0xff0000) == PRID_COMP_MIPS)) {
                pr_err("Error bits: %s%s%s%s%s%s%s%s\n",
                        reg_val & (1<<29) ? "ED " : "",
                        reg_val & (1<<28) ? "ET " : "",
@@ -1585,7 +1585,7 @@ asmlinkage void do_ftlb(void)
        /* For the moment, report the problem and hang. */
        if (cpu_has_mips_r2 &&
-            ((current_cpu_data.processor_id && 0xff0000) == PRID_COMP_MIPS)) {
+            ((current_cpu_data.processor_id & 0xff0000) == PRID_COMP_MIPS)) {
                pr_err("FTLB error exception, cp0_ecc=0x%08x:\n",
                       read_c0_ecc());
                pr_err("cp0_errorepc == %0*lx\n", field, read_c0_errorepc());
diff --git a/arch/mips/loongson/common/cs5536/cs5536_mfgpt.c b/arch/mips/loongson/common/cs5536/cs5536_mfgpt.c
index c639b9db0012..12c75db23420 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_mfgpt.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_mfgpt.c
@@ -27,8 +27,7 @@
 #include <cs5536/cs5536_mfgpt.h>
-DEFINE_SPINLOCK(mfgpt_lock);
+static DEFINE_RAW_SPINLOCK(mfgpt_lock);
-EXPORT_SYMBOL(mfgpt_lock);
 static u32 mfgpt_base;
@@ -55,7 +54,7 @@ EXPORT_SYMBOL(enable_mfgpt0_counter);
 static void init_mfgpt_timer(enum clock_event_mode mode,
                             struct clock_event_device *evt)
 {
-        spin_lock(&mfgpt_lock);
+        raw_spin_lock(&mfgpt_lock);
        switch (mode) {
        case CLOCK_EVT_MODE_PERIODIC:
@@ -79,7 +78,7 @@ static void init_mfgpt_timer(enum clock_event_mode mode,
                /* Nothing to do here */
                break;
        }
-        spin_unlock(&mfgpt_lock);
+        raw_spin_unlock(&mfgpt_lock);
 }
 static struct clock_event_device mfgpt_clockevent = {
@@ -157,7 +156,7 @@ static cycle_t mfgpt_read(struct clocksource *cs)
        static int old_count;
        static u32 old_jifs;
-        spin_lock_irqsave(&mfgpt_lock, flags);
+        raw_spin_lock_irqsave(&mfgpt_lock, flags);
        /*
         * Although our caller may have the read side of xtime_lock,
         * this is now a seqlock, and we are cheating in this routine
@@ -191,7 +190,7 @@ static cycle_t mfgpt_read(struct clocksource *cs)
        old_count = count;
        old_jifs = jifs;
-        spin_unlock_irqrestore(&mfgpt_lock, flags);
+        raw_spin_unlock_irqrestore(&mfgpt_lock, flags);
        return (cycle_t) (jifs * COMPARE) + count;
 }
diff --git a/arch/mips/mm/page.c b/arch/mips/mm/page.c
index 58033c44690d..b611102e23b5 100644
--- a/arch/mips/mm/page.c
+++ b/arch/mips/mm/page.c
@@ -273,7 +273,7 @@ void build_clear_page(void)
                uasm_i_ori(&buf, A2, A0, off);
        if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
-                uasm_i_lui(&buf, AT, 0xa000);
+                uasm_i_lui(&buf, AT, uasm_rel_hi(0xa0000000));
        off = cache_line_size ? min(8, pref_bias_clear_store / cache_line_size)
                                * cache_line_size : 0;
@@ -424,7 +424,7 @@ void build_copy_page(void)
                uasm_i_ori(&buf, A2, A0, off);
        if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
-                uasm_i_lui(&buf, AT, 0xa000);
+                uasm_i_lui(&buf, AT, uasm_rel_hi(0xa0000000));
        off = cache_line_size ? min(8, pref_bias_copy_load / cache_line_size) *
                                cache_line_size : 0;
diff --git a/arch/mips/mti-malta/malta-memory.c b/arch/mips/mti-malta/malta-memory.c
index 6d0f4ab3632d..f2364e419682 100644
--- a/arch/mips/mti-malta/malta-memory.c
+++ b/arch/mips/mti-malta/malta-memory.c
@@ -27,7 +27,7 @@ unsigned long physical_memsize = 0L;
 fw_memblock_t * __init fw_getmdesc(int eva)
 {
        char *memsize_str, *ememsize_str __maybe_unused = NULL, *ptr;
-        unsigned long memsize, ememsize __maybe_unused = 0;
+        unsigned long memsize = 0, ememsize __maybe_unused = 0;
        static char cmdline[COMMAND_LINE_SIZE] __initdata;
        int tmp;
diff --git a/arch/mips/pci/pci-rc32434.c b/arch/mips/pci/pci-rc32434.c
index b128cb973ebe..7f6ce6d734c0 100644
--- a/arch/mips/pci/pci-rc32434.c
+++ b/arch/mips/pci/pci-rc32434.c
@@ -53,7 +53,6 @@ static struct resource rc32434_res_pci_mem1 = {
        .start = 0x50000000,
        .end = 0x5FFFFFFF,
        .flags = IORESOURCE_MEM,
-        .parent = &rc32434_res_pci_mem1,
        .sibling = NULL,
        .child = &rc32434_res_pci_mem2
 };
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 4c0cedf4e2c7..ce4c68a4a823 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -150,7 +150,9 @@ endif
 CFLAGS-$(CONFIG_TUNE_CELL) += $(call cc-option,-mtune=cell)
-KBUILD_CPPFLAGS += -Iarch/$(ARCH)
+asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1)
+KBUILD_CPPFLAGS += -Iarch/$(ARCH) $(asinstr)
 KBUILD_AFLAGS   += -Iarch/$(ARCH)
 KBUILD_CFLAGS   += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
 CPP             = $(CC) -E $(KBUILD_CFLAGS)
diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
index 6586a40a46ce..cded7c1278ef 100644
--- a/arch/powerpc/include/asm/ppc_asm.h
+++ b/arch/powerpc/include/asm/ppc_asm.h
@@ -318,11 +318,16 @@ n:
        addi    reg,reg,(name - 0b)@l;
 #ifdef __powerpc64__
+#ifdef HAVE_AS_ATHIGH
+#define __AS_ATHIGH high
+#else
+#define __AS_ATHIGH h
+#endif
 #define LOAD_REG_IMMEDIATE(reg,expr)            \
        lis     reg,(expr)@highest;             \
        ori     reg,reg,(expr)@higher;  \
        rldicr  reg,reg,32,31;          \
-        oris    reg,reg,(expr)@h;               \
+        oris    reg,reg,(expr)@__AS_ATHIGH;     \
        ori     reg,reg,(expr)@l;
 #define LOAD_REG_ADDR(reg,name)                 \
diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h
index d0e784e0ff48..521790330672 100644
--- a/arch/powerpc/include/asm/sections.h
+++ b/arch/powerpc/include/asm/sections.h
@@ -39,6 +39,17 @@ static inline int overlaps_kernel_text(unsigned long start, unsigned long end)
                (unsigned long)_stext < end;
 }
+static inline int overlaps_kvm_tmp(unsigned long start, unsigned long end)
+{
+#ifdef CONFIG_KVM_GUEST
+        extern char kvm_tmp[];
+        return start < (unsigned long)kvm_tmp &&
+                (unsigned long)&kvm_tmp[1024 * 1024] < end;
+#else
+        return 0;
+#endif
+}
 #undef dereference_function_descriptor
 static inline void *dereference_function_descriptor(void *ptr)
 {
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 3ddf70276706..ea4dc3a89c1f 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -361,3 +361,4 @@ SYSCALL(finit_module)
 SYSCALL(ni_syscall) /* sys_kcmp */
 SYSCALL_SPU(sched_setattr)
 SYSCALL_SPU(sched_getattr)
+SYSCALL_SPU(renameat2)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index 4494f029b632..9b892bbd9d84 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
-#define __NR_syscalls           357
+#define __NR_syscalls           358
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 881bf2e2560d..2d526f7b48da 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -379,5 +379,6 @@
 #define __NR_kcmp               354
 #define __NR_sched_setattr      355
 #define __NR_sched_getattr      356
+#define __NR_renameat2          357
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c
index 6a0175297b0d..dd8695f6cb6d 100644
--- a/arch/powerpc/kernel/kvm.c
+++ b/arch/powerpc/kernel/kvm.c
@@ -74,7 +74,7 @@
 #define KVM_INST_MTSRIN         0x7c0001e4
 static bool kvm_patching_worked = true;
-static char kvm_tmp[1024 * 1024];
+char kvm_tmp[1024 * 1024];
 static int kvm_tmp_index;
 static inline void kvm_patch_ins(u32 *inst, u32 new_inst)
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index 59d229a2a3e0..879b3aacac32 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -237,7 +237,7 @@ static void wake_offline_cpus(void)
                if (!cpu_online(cpu)) {
                        printk(KERN_INFO "kexec: Waking offline cpu %d.\n",
                               cpu);
-                        cpu_up(cpu);
+                        WARN_ON(cpu_up(cpu));
                }
        }
 }
diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
index 94e597e6f15c..7af190a266b3 100644
--- a/arch/powerpc/kvm/book3s.c
+++ b/arch/powerpc/kvm/book3s.c
@@ -886,7 +886,7 @@ static int kvmppc_book3s_init(void)
        r = kvm_init(NULL, sizeof(struct kvm_vcpu), 0, THIS_MODULE);
        if (r)
                return r;
-#ifdef CONFIG_KVM_BOOK3S_32
+#ifdef CONFIG_KVM_BOOK3S_32_HANDLER
        r = kvmppc_book3s_init_pr();
 #endif
        return r;
@@ -895,7 +895,7 @@ static int kvmppc_book3s_init(void)
 static void kvmppc_book3s_exit(void)
 {
-#ifdef CONFIG_KVM_BOOK3S_32
+#ifdef CONFIG_KVM_BOOK3S_32_HANDLER
        kvmppc_book3s_exit_pr();
 #endif
        kvm_exit();
@@ -905,7 +905,7 @@ module_init(kvmppc_book3s_init);
 module_exit(kvmppc_book3s_exit);
 /* On 32bit this is our one and only kernel module */
-#ifdef CONFIG_KVM_BOOK3S_32
+#ifdef CONFIG_KVM_BOOK3S_32_HANDLER
 MODULE_ALIAS_MISCDEV(KVM_MINOR);
 MODULE_ALIAS("devname:kvm");
 #endif
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 1d6c56ad5b60..8fcc36306a02 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -234,7 +234,7 @@ long kvmppc_do_h_enter(struct kvm *kvm, unsigned long flags,
                pte_size = psize;
                pte = lookup_linux_pte_and_update(pgdir, hva, writing,
                                                  &pte_size);
-                if (pte_present(pte)) {
+                if (pte_present(pte) && !pte_numa(pte)) {
                        if (writing && !pte_write(pte))
                                /* make the actual HPTE be read-only */
                                ptel = hpte_make_readonly(ptel);
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index b031f932c0cc..07c8b5b0f9d2 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1323,6 +1323,110 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
        mr      r3, r9
        bl      kvmppc_save_fp
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+BEGIN_FTR_SECTION
+        b       2f
+END_FTR_SECTION_IFCLR(CPU_FTR_TM)
+        /* Turn on TM. */
+        mfmsr   r8
+        li      r0, 1
+        rldimi  r8, r0, MSR_TM_LG, 63-MSR_TM_LG
+        mtmsrd  r8
+        ld      r5, VCPU_MSR(r9)
+        rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
+        beq     1f      /* TM not active in guest. */
+        li      r3, TM_CAUSE_KVM_RESCHED
+        /* Clear the MSR RI since r1, r13 are all going to be foobar. */
+        li      r5, 0
+        mtmsrd  r5, 1
+        /* All GPRs are volatile at this point. */
+        TRECLAIM(R3)
+        /* Temporarily store r13 and r9 so we have some regs to play with */
+        SET_SCRATCH0(r13)
+        GET_PACA(r13)
+        std     r9, PACATMSCRATCH(r13)
+        ld      r9, HSTATE_KVM_VCPU(r13)
+        /* Get a few more GPRs free. */
+        std     r29, VCPU_GPRS_TM(29)(r9)
+        std     r30, VCPU_GPRS_TM(30)(r9)
+        std     r31, VCPU_GPRS_TM(31)(r9)
+        /* Save away PPR and DSCR soon so don't run with user values. */
+        mfspr   r31, SPRN_PPR
+        HMT_MEDIUM
+        mfspr   r30, SPRN_DSCR
+        ld      r29, HSTATE_DSCR(r13)
+        mtspr   SPRN_DSCR, r29
+        /* Save all but r9, r13 & r29-r31 */
+        reg = 0
+        .rept   29
+        .if (reg != 9) && (reg != 13)
+        std     reg, VCPU_GPRS_TM(reg)(r9)
+        .endif
+        reg = reg + 1
+        .endr
+        /* ... now save r13 */
+        GET_SCRATCH0(r4)
+        std     r4, VCPU_GPRS_TM(13)(r9)
+        /* ... and save r9 */
+        ld      r4, PACATMSCRATCH(r13)
+        std     r4, VCPU_GPRS_TM(9)(r9)
+        /* Reload stack pointer and TOC. */
+        ld      r1, HSTATE_HOST_R1(r13)
+        ld      r2, PACATOC(r13)
+        /* Set MSR RI now we have r1 and r13 back. */
+        li      r5, MSR_RI
+        mtmsrd  r5, 1
+        /* Save away checkpinted SPRs. */
+        std     r31, VCPU_PPR_TM(r9)
+        std     r30, VCPU_DSCR_TM(r9)
+        mflr    r5
+        mfcr    r6
+        mfctr   r7
+        mfspr   r8, SPRN_AMR
+        mfspr   r10, SPRN_TAR
+        std     r5, VCPU_LR_TM(r9)
+        stw     r6, VCPU_CR_TM(r9)
+        std     r7, VCPU_CTR_TM(r9)
+        std     r8, VCPU_AMR_TM(r9)
+        std     r10, VCPU_TAR_TM(r9)
+        /* Restore r12 as trap number. */
+        lwz     r12, VCPU_TRAP(r9)
+        /* Save FP/VSX. */
+        addi    r3, r9, VCPU_FPRS_TM
+        bl      .store_fp_state
+        addi    r3, r9, VCPU_VRS_TM
+        bl      .store_vr_state
+        mfspr   r6, SPRN_VRSAVE
+        stw     r6, VCPU_VRSAVE_TM(r9)
+1:
+        /*
+         * We need to save these SPRs after the treclaim so that the software
+         * error code is recorded correctly in the TEXASR.  Also the user may
+         * change these outside of a transaction, so they must always be
+         * context switched.
+         */
+        mfspr   r5, SPRN_TFHAR
+        mfspr   r6, SPRN_TFIAR
+        mfspr   r7, SPRN_TEXASR
+        std     r5, VCPU_TFHAR(r9)
+        std     r6, VCPU_TFIAR(r9)
+        std     r7, VCPU_TEXASR(r9)
+2:
+#endif
        /* Increment yield count if they have a VPA */
        ld      r8, VCPU_VPA(r9)        /* do they have a VPA? */
        cmpdi   r8, 0
diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
index c5c052a9729c..02f1defd8bb9 100644
--- a/arch/powerpc/kvm/book3s_pr.c
+++ b/arch/powerpc/kvm/book3s_pr.c
@@ -1153,7 +1153,7 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_pr(struct kvm *kvm,
                goto free_vcpu;
        vcpu->arch.book3s = vcpu_book3s;
-#ifdef CONFIG_KVM_BOOK3S_32
+#ifdef CONFIG_KVM_BOOK3S_32_HANDLER
        vcpu->arch.shadow_vcpu =
                kzalloc(sizeof(*vcpu->arch.shadow_vcpu), GFP_KERNEL);
        if (!vcpu->arch.shadow_vcpu)
@@ -1198,7 +1198,7 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_pr(struct kvm *kvm,
 uninit_vcpu:
        kvm_vcpu_uninit(vcpu);
 free_shadow_vcpu:
-#ifdef CONFIG_KVM_BOOK3S_32
+#ifdef CONFIG_KVM_BOOK3S_32_HANDLER
        kfree(vcpu->arch.shadow_vcpu);
 free_vcpu3s:
 #endif
@@ -1215,7 +1215,7 @@ static void kvmppc_core_vcpu_free_pr(struct kvm_vcpu *vcpu)
        free_page((unsigned long)vcpu->arch.shared & PAGE_MASK);
        kvm_vcpu_uninit(vcpu);
-#ifdef CONFIG_KVM_BOOK3S_32
+#ifdef CONFIG_KVM_BOOK3S_32_HANDLER
        kfree(vcpu->arch.shadow_vcpu);
 #endif
        vfree(vcpu_book3s);
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index d766d6ee33fe..06ba83b036d3 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -207,6 +207,10 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend,
                if (overlaps_kernel_text(vaddr, vaddr + step))
                        tprot &= ~HPTE_R_N;
+                /* Make kvm guest trampolines executable */
+                if (overlaps_kvm_tmp(vaddr, vaddr + step))
+                        tprot &= ~HPTE_R_N;
                /*
                 * If relocatable, check if it overlaps interrupt vectors that
                 * are copied down to real 0. For relocatable kernel
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index b3ecb8f5b6ce..9ae6664ff08c 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -158,6 +158,7 @@ int kvm_dev_ioctl_check_extension(long ext)
        case KVM_CAP_ONE_REG:
        case KVM_CAP_ENABLE_CAP:
        case KVM_CAP_S390_CSS_SUPPORT:
+        case KVM_CAP_IRQFD:
        case KVM_CAP_IOEVENTFD:
        case KVM_CAP_DEVICE_CTRL:
        case KVM_CAP_ENABLE_CAP_VM:
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 8de6d9cf3b95..678205195ae1 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -1,7 +1,7 @@
 #ifndef _ASM_X86_PAGE_64_DEFS_H
 #define _ASM_X86_PAGE_64_DEFS_H
-#define THREAD_SIZE_ORDER       1
+#define THREAD_SIZE_ORDER       2
 #define THREAD_SIZE  (PAGE_SIZE << THREAD_SIZE_ORDER)
 #define CURRENT_MASK (~(THREAD_SIZE - 1))
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 33e8c028842f..138ceffc6377 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -7778,7 +7778,8 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
        exec_control = vmcs12->pin_based_vm_exec_control;
        exec_control |= vmcs_config.pin_based_exec_ctrl;
-        exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+        exec_control &= ~(PIN_BASED_VMX_PREEMPTION_TIMER |
+                          PIN_BASED_POSTED_INTR);
        vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, exec_control);
        vmx->nested.preemption_timer_expired = false;
@@ -7815,7 +7816,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                if (!vmx->rdtscp_enabled)
                        exec_control &= ~SECONDARY_EXEC_RDTSCP;
                /* Take the following fields only from vmcs12 */
-                exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+                exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+                                  SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
+                                  SECONDARY_EXEC_APIC_REGISTER_VIRT);
                if (nested_cpu_has(vmcs12,
                                CPU_BASED_ACTIVATE_SECONDARY_CONTROLS))
                        exec_control |= vmcs12->secondary_vm_exec_control;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index b6c0bacca9bd..20316c67b824 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -106,6 +106,8 @@ EXPORT_SYMBOL_GPL(kvm_max_guest_tsc_khz);
 static u32 tsc_tolerance_ppm = 250;
 module_param(tsc_tolerance_ppm, uint, S_IRUGO | S_IWUSR);
+static bool backwards_tsc_observed = false;
 #define KVM_NR_SHARED_MSRS 16
 struct kvm_shared_msrs_global {
@@ -1486,7 +1488,8 @@ static void pvclock_update_vm_gtod_copy(struct kvm *kvm)
                                        &ka->master_kernel_ns,
                                        &ka->master_cycle_now);
-        ka->use_master_clock = host_tsc_clocksource & vcpus_matched;
+        ka->use_master_clock = host_tsc_clocksource && vcpus_matched
+                                && !backwards_tsc_observed;
        if (ka->use_master_clock)
                atomic_set(&kvm_guest_has_master_clock, 1);
@@ -6945,6 +6948,7 @@ int kvm_arch_hardware_enable(void *garbage)
         */
        if (backwards_tsc) {
                u64 delta_cyc = max_tsc - local_tsc;
+                backwards_tsc_observed = true;
                list_for_each_entry(kvm, &vm_list, vm_list) {
                        kvm_for_each_vcpu(i, vcpu, kvm) {
                                vcpu->arch.tsc_offset_adjustment += delta_cyc;
diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
index e1f220e3ca68..310c5f0dbef1 100644
--- a/arch/x86/vdso/vdso32-setup.c
+++ b/arch/x86/vdso/vdso32-setup.c
@@ -155,6 +155,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
        unsigned long addr;
        int ret = 0;
        struct vm_area_struct *vma;
+        static struct page *no_pages[] = {NULL};
 #ifdef CONFIG_X86_X32_ABI
        if (test_thread_flag(TIF_X32))
@@ -193,7 +194,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
                        addr -  VDSO_OFFSET(VDSO_PREV_PAGES),
                        VDSO_OFFSET(VDSO_PREV_PAGES),
                        VM_READ,
-                        NULL);
+                        no_pages);
        if (IS_ERR(vma)) {
                ret = PTR_ERR(vma);
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index c1e31a41f949..25bbc55dca89 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -1278,8 +1278,8 @@ static int __init acpi_thermal_init(void)
 static void __exit acpi_thermal_exit(void)
 {
-        destroy_workqueue(acpi_thermal_pm_queue);
        acpi_bus_unregister_driver(&acpi_thermal_driver);
+        destroy_workqueue(acpi_thermal_pm_queue);
        return;
 }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index ea83828bfea9..18d97d5c7d90 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4224,10 +4224,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
        /* devices that don't properly handle queued TRIM commands */
-        { "Micron_M500*",               "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD*",      "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Micron_M550*",               NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M550*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M550SSD*",      NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M550SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
        /*
         * Some WD SATA-I drives spin up and down erratically when the link
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 6d8a87f252de..cb9b1f8326c3 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -144,11 +144,11 @@ static void virtblk_done(struct virtqueue *vq)
                if (unlikely(virtqueue_is_broken(vq)))
                        break;
        } while (!virtqueue_enable_cb(vq));
-        spin_unlock_irqrestore(&vblk->vq_lock, flags);
        /* In case queue is stopped waiting for more buffers. */
        if (req_done)
                blk_mq_start_stopped_hw_queues(vblk->disk->queue);
+        spin_unlock_irqrestore(&vblk->vq_lock, flags);
 }
 static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req)
@@ -202,8 +202,8 @@ static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req)
        err = __virtblk_add_req(vblk->vq, vbr, vbr->sg, num);
        if (err) {
                virtqueue_kick(vblk->vq);
-                spin_unlock_irqrestore(&vblk->vq_lock, flags);
                blk_mq_stop_hw_queue(hctx);
+                spin_unlock_irqrestore(&vblk->vq_lock, flags);
                /* Out of mem doesn't actually happen, since we fall back
                 * to direct descriptors */
                if (err == -ENOMEM || err == -ENOSPC)
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index 4637697c139f..3fbee4540228 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -147,7 +147,7 @@ static bool _is_valid_div(struct clk_divider *divider, unsigned int div)
 static int _round_up_table(const struct clk_div_table *table, int div)
 {
        const struct clk_div_table *clkt;
-        int up = _get_table_maxdiv(table);
+        int up = INT_MAX;
        for (clkt = table; clkt->div; clkt++) {
                if (clkt->div == div)
diff --git a/drivers/clk/st/clkgen-pll.c b/drivers/clk/st/clkgen-pll.c
index bca0a0badbfa..a886702f7c8b 100644
--- a/drivers/clk/st/clkgen-pll.c
+++ b/drivers/clk/st/clkgen-pll.c
@@ -521,8 +521,10 @@ static struct clk * __init clkgen_odf_register(const char *parent_name,
        gate->lock = odf_lock;
        div = kzalloc(sizeof(*div), GFP_KERNEL);
-        if (!div)
+        if (!div) {
+                kfree(gate);
                return ERR_PTR(-ENOMEM);
+        }
        div->flags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO;
        div->reg = reg + pll_data->odf[odf].offset;
diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index e1769addf435..6aad8abc69a2 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -58,9 +58,9 @@
 #define PLLDU_LFCON_SET_DIVN 600
 #define PLLE_BASE_DIVCML_SHIFT 24
-#define PLLE_BASE_DIVCML_WIDTH 4
+#define PLLE_BASE_DIVCML_MASK 0xf
 #define PLLE_BASE_DIVP_SHIFT 16
-#define PLLE_BASE_DIVP_WIDTH 7
+#define PLLE_BASE_DIVP_WIDTH 6
 #define PLLE_BASE_DIVN_SHIFT 8
 #define PLLE_BASE_DIVN_WIDTH 8
 #define PLLE_BASE_DIVM_SHIFT 0
@@ -183,6 +183,14 @@
 #define divp_mask(p) (p->params->flags & TEGRA_PLLU ? PLLU_POST_DIVP_MASK :\
                      mask(p->params->div_nmp->divp_width))
+#define divm_shift(p) (p)->params->div_nmp->divm_shift
+#define divn_shift(p) (p)->params->div_nmp->divn_shift
+#define divp_shift(p) (p)->params->div_nmp->divp_shift
+#define divm_mask_shifted(p) (divm_mask(p) << divm_shift(p))
+#define divn_mask_shifted(p) (divn_mask(p) << divn_shift(p))
+#define divp_mask_shifted(p) (divp_mask(p) << divp_shift(p))
 #define divm_max(p) (divm_mask(p))
 #define divn_max(p) (divn_mask(p))
 #define divp_max(p) (1 << (divp_mask(p)))
@@ -476,13 +484,12 @@ static void _update_pll_mnp(struct tegra_clk_pll *pll,
        } else {
                val = pll_readl_base(pll);
-                val &= ~((divm_mask(pll) << div_nmp->divm_shift) |
+                val &= ~(divm_mask_shifted(pll) | divn_mask_shifted(pll) |
-                 (divn_mask(pll) << div_nmp->divn_shift) |
+                         divp_mask_shifted(pll));
-                 (divp_mask(pll) << div_nmp->divp_shift));
-                val |= ((cfg->m << div_nmp->divm_shift) |
+                val |= (cfg->m << divm_shift(pll)) |
-                        (cfg->n << div_nmp->divn_shift) |
+                       (cfg->n << divn_shift(pll)) |
-                        (cfg->p << div_nmp->divp_shift));
+                       (cfg->p << divp_shift(pll));
                pll_writel_base(val, pll);
        }
@@ -730,11 +737,12 @@ static int clk_plle_enable(struct clk_hw *hw)
        if (pll->params->flags & TEGRA_PLLE_CONFIGURE) {
                /* configure dividers */
                val = pll_readl_base(pll);
-                val &= ~(divm_mask(pll) | divn_mask(pll) | divp_mask(pll));
+                val &= ~(divp_mask_shifted(pll) | divn_mask_shifted(pll) |
-                val &= ~(PLLE_BASE_DIVCML_WIDTH << PLLE_BASE_DIVCML_SHIFT);
+                         divm_mask_shifted(pll));
-                val |= sel.m << pll->params->div_nmp->divm_shift;
+                val &= ~(PLLE_BASE_DIVCML_MASK << PLLE_BASE_DIVCML_SHIFT);
-                val |= sel.n << pll->params->div_nmp->divn_shift;
+                val |= sel.m << divm_shift(pll);
-                val |= sel.p << pll->params->div_nmp->divp_shift;
+                val |= sel.n << divn_shift(pll);
+                val |= sel.p << divp_shift(pll);
                val |= sel.cpcon << PLLE_BASE_DIVCML_SHIFT;
                pll_writel_base(val, pll);
        }
@@ -745,10 +753,11 @@ static int clk_plle_enable(struct clk_hw *hw)
        pll_writel_misc(val, pll);
        val = readl(pll->clk_base + PLLE_SS_CTRL);
+        val &= ~PLLE_SS_COEFFICIENTS_MASK;
        val |= PLLE_SS_DISABLE;
        writel(val, pll->clk_base + PLLE_SS_CTRL);
-        val |= pll_readl_base(pll);
+        val = pll_readl_base(pll);
        val |= (PLL_BASE_BYPASS | PLL_BASE_ENABLE);
        pll_writel_base(val, pll);
@@ -1292,10 +1301,11 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
        pll_writel(val, PLLE_SS_CTRL, pll);
        val = pll_readl_base(pll);
-        val &= ~(divm_mask(pll) | divn_mask(pll) | divp_mask(pll));
+        val &= ~(divp_mask_shifted(pll) | divn_mask_shifted(pll) |
-        val &= ~(PLLE_BASE_DIVCML_WIDTH << PLLE_BASE_DIVCML_SHIFT);
+                 divm_mask_shifted(pll));
-        val |= sel.m << pll->params->div_nmp->divm_shift;
+        val &= ~(PLLE_BASE_DIVCML_MASK << PLLE_BASE_DIVCML_SHIFT);
-        val |= sel.n << pll->params->div_nmp->divn_shift;
+        val |= sel.m << divm_shift(pll);
+        val |= sel.n << divn_shift(pll);
        val |= sel.cpcon << PLLE_BASE_DIVCML_SHIFT;
        pll_writel_base(val, pll);
        udelay(1);
@@ -1410,6 +1420,15 @@ struct clk *tegra_clk_register_pll(const char *name, const char *parent_name,
        return clk;
 }
+static struct div_nmp pll_e_nmp = {
+        .divn_shift = PLLE_BASE_DIVN_SHIFT,
+        .divn_width = PLLE_BASE_DIVN_WIDTH,
+        .divm_shift = PLLE_BASE_DIVM_SHIFT,
+        .divm_width = PLLE_BASE_DIVM_WIDTH,
+        .divp_shift = PLLE_BASE_DIVP_SHIFT,
+        .divp_width = PLLE_BASE_DIVP_WIDTH,
+};
 struct clk *tegra_clk_register_plle(const char *name, const char *parent_name,
                void __iomem *clk_base, void __iomem *pmc,
                unsigned long flags, struct tegra_clk_pll_params *pll_params,
@@ -1420,6 +1439,10 @@ struct clk *tegra_clk_register_plle(const char *name, const char *parent_name,
        pll_params->flags |= TEGRA_PLL_LOCK_MISC | TEGRA_PLL_BYPASS;
        pll_params->flags |= TEGRA_PLL_HAS_LOCK_ENABLE;
+        if (!pll_params->div_nmp)
+                pll_params->div_nmp = &pll_e_nmp;
        pll = _tegra_init_pll(clk_base, pmc, pll_params, lock);
        if (IS_ERR(pll))
                return ERR_CAST(pll);
@@ -1557,9 +1580,8 @@ struct clk *tegra_clk_register_pllre(const char *name, const char *parent_name,
                int m;
                m = _pll_fixed_mdiv(pll_params, parent_rate);
-                val = m << PLL_BASE_DIVM_SHIFT;
+                val = m << divm_shift(pll);
-                val |= (pll_params->vco_min / parent_rate)
+                val |= (pll_params->vco_min / parent_rate) << divn_shift(pll);
-                                << PLL_BASE_DIVN_SHIFT;
                pll_writel_base(val, pll);
        }
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 00fdd1170284..a8d7ea14f183 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -100,7 +100,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
                        || tcd->clkevt.mode == CLOCK_EVT_MODE_ONESHOT) {
                __raw_writel(0xff, regs + ATMEL_TC_REG(2, IDR));
                __raw_writel(ATMEL_TC_CLKDIS, regs + ATMEL_TC_REG(2, CCR));
-                clk_disable_unprepare(tcd->clk);
+                clk_disable(tcd->clk);
        }
        switch (m) {
@@ -109,7 +109,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
         * of oneshot, we get lower overhead and improved accuracy.
         */
        case CLOCK_EVT_MODE_PERIODIC:
-                clk_prepare_enable(tcd->clk);
+                clk_enable(tcd->clk);
                /* slow clock, count up to RC, then irq and restart */
                __raw_writel(timer_clock
@@ -126,7 +126,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
                break;
        case CLOCK_EVT_MODE_ONESHOT:
-                clk_prepare_enable(tcd->clk);
+                clk_enable(tcd->clk);
                /* slow clock, count up to RC, then irq and stop */
                __raw_writel(timer_clock | ATMEL_TC_CPCSTOP
@@ -194,7 +194,7 @@ static int __init setup_clkevents(struct atmel_tc *tc, int clk32k_divisor_idx)
        ret = clk_prepare_enable(t2_clk);
        if (ret)
                return ret;
-        clk_disable_unprepare(t2_clk);
+        clk_disable(t2_clk);
        clkevt.regs = tc->regs;
        clkevt.clk = t2_clk;
diff --git a/drivers/clocksource/timer-marco.c b/drivers/clocksource/timer-marco.c
index b52e1c078b99..7f5374dbefd9 100644
--- a/drivers/clocksource/timer-marco.c
+++ b/drivers/clocksource/timer-marco.c
@@ -199,7 +199,7 @@ static int sirfsoc_local_timer_setup(struct clock_event_device *ce)
        action->dev_id = ce;
        BUG_ON(setup_irq(ce->irq, action));
-        irq_set_affinity(action->irq, cpumask_of(cpu));
+        irq_force_affinity(action->irq, cpumask_of(cpu));
        clockevents_register_device(ce);
        return 0;
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 1bf6bbac3e03..09b9129c7bd3 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -130,7 +130,7 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                return -ENOENT;
        }
-        cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu0");
+        cpu_reg = regulator_get_optional(cpu_dev, "cpu0");
        if (IS_ERR(cpu_reg)) {
                /*
                 * If cpu0 regulator supply node is present, but regulator is
@@ -145,23 +145,23 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                        PTR_ERR(cpu_reg));
        }
-        cpu_clk = devm_clk_get(cpu_dev, NULL);
+        cpu_clk = clk_get(cpu_dev, NULL);
        if (IS_ERR(cpu_clk)) {
                ret = PTR_ERR(cpu_clk);
                pr_err("failed to get cpu0 clock: %d\n", ret);
-                goto out_put_node;
+                goto out_put_reg;
        }
        ret = of_init_opp_table(cpu_dev);
        if (ret) {
                pr_err("failed to init OPP table: %d\n", ret);
-                goto out_put_node;
+                goto out_put_clk;
        }
        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
        if (ret) {
                pr_err("failed to init cpufreq table: %d\n", ret);
-                goto out_put_node;
+                goto out_put_clk;
        }
        of_property_read_u32(np, "voltage-tolerance", &voltage_tolerance);
@@ -216,6 +216,12 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
 out_free_table:
        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+out_put_clk:
+        if (!IS_ERR(cpu_clk))
+                clk_put(cpu_clk);
+out_put_reg:
+        if (!IS_ERR(cpu_reg))
+                regulator_put(cpu_reg);
 out_put_node:
        of_node_put(np);
        return ret;
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index ba43991ba98a..e1c6433b16e0 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -366,6 +366,11 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                break;
        case CPUFREQ_GOV_LIMITS:
+                mutex_lock(&dbs_data->mutex);
+                if (!cpu_cdbs->cur_policy) {
+                        mutex_unlock(&dbs_data->mutex);
+                        break;
+                }
                mutex_lock(&cpu_cdbs->timer_mutex);
                if (policy->max < cpu_cdbs->cur_policy->cur)
                        __cpufreq_driver_target(cpu_cdbs->cur_policy,
@@ -375,6 +380,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                        policy->min, CPUFREQ_RELATION_L);
                dbs_check_cpu(dbs_data, cpu);
                mutex_unlock(&cpu_cdbs->timer_mutex);
+                mutex_unlock(&dbs_data->mutex);
                break;
        }
        return 0;
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index a886713937fd..d5d30ed863ce 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1009,6 +1009,7 @@ static void dmaengine_unmap(struct kref *kref)
                dma_unmap_page(dev, unmap->addr[i], unmap->len,
                               DMA_BIDIRECTIONAL);
        }
+        cnt = unmap->map_cnt;
        mempool_free(unmap, __get_unmap_pool(cnt)->pool);
 }
@@ -1074,6 +1075,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
        memset(unmap, 0, sizeof(*unmap));
        kref_init(&unmap->kref);
        unmap->dev = dev;
+        unmap->map_cnt = nr;
        return unmap;
 }
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index cfdbb92aae1d..7a740769c2fa 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1548,11 +1548,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
        /* Disable BLOCK interrupts as well */
        channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
-        err = devm_request_irq(chip->dev, chip->irq, dw_dma_interrupt,
-                               IRQF_SHARED, "dw_dmac", dw);
-        if (err)
-                return err;
        /* Create a pool of consistent memory blocks for hardware descriptors */
        dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
                                         sizeof(struct dw_desc), 4, 0);
@@ -1563,6 +1558,11 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
        tasklet_init(&dw->tasklet, dw_dma_tasklet, (unsigned long)dw);
+        err = request_irq(chip->irq, dw_dma_interrupt, IRQF_SHARED,
+                          "dw_dmac", dw);
+        if (err)
+                return err;
        INIT_LIST_HEAD(&dw->dma.channels);
        for (i = 0; i < nr_channels; i++) {
                struct dw_dma_chan      *dwc = &dw->chan[i];
@@ -1667,6 +1667,7 @@ int dw_dma_remove(struct dw_dma_chip *chip)
        dw_dma_off(dw);
        dma_async_device_unregister(&dw->dma);
+        free_irq(chip->irq, dw);
        tasklet_kill(&dw->tasklet);
        list_for_each_entry_safe(dwc, _dwc, &dw->dma.channels,
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 766b68ed505c..394cbc5c93e3 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -191,12 +191,10 @@ static void mv_set_mode(struct mv_xor_chan *chan,
 static void mv_chan_activate(struct mv_xor_chan *chan)
 {
-        u32 activation;
        dev_dbg(mv_chan_to_devp(chan), " activate chan.\n");
-        activation = readl_relaxed(XOR_ACTIVATION(chan));
-        activation |= 0x1;
+        /* writel ensures all descriptors are flushed before activation */
-        writel_relaxed(activation, XOR_ACTIVATION(chan));
+        writel(BIT(0), XOR_ACTIVATION(chan));
 }
 static char mv_chan_is_busy(struct mv_xor_chan *chan)
diff --git a/drivers/dma/sa11x0-dma.c b/drivers/dma/sa11x0-dma.c
index ab26d46bbe15..5ebdfbc1051e 100644
--- a/drivers/dma/sa11x0-dma.c
+++ b/drivers/dma/sa11x0-dma.c
@@ -113,11 +113,9 @@ struct sa11x0_dma_phy {
        struct sa11x0_dma_desc  *txd_load;
        unsigned                sg_done;
        struct sa11x0_dma_desc  *txd_done;
-#ifdef CONFIG_PM_SLEEP
        u32                     dbs[2];
        u32                     dbt[2];
        u32                     dcsr;
-#endif
 };
 struct sa11x0_dma_dev {
@@ -984,7 +982,6 @@ static int sa11x0_dma_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
 static int sa11x0_dma_suspend(struct device *dev)
 {
        struct sa11x0_dma_dev *d = dev_get_drvdata(dev);
@@ -1054,7 +1051,6 @@ static int sa11x0_dma_resume(struct device *dev)
        return 0;
 }
-#endif
 static const struct dev_pm_ops sa11x0_dma_pm_ops = {
        .suspend_noirq = sa11x0_dma_suspend,
diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
index c98764aeeec6..f477308b6e9c 100644
--- a/drivers/firewire/core.h
+++ b/drivers/firewire/core.h
@@ -237,8 +237,8 @@ static inline bool is_next_generation(int new_generation, int old_generation)
 #define LOCAL_BUS 0xffc0
-/* arbitrarily chosen maximum range for physical DMA: 128 TB */
+/* OHCI-1394's default upper bound for physical DMA: 4 GB */
-#define FW_MAX_PHYSICAL_RANGE           (128ULL << 40)
+#define FW_MAX_PHYSICAL_RANGE           (1ULL << 32)
 void fw_core_handle_request(struct fw_card *card, struct fw_packet *request);
 void fw_core_handle_response(struct fw_card *card, struct fw_packet *packet);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 8db663219560..586f2f7f6993 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -3716,7 +3716,7 @@ static int pci_probe(struct pci_dev *dev,
                    version >> 16, version & 0xff, ohci->card.index,
                    ohci->n_ir, ohci->n_it, ohci->quirks,
                    reg_read(ohci, OHCI1394_PhyUpperBound) ?
-                        ", >4 GB phys DMA" : "");
+                        ", physUB" : "");
        return 0;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 96177eec0a0e..eedb023af27d 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1833,7 +1833,6 @@ int i915_driver_unload(struct drm_device *dev)
                flush_workqueue(dev_priv->wq);
                mutex_lock(&dev->struct_mutex);
-                i915_gem_free_all_phys_object(dev);
                i915_gem_cleanup_ringbuffer(dev);
                i915_gem_context_fini(dev);
                WARN_ON(dev_priv->mm.aliasing_ppgtt);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 108e1ec2fa4b..388c028e223c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -242,18 +242,6 @@ struct intel_ddi_plls {
 #define WATCH_LISTS     0
 #define WATCH_GTT       0
-#define I915_GEM_PHYS_CURSOR_0 1
-#define I915_GEM_PHYS_CURSOR_1 2
-#define I915_GEM_PHYS_OVERLAY_REGS 3
-#define I915_MAX_PHYS_OBJECT (I915_GEM_PHYS_OVERLAY_REGS)
-struct drm_i915_gem_phys_object {
-        int id;
-        struct page **page_list;
-        drm_dma_handle_t *handle;
-        struct drm_i915_gem_object *cur_obj;
-};
 struct opregion_header;
 struct opregion_acpi;
 struct opregion_swsci;
@@ -1187,9 +1175,6 @@ struct i915_gem_mm {
        /** Bit 6 swizzling required for Y tiling */
        uint32_t bit_6_swizzle_y;
-        /* storage for physical objects */
-        struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];
        /* accounting, useful for userland debugging */
        spinlock_t object_stat_lock;
        size_t object_memory;
@@ -1769,7 +1754,7 @@ struct drm_i915_gem_object {
        struct drm_file *pin_filp;
        /** for phy allocated objects */
-        struct drm_i915_gem_phys_object *phys_obj;
+        drm_dma_handle_t *phys_handle;
 };
 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
@@ -2204,10 +2189,12 @@ void i915_gem_vma_destroy(struct i915_vma *vma);
 #define PIN_MAPPABLE 0x1
 #define PIN_NONBLOCK 0x2
 #define PIN_GLOBAL 0x4
+#define PIN_OFFSET_BIAS 0x8
+#define PIN_OFFSET_MASK (~4095)
 int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,
                                     struct i915_address_space *vm,
                                     uint32_t alignment,
-                                     unsigned flags);
+                                     uint64_t flags);
 int __must_check i915_vma_unbind(struct i915_vma *vma);
 int i915_gem_object_put_pages(struct drm_i915_gem_object *obj);
 void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv);
@@ -2334,13 +2321,8 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
                                     u32 alignment,
                                     struct intel_ring_buffer *pipelined);
 void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj);
-int i915_gem_attach_phys_object(struct drm_device *dev,
+int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
-                                struct drm_i915_gem_object *obj,
-                                int id,
                                int align);
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj);
-void i915_gem_free_all_phys_object(struct drm_device *dev);
 int i915_gem_open(struct drm_device *dev, struct drm_file *file);
 void i915_gem_release(struct drm_device *dev, struct drm_file *file);
@@ -2465,6 +2447,8 @@ int __must_check i915_gem_evict_something(struct drm_device *dev,
                                          int min_size,
                                          unsigned alignment,
                                          unsigned cache_level,
+                                          unsigned long start,
+                                          unsigned long end,
                                          unsigned flags);
 int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);
 int i915_gem_evict_everything(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 2871ce75f438..3326770c9ed2 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -43,10 +43,6 @@ static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *o
 static __must_check int
 i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
                               bool readonly);
-static int i915_gem_phys_pwrite(struct drm_device *dev,
-                                struct drm_i915_gem_object *obj,
-                                struct drm_i915_gem_pwrite *args,
-                                struct drm_file *file);
 static void i915_gem_write_fence(struct drm_device *dev, int reg,
                                 struct drm_i915_gem_object *obj);
@@ -209,6 +205,128 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
        return 0;
 }
+static void i915_gem_object_detach_phys(struct drm_i915_gem_object *obj)
+{
+        drm_dma_handle_t *phys = obj->phys_handle;
+        if (!phys)
+                return;
+        if (obj->madv == I915_MADV_WILLNEED) {
+                struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
+                char *vaddr = phys->vaddr;
+                int i;
+                for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                        struct page *page = shmem_read_mapping_page(mapping, i);
+                        if (!IS_ERR(page)) {
+                                char *dst = kmap_atomic(page);
+                                memcpy(dst, vaddr, PAGE_SIZE);
+                                drm_clflush_virt_range(dst, PAGE_SIZE);
+                                kunmap_atomic(dst);
+                                set_page_dirty(page);
+                                mark_page_accessed(page);
+                                page_cache_release(page);
+                        }
+                        vaddr += PAGE_SIZE;
+                }
+                i915_gem_chipset_flush(obj->base.dev);
+        }
+#ifdef CONFIG_X86
+        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+        drm_pci_free(obj->base.dev, phys);
+        obj->phys_handle = NULL;
+}
+int
+i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
+                            int align)
+{
+        drm_dma_handle_t *phys;
+        struct address_space *mapping;
+        char *vaddr;
+        int i;
+        if (obj->phys_handle) {
+                if ((unsigned long)obj->phys_handle->vaddr & (align -1))
+                        return -EBUSY;
+                return 0;
+        }
+        if (obj->madv != I915_MADV_WILLNEED)
+                return -EFAULT;
+        if (obj->base.filp == NULL)
+                return -EINVAL;
+        /* create a new object */
+        phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);
+        if (!phys)
+                return -ENOMEM;
+        vaddr = phys->vaddr;
+#ifdef CONFIG_X86
+        set_memory_wc((unsigned long)vaddr, phys->size / PAGE_SIZE);
+#endif
+        mapping = file_inode(obj->base.filp)->i_mapping;
+        for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                struct page *page;
+                char *src;
+                page = shmem_read_mapping_page(mapping, i);
+                if (IS_ERR(page)) {
+#ifdef CONFIG_X86
+                        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+                        drm_pci_free(obj->base.dev, phys);
+                        return PTR_ERR(page);
+                }
+                src = kmap_atomic(page);
+                memcpy(vaddr, src, PAGE_SIZE);
+                kunmap_atomic(src);
+                mark_page_accessed(page);
+                page_cache_release(page);
+                vaddr += PAGE_SIZE;
+        }
+        obj->phys_handle = phys;
+        return 0;
+}
+static int
+i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
+                     struct drm_i915_gem_pwrite *args,
+                     struct drm_file *file_priv)
+{
+        struct drm_device *dev = obj->base.dev;
+        void *vaddr = obj->phys_handle->vaddr + args->offset;
+        char __user *user_data = to_user_ptr(args->data_ptr);
+        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
+                unsigned long unwritten;
+                /* The physical object once assigned is fixed for the lifetime
+                 * of the obj, so we can safely drop the lock and continue
+                 * to access vaddr.
+                 */
+                mutex_unlock(&dev->struct_mutex);
+                unwritten = copy_from_user(vaddr, user_data, args->size);
+                mutex_lock(&dev->struct_mutex);
+                if (unwritten)
+                        return -EFAULT;
+        }
+        i915_gem_chipset_flush(dev);
+        return 0;
+}
 void *i915_gem_object_alloc(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -921,8 +1039,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
         * pread/pwrite currently are reading and writing from the CPU
         * perspective, requiring manual detiling by the client.
         */
-        if (obj->phys_obj) {
+        if (obj->phys_handle) {
-                ret = i915_gem_phys_pwrite(dev, obj, args, file);
+                ret = i915_gem_phys_pwrite(obj, args, file);
                goto out;
        }
@@ -3208,12 +3326,14 @@ static struct i915_vma *
 i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
                           struct i915_address_space *vm,
                           unsigned alignment,
-                           unsigned flags)
+                           uint64_t flags)
 {
        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 size, fence_size, fence_alignment, unfenced_alignment;
-        size_t gtt_max =
+        unsigned long start =
+                flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
+        unsigned long end =
                flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
        struct i915_vma *vma;
        int ret;
@@ -3242,11 +3362,11 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
        /* If the object is bigger than the entire aperture, reject it early
         * before evicting everything in a vain attempt to find space.
         */
-        if (obj->base.size > gtt_max) {
+        if (obj->base.size > end) {
-                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%zu\n",
+                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",
                          obj->base.size,
                          flags & PIN_MAPPABLE ? "mappable" : "total",
-                          gtt_max);
+                          end);
                return ERR_PTR(-E2BIG);
        }
@@ -3263,12 +3383,15 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
 search_free:
        ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,
                                                  size, alignment,
-                                                  obj->cache_level, 0, gtt_max,
+                                                  obj->cache_level,
+                                                  start, end,
                                                  DRM_MM_SEARCH_DEFAULT,
                                                  DRM_MM_CREATE_DEFAULT);
        if (ret) {
                ret = i915_gem_evict_something(dev, vm, size, alignment,
-                                               obj->cache_level, flags);
+                                               obj->cache_level,
+                                               start, end,
+                                               flags);
                if (ret == 0)
                        goto search_free;
@@ -3828,11 +3951,30 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
        return ret;
 }
+static bool
+i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+        if (alignment &&
+            vma->node.start & (alignment - 1))
+                return true;
+        if (flags & PIN_MAPPABLE && !obj->map_and_fenceable)
+                return true;
+        if (flags & PIN_OFFSET_BIAS &&
+            vma->node.start < (flags & PIN_OFFSET_MASK))
+                return true;
+        return false;
+}
 int
 i915_gem_object_pin(struct drm_i915_gem_object *obj,
                    struct i915_address_space *vm,
                    uint32_t alignment,
-                    unsigned flags)
+                    uint64_t flags)
 {
        struct i915_vma *vma;
        int ret;
@@ -3845,15 +3987,13 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
                if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
                        return -EBUSY;
-                if ((alignment &&
+                if (i915_vma_misplaced(vma, alignment, flags)) {
-                     vma->node.start & (alignment - 1)) ||
-                    (flags & PIN_MAPPABLE && !obj->map_and_fenceable)) {
                        WARN(vma->pin_count,
                             "bo is already pinned with incorrect alignment:"
                             " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
                             " obj->map_and_fenceable=%d\n",
                             i915_gem_obj_offset(obj, vm), alignment,
-                             flags & PIN_MAPPABLE,
+                             !!(flags & PIN_MAPPABLE),
                             obj->map_and_fenceable);
                        ret = i915_vma_unbind(vma);
                        if (ret)
@@ -4163,9 +4303,6 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
        trace_i915_gem_object_destroy(obj);
-        if (obj->phys_obj)
-                i915_gem_detach_phys_object(dev, obj);
        list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
                int ret;
@@ -4183,6 +4320,8 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
                }
        }
+        i915_gem_object_detach_phys(obj);
        /* Stolen objects don't hold a ref, but do hold pin count. Fix that up
         * before progressing. */
        if (obj->stolen)
@@ -4646,190 +4785,6 @@ i915_gem_load(struct drm_device *dev)
        register_shrinker(&dev_priv->mm.inactive_shrinker);
 }
-/*
- * Create a physically contiguous memory object for this object
- * e.g. for cursor + overlay regs
- */
-static int i915_gem_init_phys_object(struct drm_device *dev,
-                                     int id, int size, int align)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-        int ret;
-        if (dev_priv->mm.phys_objs[id - 1] || !size)
-                return 0;
-        phys_obj = kzalloc(sizeof(*phys_obj), GFP_KERNEL);
-        if (!phys_obj)
-                return -ENOMEM;
-        phys_obj->id = id;
-        phys_obj->handle = drm_pci_alloc(dev, size, align);
-        if (!phys_obj->handle) {
-                ret = -ENOMEM;
-                goto kfree_obj;
-        }
-#ifdef CONFIG_X86
-        set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-        dev_priv->mm.phys_objs[id - 1] = phys_obj;
-        return 0;
-kfree_obj:
-        kfree(phys_obj);
-        return ret;
-}
-static void i915_gem_free_phys_object(struct drm_device *dev, int id)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-        if (!dev_priv->mm.phys_objs[id - 1])
-                return;
-        phys_obj = dev_priv->mm.phys_objs[id - 1];
-        if (phys_obj->cur_obj) {
-                i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
-        }
-#ifdef CONFIG_X86
-        set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-        drm_pci_free(dev, phys_obj->handle);
-        kfree(phys_obj);
-        dev_priv->mm.phys_objs[id - 1] = NULL;
-}
-void i915_gem_free_all_phys_object(struct drm_device *dev)
-{
-        int i;
-        for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
-                i915_gem_free_phys_object(dev, i);
-}
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        char *vaddr;
-        int i;
-        int page_count;
-        if (!obj->phys_obj)
-                return;
-        vaddr = obj->phys_obj->handle->vaddr;
-        page_count = obj->base.size / PAGE_SIZE;
-        for (i = 0; i < page_count; i++) {
-                struct page *page = shmem_read_mapping_page(mapping, i);
-                if (!IS_ERR(page)) {
-                        char *dst = kmap_atomic(page);
-                        memcpy(dst, vaddr + i*PAGE_SIZE, PAGE_SIZE);
-                        kunmap_atomic(dst);
-                        drm_clflush_pages(&page, 1);
-                        set_page_dirty(page);
-                        mark_page_accessed(page);
-                        page_cache_release(page);
-                }
-        }
-        i915_gem_chipset_flush(dev);
-        obj->phys_obj->cur_obj = NULL;
-        obj->phys_obj = NULL;
-}
-int
-i915_gem_attach_phys_object(struct drm_device *dev,
-                            struct drm_i915_gem_object *obj,
-                            int id,
-                            int align)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret = 0;
-        int page_count;
-        int i;
-        if (id > I915_MAX_PHYS_OBJECT)
-                return -EINVAL;
-        if (obj->phys_obj) {
-                if (obj->phys_obj->id == id)
-                        return 0;
-                i915_gem_detach_phys_object(dev, obj);
-        }
-        /* create a new object */
-        if (!dev_priv->mm.phys_objs[id - 1]) {
-                ret = i915_gem_init_phys_object(dev, id,
-                                                obj->base.size, align);
-                if (ret) {
-                        DRM_ERROR("failed to init phys object %d size: %zu\n",
-                                  id, obj->base.size);
-                        return ret;
-                }
-        }
-        /* bind to the object */
-        obj->phys_obj = dev_priv->mm.phys_objs[id - 1];
-        obj->phys_obj->cur_obj = obj;
-        page_count = obj->base.size / PAGE_SIZE;
-        for (i = 0; i < page_count; i++) {
-                struct page *page;
-                char *dst, *src;
-                page = shmem_read_mapping_page(mapping, i);
-                if (IS_ERR(page))
-                        return PTR_ERR(page);
-                src = kmap_atomic(page);
-                dst = obj->phys_obj->handle->vaddr + (i * PAGE_SIZE);
-                memcpy(dst, src, PAGE_SIZE);
-                kunmap_atomic(src);
-                mark_page_accessed(page);
-                page_cache_release(page);
-        }
-        return 0;
-}
-static int
-i915_gem_phys_pwrite(struct drm_device *dev,
-                     struct drm_i915_gem_object *obj,
-                     struct drm_i915_gem_pwrite *args,
-                     struct drm_file *file_priv)
-{
-        void *vaddr = obj->phys_obj->handle->vaddr + args->offset;
-        char __user *user_data = to_user_ptr(args->data_ptr);
-        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
-                unsigned long unwritten;
-                /* The physical object once assigned is fixed for the lifetime
-                 * of the obj, so we can safely drop the lock and continue
-                 * to access vaddr.
-                 */
-                mutex_unlock(&dev->struct_mutex);
-                unwritten = copy_from_user(vaddr, user_data, args->size);
-                mutex_lock(&dev->struct_mutex);
-                if (unwritten)
-                        return -EFAULT;
-        }
-        i915_gem_chipset_flush(dev);
-        return 0;
-}
 void i915_gem_release(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_file_private *file_priv = file->driver_priv;
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 75fca63dc8c1..bbf4b12d842e 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -68,9 +68,9 @@ mark_free(struct i915_vma *vma, struct list_head *unwind)
 int
 i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
                         int min_size, unsigned alignment, unsigned cache_level,
+                         unsigned long start, unsigned long end,
                         unsigned flags)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
        struct list_head eviction_list, unwind_list;
        struct i915_vma *vma;
        int ret = 0;
@@ -102,11 +102,10 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
         */
        INIT_LIST_HEAD(&unwind_list);
-        if (flags & PIN_MAPPABLE) {
+        if (start != 0 || end != vm->total) {
-                BUG_ON(!i915_is_ggtt(vm));
                drm_mm_init_scan_with_range(&vm->mm, min_size,
-                                            alignment, cache_level, 0,
+                                            alignment, cache_level,
-                                            dev_priv->gtt.mappable_end);
+                                            start, end);
        } else
                drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 2c9d9cbaf653..20fef6c50267 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -35,6 +35,9 @@
 #define  __EXEC_OBJECT_HAS_PIN (1<<31)
 #define  __EXEC_OBJECT_HAS_FENCE (1<<30)
+#define  __EXEC_OBJECT_NEEDS_BIAS (1<<28)
+#define BATCH_OFFSET_BIAS (256*1024)
 struct eb_vmas {
        struct list_head vmas;
@@ -545,7 +548,7 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
        bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
        bool need_fence;
-        unsigned flags;
+        uint64_t flags;
        int ret;
        flags = 0;
@@ -559,6 +562,8 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        if (entry->flags & EXEC_OBJECT_NEEDS_GTT)
                flags |= PIN_GLOBAL;
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)
+                flags |= BATCH_OFFSET_BIAS | PIN_OFFSET_BIAS;
        ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, flags);
        if (ret)
@@ -592,6 +597,36 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        return 0;
 }
+static bool
+eb_vma_misplaced(struct i915_vma *vma, bool has_fenced_gpu_access)
+{
+        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
+        struct drm_i915_gem_object *obj = vma->obj;
+        bool need_fence, need_mappable;
+        need_fence =
+                has_fenced_gpu_access &&
+                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                obj->tiling_mode != I915_TILING_NONE;
+        need_mappable = need_fence || need_reloc_mappable(vma);
+        WARN_ON((need_mappable || need_fence) &&
+               !i915_is_ggtt(vma->vm));
+        if (entry->alignment &&
+            vma->node.start & (entry->alignment - 1))
+                return true;
+        if (need_mappable && !obj->map_and_fenceable)
+                return true;
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS &&
+            vma->node.start < BATCH_OFFSET_BIAS)
+                return true;
+        return false;
+}
 static int
 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                            struct list_head *vmas,
@@ -653,26 +688,10 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                /* Unbind any ill-fitting objects or pin. */
                list_for_each_entry(vma, vmas, exec_list) {
-                        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
-                        bool need_fence, need_mappable;
-                        obj = vma->obj;
                        if (!drm_mm_node_allocated(&vma->node))
                                continue;
-                        need_fence =
+                        if (eb_vma_misplaced(vma, has_fenced_gpu_access))
-                                has_fenced_gpu_access &&
-                                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
-                                obj->tiling_mode != I915_TILING_NONE;
-                        need_mappable = need_fence || need_reloc_mappable(vma);
-                        WARN_ON((need_mappable || need_fence) &&
-                               !i915_is_ggtt(vma->vm));
-                        if ((entry->alignment &&
-                             vma->node.start & (entry->alignment - 1)) ||
-                            (need_mappable && !obj->map_and_fenceable))
                                ret = i915_vma_unbind(vma);
                        else
                                ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
@@ -773,9 +792,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
                 * relocations were valid.
                 */
                for (j = 0; j < exec[i].relocation_count; j++) {
-                        if (copy_to_user(&user_relocs[j].presumed_offset,
+                        if (__copy_to_user(&user_relocs[j].presumed_offset,
-                                         &invalid_offset,
+                                           &invalid_offset,
-                                         sizeof(invalid_offset))) {
+                                           sizeof(invalid_offset))) {
                                ret = -EFAULT;
                                mutex_lock(&dev->struct_mutex);
                                goto err;
@@ -999,6 +1018,25 @@ i915_reset_gen7_sol_offsets(struct drm_device *dev,
        return 0;
 }
+static struct drm_i915_gem_object *
+eb_get_batch(struct eb_vmas *eb)
+{
+        struct i915_vma *vma = list_entry(eb->vmas.prev, typeof(*vma), exec_list);
+        /*
+         * SNA is doing fancy tricks with compressing batch buffers, which leads
+         * to negative relocation deltas. Usually that works out ok since the
+         * relocate address is still positive, except when the batch is placed
+         * very low in the GTT. Ensure this doesn't happen.
+         *
+         * Note that actual hangs have only been observed on gen7, but for
+         * paranoia do it everywhere.
+         */
+        vma->exec_entry->flags |= __EXEC_OBJECT_NEEDS_BIAS;
+        return vma->obj;
+}
 static int
 i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                       struct drm_file *file,
@@ -1153,7 +1191,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                goto err;
        /* take note of the batch buffer before we might reorder the lists */
-        batch_obj = list_entry(eb->vmas.prev, struct i915_vma, exec_list)->obj;
+        batch_obj = eb_get_batch(eb);
        /* Move the objects en-masse into the GTT, evicting if necessary. */
        need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
@@ -1355,18 +1393,21 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
        ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
        if (!ret) {
+                struct drm_i915_gem_exec_object __user *user_exec_list =
+                        to_user_ptr(args->buffers_ptr);
                /* Copy the new buffer offsets back to the user's exec list. */
-                for (i = 0; i < args->buffer_count; i++)
+                for (i = 0; i < args->buffer_count; i++) {
-                        exec_list[i].offset = exec2_list[i].offset;
+                        ret = __copy_to_user(&user_exec_list[i].offset,
-                /* ... and back out to userspace */
+                                             &exec2_list[i].offset,
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
+                                             sizeof(user_exec_list[i].offset));
-                                   exec_list,
+                        if (ret) {
-                                   sizeof(*exec_list) * args->buffer_count);
+                                ret = -EFAULT;
-                if (ret) {
+                                DRM_DEBUG("failed to copy %d exec entries "
-                        ret = -EFAULT;
+                                          "back to user (%d)\n",
-                        DRM_DEBUG("failed to copy %d exec entries "
+                                          args->buffer_count, ret);
-                                  "back to user (%d)\n",
+                                break;
-                                  args->buffer_count, ret);
+                        }
                }
        }
@@ -1412,14 +1453,21 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
        ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
        if (!ret) {
                /* Copy the new buffer offsets back to the user's exec list. */
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
+                struct drm_i915_gem_exec_object2 *user_exec_list =
-                                   exec2_list,
+                                   to_user_ptr(args->buffers_ptr);
-                                   sizeof(*exec2_list) * args->buffer_count);
+                int i;
-                if (ret) {
-                        ret = -EFAULT;
+                for (i = 0; i < args->buffer_count; i++) {
-                        DRM_DEBUG("failed to copy %d exec entries "
+                        ret = __copy_to_user(&user_exec_list[i].offset,
-                                  "back to user (%d)\n",
+                                             &exec2_list[i].offset,
-                                  args->buffer_count, ret);
+                                             sizeof(user_exec_list[i].offset));
+                        if (ret) {
+                                ret = -EFAULT;
+                                DRM_DEBUG("failed to copy %d exec entries "
+                                          "back to user\n",
+                                          args->buffer_count);
+                                break;
+                        }
                }
        }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 154b0f8bb88d..5deb22864c52 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1089,7 +1089,9 @@ alloc:
        if (ret == -ENOSPC && !retried) {
                ret = i915_gem_evict_something(dev, &dev_priv->gtt.base,
                                               GEN6_PD_SIZE, GEN6_PD_ALIGN,
-                                               I915_CACHE_NONE, 0);
+                                               I915_CACHE_NONE,
+                                               0, dev_priv->gtt.base.total,
+                                               0);
                if (ret)
                        return ret;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 48aa516a1ac0..5b60e25baa32 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7825,14 +7825,12 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                addr = i915_gem_obj_ggtt_offset(obj);
        } else {
                int align = IS_I830(dev) ? 16 * 1024 : 256;
-                ret = i915_gem_attach_phys_object(dev, obj,
+                ret = i915_gem_object_attach_phys(obj, align);
-                                                  (intel_crtc->pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1,
-                                                  align);
                if (ret) {
                        DRM_DEBUG_KMS("failed to attach phys object\n");
                        goto fail_locked;
                }
-                addr = obj->phys_obj->handle->busaddr;
+                addr = obj->phys_handle->busaddr;
        }
        if (IS_GEN2(dev))
@@ -7840,10 +7838,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 finish:
        if (intel_crtc->cursor_bo) {
-                if (INTEL_INFO(dev)->cursor_needs_physical) {
+                if (!INTEL_INFO(dev)->cursor_needs_physical)
-                        if (intel_crtc->cursor_bo != obj)
-                                i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
-                } else
                        i915_gem_object_unpin_from_display_plane(intel_crtc->cursor_bo);
                drm_gem_object_unreference(&intel_crtc->cursor_bo->base);
        }
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index d8adc9104dca..129db0c7d835 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -193,7 +193,7 @@ intel_overlay_map_regs(struct intel_overlay *overlay)
        struct overlay_registers __iomem *regs;
        if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_obj->handle->vaddr;
+                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_handle->vaddr;
        else
                regs = io_mapping_map_wc(dev_priv->gtt.mappable,
                                         i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1340,14 +1340,12 @@ void intel_setup_overlay(struct drm_device *dev)
        overlay->reg_bo = reg_bo;
        if (OVERLAY_NEEDS_PHYSICAL(dev)) {
-                ret = i915_gem_attach_phys_object(dev, reg_bo,
+                ret = i915_gem_object_attach_phys(reg_bo, PAGE_SIZE);
-                                                  I915_GEM_PHYS_OVERLAY_REGS,
-                                                  PAGE_SIZE);
                if (ret) {
                        DRM_ERROR("failed to attach phys overlay regs\n");
                        goto out_free_bo;
                }
-                overlay->flip_addr = reg_bo->phys_obj->handle->busaddr;
+                overlay->flip_addr = reg_bo->phys_handle->busaddr;
        } else {
                ret = i915_gem_obj_ggtt_pin(reg_bo, PAGE_SIZE, PIN_MAPPABLE);
                if (ret) {
@@ -1428,7 +1426,7 @@ intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
                /* Cast to make sparse happy, but it's wc memory anyway, so
                 * equivalent to the wc io mapping on X86. */
                regs = (struct overlay_registers __iomem *)
-                        overlay->reg_bo->phys_obj->handle->vaddr;
+                        overlay->reg_bo->phys_handle->vaddr;
        else
                regs = io_mapping_map_atomic_wc(dev_priv->gtt.mappable,
                                                i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1462,7 +1460,7 @@ intel_overlay_capture_error_state(struct drm_device *dev)
        error->dovsta = I915_READ(DOVSTA);
        error->isr = I915_READ(ISR);
        if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                error->base = (__force long)overlay->reg_bo->phys_obj->handle->vaddr;
+                error->base = (__force long)overlay->reg_bo->phys_handle->vaddr;
        else
                error->base = i915_gem_obj_ggtt_offset(overlay->reg_bo);
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 2b6e0ebcc13a..41ecf8a60611 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -152,6 +152,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                        uint32_t domain = r->write_domain ?
                                r->write_domain : r->read_domains;
+                        if (domain & RADEON_GEM_DOMAIN_CPU) {
+                                DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid "
+                                          "for command submission\n");
+                                return -EINVAL;
+                        }
                        p->relocs[i].domain = domain;
                        if (domain == RADEON_GEM_DOMAIN_VRAM)
                                domain |= RADEON_GEM_DOMAIN_GTT;
@@ -342,10 +348,17 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                        return -EINVAL;
                /* we only support VM on some SI+ rings */
-                if ((p->rdev->asic->ring[p->ring]->cs_parse == NULL) &&
+                if ((p->cs_flags & RADEON_CS_USE_VM) == 0) {
-                   ((p->cs_flags & RADEON_CS_USE_VM) == 0)) {
+                        if (p->rdev->asic->ring[p->ring]->cs_parse == NULL) {
-                        DRM_ERROR("Ring %d requires VM!\n", p->ring);
+                                DRM_ERROR("Ring %d requires VM!\n", p->ring);
-                        return -EINVAL;
+                                return -EINVAL;
+                        }
+                } else {
+                        if (p->rdev->asic->ring[p->ring]->ib_parse == NULL) {
+                                DRM_ERROR("VM not supported on ring %d!\n",
+                                          p->ring);
+                                return -EINVAL;
+                        }
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 0e770bbf7e29..14671406212f 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1533,11 +1533,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
        radeon_restore_bios_scratch_regs(rdev);
-        if (fbcon) {
-                radeon_fbdev_set_suspend(rdev, 0);
-                console_unlock();
-        }
        /* init dig PHYs, disp eng pll */
        if (rdev->is_atom_bios) {
                radeon_atom_encoder_init(rdev);
@@ -1562,6 +1557,12 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
        }
        drm_kms_helper_poll_enable(dev);
+        if (fbcon) {
+                radeon_fbdev_set_suspend(rdev, 0);
+                console_unlock();
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index f00dbbf4d806..356b733caafe 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -862,7 +862,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
                                 unsigned *fb_div, unsigned *ref_div)
 {
        /* limit reference * post divider to a maximum */
-        ref_div_max = min(128 / post_div, ref_div_max);
+        ref_div_max = max(min(100 / post_div, ref_div_max), 1u);
        /* get matching reference and feedback divider */
        *ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index d9ab99f47612..1f426696de36 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -130,10 +130,10 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
                                          struct list_head *head)
 {
        struct radeon_cs_reloc *list;
-        unsigned i, idx, size;
+        unsigned i, idx;
-        size = (radeon_vm_num_pdes(rdev) + 1) * sizeof(struct radeon_cs_reloc);
+        list = kmalloc_array(vm->max_pde_used + 1,
-        list = kmalloc(size, GFP_KERNEL);
+                             sizeof(struct radeon_cs_reloc), GFP_KERNEL);
        if (!list)
                return NULL;
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index bc196f49ec53..4af0da96c2e2 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1053,7 +1053,7 @@ config SENSORS_PC87427
 config SENSORS_NTC_THERMISTOR
        tristate "NTC thermistor support"
-        depends on (!OF && !IIO) || (OF && IIO)
+        depends on !OF || IIO=n || IIO
        help
          This driver supports NTC thermistors sensor reading and its
          interpretation. The driver can also monitor the temperature and
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index 8a17f01e8672..e76feb86a1d4 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -44,6 +44,7 @@ struct ntc_compensation {
        unsigned int    ohm;
 };
+/* Order matters, ntc_match references the entries by index */
 static const struct platform_device_id ntc_thermistor_id[] = {
        { "ncp15wb473", TYPE_NCPXXWB473 },
        { "ncp18wb473", TYPE_NCPXXWB473 },
@@ -141,7 +142,7 @@ struct ntc_data {
        char name[PLATFORM_NAME_SIZE];
 };
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && IS_ENABLED(CONFIG_IIO)
 static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 {
        struct iio_channel *channel = pdata->chan;
@@ -163,15 +164,15 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 static const struct of_device_id ntc_match[] = {
        { .compatible = "ntc,ncp15wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[0] },
        { .compatible = "ntc,ncp18wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[1] },
        { .compatible = "ntc,ncp21wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[2] },
        { .compatible = "ntc,ncp03wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[3] },
        { .compatible = "ntc,ncp15wl333",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWL333] },
+                .data = &ntc_thermistor_id[4] },
        { },
 };
 MODULE_DEVICE_TABLE(of, ntc_match);
@@ -223,6 +224,8 @@ ntc_thermistor_parse_dt(struct platform_device *pdev)
        return NULL;
 }
+#define ntc_match       NULL
 static void ntc_iio_channel_release(struct ntc_thermistor_platform_data *pdata)
 { }
 #endif
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 76842d7dc2e3..ffc7ad3a2c88 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -71,7 +71,7 @@ config KEYBOARD_ATKBD
        default y
        select SERIO
        select SERIO_LIBPS2
-        select SERIO_I8042 if X86
+        select SERIO_I8042 if ARCH_MIGHT_HAVE_PC_SERIO
        select SERIO_GSCPS2 if GSC
        help
          Say Y here if you want to use a standard AT or PS/2 keyboard. Usually
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index d8241ba0afa0..a15063bea700 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -111,6 +111,8 @@ struct pxa27x_keypad {
        unsigned short keycodes[MAX_KEYPAD_KEYS];
        int rotary_rel_code[2];
+        unsigned int row_shift;
        /* state row bits of each column scan */
        uint32_t matrix_key_state[MAX_MATRIX_KEY_COLS];
        uint32_t direct_key_state;
@@ -467,7 +469,8 @@ scan:
                        if ((bits_changed & (1 << row)) == 0)
                                continue;
-                        code = MATRIX_SCAN_CODE(row, col, MATRIX_ROW_SHIFT);
+                        code = MATRIX_SCAN_CODE(row, col, keypad->row_shift);
                        input_event(input_dev, EV_MSC, MSC_SCAN, code);
                        input_report_key(input_dev, keypad->keycodes[code],
                                         new_state[col] & (1 << row));
@@ -802,6 +805,8 @@ static int pxa27x_keypad_probe(struct platform_device *pdev)
                goto failed_put_clk;
        }
+        keypad->row_shift = get_count_order(pdata->matrix_key_cols);
        if ((pdata->enable_rotary0 && keypad->rotary_rel_code[0] != -1) ||
            (pdata->enable_rotary1 && keypad->rotary_rel_code[1] != -1)) {
                input_dev->evbit[0] |= BIT_MASK(EV_REL);
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index effa9c5f2c5c..6b8441f7bc32 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -17,7 +17,7 @@ config MOUSE_PS2
        default y
        select SERIO
        select SERIO_LIBPS2
-        select SERIO_I8042 if X86
+        select SERIO_I8042 if ARCH_MIGHT_HAVE_PC_SERIO
        select SERIO_GSCPS2 if GSC
        help
          Say Y here if you have a PS/2 mouse connected to your system. This
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index d68d33fb5ac2..c5ec703c727e 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -117,6 +117,31 @@ void synaptics_reset(struct psmouse *psmouse)
 }
 #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
+struct min_max_quirk {
+        const char * const *pnp_ids;
+        int x_min, x_max, y_min, y_max;
+};
+static const struct min_max_quirk min_max_pnpid_table[] = {
+        {
+                (const char * const []){"LEN0033", NULL},
+                1024, 5052, 2258, 4832
+        },
+        {
+                (const char * const []){"LEN0035", "LEN0042", NULL},
+                1232, 5710, 1156, 4696
+        },
+        {
+                (const char * const []){"LEN0034", "LEN0036", "LEN2004", NULL},
+                1024, 5112, 2024, 4832
+        },
+        {
+                (const char * const []){"LEN2001", NULL},
+                1024, 5022, 2508, 4832
+        },
+        { }
+};
 /* This list has been kindly provided by Synaptics. */
 static const char * const topbuttonpad_pnp_ids[] = {
        "LEN0017",
@@ -129,7 +154,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
        "LEN002D",
        "LEN002E",
        "LEN0033", /* Helix */
-        "LEN0034", /* T431s, T540, X1 Carbon 2nd */
+        "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
        "LEN0035", /* X240 */
        "LEN0036", /* T440 */
        "LEN0037",
@@ -142,7 +167,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
        "LEN0048",
        "LEN0049",
        "LEN2000",
-        "LEN2001",
+        "LEN2001", /* Edge E431 */
        "LEN2002",
        "LEN2003",
        "LEN2004", /* L440 */
@@ -156,6 +181,18 @@ static const char * const topbuttonpad_pnp_ids[] = {
        NULL
 };
+static bool matches_pnp_id(struct psmouse *psmouse, const char * const ids[])
+{
+        int i;
+        if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4))
+                for (i = 0; ids[i]; i++)
+                        if (strstr(psmouse->ps2dev.serio->firmware_id, ids[i]))
+                                return true;
+        return false;
+}
 /*****************************************************************************
 *      Synaptics communications functions
 ****************************************************************************/
@@ -304,20 +341,20 @@ static int synaptics_identify(struct psmouse *psmouse)
 * Resolution is left zero if touchpad does not support the query
 */
-static const int *quirk_min_max;
 static int synaptics_resolution(struct psmouse *psmouse)
 {
        struct synaptics_data *priv = psmouse->private;
        unsigned char resp[3];
+        int i;
-        if (quirk_min_max) {
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++)
-                priv->x_min = quirk_min_max[0];
+                if (matches_pnp_id(psmouse, min_max_pnpid_table[i].pnp_ids)) {
-                priv->x_max = quirk_min_max[1];
+                        priv->x_min = min_max_pnpid_table[i].x_min;
-                priv->y_min = quirk_min_max[2];
+                        priv->x_max = min_max_pnpid_table[i].x_max;
-                priv->y_max = quirk_min_max[3];
+                        priv->y_min = min_max_pnpid_table[i].y_min;
-                return 0;
+                        priv->y_max = min_max_pnpid_table[i].y_max;
-        }
+                        return 0;
+                }
        if (SYN_ID_MAJOR(priv->identity) < 4)
                return 0;
@@ -1365,17 +1402,8 @@ static void set_input_params(struct psmouse *psmouse,
        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
-                /* See if this buttonpad has a top button area */
+                if (matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
-                if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4)) {
+                        __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
-                        for (i = 0; topbuttonpad_pnp_ids[i]; i++) {
-                                if (strstr(psmouse->ps2dev.serio->firmware_id,
-                                           topbuttonpad_pnp_ids[i])) {
-                                        __set_bit(INPUT_PROP_TOPBUTTONPAD,
-                                                  dev->propbit);
-                                        break;
-                                }
-                        }
-                }
                /* Clickpads report only left button */
                __clear_bit(BTN_RIGHT, dev->keybit);
                __clear_bit(BTN_MIDDLE, dev->keybit);
@@ -1547,104 +1575,10 @@ static const struct dmi_system_id olpc_dmi_table[] __initconst = {
        { }
 };
-static const struct dmi_system_id min_max_dmi_table[] __initconst = {
-#if defined(CONFIG_DMI)
-        {
-                /* Lenovo ThinkPad Helix */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"),
-                },
-                .driver_data = (int []){1024, 5052, 2258, 4832},
-        },
-        {
-                /* Lenovo ThinkPad X240 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"),
-                },
-                .driver_data = (int []){1232, 5710, 1156, 4696},
-        },
-        {
-                /* Lenovo ThinkPad Edge E431 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"),
-                },
-                .driver_data = (int []){1024, 5022, 2508, 4832},
-        },
-        {
-                /* Lenovo ThinkPad T431s */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo ThinkPad T440s */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo ThinkPad L440 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo ThinkPad T540p */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"),
-                },
-                .driver_data = (int []){1024, 5056, 2058, 4832},
-        },
-        {
-                /* Lenovo ThinkPad L540 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo Yoga S1 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
-                                        "ThinkPad S1 Yoga"),
-                },
-                .driver_data = (int []){1232, 5710, 1156, 4696},
-        },
-        {
-                /* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION,
-                                        "ThinkPad X1 Carbon 2nd"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-#endif
-        { }
-};
 void __init synaptics_module_init(void)
 {
-        const struct dmi_system_id *min_max_dmi;
        impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table);
        broken_olpc_ec = dmi_check_system(olpc_dmi_table);
-        min_max_dmi = dmi_first_match(min_max_dmi_table);
-        if (min_max_dmi)
-                quirk_min_max = min_max_dmi->driver_data;
 }
 static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index 762b08432de0..8b748d99b934 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -79,7 +79,8 @@ static int amba_kmi_open(struct serio *io)
        writeb(divisor, KMICLKDIV);
        writeb(KMICR_EN, KMICR);
-        ret = request_irq(kmi->irq, amba_kmi_int, 0, "kmi-pl050", kmi);
+        ret = request_irq(kmi->irq, amba_kmi_int, IRQF_SHARED, "kmi-pl050",
+                          kmi);
        if (ret) {
                printk(KERN_ERR "kmi: failed to claim IRQ%d\n", kmi->irq);
                writeb(0, KMICR);
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 68edc9db2c64..b845e9370871 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -640,7 +640,7 @@ config TOUCHSCREEN_WM9713
 config TOUCHSCREEN_WM97XX_ATMEL
        tristate "WM97xx Atmel accelerated touch"
-        depends on TOUCHSCREEN_WM97XX && (AVR32 || ARCH_AT91)
+        depends on TOUCHSCREEN_WM97XX && AVR32
        help
          Say Y here for support for streaming mode with WM97xx touchscreens
          on Atmel AT91 or AVR32 systems with an AC97C module.
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 9380be7b1895..5f054c44b485 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2178,6 +2178,8 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        ti->num_discard_bios = 1;
        ti->discards_supported = true;
        ti->discard_zeroes_data_unsupported = true;
+        /* Discard bios must be split on a block boundary */
+        ti->split_discard_bios = true;
        cache->features = ca->features;
        ti->per_bio_data_size = get_per_bio_data_size(cache);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index fa0f6cbd6a41..ebfa411d1a7d 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -445,11 +445,11 @@ static int queue_if_no_path(struct multipath *m, unsigned queue_if_no_path,
        else
                m->saved_queue_if_no_path = queue_if_no_path;
        m->queue_if_no_path = queue_if_no_path;
-        if (!m->queue_if_no_path)
-                dm_table_run_md_queue_async(m->ti->table);
        spin_unlock_irqrestore(&m->lock, flags);
+        if (!queue_if_no_path)
+                dm_table_run_md_queue_async(m->ti->table);
        return 0;
 }
@@ -954,7 +954,7 @@ out:
 */
 static int reinstate_path(struct pgpath *pgpath)
 {
-        int r = 0;
+        int r = 0, run_queue = 0;
        unsigned long flags;
        struct multipath *m = pgpath->pg->m;
@@ -978,7 +978,7 @@ static int reinstate_path(struct pgpath *pgpath)
        if (!m->nr_valid_paths++) {
                m->current_pgpath = NULL;
-                dm_table_run_md_queue_async(m->ti->table);
+                run_queue = 1;
        } else if (m->hw_handler_name && (m->current_pg == pgpath->pg)) {
                if (queue_work(kmpath_handlerd, &pgpath->activate_path.work))
                        m->pg_init_in_progress++;
@@ -991,6 +991,8 @@ static int reinstate_path(struct pgpath *pgpath)
 out:
        spin_unlock_irqrestore(&m->lock, flags);
+        if (run_queue)
+                dm_table_run_md_queue_async(m->ti->table);
        return r;
 }
@@ -1566,8 +1568,8 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
                }
                if (m->pg_init_required)
                        __pg_init_all_paths(m);
-                dm_table_run_md_queue_async(m->ti->table);
                spin_unlock_irqrestore(&m->lock, flags);
+                dm_table_run_md_queue_async(m->ti->table);
        }
        return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 2e71de8e0048..242ac2ea5f29 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -27,7 +27,9 @@
 #define MAPPING_POOL_SIZE 1024
 #define PRISON_CELLS 1024
 #define COMMIT_PERIOD HZ
-#define NO_SPACE_TIMEOUT (HZ * 60)
+#define NO_SPACE_TIMEOUT_SECS 60
+static unsigned no_space_timeout_secs = NO_SPACE_TIMEOUT_SECS;
 DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
                "A percentage of time allocated for copy on write");
@@ -1670,6 +1672,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
        struct pool_c *pt = pool->ti->private;
        bool needs_check = dm_pool_metadata_needs_check(pool->pmd);
        enum pool_mode old_mode = get_pool_mode(pool);
+        unsigned long no_space_timeout = ACCESS_ONCE(no_space_timeout_secs) * HZ;
        /*
         * Never allow the pool to transition to PM_WRITE mode if user
@@ -1732,8 +1735,8 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                pool->process_prepared_mapping = process_prepared_mapping;
                pool->process_prepared_discard = process_prepared_discard_passdown;
-                if (!pool->pf.error_if_no_space)
+                if (!pool->pf.error_if_no_space && no_space_timeout)
-                        queue_delayed_work(pool->wq, &pool->no_space_timeout, NO_SPACE_TIMEOUT);
+                        queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
                break;
        case PM_WRITE:
@@ -3508,6 +3511,9 @@ static void dm_thin_exit(void)
 module_init(dm_thin_init);
 module_exit(dm_thin_exit);
+module_param_named(no_space_timeout, no_space_timeout_secs, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(no_space_timeout, "Out of data space queue IO timeout in seconds");
 MODULE_DESCRIPTION(DM_NAME " thin provisioning target");
 MODULE_AUTHOR("Joe Thornber <dm-devel@redhat.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 237b7e0ddc7a..2382cfc9bb3f 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7381,8 +7381,10 @@ void md_do_sync(struct md_thread *thread)
        /* just incase thread restarts... */
        if (test_bit(MD_RECOVERY_DONE, &mddev->recovery))
                return;
-        if (mddev->ro) /* never try to sync a read-only array */
+        if (mddev->ro) {/* never try to sync a read-only array */
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                return;
+        }
        if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
                if (test_bit(MD_RECOVERY_CHECK, &mddev->recovery)) {
@@ -7824,6 +7826,7 @@ void md_check_recovery(struct mddev *mddev)
                        /* There is no thread, but we need to call
                         * ->spare_active and clear saved_raid_disk
                         */
+                        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                        md_reap_sync_thread(mddev);
                        clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                        goto unlock;
diff --git a/drivers/net/can/led.c b/drivers/net/can/led.c
index a3d99a8fd2d1..ab7f1b01be49 100644
--- a/drivers/net/can/led.c
+++ b/drivers/net/can/led.c
@@ -97,6 +97,9 @@ static int can_led_notifier(struct notifier_block *nb, unsigned long msg,
        if (!priv)
                return NOTIFY_DONE;
+        if (!priv->tx_led_trig || !priv->rx_led_trig)
+                return NOTIFY_DONE;
        if (msg == NETDEV_CHANGENAME) {
                snprintf(name, sizeof(name), "%s-tx", netdev->name);
                led_trigger_rename_static(name, priv->tx_led_trig);
diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index f0e2a4d4f621..edb718661850 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -39,6 +39,7 @@ source "drivers/net/ethernet/cisco/Kconfig"
 config CX_ECAT
        tristate "Beckhoff CX5020 EtherCAT master support"
        depends on PCI
+        depends on X86 || COMPILE_TEST
        ---help---
          Driver for EtherCAT master module located on CCAT FPGA
          that can be found on Beckhoff CX5020, and possibly other of CX
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index d18441ebe944..23da47925fa3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -906,6 +906,18 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                bd_prod = RX_BD(bd_prod);
                bd_cons = RX_BD(bd_cons);
+                /* A rmb() is required to ensure that the CQE is not read
+                 * before it is written by the adapter DMA.  PCI ordering
+                 * rules will make sure the other fields are written before
+                 * the marker at the end of struct eth_fast_path_rx_cqe
+                 * but without rmb() a weakly ordered processor can process
+                 * stale data.  Without the barrier TPA state-machine might
+                 * enter inconsistent state and kernel stack might be
+                 * provided with incorrect packet description - these lead
+                 * to various kernel crashed.
+                 */
+                rmb();
                cqe_fp_flags = cqe_fp->type_error_flags;
                cqe_fp_type = cqe_fp_flags & ETH_FAST_PATH_RX_CQE_TYPE;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index ff2bdd80f0aa..cf14218697e4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13283,8 +13283,8 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
        netdev_reset_tc(bp->dev);
        del_timer_sync(&bp->timer);
-        cancel_delayed_work(&bp->sp_task);
+        cancel_delayed_work_sync(&bp->sp_task);
-        cancel_delayed_work(&bp->period_task);
+        cancel_delayed_work_sync(&bp->period_task);
        spin_lock_bh(&bp->stats_lock);
        bp->stats_state = STATS_STATE_DISABLED;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 09f3fefcbf9c..a4b25bc7113a 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -608,6 +608,10 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
                pr_err("%s: Bad type %d\n", __func__, ulp_type);
                return -EINVAL;
        }
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
        mutex_lock(&cnic_lock);
        if (rcu_dereference(cp->ulp_ops[ulp_type])) {
                RCU_INIT_POINTER(cp->ulp_ops[ulp_type], NULL);
@@ -620,9 +624,7 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
        }
        mutex_unlock(&cnic_lock);
-        if (ulp_type == CNIC_ULP_ISCSI)
+        if (ulp_type == CNIC_ULP_FCOE)
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
-        else if (ulp_type == CNIC_ULP_FCOE)
                dev->fcoe_cap = NULL;
        synchronize_rcu();
@@ -1039,21 +1041,17 @@ static int cnic_alloc_uio_rings(struct cnic_dev *dev, int pages)
        struct cnic_local *cp = dev->cnic_priv;
        struct cnic_uio_dev *udev;
-        read_lock(&cnic_dev_lock);
        list_for_each_entry(udev, &cnic_udev_list, list) {
                if (udev->pdev == dev->pcidev) {
                        udev->dev = dev;
                        if (__cnic_alloc_uio_rings(udev, pages)) {
                                udev->dev = NULL;
-                                read_unlock(&cnic_dev_lock);
                                return -ENOMEM;
                        }
                        cp->udev = udev;
-                        read_unlock(&cnic_dev_lock);
                        return 0;
                }
        }
-        read_unlock(&cnic_dev_lock);
        udev = kzalloc(sizeof(struct cnic_uio_dev), GFP_ATOMIC);
        if (!udev)
@@ -1067,9 +1065,7 @@ static int cnic_alloc_uio_rings(struct cnic_dev *dev, int pages)
        if (__cnic_alloc_uio_rings(udev, pages))
                goto err_udev;
-        write_lock(&cnic_dev_lock);
        list_add(&udev->list, &cnic_udev_list);
-        write_unlock(&cnic_dev_lock);
        pci_dev_get(udev->pdev);
@@ -5624,20 +5620,27 @@ static void cnic_rcv_netevent(struct cnic_local *cp, unsigned long event,
 {
        int if_type;
-        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
                void *ctx;
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->indicate_netevent)
+                ulp_ops = rcu_dereference_protected(cp->ulp_ops[if_type],
+                                                lockdep_is_held(&cnic_lock));
+                if (!ulp_ops || !ulp_ops->indicate_netevent) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
                ctx = cp->ulp_handle[if_type];
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
                ulp_ops->indicate_netevent(ctx, event, vlan_id);
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
        }
-        rcu_read_unlock();
 }
 /* netdev event handler */
diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c
index 9d75fef6396f..63eb959a28aa 100644
--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -682,10 +682,7 @@ static int mal_probe(struct platform_device *ofdev)
                goto fail6;
        /* Enable all MAL SERR interrupt sources */
-        if (mal->version == 2)
+        set_mal_dcrn(mal, MAL_IER, MAL_IER_EVENTS);
-                set_mal_dcrn(mal, MAL_IER, MAL2_IER_EVENTS);
-        else
-                set_mal_dcrn(mal, MAL_IER, MAL1_IER_EVENTS);
        /* Enable EOB interrupt */
        mal_enable_eob_irq(mal);
diff --git a/drivers/net/ethernet/ibm/emac/mal.h b/drivers/net/ethernet/ibm/emac/mal.h
index e431a32e3d69..eeade2ea8334 100644
--- a/drivers/net/ethernet/ibm/emac/mal.h
+++ b/drivers/net/ethernet/ibm/emac/mal.h
@@ -95,24 +95,20 @@
 #define MAL_IER                 0x02
+/* MAL IER bits */
 #define   MAL_IER_DE            0x00000010
 #define   MAL_IER_OTE           0x00000004
 #define   MAL_IER_OE            0x00000002
 #define   MAL_IER_PE            0x00000001
-/* MAL V1 IER bits */
-#define   MAL1_IER_NWE          0x00000008
-#define   MAL1_IER_SOC_EVENTS   MAL1_IER_NWE
-#define   MAL1_IER_EVENTS       (MAL1_IER_SOC_EVENTS | MAL_IER_DE | \
-                                 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
-/* MAL V2 IER bits */
+/* PLB read/write/timeout errors */
-#define   MAL2_IER_PT           0x00000080
+#define   MAL_IER_PTE           0x00000080
-#define   MAL2_IER_PRE          0x00000040
+#define   MAL_IER_PRE           0x00000040
-#define   MAL2_IER_PWE          0x00000020
+#define   MAL_IER_PWE           0x00000020
-#define   MAL2_IER_SOC_EVENTS   (MAL2_IER_PT | MAL2_IER_PRE | MAL2_IER_PWE)
-#define   MAL2_IER_EVENTS       (MAL2_IER_SOC_EVENTS | MAL_IER_DE | \
-                                 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
+#define   MAL_IER_SOC_EVENTS    (MAL_IER_PTE | MAL_IER_PRE | MAL_IER_PWE)
+#define   MAL_IER_EVENTS        (MAL_IER_SOC_EVENTS | MAL_IER_DE | \
+                                 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
 #define MAL_TXCASR              0x04
 #define MAL_TXCARR              0x05
diff --git a/drivers/net/ethernet/ibm/emac/rgmii.c b/drivers/net/ethernet/ibm/emac/rgmii.c
index 4fb2f96da23b..a01182cce965 100644
--- a/drivers/net/ethernet/ibm/emac/rgmii.c
+++ b/drivers/net/ethernet/ibm/emac/rgmii.c
@@ -45,6 +45,7 @@
 /* RGMIIx_SSR */
 #define RGMII_SSR_MASK(idx)     (0x7 << ((idx) * 8))
+#define RGMII_SSR_10(idx)       (0x1 << ((idx) * 8))
 #define RGMII_SSR_100(idx)      (0x2 << ((idx) * 8))
 #define RGMII_SSR_1000(idx)     (0x4 << ((idx) * 8))
@@ -139,6 +140,8 @@ void rgmii_set_speed(struct platform_device *ofdev, int input, int speed)
                ssr |= RGMII_SSR_1000(input);
        else if (speed == SPEED_100)
                ssr |= RGMII_SSR_100(input);
+        else if (speed == SPEED_10)
+                ssr |= RGMII_SSR_10(input);
        out_be32(&p->ssr, ssr);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 38e9a4c9099c..19606a44672b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2012,6 +2012,7 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port)
        if (!mlx4_is_slave(dev)) {
                mlx4_init_mac_table(dev, &info->mac_table);
                mlx4_init_vlan_table(dev, &info->vlan_table);
+                mlx4_init_roce_gid_table(dev, &info->gid_table);
                info->base_qpn = mlx4_get_base_qpn(dev, port);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 9dd1b30ea757..4b416edb4c1e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -696,6 +696,17 @@ struct mlx4_mac_table {
        int                     max;
 };
+#define MLX4_ROCE_GID_ENTRY_SIZE        16
+struct mlx4_roce_gid_entry {
+        u8 raw[MLX4_ROCE_GID_ENTRY_SIZE];
+};
+struct mlx4_roce_gid_table {
+        struct mlx4_roce_gid_entry      roce_gids[MLX4_ROCE_MAX_GIDS];
+        struct mutex                    mutex;
+};
 #define MLX4_MAX_VLAN_NUM       128
 #define MLX4_VLAN_TABLE_SIZE    (MLX4_MAX_VLAN_NUM << 2)
@@ -759,6 +770,7 @@ struct mlx4_port_info {
        struct device_attribute port_mtu_attr;
        struct mlx4_mac_table   mac_table;
        struct mlx4_vlan_table  vlan_table;
+        struct mlx4_roce_gid_table gid_table;
        int                     base_qpn;
 };
@@ -789,10 +801,6 @@ enum {
        MLX4_USE_RR     = 1,
 };
-struct mlx4_roce_gid_entry {
-        u8 raw[16];
-};
 struct mlx4_priv {
        struct mlx4_dev         dev;
@@ -840,7 +848,6 @@ struct mlx4_priv {
        int                     fs_hash_mode;
        u8 virt2phys_pkey[MLX4_MFUNC_MAX][MLX4_MAX_PORTS][MLX4_MAX_PORT_PKEYS];
        __be64                  slave_node_guids[MLX4_MFUNC_MAX];
-        struct mlx4_roce_gid_entry roce_gids[MLX4_MAX_PORTS][MLX4_ROCE_MAX_GIDS];
        atomic_t                opreq_count;
        struct work_struct      opreq_task;
@@ -1141,6 +1148,8 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
 void mlx4_init_mac_table(struct mlx4_dev *dev, struct mlx4_mac_table *table);
 void mlx4_init_vlan_table(struct mlx4_dev *dev, struct mlx4_vlan_table *table);
+void mlx4_init_roce_gid_table(struct mlx4_dev *dev,
+                              struct mlx4_roce_gid_table *table);
 void __mlx4_unregister_vlan(struct mlx4_dev *dev, u8 port, u16 vlan);
 int __mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index);
@@ -1150,6 +1159,7 @@ int mlx4_get_slave_from_resource_id(struct mlx4_dev *dev,
                                    enum mlx4_resource resource_type,
                                    u64 resource_id, int *slave);
 void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave_id);
+void mlx4_reset_roce_gids(struct mlx4_dev *dev, int slave);
 int mlx4_init_resource_tracker(struct mlx4_dev *dev);
 void mlx4_free_resource_tracker(struct mlx4_dev *dev,
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 376f2f1d445e..7ab97174886d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -75,6 +75,16 @@ void mlx4_init_vlan_table(struct mlx4_dev *dev, struct mlx4_vlan_table *table)
        table->total = 0;
 }
+void mlx4_init_roce_gid_table(struct mlx4_dev *dev,
+                              struct mlx4_roce_gid_table *table)
+{
+        int i;
+        mutex_init(&table->mutex);
+        for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++)
+                memset(table->roce_gids[i].raw, 0, MLX4_ROCE_GID_ENTRY_SIZE);
+}
 static int validate_index(struct mlx4_dev *dev,
                          struct mlx4_mac_table *table, int index)
 {
@@ -583,6 +593,84 @@ int mlx4_get_base_gid_ix(struct mlx4_dev *dev, int slave, int port)
 }
 EXPORT_SYMBOL_GPL(mlx4_get_base_gid_ix);
+static int mlx4_reset_roce_port_gids(struct mlx4_dev *dev, int slave,
+                                     int port, struct mlx4_cmd_mailbox *mailbox)
+{
+        struct mlx4_roce_gid_entry *gid_entry_mbox;
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        int num_gids, base, offset;
+        int i, err;
+        num_gids = mlx4_get_slave_num_gids(dev, slave, port);
+        base = mlx4_get_base_gid_ix(dev, slave, port);
+        memset(mailbox->buf, 0, MLX4_MAILBOX_SIZE);
+        mutex_lock(&(priv->port[port].gid_table.mutex));
+        /* Zero-out gids belonging to that slave in the port GID table */
+        for (i = 0, offset = base; i < num_gids; offset++, i++)
+                memcpy(priv->port[port].gid_table.roce_gids[offset].raw,
+                       zgid_entry.raw, MLX4_ROCE_GID_ENTRY_SIZE);
+        /* Now, copy roce port gids table to mailbox for passing to FW */
+        gid_entry_mbox = (struct mlx4_roce_gid_entry *)mailbox->buf;
+        for (i = 0; i < MLX4_ROCE_MAX_GIDS; gid_entry_mbox++, i++)
+                memcpy(gid_entry_mbox->raw,
+                       priv->port[port].gid_table.roce_gids[i].raw,
+                       MLX4_ROCE_GID_ENTRY_SIZE);
+        err = mlx4_cmd(dev, mailbox->dma,
+                       ((u32)port) | (MLX4_SET_PORT_GID_TABLE << 8), 1,
+                       MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
+                       MLX4_CMD_NATIVE);
+        mutex_unlock(&(priv->port[port].gid_table.mutex));
+        return err;
+}
+void mlx4_reset_roce_gids(struct mlx4_dev *dev, int slave)
+{
+        struct mlx4_active_ports actv_ports;
+        struct mlx4_cmd_mailbox *mailbox;
+        int num_eth_ports, err;
+        int i;
+        if (slave < 0 || slave > dev->num_vfs)
+                return;
+        actv_ports = mlx4_get_active_ports(dev, slave);
+        for (i = 0, num_eth_ports = 0; i < dev->caps.num_ports; i++) {
+                if (test_bit(i, actv_ports.ports)) {
+                        if (dev->caps.port_type[i + 1] != MLX4_PORT_TYPE_ETH)
+                                continue;
+                        num_eth_ports++;
+                }
+        }
+        if (!num_eth_ports)
+                return;
+        /* have ETH ports.  Alloc mailbox for SET_PORT command */
+        mailbox = mlx4_alloc_cmd_mailbox(dev);
+        if (IS_ERR(mailbox))
+                return;
+        for (i = 0; i < dev->caps.num_ports; i++) {
+                if (test_bit(i, actv_ports.ports)) {
+                        if (dev->caps.port_type[i + 1] != MLX4_PORT_TYPE_ETH)
+                                continue;
+                        err = mlx4_reset_roce_port_gids(dev, slave, i + 1, mailbox);
+                        if (err)
+                                mlx4_warn(dev, "Could not reset ETH port GID table for slave %d, port %d (%d)\n",
+                                          slave, i + 1, err);
+                }
+        }
+        mlx4_free_cmd_mailbox(dev, mailbox);
+        return;
+}
 static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                                u8 op_mod, struct mlx4_cmd_mailbox *inbox)
 {
@@ -691,10 +779,12 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                        /* 2. Check that do not have duplicates in OTHER
                         *    entries in the port GID table
                         */
+                        mutex_lock(&(priv->port[port].gid_table.mutex));
                        for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++) {
                                if (i >= base && i < base + num_gids)
                                        continue; /* don't compare to slave's current gids */
-                                gid_entry_tbl = &priv->roce_gids[port - 1][i];
+                                gid_entry_tbl = &priv->port[port].gid_table.roce_gids[i];
                                if (!memcmp(gid_entry_tbl->raw, zgid_entry.raw, sizeof(zgid_entry)))
                                        continue;
                                gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
@@ -707,6 +797,7 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                                                /* found duplicate */
                                                mlx4_warn(dev, "requested gid entry for slave:%d is a duplicate of gid at index %d\n",
                                                          slave, i);
+                                                mutex_unlock(&(priv->port[port].gid_table.mutex));
                                                return -EINVAL;
                                        }
                                }
@@ -715,16 +806,24 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                        /* insert slave GIDs with memcpy, starting at slave's base index */
                        gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
                        for (i = 0, offset = base; i < num_gids; gid_entry_mbox++, offset++, i++)
-                                memcpy(priv->roce_gids[port - 1][offset].raw, gid_entry_mbox->raw, 16);
+                                memcpy(priv->port[port].gid_table.roce_gids[offset].raw,
+                                       gid_entry_mbox->raw, MLX4_ROCE_GID_ENTRY_SIZE);
                        /* Now, copy roce port gids table to current mailbox for passing to FW */
                        gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
                        for (i = 0; i < MLX4_ROCE_MAX_GIDS; gid_entry_mbox++, i++)
-                                memcpy(gid_entry_mbox->raw, priv->roce_gids[port - 1][i].raw, 16);
+                                memcpy(gid_entry_mbox->raw,
+                                       priv->port[port].gid_table.roce_gids[i].raw,
-                        break;
+                                       MLX4_ROCE_GID_ENTRY_SIZE);
+                        err = mlx4_cmd(dev, inbox->dma, in_mod & 0xffff, op_mod,
+                                       MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
+                                       MLX4_CMD_NATIVE);
+                        mutex_unlock(&(priv->port[port].gid_table.mutex));
+                        return err;
                }
-                return mlx4_cmd(dev, inbox->dma, in_mod, op_mod,
+                return mlx4_cmd(dev, inbox->dma, in_mod & 0xffff, op_mod,
                                MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
                                MLX4_CMD_NATIVE);
        }
@@ -1097,7 +1196,8 @@ int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,
        num_vfs = bitmap_weight(slaves_pport.slaves, dev->num_vfs + 1) - 1;
        for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++) {
-                if (!memcmp(priv->roce_gids[port - 1][i].raw, gid, 16)) {
+                if (!memcmp(priv->port[port].gid_table.roce_gids[i].raw, gid,
+                            MLX4_ROCE_GID_ENTRY_SIZE)) {
                        found_ix = i;
                        break;
                }
@@ -1185,7 +1285,8 @@ int mlx4_get_roce_gid_from_slave(struct mlx4_dev *dev, int port, int slave_id,
        if (!mlx4_is_master(dev))
                return -EINVAL;
-        memcpy(gid, priv->roce_gids[port - 1][slave_id].raw, 16);
+        memcpy(gid, priv->port[port].gid_table.roce_gids[slave_id].raw,
+               MLX4_ROCE_GID_ENTRY_SIZE);
        return 0;
 }
 EXPORT_SYMBOL(mlx4_get_roce_gid_from_slave);
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index dd821b363686..b6cddef24391 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -586,6 +586,7 @@ void mlx4_free_resource_tracker(struct mlx4_dev *dev,
                        }
                        /* free master's vlans */
                        i = dev->caps.function;
+                        mlx4_reset_roce_gids(dev, i);
                        mutex_lock(&priv->mfunc.master.res_tracker.slave_list[i].mutex);
                        rem_slave_vlans(dev, i);
                        mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[i].mutex);
@@ -4672,7 +4673,7 @@ static void rem_slave_xrcdns(struct mlx4_dev *dev, int slave)
 void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
+        mlx4_reset_roce_gids(dev, slave);
        mutex_lock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
        rem_slave_vlans(dev, slave);
        rem_slave_macs(dev, slave);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index a51fe18f09a8..561cb11ca58c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -1020,6 +1020,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev,
        struct qlcnic_dcb_cee *peer;
        int i;
+        memset(info, 0, sizeof(*info));
        *app_count = 0;
        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 6a94ede699b4..b19a323c8647 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -307,6 +307,27 @@ static const u16 sh_eth_offset_fast_sh4[SH_ETH_MAX_REGISTER_OFFSET] = {
 };
 static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
+        [EDMR]          = 0x0000,
+        [EDTRR]         = 0x0004,
+        [EDRRR]         = 0x0008,
+        [TDLAR]         = 0x000c,
+        [RDLAR]         = 0x0010,
+        [EESR]          = 0x0014,
+        [EESIPR]        = 0x0018,
+        [TRSCER]        = 0x001c,
+        [RMFCR]         = 0x0020,
+        [TFTR]          = 0x0024,
+        [FDR]           = 0x0028,
+        [RMCR]          = 0x002c,
+        [EDOCR]         = 0x0030,
+        [FCFTR]         = 0x0034,
+        [RPADIR]        = 0x0038,
+        [TRIMD]         = 0x003c,
+        [RBWAR]         = 0x0040,
+        [RDFAR]         = 0x0044,
+        [TBRAR]         = 0x004c,
+        [TDFAR]         = 0x0050,
        [ECMR]          = 0x0160,
        [ECSR]          = 0x0164,
        [ECSIPR]        = 0x0168,
@@ -546,7 +567,6 @@ static struct sh_eth_cpu_data sh7757_data = {
        .register_type  = SH_ETH_REG_FAST_SH4,
        .eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
-        .rmcr_value     = RMCR_RNC,
        .tx_check       = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -624,7 +644,6 @@ static struct sh_eth_cpu_data sh7757_data_giga = {
                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                          EESR_TDE | EESR_ECI,
        .fdr_value      = 0x0000072f,
-        .rmcr_value     = RMCR_RNC,
        .irq_flags      = IRQF_SHARED,
        .apr            = 1,
@@ -752,7 +771,6 @@ static struct sh_eth_cpu_data r8a7740_data = {
                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                          EESR_TDE | EESR_ECI,
        .fdr_value      = 0x0000070f,
-        .rmcr_value     = RMCR_RNC,
        .apr            = 1,
        .mpr            = 1,
@@ -784,7 +802,6 @@ static struct sh_eth_cpu_data r7s72100_data = {
                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                          EESR_TDE | EESR_ECI,
        .fdr_value      = 0x0000070f,
-        .rmcr_value     = RMCR_RNC,
        .no_psr         = 1,
        .apr            = 1,
@@ -833,9 +850,6 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd)
        if (!cd->fdr_value)
                cd->fdr_value = DEFAULT_FDR_INIT;
-        if (!cd->rmcr_value)
-                cd->rmcr_value = DEFAULT_RMCR_VALUE;
        if (!cd->tx_check)
                cd->tx_check = DEFAULT_TX_CHECK;
@@ -1287,8 +1301,8 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
        sh_eth_write(ndev, mdp->cd->fdr_value, FDR);
        sh_eth_write(ndev, 0, TFTR);
-        /* Frame recv control */
+        /* Frame recv control (enable multiple-packets per rx irq) */
-        sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR);
+        sh_eth_write(ndev, RMCR_RNC, RMCR);
        sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index d55e37cd5fec..b37c427144ee 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -319,7 +319,6 @@ enum TD_STS_BIT {
 enum RMCR_BIT {
        RMCR_RNC = 0x00000001,
 };
-#define DEFAULT_RMCR_VALUE      0x00000000
 /* ECMR */
 enum FELIC_MODE_BIT {
@@ -466,7 +465,6 @@ struct sh_eth_cpu_data {
        unsigned long fdr_value;
        unsigned long fcftr_value;
        unsigned long rpadir_value;
-        unsigned long rmcr_value;
        /* interrupt checking mask */
        unsigned long tx_check;
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index a0fc151da40d..5e13fa5524ae 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2477,6 +2477,8 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
                goto out_disable_resources;
        }
+        netif_carrier_off(dev);
        retval = register_netdev(dev);
        if (retval) {
                SMSC_WARN(pdata, probe, "Error %i registering device", retval);
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index f32d730f55cc..35a139e9a833 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1567,7 +1567,6 @@ static int emac_dev_open(struct net_device *ndev)
        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ,
                                            res_num))) {
                for (irq_num = res->start; irq_num <= res->end; irq_num++) {
-                        dev_err(emac_dev, "Request IRQ %d\n", irq_num);
                        if (request_irq(irq_num, emac_irq, 0, ndev->name,
                                        ndev)) {
                                dev_err(emac_dev,
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 9a9ce8debefa..b4958c7ffa84 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1724,6 +1724,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
         * to traverse list in reverse under rcu_read_lock
         */
        mutex_lock(&team->lock);
+        team->port_mtu_change_allowed = true;
        list_for_each_entry(port, &team->port_list, list) {
                err = dev_set_mtu(port->dev, new_mtu);
                if (err) {
@@ -1732,6 +1733,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
                        goto unwind;
                }
        }
+        team->port_mtu_change_allowed = false;
        mutex_unlock(&team->lock);
        dev->mtu = new_mtu;
@@ -1741,6 +1743,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
 unwind:
        list_for_each_entry_continue_reverse(port, &team->port_list, list)
                dev_set_mtu(port->dev, dev->mtu);
+        team->port_mtu_change_allowed = false;
        mutex_unlock(&team->lock);
        return err;
@@ -2851,7 +2854,9 @@ static int team_device_event(struct notifier_block *unused,
                break;
        case NETDEV_PRECHANGEMTU:
                /* Forbid to change mtu of underlaying device */
-                return NOTIFY_BAD;
+                if (!port->team->port_mtu_change_allowed)
+                        return NOTIFY_BAD;
+                break;
        case NETDEV_PRE_TYPE_CHANGE:
                /* Forbid to change type of underlaying device */
                return NOTIFY_BAD;
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index f72570708edb..76465b117b72 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -59,6 +59,8 @@
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4    0x1297
 #define USB_PRODUCT_IPAD 0x129a
+#define USB_PRODUCT_IPAD_2      0x12a2
+#define USB_PRODUCT_IPAD_3      0x12a6
 #define USB_PRODUCT_IPAD_MINI    0x12ab
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define USB_PRODUCT_IPHONE_4S   0x12a0
@@ -107,6 +109,14 @@ static struct usb_device_id ipheth_table[] = {
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPAD_2,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPAD_3,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
                USB_VENDOR_APPLE, USB_PRODUCT_IPAD_MINI,
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 83208d4fdc59..dc4bf06948c7 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -748,11 +748,15 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
        {QMI_FIXED_INTF(0x1199, 0x68c0, 8)},    /* Sierra Wireless MC73xx */
        {QMI_FIXED_INTF(0x1199, 0x68c0, 10)},   /* Sierra Wireless MC73xx */
-        {QMI_FIXED_INTF(0x1199, 0x68c0, 11)},   /* Sierra Wireless MC73xx */
        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
        {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
        {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
        {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
+        {QMI_FIXED_INTF(0x1199, 0x9053, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9054, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9055, 8)},    /* Netgear AirCard 341U */
+        {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
diff --git a/drivers/pinctrl/vt8500/pinctrl-wmt.c b/drivers/pinctrl/vt8500/pinctrl-wmt.c
index 9802b67040cc..2c61281bebd7 100644
--- a/drivers/pinctrl/vt8500/pinctrl-wmt.c
+++ b/drivers/pinctrl/vt8500/pinctrl-wmt.c
@@ -523,17 +523,6 @@ static int wmt_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
                return GPIOF_DIR_IN;
 }
-static int wmt_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
-{
-        return pinctrl_gpio_direction_input(chip->base + offset);
-}
-static int wmt_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
-                                     int value)
-{
-        return pinctrl_gpio_direction_output(chip->base + offset);
-}
 static int wmt_gpio_get_value(struct gpio_chip *chip, unsigned offset)
 {
        struct wmt_pinctrl_data *data = dev_get_drvdata(chip->dev);
@@ -568,6 +557,18 @@ static void wmt_gpio_set_value(struct gpio_chip *chip, unsigned offset,
                wmt_clearbits(data, reg_data_out, BIT(bit));
 }
+static int wmt_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+{
+        return pinctrl_gpio_direction_input(chip->base + offset);
+}
+static int wmt_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
+                                     int value)
+{
+        wmt_gpio_set_value(chip, offset, value);
+        return pinctrl_gpio_direction_output(chip->base + offset);
+}
 static struct gpio_chip wmt_gpio_chip = {
        .label = "gpio-wmt",
        .owner = THIS_MODULE,
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 1b681427dde0..c341f855fadc 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -1621,8 +1621,6 @@ void sas_rphy_free(struct sas_rphy *rphy)
        list_del(&rphy->list);
        mutex_unlock(&sas_host->lock);
-        sas_bsg_remove(shost, rphy);
        transport_destroy_device(dev);
        put_device(dev);
@@ -1681,6 +1679,7 @@ sas_rphy_remove(struct sas_rphy *rphy)
        }
        sas_rphy_unlink(rphy);
+        sas_bsg_remove(NULL, rphy);
        transport_remove_device(dev);
        device_del(dev);
 }
diff --git a/drivers/staging/comedi/drivers/ni_daq_700.c b/drivers/staging/comedi/drivers/ni_daq_700.c
index 171a71d20c88..728bf7f14f7b 100644
--- a/drivers/staging/comedi/drivers/ni_daq_700.c
+++ b/drivers/staging/comedi/drivers/ni_daq_700.c
@@ -139,6 +139,8 @@ static int daq700_ai_rinsn(struct comedi_device *dev,
        /* write channel to multiplexer */
        /* set mask scan bit high to disable scanning */
        outb(chan | 0x80, dev->iobase + CMD_R1);
+        /* mux needs 2us to really settle [Fred Brooks]. */
+        udelay(2);
        /* convert n samples */
        for (n = 0; n < insn->n; n++) {
diff --git a/drivers/staging/rtl8192e/rtllib_tx.c b/drivers/staging/rtl8192e/rtllib_tx.c
index 11d0a9d8ee59..b7dd1539bbc4 100644
--- a/drivers/staging/rtl8192e/rtllib_tx.c
+++ b/drivers/staging/rtl8192e/rtllib_tx.c
@@ -171,7 +171,7 @@ inline int rtllib_put_snap(u8 *data, u16 h_proto)
        snap->oui[1] = oui[1];
        snap->oui[2] = oui[2];
-        *(u16 *)(data + SNAP_SIZE) = h_proto;
+        *(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
        return SNAP_SIZE + sizeof(u16);
 }
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index 3b6e5358c723..7de79d59a4cd 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -2218,6 +2218,7 @@ static void __exit speakup_exit(void)
        unregister_keyboard_notifier(&keyboard_notifier_block);
        unregister_vt_notifier(&vt_notifier_block);
        speakup_unregister_devsynth();
+        speakup_cancel_paste();
        del_timer(&cursor_timer);
        kthread_stop(speakup_task);
        speakup_task = NULL;
diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
index f0fb00392d6b..ca04d3669acc 100644
--- a/drivers/staging/speakup/selection.c
+++ b/drivers/staging/speakup/selection.c
@@ -4,6 +4,10 @@
 #include <linux/sched.h>
 #include <linux/device.h> /* for dev_warn */
 #include <linux/selection.h>
+#include <linux/workqueue.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <asm/cmpxchg.h>
 #include "speakup.h"
@@ -121,31 +125,61 @@ int speakup_set_selection(struct tty_struct *tty)
        return 0;
 }
-/* TODO: move to some helper thread, probably.  That'd fix having to check for
+struct speakup_paste_work {
- * in_atomic().  */
+        struct work_struct work;
-int speakup_paste_selection(struct tty_struct *tty)
+        struct tty_struct *tty;
+};
+static void __speakup_paste_selection(struct work_struct *work)
 {
+        struct speakup_paste_work *spw =
+                container_of(work, struct speakup_paste_work, work);
+        struct tty_struct *tty = xchg(&spw->tty, NULL);
        struct vc_data *vc = (struct vc_data *) tty->driver_data;
        int pasted = 0, count;
+        struct tty_ldisc *ld;
        DECLARE_WAITQUEUE(wait, current);
+        ld = tty_ldisc_ref_wait(tty);
+        tty_buffer_lock_exclusive(&vc->port);
        add_wait_queue(&vc->paste_wait, &wait);
        while (sel_buffer && sel_buffer_lth > pasted) {
                set_current_state(TASK_INTERRUPTIBLE);
                if (test_bit(TTY_THROTTLED, &tty->flags)) {
-                        if (in_atomic())
-                                /* if we are in an interrupt handler, abort */
-                                break;
                        schedule();
                        continue;
                }
                count = sel_buffer_lth - pasted;
-                count = min_t(int, count, tty->receive_room);
+                count = tty_ldisc_receive_buf(ld, sel_buffer + pasted, NULL,
-                tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
+                                              count);
-                        NULL, count);
                pasted += count;
        }
        remove_wait_queue(&vc->paste_wait, &wait);
        current->state = TASK_RUNNING;
+        tty_buffer_unlock_exclusive(&vc->port);
+        tty_ldisc_deref(ld);
+        tty_kref_put(tty);
+}
+static struct speakup_paste_work speakup_paste_work = {
+        .work = __WORK_INITIALIZER(speakup_paste_work.work,
+                                   __speakup_paste_selection)
+};
+int speakup_paste_selection(struct tty_struct *tty)
+{
+        if (cmpxchg(&speakup_paste_work.tty, NULL, tty) != NULL)
+                return -EBUSY;
+        tty_kref_get(tty);
+        schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work);
        return 0;
 }
+void speakup_cancel_paste(void)
+{
+        cancel_work_sync(&speakup_paste_work.work);
+        tty_kref_put(speakup_paste_work.tty);
+}
diff --git a/drivers/staging/speakup/speakup.h b/drivers/staging/speakup/speakup.h
index a7bcceec436a..898dce5e1243 100644
--- a/drivers/staging/speakup/speakup.h
+++ b/drivers/staging/speakup/speakup.h
@@ -75,6 +75,7 @@ extern void synth_buffer_clear(void);
 extern void speakup_clear_selection(void);
 extern int speakup_set_selection(struct tty_struct *tty);
 extern int speakup_paste_selection(struct tty_struct *tty);
+extern void speakup_cancel_paste(void);
 extern void speakup_register_devsynth(void);
 extern void speakup_unregister_devsynth(void);
 extern void synth_write(const char *buf, size_t count);
diff --git a/drivers/staging/speakup/speakup_acntsa.c b/drivers/staging/speakup/speakup_acntsa.c
index c7f014ed9628..5079dbd5d7ad 100644
--- a/drivers/staging/speakup/speakup_acntsa.c
+++ b/drivers/staging/speakup/speakup_acntsa.c
@@ -60,15 +60,15 @@ static struct kobj_attribute vol_attribute =
        __ATTR(vol, S_IWUGO|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute delay_time_attribute =
-        __ATTR(delay_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(delay_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute direct_attribute =
        __ATTR(direct, S_IWUGO|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute full_time_attribute =
-        __ATTR(full_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(full_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute jiffy_delta_attribute =
-        __ATTR(jiffy_delta, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(jiffy_delta, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute trigger_time_attribute =
-        __ATTR(trigger_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(trigger_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 /*
 * Create a group of attributes so that we can create and destroy them all
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index cf78d1985cd8..143deb62467d 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -60,6 +60,7 @@ void tty_buffer_lock_exclusive(struct tty_port *port)
        atomic_inc(&buf->priority);
        mutex_lock(&buf->lock);
 }
+EXPORT_SYMBOL_GPL(tty_buffer_lock_exclusive);
 void tty_buffer_unlock_exclusive(struct tty_port *port)
 {
@@ -73,6 +74,7 @@ void tty_buffer_unlock_exclusive(struct tty_port *port)
        if (restart)
                queue_work(system_unbound_wq, &buf->work);
 }
+EXPORT_SYMBOL_GPL(tty_buffer_unlock_exclusive);
 /**
 *      tty_buffer_space_avail  -       return unused buffer space
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 888881e5f292..4aeb10034de7 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1822,10 +1822,13 @@ int usb_runtime_suspend(struct device *dev)
        if (status == -EAGAIN || status == -EBUSY)
                usb_mark_last_busy(udev);
-        /* The PM core reacts badly unless the return code is 0,
+        /*
-         * -EAGAIN, or -EBUSY, so always return -EBUSY on an error.
+         * The PM core reacts badly unless the return code is 0,
+         * -EAGAIN, or -EBUSY, so always return -EBUSY on an error
+         * (except for root hubs, because they don't suspend through
+         * an upstream port like other USB devices).
         */
-        if (status != 0)
+        if (status != 0 && udev->parent)
                return -EBUSY;
        return status;
 }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 090469ebfcff..229a73f64304 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1691,8 +1691,19 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
         */
        pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
-        /* Hubs have proper suspend/resume support. */
+        /*
-        usb_enable_autosuspend(hdev);
+         * Hubs have proper suspend/resume support, except for root hubs
+         * where the controller driver doesn't have bus_suspend and
+         * bus_resume methods.
+         */
+        if (hdev->parent) {             /* normal device */
+                usb_enable_autosuspend(hdev);
+        } else {                        /* root hub */
+                const struct hc_driver *drv = bus_to_hcd(hdev->bus)->driver;
+                if (drv->bus_suspend && drv->bus_resume)
+                        usb_enable_autosuspend(hdev);
+        }
        if (hdev->level == MAX_TOPO_LEVEL) {
                dev_err(&intf->dev,
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 00661d305143..4a6d3dd68572 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -847,6 +847,13 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
        bool            ehci_found = false;
        struct pci_dev  *companion = NULL;
+        /* Sony VAIO t-series with subsystem device ID 90a8 is not capable of
+         * switching ports from EHCI to xHCI
+         */
+        if (xhci_pdev->subsystem_vendor == PCI_VENDOR_ID_SONY &&
+            xhci_pdev->subsystem_device == 0x90a8)
+                return;
        /* make sure an intel EHCI controller exists */
        for_each_pci_dev(companion) {
                if (companion->class == PCI_CLASS_SERIAL_USB_EHCI &&
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index c089668308ad..b1a8a5f4bbb8 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1822,6 +1822,16 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
                kfree(cur_cd);
        }
+        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+        for (i = 0; i < num_ports; i++) {
+                struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+                for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+                        struct list_head *ep = &bwt->interval_bw[j].endpoints;
+                        while (!list_empty(ep))
+                                list_del_init(ep->next);
+                }
+        }
        for (i = 1; i < MAX_HC_SLOTS; ++i)
                xhci_free_virt_device(xhci, i);
@@ -1857,16 +1867,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
        if (!xhci->rh_bw)
                goto no_bw;
-        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
-        for (i = 0; i < num_ports; i++) {
-                struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
-                for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
-                        struct list_head *ep = &bwt->interval_bw[j].endpoints;
-                        while (!list_empty(ep))
-                                list_del_init(ep->next);
-                }
-        }
        for (i = 0; i < num_ports; i++) {
                struct xhci_tt_bw_info *tt, *n;
                list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) {
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 7c6e1dedeb06..edf3b124583c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -580,6 +580,8 @@ static const struct usb_device_id id_table_combined[] = {
        { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID),
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        /*
         * ELV devices:
         */
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 993c93df6874..500474c48f4b 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -538,6 +538,11 @@
 */
 #define FTDI_TIAO_UMPA_PID      0x8a98  /* TIAO/DIYGADGET USB Multi-Protocol Adapter */
+/*
+ * NovaTech product ids (FTDI_VID)
+ */
+#define FTDI_NT_ORIONLXM_PID    0x7c90  /* OrionLXm Substation Automation Platform */
 /********************************/
 /** third-party VID/PID combos **/
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index df90dae53eb9..c0a42e9e6777 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -821,7 +821,7 @@ static int build_i2c_fw_hdr(__u8 *header, struct device *dev)
        firmware_rec =  (struct ti_i2c_firmware_rec*)i2c_header->Data;
        i2c_header->Type        = I2C_DESC_TYPE_FIRMWARE_BLANK;
-        i2c_header->Size        = (__u16)buffer_size;
+        i2c_header->Size        = cpu_to_le16(buffer_size);
        i2c_header->CheckSum    = cs;
        firmware_rec->Ver_Major = OperationalMajorVersion;
        firmware_rec->Ver_Minor = OperationalMinorVersion;
diff --git a/drivers/usb/serial/io_usbvend.h b/drivers/usb/serial/io_usbvend.h
index 51f83fbb73bb..6f6a856bc37c 100644
--- a/drivers/usb/serial/io_usbvend.h
+++ b/drivers/usb/serial/io_usbvend.h
@@ -594,7 +594,7 @@ struct edge_boot_descriptor {
 struct ti_i2c_desc {
        __u8    Type;                   // Type of descriptor
-        __u16   Size;                   // Size of data only not including header
+        __le16  Size;                   // Size of data only not including header
        __u8    CheckSum;               // Checksum (8 bit sum of data only)
        __u8    Data[0];                // Data starts here
 } __attribute__((packed));
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f213ee978516..948a19f0cdf7 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -161,6 +161,7 @@ static void option_instat_callback(struct urb *urb);
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
 #define NOVATELWIRELESS_PRODUCT_E362            0x9010
+#define NOVATELWIRELESS_PRODUCT_E371            0x9011
 #define NOVATELWIRELESS_PRODUCT_G2              0xA010
 #define NOVATELWIRELESS_PRODUCT_MC551           0xB001
@@ -1012,6 +1013,7 @@ static const struct usb_device_id option_ids[] = {
        /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) },
        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 1c8c6cc6de30..4b0eff6da674 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -130,6 +130,15 @@ static void afs_cm_destructor(struct afs_call *call)
 {
        _enter("");
+        /* Break the callbacks here so that we do it after the final ACK is
+         * received.  The step number here must match the final number in
+         * afs_deliver_cb_callback().
+         */
+        if (call->unmarshall == 6) {
+                ASSERT(call->server && call->count && call->request);
+                afs_break_callbacks(call->server, call->count, call->request);
+        }
        afs_put_server(call->server);
        call->server = NULL;
        kfree(call->buffer);
@@ -272,6 +281,16 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                _debug("trailer");
                if (skb->len != 0)
                        return -EBADMSG;
+                /* Record that the message was unmarshalled successfully so
+                 * that the call destructor can know do the callback breaking
+                 * work, even if the final ACK isn't received.
+                 *
+                 * If the step number changes, then afs_cm_destructor() must be
+                 * updated also.
+                 */
+                call->unmarshall++;
+        case 6:
                break;
        }
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index be75b500005d..590b55f46d61 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -75,7 +75,7 @@ struct afs_call {
        const struct afs_call_type *type;       /* type of call */
        const struct afs_wait_mode *wait_mode;  /* completion wait mode */
        wait_queue_head_t       waitq;          /* processes awaiting completion */
-        work_func_t             async_workfn;
+        void (*async_workfn)(struct afs_call *call); /* asynchronous work function */
        struct work_struct      async_work;     /* asynchronous work processor */
        struct work_struct      work;           /* actual work processor */
        struct sk_buff_head     rx_queue;       /* received packets */
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index ef943df73b8c..03a3beb17004 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -25,7 +25,7 @@ static void afs_wake_up_call_waiter(struct afs_call *);
 static int afs_wait_for_call_to_complete(struct afs_call *);
 static void afs_wake_up_async_call(struct afs_call *);
 static int afs_dont_wait_for_call_to_complete(struct afs_call *);
-static void afs_process_async_call(struct work_struct *);
+static void afs_process_async_call(struct afs_call *);
 static void afs_rx_interceptor(struct sock *, unsigned long, struct sk_buff *);
 static int afs_deliver_cm_op_id(struct afs_call *, struct sk_buff *, bool);
@@ -58,6 +58,13 @@ static void afs_collect_incoming_call(struct work_struct *);
 static struct sk_buff_head afs_incoming_calls;
 static DECLARE_WORK(afs_collect_incoming_call_work, afs_collect_incoming_call);
+static void afs_async_workfn(struct work_struct *work)
+{
+        struct afs_call *call = container_of(work, struct afs_call, async_work);
+        call->async_workfn(call);
+}
 /*
 * open an RxRPC socket and bind it to be a server for callback notifications
 * - the socket is left in blocking mode and non-blocking ops use MSG_DONTWAIT
@@ -184,6 +191,28 @@ static void afs_free_call(struct afs_call *call)
 }
 /*
+ * End a call but do not free it
+ */
+static void afs_end_call_nofree(struct afs_call *call)
+{
+        if (call->rxcall) {
+                rxrpc_kernel_end_call(call->rxcall);
+                call->rxcall = NULL;
+        }
+        if (call->type->destructor)
+                call->type->destructor(call);
+}
+/*
+ * End a call and free it
+ */
+static void afs_end_call(struct afs_call *call)
+{
+        afs_end_call_nofree(call);
+        afs_free_call(call);
+}
+/*
 * allocate a call with flat request and reply buffers
 */
 struct afs_call *afs_alloc_flat_call(const struct afs_call_type *type,
@@ -326,7 +355,8 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
               atomic_read(&afs_outstanding_calls));
        call->wait_mode = wait_mode;
-        INIT_WORK(&call->async_work, afs_process_async_call);
+        call->async_workfn = afs_process_async_call;
+        INIT_WORK(&call->async_work, afs_async_workfn);
        memset(&srx, 0, sizeof(srx));
        srx.srx_family = AF_RXRPC;
@@ -383,11 +413,8 @@ error_do_abort:
        rxrpc_kernel_abort_call(rxcall, RX_USER_ABORT);
        while ((skb = skb_dequeue(&call->rx_queue)))
                afs_free_skb(skb);
-        rxrpc_kernel_end_call(rxcall);
-        call->rxcall = NULL;
 error_kill_call:
-        call->type->destructor(call);
+        afs_end_call(call);
-        afs_free_call(call);
        _leave(" = %d", ret);
        return ret;
 }
@@ -509,12 +536,8 @@ static void afs_deliver_to_call(struct afs_call *call)
        if (call->state >= AFS_CALL_COMPLETE) {
                while ((skb = skb_dequeue(&call->rx_queue)))
                        afs_free_skb(skb);
-                if (call->incoming) {
+                if (call->incoming)
-                        rxrpc_kernel_end_call(call->rxcall);
+                        afs_end_call(call);
-                        call->rxcall = NULL;
-                        call->type->destructor(call);
-                        afs_free_call(call);
-                }
        }
        _leave("");
@@ -564,10 +587,7 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
        }
        _debug("call complete");
-        rxrpc_kernel_end_call(call->rxcall);
+        afs_end_call(call);
-        call->rxcall = NULL;
-        call->type->destructor(call);
-        afs_free_call(call);
        _leave(" = %d", ret);
        return ret;
 }
@@ -603,11 +623,8 @@ static int afs_dont_wait_for_call_to_complete(struct afs_call *call)
 /*
 * delete an asynchronous call
 */
-static void afs_delete_async_call(struct work_struct *work)
+static void afs_delete_async_call(struct afs_call *call)
 {
-        struct afs_call *call =
-                container_of(work, struct afs_call, async_work);
        _enter("");
        afs_free_call(call);
@@ -620,11 +637,8 @@ static void afs_delete_async_call(struct work_struct *work)
 * - on a multiple-thread workqueue this work item may try to run on several
 *   CPUs at the same time
 */
-static void afs_process_async_call(struct work_struct *work)
+static void afs_process_async_call(struct afs_call *call)
 {
-        struct afs_call *call =
-                container_of(work, struct afs_call, async_work);
        _enter("");
        if (!skb_queue_empty(&call->rx_queue))
@@ -637,10 +651,7 @@ static void afs_process_async_call(struct work_struct *work)
                call->reply = NULL;
                /* kill the call */
-                rxrpc_kernel_end_call(call->rxcall);
+                afs_end_call_nofree(call);
-                call->rxcall = NULL;
-                if (call->type->destructor)
-                        call->type->destructor(call);
                /* we can't just delete the call because the work item may be
                 * queued */
@@ -663,13 +674,6 @@ void afs_transfer_reply(struct afs_call *call, struct sk_buff *skb)
        call->reply_size += len;
 }
-static void afs_async_workfn(struct work_struct *work)
-{
-        struct afs_call *call = container_of(work, struct afs_call, async_work);
-        call->async_workfn(work);
-}
 /*
 * accept the backlog of incoming calls
 */
@@ -790,10 +794,7 @@ void afs_send_empty_reply(struct afs_call *call)
                _debug("oom");
                rxrpc_kernel_abort_call(call->rxcall, RX_USER_ABORT);
        default:
-                rxrpc_kernel_end_call(call->rxcall);
+                afs_end_call(call);
-                call->rxcall = NULL;
-                call->type->destructor(call);
-                afs_free_call(call);
                _leave(" [error]");
                return;
        }
@@ -823,17 +824,16 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
        call->state = AFS_CALL_AWAIT_ACK;
        n = rxrpc_kernel_send_data(call->rxcall, &msg, len);
        if (n >= 0) {
+                /* Success */
                _leave(" [replied]");
                return;
        }
        if (n == -ENOMEM) {
                _debug("oom");
                rxrpc_kernel_abort_call(call->rxcall, RX_USER_ABORT);
        }
-        rxrpc_kernel_end_call(call->rxcall);
+        afs_end_call(call);
-        call->rxcall = NULL;
-        call->type->destructor(call);
-        afs_free_call(call);
        _leave(" [error]");
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 42ae01eefc07..be2bea834bf4 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -441,42 +441,12 @@ void d_drop(struct dentry *dentry)
 }
 EXPORT_SYMBOL(d_drop);
-/*
+static void __dentry_kill(struct dentry *dentry)
- * Finish off a dentry we've decided to kill.
- * dentry->d_lock must be held, returns with it unlocked.
- * If ref is non-zero, then decrement the refcount too.
- * Returns dentry requiring refcount drop, or NULL if we're done.
- */
-static struct dentry *
-dentry_kill(struct dentry *dentry, int unlock_on_failure)
-        __releases(dentry->d_lock)
 {
-        struct inode *inode;
        struct dentry *parent = NULL;
        bool can_free = true;
-        if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) {
-                can_free = dentry->d_flags & DCACHE_MAY_FREE;
-                spin_unlock(&dentry->d_lock);
-                goto out;
-        }
-        inode = dentry->d_inode;
-        if (inode && !spin_trylock(&inode->i_lock)) {
-relock:
-                if (unlock_on_failure) {
-                        spin_unlock(&dentry->d_lock);
-                        cpu_relax();
-                }
-                return dentry; /* try again with same dentry */
-        }
        if (!IS_ROOT(dentry))
                parent = dentry->d_parent;
-        if (parent && !spin_trylock(&parent->d_lock)) {
-                if (inode)
-                        spin_unlock(&inode->i_lock);
-                goto relock;
-        }
        /*
         * The dentry is now unrecoverably dead to the world.
@@ -520,9 +490,72 @@ relock:
                can_free = false;
        }
        spin_unlock(&dentry->d_lock);
-out:
        if (likely(can_free))
                dentry_free(dentry);
+}
+/*
+ * Finish off a dentry we've decided to kill.
+ * dentry->d_lock must be held, returns with it unlocked.
+ * If ref is non-zero, then decrement the refcount too.
+ * Returns dentry requiring refcount drop, or NULL if we're done.
+ */
+static struct dentry *dentry_kill(struct dentry *dentry)
+        __releases(dentry->d_lock)
+{
+        struct inode *inode = dentry->d_inode;
+        struct dentry *parent = NULL;
+        if (inode && unlikely(!spin_trylock(&inode->i_lock)))
+                goto failed;
+        if (!IS_ROOT(dentry)) {
+                parent = dentry->d_parent;
+                if (unlikely(!spin_trylock(&parent->d_lock))) {
+                        if (inode)
+                                spin_unlock(&inode->i_lock);
+                        goto failed;
+                }
+        }
+        __dentry_kill(dentry);
+        return parent;
+failed:
+        spin_unlock(&dentry->d_lock);
+        cpu_relax();
+        return dentry; /* try again with same dentry */
+}
+static inline struct dentry *lock_parent(struct dentry *dentry)
+{
+        struct dentry *parent = dentry->d_parent;
+        if (IS_ROOT(dentry))
+                return NULL;
+        if (likely(spin_trylock(&parent->d_lock)))
+                return parent;
+        spin_unlock(&dentry->d_lock);
+        rcu_read_lock();
+again:
+        parent = ACCESS_ONCE(dentry->d_parent);
+        spin_lock(&parent->d_lock);
+        /*
+         * We can't blindly lock dentry until we are sure
+         * that we won't violate the locking order.
+         * Any changes of dentry->d_parent must have
+         * been done with parent->d_lock held, so
+         * spin_lock() above is enough of a barrier
+         * for checking if it's still our child.
+         */
+        if (unlikely(parent != dentry->d_parent)) {
+                spin_unlock(&parent->d_lock);
+                goto again;
+        }
+        rcu_read_unlock();
+        if (parent != dentry)
+                spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+        else
+                parent = NULL;
        return parent;
 }
@@ -579,7 +612,7 @@ repeat:
        return;
 kill_it:
-        dentry = dentry_kill(dentry, 1);
+        dentry = dentry_kill(dentry);
        if (dentry)
                goto repeat;
 }
@@ -797,8 +830,11 @@ static void shrink_dentry_list(struct list_head *list)
        struct dentry *dentry, *parent;
        while (!list_empty(list)) {
+                struct inode *inode;
                dentry = list_entry(list->prev, struct dentry, d_lru);
                spin_lock(&dentry->d_lock);
+                parent = lock_parent(dentry);
                /*
                 * The dispose list is isolated and dentries are not accounted
                 * to the LRU here, so we can simply remove it from the list
@@ -812,26 +848,33 @@ static void shrink_dentry_list(struct list_head *list)
                 */
                if ((int)dentry->d_lockref.count > 0) {
                        spin_unlock(&dentry->d_lock);
+                        if (parent)
+                                spin_unlock(&parent->d_lock);
                        continue;
                }
-                parent = dentry_kill(dentry, 0);
-                /*
+                if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) {
-                 * If dentry_kill returns NULL, we have nothing more to do.
+                        bool can_free = dentry->d_flags & DCACHE_MAY_FREE;
-                 */
+                        spin_unlock(&dentry->d_lock);
-                if (!parent)
+                        if (parent)
+                                spin_unlock(&parent->d_lock);
+                        if (can_free)
+                                dentry_free(dentry);
                        continue;
+                }
-                if (unlikely(parent == dentry)) {
+                inode = dentry->d_inode;
-                        /*
+                if (inode && unlikely(!spin_trylock(&inode->i_lock))) {
-                         * trylocks have failed and d_lock has been held the
-                         * whole time, so it could not have been added to any
-                         * other lists. Just add it back to the shrink list.
-                         */
                        d_shrink_add(dentry, list);
                        spin_unlock(&dentry->d_lock);
+                        if (parent)
+                                spin_unlock(&parent->d_lock);
                        continue;
                }
+                __dentry_kill(dentry);
                /*
                 * We need to prune ancestors too. This is necessary to prevent
                 * quadratic behavior of shrink_dcache_parent(), but is also
@@ -839,8 +882,26 @@ static void shrink_dentry_list(struct list_head *list)
                 * fragmentation.
                 */
                dentry = parent;
-                while (dentry && !lockref_put_or_lock(&dentry->d_lockref))
+                while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) {
-                        dentry = dentry_kill(dentry, 1);
+                        parent = lock_parent(dentry);
+                        if (dentry->d_lockref.count != 1) {
+                                dentry->d_lockref.count--;
+                                spin_unlock(&dentry->d_lock);
+                                if (parent)
+                                        spin_unlock(&parent->d_lock);
+                                break;
+                        }
+                        inode = dentry->d_inode;        /* can't be NULL */
+                        if (unlikely(!spin_trylock(&inode->i_lock))) {
+                                spin_unlock(&dentry->d_lock);
+                                if (parent)
+                                        spin_unlock(&parent->d_lock);
+                                cpu_relax();
+                                continue;
+                        }
+                        __dentry_kill(dentry);
+                        dentry = parent;
+                }
        }
 }
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index b6f46013dddf..f66c66b9f182 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -590,7 +590,7 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
                add_to_mask(state, &state->groups->aces[i].perms);
        }
-        if (!state->users->n && !state->groups->n) {
+        if (state->users->n || state->groups->n) {
                pace++;
                pace->e_tag = ACL_MASK;
                low_mode_from_nfs4(state->mask.allow, &pace->e_perm, flags);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 32b699bebb9c..9a77a5a21557 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3717,9 +3717,16 @@ out:
 static __be32
 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
 {
-        if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
+        struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
+        if (check_for_locks(stp->st_file, lo))
                return nfserr_locks_held;
-        release_lock_stateid(stp);
+        /*
+         * Currently there's a 1-1 lock stateid<->lockowner
+         * correspondance, and we have to delete the lockowner when we
+         * delete the lock stateid:
+         */
+        unhash_lockowner(lo);
        return nfs_ok;
 }
@@ -4159,6 +4166,10 @@ static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, c
        if (!same_owner_str(&lo->lo_owner, owner, clid))
                return false;
+        if (list_empty(&lo->lo_owner.so_stateids)) {
+                WARN_ON_ONCE(1);
+                return false;
+        }
        lst = list_first_entry(&lo->lo_owner.so_stateids,
                               struct nfs4_ol_stateid, st_perstateowner);
        return lst->st_file->fi_inode == inode;
diff --git a/fs/splice.c b/fs/splice.c
index 9bc07d2b53cf..e246954ea48c 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1537,7 +1537,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *uiov,
        struct iovec iovstack[UIO_FASTIOV];
        struct iovec *iov = iovstack;
        struct iov_iter iter;
-        ssize_t count = 0;
+        ssize_t count;
        pipe = get_pipe_info(file);
        if (!pipe)
@@ -1546,8 +1546,9 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *uiov,
        ret = rw_copy_check_uvector(READ, uiov, nr_segs,
                                    ARRAY_SIZE(iovstack), iovstack, &iov);
        if (ret <= 0)
-                return ret;
+                goto out;
+        count = ret;
        iov_iter_init(&iter, iov, nr_segs, count, 0);
        sd.len = 0;
@@ -1560,6 +1561,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *uiov,
        ret = __splice_from_pipe(pipe, &sd, pipe_to_user);
        pipe_unlock(pipe);
+out:
        if (iov != iovstack)
                kfree(iov);
diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h
index 63b5eff0a80f..fdd7e1b61f60 100644
--- a/include/linux/amba/bus.h
+++ b/include/linux/amba/bus.h
@@ -47,6 +47,7 @@ struct amba_driver {
 enum amba_vendor {
        AMBA_VENDOR_ARM = 0x41,
        AMBA_VENDOR_ST = 0x80,
+        AMBA_VENDOR_QCOM = 0x51,
 };
 extern struct bus_type amba_bustype;
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 8300fb87b84a..72cb0ddb9678 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -429,6 +429,7 @@ typedef bool (*dma_filter_fn)(struct dma_chan *chan, void *filter_param);
 typedef void (*dma_async_tx_callback)(void *dma_async_param);
 struct dmaengine_unmap_data {
+        u8 map_cnt;
        u8 to_cnt;
        u8 from_cnt;
        u8 bidi_cnt;
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index a899dc24be15..a6aa970758a2 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -194,6 +194,7 @@ struct team {
        bool user_carrier_enabled;
        bool queue_override_enabled;
        struct list_head *qom_lists; /* array of queue override mapping lists */
+        bool port_mtu_change_allowed;
        struct {
                unsigned int count;
                unsigned int interval; /* in ms */
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 7a28115dd396..9e572daa15d5 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb)
 }
 enum netlink_skb_flags {
-        NETLINK_SKB_MMAPED      = 0x1,          /* Packet data is mmaped */
+        NETLINK_SKB_MMAPED      = 0x1,  /* Packet data is mmaped */
-        NETLINK_SKB_TX          = 0x2,          /* Packet was sent by userspace */
+        NETLINK_SKB_TX          = 0x2,  /* Packet was sent by userspace */
-        NETLINK_SKB_DELIVERED   = 0x4,          /* Packet was delivered */
+        NETLINK_SKB_DELIVERED   = 0x4,  /* Packet was delivered */
+        NETLINK_SKB_DST         = 0x8,  /* Dst set in sendto or sendmsg */
 };
 struct netlink_skb_parms {
diff --git a/include/linux/omap-dma.h b/include/linux/omap-dma.h
index 41a13e70f41f..7944cdc27bed 100644
--- a/include/linux/omap-dma.h
+++ b/include/linux/omap-dma.h
@@ -10,7 +10,7 @@
 struct dma_chan;
-#if defined(CONFIG_DMA_OMAP) || defined(CONFIG_DMA_OMAP_MODULE)
+#if defined(CONFIG_DMA_OMAP) || (defined(CONFIG_DMA_OMAP_MODULE) && defined(MODULE))
 bool omap_dma_filter_fn(struct dma_chan *, void *);
 #else
 static inline bool omap_dma_filter_fn(struct dma_chan *c, void *d)
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 823ec7bb9c67..01d590ee5e7e 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -171,5 +171,4 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
 {
        WARN_ON_ONCE(atomic_read(&p->refcnt) <= 0);
 }
 #endif /* _NET_INETPEER_H */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index b21ea454bd33..cf6714752b69 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -357,7 +357,7 @@ enum {
 #define AUDIT_ARCH_MIPS64N32    (EM_MIPS|__AUDIT_ARCH_64BIT|\
                                 __AUDIT_ARCH_CONVENTION_MIPS64_N32)
 #define AUDIT_ARCH_MIPSEL64     (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
-#define AUDIT_ARCH_MIPSEL64N32  (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE\
+#define AUDIT_ARCH_MIPSEL64N32  (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE|\
                                 __AUDIT_ARCH_CONVENTION_MIPS64_N32)
 #define AUDIT_ARCH_OPENRISC     (EM_OPENRISC)
 #define AUDIT_ARCH_PARISC       (EM_PARISC)
diff --git a/include/uapi/linux/usb/Kbuild b/include/uapi/linux/usb/Kbuild
index 6cb4ea826834..4cc4d6e7e523 100644
--- a/include/uapi/linux/usb/Kbuild
+++ b/include/uapi/linux/usb/Kbuild
@@ -1,6 +1,7 @@
 # UAPI Header export list
 header-y += audio.h
 header-y += cdc.h
+header-y += cdc-wdm.h
 header-y += ch11.h
 header-y += ch9.h
 header-y += functionfs.h
diff --git a/include/uapi/linux/usb/cdc-wdm.h b/include/uapi/linux/usb/cdc-wdm.h
index f03134feebd6..0dc132e75030 100644
--- a/include/uapi/linux/usb/cdc-wdm.h
+++ b/include/uapi/linux/usb/cdc-wdm.h
@@ -9,6 +9,8 @@
 #ifndef _UAPI__LINUX_USB_CDC_WDM_H
 #define _UAPI__LINUX_USB_CDC_WDM_H
+#include <linux/types.h>
 /*
 * This IOCTL is used to retrieve the wMaxCommand for the device,
 * defining the message limit for both reading and writing.
diff --git a/kernel/cpu.c b/kernel/cpu.c
index a9e710eef0e2..247979a1b815 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -726,10 +726,12 @@ void set_cpu_present(unsigned int cpu, bool present)
 void set_cpu_online(unsigned int cpu, bool online)
 {
-        if (online)
+        if (online) {
                cpumask_set_cpu(cpu, to_cpumask(cpu_online_bits));
-        else
+                cpumask_set_cpu(cpu, to_cpumask(cpu_active_bits));
+        } else {
                cpumask_clear_cpu(cpu, to_cpumask(cpu_online_bits));
+        }
 }
 void set_cpu_active(unsigned int cpu, bool active)
diff --git a/kernel/futex.c b/kernel/futex.c
index 5f589279e462..81dbe773ce4c 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -745,7 +745,8 @@ void exit_pi_state_list(struct task_struct *curr)
 static int
 lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
-                union futex_key *key, struct futex_pi_state **ps)
+                union futex_key *key, struct futex_pi_state **ps,
+                struct task_struct *task)
 {
        struct futex_pi_state *pi_state = NULL;
        struct futex_q *this, *next;
@@ -786,6 +787,16 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
                                        return -EINVAL;
                        }
+                        /*
+                         * Protect against a corrupted uval. If uval
+                         * is 0x80000000 then pid is 0 and the waiter
+                         * bit is set. So the deadlock check in the
+                         * calling code has failed and we did not fall
+                         * into the check above due to !pid.
+                         */
+                        if (task && pi_state->owner == task)
+                                return -EDEADLK;
                        atomic_inc(&pi_state->refcount);
                        *ps = pi_state;
@@ -803,6 +814,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
        if (!p)
                return -ESRCH;
+        if (!p->mm) {
+                put_task_struct(p);
+                return -EPERM;
+        }
        /*
         * We need to look at the task state flags to figure out,
         * whether the task is exiting. To protect against the do_exit
@@ -935,7 +951,7 @@ retry:
         * We dont have the lock. Look up the PI state (or create it if
         * we are the first waiter):
         */
-        ret = lookup_pi_state(uval, hb, key, ps);
+        ret = lookup_pi_state(uval, hb, key, ps, task);
        if (unlikely(ret)) {
                switch (ret) {
@@ -1347,7 +1363,7 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
 *
 * Return:
 *  0 - failed to acquire the lock atomically;
- *  1 - acquired the lock;
+ * >0 - acquired the lock, return value is vpid of the top_waiter
 * <0 - error
 */
 static int futex_proxy_trylock_atomic(u32 __user *pifutex,
@@ -1358,7 +1374,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
 {
        struct futex_q *top_waiter = NULL;
        u32 curval;
-        int ret;
+        int ret, vpid;
        if (get_futex_value_locked(&curval, pifutex))
                return -EFAULT;
@@ -1386,11 +1402,13 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
         * the contended case or if set_waiters is 1.  The pi_state is returned
         * in ps in contended cases.
         */
+        vpid = task_pid_vnr(top_waiter->task);
        ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
                                   set_waiters);
-        if (ret == 1)
+        if (ret == 1) {
                requeue_pi_wake_futex(top_waiter, key2, hb2);
+                return vpid;
+        }
        return ret;
 }
@@ -1421,7 +1439,6 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
        struct futex_pi_state *pi_state = NULL;
        struct futex_hash_bucket *hb1, *hb2;
        struct futex_q *this, *next;
-        u32 curval2;
        if (requeue_pi) {
                /*
@@ -1509,16 +1526,25 @@ retry_private:
                 * At this point the top_waiter has either taken uaddr2 or is
                 * waiting on it.  If the former, then the pi_state will not
                 * exist yet, look it up one more time to ensure we have a
-                 * reference to it.
+                 * reference to it. If the lock was taken, ret contains the
+                 * vpid of the top waiter task.
                 */
-                if (ret == 1) {
+                if (ret > 0) {
                        WARN_ON(pi_state);
                        drop_count++;
                        task_count++;
-                        ret = get_futex_value_locked(&curval2, uaddr2);
+                        /*
-                        if (!ret)
+                         * If we acquired the lock, then the user
-                                ret = lookup_pi_state(curval2, hb2, &key2,
+                         * space value of uaddr2 should be vpid. It
-                                                      &pi_state);
+                         * cannot be changed by the top waiter as it
+                         * is blocked on hb2 lock if it tries to do
+                         * so. If something fiddled with it behind our
+                         * back the pi state lookup might unearth
+                         * it. So we rather use the known value than
+                         * rereading and handing potential crap to
+                         * lookup_pi_state.
+                         */
+                        ret = lookup_pi_state(ret, hb2, &key2, &pi_state, NULL);
                }
                switch (ret) {
diff --git a/kernel/kexec.c b/kernel/kexec.c
index c8380ad203bc..28c57069ef68 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1683,6 +1683,14 @@ int kernel_kexec(void)
                kexec_in_progress = true;
                kernel_restart_prepare(NULL);
                migrate_to_reboot_cpu();
+                /*
+                 * migrate_to_reboot_cpu() disables CPU hotplug assuming that
+                 * no further code needs to use CPU hotplug (which is true in
+                 * the reboot case). However, the kexec path depends on using
+                 * CPU hotplug again; so re-enable it here.
+                 */
+                cpu_hotplug_enable();
                printk(KERN_EMERG "Starting new kernel\n");
                machine_shutdown();
        }
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index aa4dff04b594..a620d4d08ca6 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -343,9 +343,16 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
         * top_waiter can be NULL, when we are in the deboosting
         * mode!
         */
-        if (top_waiter && (!task_has_pi_waiters(task) ||
+        if (top_waiter) {
-                           top_waiter != task_top_pi_waiter(task)))
+                if (!task_has_pi_waiters(task))
-                goto out_unlock_pi;
+                        goto out_unlock_pi;
+                /*
+                 * If deadlock detection is off, we stop here if we
+                 * are not the top pi waiter of the task.
+                 */
+                if (!detect_deadlock && top_waiter != task_top_pi_waiter(task))
+                        goto out_unlock_pi;
+        }
        /*
         * When deadlock detection is off then we check, if further
@@ -361,7 +368,12 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
                goto retry;
        }
-        /* Deadlock detection */
+        /*
+         * Deadlock detection. If the lock is the same as the original
+         * lock which caused us to walk the lock chain or if the
+         * current lock is owned by the task which initiated the chain
+         * walk, we detected a deadlock.
+         */
        if (lock == orig_lock || rt_mutex_owner(lock) == top_task) {
                debug_rt_mutex_deadlock(deadlock_detect, orig_waiter, lock);
                raw_spin_unlock(&lock->wait_lock);
@@ -527,6 +539,18 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
        unsigned long flags;
        int chain_walk = 0, res;
+        /*
+         * Early deadlock detection. We really don't want the task to
+         * enqueue on itself just to untangle the mess later. It's not
+         * only an optimization. We drop the locks, so another waiter
+         * can come in before the chain walk detects the deadlock. So
+         * the other will detect the deadlock and return -EDEADLOCK,
+         * which is wrong, as the other waiter is not in a deadlock
+         * situation.
+         */
+        if (detect_deadlock && owner == task)
+                return -EDEADLK;
        raw_spin_lock_irqsave(&task->pi_lock, flags);
        __rt_mutex_adjust_prio(task);
        waiter->task = task;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 204d3d281809..0a7251678982 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3195,17 +3195,40 @@ __getparam_dl(struct task_struct *p, struct sched_attr *attr)
 * We ask for the deadline not being zero, and greater or equal
 * than the runtime, as well as the period of being zero or
 * greater than deadline. Furthermore, we have to be sure that
- * user parameters are above the internal resolution (1us); we
+ * user parameters are above the internal resolution of 1us (we
- * check sched_runtime only since it is always the smaller one.
+ * check sched_runtime only since it is always the smaller one) and
+ * below 2^63 ns (we have to check both sched_deadline and
+ * sched_period, as the latter can be zero).
 */
 static bool
 __checkparam_dl(const struct sched_attr *attr)
 {
-        return attr && attr->sched_deadline != 0 &&
+        /* deadline != 0 */
-                (attr->sched_period == 0 ||
+        if (attr->sched_deadline == 0)
-                (s64)(attr->sched_period   - attr->sched_deadline) >= 0) &&
+                return false;
-                (s64)(attr->sched_deadline - attr->sched_runtime ) >= 0  &&
-                attr->sched_runtime >= (2 << (DL_SCALE - 1));
+        /*
+         * Since we truncate DL_SCALE bits, make sure we're at least
+         * that big.
+         */
+        if (attr->sched_runtime < (1ULL << DL_SCALE))
+                return false;
+        /*
+         * Since we use the MSB for wrap-around and sign issues, make
+         * sure it's not set (mind that period can be equal to zero).
+         */
+        if (attr->sched_deadline & (1ULL << 63) ||
+            attr->sched_period & (1ULL << 63))
+                return false;
+        /* runtime <= deadline <= period (if period != 0) */
+        if ((attr->sched_period != 0 &&
+             attr->sched_period < attr->sched_deadline) ||
+            attr->sched_deadline < attr->sched_runtime)
+                return false;
+        return true;
 }
 /*
@@ -3658,8 +3681,12 @@ SYSCALL_DEFINE3(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr,
        if (!uattr || pid < 0 || flags)
                return -EINVAL;
-        if (sched_copy_attr(uattr, &attr))
+        retval = sched_copy_attr(uattr, &attr);
-                return -EFAULT;
+        if (retval)
+                return retval;
+        if (attr.sched_policy < 0)
+                return -EINVAL;
        rcu_read_lock();
        retval = -ESRCH;
@@ -3709,7 +3736,7 @@ SYSCALL_DEFINE1(sched_getscheduler, pid_t, pid)
 */
 SYSCALL_DEFINE2(sched_getparam, pid_t, pid, struct sched_param __user *, param)
 {
-        struct sched_param lp;
+        struct sched_param lp = { .sched_priority = 0 };
        struct task_struct *p;
        int retval;
@@ -3726,11 +3753,8 @@ SYSCALL_DEFINE2(sched_getparam, pid_t, pid, struct sched_param __user *, param)
        if (retval)
                goto out_unlock;
-        if (task_has_dl_policy(p)) {
+        if (task_has_rt_policy(p))
-                retval = -EINVAL;
+                lp.sched_priority = p->rt_priority;
-                goto out_unlock;
-        }
-        lp.sched_priority = p->rt_priority;
        rcu_read_unlock();
        /*
@@ -5052,7 +5076,6 @@ static int sched_cpu_active(struct notifier_block *nfb,
                                      unsigned long action, void *hcpu)
 {
        switch (action & ~CPU_TASKS_FROZEN) {
-        case CPU_STARTING:
        case CPU_DOWN_FAILED:
                set_cpu_active((long)hcpu, true);
                return NOTIFY_OK;
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index ab001b5d5048..bd95963dae80 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -13,6 +13,7 @@
 #include <linux/gfp.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include "cpudeadline.h"
 static inline int parent(int i)
@@ -39,8 +40,10 @@ static void cpudl_exchange(struct cpudl *cp, int a, int b)
 {
        int cpu_a = cp->elements[a].cpu, cpu_b = cp->elements[b].cpu;
-        swap(cp->elements[a], cp->elements[b]);
+        swap(cp->elements[a].cpu, cp->elements[b].cpu);
-        swap(cp->cpu_to_idx[cpu_a], cp->cpu_to_idx[cpu_b]);
+        swap(cp->elements[a].dl , cp->elements[b].dl );
+        swap(cp->elements[cpu_a].idx, cp->elements[cpu_b].idx);
 }
 static void cpudl_heapify(struct cpudl *cp, int idx)
@@ -140,7 +143,7 @@ void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid)
        WARN_ON(!cpu_present(cpu));
        raw_spin_lock_irqsave(&cp->lock, flags);
-        old_idx = cp->cpu_to_idx[cpu];
+        old_idx = cp->elements[cpu].idx;
        if (!is_valid) {
                /* remove item */
                if (old_idx == IDX_INVALID) {
@@ -155,8 +158,8 @@ void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid)
                cp->elements[old_idx].dl = cp->elements[cp->size - 1].dl;
                cp->elements[old_idx].cpu = new_cpu;
                cp->size--;
-                cp->cpu_to_idx[new_cpu] = old_idx;
+                cp->elements[new_cpu].idx = old_idx;
-                cp->cpu_to_idx[cpu] = IDX_INVALID;
+                cp->elements[cpu].idx = IDX_INVALID;
                while (old_idx > 0 && dl_time_before(
                                cp->elements[parent(old_idx)].dl,
                                cp->elements[old_idx].dl)) {
@@ -173,7 +176,7 @@ void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid)
                cp->size++;
                cp->elements[cp->size - 1].dl = 0;
                cp->elements[cp->size - 1].cpu = cpu;
-                cp->cpu_to_idx[cpu] = cp->size - 1;
+                cp->elements[cpu].idx = cp->size - 1;
                cpudl_change_key(cp, cp->size - 1, dl);
                cpumask_clear_cpu(cpu, cp->free_cpus);
        } else {
@@ -195,10 +198,21 @@ int cpudl_init(struct cpudl *cp)
        memset(cp, 0, sizeof(*cp));
        raw_spin_lock_init(&cp->lock);
        cp->size = 0;
-        for (i = 0; i < NR_CPUS; i++)
-                cp->cpu_to_idx[i] = IDX_INVALID;
+        cp->elements = kcalloc(nr_cpu_ids,
-        if (!alloc_cpumask_var(&cp->free_cpus, GFP_KERNEL))
+                               sizeof(struct cpudl_item),
+                               GFP_KERNEL);
+        if (!cp->elements)
+                return -ENOMEM;
+        if (!alloc_cpumask_var(&cp->free_cpus, GFP_KERNEL)) {
+                kfree(cp->elements);
                return -ENOMEM;
+        }
+        for_each_possible_cpu(i)
+                cp->elements[i].idx = IDX_INVALID;
        cpumask_setall(cp->free_cpus);
        return 0;
@@ -211,4 +225,5 @@ int cpudl_init(struct cpudl *cp)
 void cpudl_cleanup(struct cpudl *cp)
 {
        free_cpumask_var(cp->free_cpus);
+        kfree(cp->elements);
 }
diff --git a/kernel/sched/cpudeadline.h b/kernel/sched/cpudeadline.h
index a202789a412c..538c9796ad4a 100644
--- a/kernel/sched/cpudeadline.h
+++ b/kernel/sched/cpudeadline.h
@@ -5,17 +5,17 @@
 #define IDX_INVALID     -1
-struct array_item {
+struct cpudl_item {
        u64 dl;
        int cpu;
+        int idx;
 };
 struct cpudl {
        raw_spinlock_t lock;
        int size;
-        int cpu_to_idx[NR_CPUS];
-        struct array_item elements[NR_CPUS];
        cpumask_var_t free_cpus;
+        struct cpudl_item *elements;
 };
diff --git a/kernel/sched/cpupri.c b/kernel/sched/cpupri.c
index 3031bac8aa3e..8834243abee2 100644
--- a/kernel/sched/cpupri.c
+++ b/kernel/sched/cpupri.c
@@ -30,6 +30,7 @@
 #include <linux/gfp.h>
 #include <linux/sched.h>
 #include <linux/sched/rt.h>
+#include <linux/slab.h>
 #include "cpupri.h"
 /* Convert between a 140 based task->prio, and our 102 based cpupri */
@@ -218,8 +219,13 @@ int cpupri_init(struct cpupri *cp)
                        goto cleanup;
        }
+        cp->cpu_to_pri = kcalloc(nr_cpu_ids, sizeof(int), GFP_KERNEL);
+        if (!cp->cpu_to_pri)
+                goto cleanup;
        for_each_possible_cpu(i)
                cp->cpu_to_pri[i] = CPUPRI_INVALID;
        return 0;
 cleanup:
@@ -236,6 +242,7 @@ void cpupri_cleanup(struct cpupri *cp)
 {
        int i;
+        kfree(cp->cpu_to_pri);
        for (i = 0; i < CPUPRI_NR_PRIORITIES; i++)
                free_cpumask_var(cp->pri_to_cpu[i].mask);
 }
diff --git a/kernel/sched/cpupri.h b/kernel/sched/cpupri.h
index f6d756173491..6b033347fdfd 100644
--- a/kernel/sched/cpupri.h
+++ b/kernel/sched/cpupri.h
@@ -17,7 +17,7 @@ struct cpupri_vec {
 struct cpupri {
        struct cpupri_vec pri_to_cpu[CPUPRI_NR_PRIORITIES];
-        int               cpu_to_pri[NR_CPUS];
+        int *cpu_to_pri;
 };
 #ifdef CONFIG_SMP
diff --git a/lib/nlattr.c b/lib/nlattr.c
index fc6754720ced..10ad042d01be 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -201,8 +201,8 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
        }
        if (unlikely(rem > 0))
-                printk(KERN_WARNING "netlink: %d bytes leftover after parsing "
+                pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
-                       "attributes.\n", rem);
+                                    rem, current->comm);
        err = 0;
 errout:
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 8c7ca811de6e..96b66fd30f96 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -415,7 +415,7 @@ batadv_mcast_forw_ipv4_node_get(struct batadv_priv *bat_priv)
        hlist_for_each_entry_rcu(tmp_orig_node,
                                 &bat_priv->mcast.want_all_ipv4_list,
                                 mcast_want_all_ipv4_node) {
-                if (!atomic_inc_not_zero(&orig_node->refcount))
+                if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                        continue;
                orig_node = tmp_orig_node;
@@ -442,7 +442,7 @@ batadv_mcast_forw_ipv6_node_get(struct batadv_priv *bat_priv)
        hlist_for_each_entry_rcu(tmp_orig_node,
                                 &bat_priv->mcast.want_all_ipv6_list,
                                 mcast_want_all_ipv6_node) {
-                if (!atomic_inc_not_zero(&orig_node->refcount))
+                if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                        continue;
                orig_node = tmp_orig_node;
@@ -493,7 +493,7 @@ batadv_mcast_forw_unsnoop_node_get(struct batadv_priv *bat_priv)
        hlist_for_each_entry_rcu(tmp_orig_node,
                                 &bat_priv->mcast.want_all_unsnoopables_list,
                                 mcast_want_all_unsnoopables_node) {
-                if (!atomic_inc_not_zero(&orig_node->refcount))
+                if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                        continue;
                orig_node = tmp_orig_node;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 2c45c069ea1a..b524c36c1273 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -538,6 +538,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
 {
        struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
        struct net_bridge_fdb_entry *fdb;
+        bool fdb_modified = false;
        /* some users want to always flood. */
        if (hold_time(br) == 0)
@@ -558,10 +559,15 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                                        source->dev->name);
                } else {
                        /* fastpath: update of existing entry */
-                        fdb->dst = source;
+                        if (unlikely(source != fdb->dst)) {
+                                fdb->dst = source;
+                                fdb_modified = true;
+                        }
                        fdb->updated = jiffies;
                        if (unlikely(added_by_user))
                                fdb->added_by_user = 1;
+                        if (unlikely(fdb_modified))
+                                fdb_notify(br, fdb, RTM_NEWNEIGH);
                }
        } else {
                spin_lock(&br->hash_lock);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 7985deaff52f..04d6348fd530 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -147,8 +147,8 @@ static int br_handle_local_finish(struct sk_buff *skb)
        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
        u16 vid = 0;
-        br_vlan_get_tag(skb, &vid);
+        /* check if vlan is allowed, to avoid spoofing */
-        if (p->flags & BR_LEARNING)
+        if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid))
                br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
        return 0;        /* process further */
 }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 53d6e32965fc..bc17210d4c52 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -589,6 +589,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
                        struct sk_buff *skb, u16 *vid);
 bool br_allowed_egress(struct net_bridge *br, const struct net_port_vlans *v,
                       const struct sk_buff *skb);
+bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid);
 struct sk_buff *br_handle_vlan(struct net_bridge *br,
                               const struct net_port_vlans *v,
                               struct sk_buff *skb);
@@ -660,6 +661,12 @@ static inline bool br_allowed_egress(struct net_bridge *br,
        return true;
 }
+static inline bool br_should_learn(struct net_bridge_port *p,
+                                   struct sk_buff *skb, u16 *vid)
+{
+        return true;
+}
 static inline struct sk_buff *br_handle_vlan(struct net_bridge *br,
                                             const struct net_port_vlans *v,
                                             struct sk_buff *skb)
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 24c5cc55589f..fcc95390f862 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -241,6 +241,34 @@ bool br_allowed_egress(struct net_bridge *br,
        return false;
 }
+/* Called under RCU */
+bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
+{
+        struct net_bridge *br = p->br;
+        struct net_port_vlans *v;
+        if (!br->vlan_enabled)
+                return true;
+        v = rcu_dereference(p->vlan_info);
+        if (!v)
+                return false;
+        br_vlan_get_tag(skb, vid);
+        if (!*vid) {
+                *vid = br_get_pvid(v);
+                if (*vid == VLAN_N_VID)
+                        return false;
+                return true;
+        }
+        if (test_bit(*vid, v->vlan_bitmap))
+                return true;
+        return false;
+}
 /* Must be protected by RTNL.
 * Must be called with vid in range from 1 to 4094 inclusive.
 */
diff --git a/net/core/dev.c b/net/core/dev.c
index 1ba2cfe3f8e8..5367bfba0947 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2289,8 +2289,8 @@ EXPORT_SYMBOL(skb_checksum_help);
 __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
 {
+        unsigned int vlan_depth = skb->mac_len;
        __be16 type = skb->protocol;
-        int vlan_depth = skb->mac_len;
        /* Tunnel gso handlers can set protocol to ethernet. */
        if (type == htons(ETH_P_TEB)) {
@@ -2303,15 +2303,30 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
                type = eth->h_proto;
        }
-        while (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
+        /* if skb->protocol is 802.1Q/AD then the header should already be
-                struct vlan_hdr *vh;
+         * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
+         * ETH_HLEN otherwise
-                if (unlikely(!pskb_may_pull(skb, vlan_depth + VLAN_HLEN)))
+         */
-                        return 0;
+        if (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
+                if (vlan_depth) {
-                vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+                        if (unlikely(WARN_ON(vlan_depth < VLAN_HLEN)))
-                type = vh->h_vlan_encapsulated_proto;
+                                return 0;
-                vlan_depth += VLAN_HLEN;
+                        vlan_depth -= VLAN_HLEN;
+                } else {
+                        vlan_depth = ETH_HLEN;
+                }
+                do {
+                        struct vlan_hdr *vh;
+                        if (unlikely(!pskb_may_pull(skb,
+                                                    vlan_depth + VLAN_HLEN)))
+                                return 0;
+                        vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+                        type = vh->h_vlan_encapsulated_proto;
+                        vlan_depth += VLAN_HLEN;
+                } while (type == htons(ETH_P_8021Q) ||
+                         type == htons(ETH_P_8021AD));
        }
        *depth = vlan_depth;
diff --git a/net/core/filter.c b/net/core/filter.c
index 842f8393121d..9de0c25323b4 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1492,8 +1492,13 @@ static struct sk_filter *__sk_prepare_filter(struct sk_filter *fp,
        fp->jited = 0;
        err = sk_chk_filter(fp->insns, fp->len);
-        if (err)
+        if (err) {
+                if (sk != NULL)
+                        sk_filter_uncharge(sk, fp);
+                else
+                        kfree(fp);
                return ERR_PTR(err);
+        }
        /* Probe if we can JIT compile the filter and if so, do
         * the compilation of the filter.
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f31268dbc0d1..741b22c62acf 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2045,11 +2045,15 @@ replay:
                if (ops->newlink) {
                        err = ops->newlink(net, dev, tb, data);
                        /* Drivers should call free_netdev() in ->destructor
-                         * and unregister it on failure so that device could be
+                         * and unregister it on failure after registration
-                         * finally freed in rtnl_unlock.
+                         * so that device could be finally freed in rtnl_unlock.
                         */
-                        if (err < 0)
+                        if (err < 0) {
+                                /* If device is not registered at all, free it now */
+                                if (dev->reg_state == NETREG_UNINITIALIZED)
+                                        free_netdev(dev);
                                goto out;
+                        }
                } else {
                        err = register_netdevice(dev);
                        if (err < 0) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 350b2072f0ab..931529d5daa2 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2684,13 +2684,12 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
        bool recovered = !before(tp->snd_una, tp->high_seq);
        if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
-                if (flag & FLAG_ORIG_SACK_ACKED) {
+                /* Step 3.b. A timeout is spurious if not all data are
-                        /* Step 3.b. A timeout is spurious if not all data are
+                 * lost, i.e., never-retransmitted data are (s)acked.
-                         * lost, i.e., never-retransmitted data are (s)acked.
+                 */
-                         */
+                if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED))
-                        tcp_try_undo_loss(sk, true);
                        return;
-                }
                if (after(tp->snd_nxt, tp->high_seq) &&
                    (flag & FLAG_DATA_SACKED || is_dupack)) {
                        tp->frto = 0; /* Loss was real: 2nd part of step 3.a */
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 6179ac186ab9..ffa029305a09 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -8,7 +8,6 @@
 #include <net/addrconf.h>
 #include <net/secure_seq.h>
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
        u16 offset = sizeof(struct ipv6hdr);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d9da8c448c76..e6836755c45d 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1392,15 +1392,19 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
        if (ipip) {
                __be32 info = ic->un.gateway;
+                __u8 type = ic->type;
+                __u8 code = ic->code;
                /* Update the MTU */
                if (ic->type == ICMP_DEST_UNREACH &&
                    ic->code == ICMP_FRAG_NEEDED) {
                        struct ip_vs_dest *dest = cp->dest;
                        u32 mtu = ntohs(ic->un.frag.mtu);
+                        __be16 frag_off = cih->frag_off;
                        /* Strip outer IP and ICMP, go to IPIP header */
-                        __skb_pull(skb, ihl + sizeof(_icmph));
+                        if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL)
+                                goto ignore_ipip;
                        offset2 -= ihl + sizeof(_icmph);
                        skb_reset_network_header(skb);
                        IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
@@ -1408,7 +1412,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
                        ipv4_update_pmtu(skb, dev_net(skb->dev),
                                         mtu, 0, 0, 0, 0);
                        /* Client uses PMTUD? */
-                        if (!(cih->frag_off & htons(IP_DF)))
+                        if (!(frag_off & htons(IP_DF)))
                                goto ignore_ipip;
                        /* Prefer the resulting PMTU */
                        if (dest) {
@@ -1427,12 +1431,13 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
                /* Strip outer IP, ICMP and IPIP, go to IP header of
                 * original request.
                 */
-                __skb_pull(skb, offset2);
+                if (pskb_pull(skb, offset2) == NULL)
+                        goto ignore_ipip;
                skb_reset_network_header(skb);
                IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
                        &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
-                        ic->type, ic->code, ntohl(info));
+                        type, code, ntohl(info));
-                icmp_send(skb, ic->type, ic->code, info);
+                icmp_send(skb, type, code, info);
                /* ICMP can be shorter but anyways, account it */
                ip_vs_out_stats(cp, skb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e0ccd84d4d67..15c731f03fa6 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1377,7 +1377,9 @@ retry:
 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
                        struct user_namespace *user_ns, int cap)
 {
-        return sk_ns_capable(nsp->sk, user_ns, cap);
+        return ((nsp->flags & NETLINK_SKB_DST) ||
+                file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
+                ns_capable(user_ns, cap);
 }
 EXPORT_SYMBOL(__netlink_ns_capable);
@@ -2323,6 +2325,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
        struct sk_buff *skb;
        int err;
        struct scm_cookie scm;
+        u32 netlink_skb_flags = 0;
        if (msg->msg_flags&MSG_OOB)
                return -EOPNOTSUPP;
@@ -2344,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
                if ((dst_group || dst_portid) &&
                    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                        goto out;
+                netlink_skb_flags |= NETLINK_SKB_DST;
        } else {
                dst_portid = nlk->dst_portid;
                dst_group = nlk->dst_group;
@@ -2373,6 +2377,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
        NETLINK_CB(skb).portid  = nlk->portid;
        NETLINK_CB(skb).dst_group = dst_group;
        NETLINK_CB(skb).creds   = siocb->scm->creds;
+        NETLINK_CB(skb).flags   = netlink_skb_flags;
        err = -EFAULT;
        if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index fd9a16a6d1de..412d9dc3a873 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -947,6 +947,20 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
        return skb;
 }
+/* A wrapper for nlmsg_multicast() checking that nlsk is still available.
+ * Must be called with RCU read lock.
+ */
+static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
+                                       u32 pid, unsigned int group)
+{
+        struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
+        if (nlsk)
+                return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
+        else
+                return -1;
+}
 static inline size_t xfrm_spdinfo_msgsize(void)
 {
        return NLMSG_ALIGN(4)
@@ -2228,7 +2242,7 @@ static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
        if (build_migrate(skb, m, num_migrate, k, sel, dir, type) < 0)
                BUG();
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MIGRATE, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
 }
 #else
 static int xfrm_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
@@ -2419,7 +2433,7 @@ static int xfrm_exp_state_notify(struct xfrm_state *x, const struct km_event *c)
                return -EMSGSIZE;
        }
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
 }
 static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event *c)
@@ -2434,7 +2448,7 @@ static int xfrm_aevent_state_notify(struct xfrm_state *x, const struct km_event
        if (build_aevent(skb, x, c) < 0)
                BUG();
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_AEVENTS, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_AEVENTS);
 }
 static int xfrm_notify_sa_flush(const struct km_event *c)
@@ -2460,7 +2474,7 @@ static int xfrm_notify_sa_flush(const struct km_event *c)
        nlmsg_end(skb, nlh);
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
 }
 static inline size_t xfrm_sa_len(struct xfrm_state *x)
@@ -2547,7 +2561,7 @@ static int xfrm_notify_sa(struct xfrm_state *x, const struct km_event *c)
        nlmsg_end(skb, nlh);
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_SA);
 out_free_skb:
        kfree_skb(skb);
@@ -2638,7 +2652,7 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
        if (build_acquire(skb, x, xt, xp) < 0)
                BUG();
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
 }
 /* User gives us xfrm_user_policy_info followed by an array of 0
@@ -2752,7 +2766,7 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct
        if (build_polexpire(skb, xp, dir, c) < 0)
                BUG();
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
 }
 static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_event *c)
@@ -2814,7 +2828,7 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_e
        nlmsg_end(skb, nlh);
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
 out_free_skb:
        kfree_skb(skb);
@@ -2842,7 +2856,7 @@ static int xfrm_notify_policy_flush(const struct km_event *c)
        nlmsg_end(skb, nlh);
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY);
 out_free_skb:
        kfree_skb(skb);
@@ -2911,7 +2925,7 @@ static int xfrm_send_report(struct net *net, u8 proto,
        if (build_report(skb, proto, sel, addr) < 0)
                BUG();
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_REPORT);
 }
 static inline size_t xfrm_mapping_msgsize(void)
@@ -2963,7 +2977,7 @@ static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
        if (build_mapping(skb, x, ipaddr, sport) < 0)
                BUG();
-        return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
+        return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MAPPING);
 }
 static bool xfrm_is_alive(const struct km_event *c)
diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c
index 94d08733cb38..76cbb9ec953a 100644
--- a/sound/core/pcm_dmaengine.c
+++ b/sound/core/pcm_dmaengine.c
@@ -182,6 +182,7 @@ static int dmaengine_pcm_prepare_and_submit(struct snd_pcm_substream *substream)
 int snd_dmaengine_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 {
        struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
        int ret;
        switch (cmd) {
@@ -196,6 +197,11 @@ int snd_dmaengine_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
                dmaengine_resume(prtd->dma_chan);
                break;
        case SNDRV_PCM_TRIGGER_SUSPEND:
+                if (runtime->info & SNDRV_PCM_INFO_PAUSE)
+                        dmaengine_pause(prtd->dma_chan);
+                else
+                        dmaengine_terminate_all(prtd->dma_chan);
+                break;
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                dmaengine_pause(prtd->dma_chan);
                break;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 2c54629d62d1..6cc3cf285558 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1743,6 +1743,9 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
        /* Lynx Point */
        { PCI_DEVICE(0x8086, 0x8c20),
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+        /* 9 Series */
+        { PCI_DEVICE(0x8086, 0x8ca0),
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
        /* Wellsburg */
        { PCI_DEVICE(0x8086, 0x8d20),
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },